Baike.dev
All toolsAI codingTrendingOpen sourceNewsSubmit
Log in
Back to tool/Back to issues
#4132·local-deep-research

Add `normalize_url` to `embeddings.openai.base_url` for parity with LLM base URL

Author: LearningCircuitCreated May 18, 2026Updated Sep 18, 2026
Labelsbugsecurity

Context

Surfaced during pre-merge review of PR #4075 (TRUST.md). The LLM OpenAI-compatible provider (src/local_deep_research/llm/providers/openai_base.py) calls normalize_url() on the user-configured base_url, which:

  • Adds https:// for non-private hostnames when no scheme is given
  • Adds http:// for private addresses (localhost / RFC1918 / .local)
  • Returns explicit-scheme URLs unchanged

The OpenAI embeddings provider (src/local_deep_research/embeddings/providers/implementations/openai.py) does not call normalize_url() on embeddings.openai.base_url. It passes the value through to the OpenAI Python SDK as-is.

Consequences:

  • A user who sets embeddings.openai.base_url = "localhost:8000" (no scheme) gets UnsupportedProtocol at request time instead of the auto-http:// they'd get for the LLM base_url.
  • The two settings behave inconsistently.

TRUST.md §4 currently documents this asymmetry as a caveat. A small code change would let us drop the caveat.

Fix

Call normalize_url() on embeddings.openai.base_url in embeddings/providers/implementations/openai.py (wherever the value is read — around lines 67, 157, 182 per recent review).

Add tests mirroring the LLM provider's URL-normalization tests, including:

  • No-scheme private → http://
  • No-scheme external → https://
  • Explicit http:// external → preserved unchanged (user choice respected)
  • Explicit https:// → preserved unchanged

After this lands, TRUST.md §4's "Cloud embeddings have the same property" subsection can drop the asymmetry note.

Source: LearningCircuit/local-deep-research

View original on GitHubView discussion on GitHub