monkeybot 3.0.3__tar.gz → 3.0.4__tar.gz

{monkeybot-3.0.3 → monkeybot-3.0.4}/CHANGELOG.md

@@ -6,6 +6,18 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### CLI
+
+### Changed
+
+- CLI extras catalog / `monkeybot new` provider menu lists `ollama-cloud` and `ollama-local` instead of a single `ollama` row. `--with ollama` and `--provider ollama` still work.
+
+## [core v3.0.4] - 2026-08-28
+
+### Added
+
+- Explicit `ollama-cloud` and `ollama-local` provider ids so Cloud always hits `https://ollama.com` even when a leftover local `OLLAMA_BASE_URL` is set. Legacy `ollama` still auto-routes from env.
+
 ## [core v3.0.3] - 2026-08-23
 
 ### Added

{monkeybot-3.0.3 → monkeybot-3.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.0.3
+Version: 3.0.4
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/skills/monkeybot/SKILL.md

@@ -111,7 +111,9 @@ uv sync
 | `vertex-claude` | `GCP_PROJECT_ID` / `GOOGLE_CLOUD_PROJECT` / `ANTHROPIC_VERTEX_PROJECT_ID` (ADC) | `monkeybot[vertex-claude]` |
 | `aws_bedrock` | `AWS_ACCESS_KEY_ID` / `AWS_PROFILE` + `AWS_REGION` | `monkeybot[bedrock]` |
 | `huggingface` | `HF_TOKEN` (or `HUGGINGFACE_API_KEY`) | `monkeybot[huggingface]` |
-| `ollama` | None required — `OLLAMA_BASE_URL` (default `http://localhost:11434`) for a non-default server | `monkeybot[ollama]` |
+| `ollama-cloud` | `OLLAMA_API_KEY` | `monkeybot[ollama]` |
+| `ollama-local` | None required — `OLLAMA_BASE_URL` (default `http://localhost:11434`) | `monkeybot[ollama]` |
+| `ollama` | Legacy auto-route (key + blank URL = cloud; explicit URL wins) | `monkeybot[ollama]` |
 
 **Agent-first dependencies.** The CLI is thin — it does **not** install provider/storage extras globally. `monkeybot new` scaffolds a `pyproject.toml` with the selected provider (and any `--with` extras). Run plain `uv sync` in the agent directory. `monkeybot run` / `chat` spawn the gateway from that project's interpreter (`.venv/bin/python`, else `uv run python`), and `doctor` checks extras in that same interpreter. For a config-only tree (just `monkeybot_config/`, no `pyproject.toml`) the gateway uses the CLI's interpreter when it already has MonkeyBot 3.x (and MemPalace if memory is on). If memory is enabled and that interpreter cannot import MemPalace, `run` / `chat` provision a cached CLI-managed venv under `~/.cache/monkeybot/runtimes/` holding `monkeybot[memory]` pinned to the running core (never rewrites a `pyproject.toml`). `doctor` reuses that cache when it is already present. Otherwise extras must be installed in the CLI env (`uv tool install --with 'monkeybot[<extra>]' monkeybot-cli`).
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/skills/monkeybot/references/config-sections.md

@@ -45,7 +45,7 @@ Validate check ids: `paths.agent_md.exists`, `paths.skills_path.exists`, `paths.
 | `max_turns` | `1000` | Hard cap on turns per run |
 | `summarization_model` | (main model) | Cheaper model for history summarization (env `CONTEXT_SUMMARIZATION_MODEL`) |
 
-Validate check ids: `model.provider.supported`, `model.name.present`. Supported YAML providers: `gemini`/`vertex`, `openai`, `anthropic`, `vertex-claude`, `huggingface`, `ollama`, `aws_bedrock`, `fake`.
+Validate check ids: `model.provider.supported`, `model.name.present`. Supported YAML providers: `gemini`/`vertex`, `openai`, `anthropic`, `vertex-claude`, `huggingface`, `ollama-cloud`, `ollama-local`, `ollama`, `aws_bedrock`, `fake`.
 
 ## `gcp` / `anthropic_vertex` (non-secret identifiers)
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/src/monkeybot_cli/extras_catalog.py

@@ -24,7 +24,8 @@ PROVIDER_CHOICES: tuple[ExtraChoice, ...] = (
     ExtraChoice("vertex-claude", "Claude on Vertex AI"),
     ExtraChoice("aws_bedrock", "AWS Bedrock"),
     ExtraChoice("huggingface", "Hugging Face"),
-    ExtraChoice("ollama", "Ollama (local)"),
+    ExtraChoice("ollama-cloud", "Ollama Cloud"),
+    ExtraChoice("ollama-local", "Ollama (local)"),
     ExtraChoice("nvidia", "NVIDIA NIM"),
     ExtraChoice("openrouter", "OpenRouter"),
 )

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/src/monkeybot_cli/providers.py

@@ -59,6 +59,17 @@ PROVIDER_SPECS: dict[str, ProviderSpec] = {
         (),
         credentials_optional=True,
     ),
+    "ollama-cloud": ProviderSpec(
+        ("ollama-cloud", "ollama_cloud"),
+        "ollama",
+        ("OLLAMA_API_KEY",),
+    ),
+    "ollama-local": ProviderSpec(
+        ("ollama-local", "ollama_local"),
+        "ollama",
+        (),
+        credentials_optional=True,
+    ),
     "fake": ProviderSpec(("fake",), None, (), credentials_optional=True),
 }
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/src/monkeybot_cli/scaffold.py

@@ -138,6 +138,7 @@ def ensure_workspace(dest: Path, *, force: bool) -> list[str]:
         "browser/playbooks",
         "browser/Screenshots",
         "generated-media/images",
+        "generated-media/video",
     ):
         path = workspace / rel
         path.mkdir(parents=True, exist_ok=True)

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/src/monkeybot_cli/scaffold_defaults/env.example

@@ -28,7 +28,10 @@ DB_URL=sqlite:///data/monkeybot.db
 # Hugging Face
 # HF_TOKEN=
 
-# Ollama (local models — no API key needed)
+# Ollama Cloud (model.provider: ollama-cloud) — key from ollama.com/settings/keys
+# OLLAMA_API_KEY=
+
+# Ollama local (model.provider: ollama-local) — no API key needed
 # OLLAMA_BASE_URL=http://localhost:11434
 
 # Optional web search

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/src/monkeybot_cli/scaffold_defaults/monkeybot.example.yaml

@@ -87,7 +87,7 @@ paths:
   workspace_root: ./workspace
 
 model:
-  # gemini | openai | anthropic | vertex-claude | huggingface | ollama | nvidia | openrouter | aws_bedrock | fake
+  # gemini | openai | anthropic | vertex-claude | huggingface | ollama-cloud | ollama-local | ollama | nvidia | openrouter | aws_bedrock | fake
   provider: gemini
   name: gemini-3.1-flash-live-preview
   temperature: 0.7

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/tests/test_extras_catalog.py

@@ -21,6 +21,8 @@ def test_normalize_extra_token_features_and_providers() -> None:
     assert normalize_extra_token("anthropic") == "claude"
     assert normalize_extra_token("aws_bedrock") == "bedrock"
     assert normalize_extra_token("claude") == "claude"
+    assert normalize_extra_token("ollama-cloud") == "ollama"
+    assert normalize_extra_token("ollama-local") == "ollama"
     assert normalize_extra_token("fake") is None
     assert normalize_extra_token("not-a-real-extra") is None
 
@@ -42,6 +44,9 @@ def test_extra_module_covers_catalog_extras() -> None:
 def test_provider_extra_name() -> None:
     assert provider_extra_name("openai") == "openai"
     assert provider_extra_name("anthropic") == "claude"
+    assert provider_extra_name("ollama-cloud") == "ollama"
+    assert provider_extra_name("ollama-local") == "ollama"
+    assert provider_extra_name("ollama") == "ollama"
     assert provider_extra_name("fake") is None
 
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/cli/tests/test_scaffold.py

@@ -37,6 +37,7 @@ def test_run_new_creates_bundle(tmp_path: Path) -> None:
     assert (tmp_path / "workspace" / ".gitkeep").is_file()
     assert (tmp_path / "workspace" / "browser" / "playbooks").is_dir()
     assert (tmp_path / "workspace" / "generated-media" / "images").is_dir()
+    assert (tmp_path / "workspace" / "generated-media" / "video").is_dir()
     assert not (tmp_path / "workspace" / "skills").exists()
     assert (tmp_path / "Dockerfile").is_file()
     assert (tmp_path / ".dockerignore").is_file()

{monkeybot-3.0.3 → monkeybot-3.0.4}/docs/features.md

@@ -221,6 +221,7 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 | `vertex_anthropic` | vertex-claude | anthropic-messages | `cache_control` |
 | `aws_bedrock` | — | anthropic-messages | `cache_control` |
 | `huggingface` / `nvidia` / `ollama` | — | openai-compat | none |
+| `ollama-cloud` / `ollama-local` | ollama_cloud, ollama_local | openai-compat | none |
 | `fake` | — | fake | gateway/test only |
 
 **Auth:** see CLI `monkeybot doctor` and `cli/.../providers.py` (`PROVIDER_SPECS`).
@@ -232,7 +233,7 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 - `count_input_tokens()` must match the same payload shape as `stream()` (summarization triggers, tool budgets).
 - Provider resolution via `MODEL_PROVIDER` aliases (`gemini` → `google_vertexai`, `vertex-claude` → `vertex_anthropic`).
 - Optional extras in `pyproject.toml`: `gemini`, `openai`, `claude`, `vertex-claude`, `bedrock`, `huggingface`, `ollama`, `nvidia`.
-- `ollama`, `huggingface`, and `nvidia` share the OpenAI-compatible streaming core (`providers/_openai_compat.py`) and only differ in base URL / auth; `ollama` runs against a local server (`OLLAMA_BASE_URL`, default `http://localhost:11434`) and needs no API key; `nvidia` hits `https://integrate.api.nvidia.com/v1` and needs a free `NVIDIA_API_KEY` from build.nvidia.com.
+- `ollama`, `huggingface`, and `nvidia` share the OpenAI-compatible streaming core (`providers/_openai_compat.py`) and only differ in base URL / auth. Prefer explicit ids: `ollama-cloud` always hits `https://ollama.com` and requires `OLLAMA_API_KEY`; `ollama-local` always uses the local/self-hosted host (`OLLAMA_BASE_URL`, default `http://localhost:11434`) and needs no API key. Legacy `ollama` still auto-routes (a key with no URL means cloud; an explicit URL always wins). `nvidia` hits `https://integrate.api.nvidia.com/v1` and needs a free `NVIDIA_API_KEY` from build.nvidia.com.
 - `MODEL_PROVIDER=fake` is gateway/test-only; unit tests inject `ScriptedFakeProvider` directly.
 
 **Prompt-cache session hints (`ProviderCallHints`):**
@@ -267,7 +268,7 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 | `glob` / `grep` | Path discovery / content regex search (prefer over shell) |
 | `apply_patch` | Multi-file Codex-style Add/Update/Delete/Move; fail-closed before any write |
 | `search_memory` | Keyword search in memory tree |
-| `search` / `recall` | Local knowledge index (workspace + notes); **parallel-safe**. Gateway owns writes; subagents open the index **read-only** |
+| `search` / `recall` | Local knowledge index (workspace + notes); **parallel-safe**. Gateway owns writes; subagents open the index **read-only**. Harness-as-library (Pattern B/C) callers can opt into read-only via `MONKEYBOT_KNOWLEDGE_READ_ONLY=1`; the gateway always ignores this flag and stays the writer |
 | `list_skills` | Skill discovery |
 | `run_command` | Allowlisted shell (host or OpenSandbox) |
 | `task` | Subagent subprocess (parent only) |
@@ -292,6 +293,7 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 - `task` omitted in subagent workers (`include_task_tool=False`).
 - Nested `task` disabled inside subagents.
 - Custom tools must not collide with core or MCP names.
+- `MONKEYBOT_KNOWLEDGE_READ_ONLY` (default off) opens the knowledge index read-only for `create_harness_deps` (Pattern B/C) callers; subagent workers are always read-only regardless of the flag. The gateway SSE app is the sole writer per workspace and ignores this flag, logging a warning if it is set.
 
 ---
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot"
-version = "3.0.3"
+version = "3.0.4"
 description = "monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP."
 requires-python = ">=3.11"
 readme = "README.md"

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/core/bootstrap.py

@@ -17,7 +17,10 @@ from monkeybot.core.config.settings import auto_schema_enabled_from_config, get_
 from monkeybot.core.context import build_context
 from monkeybot.core.hooks import HookManager
 from monkeybot.core.knowledge import KnowledgeSubsystem, resolve_knowledge_settings
-from monkeybot.core.knowledge.config import knowledge_enabled_from_config
+from monkeybot.core.knowledge.config import (
+    knowledge_enabled_from_config,
+    knowledge_read_only_from_env,
+)
 from monkeybot.core.llm.provider import Provider
 from monkeybot.core.llm.usage import usage_from_totals
 from monkeybot.core.mcp.mcp_client import MCPClient
@@ -181,6 +184,7 @@ async def create_harness_deps(
                     settings=settings,
                     knowledge_root=Path(settings.knowledge_root),
                     index_path=Path(settings.index_path),
+                    read_only=knowledge_read_only_from_env(),
                 )
                 await knowledge.ensure_ready()
             except Exception as exc:

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/core/config/settings.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import logging
 import os
 from dataclasses import dataclass
-from typing import Any
+from typing import Any, Literal
 
 from monkeybot.core.config.yaml_loader import load_monkeybot_yaml_dict
 from monkeybot.core.llm.provider import Provider
@@ -27,6 +27,16 @@ _MODEL_PROVIDER_ALIASES: dict[str, str] = {
     "google-vertexai": "google_vertexai",
     "vertex-claude": "vertex_anthropic",
     "vertex_claude": "vertex_anthropic",
+    # Hyphen form is the YAML / desktop-app id (unlike vertex-claude, which
+    # maps onto a different internal id).
+    "ollama_cloud": "ollama-cloud",
+    "ollama_local": "ollama-local",
+}
+
+_OLLAMA_MODES: dict[str, Literal["auto", "cloud", "local"]] = {
+    "ollama": "auto",
+    "ollama-cloud": "cloud",
+    "ollama-local": "local",
 }
 
 
@@ -203,9 +213,11 @@ def get_provider_config(
             ),
             resolved_model,
         )
-    if provider_key == "ollama":
+    ollama_mode = _OLLAMA_MODES.get(provider_key)
+    if ollama_mode is not None:
         return ProviderConfig(
             OllamaProvider(
+                mode=ollama_mode,
                 temperature=sampling.temperature,
                 max_tokens=sampling.max_tokens,
                 thinking_budget=thinking_budget,
@@ -243,7 +255,7 @@ def get_provider_config(
     raise ValueError(
         f"Unsupported model provider: {provider_key}. "
         "Supported providers: google_vertexai, openai, anthropic, vertex_anthropic, "
-        "huggingface, ollama, nvidia, openrouter, aws_bedrock"
+        "huggingface, ollama, ollama-cloud, ollama-local, nvidia, openrouter, aws_bedrock"
     )
 
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/core/config/validation.py

@@ -17,6 +17,8 @@ SUPPORTED_MODEL_PROVIDERS = frozenset(
         "vertex_anthropic",
         "huggingface",
         "ollama",
+        "ollama-cloud",
+        "ollama-local",
         "nvidia",
         "openrouter",
         "fake",
@@ -24,23 +26,17 @@ SUPPORTED_MODEL_PROVIDERS = frozenset(
     }
 )
 
-SUPPORTED_YAML_MODEL_PROVIDERS = frozenset(
+# Canonical ids plus YAML aliases (gemini → google_vertexai, ollama_cloud →
+# ollama-cloud, …). Env validation uses SUPPORTED_MODEL_PROVIDERS after
+# normalize_model_provider; YAML validation checks the raw string.
+SUPPORTED_YAML_MODEL_PROVIDERS = SUPPORTED_MODEL_PROVIDERS | frozenset(
     {
         "gemini",
         "vertex",
-        "google_vertexai",
-        "google_genai",
-        "openai",
-        "anthropic",
         "vertex-claude",
         "vertex_claude",
-        "vertex_anthropic",
-        "huggingface",
-        "ollama",
-        "nvidia",
-        "openrouter",
-        "fake",
-        "aws_bedrock",
+        "ollama_cloud",
+        "ollama_local",
     }
 )
 

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/core/knowledge/__init__.py

@@ -2,6 +2,7 @@
 
 from monkeybot.core.knowledge.config import (
     knowledge_enabled_from_config,
+    knowledge_read_only_from_env,
     resolve_knowledge_settings,
 )
 from monkeybot.core.knowledge.subsystem import KnowledgeSubsystem
@@ -12,5 +13,6 @@ __all__ = [
     "KnowledgeSubsystem",
     "RecallHit",
     "knowledge_enabled_from_config",
+    "knowledge_read_only_from_env",
     "resolve_knowledge_settings",
 ]

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/core/knowledge/config.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import os
 import shutil
 from pathlib import Path
 from typing import Any
@@ -39,6 +40,19 @@ def knowledge_enabled_from_config(config_path: str | None = None) -> bool:
     raise ConfigError(f"knowledge.enabled must be true or false, got {raw!r}")
 
 
+def knowledge_read_only_from_env() -> bool:
+    """Opt-in only; default off (``MONKEYBOT_KNOWLEDGE_READ_ONLY``).
+
+    Intended for harness-as-library (Pattern B/C) and other reader-only
+    clients that want search without indexing writes. The gateway process
+    is the sole writer per workspace (see :class:`KnowledgeSubsystem`) and
+    ignores this flag rather than honoring it, so exporting it in a shared
+    env file cannot silently turn the writer into a reader.
+    """
+    raw = os.environ.get("MONKEYBOT_KNOWLEDGE_READ_ONLY", "").strip().lower()
+    return raw in ("1", "true", "yes")
+
+
 def resolve_knowledge_settings(
     *,
     agent_root: Path | None = None,
@@ -255,5 +269,6 @@ def _bool(yaml_raw: Any, default: bool) -> bool:
 
 __all__ = [
     "knowledge_enabled_from_config",
+    "knowledge_read_only_from_env",
     "resolve_knowledge_settings",
 ]

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/core/runtime/loop_usage.py

@@ -61,12 +61,17 @@ def _merge_usage_event(usage: Usage, ev: UsageEvent) -> None:
     usage.cache_creation_tokens += ev.cache_creation_tokens
 
 
+_THINKING_BUDGET_PROVIDERS = frozenset(
+    {"gemini", "claude", "ollama", "ollama-cloud", "ollama-local"}
+)
+
+
 def _stream_thinking_budget(
     provider: Provider,
     resolved_messages: Sequence[Message],
 ) -> int | None:
     """Per-call thinking budget override; None keeps the provider default."""
-    if provider.name not in ("gemini", "claude", "ollama"):
+    if provider.name not in _THINKING_BUDGET_PROVIDERS:
         return None
     raw = os.environ.get("MONKEYBOT_RESUME_THINKING_BUDGET", "").strip()
     if not raw:

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/gateway/sse/app.py

@@ -35,7 +35,10 @@ from monkeybot.core.config.settings import (
 from monkeybot.core.context import LoopsToolRegistry, build_context
 from monkeybot.core.hooks import HookManager
 from monkeybot.core.knowledge import KnowledgeSubsystem, resolve_knowledge_settings
-from monkeybot.core.knowledge.config import knowledge_enabled_from_config
+from monkeybot.core.knowledge.config import (
+    knowledge_enabled_from_config,
+    knowledge_read_only_from_env,
+)
 from monkeybot.core.layout import AgentLayout
 from monkeybot.core.llm.provider import (
     Done,
@@ -45,7 +48,8 @@ from monkeybot.core.llm.provider import (
     ToolCall,
     UsageEvent,
 )
-from monkeybot.core.llm.usage import Usage as UsageRecord, UsageGranularity
+from monkeybot.core.llm.usage import Usage as UsageRecord
+from monkeybot.core.llm.usage import UsageGranularity
 from monkeybot.core.logging_utils import kv
 from monkeybot.core.mcp.mcp_client import MCPClient
 from monkeybot.core.memory.config import memory_enabled_from_config
@@ -647,6 +651,13 @@ async def _startup(fastapi_app: FastAPI) -> None:
     # Unified knowledge layer — FTS + ANN + links + search
     if knowledge_enabled_from_config():
         try:
+            if knowledge_read_only_from_env():
+                logger.warning(
+                    "MONKEYBOT_KNOWLEDGE_READ_ONLY is set but ignored here: the gateway "
+                    "process is the sole writer per workspace and always opens the "
+                    "knowledge index read-write. Set it on subagent/harness-as-library "
+                    "clients instead."
+                )
             layout = AgentLayout.from_environment()
             settings = resolve_knowledge_settings(workspace_root=layout.workspace_root)
             knowledge = await KnowledgeSubsystem.create(
@@ -654,6 +665,7 @@ async def _startup(fastapi_app: FastAPI) -> None:
                 settings=settings,
                 knowledge_root=Path(settings.knowledge_root),
                 index_path=Path(settings.index_path),
+                read_only=False,
             )
             hook_mgr = _deps.hook_manager
             if hook_mgr is None:

{monkeybot-3.0.3 → monkeybot-3.0.4}/src/monkeybot/providers/ollama.py

@@ -5,18 +5,24 @@ Ollama exposes an OpenAI-compatible endpoint at ``/v1`` on top of its native
 API, so this adapter reuses the same request/response plumbing as
 ``OpenAIProvider`` and ``HuggingFaceProvider``.
 
+YAML ``model.provider``:
+
+- ``ollama-cloud`` — always ``https://ollama.com``. Ignores a leftover local
+  ``OLLAMA_BASE_URL``. Requires ``OLLAMA_API_KEY``.
+- ``ollama-local`` — always the local/self-hosted host. Ignores a cloud URL.
+- ``ollama`` — legacy auto-route: a key with no URL means cloud; an explicit
+  URL always wins (including ``http://127.0.0.1:11434``).
+
 Configuration (environment variables or ``monkeybot.yaml``):
 
-- ``OLLAMA_BASE_URL`` — OpenAI-compat base host. Defaults to
-  ``http://localhost:11434`` when no API key is set, or ``https://ollama.com``
-  when ``OLLAMA_API_KEY`` is set and this is blank. ``/v1`` is appended when
-  missing.
+- ``OLLAMA_BASE_URL`` — OpenAI-compat base host. Used by ``ollama-local`` and
+  legacy ``ollama``. Ignored by ``ollama-cloud`` unless it already points at
+  ollama.com. ``/v1`` is appended when missing.
 - ``OLLAMA_API_KEY`` — required for Ollama Cloud (ollama.com/settings/keys).
   Local Ollama ignores it; the OpenAI SDK still needs a non-empty string, so a
-  dummy is used when unset. Set ``OLLAMA_BASE_URL`` explicitly if a local
-  reverse proxy enforces auth.
+  dummy is used when unset.
 - ``MODEL_NAME`` — model id passed to the API (e.g. ``llama3.1``, ``qwen2.5``,
-  or a cloud id such as ``gpt-oss:120b``). Local models must already be pulled
+  or a cloud id such as ``glm-5.3-flash``). Local models must already be pulled
   (``ollama pull <model>``).
 - ``MODEL_TEMPERATURE`` — sampling temperature (default: ``0.7``; set via ``monkeybot.yaml`` / constructor)
 - ``MODEL_MAX_TOKENS`` — max output tokens (default: ``60000``; set via ``monkeybot.yaml`` / constructor)
@@ -35,6 +41,8 @@ from __future__ import annotations
 import logging
 import os
 from collections.abc import AsyncIterator, Sequence
+from typing import Literal
+from urllib.parse import urlparse
 
 from monkeybot.core.llm.provider import (
     Message,
@@ -48,26 +56,81 @@ from monkeybot.providers._openai_compat import (
 )
 from monkeybot.providers.sampling import resolve_model_sampling
 
+OllamaMode = Literal["auto", "cloud", "local"]
+
 _DEFAULT_LOCAL_URL = "http://localhost:11434"
 _DEFAULT_CLOUD_URL = "https://ollama.com"
 _DUMMY_API_KEY = "ollama"
 _log = logging.getLogger(__name__)
 
 
-def _resolve_host_and_key() -> tuple[str, str]:
-    """Pick local vs cloud host from env.
+def _is_cloud_host(url: str) -> bool:
+    host = urlparse(url if "://" in url else f"https://{url}").hostname or ""
+    host = host.lower()
+    return host == "ollama.com" or host.endswith(".ollama.com")
+
+
+def _normalize_cloud_base(url: str) -> str:
+    """Return a usable https URL for an Ollama Cloud host.
+
+    Scheme-less values get ``https://``. Plaintext ``http://`` is upgraded so
+    the API key never travels in the clear.
+    """
+    if "://" not in url:
+        return f"https://{url}"
+    parsed = urlparse(url)
+    if parsed.scheme == "http":
+        upgraded = parsed._replace(scheme="https").geturl()
+        _log.warning(
+            "ollama-cloud upgrading plaintext OLLAMA_BASE_URL %s",
+            kv(ignored=url, host=upgraded),
+        )
+        return upgraded
+    return url
 
-    A key without a URL means Ollama Cloud. A URL always wins, so a reverse
-    proxy in front of local Ollama can still authenticate by setting both.
+
+def _resolve_host_and_key(mode: OllamaMode = "auto") -> tuple[str, str]:
+    """Pick local vs cloud host from env and provider mode.
+
+    ``cloud`` ignores a leftover localhost URL so a prior local-runtime persist
+    cannot steal cloud traffic. ``local`` ignores a cloud URL and never forwards
+    ``OLLAMA_API_KEY`` (an authenticating reverse proxy uses legacy ``ollama``
+    plus an explicit URL). ``auto`` keeps the legacy rule: an explicit URL
+    always wins.
     """
     api_key = (os.environ.get("OLLAMA_API_KEY") or "").strip()
     base = (os.environ.get("OLLAMA_BASE_URL") or "").strip().rstrip("/")
+    if mode == "cloud":
+        if not api_key:
+            raise ValueError(
+                "OLLAMA_API_KEY is not set. Create a key at "
+                "https://ollama.com/settings/keys and add it to your .env or "
+                "environment (required for model.provider ollama-cloud)."
+            )
+        if base and _is_cloud_host(base):
+            return _normalize_cloud_base(base), api_key
+        if base:
+            _log.warning(
+                "ollama-cloud ignoring non-cloud OLLAMA_BASE_URL %s",
+                kv(ignored=base, host=_DEFAULT_CLOUD_URL),
+            )
+        return _DEFAULT_CLOUD_URL, api_key
+    if mode == "local":
+        if base and not _is_cloud_host(base):
+            return base, _DUMMY_API_KEY
+        if base:
+            _log.warning(
+                "ollama-local ignoring cloud OLLAMA_BASE_URL %s",
+                kv(ignored=base, host=_DEFAULT_LOCAL_URL),
+            )
+        return _DEFAULT_LOCAL_URL, _DUMMY_API_KEY
     if base:
         return base, api_key or _DUMMY_API_KEY
     if api_key:
         _log.warning(
             "OLLAMA_API_KEY set with no OLLAMA_BASE_URL; using Ollama Cloud %s "
-            "(set OLLAMA_BASE_URL explicitly for a local reverse proxy)",
+            "(set model.provider to ollama-local, or OLLAMA_BASE_URL, for a "
+            "local reverse proxy)",
             kv(host=_DEFAULT_CLOUD_URL),
         )
         return _DEFAULT_CLOUD_URL, api_key
@@ -106,6 +169,10 @@ class OllamaProvider:
 
     @property
     def name(self) -> str:
+        if self._mode == "cloud":
+            return "ollama-cloud"
+        if self._mode == "local":
+            return "ollama-local"
         return "ollama"
 
     @property
@@ -115,11 +182,14 @@ class OllamaProvider:
     def __init__(
         self,
         *,
+        mode: OllamaMode = "auto",
         temperature: float | None = None,
         max_tokens: int | None = None,
         thinking_budget: int | None = None,
     ) -> None:
-        self._base_url, self._api_key = _resolve_host_and_key()
+        self._mode = mode
+        self._base_url, self._api_key = _resolve_host_and_key(mode)
+        _log.info("ollama host resolved %s", kv(mode=self._mode, host=self._base_url))
         sampling = resolve_model_sampling(temperature=temperature, max_tokens=max_tokens)
         self._temperature = sampling.temperature
         self._max_tokens = sampling.max_tokens
@@ -133,8 +203,8 @@ class OllamaProvider:
         """Return the OpenAI-compat base URL for ``model``.
 
         ``OLLAMA_BASE_URL`` is used as-is when it already ends in ``/v1``;
-        otherwise ``/v1`` is appended. Defaults to local Ollama, or Ollama
-        Cloud when ``OLLAMA_API_KEY`` is set and the URL is blank.
+        otherwise ``/v1`` is appended. Host selection is mode-driven
+        (``ollama-cloud`` / ``ollama-local`` / legacy ``ollama``).
         """
         del model  # model id is passed per request; base URL is env-driven
         host = self._base_url
@@ -170,7 +240,7 @@ class OllamaProvider:
         async for event in stream_chat_completions_with_tool_fallback(
             base_url=self._resolve_base_url(model),
             api_key=self._api_key,
-            provider="ollama",
+            provider=self.name,
             messages=messages,
             tools=tools,
             model=model,

{monkeybot-3.0.3 → monkeybot-3.0.4}/tests/core/test_config_extensions.py

@@ -129,6 +129,28 @@ class TestVertexAnthropicProvider:
         assert cfg.provider.name == "ollama"
         assert cfg.model == "llama3.1"
 
+    def test_get_provider_config_ollama_cloud(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setenv("OLLAMA_API_KEY", "cloud-key")
+        monkeypatch.setenv("OLLAMA_BASE_URL", "http://127.0.0.1:11434")
+        cfg = get_provider_config(provider="ollama-cloud", model_name="glm-5.3-flash")
+        assert cfg.provider.name == "ollama-cloud"
+        assert cfg.model == "glm-5.3-flash"
+        assert cfg.provider._resolve_base_url("glm-5.3-flash") == "https://ollama.com/v1"
+
+    def test_get_provider_config_ollama_local(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("OLLAMA_BASE_URL", raising=False)
+        cfg = get_provider_config(provider="ollama-local", model_name="llama3.1")
+        assert cfg.provider.name == "ollama-local"
+        assert cfg.model == "llama3.1"
+        assert cfg.provider._api_key == "ollama"
+
+    def test_get_provider_config_ollama_cloud_requires_key(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.delenv("OLLAMA_API_KEY", raising=False)
+        with pytest.raises(ValueError, match="OLLAMA_API_KEY is not set"):
+            get_provider_config(provider="ollama-cloud", model_name="glm-5.3-flash")
+
     def test_get_provider_config_vertex_anthropic_happy_path(self, monkeypatch: pytest.MonkeyPatch) -> None:
         monkeypatch.setenv("GCP_PROJECT_ID", "test-project")
         monkeypatch.setenv("ANTHROPIC_VERTEX_REGION", "us-central1")