fix(agent): add provider health check probe (#358)

## Summary

- Add an authenticated provider/model health probe endpoint backed by
aionrs provider execution.
- Keep health probes out of conversation persistence and session state.
- Add structured health diagnostics and AWS credential error
classification.

## Test plan

- [x] `MACOSX_DEPLOYMENT_TARGET=15.5 just push -u origin
fix/model-health-probe`

---------

Co-authored-by: zynx <>

Author: piorpua

crates/aionui-ai-agent/src/factory/aionrs.rs

@@ -177,7 +177,7 @@ pub(super) async fn build(
 /// Mirrors the frontend `src/process/agent/aionrs/envBuilder.ts` mapping.
 /// For `new-api` platform, per-model protocol overrides from `model_protocols`
 /// JSON take precedence.
-fn map_aionrs_provider(platform: &str, model_id: &str, model_protocols: Option<&str>) -> String {
+pub(crate) fn map_aionrs_provider(platform: &str, model_id: &str, model_protocols: Option<&str>) -> String {
     if platform == "new-api"
         && let Some(protocols_json) = model_protocols
         && let Ok(map) = serde_json::from_str::<serde_json::Map<String, serde_json::Value>>(protocols_json)
@@ -202,7 +202,7 @@ fn map_aionrs_provider(platform: &str, model_id: &str, model_protocols: Option<&
 /// - Strips trailing `/v1` from base_url (aionrs appends its own path)
 /// - Gemini: prepends `/v1beta/openai` and overrides `api_path`
 /// - OpenAI official (`api.openai.com`): sets `max_completion_tokens`
-fn resolve_aionrs_url_and_compat(
+pub(crate) fn resolve_aionrs_url_and_compat(
     platform: &str,
     raw_base_url: &str,
     mapped_provider: &str,
@@ -249,7 +249,7 @@ fn normalize_aionrs_base_url(url: &str) -> String {
     trimmed.strip_suffix("/v1").unwrap_or(trimmed).to_owned()
 }
 
-fn resolve_bedrock_config(json: Option<&str>) -> Option<aion_config::config::BedrockConfig> {
+pub(crate) fn resolve_bedrock_config(json: Option<&str>) -> Option<aion_config::config::BedrockConfig> {
     let bc: aionui_api_types::BedrockConfig = serde_json::from_str(json?).ok()?;
     Some(aion_config::config::BedrockConfig {
         region: Some(bc.region),

crates/aionui-ai-agent/src/factory/mod.rs

@@ -1,7 +1,7 @@
 pub mod acp_assembler;
 
 mod acp;
-mod aionrs;
+pub(crate) mod aionrs;
 mod context;
 mod nanobot;
 mod openclaw;

crates/aionui-ai-agent/src/routes/agent.rs

@@ -13,7 +13,8 @@ use axum::routing::{get, patch, post, put};
 
 use aionui_api_types::{
     AcpHealthCheckRequest, AcpHealthCheckResponse, AgentMetadata, ApiResponse, CustomAgentUpsertRequest,
-    DeleteCustomAgentResponse, SetEnabledRequest, TryConnectCustomAgentRequest, TryConnectCustomAgentResponse,
+    DeleteCustomAgentResponse, ProviderHealthCheckRequest, ProviderHealthCheckResponse, SetEnabledRequest,
+    TryConnectCustomAgentRequest, TryConnectCustomAgentResponse,
 };
 use aionui_auth::CurrentUser;
 use aionui_common::AppError;
@@ -25,6 +26,7 @@ pub fn agent_routes(state: AgentRouterState) -> Router {
         .route("/api/agents", get(list_agents))
         .route("/api/agents/refresh", post(refresh_agents))
         .route("/api/agents/health-check", post(health_check))
+        .route("/api/agents/provider-health-check", post(provider_health_check))
         .route("/api/agents/{id}/enabled", patch(set_agent_enabled))
         .route("/api/agents/custom", post(create_custom))
         .route("/api/agents/custom/{id}", put(update_custom).delete(delete_custom))
@@ -55,6 +57,15 @@ async fn health_check(
     Ok(Json(ApiResponse::ok(state.service.acp_health_check(req).await?)))
 }
 
+async fn provider_health_check(
+    State(state): State<AgentRouterState>,
+    Extension(_user): Extension<CurrentUser>,
+    body: Result<Json<ProviderHealthCheckRequest>, JsonRejection>,
+) -> Result<Json<ApiResponse<ProviderHealthCheckResponse>>, AppError> {
+    let Json(req) = body.map_err(|e| AppError::BadRequest(e.to_string()))?;
+    Ok(Json(ApiResponse::ok(state.service.provider_health_check(req).await?)))
+}
+
 async fn try_connect_custom(
     State(state): State<AgentRouterState>,
     Extension(_user): Extension<CurrentUser>,

crates/aionui-ai-agent/src/services/agent.rs

@@ -15,19 +15,35 @@
 use std::path::PathBuf;
 use std::sync::Arc;
 
-use aionui_api_types::{AcpHealthCheckRequest, AcpHealthCheckResponse, AgentMetadata};
+use aionui_api_types::{
+    AcpHealthCheckRequest, AcpHealthCheckResponse, AgentMetadata, ProviderHealthCheckRequest,
+    ProviderHealthCheckResponse,
+};
 use aionui_common::AppError;
+use aionui_db::IProviderRepository;
 
+use super::provider_health::ProviderHealthCheckService;
 use crate::registry::AgentRegistry;
 
 pub struct AgentService {
     registry: Arc<AgentRegistry>,
     data_dir: PathBuf,
+    provider_health: ProviderHealthCheckService,
 }
 
 impl AgentService {
-    pub fn new(registry: Arc<AgentRegistry>, data_dir: PathBuf) -> Arc<Self> {
-        Arc::new(Self { registry, data_dir })
+    pub fn new(
+        registry: Arc<AgentRegistry>,
+        provider_repo: Arc<dyn IProviderRepository>,
+        encryption_key: [u8; 32],
+        data_dir: PathBuf,
+    ) -> Arc<Self> {
+        let provider_health = ProviderHealthCheckService::new(provider_repo, encryption_key, data_dir.clone());
+        Arc::new(Self {
+            registry,
+            data_dir,
+            provider_health,
+        })
     }
 
     /// Data directory used by the custom-agent probe to spawn CLI
@@ -57,4 +73,11 @@ impl AgentService {
     pub async fn acp_health_check(&self, req: AcpHealthCheckRequest) -> Result<AcpHealthCheckResponse, AppError> {
         Ok(crate::protocol::cli_detect::health_check(&self.registry, &req.backend).await)
     }
+
+    pub async fn provider_health_check(
+        &self,
+        req: ProviderHealthCheckRequest,
+    ) -> Result<ProviderHealthCheckResponse, AppError> {
+        self.provider_health.health_check(req).await
+    }
 }

crates/aionui-ai-agent/src/services/mod.rs

@@ -1,5 +1,6 @@
 pub mod agent;
 pub mod custom;
+pub mod provider_health;
 pub mod remote;
 
 pub use agent::AgentService;