feat(api): abort signal support for native-ollama (completePrompt + createMessage)

packages/config-eslint/api-provider-hygiene.js

@@ -0,0 +1,37 @@
+// Guards for repeat review findings in src/api. Built-in no-restricted-syntax only: no custom rule code.
+// Sources: shared helpers live in src/api/providers/utils/abort-signal.ts.
+// Paths are relative to the `src` package, where this config is loaded.
+
+const sharedAbortHelpers =
+	"mergeAbortSignalAndTimeout|mergeAbortSignals|throwIfAborted|isRequestAborted|createAbortError|rejectOnAbort|resolveModelWithAbort"
+
+// Names that usually hold a secret or an endpoint that can embed credentials.
+// `cacheKey` and `contextTokens` must not match.
+const sensitiveName = "^(url|apiKey|secret|password)$|(Url|URL|ApiKey|Secret|Token)$"
+
+export const apiProviderHygieneSelectors = [
+	{
+		selector: `:matches(FunctionDeclaration, VariableDeclarator)[id.name=/^(${sharedAbortHelpers})$/]`,
+		message: "Import this helper from providers/utils/abort-signal instead of declaring a local copy.",
+	},
+	{
+		selector:
+			"CallExpression[callee.object.name='AbortSignal'][callee.property.name='timeout']:not([arguments.0.type='Literal']):not([arguments.0.name=/^[A-Z][A-Z0-9_]*$/])",
+		message:
+			"Use mergeAbortSignalAndTimeout for a variable delay. AbortSignal.timeout throws on Infinity and fractions, and clamps large values to 1 ms.",
+	},
+	{
+		selector: `CallExpression[callee.object.name='console'] TemplateLiteral > :matches(Identifier[name=/${sensitiveName}/], MemberExpression[property.name=/${sensitiveName}/])`,
+		message:
+			"Do not log a URL, key, secret or token. A base URL can embed credentials or query secrets. Log the origin only.",
+	},
+]
+
+export const apiProviderHygieneConfig = {
+	files: ["api/**/*.ts"],
+	// The helper module owns the shared names. Tests build their own fixtures.
+	ignores: ["api/providers/utils/abort-signal.ts", "**/__tests__/**", "**/*.test.ts", "**/*.spec.ts"],
+	rules: {
+		"no-restricted-syntax": ["error", ...apiProviderHygieneSelectors],
+	},
+}

packages/config-eslint/api-provider-hygiene.test.js

@@ -0,0 +1,90 @@
+import assert from "node:assert/strict"
+import { describe, it } from "node:test"
+
+import { Linter } from "eslint"
+import typescriptEslint from "typescript-eslint"
+
+import { apiProviderHygieneConfig } from "./api-provider-hygiene.js"
+
+const linter = new Linter({ configType: "flat" })
+const config = [{ files: ["**/*.ts"], languageOptions: { parser: typescriptEslint.parser } }, apiProviderHygieneConfig]
+
+const lint = (code, filename = "api/providers/example.ts") =>
+	linter.verify(code, config, { filename }).map((message) => message.message)
+
+describe("api provider hygiene: shared abort helpers", () => {
+	for (const code of [
+		"function createAbortError(name: string) { return new Error(name) }",
+		"const rejectOnAbort = () => {}",
+		"async function resolveModelWithAbort() {}",
+	]) {
+		it(`flags a local copy: ${code}`, () => {
+			assert.equal(lint(code).length, 1)
+		})
+	}
+
+	it("allows importing the helper", () => {
+		assert.deepEqual(lint('import { createAbortError } from "./utils/abort-signal"\ncreateAbortError("x")'), [])
+	})
+
+	it("does not apply to the helper module", () => {
+		assert.deepEqual(lint("export function createAbortError() {}", "api/providers/utils/abort-signal.ts"), [])
+	})
+
+	it("does not apply to tests", () => {
+		assert.deepEqual(lint("function createAbortError() {}", "api/providers/__tests__/example.spec.ts"), [])
+	})
+
+	it("does not apply outside src/api", () => {
+		assert.deepEqual(lint("function createAbortError() {}", "services/example.ts"), [])
+	})
+})
+
+describe("api provider hygiene: AbortSignal.timeout", () => {
+	for (const code of [
+		"AbortSignal.timeout(timeoutMs)",
+		"AbortSignal.timeout(options.timeoutMs)",
+		"AbortSignal.timeout(seconds * 1000)",
+	]) {
+		it(`flags a variable delay: ${code}`, () => {
+			assert.equal(lint(code).length, 1)
+		})
+	}
+
+	for (const code of [
+		"AbortSignal.timeout(10_000)",
+		"AbortSignal.timeout(MODEL_CATALOG_FETCH_TIMEOUT_MS)",
+		"AbortSignal.any([a, b])",
+	]) {
+		it(`allows: ${code}`, () => {
+			assert.deepEqual(lint(code), [])
+		})
+	}
+})
+
+describe("api provider hygiene: sensitive values in logs", () => {
+	for (const code of [
+		"console.warn(`Error connecting at ${baseUrl}`)",
+		"console.warn(`Error connecting at ${this.options.ollamaBaseUrl}`)",
+		"console.error(`refresh failed for ${this._serverUrl}`)",
+		"console.log(`key ${apiKey}`)",
+		"console.log(`auth ${accessToken}`)",
+		"console.log(`from ${url}`)",
+	]) {
+		it(`flags: ${code}`, () => {
+			assert.equal(lint(code).length, 1)
+		})
+	}
+
+	for (const code of [
+		"console.error(`Error writing ${cacheKey} to disk`)",
+		"console.warn(`Current tokens: ${contextTokens}`)",
+		"console.warn(`Endpoint ${endpointOrigin} is not secure`)",
+		"const message = `at ${baseUrl}`",
+		'console.warn("static message")',
+	]) {
+		it(`allows: ${code}`, () => {
+			assert.deepEqual(lint(code), [])
+		})
+	}
+})

packages/config-eslint/package.json

@@ -6,10 +6,11 @@
 		"./base": "./base.js",
 		"./react": "./react.js",
 		"./next-js": "./next.js",
-		"./provider-identifiers": "./provider-identifiers.js"
+		"./provider-identifiers": "./provider-identifiers.js",
+		"./api-provider-hygiene": "./api-provider-hygiene.js"
 	},
 	"scripts": {
-		"test": "node --test provider-identifiers.test.js"
+		"test": "node --test provider-identifiers.test.js api-provider-hygiene.test.js"
 	},
 	"devDependencies": {
 		"@eslint/js": "9.39.4",