[freeqaz]

Problem

#2351 refuses a model baseUrl that writes one or no slash after its http: or https: scheme (https:/v1, https:v1, http:/host, HTTPS:/host, https:${HOST}, https:{{ vars.host }}). The refusal names the field but says only Configuration field <field> must be an absolute http or https URL. A value such as https:/models.example.test/v1 reads as absolute to a person, so the message does not say what to fix. The breaking-changes notice says to write // after the scheme; the save response does not.

Change

• packages/occ/src/errors.ts: a new baseUrlSlashes message for ModelProviderSettingError: Configuration field <field> must start with https:// or http:// (the // after the scheme is missing). It keeps the field path and never echoes the value.
• packages/occ/src/model-provider-settings.ts: when a baseUrl is refused and its text up to the first Preset variable starts with an http(s) scheme (any case, after leading spaces or controls, ignoring tabs and newlines as the URL parser does) followed by anything other than two slashes or backslashes, the refusal uses the new message. Every other refusal keeps its text, including an empty host (https:///v1), another scheme (ftp://...), a non-URL, a ${VAR:-https:/v1} fallback (the value does not start with the scheme), and a value that is not a string, such as ["https:/v1"].
• The console shows the API's message as is (serverMessage), so it needs no copy change.
• docs/guides/deploy/breaking-changes.md: the 2026-10-13 "How to tell" lists the new message (2467 words by the docs counter).

Verification

• tests/integration/configuration-controller.test.mjs: "Preset and Configuration saves refuse a baseUrl or api that a variable fills with no host or no string" now pins the new message for https:/models.example.test/v1, https:v1, http:/models.example.test, \tHTTPS:/models.example.test, https:\models.example.test, https:${MODEL_HOST}/v1, a model's http:/${MODEL_HOST}, Preset https:{{ vars.h }} and HTTPS:/{{ vars.h }}/v1, and a launch filled with https:/v1. https:///v1, HTTP:\\\v1, http:////... the ${MODEL_URL:-https:/...} fallback and an array ["https:/v1"] still get the general message.
• The test fails on main (first new case: actual is the general message) and passes with the fix.
• The two baseUrl tests 20/20 pinned to 2 CPUs (taskset -c 0,1); the full file 97/97 at 2 CPUs.
• tsc --build, eslint --max-warnings 0 and prettier --check on the touched files: clean.

Risks

Low. Message text only; which values are refused does not change. Clients that matched the old text exactly for these shapes see the new sentence.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here.

Automatic review is on hold, including after source changes. Request a fresh re-review after resolving the failure; maintainers can also release the hold through an intentional scanner-policy update.

Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it.

View the workflow run.