fix: keep LiteLLM default local

[jbg]

Summary

• use one localhost LiteLLM default for runtime construction and provider metadata
• preserve explicitly configured proxy hosts
• add a no-network regression for missing and explicit host configuration

Addresses https://github.com/project-loupe/audit-goose/issues/82.

Security boundary

Selecting LiteLLM without an explicit host must not send bearer credentials, model inventory, or conversation data to a remote service the operator did not choose. The advertised local proxy remains the runtime default.

Verification

• bin/cargo fmt
• bin/cargo test -p goose --test litellm_default_host
• bin/cargo build -p goose
• bin/cargo clippy --all-targets -- -D warnings

This finding was discovered by Project Loupe.

[DOsinga]

Thanks for identifying and addressing this LiteLLM default-host mismatch. The security boundary and regression test are useful context.

Goose uses an issue-first workflow for external contributions: proposed work should begin with an issue in the Goose repository and reach the project’s Ready status before implementation. The linked Project Loupe finding documents the problem well, but it is not a Goose issue on the Goose Issues board.

Could you please convert this proposal into a Goose issue describing the problem and desired behavior? Useful details to carry over include the mismatch between the provider metadata and runtime fallback, the risk of sending credentials or conversation data to an unselected remote host, the requirement to preserve explicitly configured proxy hosts, and a no-network verification plan for both missing and explicit host configuration. These details can inform the discussion without treating the current implementation as an already agreed design.

Once the issue has been reviewed and reaches Ready, this PR can be linked to it and implementation review can continue. We’ll snooze the PR for two days while that happens. Thanks!