docs: refresh self-hosted web search references

docs/tools/ollama-search.md

@@ -13,8 +13,8 @@ OpenClaw supports **Ollama Web Search** as a bundled `web_search` provider.
 It uses Ollama's experimental web-search API and returns structured results
 with titles, URLs, and snippets.
 
-Unlike the Ollama model provider, this setup does not need an API key. It
-does require:
+Unlike the Ollama model provider, this setup does not need an API key by
+default. It does require:
 
 - an Ollama host that is reachable from OpenClaw
 - `ollama signin`
@@ -78,9 +78,15 @@ Optional Ollama host override:
 
 If no explicit Ollama base URL is set, OpenClaw uses `http://127.0.0.1:11434`.
 
+If your Ollama host expects bearer auth, OpenClaw reuses
+`models.providers.ollama.apiKey` (or the matching env-backed provider auth)
+for web-search requests too.
+
 ## Notes
 
-- No API key field is required for this provider.
+- No web-search-specific API key field is required for this provider.
+- If the Ollama host is auth-protected, OpenClaw reuses the normal Ollama
+  provider API key when present.
 - OpenClaw warns during setup if Ollama is unreachable or not signed in, but
   it does not block selection.
 - Runtime auto-detect can fall back to Ollama Web Search when no higher-priority

docs/tools/searxng-search.md

@@ -82,6 +82,12 @@ Plugin-level settings for the SearXNG instance:
 
 The `baseUrl` field also accepts SecretRef objects.
 
+Transport rules:
+
+- `https://` works for public or private SearXNG hosts
+- `http://` is only accepted for trusted private-network or loopback hosts
+- public SearXNG hosts must use `https://`
+
 ## Environment variable
 
 Set `SEARXNG_BASE_URL` as an alternative to config:
@@ -106,6 +112,8 @@ key wins first).
 
 - **JSON API** -- uses SearXNG's native `format=json` endpoint, not HTML scraping
 - **No API key** -- works with any SearXNG instance out of the box
+- **Base URL validation** -- `baseUrl` must be a valid `http://` or `https://`
+  URL; public hosts must use `https://`
 - **Auto-detection order** -- SearXNG is checked last (order 200) in auto-detection,
   so any API-backed provider with a key takes priority over SearXNG, and SearXNG sits
   behind DuckDuckGo (order 100) as well

docs/tools/web.md

@@ -105,7 +105,7 @@ local while `web_search` and `x_search` can use xAI Responses under the hood.
 | [Gemini](/tools/gemini-search)            | AI-synthesized + citations | --                                               | `GEMINI_API_KEY`                            |
 | [Grok](/tools/grok-search)                | AI-synthesized + citations | --                                               | `XAI_API_KEY`                               |
 | [Kimi](/tools/kimi-search)                | AI-synthesized + citations | --                                               | `KIMI_API_KEY` / `MOONSHOT_API_KEY`         |
-| [Ollama Web Search](/tools/ollama-search) | Structured snippets        | --                                               | None (`ollama signin` required)             |
+| [Ollama Web Search](/tools/ollama-search) | Structured snippets        | --                                               | None by default; `ollama signin` required   |
 | [Perplexity](/tools/perplexity-search)    | Structured snippets        | Country, language, time, domains, content limits | `PERPLEXITY_API_KEY` / `OPENROUTER_API_KEY` |
 | [SearXNG](/tools/searxng-search)          | Structured snippets        | Categories, language                             | None (self-hosted)                          |
 | [Tavily](/tools/tavily)                   | Structured snippets        | Via `tavily_search` tool                         | `TAVILY_API_KEY`                            |
@@ -164,7 +164,7 @@ first one that is ready:
 7. **Exa** -- `EXA_API_KEY` or `plugins.entries.exa.config.webSearch.apiKey`
 8. **Tavily** -- `TAVILY_API_KEY` or `plugins.entries.tavily.config.webSearch.apiKey`
 9. **DuckDuckGo** -- key-free HTML fallback with no account or API key
-10. **Ollama Web Search** -- key-free fallback via your configured Ollama host; requires Ollama to be reachable and signed in with `ollama signin`
+10. **Ollama Web Search** -- key-free fallback via your configured Ollama host; requires Ollama to be reachable and signed in with `ollama signin` (reuses Ollama provider auth if the host needs bearer auth)
 
 Key-free providers are checked after API-backed providers:
 
@@ -278,6 +278,8 @@ show the `x_search` prompt.
   Perplexity behaves the same way when you use the Sonar/OpenRouter
   compatibility path (`plugins.entries.perplexity.config.webSearch.baseUrl` /
   `model` or `OPENROUTER_API_KEY`).
+  SearXNG accepts `http://` only for trusted private-network or loopback hosts;
+  public SearXNG endpoints must use `https://`.
   Firecrawl and Tavily only support `query` and `count` through `web_search`
   -- use their dedicated tools for advanced options.
 </Warning>