refactor(ollama): migrate auth proxy to .mts

[cv]

Summary

Migrate the host-side Ollama authentication proxy from CommonJS scripts/ollama-auth-proxy.js to the typed ESM scripts/ollama-auth-proxy.mts entrypoint while preserving the existing request-handling and lifecycle contract. This maintainer salvage preserves the verified commits from #6949 and reconciles its process matcher with the Bedrock adapter migration merged in #6938.

Related Issue

Resolves #6926
Part of #6918
Supersedes #6949

Changes

• Rename the Ollama authentication proxy entrypoint to .mts and retain its fail-closed Bearer-token check, byte-length gate before timingSafeEqual, sensitive-header stripping, loopback backend, public listener, and nonzero EADDRINUSE behavior.
• Match only filename-bounded legacy .js and current .mts proxy processes during lifecycle cleanup and uninstall, with positive coverage for both names and negative coverage for helper and suffix near matches.
• Reconcile the shared local-adapter matcher after refactor(inference): migrate Bedrock runtime adapter launcher to .mts #6938: strings use substring matching, regular expressions retain Bedrock's bounded launcher matching, and callbacks support Ollama's ownership predicate. All call sites use the existing processMatcher name.
• Repoint unit, recovery, uninstall, and live E2E fixtures to the .mts entrypoint.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the filenames and shared matcher are internal; existing setup, lifecycle, uninstall, and port-conflict documentation remains accurate. A documentation-writer review found no page or standalone changelog change necessary.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the focused security re-review on refactor(ollama): migrate auth proxy to .mts #6949 passed after the bounded matcher and negative tests were added; the conflict resolution preserves refactor(inference): migrate Bedrock runtime adapter launcher to .mts #6938's bounded Bedrock matcher and was independently revalidated.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 85 focused lifecycle, Bedrock, uninstall, handler, and recovery tests passed after generating ignored build artifacts.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Additional validation: npm run build:cli and npm run typecheck:cli passed. All original #6949 commits remain in the branch unchanged, and the signed merge commit records the mechanical two-file resolution against current main.

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com
Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• New Features
  • Updated the authenticated Ollama proxy launcher to the TypeScript module entrypoint with configurable ports.
• Bug Fixes
  • Improved proxy and local-adapter process detection so cleanup targets only the intended auth-proxy variants.
  • Enhanced handling of proxy startup when the configured port is already in use, and better behavior during backend disconnects.
• Tests
  • Expanded coverage for proxy ownership, restart/recovery flows, near-name process matching, and error cases (including port conflicts and backend disconnect scenarios).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 99b5a3df-2d9d-4266-8ccb-1d314fb7f86a

📥 Commits

Reviewing files that changed from the base of the PR and between 1573fb5 and 2ba63b1.

📒 Files selected for processing (3)

• scripts/ollama-auth-proxy.mts
• test/ollama-auth-proxy-handler-helpers.ts
• test/ollama-auth-proxy-handler.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• scripts/ollama-auth-proxy.mts

---

📝 Walkthrough

Walkthrough

The Ollama authentication proxy moves from scripts/ollama-auth-proxy.js to .mts. Shared command-line matching now identifies supported proxy processes, and production, cleanup, recovery, E2E, and lifecycle tests use the new entrypoint.

Changes

Ollama proxy migration

Layer / File(s)	Summary
Shared process matching src/lib/inference/local-adapter-lifecycle.ts, src/lib/inference/ollama/process.ts	Process matching now supports predicate functions, with a shared classifier for .js and .mts Ollama auth-proxy commands.
Proxy entrypoint and production wiring scripts/ollama-auth-proxy.mts, src/lib/inference/ollama/proxy.ts	The authenticated reverse proxy is implemented in .mts, and spawning plus stale-process detection use the new entrypoint and matcher.
Lifecycle and uninstall integration src/lib/actions/uninstall/run-plan.ts, src/lib/inference/*adapter*.ts	Cleanup paths use processMatcher and shared Ollama proxy command-line detection.
Launcher migration and validation test/**/*ollama*, test/e2e/live/*, src/lib/**/*test.ts	Tests and E2E helpers launch .mts, cover backend disconnect and port ownership failures, and distinguish supported proxy names from near-named scripts.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant OllamaAuthProxy
  participant OllamaBackend
  Client->>OllamaAuthProxy: Send request with Bearer token
  OllamaAuthProxy->>OllamaAuthProxy: Validate token
  OllamaAuthProxy->>OllamaBackend: Forward authorized request without auth headers
  OllamaBackend-->>OllamaAuthProxy: Return response
  OllamaAuthProxy-->>Client: Return backend response

Loading

Possibly related issues

• Migrate the OpenClaw chat-send patch tool to .mts #6928: Both migrate a JavaScript CLI script to a typed .mts entrypoint and update references and tests.
• Migrate repository tools to explicit .mts ESM boundaries #6918: Directly concerns migrating the Ollama authentication proxy to scripts/ollama-auth-proxy.mts.

Possibly related PRs

• NVIDIA/NemoClaw#6938: Both update shared local-adapter process-matching and kill plumbing for .mts launchers.
• NVIDIA/NemoClaw#6949: Directly overlaps the Ollama proxy .mts migration and process-detection updates.

Suggested labels: refactor

Suggested reviewers: ericksoa, brandonpelfrey, prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: migrating the Ollama auth proxy to .mts.
Linked Issues check	✅ Passed	The proxy migration, launcher updates, lifecycle/process matching, and focused tests all align with issue #6926's requirements.
Out of Scope Changes check	✅ Passed	The changes are centered on the Ollama proxy migration and related tests, with no clearly unrelated features introduced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/salvage-6949-mts-migration

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/salvage-6949-m... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 4a2354f	codex/salvage-6949-m... 2ba63b1	+/-
src/lib/inferen...ollama/proxy.ts	35%	35%	0%
src/lib/actions...all/run-plan.ts	83%	83%	0%
src/lib/inferen...er-lifecycle.ts	69%	71%	+2%
src/lib/inferen...lama/process.ts	0%	100%	+100%

---

_{Updated July 15, 2026 22:17 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 1 blocker · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported 1 more blocker, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, inference-routing, network-policy, ollama-auth-proxy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/ollama-auth-proxy.mts`:
- Around line 62-81: Update the proxy request handling around proxyRes and
proxyReq to listen for proxyRes stream errors, destroy the upstream request when
clientReq disconnects, and only write the 502 fallback when
clientRes.headersSent is false. Add coverage for a backend disconnect after
partial headers or body while preserving normal piping behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 37670d50-8341-4eb1-b9ec-3ff11df57278

📥 Commits

Reviewing files that changed from the base of the PR and between 4a2354f and 1573fb5.

📒 Files selected for processing (15)

• scripts/ollama-auth-proxy.js
• scripts/ollama-auth-proxy.mts
• src/lib/actions/uninstall/run-plan.test.ts
• src/lib/actions/uninstall/run-plan.ts
• src/lib/inference/bedrock-runtime-adapter.ts
• src/lib/inference/local-adapter-lifecycle.test.ts
• src/lib/inference/local-adapter-lifecycle.ts
• src/lib/inference/ollama/process.ts
• src/lib/inference/ollama/proxy.ts
• src/lib/inference/openrouter-runtime-adapter-lifecycle.ts
• test/e2e/live/gpu-e2e-helpers.ts
• test/e2e/live/ollama-auth-proxy.test.ts
• test/ollama-auth-proxy-handler-helpers.ts
• test/ollama-auth-proxy-handler.test.ts
• test/ollama-proxy-recovery.test.ts

💤 Files with no reviewable changes (1)

• scripts/ollama-auth-proxy.js

[prekshivyas]

@cv @ericksoa @brandonpelfrey Maintainer E2E dispatch is ready for the exact reviewed revision below. Ordinary CI is green, CodeRabbit is clean, the canonical advisor has 0 blockers / 0 warnings / 0 suggestions, and the exact SHA passed a fresh CLI build, typecheck, 74 focused tests, and a direct plain-Node v22.19.0 proxy runtime probe.

Please run E2E / PR Gate Controller from main with:

• operation: run-control-plane
• pr_number: 6974
• expected_head_sha: 2ba63b13d695edf910f6e90bffac6a787c87711e
• expected_base_sha: 4a2354f2215242b848bee61040c062214dc97249
• review_reason: Reviewed exact Ollama auth-proxy migration revision; run selected credentialed E2E jobs.

Selected jobs: cloud-onboard, credential-sanitization, security-posture, inference-routing, network-policy, ollama-auth-proxy. Deterministic plan: c8991cf8796d34f98a5ebba9790f275a0aec8c9b041e77ca766a5157d1c9d161.