feat(api): abort signal support for native-ollama (completePrompt + createMessage)

src/api/providers/fetchers/__tests__/ollama.test.ts

@@ -1,6 +1,6 @@
 import axios from "axios"
 
-import { getOllamaModels, parseOllamaModel } from "../ollama"
+import { getOllamaModels, isIpv4LoopbackHost, isSecureOllamaEndpoint, parseOllamaModel } from "../ollama"
 import ollamaModelsData from "./fixtures/ollama-model-details.json"
 
 // Mock axios
@@ -116,7 +116,175 @@ describe("Ollama Fetcher", () => {
 		})
 	})
 
+	describe("isSecureOllamaEndpoint", () => {
+		it("should treat loopback HTTP endpoints as safe", () => {
+			expect(isSecureOllamaEndpoint("http://localhost:11434")).toBe(true)
+			expect(isSecureOllamaEndpoint("http://127.0.0.1:11434")).toBe(true)
+			expect(isSecureOllamaEndpoint("http://[::1]:11434")).toBe(true)
+		})
+
+		it("should only treat strict 127.0.0.0/8 IPv4 literals as safe", () => {
+			// Regression: the old /^127\./ prefix also matched DNS names such as
+			// 127.example.com, which would leak the key over cleartext HTTP.
+			expect(isSecureOllamaEndpoint("http://127.example.com:11434")).toBe(false)
+			expect(isSecureOllamaEndpoint("http://127.99.99.99:11434")).toBe(true) // rest of 127.0.0.0/8
+			expect(isSecureOllamaEndpoint("http://127.0.0.255:11434")).toBe(true) // range edge
+			expect(isSecureOllamaEndpoint("http://1270.0.0.1:11434")).toBe(false) // 1270 is not a valid octet
+			expect(isSecureOllamaEndpoint("http://127.256.0.1:11434")).toBe(false)
+			expect(isSecureOllamaEndpoint("http://one.two.three.four:11434")).toBe(false)
+		})
+
+		it("should treat any HTTPS endpoint as safe", () => {
+			expect(isSecureOllamaEndpoint("https://ollama.example.com")).toBe(true)
+			expect(isSecureOllamaEndpoint("https://10.0.0.5:11434")).toBe(true)
+		})
+
+		it("should treat remote HTTP endpoints as unsafe", () => {
+			expect(isSecureOllamaEndpoint("http://ollama.example.com:11434")).toBe(false)
+			expect(isSecureOllamaEndpoint("http://10.0.0.5:11434")).toBe(false)
+		})
+
+		it("should treat unparseable endpoints as unsafe", () => {
+			expect(isSecureOllamaEndpoint("not a url")).toBe(false)
+		})
+	})
+
+	describe("isIpv4LoopbackHost", () => {
+		it("should accept only four-octet 127/8 literals", () => {
+			expect(isIpv4LoopbackHost("127.0.0.1")).toBe(true)
+			expect(isIpv4LoopbackHost("127.255.255.255")).toBe(true)
+			expect(isIpv4LoopbackHost("0.0.0.1")).toBe(false)
+		})
+
+		it("should reject hosts with the wrong octet count", () => {
+			expect(isIpv4LoopbackHost("127.0.0")).toBe(false)
+			expect(isIpv4LoopbackHost("127.0.0.0.1")).toBe(false)
+		})
+
+		it("should reject non-numeric octets even when they parse as numbers", () => {
+			// Number("0x4") === 4 and Number("1e2") === 100, so only the anchored
+			// octet regex rejects these inputs.
+			expect(isIpv4LoopbackHost("127.0.0.0x4")).toBe(false)
+			expect(isIpv4LoopbackHost("127.1e2.0.1")).toBe(false)
+		})
+
+		it("should reject out-of-range octets", () => {
+			expect(isIpv4LoopbackHost("127.999.0.1")).toBe(false)
+			expect(isIpv4LoopbackHost("0127.0.0.1")).toBe(false)
+		})
+	})
+
 	describe("getOllamaModels", () => {
+		// Shared /api/tags and /api/show mock payloads. Each call returns fresh
+		// objects so tests cannot share mutable state.
+		const makeOllamaTagsPayload = (modelName: string) => ({
+			models: [
+				{
+					name: modelName,
+					model: modelName,
+					modified_at: "2025-06-03T09:23:22.610222878-04:00",
+					size: 14333928010,
+					digest: "6a5f0c01d2c96c687d79e32fdd25b87087feb376bf9838f854d10be8cf3c10a5",
+					details: {
+						family: "llama",
+						families: ["llama"],
+						format: "gguf",
+						parameter_size: "23.6B",
+						parent_model: "",
+						quantization_level: "Q4_K_M",
+					},
+				},
+			],
+		})
+		const makeOllamaShowPayload = () => ({
+			license: "Mock License",
+			modelfile: "FROM /path/to/blob\nTEMPLATE {{ .Prompt }}",
+			parameters: "num_ctx 4096\nstop_token <eos>",
+			template: "{{ .System }}USER: {{ .Prompt }}ASSISTANT:",
+			modified_at: "2025-06-03T09:23:22.610222878-04:00",
+			details: {
+				parent_model: "",
+				format: "gguf",
+				family: "llama",
+				families: ["llama"],
+				parameter_size: "23.6B",
+				quantization_level: "Q4_K_M",
+			},
+			model_info: {
+				"ollama.context_length": 4096,
+				"some.other.info": "value",
+			},
+			capabilities: ["completion", "tools"], // Has tools capability
+		})
+
+		it("should omit the Authorization header for a remote HTTP endpoint", async () => {
+			const baseUrl = "http://ollama.example.com:11434"
+			const apiKey = "test-api-key-123"
+
+			mockedAxios.get.mockResolvedValueOnce({ data: { models: [] } })
+
+			const result = await getOllamaModels(baseUrl, apiKey)
+
+			expect(mockedAxios.get).toHaveBeenCalledTimes(1)
+			expect(mockedAxios.get).toHaveBeenCalledWith(`${baseUrl}/api/tags`, { headers: {} })
+			expect(result).toEqual({})
+		})
+
+		it("should include the Authorization header for an HTTPS endpoint", async () => {
+			const baseUrl = "https://ollama.example.com:11434"
+			const apiKey = "test-api-key-123"
+
+			mockedAxios.get.mockResolvedValueOnce({ data: { models: [] } })
+
+			const result = await getOllamaModels(baseUrl, apiKey)
+
+			expect(mockedAxios.get).toHaveBeenCalledTimes(1)
+			expect(mockedAxios.get).toHaveBeenCalledWith(`${baseUrl}/api/tags`, {
+				headers: { Authorization: `Bearer ${apiKey}` },
+			})
+			expect(result).toEqual({})
+		})
+
+		it.each(["http://localhost:11434", "http://[::1]:11434"])(
+			"should send the Authorization header and disable proxy routing for a loopback endpoint %s",
+			async (baseUrl) => {
+				const apiKey = "test-api-key-123"
+				const modelName = "devstral2to16:latest"
+
+				mockedAxios.get.mockResolvedValueOnce({ data: makeOllamaTagsPayload(modelName) })
+				mockedAxios.post.mockResolvedValueOnce({ data: makeOllamaShowPayload() })
+
+				const result = await getOllamaModels(baseUrl, apiKey)
+
+				// A cleartext loopback request carrying the bearer token must not
+				// be routed through any HTTP proxy, otherwise the proxy would see
+				// the credential in cleartext (CWE-319). Both requests bypass the
+				// proxy. The IPv6 loopback [::1] is treated the same as the IPv4
+				// loopback: the credential is attached and proxy routing is
+				// disabled.
+				const expectedHeaders = { Authorization: `Bearer ${apiKey}` }
+				expect(mockedAxios.get).toHaveBeenCalledTimes(1)
+				expect(mockedAxios.get).toHaveBeenCalledWith(`${baseUrl}/api/tags`, {
+					headers: expectedHeaders,
+					proxy: false,
+				})
+
+				expect(mockedAxios.post).toHaveBeenCalledTimes(1)
+				expect(mockedAxios.post).toHaveBeenCalledWith(
+					`${baseUrl}/api/show`,
+					{ model: modelName },
+					{
+						headers: expectedHeaders,
+						proxy: false,
+					},
+				)
+
+				expect(typeof result).toBe("object")
+				expect(Object.keys(result).length).toBe(1)
+				expect(result[modelName]).toBeDefined()
+			},
+		)
+
 		it("should fetch model list from /api/tags and include models with tools capability", async () => {
 			const baseUrl = "http://localhost:11434"
 			const modelName = "devstral2to16:latest"
@@ -336,61 +504,25 @@ describe("Ollama Fetcher", () => {
 			const apiKey = "test-api-key-123"
 			const modelName = "test-model:latest"
 
-			const mockApiTagsResponse = {
-				models: [
-					{
-						name: modelName,
-						model: modelName,
-						modified_at: "2025-06-03T09:23:22.610222878-04:00",
-						size: 14333928010,
-						digest: "6a5f0c01d2c96c687d79e32fdd25b87087feb376bf9838f854d10be8cf3c10a5",
-						details: {
-							family: "llama",
-							families: ["llama"],
-							format: "gguf",
-							parameter_size: "23.6B",
-							parent_model: "",
-							quantization_level: "Q4_K_M",
-						},
-					},
-				],
-			}
-			const mockApiShowResponse = {
-				license: "Mock License",
-				modelfile: "FROM /path/to/blob\nTEMPLATE {{ .Prompt }}",
-				parameters: "num_ctx 4096\nstop_token <eos>",
-				template: "{{ .System }}USER: {{ .Prompt }}ASSISTANT:",
-				modified_at: "2025-06-03T09:23:22.610222878-04:00",
-				details: {
-					parent_model: "",
-					format: "gguf",
-					family: "llama",
-					families: ["llama"],
-					parameter_size: "23.6B",
-					quantization_level: "Q4_K_M",
-				},
-				model_info: {
-					"ollama.context_length": 4096,
-					"some.other.info": "value",
-				},
-				capabilities: ["completion", "tools"], // Has tools capability
-			}
-
-			mockedAxios.get.mockResolvedValueOnce({ data: mockApiTagsResponse })
-			mockedAxios.post.mockResolvedValueOnce({ data: mockApiShowResponse })
+			mockedAxios.get.mockResolvedValueOnce({ data: makeOllamaTagsPayload(modelName) })
+			mockedAxios.post.mockResolvedValueOnce({ data: makeOllamaShowPayload() })
 
 			const result = await getOllamaModels(baseUrl, apiKey)
 
 			const expectedHeaders = { Authorization: `Bearer ${apiKey}` }
-
+			// Cleartext loopback + bearer token: the fetcher also disables proxy
+			// routing on both requests (CWE-319).
 			expect(mockedAxios.get).toHaveBeenCalledTimes(1)
-			expect(mockedAxios.get).toHaveBeenCalledWith(`${baseUrl}/api/tags`, { headers: expectedHeaders })
+			expect(mockedAxios.get).toHaveBeenCalledWith(`${baseUrl}/api/tags`, {
+				headers: expectedHeaders,
+				proxy: false,
+			})
 
 			expect(mockedAxios.post).toHaveBeenCalledTimes(1)
 			expect(mockedAxios.post).toHaveBeenCalledWith(
 				`${baseUrl}/api/show`,
 				{ model: modelName },
-				{ headers: expectedHeaders },
+				{ headers: expectedHeaders, proxy: false },
 			)
 
 			expect(typeof result).toBe("object")

src/api/providers/fetchers/ollama.ts

@@ -64,6 +64,48 @@ export const parseOllamaModel = (rawModel: OllamaModelInfoResponse): ModelInfo |
 	return modelInfo
 }
 
+/**
+ * Determines whether an Ollama endpoint is safe to carry an API key.
+ *
+ * Ollama's default installation listens on loopback, where plaintext HTTP is
+ * the norm. API keys are secrets, though, and must not be sent in cleartext to
+ * a remote host (CWE-319). Only HTTPS or a loopback host is considered safe
+ * enough to attach the Authorization header.
+ *
+ * Shared by the axios fetcher (getOllamaModels) and the native provider
+ * (NativeOllamaHandler), so this strict check gates credentials on both paths.
+ */
+export function isSecureOllamaEndpoint(baseUrl: string): boolean {
+	if (!URL.canParse(baseUrl)) {
+		return false
+	}
+	const url = new URL(baseUrl)
+	if (url.protocol === "https:") {
+		return true
+	}
+	const host = url.hostname
+	return host === "localhost" || host === "[::1]" || isIpv4LoopbackHost(host)
+}
+
+/**
+ * Strict 127.0.0.0/8 IPv4-loopback literal check. `host` comes from
+ * `URL.hostname`, which is WHATWG-normalized (IPv4 literals carry no brackets
+ * and no leading zeros), so the anchored octet check is exact. A loose
+ * /^127\./ prefix would also match DNS names like `127.example.com`, letting
+ * the key leak over cleartext HTTP (CWE-319).
+ */
+export function isIpv4LoopbackHost(host: string): boolean {
+	const octets = host.split(".")
+	if (octets.length !== 4) {
+		return false
+	}
+	if (!octets.every((octet) => /^\d{1,3}$/.test(octet))) {
+		return false
+	}
+	const values = octets.map((octet) => Number(octet))
+	return values[0] === 127 && values.every((value) => value <= 255)
+}
+
 export async function getOllamaModels(
 	baseUrl = "http://localhost:11434",
 	apiKey?: string,
@@ -79,13 +121,28 @@ export async function getOllamaModels(
 			return models
 		}
 
-		// Prepare headers with optional API key
+		// Prepare headers with optional API key. The credential is only attached
+		// when the endpoint is HTTPS or loopback; sending it over plaintext HTTP
+		// to a remote host would leak it (CWE-319).
+		const credentialGated = Boolean(apiKey && isSecureOllamaEndpoint(baseUrl))
 		const headers: Record<string, string> = {}
-		if (apiKey) {
+		if (credentialGated) {
 			headers["Authorization"] = `Bearer ${apiKey}`
 		}
 
-		const response = await axios.get<OllamaModelsResponse>(`${baseUrl}/api/tags`, { headers, signal: opts?.signal })
+		// A loopback HTTP endpoint carrying the key must bypass any HTTP proxy,
+		// otherwise the proxy would see the bearer token in cleartext (CWE-319).
+		// HTTPS endpoints keep normal proxy behavior (traffic stays encrypted).
+		// Parsing is safe here: baseUrl is normalized ("" → default) above and
+		// the !URL.canParse(baseUrl) guard returned early.
+		const cleartextLoopback = credentialGated && new URL(baseUrl).protocol === "http:"
+		const proxyConfig: { proxy?: false } = cleartextLoopback ? { proxy: false } : {}
+
+		const response = await axios.get<OllamaModelsResponse>(`${baseUrl}/api/tags`, {
+			headers,
+			...proxyConfig,
+			signal: opts?.signal,
+		})
 		const parsedResponse = OllamaModelsResponseSchema.safeParse(response.data)
 		const modelInfoPromises = []
 
@@ -98,7 +155,7 @@ export async function getOllamaModels(
 							{
 								model: ollamaModel.model,
 							},
-							{ headers, signal: opts?.signal },
+							{ headers, ...proxyConfig, signal: opts?.signal },
 						)
 						.then((ollamaModelInfo) => {
 							const modelInfo = parseOllamaModel(ollamaModelInfo.data)