test: add missing base_url edge case + clarify 0.0.0.0 marker intent

Document defensive behavior: openai_compat with no base_url returns True
(cloud) because unknown destination is assumed cloud. Add explanatory
comment to LOCAL_URL_MARKERS for the 0.0.0.0 bind-address case.

scripts/byok_guard.py

@@ -7,6 +7,8 @@ providers. Used by Settings (activation warning) and app.py (sidebar indicator).
 No Streamlit dependency — pure Python so it's unit-testable and reusable.
 """
 
+# 0.0.0.0 is a bind address (all interfaces), not a true loopback, but a backend
+# configured to call it is talking to the local machine — treat as local.
 LOCAL_URL_MARKERS = ("localhost", "127.0.0.1", "0.0.0.0")
 
 

tests/test_byok_guard.py

@@ -41,6 +41,11 @@ class TestIsCloudBackend:
         cfg = {"type": "anthropic", "local": True}
         assert is_cloud_backend("anthropic", cfg) is False
 
+    def test_openai_compat_missing_base_url_treated_as_cloud(self):
+        # No base_url → unknown destination → defensively treated as cloud
+        cfg = {"type": "openai_compat"}
+        assert is_cloud_backend("unknown", cfg) is True
+
     def test_unknown_type_without_url_is_local(self):
         assert is_cloud_backend("mystery", {"type": "unknown_type"}) is False