security: restrict bearer authentication over plaintext HTTP to loopback

[RaviTharuma]

Problem

The plugin accepts any http: CLIProxyAPI URL and transmits the bearer credential to it. Plain HTTP is reasonable for a loopback development endpoint, but it is unsafe for a remote host.

Evidence

• src/plugin.ts:249-269 accepts both http: and https: without checking whether an HTTP host is loopback.
• src/model-fetcher.ts:28-52 sends Authorization: Bearer <apiKey> during model discovery.
• src/plugin.ts:458-492 attaches the bearer token to intercepted inference requests under that base URL.

For example, this configuration is accepted:

{
  "provider": {
    "cliproxy": {
      "options": {
        "baseURL": "http://proxy.example/v1"
      }
    }
  }
}

The API key and subsequent model traffic then traverse the network without transport encryption or server authentication.

Impact

An on-path attacker can observe or modify:

• the CLIProxyAPI bearer credential,
• model catalog responses,
• prompts and model responses,
• tool-call payloads and other inference metadata.

This is especially easy to miss because the plugin's default URL uses localhost HTTP, which makes http: appear generally supported.

Recommended behavior

• Permit plain HTTP only for loopback targets such as:
  • localhost and its subdomains only if deliberately supported,
  • IPv4 127.0.0.0/8,
  • IPv6 ::1.
• Require HTTPS for all other hosts.
• If remote HTTP must remain possible, gate it behind an explicit option such as allowInsecureRemoteHttp: true and emit a prominent warning.
• Validate the final URL after normalization and add tests covering localhost, IPv4/IPv6 loopback, private LAN IPs, and public hostnames.

This issue is independent of #4: even a credential intentionally configured for a remote endpoint should not silently be sent over plaintext HTTP.