fix(ollama): preserve :cloud model tag for private remote Ollama servers (zeroclaw-labs#4173)

The Ollama provider previously stripped the :cloud suffix from model names
for any non-localhost endpoint, assuming all remote endpoints were Ollama
Cloud (ollama.com). This caused a 404 when a private Ollama server (e.g.
a LAN server at 192.168.x.x) was configured as api_url: the local server
stores cloud-proxy models under their full name (e.g. "glm-5:cloud"), so
stripping the tag results in "model not found" instead of the correct
"quota exhausted" (429) error.

Fix: introduce is_ollama_cloud_endpoint() which matches only ollama.com.
The :cloud suffix is now stripped (and auth required) only when targeting
Ollama Cloud. Private remote servers receive the model name as-is, letting
them serve the cloud-proxy model correctly and return the proper 429 when
cloud quota is exhausted — which triggers fallback to a local model.

Two new tests cover the private-server behavior.

Co-authored-by: ZeroClaw <zeroclaw@zeroclaw.bot>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

src/providers/ollama.rs

@@ -170,13 +170,19 @@ impl OllamaProvider {
             .is_some_and(|host| matches!(host.as_str(), "localhost" | "127.0.0.1" | "::1"))
     }
 
+    fn is_ollama_cloud_endpoint(&self) -> bool {
+        reqwest::Url::parse(&self.base_url)
+            .ok()
+            .and_then(|url| url.host_str().map(|host| host.to_string()))
+            .is_some_and(|host| host == "ollama.com")
+    }
+
     fn http_client(&self) -> Client {
         crate::config::build_runtime_proxy_client_with_timeouts("provider.ollama", 300, 10)
     }
 
     fn resolve_request_details(&self, model: &str) -> anyhow::Result<(String, bool)> {
         let requests_cloud = model.ends_with(":cloud");
-        let normalized_model = model.strip_suffix(":cloud").unwrap_or(model).to_string();
 
         if requests_cloud && self.is_local_endpoint() {
             anyhow::bail!(
@@ -185,16 +191,26 @@ impl OllamaProvider {
             );
         }
 
-        if requests_cloud && self.api_key.is_none() {
-            anyhow::bail!(
-                "Model '{}' requested cloud routing, but no API key is configured. Set OLLAMA_API_KEY or config api_key.",
-                model
-            );
+        // When targeting Ollama Cloud (ollama.com), strip the :cloud suffix and require auth.
+        // Ollama Cloud maps the base model name (e.g. "glm-5") to the cloud-hosted version.
+        //
+        // When targeting a private remote Ollama server, preserve the full model name including
+        // the :cloud tag, since local Ollama stores cloud-proxy models under their full name
+        // (e.g. "glm-5:cloud"). No auth header is sent to private servers.
+        if requests_cloud && self.is_ollama_cloud_endpoint() {
+            if self.api_key.is_none() {
+                anyhow::bail!(
+                    "Model '{}' requested cloud routing, but no API key is configured. Set OLLAMA_API_KEY or config api_key.",
+                    model
+                );
+            }
+            let normalized_model = model.strip_suffix(":cloud").unwrap_or(model).to_string();
+            return Ok((normalized_model, true));
         }
 
         let should_auth = self.api_key.is_some() && !self.is_local_endpoint();
 
-        Ok((normalized_model, should_auth))
+        Ok((model.to_string(), should_auth))
     }
 
     fn parse_tool_arguments(arguments: &str) -> serde_json::Value {
@@ -978,6 +994,26 @@ mod tests {
         assert!(should_auth);
     }
 
+    #[test]
+    fn private_remote_server_cloud_suffix_preserves_model_name() {
+        // A private Ollama server stores cloud-proxy models with the :cloud tag intact
+        // (e.g. "glm-5:cloud"). The model name must NOT be stripped — unlike Ollama Cloud
+        // which maps "glm-5" to the cloud version, a private server would 404 on "glm-5".
+        let p = OllamaProvider::new(Some("http://192.168.1.100:11434"), Some("ollama-key"));
+        let (model, should_auth) = p.resolve_request_details("glm-5:cloud").unwrap();
+        assert_eq!(model, "glm-5:cloud");
+        assert!(should_auth);
+    }
+
+    #[test]
+    fn private_remote_server_cloud_suffix_no_key_still_works() {
+        // Private Ollama servers typically don't require an API key.
+        let p = OllamaProvider::new(Some("http://192.168.1.100:11434"), None);
+        let (model, should_auth) = p.resolve_request_details("glm-5:cloud").unwrap();
+        assert_eq!(model, "glm-5:cloud");
+        assert!(!should_auth);
+    }
+
     #[test]
     fn remote_endpoint_with_api_suffix_still_allows_cloud_models() {
         let p = OllamaProvider::new(Some("https://ollama.com/api"), Some("ollama-key"));