Commit Graph

2 Commits

Author SHA1 Message Date
Alpamys ba7a6b1ee1 fix: validate model name before ollama rm (security review finding)
Add validate_model_name() check in deploy --remove path to prevent
passing unsanitized names to ollama rm subprocess. Adds test coverage.
2026-04-01 13:51:15 +05:00
Alpamys f98519ef87 feat: add Ollama integration — deploy GGUF models in one command (v0.18.0)
New commands:
- `soup deploy ollama` — deploy GGUF to local Ollama with auto-template detection
- `soup deploy ollama --list` / `--remove` — manage Soup-deployed models
- `soup export --deploy ollama` — export + auto-deploy in one step

New files:
- soup_cli/utils/ollama.py — detect, deploy, list, remove, Modelfile generation
- soup_cli/commands/deploy.py — Typer command group with Rich panels
- tests/test_deploy_ollama.py — 78 tests covering all paths

Security hardening:
- GGUF path traversal protection + .gguf extension validation
- Model name validation (no path separators, null bytes)
- Modelfile parameter key allowlist prevents directive injection
- Parameter value newline/null sanitization
- Subprocess calls use list args (no shell injection)
- Warning panel before overwriting existing Ollama models

1449 tests, 57 test files, all passing.
2026-04-01 13:47:40 +05:00