Add Ollama Provider

Routes an agent group to a local Ollama instance instead of the Anthropic API. See docs/ollama.md for how this works and the tradeoffs involved.

Prerequisites

1. Ollama is installed and running on the host, verify: curl -s http://localhost:11434/api/tags
2. A model is pulled, e.g. ollama pull gemma4 or ollama pull qwen3-coder
3. The agent group already exists, run /init-first-agent first if needed

1. Check source support

The feature requires two fields in ContainerConfig (env and blockedHosts) and their corresponding wiring in container-runner.ts. Check if already present:

grep -c 'blockedHosts' src/container-config.ts src/container-runner.ts

If either count is 0, apply the changes in steps 1a and 1b. Otherwise skip to step 2.

1a. Extend ContainerConfig

In src/container-config.ts, add to the ContainerConfig interface:

env?: Record<string, string>;
blockedHosts?: string[];

And in readContainerConfig, add inside the returned object:

env: raw.env,
blockedHosts: raw.blockedHosts,

1b. Wire into container-runner

In src/container-runner.ts, after the NANOCLAW_MCP_SERVERS block, add:

// Per-agent-group env overrides, applied last to win over OneCLI values.
if (containerConfig.env) {
  for (const [key, value] of Object.entries(containerConfig.env)) {
    args.push('-e', `${key}=${value}`);
  }
}

// Blocked hosts: resolve to 0.0.0.0 so they are unreachable inside the container.
if (containerConfig.blockedHosts) {
  for (const host of containerConfig.blockedHosts) {
    args.push('--add-host', `${host}:0.0.0.0`);
  }
}

1c. Fix home directory permissions (if not already done)

The container may run as your host uid (not uid 1000). Check the Dockerfile:

grep 'chmod.*home/node' container/Dockerfile