fix(app): never resolve a provider from a list that failed to load

The previous guard only covered a job that named a provider, which left
the same hole one step over. A job that names none still has a choice
behind it: the configured default, whose id lives in extension storage
but whose model and credentials live in the list. So an unreachable list
sent those runs to the built-in provider and recorded them completed,
which is the case this guard existed to prevent.

The condition drops to the list itself, which also states the invariant
plainly. An empty list keeps the fallback, because that is the server
answering that it genuinely has no providers rather than not answering.

Author: DaniAkash

packages/browseros-agent/apps/app/lib/schedules/getChatServerResponse.ts

@@ -80,17 +80,22 @@ const resolveProvider = async (
   // storage lookup, and the explicit-provider path used to fetch it twice.
   const loaded = await listProvidersOrNull()
 
-  // A job that named a provider must not quietly run on a different one. The
-  // list being unreachable says nothing about whether that provider exists, so
-  // substituting the built-in would spend the wrong credentials on the wrong
-  // model and still record the run as completed.
-  if (providerId && loaded === null) {
+  // Never resolve a provider from a list that failed to load. A job that named
+  // one must not quietly run on a different one, and a job that named none
+  // still has a choice behind it: the configured default, whose id lives in
+  // extension storage but whose credentials and model live in that list. Either
+  // way, substituting the built-in would spend the wrong credentials on the
+  // wrong model and still record the run as completed.
+  //
+  // An empty list is a different answer and keeps the fallback: the server
+  // answered, and it really has no providers.
+  if (loaded === null) {
     throw new Error(
       'Cannot reach the BrowserOS server to load the selected provider',
     )
   }
 
-  const providers = loaded ?? []
+  const providers = loaded
 
   if (providerId) {
     const match = findChatProviderById(providers, providerId)

packages/browseros-agent/apps/app/lib/schedules/provider-resolution.test.ts

@@ -201,12 +201,26 @@ describe('provider resolution when the server is unreachable', () => {
     ).rejects.toThrow('Cannot reach the BrowserOS server')
   })
 
-  // No provider was named, so there is no choice to betray and the built-in
-  // fallback is the behaviour this always had.
-  it('falls back to the built-in provider when none was named', async () => {
+  // A job that named nothing still has a choice behind it: the configured
+  // default. Its id is in extension storage but its model and credentials are
+  // in the list that failed to load, so the built-in is not a safe stand-in.
+  it('fails a scheduled job that relies on the configured default', async () => {
     storageValues.set('unreachable', true)
     const { getChatServerResponse } = await import('./getChatServerResponse')
 
+    await expect(
+      getChatServerResponse({ message: 'Run my schedule' }),
+    ).rejects.toThrow('Cannot reach the BrowserOS server')
+
+    expect(fetchBodies).toHaveLength(0)
+  })
+
+  // An empty list is a different answer from an unreachable one: the server
+  // replied and really has no providers, so the built-in is correct.
+  it('still falls back to the built-in provider when the server has none', async () => {
+    storageValues.set('providers', [])
+    const { getChatServerResponse } = await import('./getChatServerResponse')
+
     await getChatServerResponse({ message: 'Run my schedule' })
 
     expect(fetchBodies[0]).toMatchObject({ provider: 'browseros' })

packages/browseros-agent/apps/app/lib/schedules/refine-prompt.ts

@@ -14,13 +14,16 @@ const resolveProvider = async (
   providerId?: string,
 ): Promise<LlmProviderConfig> => {
   const loaded = await listProvidersOrNull()
-  if (providerId && loaded === null) {
+  // Same rule as the scheduled run: the configured default is a choice too, and
+  // its model and credentials are in the list that failed to load. Callers here
+  // already catch and surface this.
+  if (loaded === null) {
     throw new Error(
       'Cannot reach the BrowserOS server to load the selected provider',
     )
   }
 
-  const providers = loaded ?? []
+  const providers = loaded
   if (providers.length) {
     const explicitProvider = findChatProviderById(providers, providerId)
     if (explicitProvider) return explicitProvider