Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/providers/management/service.py`:
- Around line 377-393: After discovering models using get_provider, re-acquire
the provider state under the same protection used for updates (the provider
lock) before calling update_provider: fetch the provider again (call
self.get_provider(name) or the internal locked getter), compare its base_url to
the one you probed (the previous config.base_url used with _infer_preset_hint
and discover_models), and if they differ abort (or optionally retry discovery)
instead of creating UpdateProviderRequest(models=discovered) and calling
self.update_provider(name, ...); ensure this check happens under the lock so
concurrent changes cannot race and you only persist models for a matching
base_url.
- Around line 387-389: The preset inference currently uses
_infer_preset_hint(config.base_url) and passes that to discover_models, but
_infer_preset_hint only returns "ollama" when the parsed port matches the
default Ollama port, causing Ollama instances on custom ports or behind proxies
to fall back to the wrong probe; update the logic around _infer_preset_hint and
discover_models to (a) persist or accept an explicit preset kind when present
instead of deriving solely from urlparse(config.base_url).port, and (b) add an
Ollama fallback probe path in discover_models when the host or path pattern
strongly indicates Ollama (e.g., hostname contains "ollama" or base_url path
includes Ollama-style endpoints) so custom-port or proxied Ollama deployments
are probed via /api/tags; ensure changes reference the variables and functions
_infer_preset_hint, preset_hint, discover_models, and config.base_url.
- Around line 389-393: Discovery currently calls
discover_models(config.base_url, preset_hint) without provider auth or client
policy; update the call site to pass the full ProviderConfig (including api_key,
oauth, headers and client policy) so discover_models can use
BaseCompletionProvider path with retry/rate-limiting, i.e., replace the two-arg
call with one that forwards the ProviderConfig (or add an overload that accepts
ProviderConfig) and ensure discover_models uses BaseCompletionProvider to
perform requests; alternatively, if threading ProviderConfig into discovery is
not yet implemented, explicitly reject providers whose config.auth_type !=
AuthType.NONE in the discover flow (before calling discover_models) and return
an error, referencing discover_models, update_provider, UpdateProviderRequest,
ProviderConfig and BaseCompletionProvider so reviewers can locate the change.

In `@web/src/components/setup/SetupProvider.vue`:
- Around line 181-188: The current mount logic auto-sets testPassed = true when
hasModels.value is true, meaning existing providers are treated as verified
without running a connection check; change this to trigger the same validation
routine used by the manual "Test connection" flow instead of flipping testPassed
directly: locate the component's test handler (e.g., runProviderTest /
testProviderConnection) and call it after setting createdProviderName.value (or
implement a new function that runs the connection check and sets testPassed
based on the result), or add a configurable flag (e.g., skipAutoTest) to
preserve the old behavior when desired.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/api/controllers/setup_models.py`:
- Around line 113-129: The validator _validate_preset_exists currently mutates a
frozen model via object.__setattr__; change it to run before construction by
replacing `@model_validator`(mode="after") with `@model_validator`(mode="before")
(or add a new before-mode validator) and move the import of PERSONALITY_PRESETS
into that method or top-level as needed; validate the incoming values by
normalizing the input (key = values.get("personality_preset",
"").strip().lower()), raise ValueError if key not in PERSONALITY_PRESETS, then
return a new values dict with "personality_preset" set to the canonical key so
the model is constructed with the normalized value (do not use
object.__setattr__).

In `@src/synthorg/providers/discovery.py`:
- Around line 128-131: socket.getaddrinfo is being called synchronously in
_check_blocked_address (and transitively in _validate_discovery_url), which
blocks the event loop; change _check_blocked_address and _validate_discovery_url
to async and run the blocking call via the event loop executor (e.g.,
loop.run_in_executor or asyncio.to_thread) when calling
socket.getaddrinfo(hostname, None), await the result, and propagate exceptions
as before so DNS lookups do not block the async context.
- Around line 393-400: The log call in _do_fetch_json drops the preset context
by hardcoding preset=None; modify _do_fetch_json to accept a preset_name
parameter (defaulting to None for compatibility) and use that value in the
logger.warning call for PROVIDER_DISCOVERY_FAILED, then update callers (notably
_fetch_json) to pass their preset_name through when invoking _do_fetch_json so
the warning includes the correct preset context.

In `@src/synthorg/providers/management/service.py`:
- Around line 625-647: _build_discovery_headers currently ignores AuthType.OAUTH
and returns None, causing discovery requests to run unauthenticated; update
_build_discovery_headers to explicitly handle AuthType.OAUTH by either
attempting to obtain an OAuth token from ProviderConfig (e.g., a token getter on
ProviderConfig or an oauth_client) and returning {"Authorization": f"Bearer
{token}"} if available, or — if token acquisition is out of scope — emit a clear
log message indicating OAuth-based discovery is being skipped (use the module
logger) and then return None; reference ProviderConfig and AuthType.OAUTH in
your change so the OAuth path is explicit.

In `@tests/unit/api/controllers/test_setup.py`:
- Around line 178-212: The tests
test_min_password_length_non_integer_returns_default and
test_min_password_length_below_default_returns_default mutate
settings_repo._store[("api","min_password_length")] but always pop() it in
finally, making test order-dependent; change each test to snapshot the original
value before setting (e.g., orig =
settings_repo._store.get(("api","min_password_length"))) then in finally restore
it by setting it back if orig is not None or pop only if orig was None, ensuring
the original value is preserved when the test exits.

In `@web/src/__tests__/views/SetupPage.test.ts`:
- Around line 181-184: Replace the fragile class-based selector in the test
(currently using '.rounded-xl.bg-brand-600') with a stable test id: change the
assertion in SetupPage.test.ts to find '[data-testid="brand-logo"]' and assert
existence and text as before; then add data-testid="brand-logo" to the logo
container element in the SetupPage component (SetupPage.vue) so the test targets
that attribute instead of presentation classes.

In `@web/src/components/setup/SetupAdmin.vue`:
- Around line 109-126: The Back button can be clicked while a submit is
in-flight, causing a race; update the Back Button (the one with
`@click`="emit('previous')") to also be disabled when auth.loading is true (and/or
when locked is true) by adding the same disabled condition used on the submit
Button (e.g., :disabled="!username || !password || !confirmPassword || locked ||
auth.loading") so navigation is prevented during the async create-admin
operation.

In `@web/src/components/setup/SetupAgent.vue`:
- Around line 244-261: The Back button can be used while agent creation is in
progress, allowing a late completion to still emit a completion event and
advance the wizard; update the Back handler in SetupAgent.vue so it respects the
creating flag—either disable the Back Button when creating is true (bind
:disabled="creating || ...") or change the `@click` handler that calls
emit('previous') to first check/guard if(!creating) emit('previous'); reference
the Back Button element and the creating reactive/property to ensure users
cannot navigate back during an in-flight create request.

In `@web/src/components/setup/SetupCompany.vue`:
- Around line 136-144: The Back button must be disabled while company creation
is in progress to prevent step changes mid-request; bind the Button's disabled
prop to the same loading/ref used by the submit flow (e.g.,
:disabled="isSubmitting" or :disabled="creatingCompany") and ensure that the
submit method sets that reactive boolean true before the async create call and
false after (or on error). If no such flag exists, add a boolean ref
(isSubmitting) in SetupCompany.vue, toggle it in the create/submit handler, and
use :disabled="isSubmitting" on the Button that currently has
`@click`="emit('previous')" so the click is inert while submitting.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/providers/discovery.py`:
- Around line 197-202: The logs currently pass the raw variable url into
logger.warning (e.g., the PROVIDER_DISCOVERY_FAILED calls) which can leak
credentials or tokens; before logging, redact sensitive parts (userinfo and
query) and pass the redacted string (e.g., redacted_url) instead of url. Add or
use a small helper (redact_url) that parses the URL (urllib.parse.urlparse /
urlunparse), strips user:pass and query params (or replaces them with
placeholders), and update all logger.warning / logger.error sites that pass url
(including the occurrences around the PROVIDER_DISCOVERY_FAILED calls and the
other ranges noted) to log the redacted_url variable. Ensure the helper is
reusable and used wherever url is logged.
- Around line 77-98: The SSRF check currently only validates the hostname in
_check_blocked_address but does not return the concrete resolved address,
allowing DNS rebinding between validation and the actual httpx request; modify
_check_blocked_address to return the pinned IP (after calling
_check_ip_blocked/_check_resolved_hostname) instead of/or along with None, and
update _do_fetch_json to use that resolved IP when making the request by either
constructing a numeric-IP URL (preserving original Host header) or creating a
custom httpx transport that binds the connection to the resolved address;
reference _check_blocked_address, _check_ip_blocked, _check_resolved_hostname
for resolution/validation and update _do_fetch_json to accept and use the pinned
address for the actual connection.

---

Duplicate comments:
In `@src/synthorg/providers/management/service.py`:
- Around line 414-419: The preset hint derivation using
_infer_preset_hint(config.base_url) can return only a port so
discover_models(config.base_url, resolved_hint, ...) misroutes non-default
Ollama deployments; update the logic so the actual preset kind (e.g., "ollama")
is preserved or require the caller to pass preset_hint explicitly instead of
inferring from port: change _infer_preset_hint to return a full preset
identifier (not just port), or add/validate a preset_kind/preset_hint parameter
before calling discover_models, and ensure both call sites (where resolved_hint
is computed around resolved_hint = preset_hint or
_infer_preset_hint(config.base_url) and the repeated block at the other
location) pass the canonical preset kind so discover_models can switch to
/api/tags correctly.
- Around line 422-443: The base_url re-check and subsequent update are not
atomic because get_provider(name) is called outside the service lock; lock
self._lock around re-reading the provider, comparing base_url to
config.base_url, and calling update_provider so the check+write are serialized,
or add an internal locked helper (e.g. _update_provider_locked) that performs
current = await self.get_provider(name), compares current.base_url to
config.base_url, and performs await self.update_provider(name, update_req) under
the same asyncio.Lock to avoid the TOCTOU race.