fix(ollama): allow Orb host local auth#84963
Conversation
|
Codex review: passed. Workflow note: Future ClawSweeper reviews update this same comment in place. How this review workflow works
Summary Reproducibility: yes. The linked issue provides a concrete OrbStack config and missing-auth log, and current main's local-host checks exclude PR rating Rank-up moves:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. Real behavior proof Risk before merge
Maintainer options:
Next step before merge Security Review detailsBest possible solution: Land the narrow alias-classification fix after exact-head checks pass, preserving remote-host credential boundaries and loopback-only implicit discovery suppression. Do we have a high-confidence way to reproduce the issue? Yes. The linked issue provides a concrete OrbStack config and missing-auth log, and current main's local-host checks exclude Is this the best way to solve the issue? Yes. The branch keeps the fix narrow by adding the OrbStack aliases only to local-auth classification and separating loopback discovery suppression so remote/custom-provider behavior stays intact. Label changes:
Label justifications:
What I checked:
Likely related people:
Codex review notes: model gpt-5.5, reasoning high; reviewed against 66dcc4ee8fd1. |
|
ClawSweeper PR egg ✨ Hatched: 🥚 common Pearl Shellbean Hatch commandComment Hatchability rules:
Rarity: 🥚 common. What is this egg doing here?
|
|
Maintainer real behavior proof for the Orb host Ollama path. Behavior addressed: Real environment tested: macOS host with OrbStack 2.1.3 and real Ollama 0.24.0 installed/running on the host; temporary Orb Ubuntu arm64 machine; OpenClaw PR head Exact steps or command run after this patch: git diff --check
node scripts/run-vitest.mjs src/agents/model-auth.test.ts extensions/ollama/src/discovery-shared.test.ts extensions/ollama/index.test.ts extensions/ollama/src/setup.test.ts extensions/ollama/src/provider-models.ssrf.test.ts
node --import tsx --input-type=module # source-level resolveApiKeyForProvider repro for http://host.orb.internal:11434
ollama pull smollm2:135m
orb -m openclaw-ollama-proof sh -lc 'curl -fsS --max-time 20 http://host.orb.internal:11434/api/tags; curl -fsS --max-time 60 http://host.orb.internal:11434/api/generate -d "{\"model\":\"smollm2:135m\",\"prompt\":\"Reply with exactly: orb-ok\",\"stream\":false}"'Evidence after fix: Observed result after fix: the PR accepts the Orb host alias for local Ollama marker auth, preserves remote-host auth boundaries, and a real Orb VM can reach host-side Ollama through What was not tested: the reporter's exact |
|
@clawsweeper automerge |
|
🦞🔧 Source: I will update this PR branch, or open a safe credited replacement, if the repair worker finds a narrow CI fix. Automerge progress:
|
670bc6c to
0058151
Compare
|
ClawSweeper 🐠 reef update Thanks for the contribution. ClawSweeper hit a branch-permission wall on this PR, so it opened a replacement branch to keep review moving while preserving credit. Why replacement: ClawSweeper could not update the source PR branch directly; GitHub did not grant sufficient push rights to the bot for that branch.
fish notes: model gpt-5.5, reasoning high; reviewed against cb82dcf. |
Summary
host.orb.internalas a local Ollama host forollama-localmarker auth.Closes #84875
Verification
git diff --checknode scripts/run-vitest.mjs src/agents/model-auth.test.ts extensions/ollama/src/discovery-shared.test.ts extensions/ollama/index.test.ts extensions/ollama/src/setup.test.ts extensions/ollama/src/provider-models.ssrf.test.tsnode --import tsx --input-type=modulesource-level auth repro forhttp://host.orb.internal:11434codex review --commit HEADaccepted one loopback/discovery finding; the patch now separates local-auth hosts from loopback-discovery hosts and the rerun completed its focused Vitest proof before entering the known helper recursion path, which was stopped.Real behavior proof
Behavior addressed:
models.providers.ollamawithbaseUrl: "http://host.orb.internal:11434"andapiKey: "ollama-local"now resolves local marker auth instead of falling through toNo API key found for provider "ollama".Real environment tested: Local OpenClaw source worktree on Node 22.22.0; the issue was also reproduced against
v2026.5.19in a detached local worktree before this patch.Exact steps or command run after this patch: Ran the focused Vitest command listed above,
git diff --check, and a source-levelresolveApiKeyForProviderrepro using an explicit empty auth-profile store and the reported Orb base URL.Evidence after fix: The source-level repro returned
isLocalOllamaBaseUrl: trueandresolvedAuth: { apiKey: "ollama-local", source: "models.json (local marker)", mode: "api-key" }; the focused Vitest run passed 6 files and 188 tests.Observed result after fix:
host.orb.internalis accepted as local Ollama for auth; explicit Orb host Ollama providers are treated as non-loopback custom providers for discovery suppression.What was not tested: A live Orb VM with a real host-side Ollama server. Crabbox/Testbox proof was attempted but unavailable locally because no Crabbox coordinator token/AWS broker credentials were present and the Blacksmith CLI was not installed/authenticated.