How SecureDesign Establishes and Manages Connections with Local AI Models (LM Studio and Ollama)

SecureDesign treats LM Studio and Ollama as provider implementations of the abstract AIProvider interface, storing their configuration in VS Code's secret storage via SecureStorageService, and instantiating them through the getSdkLanguageModel function which returns a standardized LanguageModelV2 object for streaming text.

The SecureDesign VS Code extension enables developers to interact with locally-hosted AI models through a unified provider architecture. By abstracting LM Studio and Ollama behind a common interface defined in src/providers/types.ts, the extension seamlessly integrates local inference engines into its agentic workflow without requiring API-key credentials.

The Provider Abstraction Layer

In src/providers/types.ts, SecureDesign defines an abstract AIProvider class that standardizes how all model providers interact with the extension. For local providers, the hasCredentials method (lines 70-76) returns true unconditionally, eliminating the need for API keys while maintaining interface consistency. This abstraction allows the CustomAgentService to treat local and remote providers identically when orchestrating chat requests.

Credential Handling for Local Models

Unlike cloud providers that require authentication tokens, LM Studio and Ollama connections rely solely on base URL configuration. The AIProvider.hasCredentials implementation signals that these providers are always "authenticated" by virtue of running locally, bypassing the secret key validation required for services like OpenAI or Anthropic.

Secure Configuration Storage

When users add a local provider through the "+ Add Model Provider" UI, SecureDesign persists settings using the SecureStorageService class defined in src/services/secureStorageService.ts. This wrapper encrypts and stores the provider's base URL and optional API key within VS Code's built-in secret storage, ensuring sensitive connection details never reside in plaintext configuration files.

Storage Implementation Details

The SecureStorageService implements a StorageAdapter interface with set and get methods that serialize configuration objects as JSON strings. For Ollama, the storage key "ollama" maps to a record containing baseUrl and optionally apiKey, while LM Studio uses the key "lmstudio" with similar structure.

// src/services/secureStorageService.ts
export class SecureStorageService implements StorageAdapter {
  constructor(private readonly secrets: vscode.SecretStorage) {}

  async set(key: string, value: Record<string, string>) {
    await this.secrets.store(key, JSON.stringify(value));
  }

  async get(key: string) {
    const raw = await this.secrets.get(key);
    return raw ? JSON.parse(raw) : undefined;
  }
}

Model Instantiation and Streaming

During active chat sessions, CustomAgentService.query (in src/services/customAgentService.ts) instantiates the actual model object by invoking getSdkLanguageModel(this.storage) from the ai-sdk-react-model-picker library. This function retrieves the encrypted configuration from SecureStorageService, dynamically loads the appropriate provider plugin—either ollama-ai-provider-v2 for Ollama or the LM Studio provider—and returns a LanguageModelV2 instance compatible with the Vercel AI SDK.

The Streaming Pipeline

Once instantiated, the local model connects through a unified streaming interface. The extension calls streamText with the LanguageModelV2 object, enabling real-time token generation from localhost endpoints exactly as it would for remote APIs.

// src/services/customAgentService.ts
import { getSdkLanguageModel } from 'ai-sdk-react-model-picker';

const model: LanguageModelV2 = await getSdkLanguageModel(this.storage);

const result = streamText({
  model,
  system: this.getSystemPrompt(),
  messages: conversationHistory,
  tools, // File/write/edit tools enabled if supported
  abortSignal: abortController.signal,
});

Required Configuration Parameters

SecureDesign requires specific environment variables to establish localhost connections, configured through the provider addition UI and stored securely.

• LM Studio: Requires LMSTUDIO_BASE_URL (default: http://localhost:1234/v1)
• Ollama: Requires OLLAMA_BASE_URL (default: http://localhost:11434/api), with optional OLLAMA_API_KEY for authenticated local instances

Tool Calling Integration

When a local model advertises supportsToolCalling through its provider metadata, CustomAgentService automatically enables the extension's full tool-calling workflow. This capability allows locally-hosted models to execute file operations, code edits, and other agentic actions using the same tools parameter passed to streamText, regardless of whether the inference runs locally or in the cloud.

Summary

• SecureDesign unifies local and remote AI providers behind the abstract AIProvider interface defined in src/providers/types.ts.
• Local model configurations persist in VS Code's encrypted secret storage via SecureStorageService, eliminating plaintext credential exposure.
• The getSdkLanguageModel function from the ai-sdk-react-model-picker library handles dynamic provider plugin loading for both LM Studio and Ollama.
• Connection parameters require only base URL configuration (defaulting to standard localhost ports), with optional API keys for authenticated local setups.
• Local models integrate fully with SecureDesign's tool-calling capabilities when they expose supportsToolCalling metadata.

Frequently Asked Questions

Does SecureDesign require API keys for LM Studio or Ollama?

No. According to the source code in src/providers/types.ts, the hasCredentials method returns true for all local providers, eliminating API key requirements. However, Ollama supports optional authentication via OLLAMA_API_KEY if your local instance requires it.

How does SecureDesign store connection details for local models?

The extension uses SecureStorageService (implemented in src/services/secureStorageService.ts) to encrypt and store base URLs and optional keys within VS Code's native secret storage, ensuring connection details remain secure and separate from workspace settings.

Can local models use the same tools as cloud providers in SecureDesign?

Yes. When a local model advertises supportsToolCalling, the CustomAgentService passes the same tools array to streamText regardless of provider type, enabling file operations and code editing through LM Studio or Ollama endpoints.

What library handles the actual connection to Ollama and LM Studio?

SecureDesign leverages the ai-sdk-react-model-picker library's getSdkLanguageModel function, which dynamically loads provider-specific plugins like ollama-ai-provider-v2 (listed in package.json) to establish the connection and return a standardized LanguageModelV2 object.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}