Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

test/e2e/test-ollama-auth-proxy-e2e.sh (1)

456-468: ⚠️ Potential issue | 🟠 Major

Make the divergence phase fail fast and drop the unused curl captures.

This still lets the test continue when the old/new token split is not reproduced, so the regression can go green without ever hitting the restart path. OLD_TOKEN_RESULT, NEW_TOKEN_RESULT, and FIXED_RESULT are also unused and trip ShellCheck. As per coding guidelines: **/*.sh: Shell scripts must include ShellCheck compliance (.shellcheckrc enforced at root), be formatted with shfmt, have shebangs, and be executable.

🧪 Tighten the regression check

-  OLD_TOKEN_RESULT=$(curl -sf --max-time 3 \
-    -H "Authorization: Bearer $ORIGINAL_TOKEN" \
-    "http://localhost:${PROXY_PORT}/v1/models" 2>&1) && OLD_TOKEN_OK=true || OLD_TOKEN_OK=false
+  if curl -sf --max-time 3 \
+    -H "Authorization: Bearer $ORIGINAL_TOKEN" \
+    "http://localhost:${PROXY_PORT}/v1/models" >/dev/null 2>&1; then
+    OLD_TOKEN_OK=true
+  else
+    OLD_TOKEN_OK=false
+  fi
 
-  NEW_TOKEN_RESULT=$(curl -sf --max-time 3 \
-    -H "Authorization: Bearer $DIVERGENT_TOKEN" \
-    "http://localhost:${PROXY_PORT}/v1/models" 2>&1) && NEW_TOKEN_OK=true || NEW_TOKEN_OK=false
+  if curl -sf --max-time 3 \
+    -H "Authorization: Bearer $DIVERGENT_TOKEN" \
+    "http://localhost:${PROXY_PORT}/v1/models" >/dev/null 2>&1; then
+    NEW_TOKEN_OK=true
+  else
+    NEW_TOKEN_OK=false
+  fi
 
   if [ "$OLD_TOKEN_OK" = true ] && [ "$NEW_TOKEN_OK" = false ]; then
     pass "Confirmed: proxy running with old token, rejects new token (divergence exists)"
   else
-    info "Token state: old=$OLD_TOKEN_OK new=$NEW_TOKEN_OK (may already be fixed)"
+    fail "Token divergence phase did not reproduce the expected old/new token split"
   fi
@@
-  FIXED_RESULT=$(curl -sf --max-time 3 \
-    -H "Authorization: Bearer $DIVERGENT_TOKEN" \
-    "http://localhost:${PROXY_PORT}/v1/models" 2>&1) && FIXED_OK=true || FIXED_OK=false
+  if curl -sf --max-time 3 \
+    -H "Authorization: Bearer $DIVERGENT_TOKEN" \
+    "http://localhost:${PROXY_PORT}/v1/models" >/dev/null 2>&1; then
+    FIXED_OK=true
+  else
+    FIXED_OK=false
+  fi

Also applies to: 497-499

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/e2e/test-ollama-auth-proxy-e2e.sh` around lines 456 - 468, The
divergence check currently captures curl output into
OLD_TOKEN_RESULT/NEW_TOKEN_RESULT (unused) and lets the test continue if
divergence isn't reproduced; remove those unused captures and make the check
fail fast: call curl with -sf --max-time 3 and only use its exit status to set
OLD_TOKEN_OK and NEW_TOKEN_OK (or test curl directly), then if the expected
state (OLD_TOKEN_OK=true and NEW_TOKEN_OK=false) is not met, call fail/exit 1
immediately (instead of info) so the regression stops and subsequent restart
path runs; also remove any references to FIXED_RESULT to avoid ShellCheck
warnings and keep the pass/info logic only for the success case.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard-ollama-proxy.ts (1)

195-207: ⚠️ Potential issue | 🟠 Major

Run stale-proxy cleanup unconditionally before restart.

At Line 205 restart can still happen without cleanup when PID is missing/corrupt, leaving an old proxy on the port and causing restart to fail or stay divergent.

Suggested fix

   const pid = loadPersistedProxyPid();
-  if (isOllamaProxyProcess(pid)) {
-    if (isProxyTokenValid(token)) {
-      ollamaProxyToken = token;
-      return;
-    }
-    // Proxy is running but rejects the persisted token — restart it.
-    killStaleProxy();
-  }
+  if (isOllamaProxyProcess(pid) && isProxyTokenValid(token)) {
+    ollamaProxyToken = token;
+    return;
+  }
+  // Always clean stale proxies (PID-file and port-scan paths) before spawning.
+  killStaleProxy();
 
   // Proxy not running (or token mismatch) — restart with the persisted token.
   ollamaProxyToken = token;
   spawnOllamaAuthProxy(token);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard-ollama-proxy.ts` around lines 195 - 207, The restart logic
may skip stale-proxy cleanup when the persisted PID is missing or corrupt, so
always invoke killStaleProxy before starting a new proxy: in the block handling
restart (where ollamaProxyToken is set and spawnOllamaAuthProxy(token) is
called), ensure killStaleProxy() is executed unconditionally whenever you intend
to restart the proxy (regardless of loadPersistedProxyPid() or
isOllamaProxyProcess(pid) results), then set ollamaProxyToken = token and call
spawnOllamaAuthProxy(token); keep checks using loadPersistedProxyPid,
isOllamaProxyProcess, and isProxyTokenValid to avoid unnecessary restarts but
ensure cleanup runs before spawn.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

test/e2e/test-ollama-auth-proxy-e2e.sh (1)

448-449: Replace the unconditional xxd dependency with Node.js crypto for divergent token generation.

Line 448 uses xxd without validating availability. Since Node.js is already a script prerequisite, use its crypto module for consistent environment contracts:

Suggested change

-DIVERGENT_TOKEN="divergent-$(date +%s)-$(head -c 16 /dev/urandom | xxd -p)"
+DIVERGENT_TOKEN="divergent-$(date +%s)-$(node -e 'console.log(require("node:crypto").randomBytes(16).toString("hex"))')"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/e2e/test-ollama-auth-proxy-e2e.sh` around lines 448 - 449, The
DIVERGENT_TOKEN generation uses an external xxd binary
(DIVERGENT_TOKEN="divergent-$(date +%s)-$(head -c 16 /dev/urandom | xxd -p)");
replace that with a Node.js-built token to avoid the xxd dependency: invoke node
to produce 16 random bytes as hex combined with the existing $(date +%s) prefix
(i.e., generate the hex via Node's crypto.randomBytes(16).toString('hex') and
assemble the same "divergent-<timestamp>-<hex>" value) and assign it to the
DIVERGENT_TOKEN variable so the shell script relies only on Node.js for
randomness.