From ce5dc13142b68a77b1c524b8d981ce8dfe1dde4d Mon Sep 17 00:00:00 2001
From: RaresKeY <158580472+RaresKeY@users.noreply.github.com>
Date: Thu, 6 Aug 2026 17:04:07 +0100
Subject: [PATCH] fix(models): bind provider detection to DNS labels

---
 src/model_capability_readers/base.py   | 17 +++++++++++------
 tests/test_model_capability_readers.py |  9 +++++++++
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/src/model_capability_readers/base.py b/src/model_capability_readers/base.py
index ee17650a6..001b05fc4 100644
--- a/src/model_capability_readers/base.py
+++ b/src/model_capability_readers/base.py
@@ -290,17 +290,22 @@ def detect_vendor(base_url: Any = "", endpoint_kind: Any = "") -> str:
         return kind_map[kind]
 
     parsed = urlparse(compact_str(base_url))
-    host = (parsed.hostname or "").lower()
+    host = (parsed.hostname or "").lower().rstrip(".")
     port = parsed.port
-    if host.endswith("openrouter.ai"):
+
+    def host_matches(domain: str) -> bool:
+        domain = domain.lower().rstrip(".")
+        return host == domain or host.endswith(f".{domain}")
+
+    if host_matches("openrouter.ai"):
         return VENDOR_OPENROUTER
-    if host.endswith("openai.com"):
+    if host_matches("openai.com"):
         return VENDOR_OPENAI
-    if host.endswith("anthropic.com"):
+    if host_matches("anthropic.com"):
         return VENDOR_ANTHROPIC
-    if host.endswith("googleapis.com"):
+    if host_matches("googleapis.com"):
         return VENDOR_GOOGLE
-    if host.endswith("ollama.com") or port == 11434:
+    if host_matches("ollama.com") or port == 11434:
         return VENDOR_OLLAMA
     if port == 1234:
         return VENDOR_LMSTUDIO
diff --git a/tests/test_model_capability_readers.py b/tests/test_model_capability_readers.py
index 36ef93ab1..cf052694d 100644
--- a/tests/test_model_capability_readers.py
+++ b/tests/test_model_capability_readers.py
@@ -30,6 +30,15 @@ def test_detect_vendor_uses_endpoint_kind_then_host_and_common_local_ports():
     assert detect_vendor("http://localhost:7000/v1") == VENDOR_GENERIC_OPENAI
 
 
+def test_detect_vendor_requires_a_dns_label_boundary():
+    assert detect_vendor("https://api.openai.com./v1") == VENDOR_OPENAI
+    assert detect_vendor("https://notopenai.com/v1") == VENDOR_GENERIC_OPENAI
+    assert detect_vendor("https://fakeopenrouter.ai/v1") == VENDOR_GENERIC_OPENAI
+    assert detect_vendor("https://notgoogleapis.com/v1") == VENDOR_GENERIC_OPENAI
+    assert detect_vendor("https://evilanthropic.com/v1") == VENDOR_GENERIC_OPENAI
+    assert detect_vendor("https://fakeollama.com/v1") == VENDOR_GENERIC_OPENAI
+
+
 def test_generic_openai_reader_keeps_basic_model_payload_unknown():
     records = generic_openai.records_from_payload(
         {