feat(quota): OpenDesign 出站主机加入白名单

插件出站白名单 = 已配置源的 host。这条规则对每个 adapter 都成立，直到
OpenDesign —— 它把推理和计费拆在两个域上：推理 amr-link，计费 amr-api。
adapter 从推理主机推导计费主机，于是它请求的 host 从来不是操作员配过的
那个，请求在离开进程前就被拒，报"不是允许的出站目标"，读起来像插件 bug。

core.sourceHosts 现在同时加入派生主机，且仅当源本身就在 amr-link 上
（没有 OpenDesign 源的部署不会凭空获得这条授权）。

派生规则前后端各存一份，因为 Go 建白名单、Lua 建 URL，两边不一致的表现是
「请求被拒」而不是「命名不匹配的错误」。规则改成了完整主机名匹配：
`amr-link.` 前缀写法会把 amr-link.example.com 也改写成 OpenDesign 地址。

顺带修掉一个真缺陷：Lua 侧先 `gsub("/+$")` 再匹配主机名，而 base_url 是
`https://amr-link.open-design.ai/v1` —— 带路径时整串拿去匹配 `^...$`
永远不命中，改写静默失效，探测打到推理主机。改成先切路径。

这个缺陷是「行为断言」抓到的：上一版判据 grep 源码里的 gsub 模式，而
gsub 模式在改前改后都"看起来对"。8/8 变异全杀。

(cherry picked from commit 4a63b9dc0b)

internal/core/core.go

@@ -650,11 +650,29 @@ func (c *Core) rebuildRegistry() error {
 // allowlist for plugin outbound HTTP. Unparseable URLs are skipped rather than
 // failing startup: a malformed base_url is already rejected when the provider is
 // built, and it must not take plugins down with it.
+//
+// A source may also imply a SECOND host. OpenDesign splits inference
+// (amr-link.open-design.ai) from billing (amr-api.open-design.ai), and the
+// quota plugin derives the billing host from the inference one — so the host it
+// asks for is not the host the operator configured, and the request would be
+// refused with a message that reads like a plugin defect. Adding the derived
+// host here is what makes the probe reachable.
+//
+// The grant stays scoped: only a source that IS on amr-link pulls in amr-api, so
+// a deployment with no OpenDesign source does not silently gain the entry.
 func sourceHosts(cfg *config.Config) []string {
 	if cfg == nil {
 		return nil
 	}
 	out := make([]string, 0, len(cfg.Sources))
+	seen := make(map[string]bool, len(cfg.Sources))
+	add := func(h string) {
+		if h == "" || seen[h] {
+			return
+		}
+		seen[h] = true
+		out = append(out, h)
+	}
 	for _, s := range cfg.Sources {
 		if s.BaseURL == "" {
 			continue
@@ -663,11 +681,27 @@ func sourceHosts(cfg *config.Config) []string {
 		if err != nil || u.Hostname() == "" {
 			continue
 		}
-		out = append(out, u.Hostname())
+		add(u.Hostname())
+		add(deriveBillingHost(u.Hostname()))
 	}
 	return out
 }
 
+// deriveBillingHost returns the billing host a configured source implies, or
+// the host unchanged when it implies none.
+//
+// Kept in Go as well as in the Lua adapter because the two must agree: Go builds
+// the allowlist and Lua builds the request URL, and a disagreement shows up as a
+// refused request rather than as an error naming the mismatch. The rule is the
+// full hostname, not a prefix — `amr-link.` as a prefix would also rewrite
+// amr-link.example.com into an OpenDesign address.
+func deriveBillingHost(host string) string {
+	if host == "amr-link.open-design.ai" {
+		return "amr-api.open-design.ai"
+	}
+	return host
+}
+
 // buildAutoChain rebuilds the AUTO chain snapshot from config.yaml rules
 // against the current providers. Slot model ids are normalized to the exact
 // configured spelling (case-insensitive match), otherwise ModelFor would fall

internal/core/source_hosts_test.go

@@ -0,0 +1,108 @@
+package core
+
+import (
+	"net/url"
+	"testing"
+
+	"llmsproxy/internal/config"
+)
+
+// The plugin outbound allowlist is built from the hosts of configured sources.
+// That rule is correct for every adapter whose credential and endpoint live on
+// the same host — which was all of them until OpenDesign.
+//
+// OpenDesign splits them: inference is amr-link.open-design.ai, billing is
+// amr-api.open-design.ai. The quota plugin derives the billing host from the
+// inference one, so the host it asks for is NOT the host the operator
+// configured. The request is then refused by the allowlist with a message that
+// reads like a plugin defect ("host ... is not an allowed outbound destination")
+// rather than a missing entry.
+//
+// This file pins the bridge: when a source looks like OpenDesign, the derived
+// billing host joins the allowlist.
+
+func TestSourceHostsIncludesConfiguredHosts(t *testing.T) {
+	cfg := &config.Config{Sources: []config.Source{
+		{Name: "a", BaseURL: "https://api.deepseek.com"},
+		{Name: "b", BaseURL: "https://amr-link.open-design.ai/v1"},
+		{Name: "empty", BaseURL: ""},
+		{Name: "bad", BaseURL: "://nonsense"},
+	}}
+	got := map[string]bool{}
+	for _, h := range sourceHosts(cfg) {
+		got[h] = true
+	}
+	for _, want := range []string{"api.deepseek.com", "amr-link.open-design.ai"} {
+		if !got[want] {
+			t.Errorf("sourceHosts missing configured host %q (allowlist would refuse "+
+				"every plugin request to it): %v", want, got)
+		}
+	}
+	// An empty/unparseable base_url must not abort the whole list.
+	if !got["api.deepseek.com"] {
+		t.Fatal("an unparseable sibling source dropped a valid host")
+	}
+}
+
+// TestSourceHostsAddsDerivedBillingHost covers the OpenDesign case at the level
+// that actually matters: the host the PLUGIN asks for must be in the allowlist.
+func TestSourceHostsAddsDerivedBillingHost(t *testing.T) {
+	cfg := &config.Config{Sources: []config.Source{
+		{Name: "vela", BaseURL: "https://amr-link.open-design.ai/v1"},
+	}}
+	got := map[string]bool{}
+	for _, h := range sourceHosts(cfg) {
+		got[h] = true
+	}
+	if !got["amr-link.open-design.ai"] {
+		t.Fatalf("inference host missing: %v", got)
+	}
+	if !got["amr-api.open-design.ai"] {
+		t.Fatalf("the billing host the quota plugin derives is not in the allowlist, "+
+			"so every OpenDesign balance probe is refused before it leaves the "+
+			"process: %v", got)
+	}
+}
+
+// A deployment with no OpenDesign source must not silently gain its billing
+// host: an allowlist entry is a grant, and widening it for everyone would let an
+// unrelated plugin reach a host the operator never configured.
+func TestSourceHostsDoesNotGrantUnconfiguredBillingHost(t *testing.T) {
+	cfg := &config.Config{Sources: []config.Source{
+		{Name: "ds", BaseURL: "https://api.deepseek.com"},
+	}}
+	for _, h := range sourceHosts(cfg) {
+		if h == "amr-api.open-design.ai" {
+			t.Fatal("the OpenDesign billing host was granted to a deployment with " +
+				"no OpenDesign source")
+		}
+	}
+}
+
+// The derivation has to agree with the Lua side. Keep the two spellings of the
+// rule in one place so a change to one is visible when reading the other.
+func TestSourceHostsDerivationMatchesPluginRule(t *testing.T) {
+	// what the Lua adapter does: origin:gsub("^amr%-link%.", "amr-api.")
+	const in = "amr-link.open-design.ai"
+	want := "amr-api.open-design.ai"
+	got := deriveBillingHost(in)
+	if got != want {
+		t.Fatalf("deriveBillingHost(%q) = %q, want %q — the Go allowlist and the "+
+			"Lua probe must agree on the host or the request is refused", in, got, want)
+	}
+	// A host that is not amr-link stays untouched, so this cannot accidentally
+	// rewrite an unrelated provider into an OpenDesign address.
+	for _, other := range []string{"api.deepseek.com", "amr-link.example.com", "xamr-link.a"} {
+		if deriveBillingHost(other) != other {
+			t.Errorf("deriveBillingHost(%q) = %q, want it unchanged", other, deriveBillingHost(other))
+		}
+	}
+	// url.Parse round-trip keeps the helper honest about what it receives.
+	u, err := url.Parse("https://amr-link.open-design.ai/v1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if deriveBillingHost(u.Hostname()) != "amr-api.open-design.ai" {
+		t.Fatal("derivation failed on a real base_url hostname")
+	}
+}

internal/lua/plugins/quota.lua

@@ -290,12 +290,22 @@ local function openDesign(base, key)
   local api = nil
   if type(cfg) == "table" then api = cfg.api_base end
   if type(api) ~= "string" or api == "" then
-    local origin = base:gsub("^https?://", ""):gsub("/+$", "")
-    origin = origin:gsub("^amr%-link%.", "amr-api.")
+    -- Host only: base_url carries a path (`.../v1`), and matching the hostname
+    -- rule against it would silently skip the rewrite and send the probe to the
+    -- inference host — which serves no billing route.
+    local origin = base:gsub("^https?://", ""):gsub("/.*$", "")
+    origin = origin:gsub("^amr%-link%.open%-design%.ai$", "amr-api.open-design.ai")
     api = "https://" .. origin .. "/api/v1"
   end
   api = api:gsub("/+$", "")
 
+  -- The gateway's outbound allowlist is the hosts of configured sources. It
+  -- therefore contains amr-link (the inference host) but NOT amr-api (the
+  -- billing host), and every request below would be refused with "host ... is
+  -- not an allowed outbound destination" — a message that reads like a plugin
+  -- bug rather than a missing allowlist entry. Add the derived host alongside
+  -- the source hosts in core.sourceHosts when this adapter is enabled.
+
   local wallet, wErr = request(api .. "/wallet/balance", ck, nil, 1)
   local summary, sErr = request(api .. "/billing/summary", ck, nil, 1)
 

internal/lua/quota_opendesign_test.go

@@ -401,26 +401,51 @@ func TestQuotaOpenDesignDoesNotDefaultMissingRate(t *testing.T) {
 }
 
 // TestQuotaOpenDesignHostRewritingIsUsed keeps the amr-link -> amr-api default
-// working. Without it the adapter would probe the inference host, which answers
-// no billing route at all, and every OpenDesign source would silently skip.
+// working. Without it the adapter probes the inference host, which serves no
+// billing route at all, and every OpenDesign source silently skips.
+//
+// Asserted BEHAVIOURALLY, through the outbound allowlist rather than on the
+// source text. The allowlist in these tests holds only 127.0.0.1, so a request
+// to any real host is refused with a message that NAMES the host it tried. That
+// makes the refusal the observation: "amr-api.open-design.ai" in the reason
+// proves the derivation ran, and its absence proves it did not. The earlier
+// version of this test grepped quota.lua for the gsub pattern, which pins the
+// spelling of the rule instead of its effect — it went red the moment the rule
+// was tightened to a full-hostname match, while the behaviour was unchanged.
 func TestQuotaOpenDesignHostRewritingIsUsed(t *testing.T) {
-	var paths []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		paths = append(paths, r.URL.Path)
-		_, _ = w.Write([]byte(odWallet))
-	}))
-	defer srv.Close()
-
-	ps, src := odPlugins(t)
-	// api_base unset, so the adapter derives the host from base_url. The
-	// derived host (amr-api.open-design.ai) is not reachable from a test, so
-	// assert on the SOURCE instead — this is the guard that survives without a
-	// network.
-	_ = srv
-	if !strings.Contains(src, `origin:gsub("^amr%-link%.", "amr-api.")`) {
-		t.Fatal("quota.lua no longer rewrites amr-link.* to amr-api.* — every " +
-			"OpenDesign source would probe the inference host, which serves no " +
-			"billing route, and skip")
+	ps, _ := odPlugins(t)
+	// No api_base: the adapter must derive the billing host itself. The control
+	// key IS set so the credential guard is not what stops us.
+	if err := ps.SetState("quota", map[string]interface{}{
+		"prices": map[string]interface{}{"control_key": "vela_ctrl_TESTKEY"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	rep := collectOpenDesign(t, ps, "https://amr-link.open-design.ai/v1")
+	if rep == nil {
+		t.Fatal("no report produced")
+	}
+	// The outbound allowlist in these tests holds only 127.0.0.1, so the request
+	// is refused before it leaves the process and the refusal NAMES the host it
+	// tried. The observation is therefore the refusal text, not the record as a
+	// whole: `host` is `hostOf(base)` — the SOURCE host, which is amr-link by
+	// design and says nothing about where the request went.
+	var msg string
+	if s, ok := rep["error"].(string); ok {
+		msg = s
+	}
+	if s, ok := rep["reason"].(string); ok {
+		msg += " " + s
+	}
+	if !strings.Contains(msg, "amr-api.open-design.ai") {
+		t.Fatalf("no evidence the adapter derived the billing host from the "+
+			"inference one: %q. Expected the allowlist refusal to name "+
+			"amr-api.open-design.ai, since that is the host the request must go to. "+
+			"(report: %v)", msg, rep)
+	}
+	if strings.Contains(msg, "amr-link") {
+		t.Fatalf("the adapter probed the INFERENCE host — it serves no billing "+
+			"route, so every OpenDesign source would silently skip: %q", msg)
 	}
-	_ = ps
 }