fix(completions): reject empty PromptStrings in streaming to avoid index-out-of-range panic

[Anai-Guo]

What / why

CompletionEndpoint's streaming branch (core/http/endpoints/openai/completion.go) only guarded len(config.PromptStrings) > 1 before unconditionally reading config.PromptStrings[0]:

if len(config.PromptStrings) > 1 {
    return errors.New("cannot handle more than 1 `PromptStrings` when Streaming")
}
...
predInput := config.PromptStrings[0]   // panics when len == 0

A completion request to /v1/completions (streaming) whose prompt field is an empty array, an array of non-strings, or omitted entirely leaves config.PromptStrings with length 0. The > 1 guard passes, and PromptStrings[0] then panics with index out of range [0] with length 0, crashing the handler goroutine.

Fix

Guard for exactly one prompt string. len != 1 now returns a clean error for the empty case as well as the pre-existing multi-prompt case — a minimal, behavior-preserving change (a well-formed single-prompt streaming request is unaffected).

if len(config.PromptStrings) != 1 {
    return errors.New("streaming completions require exactly 1 `PromptStrings`")
}

Fixes #11021.

🤖 Generated with Claude Code

[localai-org-maint-bot]

The length guard prevents the panic, but returning a plain errors.New makes Echo respond with HTTP 500 for all three reported malformed inputs. I reproduced this against the PR head with e2e cases for an omitted prompt, prompt: [], and prompt: [1,2,3]; each still returned 500, while issue #11021 requires a 400 validation response. Please return echo.NewHTTPError(http.StatusBadRequest, "streaming completions require exactly one prompt string") before setting the SSE response headers, and add regression coverage for those three payloads. With that change, the focused e2e regression passes 3/3 locally. I prepared and verified the minor patch locally, but cannot push a new commit under your DCO sign-off; you need to apply/sign it.

[Anai-Guo]

Thanks for the detailed reproduction. Fixed in ba82146:

• The guard now returns echo.NewHTTPError(http.StatusBadRequest, "streaming completions require exactly one prompt string") before any SSE headers are written, so an omitted prompt, prompt: [], and prompt: [1,2,3] all resolve to a 400 validation response instead of a 500 on a half-opened event stream.
• Extracted the check into validateStreamingPromptStrings and added completion_stream_validation_test.go with table-driven regression coverage for the three reported payloads plus the happy path (exactly one prompt string).

🤖 Generated with Claude Code

[localai-org-maint-bot]

@mudler this is good to merge. The author addressed the requested validation path exactly: malformed streaming prompts now return an Echo HTTP 400 before SSE headers are written, with Ginkgo regression coverage for nil, empty, multiple, and single prompts. Fresh local verification: go test ./core/http/endpoints/openai -run TestOpenAI -count=1 passes.