fix: add auth proxy port to local-inference policy (#709)#2114
Merged
Conversation
…startup error (#709) The local-inference policy preset only allowed port 11434 (direct Ollama) but on non-WSL systems containers route through the auth proxy on port 11435. This port mismatch caused HTTP 403/401 errors from inside sandboxes even with the local-inference policy enabled. Also upgrades the proxy startup failure from a warning to a hard error so onboarding does not continue with a broken provider configuration.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdded a new network policy endpoint for Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
The previous process.exit(1) inside startOllamaAuthProxy broke 4 onboard-selection tests that mock runCapture but not child_process.spawn. Return a boolean instead and let the onboard flow call sites handle the failure. Update the 4 Ollama test mocks to handle the ps command used by isOllamaProxyProcess.
cv
approved these changes
Apr 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the remaining open issue in #709 — local Ollama inference from inside sandbox containers returns HTTP 403/401 even with
local-inferencepolicy enabled.Root cause: PR #1922 introduced an authenticated reverse proxy on port 11435, but PR #2000's
local-inferencepolicy preset only allows port 11434 (direct Ollama) and 8000 (vLLM). On non-WSL Linux systems, container traffic is routed to port 11435 (src/lib/local-inference.ts:21), which the policy blocks.Changes:
local-inference.yaml: Add port 11435 (auth proxy) endpoint so containers can reach the proxy on non-WSL systemsonboard.ts: Upgrade proxy startup failure from a soft warning to a hard error with actionable diagnostics — prevents onboarding from completing with a broken provider configpolicies.test.ts: Assert port 11435 is present in the preset to prevent regressionTest plan
--fromtest)Summary by CodeRabbit
New Features
Bug Fixes
Tests