Server panics with "Invalid or missing API key" and crash-loops when using ollama/completion with api_key configured

[MetalKnight]

Environment
● Tabby v0.32.0, self-hosted via Docker (official tabbyml/tabby:latest image)
● Inference backend: external ollama server (AMD Lemonade Server, NPU backend)
● Model: Qwen2.5-Coder-1.5B-Instruct-NPU
● Client: VS Code extension TabbyML.vscode-tabby v1.28.0, tabby-agent v1.9.0-dev

Config (config.toml)

[model.completion.http]
kind = "ollama/completion"
model_name = "Qwen2.5-Coder-1.5B-Instruct-NPU"
api_endpoint = "http://<host>:13305"
api_key = "***"
prompt_template = "<|fim_prefix|>{prefix}<|fim_suffix|>{suffix}<|fim_middle|>"

Actual behavior
The container panics immediately and enters a continuous crash/restart loop:

The application panicked (crashed).
Message: called `Result::unwrap()` on an `Err` value: An error occurred with
ollama-rs: {"error": "Invalid or missing API key"}
Location: crates/ollama-api-bindings/src/completion.rs:66

The panic recurs on every restart attempt, making kind = "ollama/completion" completely unusable whenever the backend requires bearer-token authentication (confirmed working correctly for the same backend/model when tested directly via curl with the same API key against /api/generate).

Reproduction steps

1. Configure model.completion.http with kind = "ollama/completion" and a non-empty api_key, pointed at any Ollama-API-compatible backend that requires bearer-token auth.
2. Start the Tabby server.
3. Observe immediate panic on first completion request attempt, followed by a crash-restart loop.

Workaround
Removing api_key (if the backend allows unauthenticated access) avoids the crash, but is not viable for backends that enforce authentication.

[MilkyWay008]

Pretty sure that panic is a Tabby bug, the ollama-api-bindings unwraps the auth error instead of propagating it, so any Ollama endpoint enforcing a key will crash-loop it. Confirm with docker logs for the backtrace and test from inside the container (docker exec <container> curl -s http://<host>:13305/api/generate) in case host routing is involved. Also replay the auth call with curl -v to compare the header Tabby sends vs what Lemonade expects, sometimes it's a bearer-vs-custom mismatch. Oh also, btw, I built a portable Hermes OTG and I run it on USB as my rescue agent, super handy doing quick diagnose & fix, check it, imo it'll help you. https://github.com/MilkyWay008/Hermes-OTG