Memory: preserve Ollama env fallback semantics

joshavant · joshavant · commit 7bcead1ddf33 · 2026-03-05T17:17:48.000-06:00
diff --git a/src/memory/embeddings-ollama.test.ts b/src/memory/embeddings-ollama.test.ts
@@ -44,7 +44,7 @@ describe("embeddings-ollama", () => {
           providers: {
             ollama: {
               baseUrl: "http://127.0.0.1:11434/v1",
-              apiKey: "ollama-local",
+              apiKey: "ollama-\nlocal\r\n",
               headers: {
                 "X-Provider-Header": "provider",
               },
@@ -87,24 +87,43 @@ describe("embeddings-ollama", () => {
     ).rejects.toThrow(/agents\.\*\.memorySearch\.remote\.apiKey: unresolved SecretRef/i);
   });
 
-  it("fails fast when models.providers.ollama.apiKey is an unresolved SecretRef", async () => {
-    await expect(
-      createOllamaEmbeddingProvider({
-        config: {
-          models: {
-            providers: {
-              ollama: {
-                baseUrl: "http://127.0.0.1:11434/v1",
-                apiKey: { source: "env", provider: "default", id: "OLLAMA_API_KEY" },
-                models: [],
-              },
+  it("falls back to env key when models.providers.ollama.apiKey is an unresolved SecretRef", async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(JSON.stringify({ embedding: [1, 0] }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    vi.stubEnv("OLLAMA_API_KEY", "ollama-env");
+
+    const { provider } = await createOllamaEmbeddingProvider({
+      config: {
+        models: {
+          providers: {
+            ollama: {
+              baseUrl: "http://127.0.0.1:11434/v1",
+              apiKey: { source: "env", provider: "default", id: "OLLAMA_API_KEY" },
+              models: [],
             },
           },
-        } as unknown as OpenClawConfig,
-        provider: "ollama",
-        model: "nomic-embed-text",
-        fallback: "none",
+        },
+      } as unknown as OpenClawConfig,
+      provider: "ollama",
+      model: "nomic-embed-text",
+      fallback: "none",
+    });
+
+    await provider.embedQuery("hello");
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:11434/api/embeddings",
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: "Bearer ollama-env",
+        }),
       }),
-    ).rejects.toThrow(/models\.providers\.ollama\.apiKey: unresolved SecretRef/i);
+    );
   });
 });
diff --git a/src/memory/embeddings-ollama.ts b/src/memory/embeddings-ollama.ts
@@ -1,6 +1,7 @@
 import { resolveEnvApiKey } from "../agents/model-auth.js";
 import { formatErrorMessage } from "../infra/errors.js";
 import type { SsrFPolicy } from "../infra/net/ssrf.js";
+import { normalizeOptionalSecretInput } from "../utils/normalize-secret-input.js";
 import type { EmbeddingProvider, EmbeddingProviderOptions } from "./embeddings.js";
 import { buildRemoteBaseUrlPolicy, withRemoteHttpResponse } from "./remote-http.js";
 import { resolveMemorySecretInputString } from "./secret-input.js";
@@ -53,10 +54,9 @@ function resolveOllamaApiKey(options: EmbeddingProviderOptions): string | undefi
   if (remoteApiKey) {
     return remoteApiKey;
   }
-  const providerApiKey = resolveMemorySecretInputString({
-    value: options.config.models?.providers?.ollama?.apiKey,
-    path: "models.providers.ollama.apiKey",
-  });
+  const providerApiKey = normalizeOptionalSecretInput(
+    options.config.models?.providers?.ollama?.apiKey,
+  );
   if (providerApiKey) {
     return providerApiKey;
   }
diff --git a/src/memory/embeddings.test.ts b/src/memory/embeddings.test.ts
@@ -210,6 +210,43 @@ describe("embedding provider remote overrides", () => {
     expect(headers["Content-Type"]).toBe("application/json");
   });
 
+  it("fails fast when Gemini remote apiKey is an unresolved SecretRef", async () => {
+    await expect(
+      createEmbeddingProvider({
+        config: {} as never,
+        provider: "gemini",
+        remote: {
+          apiKey: { source: "env", provider: "default", id: "GEMINI_API_KEY" },
+        },
+        model: "text-embedding-004",
+        fallback: "openai",
+      }),
+    ).rejects.toThrow(/agents\.\*\.memorySearch\.remote\.apiKey:/i);
+  });
+
+  it("uses GEMINI_API_KEY env indirection for Gemini remote apiKey", async () => {
+    const fetchMock = createGeminiFetchMock();
+    vi.stubGlobal("fetch", fetchMock);
+    vi.stubEnv("GEMINI_API_KEY", "env-gemini-key");
+
+    const result = await createEmbeddingProvider({
+      config: {} as never,
+      provider: "gemini",
+      remote: {
+        apiKey: "GEMINI_API_KEY",
+      },
+      model: "text-embedding-004",
+      fallback: "openai",
+    });
+
+    const provider = requireProvider(result);
+    await provider.embedQuery("hello");
+
+    const { init } = readFirstFetchRequest(fetchMock);
+    const headers = (init?.headers ?? {}) as Record<string, string>;
+    expect(headers["x-goog-api-key"]).toBe("env-gemini-key");
+  });
+
   it("builds Mistral embeddings requests with bearer auth", async () => {
     const fetchMock = createFetchMock();
     vi.stubGlobal("fetch", fetchMock);
