Ollama web-search provider fails with TypeError: fetch failed even when ollama.com is reachable and key is valid

OpenClaw version: 2026.4.23 (a979721) Node: v22.22.2 OS: Linux (Azure VM, x64) Provider: ollama (Ollama Cloud Web Search)

Summary

openclaw capability web search --provider ollama --query ... fails with bare TypeError: fetch failed and a follow-up gateway warn Ollama could not be reached at https://ollama.com., even though:

• Plain curl to https://ollama.com/api/web_search (with the same Bearer token) returns 200 and real results.
• A direct globalThis.fetch(...) from Node 22 to the same endpoint succeeds.
• fetchWithSsrFGuard invoked manually from a Node script with policy: { hostnameAllowlist: ['ollama.com'], allowPrivateNetwork: true } succeeds end-to-end against https://ollama.com/api/web_search.
• DuckDuckGo provider (--provider duckduckgo) works fine via the same gateway, so transport, SSRF guard, and dispatcher pipeline are all healthy.

So the failure is Ollama-provider-specific, not a network/TLS/SSRF issue.

Repro

1. openclaw config set tools.web.search.provider ollama
2. Configure key under plugins.entries.ollama.config.webSearch.{baseUrl: "https://ollama.com", apiKey: "<valid ollama.com key>"} (also tried models.providers.ollama.{baseUrl, apiKey}).
3. openclaw gateway restart
4. openclaw capability web search --provider ollama --query "weather Seattle" --limit 2

Observed:

TypeError: fetch failed

Gateway log also emits: Ollama could not be reached at https://ollama.com.

Findings while debugging

In dist/web-search-provider-DIPTM49D.js:

1. Stale endpoint path. OLLAMA_WEB_SEARCH_PATH is set to /api/experimental/web_search, but the live Ollama Cloud endpoint is /api/web_search. The experimental path returns 404 {"error":"path \"/api/experimental/web_search\" not found"}. (Patching this string in dist did not fix the bare fetch failed, so the path is wrong but isn't the only issue surfaced as fetch failed — possibly the prereq path masks it.)

2. resolveOllamaWebSearchBaseUrl actively rejects https://ollama.com. The fallback path through models.providers.ollama.baseUrl does:

   const baseUrl = resolveOllamaApiBase(configuredBaseUrl);
   if (baseUrl !== "https://ollama.com") return baseUrl;
   // falls through to OLLAMA_DEFAULT_BASE_URL = http://127.0.0.1:11434

   That's almost certainly inverted — the cloud URL is the very thing this provider should accept. Plugin path (plugins.entries.ollama.config.webSearch.baseUrl) is read first and isn't filtered, which is what saved me here.

3. warnOllamaWebSearchPrereqs calls fetchOllamaModels(baseUrl) against <baseUrl>/api/tags. https://ollama.com/api/tags actually returns 200 (a model catalog) when called from curl or raw Node fetch, but the gateway logs "Ollama could not be reached at https://ollama.com." — so either the prereq-check version of fetchWithSsrFGuard or its policy in this codepath is rejecting the call. I didn't fully isolate this one.

4. The thrown error has no surfaced cause/stack at the CLI; only the wrapper string TypeError: fetch failed reaches the user. Useful to log error.cause for SSRF/dispatcher diagnostics here.

Suggested fixes

• Fix OLLAMA_WEB_SEARCH_PATH to /api/web_search.
• Remove the if (baseUrl !== "https://ollama.com") return baseUrl; filter in resolveOllamaWebSearchBaseUrl — that branch defeats the cloud usage entirely; keep the loopback default only as a fallback when no baseUrl is configured at all.
• In the search/prereq codepath, log error.cause?.message/error.cause?.code on TypeError: fetch failed to make these failures debuggable.
• The provider's requiresCredential: false is misleading for cloud usage; it does need a key.

Workaround

Switching tools.web.search.provider to duckduckgo works without any further config, so users can fall back there.