[developerz-ai]

What

doctor's Ollama step reported "bound to loopback only" from the configured
OLLAMA_HOST without inspecting the socket, and the bind read only matched
wildcard addresses, so an ollama listening on a routable interface IP was
invisible. Read the observed listener instead: report any non-loopback bind
as a failure with its fix line, and only claim loopback once the listener
was actually inspected. Adds tests/ollama_bind_test.sh.

Acceptance

• doctor's Ollama step reports a listener bound to a routable IP (e.g. 192.168.1.10:11434) as a failure whose fix line names the command that fixes it
• "bound to loopback only" is printed only when the listener was inspected and every observed bind is loopback; with ss absent doctor prints no such line and reports the bind as unverified with a fix line
• tests/ollama_bind_test.sh fails against the pre-change lib/doctor.sh:247-256 and lib/ollama.sh:30-39, and passes on the merged tree
• bash .github/run-tests.sh is green, including the new member picked up by the runner's tests/*.sh glob
• no package-manager name (apt, dnf, pacman, iproute2) is added to lib/; the missing-ss fix line comes from platform_install_cmd_for ss
• the outbound-https warning (lib/doctor.sh:51-55 and :215) and the sudo package fix line (lib/doctor.sh:113) are unchanged
• tests/init_test.sh stays hermetic: the doctor run under test never consults the host's real ss, and its healthy-host counters still read 0 failures and 0 warnings
• tests/ollama_systemd_failure_test.sh still passes unchanged (ollama_public_bind's name, output shape and ollama_bind_local's behaviour are untouched)
• docs/usage.md:160-161 and README.md:248-251 no longer claim doctor only catches a 0.0.0.0 bind
• bash -n over bin/mini lib/.sh platforms/.sh install.sh is clean and the CI ShellCheck flags report nothing new in the changed files

Changes

• lib/ollama.sh (edit) — Widen the listener read so a routable-IP bind is as visible as the wildcard: the ss -tlnH local-address field (field 4) must yield every NON-loopback bind on the ollama port (0.0.0.0, *, [::] AND e.g. 192.168.1.10:11434), and a NEW function next to it must expose the observed addresses so the caller can tell 'inspected and loopback' from 'could not inspect' (no ss). Keep ollama_is_loopback/ollama_up/ollama_version/ollama_public_bind/ollama_bind_local names, output shapes and exit codes unchanged; do not touch ollama_write_systemd_dropin.
• lib/doctor.sh (edit) — Ollama step (lib/doctor.sh:247-256) must decide the bind from the OBSERVED listener: any non-loopback bind is a d_fail plus a d_fix line naming the command that fixes it; 'bound to loopback only' is printed only when the listener was inspected and every observed bind is loopback; when it cannot be inspected (no ss) doctor says the bind is unverified and prints a fix line via $(platform_install_cmd_for ss). No package-manager name in lib/. Leave the outbound-https warning (:51-55, :215) and the sudo fix line (:113) alone.
• tests/init_test.sh (edit) — Keep the stubbed doctor run hermetic: stub every lib/ollama.sh function the Ollama step now calls (including the new listener helper) so the host's real ss is never consulted, and keep the healthy-host counters (0 failures, 0 warnings) holding. The existing stubs for ollama_up/ollama_version/ollama_public_bind/ollama_is_loopback stay as they are.
• tests/ollama_bind_test.sh (create) — New hermetic test (own mktemp sandbox, no network, no host service) that drives doctor the way tests/init_test.sh's doctor_case does, with a fake ss on PATH: a routable bind 192.168.1.10:11434 must be reported as a failure with a fix line and NO 'loopback only' line; a 127.0.0.1 bind must print 'loopback only'; with no ss available doctor must print no 'loopback only' line. Assert the mechanism (the failure counter / the reported address), not just wording. Write it FIRST: it must fail against today's lib/doctor.sh:247-256 and lib/ollama.sh:30-39, then pass after the fix.
• docs/usage.md (edit) — docs/usage.md:160-161 claims mini doctor 'fails loudly if it finds it bound to 0.0.0.0'. After this change doctor fails on ANY non-loopback bind (wildcard or a routable IP) and only claims 'loopback only' once it has inspected the listener; without ss it reports the bind as unverified. Update that sentence to match. Prose only — no other claim in this file is affected.
• README.md (edit) — README.md:248-251 repeats the same claim ('mini doctor fails loudly if it sees a 0.0.0.0 bind'). Update it to the new behaviour: any non-loopback bind (wildcard or routable IP) is a failure, and 'loopback only' is only claimed after the listener was actually inspected. Keep the README's voice and line width; prose only.
• CLAUDE.md (edit) — [docs] CLAUDE.md:121 says the runner's default member list is 'all nine today' and the table at 123-133 lists nine scripts; this diff added tests/ollama_bind_test.sh, so the suite now has ten members (tests/*.sh glob yields 10 files). Change 'nine' to 'ten' and add the table row '| ollama_bind_test.sh | doctor's ollama bind verdict, read from the observed listener |' in alphabetical position before ollama_systemd_failure_test.sh.

Verification

No check command was found for this repository, so no gate ran before the commit.

What the editors ran to see the change working, and what they saw:

• bash -n lib/ollama.sh lib/doctor.sh && bash .github/run-tests.sh tests/init_test.sh tests/ollama_bind_test.sh (bind): All 2 test script(s) passed. init_test: 61 passed, 0 failed (healthy stubbed host: fails no check, warns about nothing, exits 0). ollama_bind_test: 22 passed, 0 failed — routable bind reported as a failure (+1 failure, 0 warnings), wildcard '0.0.0.0:11434, [::]:11434', loopback 'bound to loopback only' (0/0), no ss -> 'the bind is reported as unverified' + 'fix: sudo apt install -y iproute2' (0 failures, 1 warning). Exit 0.
• copied the tree to /tmp/mini-pre, reverted lib/ollama.sh's ollama_public_bind and lib/doctor.sh's Ollama step to their pre-change form there, ran bash tests/ollama_bind_test.sh against that copy (bind): 9 failed, 13 passed, exit 1 — 'a routable bind is reported as a failure: missing [ollama is listening on 192.168.1.10:11434 — reachable from the network, with no auth]', 'a routable bind is not called loopback-only: unexpectedly found [bound to loopback only]', 'a routable bind adds exactly one failure — expected [1], got [0]', 'no ss -> the bind is reported as unverified: missing [unverified]'. The checkout was never modified.
• bash tests/ollama_systemd_failure_test.sh (bind): 11 PASS lines (daemon-reload/restart fail closed, local rebind refusal, systemd refusal, stop paths), exit 0 — the ollama_public_bind contract is untouched.
• grep -nE '\b(apt|apt-get|dnf|pacman|zypper|apk|yum|iproute2)\b' lib/*.sh (bind): Only pre-existing lines match (lib/doctor.sh 108, 113, 116; lib/opencode.sh prompt templates); my new lib/ lines add no package-manager name — the missing-ss fix line comes from platform_install_cmd_for ss in platforms/debian.sh.
• grep -nE 'public_bind|listen_binds|addr_is_loopback|is_loopback' across the repo (bind): ollama_public_bind is called only by lib/doctor.sh:256 and lib/ollama.sh:118 (ollama_bind_local); ollama_is_loopback still used at lib/ollama.sh:94 and :175 (ollama_write_systemd_dropin untouched); the new ollama_listen_binds is stubbed at tests/init_test.sh:331 and exercised for real in tests/ollama_bind_test.sh.
• code_grep over *.md for '0\.0\.0\.0|loopback only|bound to' and for 'reachable from the network|public interface|doctor.{0,40}bind|bind.{0,40}doctor' (docs): After the edits the only remaining hits are CLAUDE.md:53 (a house rule about mini's own listeners, not a doctor-detection claim) and the two rewritten passages; no other markdown page still claims doctor catches only a 0.0.0.0 bind.
• code_changes on docs/usage.md and README.md, then code_read of both edited regions (docs): docs/usage.md:160-166 now reads 'reads the live listener rather than the configured host: any bind that is not loopback — 0.0.0.0, ::, or a routable address such as 192.168.1.10 — is a failure ... "bound to loopback only" is reported only after the listener has actually been inspected; on a box without ss the bind cannot be checked, so doctor calls it unverified and prints the command that installs ss.' README.md:248-254 says the same in README voice. No other file modified.
• code_read lib/doctor.sh:245-272 and lib/ollama.sh:30-71, plus code_grep over README.md and docs/ for 0.0.0.0|11434|loopback|unverified (docs): doctor's three branches: d_fail "ollama is listening on ${addrs} — reachable from the network, with no auth" + d_fix "mini serve --local ..."; d_ok "bound to loopback only" only when inspected=1; d_warn "could not inspect the ollama listener — the bind is unverified" + d_fix "$(platform_install_cmd_for ss)" when inspected=0. The grep found the only 0.0.0.0 mentions left are the updated ones at README.md:251 and docs/usage.md:162.
• bash tests/ollama_bind_test.sh (doctor): 25 passed, 0 failed — including the new case: "ok a shifting listener table is not called loopback-only", "ok a shifting listener table reports no bind it never read", "ok the listener table is read once"; the pre-existing routable/wildcard/loopback/no-ss cases still pass (22 assertions).
• cd /tmp/prechange && bash tests/ollama_bind_test.sh (a tar copy of the tree with lib/doctor.sh restored to the pre-change two-read block) (doctor): 23 passed, 2 failed — "FAIL a shifting listener table is not called loopback-only — unexpectedly found [bound to loopback only]" and "FAIL the listener table is read once — expected [1], got [2]". The new case fails against the pre-change doctor.sh and passes on the merged tree.
• +3 more

Notes

Premises of the request the team disproved:

• The request says lib/ollama.sh:32-39 'can leave it on a routable interface'. Those lines are the read-only reporter ollama_public_bind (lib/ollama.sh:30-39) — it never touches the server. The code that can leave ollama off loopback is lib/ollama.sh:140-146, where the systemd drop-in pins OLLAMA_HOST=127.0.0.1 only when ollama_is_loopback is true. That writer is out of scope for this piece.

Handoffs this run could not complete:

• README.md — doctor's Ollama step now decides the bind from the observed listener instead of from OLLAMA_HOST: it fails on every non-loopback bind (wildcard 0.0.0.0 / * / [::] and routable addresses such as 192.168.1.10:11434), and reports the bind as unverified — with a fix line from platform_install_cmd_for ss — when the listener cannot be inspected.; README.md:248-251 still claims mini doctor "fails loudly if it finds it bound to 0.0.0.0". That is now too narrow: a routable-address bind is caught too, and a missing ss is reported as unverified rather than ignored. The sentence must say doctor fails on any bind that is not loopback (and reports an unverified bind when ss is absent). (the editor sent to make it neither wrote it nor said why not)
• docs/usage.md — same as README: the Ollama step's verdict comes from the observed listener, and covers every non-loopback bind plus the unverified (no ss) case.; docs/usage.md:160-161 makes the same 0.0.0.0-only claim about mini doctor. It must be updated to match the new behaviour: any non-loopback bind is a failure, and an uninspected bind (no ss) is reported as unverified with the ss install command as its fix. (the editor sent to make it neither wrote it nor said why not)
• CLAUDE.md — tests/ollama_bind_test.sh is a suite member (the runner picks it up by its tests/*.sh glob — .github/run-tests.sh:46) and now carries a fourth case, so the offline suite has ten members, not nine.; CLAUDE.md:121 says "all nine today" and the table at CLAUDE.md:123-133 lists nine scripts; ollama_bind_test.sh is missing from it, so the steering file under-counts the suite the CI step runs. The fix is to change "all nin

…(truncated)

---

🤖 Opened by developerz.ai for task tsk_90e99ced6878c631e688ca38994ecbe6 on developerz-ai/mini.

Raised automatically by the raw_task_triage lane.

🤖 developerz.ai, an automated agent, not a human — this PR is one slice of a stacked plan.
Dispatched automatically by the raw_task_triage lane
Model MiniMax-M3 on api.minimax.io via native, funded by account_key
Ran on box hv-dedicated-dev-marshall
Cost ~$0.84 for 7.3M in / 189.4k out (estimate: list price x reported tokens, cached input at its cached rate)
Run timeline run_a30e54c9aba54b0c8117ee2ea03fd071
Part 1/1 of plan rtk_5739467c8bf0410795c408d65cf1271c

[developerz-ai]

✅ Reviewed — nothing blocking

0 actionable comment(s) · grounded on your code

_{⏱ 50s wall clock · claude-opus-5-5 via custom · 2 model call(s) · 1,171 output token(s)}

_{🤖 developerz.ai — automated review, running on your model and your box.}

[developerz-ai]

Review summary — 7 file(s), 1 finding(s).

Critical 0 · Major 0 · Minor 1 · Nit 0

The doctor bind tests are sound, but the widened ollama_public_bind behind the post-rebind warning in ollama_bind_local has no test that fails if the change is reverted.

🤖 developerz.ai review — automated, running on your model and your box. What is this? · Reviewed by custom/claude-opus-5-5 on box hv-dedicated-ci-0 — 234.6k in / 5.09k out over 3 calls, on your flat-rate plan: no per-token charge (no list price on record).

[developerz-ai]

Address review findings on #39

• Picked up
• Surveying the repo
• Working
• Pull request opened — fix(doctor): verify the ollama bind against the real listener #39
• Done

Work landed on #39 — watching it toward merge.

9m · 37 tool calls · 9 messages

Sessions: coding run · review 1

---

🤖 developerz.ai, an automated agent, not a human — hv-dedicated-dev-marshall (developerz-ai[bot]) · model claude-sonnet-5 on router.ai.developerz.ai

[developerz-ai]

Review summary — 1 file(s), 0 finding(s).

This increment adds a direct test of ollama_public_bind covering routable, wildcard and loopback listeners. It answers the earlier finding that a regression to wildcard-only matching would go unnoticed, and it adds low risk.

🤖 developerz.ai review — automated, running on your model and your box. What is this? · Reviewed by custom/claude-opus-5-5 on box hv-dedicated-dev-marshall — 69.1k in / 1.17k out over 2 calls, on your flat-rate plan: no per-token charge (no list price on record).