Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (1)

7606-7606: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use the same reachability gate for the fallback proxy recovery.

This hunk switches credential wiring to shouldFrontOllamaWithProxy(), but Lines 7578-7581 still decide whether to start the recovery proxy with !isWsl(). On native dockerd-on-WSL, that means validation can fail and exit before the proxy is ever started, even though this branch now expects the proxy path.

Suggested fix

-      if (!isWsl()) {
+      if (shouldFrontOllamaWithProxy()) {
         ensureOllamaAuthProxy();
         proxyReady = isProxyHealthy();
       }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` at line 7606, The reachability gate for starting the
fallback recovery proxy must match the new credential branch: replace the legacy
check that uses !isWsl() (the condition that decides whether to start/skip the
recovery proxy and whether to run validation) with shouldFrontOllamaWithProxy()
so the code that starts the recovery proxy and the validation path use the same
predicate; update the logic around the recovery proxy startup and any early-exit
validation that currently runs under !isWsl() to instead use
shouldFrontOllamaWithProxy() (referencing the existing
shouldFrontOllamaWithProxy() call and the recovery proxy start/validation code
paths) so validation won’t fail/exit before the proxy is started.

docs/inference/use-local-inference.md (1)

99-99: ⚡ Quick win

Remove unnecessary bold (LLM pattern detected).

The bold on **not** is emphatic emphasis rather than a UI label, parameter name, or genuine warning. This is a common LLM-generated pattern that should be avoided.

Suggested fix

-**Native Docker installed inside a WSL distro** (the more common WSL2 setup with `docker-ce`) does **not** see the host's loopback from its bridge network, so the proxy runs there too.
+Native Docker installed inside a WSL distro (the more common WSL2 setup with `docker-ce`) does not see the host's loopback from its bridge network, so the proxy runs there too.

As per coding guidelines: Bold is reserved for UI labels, parameter names, and genuine warnings.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/inference/use-local-inference.md` at line 99, In the sentence containing
"Native Docker installed inside a WSL distro (the more common WSL2 setup with
`docker-ce`) does **not** see the host's loopback from its bridge network, so
the proxy runs there too.", remove the unnecessary bold markup around "not" so
it reads "...does not see the host's loopback...", preserving the inline code
span for `docker-ce` and leaving the rest of the sentence unchanged.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (1)

7609-7623: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use the same reachability gate for proxy recovery and token wiring.

Line 7609 now keys proxy credentials off shouldFrontOllamaWithProxy(), but Line 7581 still only probes/starts the proxy behind !isWsl(). On native dockerd-in-WSL that leaves the recovery path on the old heuristic, so local validation can fail and abort before the proxy path is ever considered.

Suggested fix

   if (!validation.ok) {
     // The container reachability check uses Docker's --add-host host-gateway,
     // which may not work on all Docker configurations (e.g., Brev, rootless).
     // The real sandbox uses k3s CoreDNS + NodeHosts — a different path.
     // Try to start/restart the auth proxy before probing — this recovers
     // from stale or missing proxy processes before we decide to abort.
-    if (!isWsl()) {
+    if (shouldFrontOllamaWithProxy()) {
       ensureOllamaAuthProxy();
       proxyReady = isProxyHealthy();
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 7609 - 7623, The proxy recovery probe is
gated by the old isWsl() heuristic while token wiring uses
shouldFrontOllamaWithProxy(), causing mismatched behavior; change the
recovery/start condition to use shouldFrontOllamaWithProxy() so both paths
align: where the code currently checks !isWsl() before calling
ensureOllamaAuthProxy()/probing the proxy (the block that sets proxyReady),
update that condition to shouldFrontOllamaWithProxy(), ensure proxyReady is set
the same way, and keep the later token wiring logic that calls
getOllamaProxyToken(), ensureOllamaAuthProxy(), and persistAndProbeOllamaProxy()
unchanged so both recovery and token wiring use the same reachability gate.

test/onboard.test.ts (1)

925-927: ⚡ Quick win

Add an explicit assertion that the proxy token never appears in argv.

This test already validates credential-name wiring, but it should also fail if the literal token is accidentally embedded in the command string.

Suggested test hardening

     assert.match(providerCommand.command, /--credential NEMOCLAW_OLLAMA_PROXY_TOKEN/);
     assert.equal(providerCommand.env?.NEMOCLAW_OLLAMA_PROXY_TOKEN, "proxy-token");
+    assert.doesNotMatch(providerCommand.command, /proxy-token/);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/onboard.test.ts` around lines 925 - 927, Add an assertion ensuring the
literal proxy token never appears in the generated command argv; specifically,
after the existing checks on providerCommand.command and providerCommand.env
(references: providerCommand.command and providerCommand.env), add a negative
assertion that providerCommand.command (or providerCommand.argv if present) does
not include the string "proxy-token" (e.g., assert.doesNotMatch or
assert.ok(!...includes("proxy-token"))), so the test fails if the secret token
is accidentally embedded into the command line.