bug(providers): Ollama (local) shows 'API key configured' when only Ollama Cloud key is set — both providers share OLLAMA_API_KEY in _PROVIDER_ENV_VAR

[nesquena-hermes]

Summary

Ollama (local) and Ollama Cloud both display "API key configured" after only adding a key for Ollama Cloud. They share the same env var (OLLAMA_API_KEY) in the WebUI's provider→env map, so any key set for one shows the other as configured too.

Steps to reproduce

1. Start with a fresh config (no Ollama keys set anywhere).
2. Open Settings → Providers.
3. Add an API key for Ollama Cloud only.
4. Observe that the Ollama card (non-cloud) also shows the green "API key configured" badge.

Expected

Local Ollama and Ollama Cloud are independent providers. Configuring one should not make the other appear configured.

Local Ollama is typically keyless (it's a self-hosted LLM server with optional auth), while Ollama Cloud authenticates against ollama.com using OLLAMA_API_KEY. They should be tracked separately in the UI.

Actual

Both cards show the green "API key configured" badge after only Ollama Cloud has been set up.

Root cause

api/providers.py lines 47–48 maps both providers to the same env var:

_PROVIDER_ENV_VAR: dict[str, str] = {
    ...
    "ollama": "OLLAMA_API_KEY",
    "ollama-cloud": "OLLAMA_API_KEY",
    ...
}

_provider_has_key("ollama") then checks OLLAMA_API_KEY and finds the value the user set for Ollama Cloud, returning True.

This contradicts the runtime semantics in hermes_cli/runtime_provider.py (~line 615), which only consumes OLLAMA_API_KEY when the base URL hostname is ollama.com:

_is_ollama_url = base_url_host_matches(base_url, "ollama.com")
api_key_candidates = [
    explicit_api_key,
    (cfg_api_key if use_config_base_url else ""),
    (os.getenv("OLLAMA_API_KEY") if _is_ollama_url else ""),
    ...
]

For bare ollama (local), OLLAMA_API_KEY is not used — the local server is reached via a custom base URL and typically requires no auth (hermes_cli/providers.py:340 defines "ollama": "custom"). So the WebUI is reporting "configured" for a provider that semantically does not consume the key it's checking.

Suggested fix

Two options, both small:

Option A — drop bare ollama from _PROVIDER_ENV_VAR entirely (preferred).

Local Ollama is keyless. Remove the mapping at api/providers.py:47:

-    "ollama": "OLLAMA_API_KEY",
     "ollama-cloud": "OLLAMA_API_KEY",

_provider_has_key("ollama") will then fall through to the config.yaml checks (providers.ollama.api_key etc.), which already work correctly on a per-provider basis. Local Ollama users who genuinely need auth can still set providers.ollama.api_key in config.yaml and it will register without leaking to ollama-cloud.

Option B — give local Ollama its own env var (e.g. OLLAMA_LOCAL_API_KEY), but this introduces a new public-facing env var and complicates docs. Option A is cleaner.

Test shape

Add a test in tests/test_provider_management.py:

def test_ollama_local_not_configured_when_only_cloud_key_set(monkeypatch):
    monkeypatch.setenv("OLLAMA_API_KEY", "sk-cloud-key")
    # ... call get_providers()
    by_id = {p["id"]: p for p in result["providers"]}
    assert by_id["ollama-cloud"]["has_key"] is True
    assert by_id["ollama"]["has_key"] is False  # currently True — bug

Scope

Fix is in ~/hermes-webui-public/api/providers.py — under 5 LOC. Mac app inherits the fix automatically.

Reported by

@AvidFuturist in Discord (webui channel, May 1 2026).