fix(ollama): allow Orb host local auth

clawsweeper[bot] · clawsweeper[bot] · commit cb82dcf52263 · 2026-05-21T15:27:09.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -15,7 +15,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
-- Providers/Ollama: treat OrbStack host aliases as local Ollama endpoints so `ollama-local` marker auth works when OpenClaw runs inside Orb and Ollama runs on the host. Fixes #84875.
+- Providers/Ollama: treat Docker/OrbStack host aliases as local Ollama endpoints so `ollama-local` marker auth works when OpenClaw runs inside a VM/container and Ollama runs on the host. Fixes #84875.
 - Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
 - Control UI/Web Push: use `https://openclaw.ai` as the generated default VAPID subject instead of the old localhost mailbox so iOS PWA push setup uses an Apple-acceptable subject when `OPENCLAW_VAPID_SUBJECT` is unset. Fixes #83134. (#83317) Thanks @IWhatsskill.
 - Agents/Pi: keep embedded session transcript writes from tripping false takeover detection after packaged npm onboarding agent turns.
diff --git a/extensions/ollama/index.test.ts b/extensions/ollama/index.test.ts
@@ -572,8 +572,8 @@ describe("ollama plugin", () => {
     expect(buildOllamaProviderMock).not.toHaveBeenCalled();
   });
 
-  it.each(["docker.orb.internal", "host.orb.internal"])(
-    "skips implicit localhost discovery when a custom Orb host Ollama provider is configured for %s",
+  it.each(["docker.orb.internal", "host.docker.internal", "host.orb.internal"])(
+    "skips implicit localhost discovery when a custom host-backed Ollama provider is configured for %s",
     async (hostname) => {
       const provider = registerProvider();
 
diff --git a/extensions/ollama/src/discovery-shared.test.ts b/extensions/ollama/src/discovery-shared.test.ts
@@ -16,6 +16,7 @@ describe("isLocalOllamaBaseUrl", () => {
     "http://gpu-node-1:11434",
     "http://mac-studio.local:11434",
     "http://docker.orb.internal:11434",
+    "http://host.docker.internal:11434",
     "http://host.orb.internal:11434",
     "http://[fd00::1]:11434",
     "http://[fe90::1]:11434",
diff --git a/extensions/ollama/src/discovery-shared.ts b/extensions/ollama/src/discovery-shared.ts
@@ -77,6 +77,7 @@ const LOCAL_OLLAMA_HOSTNAMES = new Set([
   "::1",
   "::",
   "docker.orb.internal",
+  "host.docker.internal",
   "host.orb.internal",
 ]);
 const LOOPBACK_OLLAMA_HOSTNAMES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "::"]);
diff --git a/src/agents/model-auth.test.ts b/src/agents/model-auth.test.ts
@@ -1111,8 +1111,8 @@ describe("resolveApiKeyForProvider – synthetic local auth for custom providers
     });
   });
 
-  it.each(["docker.orb.internal", "host.orb.internal"])(
-    "accepts ollama-local marker auth for Orb host alias %s",
+  it.each(["docker.orb.internal", "host.docker.internal", "host.orb.internal"])(
+    "accepts ollama-local marker auth for host-backed alias %s",
     async (hostname) => {
       const auth = await resolveApiKeyForProvider({
         provider: "ollama",
diff --git a/src/agents/model-auth.ts b/src/agents/model-auth.ts
@@ -268,6 +268,7 @@ function isLocalBaseUrl(baseUrl: string): boolean {
       host === "::ffff:7f00:1" ||
       host === "::ffff:127.0.0.1" ||
       host === "docker.orb.internal" ||
+      host === "host.docker.internal" ||
       host === "host.orb.internal" ||
       host.endsWith(".local") ||
       isPrivateIpv4Host(host)
