fix(onboard): reuse mirrored Windows Ollama

[prekshivyas]

Summary

Reuse Windows-host Ollama when WSL mirrored networking exposes that daemon through 127.0.0.1. Before this change, NemoClaw treated the loopback response as a WSL-local daemon and could route Ollama 0.32.5 through the Linux upgrade installer even though the usable daemon was installed on Windows.

Related Issue

Fixes #9300

Changes

• Classify WSL loopback as Windows-host Ollama only when wslinfo reports mirrored networking, a Windows Ollama installation is present, Docker can reach the Windows daemon, and Linux procfs shows no WSL-owned listener on the Ollama port.
• Exclude that positively identified Windows daemon from the WSL-local binary and daemon version-upgrade path.
• Keep fail-closed behavior for ordinary WSL loopback daemons, dual-daemon topologies, unavailable socket identity, and unrecognized WSL networking modes.
• Add regression coverage for mirrored-network classification, Ollama 0.32.5, local-listener identity, and ambiguous modes; document the topology rule.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head re-review requested from @cv after the socket-identity hardening; initial approval: fix(onboard): reuse mirrored Windows Ollama #9345 (review)
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npm run test -- --run src/lib/onboard/provider-host-state.test.ts src/lib/onboard/ollama-install-menu.test.ts src/lib/onboard/provider-menu.test.ts test/install-express-wsl-ollama.test.ts test/onboard-selection-windows-provider-rejection.test.ts test/onboard-selection.test.ts (133 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; the change is isolated to Ollama topology classification and its install menu.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — build succeeded with 0 errors and 2 pre-existing warnings
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5020729f-ed83-4c7b-acfd-98a324e99d30

📥 Commits

Reviewing files that changed from the base of the PR and between 27f3a4e and 6edb6db.

📒 Files selected for processing (1)

• src/lib/onboard/provider-host-state.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/lib/onboard/provider-host-state.test.ts

Included review availability: Your plan includes up to 12 reviews per rolling hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The onboarding flow detects Windows-host Ollama exposed through WSL mirrored networking. It checks for a WSL-local listener and passes the classification to install-menu resolution. Local installation and upgrade handling is suppressed for confirmed Windows-host Ollama.

Changes

Ollama WSL detection and onboarding

Layer / File(s)	Summary
Local listener detection src/lib/onboard/provider-host-state.ts, src/lib/onboard/provider-host-state.test.ts, src/lib/inference/local.ts	The provider state module detects Ollama listeners from Linux procfs data. The detection supports injected file reads and returns null for unavailable or malformed data.
Host classification and state wiring src/lib/onboard/provider-host-state.ts, src/lib/onboard/provider-host-state.test.ts	Mirrored networking is classified as Windows-host Ollama only when Windows installation, Docker reachability, and no WSL-local listener are confirmed. Ambiguous and dual-daemon cases remain non-Windows-host classifications. The result is passed to onboarding.
Local upgrade suppression src/lib/onboard/ollama-install-menu.ts, src/lib/onboard/ollama-install-menu.test.ts, docs/inference/set-up-ollama.mdx	Windows-host Ollama is excluded from local version probing, installer entries, binary-upgrade requirements, and upgrade flags. Tests and documentation cover the mirrored-networking behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 6edb6

This change reuses a reachable Windows-host Ollama daemon in mirrored WSL networking instead of incorrectly routing it through the Linux installer; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant ProviderHostState
  participant WSLNetworking
  participant LocalListenerDetection
  participant OllamaInstallMenu
  ProviderHostState->>WSLNetworking: Probe WSL networking mode
  ProviderHostState->>LocalListenerDetection: Check Ollama port for a WSL-local listener
  ProviderHostState->>OllamaInstallMenu: Pass isWindowsHostOllama
  OllamaInstallMenu-->>ProviderHostState: Suppress local installer and upgrade handling

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: reusing mirrored Windows-host Ollama during onboarding.
Linked Issues check	✅ Passed	The changes classify mirrored Windows-host Ollama, skip local installation and upgrades, and add regression coverage for issue #9300.
Out of Scope Changes check	✅ Passed	The implementation, tests, and documentation directly support mirrored Windows-host Ollama detection and safe onboarding behavior.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ollama-empty-models-wsl-9300

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-9345.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 6edb6db in the fix/ollama-empty-mod... branch remains at 96%, unchanged from commit b4b6680 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 6edb6db in the fix/ollama-empty-mod... branch is 83%. The coverage in commit e746431 in the main branch is 82%.

Show a code coverage summary of the most impacted files.

File	main e746431	fix/ollama-empty-mod... 6edb6db	+/-
src/lib/actions...er-lifecycle.ts	94%	85%	-9%
src/lib/onboard...carryforward.ts	96%	88%	-8%
src/lib/actions...aged-profile.ts	88%	84%	-4%
src/lib/inference/local.ts	82%	81%	-1%
src/lib/policy/index.ts	64%	64%	0%
src/lib/agent/defs.ts	97%	97%	0%
src/lib/onboard...ce-lifecycle.ts	89%	93%	+4%
src/lib/cua/run...ime-manifest.ts	84%	90%	+6%
src/lib/cua/bounded-file.ts	84%	94%	+10%
src/lib/actions...ld-mcp-phase.ts	87%	98%	+11%

---

_{Updated August 17, 2026 20:02 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized terminology decisions differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

3 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• mirrored networking at docs/inference/set-up-ollama.mdx:52: selected only by the second-opinion lane as established.
• procfs at src/lib/onboard/provider-host-state.ts:108: selected only by the second-opinion lane as established.
• mirrored Windows-host Ollama at src/lib/onboard/ollama-install-menu.test.ts:203: selected only by the second-opinion lane as justified.

1 additional E2E selection from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• hermes-e2e: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — Windows-host Ollama at docs/inference/set-up-ollama.mdx:52: Use the established term for the Windows-owned daemon classification.
• established — mirrored networking at src/lib/onboard/provider-host-state.ts:272: Use the established term for this WSL networking mode.
• justified — WSL-local listener at docs/inference/set-up-ollama.mdx:52: Retain the modifier because listener ownership determines whether the Linux install and upgrade path applies.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: inference-routing

Manual-only E2E: onboard-repair, onboard-resume, cloud-onboard, network-policy
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[prekshivyas]

Addressed advisor warning PRA-1 and tightened the underlying identity check on current head 6edb6db93:

• An unrecognized wslinfo --networking-mode value now has an explicit fail-closed regression test that preserves the Linux upgrade path.
• Mirrored loopback is classified as Windows-host Ollama only when both procfs TCP tables are readable and show no WSL-owned listener on the configured Ollama port.
• Added dual-daemon and unavailable/malformed procfs coverage.
• Exact-head targeted validation: 6 files, 133 tests passed; repository checks, CLI type-checking, hooks, and strict docs validation passed.

This prevents a WSL-local daemon from being mistaken for the independently Docker-reachable Windows daemon.