add ability to disable cloud (#14221)

* add ability to disable cloud

Users can now easily opt-out of cloud inference and web search by
setting

```
"disable_ollama_cloud": true
```

in their `~/.ollama/server.json` settings file. After a setting update,
the server must be restarted.

Alternatively, setting the environment variable `OLLAMA_NO_CLOUD=1` will
also disable cloud features. While users previously were able to avoid
cloud models by not pulling or `ollama run`ing them, this gives them an
easy way to enforce that decision. Any attempt to run a cloud model when
cloud is disabled will fail.

The app's old "airplane mode" setting, which did a similar thing for
hiding cloud models within the app is now unified with this new cloud
disabled mode. That setting has been replaced with a "Cloud" toggle,
which behind the scenes edits `server.json` and then restarts the
server.

* gate cloud models across TUI and launch flows when cloud is disabled

Block cloud models from being selected, launched, or written to
integration configs when cloud mode is turned off:

- TUI main menu: open model picker instead of launching with a
  disabled cloud model
- cmd.go: add IsCloudModelDisabled checks for all Selection* paths
- LaunchCmd: filter cloud models from saved Editor configs before
  launch, fall through to picker if none remain
- Editor Run() methods (droid, opencode, openclaw): filter cloud
  models before calling Edit() and persist the cleaned list
- Export SaveIntegration, remove SaveIntegrationModel wrapper that
  was accumulating models instead of replacing them

* rename saveIntegration to SaveIntegration in config.go and tests

* cmd/config: add --model guarding and empty model list fixes

* Update docs/faq.mdx

Co-authored-by: Jeffrey Morgan <jmorganca@gmail.com>

* Update internal/cloud/policy.go

Co-authored-by: Jeffrey Morgan <jmorganca@gmail.com>

* Update internal/cloud/policy.go

Co-authored-by: Jeffrey Morgan <jmorganca@gmail.com>

* Update server/routes.go

Co-authored-by: Jeffrey Morgan <jmorganca@gmail.com>

* Revert "Update internal/cloud/policy.go"

This reverts commit 8bff8615f9.

Since this error shows up in other integrations, we want it to be
prefixed with Ollama

* rename cloud status

* more status renaming

* fix tests that weren't updated after rename

---------

Co-authored-by: ParthSareen <parth.sareen@ollama.com>
Co-authored-by: Jeffrey Morgan <jmorganca@gmail.com>

server/aliases.go

@@ -115,6 +115,15 @@ func (s *store) saveLocked() error {
 		return err
 	}
 
+	// Read existing file into a generic map to preserve unknown fields
+	// (e.g. disable_ollama_cloud) that aliasStore doesn't own.
+	existing := make(map[string]json.RawMessage)
+	if data, err := os.ReadFile(s.path); err == nil {
+		if err := json.Unmarshal(data, &existing); err != nil {
+			slog.Debug("failed to parse existing server config; preserving unknown fields skipped", "path", s.path, "error", err)
+		}
+	}
+
 	// Combine exact and prefix entries
 	entries := make([]aliasEntry, 0, len(s.entries)+len(s.prefixEntries))
 	for _, entry := range s.entries {
@@ -126,10 +135,17 @@ func (s *store) saveLocked() error {
 		return strings.Compare(entries[i].Alias, entries[j].Alias) < 0
 	})
 
-	cfg := serverConfig{
-		Version: serverConfigVersion,
-		Aliases: entries,
+	// Overwrite only the keys we own
+	versionJSON, err := json.Marshal(serverConfigVersion)
+	if err != nil {
+		return err
 	}
+	aliasesJSON, err := json.Marshal(entries)
+	if err != nil {
+		return err
+	}
+	existing["version"] = versionJSON
+	existing["aliases"] = aliasesJSON
 
 	f, err := os.CreateTemp(dir, "router-*.json")
 	if err != nil {
@@ -138,7 +154,7 @@ func (s *store) saveLocked() error {
 
 	enc := json.NewEncoder(f)
 	enc.SetIndent("", "  ")
-	if err := enc.Encode(cfg); err != nil {
+	if err := enc.Encode(existing); err != nil {
 		_ = f.Close()
 		_ = os.Remove(f.Name())
 		return err

server/routes.go

@@ -38,6 +38,7 @@ import (
 	"github.com/ollama/ollama/envconfig"
 	"github.com/ollama/ollama/format"
 	"github.com/ollama/ollama/fs/ggml"
+	internalcloud "github.com/ollama/ollama/internal/cloud"
 	"github.com/ollama/ollama/llm"
 	"github.com/ollama/ollama/logutil"
 	"github.com/ollama/ollama/manifest"
@@ -58,6 +59,11 @@ import (
 
 const signinURLStr = "https://ollama.com/connect?name=%s&key=%s"
 
+const (
+	cloudErrRemoteInferenceUnavailable    = "remote model is unavailable"
+	cloudErrRemoteModelDetailsUnavailable = "remote model details are unavailable"
+)
+
 func shouldUseHarmony(model *Model) bool {
 	if slices.Contains([]string{"gptoss", "gpt-oss"}, model.Config.ModelFamily) {
 		// heuristic to check whether the template expects to be parsed via harmony:
@@ -229,6 +235,11 @@ func (s *Server) GenerateHandler(c *gin.Context) {
 	}
 
 	if m.Config.RemoteHost != "" && m.Config.RemoteModel != "" {
+		if disabled, _ := internalcloud.Status(); disabled {
+			c.JSON(http.StatusForbidden, gin.H{"error": internalcloud.DisabledError(cloudErrRemoteInferenceUnavailable)})
+			return
+		}
+
 		origModel := req.Model
 
 		remoteURL, err := url.Parse(m.Config.RemoteHost)
@@ -1066,9 +1077,12 @@ func (s *Server) ShowHandler(c *gin.Context) {
 
 	resp, err := GetModelInfo(req)
 	if err != nil {
+		var statusErr api.StatusError
 		switch {
 		case os.IsNotExist(err):
 			c.JSON(http.StatusNotFound, gin.H{"error": fmt.Sprintf("model '%s' not found", req.Model)})
+		case errors.As(err, &statusErr):
+			c.JSON(statusErr.StatusCode, gin.H{"error": statusErr.ErrorMessage})
 		case err.Error() == errtypes.InvalidModelNameErrMsg:
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		default:
@@ -1095,6 +1109,15 @@ func GetModelInfo(req api.ShowRequest) (*api.ShowResponse, error) {
 		return nil, err
 	}
 
+	if m.Config.RemoteHost != "" {
+		if disabled, _ := internalcloud.Status(); disabled {
+			return nil, api.StatusError{
+				StatusCode:   http.StatusForbidden,
+				ErrorMessage: internalcloud.DisabledError(cloudErrRemoteModelDetailsUnavailable),
+			}
+		}
+	}
+
 	modelDetails := api.ModelDetails{
 		ParentModel:       m.ParentModel,
 		Format:            m.Config.ModelFormat,
@@ -1571,6 +1594,7 @@ func (s *Server) GenerateRoutes(rc *ollama.Registry) (http.Handler, error) {
 	r.GET("/", func(c *gin.Context) { c.String(http.StatusOK, "Ollama is running") })
 	r.HEAD("/api/version", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"version": version.Version}) })
 	r.GET("/api/version", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"version": version.Version}) })
+	r.GET("/api/status", s.StatusHandler)
 
 	// Local model cache management (new implementation is at end of function)
 	r.POST("/api/pull", s.PullHandler)
@@ -1634,6 +1658,8 @@ func (s *Server) GenerateRoutes(rc *ollama.Registry) (http.Handler, error) {
 func Serve(ln net.Listener) error {
 	slog.SetDefault(logutil.NewLogger(os.Stderr, envconfig.LogLevel()))
 	slog.Info("server config", "env", envconfig.Values())
+	cloudDisabled, _ := internalcloud.Status()
+	slog.Info(fmt.Sprintf("Ollama cloud disabled: %t", cloudDisabled))
 
 	blobsDir, err := manifest.BlobsPath("")
 	if err != nil {
@@ -1824,6 +1850,16 @@ func streamResponse(c *gin.Context, ch chan any) {
 	})
 }
 
+func (s *Server) StatusHandler(c *gin.Context) {
+	disabled, source := internalcloud.Status()
+	c.JSON(http.StatusOK, api.StatusResponse{
+		Cloud: api.CloudStatus{
+			Disabled: disabled,
+			Source:   source,
+		},
+	})
+}
+
 func (s *Server) WhoamiHandler(c *gin.Context) {
 	// todo allow other hosts
 	u, err := url.Parse("https://ollama.com")
@@ -2010,6 +2046,11 @@ func (s *Server) ChatHandler(c *gin.Context) {
 	}
 
 	if m.Config.RemoteHost != "" && m.Config.RemoteModel != "" {
+		if disabled, _ := internalcloud.Status(); disabled {
+			c.JSON(http.StatusForbidden, gin.H{"error": internalcloud.DisabledError(cloudErrRemoteInferenceUnavailable)})
+			return
+		}
+
 		origModel := req.Model
 
 		remoteURL, err := url.Parse(m.Config.RemoteHost)

server/routes_aliases_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -16,7 +17,7 @@ import (
 
 func TestAliasShadowingRejected(t *testing.T) {
 	gin.SetMode(gin.TestMode)
-	t.Setenv("HOME", t.TempDir())
+	setTestHome(t, t.TempDir())
 
 	s := Server{}
 	w := createRequest(t, s.CreateHandler, api.CreateRequest{
@@ -40,7 +41,7 @@ func TestAliasShadowingRejected(t *testing.T) {
 
 func TestAliasResolvesForChatRemote(t *testing.T) {
 	gin.SetMode(gin.TestMode)
-	t.Setenv("HOME", t.TempDir())
+	setTestHome(t, t.TempDir())
 
 	var remoteModel string
 	rs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -256,7 +257,7 @@ func TestPrefixAliasChain(t *testing.T) {
 
 func TestPrefixAliasCRUD(t *testing.T) {
 	gin.SetMode(gin.TestMode)
-	t.Setenv("HOME", t.TempDir())
+	setTestHome(t, t.TempDir())
 
 	s := Server{}
 
@@ -364,7 +365,7 @@ func TestPrefixAliasCaseInsensitive(t *testing.T) {
 
 func TestPrefixAliasLocalModelPrecedence(t *testing.T) {
 	gin.SetMode(gin.TestMode)
-	t.Setenv("HOME", t.TempDir())
+	setTestHome(t, t.TempDir())
 
 	s := Server{}
 
@@ -424,3 +425,51 @@ func TestPrefixAliasLocalModelPrecedence(t *testing.T) {
 		t.Fatalf("expected resolved name to be %q, got %q", expectedTarget.DisplayShortest(), resolved.DisplayShortest())
 	}
 }
+
+func TestAliasSavePreservesCloudDisable(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	tmpDir := t.TempDir()
+	setTestHome(t, tmpDir)
+
+	configPath := filepath.Join(tmpDir, ".ollama", "server.json")
+	if err := os.MkdirAll(filepath.Dir(configPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	initial := map[string]any{
+		"version":              serverConfigVersion,
+		"disable_ollama_cloud": true,
+		"aliases":              []aliasEntry{},
+	}
+	data, err := json.Marshal(initial)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	s := Server{}
+	w := createRequest(t, s.CreateAliasHandler, aliasEntry{Alias: "alias-model", Target: "target-model"})
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	updated, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var updatedCfg map[string]json.RawMessage
+	if err := json.Unmarshal(updated, &updatedCfg); err != nil {
+		t.Fatal(err)
+	}
+
+	raw, ok := updatedCfg["disable_ollama_cloud"]
+	if !ok {
+		t.Fatal("expected disable_ollama_cloud key to be preserved")
+	}
+	if string(raw) != "true" {
+		t.Fatalf("expected disable_ollama_cloud to remain true, got %s", string(raw))
+	}
+}

server/routes_cloud_test.go

@@ -0,0 +1,94 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/ollama/ollama/api"
+	internalcloud "github.com/ollama/ollama/internal/cloud"
+)
+
+func TestStatusHandler(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	setTestHome(t, t.TempDir())
+	t.Setenv("OLLAMA_NO_CLOUD", "1")
+
+	s := Server{}
+	w := createRequest(t, s.StatusHandler, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var resp api.StatusResponse
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatal(err)
+	}
+
+	if !resp.Cloud.Disabled {
+		t.Fatalf("expected cloud.disabled true, got false")
+	}
+	if resp.Cloud.Source != "env" {
+		t.Fatalf("expected cloud.source env, got %q", resp.Cloud.Source)
+	}
+}
+
+func TestCloudDisabledBlocksRemoteOperations(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	setTestHome(t, t.TempDir())
+	t.Setenv("OLLAMA_NO_CLOUD", "1")
+
+	s := Server{}
+
+	w := createRequest(t, s.CreateHandler, api.CreateRequest{
+		Model:      "test-cloud",
+		RemoteHost: "example.com",
+		From:       "test",
+		Info: map[string]any{
+			"capabilities": []string{"completion"},
+		},
+		Stream: &stream,
+	})
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	t.Run("chat remote blocked", func(t *testing.T) {
+		w := createRequest(t, s.ChatHandler, api.ChatRequest{
+			Model:    "test-cloud",
+			Messages: []api.Message{{Role: "user", Content: "hi"}},
+		})
+		if w.Code != http.StatusForbidden {
+			t.Fatalf("expected status 403, got %d", w.Code)
+		}
+		if got := w.Body.String(); got != `{"error":"`+internalcloud.DisabledError(cloudErrRemoteInferenceUnavailable)+`"}` {
+			t.Fatalf("unexpected response: %s", got)
+		}
+	})
+
+	t.Run("generate remote blocked", func(t *testing.T) {
+		w := createRequest(t, s.GenerateHandler, api.GenerateRequest{
+			Model:  "test-cloud",
+			Prompt: "hi",
+		})
+		if w.Code != http.StatusForbidden {
+			t.Fatalf("expected status 403, got %d", w.Code)
+		}
+		if got := w.Body.String(); got != `{"error":"`+internalcloud.DisabledError(cloudErrRemoteInferenceUnavailable)+`"}` {
+			t.Fatalf("unexpected response: %s", got)
+		}
+	})
+
+	t.Run("show remote blocked", func(t *testing.T) {
+		w := createRequest(t, s.ShowHandler, api.ShowRequest{
+			Model: "test-cloud",
+		})
+		if w.Code != http.StatusForbidden {
+			t.Fatalf("expected status 403, got %d", w.Code)
+		}
+		if got := w.Body.String(); got != `{"error":"`+internalcloud.DisabledError(cloudErrRemoteModelDetailsUnavailable)+`"}` {
+			t.Fatalf("unexpected response: %s", got)
+		}
+	})
+}

server/test_home_test.go

@@ -0,0 +1,14 @@
+package server
+
+import (
+	"testing"
+
+	"github.com/ollama/ollama/envconfig"
+)
+
+func setTestHome(t *testing.T, home string) {
+	t.Helper()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	envconfig.ReloadServerConfig()
+}