v1.2.0:7 — add SparkControl AI provider + fix base-URL footgun

SparkControl is a self-hosted local-inference gateway with an OpenAI-compatible API, reached over the internal same-box StartOS address (http://spark-control.startos:9999/v1, plain HTTP). It takes no API key, so generateOpenAIStyle gained a { requireApiKey } option and now omits the Authorization header when no key is set. The Settings form auto-detects the loaded vLLM model via SparkControl's /api/endpoints probe, mirroring the Ollama auto-detect; it's $0 in the cost UI. Custom-URL => admin-only + SSRF-guarded, same as Ollama.

Also fixes a config footgun behind the empty-response report: a custom base URL could ride along to a fixed-URL provider (claude/openai/gemini) whose form field is hidden, get stored, and be silently ignored (the provider always hits its hardcoded endpoint). Both config write paths now null baseUrl for non-custom-URL providers, and the form clears it on provider change.

No schema/data change (AIConfigProfile.provider is free-text). 259 tests pass; built + sideloaded to immense-voyage.local with a clean non-root launch.

start9/0.4/startos/versions/index.ts

@@ -21,6 +21,7 @@ import { v_1_2_0_3 } from './v1.2.0.3'
 import { v_1_2_0_4 } from './v1.2.0.4'
 import { v_1_2_0_5 } from './v1.2.0.5'
 import { v_1_2_0_6 } from './v1.2.0.6'
+import { v_1_2_0_7 } from './v1.2.0.7'
 
 /**
  * Version graph for the `proof-of-work` package.
@@ -86,9 +87,13 @@ import { v_1_2_0_6 } from './v1.2.0.6'
  *            inline-edit + refine-with-AI, then pre-fill the workout log.
  *            Reuses the generation spine via a new AIGeneration.kind
  *            discriminant (boot ALTER, default "program"). No data changes.
+ * v1.2.0:7 — SparkControl AI provider (6th provider): keyless, same-box
+ *            internal address, model auto-detected via /api/endpoints. Plus a
+ *            base-URL footgun fix (a custom URL could attach to a fixed-URL
+ *            provider and be silently ignored). No schema/data change.
  */
 export const versionGraph = VersionGraph.of({
-  current: v_1_2_0_6,
+  current: v_1_2_0_7,
   other: [
     v_1_0_0_1,
     v_1_0_0_2,
@@ -111,5 +116,6 @@ export const versionGraph = VersionGraph.of({
     v_1_2_0_3,
     v_1_2_0_4,
     v_1_2_0_5,
+    v_1_2_0_6,
   ],
 })

start9/0.4/startos/versions/v1.2.0.7.ts

@@ -0,0 +1,33 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+/**
+ * v1.2.0:7 — SparkControl AI provider + base-URL footgun fix (2026-06-19).
+ *
+ * Adds a 6th AI provider, "SparkControl (local)" — the operator's own
+ * self-hosted local-inference gateway. Its LLM surface is OpenAI-compatible,
+ * so it reuses the OpenAI-style streamer, with two twists: no API key (keyless
+ * on the LAN) and reached over the internal same-box StartOS address
+ * (http://spark-control.startos:9999/v1, plain HTTP — no TLS games). The
+ * Settings UI auto-detects the loaded vLLM model via SparkControl's
+ * /api/endpoints discovery, mirroring the Ollama auto-detect.
+ *
+ * Also fixes a config footgun: a base URL could ride along to a fixed-URL
+ * provider (Claude/OpenAI/Gemini) whose form field is hidden — stored but
+ * silently ignored by the provider, which always hits its hardcoded endpoint.
+ * Both config write paths now drop a base URL for non-custom-URL providers,
+ * and the form clears it on provider change.
+ *
+ * No schema or data change: `AIConfigProfile.provider` is a free-text column,
+ * so the new value needs no migration. Existing configs are untouched.
+ */
+export const v_1_2_0_7 = VersionInfo.of({
+  version: '1.2.0:7',
+  releaseNotes: {
+    en_US:
+      'New AI provider: SparkControl — your self-hosted local-inference gateway. Reached over the same-box address with no API key; the model is auto-detected. Also fixes a bug where a custom base URL could attach to a fixed-URL provider (Claude/OpenAI/Gemini) and be silently ignored. No data changes.',
+  },
+  migrations: {
+    up: async () => {},
+    down: IMPOSSIBLE,
+  },
+})