fix(onboard): reuse reachable Windows-host Ollama

[sandl99]

Summary

Windows WSL express install now reuses a reachable Windows-host Ollama daemon when PowerShell cannot find its executable. Previously, the provider menu kept the install action and onboarding attempted an unnecessary reinstall.

Related Issue

Fixes #7472

Changes

• Suppress the Windows-host install action when Ollama already responds through host.docker.internal.
• Add provider-menu coverage for a reachable daemon whose executable is not detected.
• Add setup coordinator coverage that verifies express install selects the running Ollama provider.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The fix restores the documented Windows-host Ollama reuse behavior and changes no command, configuration, or user-facing text.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head security follow-up passed for 4b139ae77: fix(onboard): reuse reachable Windows-host Ollama #7476 (comment)
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Head 4b139ae77 adds only an empty signed CI-retry commit. Its tree and effective PR diff match reviewed head 35d0bac66. Existing WSL Ollama documentation covers the corrected behavior. Focused tests, CLI build, CLI type-check, check:diff, and git diff --check passed.
• Agent: Codex Desktop documentation writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project cli src/lib/onboard/provider-menu.test.ts src/lib/onboard/setup-nim-flow.test.ts src/lib/onboard/setup-nim-ollama.test.ts passed 41/41. npm run typecheck:cli, Biome, and the test-title check passed.
• Applicable broad gate passed — exact-head CI, E2E, PR Gate, and coordination passed for 4b139ae77 on base 5faed2cbc.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: San Dang sdang@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The onboarding provider menu now avoids offering Windows Ollama installation when an existing Windows-host Ollama is configured. Tests cover menu filtering and non-interactive reuse of the reachable host instance.

Changes

Windows-host Ollama onboarding

Layer / File(s)	Summary
Windows Ollama menu gating src/lib/onboard/provider-menu.ts, src/lib/onboard/provider-menu.test.ts	The install-windows-ollama option now requires WSL, no detected Windows Ollama, and !isWindowsHostOllama; a test covers the reachable-host scenario.
Non-interactive Ollama reuse src/lib/onboard/setup-nim-flow.test.ts, src/lib/onboard/setup-nim-ollama.test.ts	Tests verify that setup invokes the running-Ollama handler and uses the reachable Windows-host endpoint.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: hwangjohn

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address #7472 by reusing reachable host.docker.internal Ollama and skipping the install action when it is already available.
Out of Scope Changes check	✅ Passed	The diff stays focused on WSL Windows-host Ollama reuse and related tests, with no unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: reusing a reachable Windows-host Ollama during onboarding.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7472-wsl-ollama-reuse

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 4b139ae in the fix/7472-wsl-ollama-... branch remains at 96%, unchanged from commit 5faed2c in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 4b139ae in the fix/7472-wsl-ollama-... branch remains at 80%, unchanged from commit 5faed2c in the main branch.

Show a code coverage summary of the most impacted files.

File	main 5faed2c	fix/7472-wsl-ollama-... 4b139ae	+/-
src/lib/onboard...der-metadata.ts	100%	100%	0%
src/lib/onboard...rovider-menu.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/tunnel/services.ts	73%	73%	0%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 24, 2026 17:13 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 1 suggestion
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, the same number of warnings, 1 more suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[sandl99]

Security review: PASS

Commit b2f64f190 is safe to merge from a security perspective. The change reuses the existing typed Windows-host reachability state, preserves the Docker Desktop support check and downstream model validation, and introduces no credential, network-policy, dependency, or privilege change.

Findings

The review found no security findings.

Detailed analysis

1. PASS — Secrets and credentials: The diff adds no secret value, credential field, or credential-handling path.
2. PASS — Input validation and data sanitization: The changed condition consumes existing internal boolean host-state fields and parses no new user input.
3. PASS — Authentication and authorization: The diff adds no endpoint or authorization decision.
4. PASS — Dependencies and third-party libraries: The diff changes no dependency or package metadata.
5. PASS — Error handling and logging: The diff changes no error message or logging path.
6. PASS — Cryptography and data protection: The diff adds no cryptographic or stored-data behavior.
7. PASS — Configuration and security headers: The diff changes no runtime configuration, port exposure, container setting, or HTTP header.
8. PASS — Security testing: The tests cover the reachable Windows-host reuse path. Existing menu coverage still proves that a host with no reachable or detected Ollama offers installation.
9. PASS — System security: Reuse requires the existing isWindowsHostOllama state. The provider flow retains Docker Desktop support enforcement and downstream Ollama model validation.

Files reviewed

• src/lib/onboard/provider-menu.ts
• src/lib/onboard/provider-menu.test.ts
• src/lib/onboard/setup-nim-flow.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/setup-nim-flow.test.ts`:
- Around line 448-458: The test currently derives endpoint behavior from the
mocked handleRunningOllamaSelection implementation, so it cannot detect
regressions in production endpoint construction. Keep this test focused on
coordinator dispatch, and add or retain a public-boundary test that invokes the
real handler and asserts the observable provider and endpointUrl values,
including Windows-host reuse behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 03a27cb2-733c-4325-a8b6-58b56b27d071

📥 Commits

Reviewing files that changed from the base of the PR and between 46ecb86 and b2f64f1.

📒 Files selected for processing (3)

• src/lib/onboard/provider-menu.test.ts
• src/lib/onboard/provider-menu.ts
• src/lib/onboard/setup-nim-flow.test.ts

[sandl99]

Security review follow-up: PASS

Reviewed current head 020eac09b. The only change since the detailed security review is test restructuring: the coordinator test now asserts dispatch only, and a real-handler test asserts the Windows-host Ollama endpoint. Production code, dependencies, credentials, network policy, privileges, and runtime configuration are unchanged. All nine security categories remain PASS with no findings.

Detailed review: #7476 (comment)

[prekshivyas]

Exact-head security follow-up: PASS

Reviewed current head 35d0bac66 on base 5faed2cbc. The new commit only merges current main; the effective PR diff remains the same four onboarding source/test files reviewed at 020eac09b.

All nine security categories remain PASS with no findings:

1. No secrets or credential handling changed.
2. No new untrusted input or parsing was introduced.
3. No authentication or authorization decision changed.
4. No dependency changed.
5. No error or logging behavior changed.
6. No cryptography or stored-data behavior changed.
7. No runtime configuration, port exposure, container setting, or header changed.
8. Focused behavior coverage passed 41/41, including menu, coordinator, and real-handler endpoint coverage.
9. Reuse still depends on the existing typed Windows-host reachability state and retains downstream Docker support and model validation.

Additional exact-head evidence: CLI build and type-check passed, npm run check:diff passed, the branch is conflict-free, and all three commits are GitHub Verified.

Detailed original review: #7476 (comment)

[prekshivyas]

Exact-head security follow-up: PASS

Reviewed current head 4b139ae77. The only change since the detailed exact-base review at 35d0bac66 is an empty signed CI-retry commit after a transient OpenShell port-forward failure. The tree, effective four-file PR diff, dependencies, credentials, network behavior, privileges, and runtime configuration are identical.

All nine security categories remain PASS with no findings. Focused tests, CLI build, CLI type-check, npm run check:diff, and git diff --check passed on the identical tree.

Detailed exact-base review: #7476 (comment)

[mercl-lau]

QA verification update — PARTIAL / FAIL on v0.0.96

Tested on Windows 11 with WSL2 Ubuntu 24.04 x86_64, Docker Desktop 29.6.1, Windows-host Ollama 0.31.1, OpenShell 0.0.85, and OpenClaw 2026.7.1.

Two real onboarding paths were exercised with powershell.exe intentionally unavailable only to the test process, matching the condition where the Windows executable cannot be detected. The existing Windows Ollama daemon remained running and returned HTTP 200.

1. WSL mirrored networking: the same Windows daemon was reachable through both 127.0.0.1:11434 and host.docker.internal:11434. Detection selected loopback first, treated the provider as install-windows-ollama, and reproduced:

   Installing Ollama on Windows host...
   Failed to spawn powershell.exe: spawn powershell.exe ENOENT
   Install did not produce ollama.exe on PATH.
   

   Onboarding exited 1.

2. Explicit Windows-host route: with only the loopback probe suppressed for the test process, host.docker.internal:11434 remained HTTP 200. The same request normalized to ollama, skipped installation, and full onboarding exited 0. The sandbox reached Ready with healthy inference. The Windows Ollama process and executable timestamp were unchanged.

The fix works when the reachable daemon resolves as host.docker.internal, but WSL mirrored networking can expose the Windows daemon on loopback first and still take the install path. This remains reproducible on v0.0.96.

Reopening #7472 for the remaining mirrored-networking case.

from kookies