test(ollama): preserve proxy token during re-onboard

[sandl99]

Summary

Preserves the committed local Ollama proxy token during re-onboarding so the token mounted in the existing sandbox does not diverge from the restarted host proxy. Temporary compatible custom-endpoint setup still receives a fresh token and retains its rollback behavior.

Changes

• Reuse the persisted proxy token when starting the committed local Ollama route.
• Keep fresh-token generation explicit for the uncommitted compatible custom-endpoint route.
• Update the provider-switch recovery test to protect token continuity while still requiring the backend to switch to local Ollama.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This restores credential continuity for the existing local Ollama workflow without changing commands, configuration, or required user actions.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex CLI security review passed with no findings: test(ollama): preserve proxy token during re-onboard #7620 (comment)
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: No documentation paths changed. The commit restores the existing Local Ollama re-onboarding contract by retaining the persisted proxy token. It does not change the documented proxy setup, token file, commands, configuration, or user workflow.
• Agent: Codex CLI

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — Ollama proxy recovery, rollback, and startup integration tests (16 passed); setup-nim-ollama CLI tests (14 passed)
• Applicable broad gate passed — npm run typecheck:cli
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved Ollama authentication proxy recovery when switching between compatible backends.
  • Preserved existing proxy tokens when available, helping maintain reliable authentication across restarts and provider changes.
  • Ensured no-auth connections receive a fresh token while using the specified endpoint.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

Ollama proxy startup now separates token generation from launch, reuses persisted tokens when available, and defers persistence until provider confirmation. No-auth startup passes an explicit token and backend origin. Recovery tests now verify committed-token preservation during backend switching.

Changes

Ollama proxy token flow

Layer / File(s)	Summary
Token generation and startup wiring src/lib/inference/ollama/proxy.ts	Adds explicit token generation and token-aware startup, reuses persisted tokens, defers persistence, and passes endpoint origins for no-auth proxy startup.
Backend switching recovery validation test/ollama-proxy-recovery.test.ts	Renames the switching scenario and expects the committed compatible-backend token to remain active.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7427: Related Ollama compatible-endpoint routing changes that also affect proxy token creation and usage.

Suggested reviewers: brandonpelfrey, cv, ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: preserving the Ollama proxy token during re-onboarding.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-ollama-token-reonboard

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit d38b88a in the codex/fix-ollama-tok... branch remains at 96%, unchanged from commit 77e6e38 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit d38b88a in the codex/fix-ollama-tok... branch is 80%. The coverage in commit 77e6e38 in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main 77e6e38	codex/fix-ollama-tok... d38b88a	+/-
src/lib/actions...time-command.ts	100%	82%	-18%
src/lib/actions...-add-restart.ts	19%	10%	-9%
src/lib/actions...on-readiness.ts	100%	91%	-9%
src/lib/actions...lution-probe.ts	95%	88%	-7%
src/lib/actions...x/mcp-bridge.ts	41%	35%	-6%
src/lib/state/o...oint-migrate.ts	96%	92%	-4%
src/lib/actions...e-validation.ts	84%	81%	-3%
src/lib/onboard...shboard-port.ts	93%	90%	-3%
src/lib/actions...dbox/destroy.ts	95%	93%	-2%
src/lib/onboard...eway-service.ts	82%	81%	-1%

---

_{Updated July 27, 2026 07:44 UTC}

[sandl99]

Verdict

PASS. The PR is safe to merge from a security perspective. It preserves the already committed, host-managed Ollama proxy credential during local re-onboarding while retaining cryptographically random fresh credentials for temporary compatible-endpoint replacement and the existing rollback path.

Findings Table

The review found no security findings.

Detailed Analysis

1. Secrets and Credentials — PASS: No real credentials are committed or logged; test tokens are inert placeholders. The production path reads the existing protected token file.
2. Input Validation and Data Sanitization — PASS: No new user-controlled input or parsing is introduced.
3. Authentication and Authorization — PASS: The authenticated proxy boundary remains enforced; re-onboarding now avoids host/sandbox credential divergence.
4. Dependencies and Third-Party Libraries — PASS: No dependency changes.
5. Error Handling and Logging — PASS: Token values are not added to diagnostics or logs.
6. Cryptography and Data Protection — PASS: Fresh temporary credentials continue to use crypto.randomBytes(24); persisted-token file permissions and lifecycle are unchanged.
7. Configuration and Security Headers — PASS: No ports, container privileges, policies, or HTTP security configuration change.
8. Security Testing — PASS: The updated recovery test protects committed-token continuity, while existing startup and rollback tests verify fresh temporary tokens and restoration of committed state.
9. System Security — PASS: The change narrows token selection by current consumer and does not weaken process ownership, health probes, file permissions, or rollback controls.

Files Reviewed

• src/lib/inference/ollama/proxy.ts
• test/ollama-proxy-recovery.test.ts

Reviewed head: da4e66e78507703434fb182c0888279c5f07843a

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/inference/ollama/proxy.ts`:
- Around line 331-336: Update startOllamaAuthProxy so it no longer directly
calls loadPersistedProxyToken; route persisted-token retrieval through an
existing state-layer reader or inject that reader into the inference helper.
Keep token selection and startOllamaAuthProxyWithToken invocation in this
module, while ensuring persisted local/session file access remains owned by
src/lib/state.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 73bb2467-449c-481b-b9a5-4555f1716a88

📥 Commits

Reviewing files that changed from the base of the PR and between 87270de and da4e66e.

📒 Files selected for processing (2)

• src/lib/inference/ollama/proxy.ts
• test/ollama-proxy-recovery.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: inference-routing, network-policy

1 optional E2E recommendation

• ollama-auth-proxy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.