fix(ai): test the on-screen Ollama address, not only the saved one

The model dropdown probes the address typed into the Settings form, so it
populated for a hosted Ollama. "Test connection" beside it took no body and
read the org's saved address instead — so a host entered but not yet saved
was tested against the default (localhost) and reported as unreachable,
while the dropdown right above it listed that same host's models.

Let the test carry the on-screen host/model/thinking and check those,
falling back to the stored value per field when absent. The credential is
deliberately not overridable here — it comes from storage, so a test can't
be turned into a way to send a saved secret to a just-typed address. The
address is validated in the handler, so a bad one is a clear 400 rather
than a silent probe of the default.

Signed-off-by: Arun Rajkumar <mickyarunr@gmail.com>

Author: mickyarun

backend/app/api/v1/settings_claude.py

@@ -253,14 +253,46 @@ async def update_claude_settings(
     return _read_model(org)
 
 
+class ClaudeConnectionTest(BaseModel):
+    """On-screen host settings to test, so "Test connection" checks what the
+    user is looking at rather than only what was last saved.
+
+    All optional: an omitted field falls back to the stored value, and an empty
+    body reproduces the original "test what's saved" behaviour. Carries no
+    credential — the token comes from storage, so a test can't be used to send a
+    secret to a just-typed address.
+    """
+
+    base_url: str | None = Field(None, description="Server address, for HTTP-based providers.")
+    model: str | None = None
+    thinking: bool | None = None
+
+
 @router.post("/claude/test")
 async def test_claude_settings(
+    body: ClaudeConnectionTest | None = None,
     current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ) -> dict[str, Any]:
-    """Run the org's provider version check + a trivial prompt against its auth."""
+    """Run the org's provider version check + a trivial prompt against its auth.
+
+    Tests the on-screen host settings when the client sends them, so the Test
+    button checks the same address the model dropdown just probed instead of the
+    last-saved one — a host entered but not yet saved was otherwise tested
+    against localhost and reported broken.
+    """
     # Ensure the most recent stored credential (if any) is in process env
     # first, in case the backend was restarted since the last PATCH.
     org = await OrganizationRepository(db).get_for_user(current_user)
     apply_claude_auth_to_env(org)
-    return await check_provider_connection(org)
+    if body is None:
+        return await check_provider_connection(org)
+    # Validate the address here so a bad one is a clear 400, not a silent probe
+    # of the default. _clean_base_url returns None for an empty string, which the
+    # connection check reads as "use the stored value".
+    return await check_provider_connection(
+        org,
+        base_url=_clean_base_url(body.base_url) if body.base_url is not None else None,
+        model=body.model,
+        thinking=body.thinking,
+    )

backend/app/services/ai_runner/connection_check.py

@@ -26,7 +26,7 @@
 
 from app.models.organization import AIProvider, Organization
 from app.services.ai_runner.capabilities import capabilities_for
-from app.services.ai_runner.capability_gate import adapt_config
+from app.services.ai_runner.capability_gate import adapt_config, org_api_key, provider_env
 from app.services.ai_runner.registry import provider_instance
 from app.services.ai_runner.subprocess_env import build_provider_env
 from app.services.claude_runner import NO_REPO_CONTEXT, ClaudeRunnerConfig
@@ -124,16 +124,45 @@ async def check_connection(
     return result
 
 
-async def check_provider_connection(org: Organization) -> dict[str, Any]:
+async def check_provider_connection(
+    org: Organization,
+    *,
+    base_url: str | None = None,
+    model: str | None = None,
+    thinking: bool | None = None,
+) -> dict[str, Any]:
     """Verify the org's provider is reachable and can authenticate.
 
     The org's own host/model/thinking settings are resolved through the same
     seam a real run uses, so "Test connection" checks the configuration the org
     will actually run with. Without that, a provider pointed at a remote host
     would silently be probed on localhost — reporting a confident green for a
     host nobody tested, or an install hint for a config that was fine.
+
+    The keyword overrides let the Settings page test what the user is *looking
+    at* rather than only what was last saved. The model dropdown already probes
+    the typed address to populate itself; the Test button beside it read the
+    saved value instead, so a host entered but not yet saved was tested against
+    localhost and reported broken. Each override is applied only when supplied,
+    falling back to the stored value — so an unrelated caller keeps today's
+    behaviour. The credential is never overridden here: it comes from storage,
+    because a test must not be a way to have the backend send a secret to an
+    address the caller just typed.
     """
     provider = org.ai_provider or AIProvider.claude
     caps = capabilities_for(provider)
+
+    overriding = base_url is not None or model is not None or thinking is not None
+    if overriding and caps.requires_base_url:
+        env = provider_env(
+            caps,
+            base_url=base_url if base_url is not None else org.ai_base_url,
+            model=model if model is not None else org.ai_model,
+            thinking=thinking if thinking is not None else bool(org.ai_thinking),
+            api_key=org_api_key(caps, org),
+        )
+        timeout = int(_DEFAULT_PING_TIMEOUT_S * caps.timeout_multiplier)
+        return await check_connection(provider, env, timeout)
+
     probe = adapt_config(caps, org, ClaudeRunnerConfig(timeout_seconds=_DEFAULT_PING_TIMEOUT_S))
     return await check_connection(provider, probe.env_extra, probe.timeout_seconds)

backend/tests/services/test_connection_check_overrides.py

@@ -0,0 +1,94 @@
+# Copyright 2025-2026 Arun Rajkumar
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+""" "Test connection" must test what the user is looking at.
+
+A hosted Ollama entered in the Settings form populates the model dropdown —
+because that probe reads the typed address — but "Test connection" read the
+saved address instead, so a host typed and not yet saved was tested against
+localhost and reported broken. These pin that the connection test honours the
+on-screen overrides, and still falls back to the stored value without them.
+"""
+
+import uuid
+from types import SimpleNamespace
+from typing import Any
+
+from app.models.organization import AIProvider
+from app.services.ai_runner import connection_check
+from app.services.ai_runner.ollama_models import OLLAMA_HOST_ENV
+
+
+def _ollama_org(base_url: str | None) -> Any:
+    """An Ollama org with no stored credential (no-auth / host mode)."""
+    return SimpleNamespace(
+        id=uuid.uuid4(),
+        ai_provider=AIProvider.ollama,
+        ai_base_url=base_url,
+        ai_model="qwen3",
+        ai_thinking=False,
+        claude_api_key_encrypted=None,
+        claude_auth_mode="host",
+    )
+
+
+def _capture_env(monkeypatch: Any) -> dict[str, Any]:
+    seen: dict[str, Any] = {}
+
+    async def _fake_check(provider: Any, env_extra: Any, timeout: Any) -> dict[str, Any]:
+        seen["provider"] = provider
+        seen["env"] = env_extra or {}
+        return {"test_passed": True}
+
+    monkeypatch.setattr(connection_check, "check_connection", _fake_check)
+    return seen
+
+
+async def test_a_typed_address_is_tested_not_the_empty_saved_one(monkeypatch: Any) -> None:
+    """The field's exact failure: nothing saved yet, so the old path probed
+    localhost while the dropdown had already listed the typed host's models."""
+    seen = _capture_env(monkeypatch)
+
+    await connection_check.check_provider_connection(
+        _ollama_org(base_url=None),
+        base_url="https://gw.example.com/ollama",
+        model="qwen3",
+        thinking=False,
+    )
+
+    assert seen["env"][OLLAMA_HOST_ENV] == "https://gw.example.com/ollama"
+
+
+async def test_no_overrides_still_tests_the_saved_address(monkeypatch: Any) -> None:
+    """An empty body must reproduce the original behaviour — other callers, and
+    the auto-test right after a save, rely on it."""
+    seen = _capture_env(monkeypatch)
+
+    await connection_check.check_provider_connection(
+        _ollama_org("https://saved.example.com/ollama")
+    )
+
+    assert seen["env"][OLLAMA_HOST_ENV] == "https://saved.example.com/ollama"
+
+
+async def test_a_partial_override_falls_back_to_the_saved_address(monkeypatch: Any) -> None:
+    """Overriding only the model must not blank the host — each field falls back
+    independently, so a thinking-toggle test still hits the saved server."""
+    seen = _capture_env(monkeypatch)
+
+    await connection_check.check_provider_connection(
+        _ollama_org("https://saved.example.com/ollama"), thinking=True
+    )
+
+    assert seen["env"][OLLAMA_HOST_ENV] == "https://saved.example.com/ollama"

frontend/src/views/settings/SettingsClaudeCode.vue

@@ -543,7 +543,18 @@ async function checkConnection(): Promise<void> {
   claudeVersion.value = ''
   showInstallHint.value = false
   try {
-    const { data } = await api.post('/v1/settings/claude/test', null, { timeout: 120_000 })
+    // Send the on-screen host settings so the test checks the same address the
+    // model dropdown just probed, not the last-saved one — otherwise a host
+    // typed but not yet saved tests against the default (localhost) and reports
+    // a working server as broken. Non-host providers ignore these fields.
+    const body = currentCaps.value?.requires_base_url
+      ? {
+          base_url: baseUrl.value.trim() || undefined,
+          model: model.value || undefined,
+          thinking: thinking.value,
+        }
+      : null
+    const { data } = await api.post('/v1/settings/claude/test', body, { timeout: 120_000 })
     applyTestResult(data)
   } catch (err) {
     claudeStatus.value = 'failed'