fix: add auth proxy port to local-inference policy (#709)

nemoclaw-blueprint/policies/presets/local-inference.yaml

@@ -16,6 +16,13 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
+      - host: host.openshell.internal
+        port: 11435
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: POST, path: "/**" }
       - host: host.openshell.internal
         port: 8000
         protocol: rest

src/lib/onboard.ts

@@ -1901,7 +1901,7 @@ function killStaleProxy(): void {
   }
 }
 
-function startOllamaAuthProxy(): void {
+function startOllamaAuthProxy(): boolean {
   const crypto = require("crypto");
   killStaleProxy();
 
@@ -1912,8 +1912,12 @@ function startOllamaAuthProxy(): void {
   const pid = spawnOllamaAuthProxy(ollamaProxyToken);
   sleep(1);
   if (!isOllamaProxyProcess(pid)) {
-    console.error(`  Warning: Ollama auth proxy did not start on :${OLLAMA_PROXY_PORT}`);
+    console.error(`  Error: Ollama auth proxy failed to start on :${OLLAMA_PROXY_PORT}`);
+    console.error(`  Containers will not be able to reach Ollama without the proxy.`);
+    console.error(`  Check if port ${OLLAMA_PROXY_PORT} is already in use: lsof -ti :${OLLAMA_PROXY_PORT}`);
+    return false;
   }
+  return true;
 }
 
 /**
@@ -4144,7 +4148,9 @@ async function setupNim(gpu) {
           // WSL2 doesn't need the proxy — Docker can reach the host directly.
           console.log(`  ✓ Using Ollama on localhost:${OLLAMA_PORT}`);
         } else {
-          startOllamaAuthProxy();
+          if (!startOllamaAuthProxy()) {
+            process.exit(1);
+          }
           console.log(`  ✓ Using Ollama on localhost:${OLLAMA_PORT} (proxy on :${OLLAMA_PROXY_PORT})`);
         }
         provider = "ollama-local";
@@ -4204,7 +4210,9 @@ async function setupNim(gpu) {
         // Shell required: backgrounding (&), env var prefix, output redirection.
         run(`OLLAMA_HOST=0.0.0.0:${OLLAMA_PORT} ollama serve > /dev/null 2>&1 &`, { ignoreError: true });
         sleep(2);
-        startOllamaAuthProxy();
+        if (!startOllamaAuthProxy()) {
+          process.exit(1);
+        }
         console.log(`  ✓ Using Ollama on localhost:${OLLAMA_PORT} (proxy on :${OLLAMA_PROXY_PORT})`);
         provider = "ollama-local";
         credentialEnv = "OPENAI_API_KEY";

test/onboard-selection.test.ts

@@ -611,6 +611,7 @@ runner.runCapture = (command) => {
   if (cmd.includes("ollama list")) return "nemotron-3-nano:30b  abc  24 GB  now";
   if (cmd.includes("127.0.0.1:8000/v1/models")) return "";
   if (cmd.includes("api/generate")) return '{"response":"hello"}';
+  if (cmd.includes("-o args=")) return "node ollama-auth-proxy.js";
   return "";
 };
 
@@ -708,6 +709,7 @@ runner.runCapture = (command) => {
   if (cmd.includes("ollama list")) return "nemotron-3-nano:30b  abc  24 GB  now";
   if (cmd.includes("127.0.0.1:8000/v1/models")) return "";
   if (cmd.includes("api/generate")) return '{"response":"hello"}';
+  if (cmd.includes("-o args=")) return "node ollama-auth-proxy.js";
   return "";
 };
 
@@ -811,6 +813,7 @@ runner.runCapture = (command) => {
   if (cmd.includes("ollama list")) return "";
   if (cmd.includes("127.0.0.1:8000/v1/models")) return "";
   if (cmd.includes("api/generate")) return '{"response":"hello"}';
+  if (cmd.includes("-o args=")) return "node ollama-auth-proxy.js";
   return "";
 };
 
@@ -921,6 +924,7 @@ runner.runCapture = (command) => {
   if (cmd.includes("ollama list")) return "";
   if (cmd.includes("127.0.0.1:8000/v1/models")) return "";
   if (cmd.includes("api/generate")) return '{"response":"hello"}';
+  if (cmd.includes("-o args=")) return "node ollama-auth-proxy.js";
   return "";
 };
 

test/policies.test.ts

@@ -156,10 +156,11 @@ describe("policies", () => {
       }
     });
 
-    it("local-inference preset targets host.openshell.internal on Ollama and vLLM ports", () => {
+    it("local-inference preset targets host.openshell.internal on Ollama, proxy, and vLLM ports", () => {
       const content = policies.loadPreset("local-inference");
       expect(content).toContain("host.openshell.internal");
       expect(content).toContain("port: 11434");
+      expect(content).toContain("port: 11435");
       expect(content).toContain("port: 8000");
     });