mudler's LocalAI [bot]andEttore Di Giacinto 0ab632b6bd fix(auth): protect HTTP routes by default (#11602) ...

* fix(auth): default to protected HTTP routes

Use a method-aware registry for the small anonymous bootstrap surface.
Unknown routes now require credentials instead of inheriting fail-open
path classification.

Keep node self-service routes behind their registration-token middleware.
Global auth no longer rejects valid worker credentials first.

Assisted-by: Codex:gpt-5

* docs(auth): document public HTTP surface

Assisted-by: Codex:gpt-5

* test(auth): align route coverage with default denial

Assisted-by: Codex:gpt-5

---------

Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-08-19 20:49:19 +02:00

..

gen_inference_defaults

security(http): refuse redirects on outbound clients via hardened pkg/httpclient (#10087)

2026-05-30 12:04:10 +02:00

meta

feat(chat): add end-to-end context compression (#11556)

2026-08-18 11:31:03 +00:00

application_artifact_materializer_test.go

feat(modelartifacts): support bounded parallel Hugging Face file downloads (#11162)

2026-08-07 18:00:45 +02:00

application_config_test.go

feat(vram): per-node VRAM allocation budget (LOCALAI_VRAM_BUDGET) (#10833)

2026-07-15 09:58:45 +02:00

application_config.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

backend_capabilities_test.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

backend_capabilities.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

backend_hooks.go

feat(vllm): parity with llama.cpp backend (#9328)

2026-04-13 11:00:29 +02:00

chat_template_kwargs_test.go

feat: generic chat_template_kwargs (model config + per-request metadata) (#10359)

2026-06-16 12:16:34 +02:00

config_suite_test.go

dependencies(grpcio): bump to fix CI issues (#2362)

2024-05-21 14:33:47 +02:00

context_fit_internal_test.go

fix(config): cap auto-derived context to fit VRAM (#10696)

2026-07-06 12:53:45 +02:00

context_fit.go

fix(config): cap auto-derived context to fit VRAM (#10696)

2026-07-06 12:53:45 +02:00

defaults.go

fix(config): cap auto-derived context to fit VRAM (#10696)

2026-07-06 12:53:45 +02:00

disk_headroom_setting_test.go

fix(nodes): never schedule a model onto a node that cannot store it (#11054)

2026-07-23 00:03:21 +02:00

distributed_config_test.go

fix(distributed): configurable remote model-load timeout, and reap the load when it times out (#10948)

2026-07-19 12:01:48 +02:00

distributed_config.go

fix(distributed): run cold model loads as durable jobs instead of holding the advisory lock (#11514)

2026-08-15 13:20:11 +02:00

gallery_test.go

feat(gallery): fall back to mirrors and a cached index when the primary source fails (#11389)

2026-08-06 17:56:36 +02:00

gallery.go

feat(gallery): fall back to mirrors and a cached index when the primary source fails (#11389)

2026-08-06 17:56:36 +02:00

generic_defaults_test.go

feat(config): prefix caching default + consolidate scattered defaults (#10415)

2026-06-20 22:44:44 +02:00

generic_defaults.go

feat(config): prefix caching default + consolidate scattered defaults (#10415)

2026-06-20 22:44:44 +02:00

gguf_media_marker_test.go

fix(vision): probe the media marker for pinned llama.cpp backend variants (#10955)

2026-07-19 12:46:50 +02:00

gguf_reasoning_test.go

Respect explicit reasoning config during GGUF thinking probe (#9463)

2026-04-21 21:53:10 +02:00

gguf.go

feat(llama-cpp): serve Qwen3-TTS through the llama.cpp backend (#11392)

2026-08-10 10:18:47 +02:00

hardware_defaults_internal_test.go

fix(llama-cpp): cap single-pass embedding batch to fit VRAM (#10695)

2026-07-06 12:56:09 +02:00

hardware_defaults_test.go

fix(config): only inject llama.cpp serving options on the llama.cpp path (#10822)

2026-07-14 17:46:15 +02:00

hardware_defaults.go

fix(config): only inject llama.cpp serving options on the llama.cpp path (#10822)

2026-07-14 17:46:15 +02:00

hooks_llamacpp.go

feat(config): context_size: -1 to auto-use model's full trained context (#10752)

2026-07-09 09:03:40 +02:00

hooks_test.go

fix(vllm): apply Options[] engine flags before engine init (#11147)

2026-07-30 12:13:00 +02:00

hooks_vllm.go

fix(vllm): apply Options[] engine flags before engine init (#11147)

2026-07-30 12:13:00 +02:00

inference_defaults_test.go

feat: inferencing default, automatic tool parsing fallback and wire min_p (#9092)

2026-03-22 00:57:15 +01:00

inference_defaults.go

feat: inferencing default, automatic tool parsing fallback and wire min_p (#9092)

2026-03-22 00:57:15 +01:00

inference_defaults.json

chore: bump inference defaults from unsloth (#11270)

2026-08-12 09:12:12 +02:00

mitm_host_owners_test.go

feat(middleware): Model routing, PII filtering, Cloud model proxies (#9802)

2026-05-25 09:28:27 +02:00

model_artifact_binding_test.go

fix(model-artifacts): persist companion artifacts so remote workers get the base_model option (#11075)

2026-07-23 16:50:50 +02:00

model_artifact_binding.go

fix(model-artifacts): persist companion artifacts so remote workers get the base_model option (#11075)

2026-07-23 16:50:50 +02:00

model_artifact_companion_test.go

fix(model-artifacts): materialize longcat-video on the controller, and support companion repos (#10949)

2026-07-19 12:01:36 +02:00

model_artifact_fallback_test.go

fix(modelartifacts): treat CIFS EACCES as lock contention, not failure (#10986)

2026-07-20 22:12:39 +02:00

model_artifact_inference_test.go

fix(model-artifacts): materialize longcat-video on the controller, and support companion repos (#10949)

2026-07-19 12:01:36 +02:00

model_artifact_inference.go

fix(modelartifacts): treat CIFS EACCES as lock contention, not failure (#10986)

2026-07-20 22:12:39 +02:00

model_capabilities_test.go

feat(llama-cpp): serve Qwen3-TTS through the llama.cpp backend (#11392)

2026-08-10 10:18:47 +02:00

model_capabilities.go

feat(llama-cpp): serve Qwen3-TTS through the llama.cpp backend (#11392)

2026-08-10 10:18:47 +02:00

model_config_filter.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

model_config_loader_companion_test.go

fix(model-artifacts): persist companion artifacts so remote workers get the base_model option (#11075)

2026-07-23 16:50:50 +02:00

model_config_loader_resolve_test.go

feat(classifier/VAD): support voice control on low power devices (#10804)

2026-07-29 12:50:22 +02:00

model_config_loader_test.go

feat: materialize Hugging Face model artifacts (#10825)

2026-07-15 01:09:33 +02:00

model_config_loader.go

feat(classifier/VAD): support voice control on low power devices (#10804)

2026-07-29 12:50:22 +02:00

model_config_test.go

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

model_config.go

feat(chat): add end-to-end context compression (#11556)

2026-08-18 11:31:03 +00:00

model_load_budget_test.go

fix(distributed): scale the remote model-load deadline with checkpoint size (#11030)

2026-07-22 09:30:23 +02:00

model_load_budget.go

fix(distributed): scale the remote model-load deadline with checkpoint size (#11030)

2026-07-22 09:30:23 +02:00

model_test.go

fix(tests): inline model_test fixtures after tests/models_fixtures removal

2026-04-28 12:58:49 +00:00

mtp_test.go

feat(llama-cpp): serve Qwen3-TTS through the llama.cpp backend (#11392)

2026-08-10 10:18:47 +02:00

mtp.go

fix(mtp): don't auto-enable self-spec MTP for draft-only assistant GGUFs (#10208)

2026-06-07 22:09:02 +02:00

parser_defaults.json

feat(vllm): parity with llama.cpp backend (#9328)

2026-04-13 11:00:29 +02:00

pipeline_streaming_test.go

feat(realtime): stream the LLM / TTS / transcription pipeline stages (#10176)

2026-06-11 08:43:12 +01:00

pipeline_turn_detection_test.go

feat(realtime): Semantic VAD EOU token (#10444)

2026-06-30 09:01:22 +02:00

pooling_config_test.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

reasoning_effort_test.go

feat: forward reasoning_effort to the backend so jinja models honor it (#10184)

2026-06-05 13:45:43 +00:00

router_knn_config_test.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

runtime_settings_persist_test.go

refactor(settings): single declarative registry for runtime settings (fixes the #10845 bug class) (#10864)

2026-07-16 22:39:59 +02:00

runtime_settings_persist.go

refactor(settings): single declarative registry for runtime settings (fixes the #10845 bug class) (#10864)

2026-07-16 22:39:59 +02:00

runtime_settings_registry_internal_test.go

feat(modelartifacts): support bounded parallel Hugging Face file downloads (#11162)

2026-08-07 18:00:45 +02:00

runtime_settings_registry.go

feat(modelartifacts): support bounded parallel Hugging Face file downloads (#11162)

2026-08-07 18:00:45 +02:00

runtime_settings_startup_test.go

feat(gallery): default to index.localai.io with GitHub as a mirror (#11409)

2026-08-07 09:19:49 +02:00

runtime_settings_startup.go

feat(modelartifacts): support bounded parallel Hugging Face file downloads (#11162)

2026-08-07 18:00:45 +02:00

runtime_settings.go

feat(modelartifacts): support bounded parallel Hugging Face file downloads (#11162)

2026-08-07 18:00:45 +02:00

serving_defaults_test.go

fix(config): only inject llama.cpp serving options on the llama.cpp path (#10822)

2026-07-14 17:46:15 +02:00

serving_defaults.go

fix(config): only inject llama.cpp serving options on the llama.cpp path (#10822)

2026-07-14 17:46:15 +02:00

vllm_spec_test.go

feat(vllm-cpp): wire the full engine config surface through engine_args (#11159)

2026-08-06 12:10:56 +02:00

vllm_spec.go

feat(vllm-cpp): wire the full engine config surface through engine_args (#11159)

2026-08-06 12:10:56 +02:00

voice_gate_test.go

feat(realtime): speaker-aware conversations - surface identity to client and LLM (#10424)

2026-06-21 21:07:10 +02:00