[Ollama-local] Gateway routing proxy does not inject NEMOCLAW_OLLAMA_PROXY_TOKEN as Bearer on :11435 — silent hang on clean machine (continuation of #2519) #3198

Description

Continuation of #2519. PR #2580 landed the wizard-side fix (stopped capturing host OPENAI_API_KEY for ollama-local, switched gateway config to NEMOCLAW_OLLAMA_PROXY_TOKEN), which resolved the original HTTP 401 symptom. However, the runtime credential-injection path in the routing proxy is still broken: the gateway routes ollama-local requests to :11435 but never injects NEMOCLAW_OLLAMA_PROXY_TOKEN as a Bearer header. On a clean machine with no OPENAI_API_KEY at all, the failure mode shifts from an explicit 401 to a silent hang — nemoclaw status reports healthy, the TUI spins indefinitely, and the sandbox logs show NET:FAIL [LOW] inference.local:443 every ~15s.

Reproduced by @hulynn on nemoclaw v0.0.31 (see verbatim repro below).

Scope vs. #2519

Repro (from @hulynn, v0.0.31, verbatim)

[Repro] v0.0.31, no OPENAI_API_KEY, clean machine

Reproduced on nemoclaw v0.0.31 (Brev cloud, Ubuntu 22.04, A100-SXM4-80GB, Ollama v0.22.0, model qwen2.5:0.5b).

Trigger: No OPENAI_API_KEY set. Wizard shows API key: (not required for ollama-local) — nothing stored in credentials.json. Onboard completes, nemoclaw status reports Inference: healthy. TUI spins indefinitely, no response.

Sandbox logs:

[openshell_router] routing proxy inference request
  endpoint=http://host.openshell.internal:11435/v1 path=/v1/chat/completions
[sandbox] NET:FAIL [LOW] inference.local:443   ← repeats every ~15s

Host:

$ curl http://localhost:11435/
HTTP 401 Unauthorized

The gateway routes to :11435 but injects no Authorization header. openshell provider get ollama-local shows NEMOCLAW_OLLAMA_PROXY_TOKEN as the credential key, but it is never injected as Bearer when routing.

Environment

• NemoClaw: v0.0.31
• Platform: Brev cloud, Ubuntu 22.04, A100-SXM4-80GB
• Ollama: v0.22.0, model qwen2.5:0.5b
• No OPENAI_API_KEY set in host env
• Clean machine — no pre-existing credentials.json entry for OPENAI_API_KEY

Expected Result

Routing proxy injects NEMOCLAW_OLLAMA_PROXY_TOKEN as Authorization: Bearer <token> on every ollama-local forward to :11435. Gateway-side Ollama proxy accepts the token. Agent calls succeed end-to-end.

Actual Result

• nemoclaw status: Inference: healthy (the liveness probe at http://127.0.0.1:11434/api/tags passes because it hits Ollama directly, bypassing the gateway route).
• TUI shows "kerfuffling" / "conjuring" indefinitely on any prompt.
• Sandbox logs show repeated NET:FAIL [LOW] inference.local:443 events.
• Direct curl http://localhost:11435/ → HTTP 401 Unauthorized, confirming the :11435 proxy validates a Bearer the routing proxy never sends.

Suspected Root Cause

The runtime routing proxy (openshell_router) does not read the provider's registered credentialEnv (now NEMOCLAW_OLLAMA_PROXY_TOKEN after PR #2580) and inject it as an Authorization: Bearer header when forwarding to :11435. Config says the right thing; the HTTP layer doesn't act on it.

Likely candidate paths to audit:

• openshell_router credential-injection middleware — confirm it resolves credentialEnv → env var → Bearer for all registered providers, not just ones with a non-null credentialEnv and a legacy OPENAI_API_KEY-style name.
• Whether the :11435 proxy's expected token name matches what the gateway reads from NEMOCLAW_OLLAMA_PROXY_TOKEN.

References

• Original issue: [Linux][Brev]Ollama-local provider returns HTTP 401 Unauthorized via inference.local — wizard caches OPENAI_API_KEY env var into credentials.json and not refreshable via env unset #2519 (closed against wizard-side 401 scope)
• Partial fix: PR fix(onboard): decouple local inference providers from OPENAI_API_KEY #2580 — fix(onboard): decouple local inference providers from OPENAI_API_KEY
• Diagnostic breadcrumb: openshell provider get ollama-local confirms credentialEnv is registered; sandbox logs confirm no Authorization header on the outbound request.