fix(ollama): allow Orb host local auth

clawsweeper[bot] · clawsweeper[bot] · commit 0058151e41c6 · 2026-05-21T15:05:20.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,7 +13,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
-- Providers/Ollama: treat Orb VM host aliases as local Ollama endpoints so `ollama-local` marker auth works when OpenClaw runs inside Orb and Ollama runs on the host. Fixes #84875.
+- Providers/Ollama: treat OrbStack host aliases as local Ollama endpoints so `ollama-local` marker auth works when OpenClaw runs inside Orb and Ollama runs on the host. Fixes #84875.
 - Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
 - Control UI/Web Push: use `https://openclaw.ai` as the generated default VAPID subject instead of the old localhost mailbox so iOS PWA push setup uses an Apple-acceptable subject when `OPENCLAW_VAPID_SUBJECT` is unset. Fixes #83134. (#83317) Thanks @IWhatsskill.
 - Agents/Pi: keep embedded session transcript writes from tripping false takeover detection after packaged npm onboarding agent turns.
diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts
@@ -572,28 +572,31 @@ describe("ollama plugin", () => {
     expect(buildOllamaProviderMock).not.toHaveBeenCalled();
   });
 
-  it("skips implicit localhost discovery when a custom Orb host Ollama provider is configured", async () => {
-    const provider = registerProvider();
-
-    const result = await provider.catalog.run({
-      config: {
-        models: {
-          providers: {
-            "ollama-orb": {
-              api: "ollama",
-              baseUrl: "http://host.orb.internal:11434",
-              models: [{ id: "qwen3.5:27b", name: "Qwen 3.5 27B" }],
+  it.each(["docker.orb.internal", "host.orb.internal"])(
+    "skips implicit localhost discovery when a custom Orb host Ollama provider is configured for %s",
+    async (hostname) => {
+      const provider = registerProvider();
+
+      const result = await provider.catalog.run({
+        config: {
+          models: {
+            providers: {
+              "ollama-orb": {
+                api: "ollama",
+                baseUrl: `http://${hostname}:11434`,
+                models: [{ id: "qwen3.5:27b", name: "Qwen 3.5 27B" }],
+              },
             },
           },
         },
-      },
-      env: { NODE_ENV: "development", OLLAMA_API_KEY: "ollama-live" },
-      resolveProviderApiKey: () => ({ apiKey: "ollama-live" }),
-    } as never);
+        env: { NODE_ENV: "development", OLLAMA_API_KEY: "ollama-live" },
+        resolveProviderApiKey: () => ({ apiKey: "ollama-live" }),
+      } as never);
 
-    expect(result).toBeNull();
-    expect(buildOllamaProviderMock).not.toHaveBeenCalled();
-  });
+      expect(result).toBeNull();
+      expect(buildOllamaProviderMock).not.toHaveBeenCalled();
+    },
+  );
 
   it("treats custom 127/8 Ollama providers as loopback for implicit discovery", async () => {
     const provider = registerProvider();
diff --git a/extensions/ollama/src/discovery-shared.test.ts b/extensions/ollama/src/discovery-shared.test.ts
@@ -15,6 +15,7 @@ describe("isLocalOllamaBaseUrl", () => {
     "http://192.168.1.100:11434",
     "http://gpu-node-1:11434",
     "http://mac-studio.local:11434",
+    "http://docker.orb.internal:11434",
     "http://host.orb.internal:11434",
     "http://[fd00::1]:11434",
     "http://[fe90::1]:11434",
diff --git a/extensions/ollama/src/discovery-shared.ts b/extensions/ollama/src/discovery-shared.ts
@@ -76,6 +76,7 @@ const LOCAL_OLLAMA_HOSTNAMES = new Set([
   "0.0.0.0",
   "::1",
   "::",
+  "docker.orb.internal",
   "host.orb.internal",
 ]);
 const LOOPBACK_OLLAMA_HOSTNAMES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "::"]);
diff --git a/src/agents/model-auth.test.ts b/src/agents/model-auth.test.ts
@@ -1111,40 +1111,43 @@ describe("resolveApiKeyForProvider – synthetic local auth for custom providers
     });
   });
 
-  it("accepts ollama-local marker auth for Orb host aliases", async () => {
-    const auth = await resolveApiKeyForProvider({
-      provider: "ollama",
-      cfg: {
-        models: {
-          providers: {
-            ollama: {
-              baseUrl: "http://host.orb.internal:11434",
-              api: "ollama",
-              apiKey: "ollama-local",
-              models: [
-                {
-                  id: "qwen3.5:27b",
-                  name: "Qwen 3.5 27B",
-                  reasoning: false,
-                  input: ["text"],
-                  cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-                  contextWindow: 262144,
-                  maxTokens: 8192,
-                },
-              ],
+  it.each(["docker.orb.internal", "host.orb.internal"])(
+    "accepts ollama-local marker auth for Orb host alias %s",
+    async (hostname) => {
+      const auth = await resolveApiKeyForProvider({
+        provider: "ollama",
+        cfg: {
+          models: {
+            providers: {
+              ollama: {
+                baseUrl: `http://${hostname}:11434`,
+                api: "ollama",
+                apiKey: "ollama-local",
+                models: [
+                  {
+                    id: "qwen3.5:27b",
+                    name: "Qwen 3.5 27B",
+                    reasoning: false,
+                    input: ["text"],
+                    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                    contextWindow: 262144,
+                    maxTokens: 8192,
+                  },
+                ],
+              },
             },
           },
         },
-      },
-      store: { version: 1, profiles: {} },
-    });
+        store: { version: 1, profiles: {} },
+      });
 
-    expectAuthFields(auth, {
-      apiKey: "ollama-local",
-      source: "models.json (local marker)",
-      mode: "api-key",
-    });
-  });
+      expectAuthFields(auth, {
+        apiKey: "ollama-local",
+        source: "models.json (local marker)",
+        mode: "api-key",
+      });
+    },
+  );
 
   it("does not accept non-secret local markers for remote custom providers", async () => {
     await expect(
diff --git a/src/agents/model-auth.ts b/src/agents/model-auth.ts
@@ -267,6 +267,7 @@ function isLocalBaseUrl(baseUrl: string): boolean {
       host === "::1" ||
       host === "::ffff:7f00:1" ||
       host === "::ffff:127.0.0.1" ||
+      host === "docker.orb.internal" ||
       host === "host.orb.internal" ||
       host.endsWith(".local") ||
       isPrivateIpv4Host(host)
