fix(ollama): allow Orb host local auth

dutifulbob · dutifulbob · commit 670bc6cae241 · 2026-05-21T21:45:07.000+08:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Providers/Ollama: treat Orb VM host aliases as local Ollama endpoints so `ollama-local` marker auth works when OpenClaw runs inside Orb and Ollama runs on the host. Fixes #84875.
 - Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
 - Memory/search: stop recall tracking from writing dreaming side-effect artifacts when `dreaming.enabled=false`, while preserving normal search results. Fixes #84436. (#84444) Thanks @NianJiuZst.
 - Diffs: render viewer toolbar icons from a closed icon-name map instead of HTML strings, removing the toolbar icon XSS sink. (#83955) Thanks @tanshanshan.
diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts
@@ -572,6 +572,29 @@ describe("ollama plugin", () => {
     expect(buildOllamaProviderMock).not.toHaveBeenCalled();
   });
 
+  it("skips implicit localhost discovery when a custom Orb host Ollama provider is configured", async () => {
+    const provider = registerProvider();
+
+    const result = await provider.catalog.run({
+      config: {
+        models: {
+          providers: {
+            "ollama-orb": {
+              api: "ollama",
+              baseUrl: "http://host.orb.internal:11434",
+              models: [{ id: "qwen3.5:27b", name: "Qwen 3.5 27B" }],
+            },
+          },
+        },
+      },
+      env: { NODE_ENV: "development", OLLAMA_API_KEY: "ollama-live" },
+      resolveProviderApiKey: () => ({ apiKey: "ollama-live" }),
+    } as never);
+
+    expect(result).toBeNull();
+    expect(buildOllamaProviderMock).not.toHaveBeenCalled();
+  });
+
   it("treats custom 127/8 Ollama providers as loopback for implicit discovery", async () => {
     const provider = registerProvider();
     buildOllamaProviderMock.mockResolvedValueOnce({
diff --git a/extensions/ollama/src/discovery-shared.test.ts b/extensions/ollama/src/discovery-shared.test.ts
@@ -15,6 +15,7 @@ describe("isLocalOllamaBaseUrl", () => {
     "http://192.168.1.100:11434",
     "http://gpu-node-1:11434",
     "http://mac-studio.local:11434",
+    "http://host.orb.internal:11434",
     "http://[fd00::1]:11434",
     "http://[fe90::1]:11434",
   ])("classifies %s as local", (baseUrl) => {
diff --git a/extensions/ollama/src/discovery-shared.ts b/extensions/ollama/src/discovery-shared.ts
@@ -70,7 +70,15 @@ function shouldSkipAmbientOllamaDiscovery(env: NodeJS.ProcessEnv): boolean {
   return Boolean(env.VITEST) || env.NODE_ENV === "test";
 }
 
-const LOCAL_OLLAMA_HOSTNAMES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "::"]);
+const LOCAL_OLLAMA_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "::",
+  "host.orb.internal",
+]);
+const LOOPBACK_OLLAMA_HOSTNAMES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "::"]);
 
 function isIpv4Loopback(host: string): boolean {
   if (!/^\d+\.\d+\.\d+\.\d+$/.test(host)) {
@@ -137,7 +145,7 @@ function isLoopbackOllamaBaseUrl(baseUrl: string | undefined | null): boolean {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
-  return LOCAL_OLLAMA_HOSTNAMES.has(host) || isIpv4Loopback(host);
+  return LOOPBACK_OLLAMA_HOSTNAMES.has(host) || isIpv4Loopback(host);
 }
 
 function hasExplicitRemoteOllamaApiProvider(
diff --git a/src/agents/model-auth.test.ts b/src/agents/model-auth.test.ts
@@ -1111,6 +1111,41 @@ describe("resolveApiKeyForProvider – synthetic local auth for custom providers
     });
   });
 
+  it("accepts ollama-local marker auth for Orb host aliases", async () => {
+    const auth = await resolveApiKeyForProvider({
+      provider: "ollama",
+      cfg: {
+        models: {
+          providers: {
+            ollama: {
+              baseUrl: "http://host.orb.internal:11434",
+              api: "ollama",
+              apiKey: "ollama-local",
+              models: [
+                {
+                  id: "qwen3.5:27b",
+                  name: "Qwen 3.5 27B",
+                  reasoning: false,
+                  input: ["text"],
+                  cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                  contextWindow: 262144,
+                  maxTokens: 8192,
+                },
+              ],
+            },
+          },
+        },
+      },
+      store: { version: 1, profiles: {} },
+    });
+
+    expectAuthFields(auth, {
+      apiKey: "ollama-local",
+      source: "models.json (local marker)",
+      mode: "api-key",
+    });
+  });
+
   it("does not accept non-secret local markers for remote custom providers", async () => {
     await expect(
       resolveApiKeyForProvider({
diff --git a/src/agents/model-auth.ts b/src/agents/model-auth.ts
@@ -267,6 +267,7 @@ function isLocalBaseUrl(baseUrl: string): boolean {
       host === "::1" ||
       host === "::ffff:7f00:1" ||
       host === "::ffff:127.0.0.1" ||
+      host === "host.orb.internal" ||
       host.endsWith(".local") ||
       isPrivateIpv4Host(host)
     );
