agent window: a site's relay stands in for the endpoint it relays

On isokit.buildfor.life, entering https://inference.p0.contact/v1 in the
agent window's settings made the page call the inference server directly,
which browsers refuse (its nginx answers the CORS preflight with 401):
"The browser could not reach ... (Failed to fetch)".

- the relay meta names its upstream (data-upstream; build_web.py
  --agent-upstream, the deploy passes the inference server): that URL now
  goes through the relay and is saved as "follow the site's default"
- an unreachable endpoint says what to do: the relay's URL on a site with
  one, else isokit studio or isokit.buildfor.life
- check_web.py: relayed upstream and the unreachable message

tools/build_web.py

@@ -113,7 +113,9 @@ def main():
     ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     ap.add_argument("--out", default=str(ROOT / "dist" / "web"))
     ap.add_argument("--skip-cargo", action="store_true", help="reuse the last WASM build (front-end changes only)")
-    ap.add_argument("--agent-url", help="default endpoint of the agent window, e.g. a relay on the same site (/llm/v1)")
+    ap.add_argument("--agent-url", help="default endpoint of the agent window: a relay on the same site (/llm/v1)")
+    ap.add_argument("--agent-upstream", default="https://inference.p0.contact/v1",
+                    help="the endpoint that --agent-url relays to; entered in the window, it goes through the relay")
     a = ap.parse_args()
     out = Path(a.out).resolve()
     web = out / "assets" / "web"
@@ -157,7 +159,8 @@ def main():
     html = replace_once(html, '<title>isokit Studio</title>',
                         '<title>isokit Studio</title>\n<meta name="description" content="isokit Studio: edit isometric site plans in the browser.">'
                         + (f'\n<meta name="isokit-build" content="{build}">' if build else "")
-                        + (f'\n<meta name="isokit-agent" content="{html_attr(a.agent_url)}">' if a.agent_url else ""))
+                        + (f'\n<meta name="isokit-agent" content="{html_attr(a.agent_url)}" data-upstream="{html_attr(a.agent_upstream)}">'
+                           if a.agent_url else ""))
     html = replace_once(html, 'href="/assets/studio/favicon.svg"', f'href="assets/studio/favicon.svg?{v}"')
     html = replace_once(html, 'href="/assets/viewer/isokit-view.css"', f'href="assets/viewer/isokit-view.css?{v}"')
     html = replace_once(html, '<link rel="stylesheet" href="/assets/theme.css">', '<style id="iso-theme"></style>')

tools/check_web.py

@@ -196,6 +196,34 @@ try:
         stored = pg.evaluate("() => JSON.parse(localStorage.getItem('isokit-agent'))")
         check(stored.get("key") == "test-key" and not stored.get("model"), f"settings stay in this browser {stored}")
 
+        # a site relay (here: the mock) stands in for its upstream, which pages may not call directly
+        upstream = "https://inference.p0.contact/v1"
+        pg.evaluate("""([u, up]) => { const m = document.createElement('meta'); m.name = 'isokit-agent'; m.content = u;
+            m.setAttribute('data-upstream', up); document.head.appendChild(m); }""", [agent_checks.MOCK + "/v1", upstream])
+        pg.locator("#agent").click()
+        pg.locator("#agset").click()
+        pg.locator("#agurl").fill(upstream + "/")
+        n_chat = len(agent_checks.chats())
+        pg.locator('#agsetf button[type="submit"]').click()
+        pg.wait_for_function("() => document.querySelector('#agwho .ag-on')", timeout=5000)
+        check(pg.evaluate("() => JSON.parse(localStorage.getItem('isokit-agent')).url") is None,
+              "entering the relayed endpoint keeps following the site's default")
+        pg.locator("#agtext").fill("hello via the relay")
+        pg.locator("#agtext").press("Enter")
+        pg.wait_for_function("() => !document.querySelector('.ag-busy')", timeout=10000)
+        check(len(agent_checks.chats()) == n_chat + 1, "the relayed endpoint is called through the relay")
+        # no relay for another site: the message says what to do
+        pg.evaluate("() => document.querySelector('meta[name=isokit-agent]').remove()")
+        pg.locator("#agset").click() if pg.locator("#agsetf").is_hidden() else None
+        pg.locator("#agurl").fill("http://127.0.0.1:7939/v1")
+        pg.locator('#agsetf button[type="submit"]').click()
+        pg.wait_for_function("() => /could not reach/.test(document.getElementById('agsetmsg').textContent)", timeout=15000)
+        msg = pg.locator("#agsetmsg").inner_text()
+        check("CORS" in msg and "isokit studio" in msg, "an unreachable endpoint on another site explains CORS and the way out: " + msg[:90])
+        shot(pg, "web-agent-unreachable.jpg")
+        pg.evaluate("() => localStorage.setItem('isokit-agent', JSON.stringify({url: arguments[0], key: 'test-key'}))".replace("arguments[0]", "'" + agent_checks.MOCK + "/v1'"))
+        pg.locator("#agclose").click()
+
         # ---------------------------------------------------------------- two tabs on one project
         pg2 = ctx.new_page()
         watch(pg2)
@@ -320,7 +348,7 @@ try:
         shot(pg, "web-narrow.jpg")
 
         # the browser logs the 401 of the agent window's wrong-key check
-        errs = [e for e in errs if "status of 401" not in e]
+        errs = [e for e in errs if "status of 401" not in e and "ERR_CONNECTION_REFUSED" not in e]
         check(not errs, f"no page errors {errs[:5]}")
         b.close()
 finally: