🔍 Proxy Bug

• Date: 2026-01-23
• Status: Resolved

🔴 Issue

• Symptom: Tree generation failed after moving API keys from config.js to .env.

🔍 Root Cause Analysis

• Problem Chain:
  1. Moved API_KEY from src/scripts/config.js to tree/.env.
  2. Browser JS cannot read server-side .env files.
  3. api.js imported API_KEY from config.js as undefined.
  4. Outgoing LLM API calls failed with 401 Unauthorized (Authorization: Bearer undefined).
  5. Debug panel logged no entries due to lack of successful API calls.
• Target File: src/scripts/api.js (line 1)

✅ Solution: Server-Side Proxy

• Architecture Shift:
  • Old: Browser -> Direct API Call -> Groq/OpenRouter (API key exposed in client JS)
  • New: Browser -> /api/llm proxy -> Server -> Groq/OpenRouter (API key secured on server via .env)
• Backend Refactor (server.py):
  • Integrated .env loader.
  • Added POST /api/llm proxy endpoint with secure key injection.
  • Added GET /api/config for provider availability checks (no secrets).
• Client Refactor (api.js):
  • Removed config.js import.
  • Re-routed callAPI() to POST /api/llm.
  • Added fetchProviderAvailability() for UI feedback.
  • Implemented userMessage error handling.
• Configuration:
  • Created .env.example template.
  • Deprecated config.js and quarantined it to obsolete/.

📁 Files Changed

• server.py (LLM proxy and configuration endpoints)
• src/scripts/api.js (use proxy, remove config import)
• src/scripts/config.js / src/scripts/config.js.example (deprecated)
• .env.example (template)

🧪 Verification

• Run: python server.py in tree/ directory.
• Log Probe: Confirm startup log displays ✅ groq and ✅ openrouter.
• UI Test: Navigate to http://localhost:50080 (historically 8080), generate tree, verify debug logs show provider field.

🔐 Security Benefits

• API keys hidden from client-side runtime.
• Environment variables loaded securely from gitignored .env.
• Availability checks exposed without disclosing actual keys.

---