* fix(ollama): do not advertise tools when /api/show fails
Failed show responses left capabilities undefined, which
buildOllamaModelDefinition treats as optimistic supportsTools.
Match setup inspect: return empty capabilities instead.
* test(ollama): cover show-fail tools gate including L3 live HTTP
Unit paths for HTTP error/throw plus real 127.0.0.1 server proving
buildOllamaProvider keeps supportsTools false when /api/show 500s.
* fix(ollama): keep reasoning heuristics when /api/show fails
Distinguish failed inspection from authoritative empty capabilities
so tools stay conservative without suppressing model-name reasoning.
* test(ollama): cover three capability states for tools and reasoning
Failed show keeps reasoning heuristics; authoritative [] disables both.
* fix(ollama): propagate showInspectionFailed through setup configs
Setup inspection failures now use the three-state marker instead of
authoritative empty capabilities, keeping tools off and reasoning heuristics.
* test(ollama): setup show-fail keeps tools off and reasoning heuristics
Cover interactive setup when /api/show returns 500 for deepseek-r1.
* fix(ollama): propagate showInspectionFailed through dynamic model resolve
/models add dynamic path now builds failed-show definitions with tools
off while preserving reasoning name heuristics.
* test(ollama): dynamic resolve covers failed /api/show three-state behavior
Mock builder matches production tools/reasoning contract for inspection failure.
* fix(ollama): keep catalog-missing dynamic resolve fail-closed on show failure
Failed /api/show is an existence probe for unresolved models; return undefined so typos/404s stay rejected. Tag-discovered and setup paths keep showInspectionFailed tools-off behavior.
* chore(changelog): remove release-owned entry
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* fix(ollama): bound model-discovery JSON response reads
The /api/tags and /api/show discovery reads in extensions/ollama/src/provider-models.ts
parsed their HTTP responses with an unbounded await response.json(). Ollama base URLs
are user-supplied and can point at remote/cloud endpoints, so a hostile or buggy server
(or one reachable via SSRF) could stream an unbounded or never-ending JSON body and drive
model discovery into OOM.
Route both reads through the shared @openclaw/media-core byte-bounded reader
(readResponseWithLimit, re-exported via openclaw/plugin-sdk/response-limit-runtime) under
a single 16 MiB cap before JSON.parse, cancelling the stream on overflow. Overflow throws a
bounded error that the existing fail-soft handlers swallow, so a capped endpoint degrades
gracefully: /api/tags returns { reachable: false, models: [] } and /api/show returns {}.
Symmetric counterpart to the #95103/#95108 response-limit campaign.
AI-assisted.
* fix(ollama): reuse shared bounded JSON reader for model discovery
Replace the local readOllamaDiscoveryJson helper with the shared
readProviderJsonResponse (from openclaw/plugin-sdk/provider-http), which
already enforces the 16 MiB cap, cancels the stream on overflow, and wraps
malformed JSON with the caller label. The /api/tags and /api/show discovery
reads now go through it directly while keeping the existing fail-soft
handlers ({ reachable: false, models: [] } and {}).
Add a focused regression test: when a discovery stream exceeds the JSON byte
cap, fetchOllamaModels returns { reachable: false, models: [] },
queryOllamaModelShowInfo returns {}, and the bounded reader cancels the body
mid-flight so less than the full advertised stream is read.
Summary:
- The branch makes unknown-capabilities Ollama model definitions explicitly tool-capable, adds regression assertions and changelog text, and guards the issue-labeler job to run only on issue events.
- Reproducibility: yes. for the metadata gap: current main builds unknown-capabilities Ollama models without a ... er-fix live provider output with `supportsTools: true`. I did not run local tests in this read-only review.
Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(ollama): default unknown capabilities to tools
Validation:
- ClawSweeper review passed for head 27527716c0.
- Required merge gates passed before the squash merge.
Prepared head SHA: 27527716c0
Review: https://github.com/openclaw/openclaw/pull/84075#issuecomment-4486492661
Co-authored-by: Bob <dutifulbob@gmail.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: osolmaz
Co-authored-by: osolmaz <2453968+osolmaz@users.noreply.github.com>
Vincent Koc