fix(onboard): skip Linux systemd override for Windows-host Ollama

[harjothkhara]

Summary

On WSL2 with Docker Desktop, a running Windows-host Ollama daemon is reached at host.docker.internal. Non-interactive onboard with NEMOCLAW_PROVIDER=install-windows-ollama collapses that request to the running-daemon handler, which then applied a Linux systemd loopback override and exited with code 1 before creating the sandbox. That override targets a local ollama.service; it cannot configure a daemon that runs on the Windows host.

After this change, onboard reuses the reachable Windows-host daemon and never touches a Linux systemd Ollama service. This restores the behavior first fixed in #4208.

PR #8634 also carries three repairs for failures inherited from base SHA b9a0d98d. The base SHA and PR merge commit failed the same checks. A maintainer directed these repairs through this PR.

Related Issue

Refs: #8596

Changes

• src/lib/onboard/setup-nim-ollama.ts: handleRunningOllamaSelection now takes the resolved isWindowsHostOllama flag and skips ensureOllamaLoopbackSystemdOverride when the daemon is on the Windows host. The flag defaults to false, so the local-Linux path is unchanged.
• src/lib/onboard/setup-nim-flow.ts: the ollama dispatch passes the already-computed isWindowsHostOllama (ollamaHost === host.docker.internal) to the handler.
• scripts/install.sh: installer preflight reuses validated, deduplicated readiness IDs for headers and detail lines. Malformed IDs cannot enter diagnostic output.
• test/package-contract/installer-host-preflight.test.ts: the compiled-package fixture supplies the gateway declaration module that installer preflight requires.
• .github/workflows/base-image.yaml: the base-image publisher watches both managed-image activation files and their reviewed path glob.
• Tests: a handler test proves the override is skipped for a Windows-host daemon ([WSL2][Onboard] Windows-host Ollama reuse exits during provider configuration #8596); the [WSL2][Install] express install fails with "Install did not produce ollama.exe on PATH" when Ollama already installed #7472 coordinator test now asserts the flow wires the flag through. Existing installer, package, and workflow contracts cover the inherited repairs.

The flag is the smallest signal that separates the two cases. It is already computed in the dispatcher, so nothing new is derived. This is not a compatibility or configuration layer.

Known limit

The flag marks the host.docker.internal route only. Two related boundaries are out of scope here and are safe to fix separately:

• Sandbox resume repair (repairLocalInferenceSystemdOverrideOrExit, src/lib/onboard/local-inference-topology.ts) still applies the override for a recorded ollama-local provider, with no way yet to tell a recorded Windows-host daemon from a local one.
• Under WSL mirrored networking the Windows daemon answers on 127.0.0.1, so isWindowsHostOllama reads false; the override then does nothing unless a local ollama.service also exists.

Type of Change

• Code change (feature, bug fix, or refactor)

Quality Gates

• Tests added or updated for changed behavior
• Docs not applicable — justification: the Ollama change restores behavior the docs already describe. The added CI repairs restore repository checks and existing diagnostic constraints without adding a command, option, default, configuration, schema, or user-visible message.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending maintainer review (onboarding, inference, and installer preflight paths).

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The Ollama change restores documented Windows-host reuse. The workflow paths, validated diagnostic IDs, and package fixture change no public documentation contract or user-visible message.
• Agent: Codex Desktop

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main
• Targeted behavior tests pass for the current change set — command/result:
  • npm exec -- vitest run --project cli src/lib/onboard/setup-nim-ollama.test.ts src/lib/onboard/setup-nim-flow.test.ts → 49 passed
  • npm exec -- vitest run --project installer-integration test/install-preflight.test.ts -t 'applies installer storage admission' → 5 passed, 94 skipped
  • npm exec -- vitest run --project package-contract test/package-contract/installer-host-preflight.test.ts → 3 passed
  • npm exec -- vitest run --project e2e-support test/e2e/support/base-image-publication.test.ts → 39 passed
  • npm run typecheck:cli → passed
  • npm run checks:repository → passed
  • npm run validate:pr → passed all applicable pre-commit, commit-message, and pre-push checks
  • Existing integration evidence: vitest run --project integration test/onboard-selection.test.ts → 64 passed
  • RED/GREEN: with the source restored to upstream and the new test kept, skips the Linux systemd loopback override for a Windows-host Ollama daemon (#8596) fails because the override runs. The [WSL2][Install] express install fails with "Install did not produce ollama.exe on PATH" when Ollama already installed #7472 coordinator assertion fails when the flow does not pass the flag. Both tests pass with the PR changes.
• No secrets, API keys, or credentials committed

---

Signed-off-by: harjoth harjoth.khara@gmail.com
Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved Ollama setup on Windows hosts by using the reachable host endpoint.
  • Prevented unnecessary Linux systemd loopback overrides when Ollama runs on a Windows host.
  • Preserved recovery behavior for standard Linux Ollama installations.
  • Improved installer readiness reporting by filtering unsupported admission findings and capabilities.

• Tests

  • Added coverage for Windows-host detection, startup handling, endpoint usage, and skipped loopback overrides.
  • Improved installer host-preflight test coverage.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The onboarding flow passes Windows-host Ollama detection into running-daemon handling. Windows-host Ollama skips Linux systemd loopback override logic and uses the reachable host endpoint. The installer sanitizes readiness identifiers, and the base-image workflow expands its path filters.

Changes

Windows-host Ollama onboarding

Layer / File(s)	Summary
Propagate Windows-host state src/lib/onboard/setup-nim-flow.ts, src/lib/onboard/setup-nim-flow.test.ts	The dependency contract accepts the Windows-host indicator. The flow passes it to the running Ollama handler, and the test verifies the value.
Handle Windows-host Ollama src/lib/onboard/setup-nim-ollama.ts, src/lib/onboard/setup-nim-ollama.test.ts	The handler skips Linux systemd loopback override handling for Windows-host Ollama. Tests verify startup handling and the host-reachable endpoint.

Installer host preflight

Layer / File(s)	Summary
Sanitize readiness identifiers scripts/install.sh, test/package-contract/installer-host-preflight.test.ts	Denied admissions use stable finding and capability IDs for readiness diagnostics. The fixture provides a successful declaration loader.

Managed-image workflow triggers

Layer / File(s)	Summary
Expand managed-image path filters .github/workflows/base-image.yaml	The workflow includes managed-image activation tests and helper files in its push filters.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8715: Covers related Windows/WSL Ollama host routing and reachability tests.
• NVIDIA/NemoClaw#8776: Shares installer preflight changes for sanitized readiness identifier handling.
• NVIDIA/NemoClaw#8778: Updates related base-image workflow path triggers.

Suggested labels: provider: ollama

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: skipping the Linux systemd override for Windows-host Ollama during onboarding.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — Windows-host Ollama at src/lib/onboard/setup-nim-ollama.ts:272: Retain the established term.
• justified — Linux systemd loopback override at src/lib/onboard/setup-nim-ollama.test.ts:278: Retain the modifier because it distinguishes the Linux-only override from Windows-host Ollama handling.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: cloud-onboard, managed-image-multiarch-startup, onboard-repair, onboard-resume
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

1 optional E2E recommendation

• ollama-auth-proxy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[cv]

The Windows-host Ollama path now skips only the inapplicable Linux systemd override while preserving existing Linux behavior. Focused handler and flow tests cover both paths, and I found no correctness, compatibility, security, test, or documentation blocker.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.