@jameslovespancakes/pi-plus 1.0.22 → 1.0.23

package/README.md

@@ -37,9 +37,10 @@ the app's Stop button stops the agent. Your selected model still runs through pi
 ──────────────────────────────────────
 ```
 
-**`/claude-remote`** toggles On/Off. On connects now and auto-starts in future
-interactive sessions; Off disconnects and disables auto-start. The footer dot
-is green when connected and red otherwise.
+**`/claude-remote`** toggles On/Off for this session only. Startup, new sessions,
+resumes, forks, and reloads always start Off; old auto-start preferences are
+ignored. Off disconnects immediately. The footer dot is green when connected
+and red otherwise.
 
 Off by default. Requires your primary Anthropic OAuth login via `/login`.
 Experimental: text input and completed-message mirroring, not token streaming.
@@ -124,11 +125,23 @@ boundary, including workflow subagents—not just through prompt instructions.
 ──────────────────────────────────────
  Providers
 › ● Anthropic              Allowed
-  ● OpenRouter             Needs Approval
+  ● OpenRouter             Off
 ──────────────────────────────────────
 ```
 
 **`/provider`** opens the picker. Enter or Space toggles access in place.
+OpenRouter cycles **Off → On → On (ZDR) → Off**. Grants are session-local;
+explicit policy denials stay locked. Other providers keep their existing toggles.
+
+**On (ZDR)** restricts OpenRouter inference to Zero Data Retention endpoints,
+including workflow agents and compaction. No eligible endpoint means an error,
+never a non-ZDR retry; fallback among ZDR endpoints is allowed. Native Chat
+Completions and Anthropic Messages routes are supported; unsupported APIs or
+custom endpoints fail closed. Ordinary On does not remove account-level privacy
+rules. ZDR does not cover separately enabled search plugins or local session logs.
+
+Commands: `/provider approve openrouter`, `/provider zdr openrouter`, and
+`/provider remove openrouter`.
 
 ## Workflows
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jameslovespancakes/pi-plus",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "type": "module",
   "description": "pi and more",
   "license": "MIT",

package/src/core/env.ts

@@ -15,7 +15,6 @@ export type EnvKey =
   | "AGENT_BOARD_NAME"
   | "AGENT_BOARD_MODE"
   | "AGENT_BOARD_SSH"
-  | "PI_CLAUDE_REMOTE"
   | "PI_CLAUDE_REMOTE_ALLOW_INBOUND"
   | "CLAUDE_TRUSTED_DEVICE_TOKEN";
 
@@ -26,7 +25,6 @@ export const ENV_KEYS: { key: EnvKey; label: string; secret: boolean }[] = [
   { key: "AGENT_BOARD_NAME", label: "Agent board display name", secret: false },
   { key: "AGENT_BOARD_MODE", label: "Agent board deployment (local|remote|external)", secret: false },
   { key: "AGENT_BOARD_SSH", label: "Agent board SSH host, when remote", secret: false },
-  { key: "PI_CLAUDE_REMOTE", label: "Claude Remote auto-start (1|0)", secret: false },
   { key: "PI_CLAUDE_REMOTE_ALLOW_INBOUND", label: "Claude Remote input (1|0)", secret: false },
   { key: "CLAUDE_TRUSTED_DEVICE_TOKEN", label: "Claude trusted-device token (optional)", secret: true },
 ];

package/src/core/policy/openrouter.ts

@@ -0,0 +1,54 @@
+import type { Api, Model, StreamOptions } from "@earendil-works/pi-ai";
+
+function officialEndpoint(model: Model<Api>): boolean {
+  try {
+    const url = new URL(model.baseUrl);
+    const path = model.api === "anthropic-messages" ? "/api" : "/api/v1";
+    return url.origin === "https://openrouter.ai" && url.pathname.replace(/\/+$/, "") === path
+      && !url.username && !url.password && !url.search && !url.hash;
+  } catch { return false; }
+}
+
+/** Enforce through pi's own routing support, without replacing its provider or tools. */
+export function withOpenRouterZdr(model: Model<Api>, options?: StreamOptions) {
+  if (!["openai-completions", "anthropic-messages"].includes(model.api) || !officialEndpoint(model)) {
+    throw new Error("OpenRouter On (ZDR) cannot enforce this API or endpoint. Use pi's native OpenRouter Chat Completions or Messages route.");
+  }
+  const preferences = model.compat && "openRouterRouting" in model.compat ? model.compat.openRouterRouting : undefined;
+  return {
+    model: model.api === "openai-completions" ? {
+      ...model,
+      compat: {
+        ...model.compat,
+        openRouterRouting: { ...preferences, zdr: true },
+      },
+    } : model,
+    options: {
+      ...options,
+      // Run caller instrumentation first, then enforce the final request's
+      // privacy restriction. No retry without ZDR is allowed.
+      onPayload: async (payload: unknown, requestModel: Model<Api>) => {
+        const replacement = await options?.onPayload?.(payload, requestModel);
+        const body = replacement === undefined ? payload : replacement;
+        if (!body || typeof body !== "object" || !("messages" in body) || !Array.isArray(body.messages)
+          || "input" in body || "instructions" in body) {
+          throw new Error("OpenRouter On (ZDR) blocked an unsupported request payload.");
+        }
+        const routing = "provider" in body ? body.provider : undefined;
+        // Pi natively serializes openRouterRouting on Chat Completions. Its
+        // Anthropic adapter does not, although OpenRouter's Messages API accepts
+        // the same provider preferences. Add only that missing request field.
+        if (model.api === "anthropic-messages") {
+          if (routing !== undefined && (!routing || typeof routing !== "object" || Array.isArray(routing))) {
+            throw new Error("OpenRouter On (ZDR) blocked malformed provider preferences.");
+          }
+          return { ...body, provider: { ...preferences, ...routing, zdr: true } };
+        }
+        if (!routing || typeof routing !== "object" || !("zdr" in routing) || routing.zdr !== true) {
+          throw new Error("OpenRouter On (ZDR) blocked a request without provider.zdr=true.");
+        }
+        return body;
+      },
+    },
+  };
+}

package/src/core/policy/policy.ts

@@ -1,45 +1,29 @@
 import { readConfig, updateConfig } from "../config.ts";
 
-/**
- * Approval policy for model selection.
- *
- * Subscription providers are free to use. Metered providers (OpenRouter and
- * anything else that bills per token) require an explicit approval before a
- * request is allowed to leave the machine.
- */
-
 export interface PolicyFile {
   autoApprove: string[];
   requireApproval: string[];
   deny: string[];
 }
 
-const DEFAULT_POLICY: PolicyFile = {
-  // `google/*` is the metered Gemini API; `gemini/*` is the subscription,
-  // which the account's plan has already paid for.
-  autoApprove: ["anthropic/*", "openai-codex/*", "gemini/*"],
-  requireApproval: ["openrouter/*", "google/*", "openai/*", "xai/*"],
-  deny: [],
-};
-
 export type Decision =
   | { allowed: true; reason: "auto" | "approved" }
   | { allowed: false; reason: "denied" | "needs-approval"; message: string };
 
-const approvals = new Map<string, number>();
+export type ProviderState = "auto" | "approved" | "blocked" | "denied" | "zdr";
+
+export interface ProviderApproval {
+  provider: string;
+  approved: boolean;
+  until?: number;
+}
 
 export function loadPolicy(): PolicyFile {
   return readConfig().policy;
 }
 
 export function savePolicy(next: PolicyFile): void {
-  updateConfig((config) => {
-    config.policy = {
-      autoApprove: next.autoApprove ?? DEFAULT_POLICY.autoApprove,
-      requireApproval: next.requireApproval ?? DEFAULT_POLICY.requireApproval,
-      deny: next.deny ?? DEFAULT_POLICY.deny,
-    };
-  });
+  updateConfig((config) => { config.policy = next; });
 }
 
 function matches(pattern: string, value: string): boolean {
@@ -51,135 +35,130 @@ function matchesAny(patterns: string[], value: string): boolean {
   return patterns.some((pattern) => matches(pattern, value));
 }
 
-/**
- * Provider ids that require approval, derived from the policy patterns so the
- * toggle list always reflects the configured file rather than a hardcoded set.
- */
+/** Configured approval gates, independent of a session's live grants. */
 export function gatedProviders(): string[] {
-  const names = loadPolicy().requireApproval
-    .map((pattern) => pattern.split("/")[0])
+  const names = loadPolicy().requireApproval.map((pattern) => pattern.split("/")[0])
     .filter((name) => name && !name.includes("*"));
   return [...new Set(names)].sort();
 }
 
-export type ProviderState = "auto" | "approved" | "blocked" | "denied";
+/** Runtime grants belong to an extension session, never a shared module or config file. */
+export class ProviderPolicy {
+  private readonly approvals = new Map<string, number>();
+  private openRouterMode: "off" | "on" | "zdr" | undefined;
 
-/** How the policy currently treats a provider, for display and toggling. */
-export function providerState(provider: string): ProviderState {
-  const current = loadPolicy();
-  if (matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) return "denied";
-  if (matchesAny(current.requireApproval, `${provider}/*`)) {
-    return isApproved(provider) ? "approved" : "blocked";
+  reset(): void {
+    this.approvals.clear();
+    this.openRouterMode = undefined;
   }
-  return "auto";
-}
 
-/**
- * Flips whether a provider may be used.
- *
- * Auto-approved providers are moved into `requireApproval` so the switch is
- * reversible; gated ones just gain or lose their session grant. Denied
- * providers are left alone; `deny` is an explicit, deliberate block.
- */
-export function toggleProvider(provider: string): ProviderState {
-  const state = providerState(provider);
-  if (state === "denied") return state;
-
-  if (state === "auto") {
-    const current = loadPolicy();
-    savePolicy({
-      ...current,
-      autoApprove: current.autoApprove.filter((pattern) => !matches(pattern, `${provider}/*`) && pattern !== `${provider}/*`),
-      requireApproval: [...new Set([...current.requireApproval, `${provider}/*`])],
-    });
-    revoke(provider);
-    return "blocked";
+  openRouterZdrRequired(): boolean {
+    return this.openRouterMode === "zdr";
   }
 
-  if (state === "approved") {
-    revoke(provider);
-    return "blocked";
+  approveOpenRouterZdr(): void {
+    this.approve("openrouter");
+    this.openRouterMode = "zdr";
   }
 
-  approve(provider);
-  return "approved";
-}
-
-/** Grant approval for a provider until `untilMs` (omitted means this session). */
-export function approve(provider: string, durationMs?: number): void {
-  approvals.set(provider, durationMs ? Date.now() + durationMs : Number.MAX_SAFE_INTEGER);
-}
-
-export function revoke(provider: string): void {
-  approvals.delete(provider);
-}
-
-export function isApproved(provider: string): boolean {
-  const until = approvals.get(provider);
-  return until !== undefined && Date.now() < until;
-}
+  /** No duration means a grant for this session only. */
+  approve(provider: string, durationMs?: number): void {
+    this.approvals.set(provider, durationMs ? Date.now() + durationMs : Number.MAX_SAFE_INTEGER);
+    if (provider === "openrouter") this.openRouterMode = "on";
+  }
 
-/** Flips a provider's approval and reports the resulting state. */
-export function toggleApproval(provider: string): boolean {
-  if (isApproved(provider)) {
-    revoke(provider);
-    return false;
+  revoke(provider: string): void {
+    this.approvals.delete(provider);
+    if (provider === "openrouter") this.openRouterMode = "off";
   }
-  approve(provider);
-  return true;
-}
 
-export interface ProviderApproval {
-  provider: string;
-  approved: boolean;
-  until?: number;
-}
+  isApproved(provider: string): boolean {
+    const until = this.approvals.get(provider);
+    return until !== undefined && Date.now() < until;
+  }
 
-/** Current approval state for every gated provider, for display. */
-export function approvalStates(): ProviderApproval[] {
-  return gatedProviders().map((provider) => {
-    const until = approvals.get(provider);
-    const approved = until !== undefined && Date.now() < until;
-    return { provider, approved, until: approved && until !== Number.MAX_SAFE_INTEGER ? until : undefined };
-  });
-}
+  providerState(provider: string): ProviderState {
+    const current = loadPolicy();
+    if (matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) return "denied";
+    if (provider === "openrouter" && this.openRouterMode !== undefined) {
+      return this.isApproved(provider) ? (this.openRouterZdrRequired() ? "zdr" : "approved") : "blocked";
+    }
+    if (matchesAny(current.requireApproval, `${provider}/*`)) {
+      return this.isApproved(provider) ? "approved" : "blocked";
+    }
+    return "auto";
+  }
 
-export function checkModel(provider: string, modelId: string): Decision {
-  const current = loadPolicy();
-  const ref = `${provider}/${modelId}`;
+  /** Only OpenRouter cycles through a third (ZDR-only) state. */
+  toggleProvider(provider: string): ProviderState {
+    const state = this.providerState(provider);
+    if (state === "denied") return state;
+    if (provider === "openrouter") {
+      if (state === "auto" || state === "approved") this.approveOpenRouterZdr();
+      else if (state === "zdr") this.revoke(provider);
+      else this.approve(provider);
+      return this.providerState(provider);
+    }
+    if (state === "auto") {
+      const current = loadPolicy();
+      savePolicy({
+        ...current,
+        autoApprove: current.autoApprove.filter((pattern) => !matches(pattern, `${provider}/*`)),
+        requireApproval: [...new Set([...current.requireApproval, `${provider}/*`])],
+      });
+      this.revoke(provider);
+      return "blocked";
+    }
+    return this.toggleApproval(provider) ? "approved" : "blocked";
+  }
 
-  if (matchesAny(current.deny, ref) || matchesAny(current.deny, `${provider}/*`)) {
-    return { allowed: false, reason: "denied", message: `${ref} is denied by model policy.` };
+  toggleApproval(provider: string): boolean {
+    if (this.isApproved(provider)) { this.revoke(provider); return false; }
+    this.approve(provider);
+    return true;
   }
-  if (matchesAny(current.autoApprove, ref)) return { allowed: true, reason: "auto" };
-
-  const gated = matchesAny(current.requireApproval, ref);
-  if (!gated) return { allowed: true, reason: "auto" };
-
-  if (!isApproved(provider)) {
-    return {
-      allowed: false,
-      reason: "needs-approval",
-      message:
-        `${ref} is a metered (pay-per-token) model and is not approved in this session. `
-        + `Use a subscription model such as anthropic/* or openai-codex/*, or ask the user to run `
-        + `/provider approve ${provider}.`,
-    };
+
+  approvalStates(): ProviderApproval[] {
+    const ids = new Set([...gatedProviders(), ...this.approvals.keys()]);
+    return [...ids].sort().map((provider) => {
+      const until = this.approvals.get(provider);
+      const approved = this.isApproved(provider);
+      return { provider, approved, until: approved && until !== Number.MAX_SAFE_INTEGER ? until : undefined };
+    });
   }
 
-  return { allowed: true, reason: "approved" };
-}
+  checkModel(provider: string, modelId: string): Decision {
+    const current = loadPolicy();
+    const ref = `${provider}/${modelId}`;
+    if (matchesAny(current.deny, ref) || matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) {
+      return { allowed: false, reason: "denied", message: `${ref} is denied by model policy.` };
+    }
+    // Explicit OpenRouter Off must override even an auto-approve wildcard.
+    const explicitOpenRouterMode = provider === "openrouter" && this.openRouterMode !== undefined;
+    if (!explicitOpenRouterMode && matchesAny(current.autoApprove, ref)) return { allowed: true, reason: "auto" };
+    if (!explicitOpenRouterMode && !matchesAny(current.requireApproval, ref)) return { allowed: true, reason: "auto" };
+    if (!this.isApproved(provider)) {
+      return {
+        allowed: false, reason: "needs-approval",
+        message: `${ref} is a metered (pay-per-token) model and is not approved in this session. `
+          + "Use a subscription model such as anthropic/* or openai-codex/*, or ask the user to run "
+          + `/provider approve ${provider}.`,
+      };
+    }
+    return { allowed: true, reason: "approved" };
+  }
 
-export function policySummary(): string {
-  const current = loadPolicy();
-  const active = approvalStates()
-    .filter((entry) => entry.approved)
-    .map((entry) => `${entry.provider}${entry.until ? ` (until ${new Date(entry.until).toLocaleTimeString()})` : " (session)"}`);
-  return [
-    "Model approval policy",
-    `  auto-approved:    ${current.autoApprove.join(", ") || "none"}`,
-    `  needs approval:   ${current.requireApproval.join(", ") || "none"}`,
-    `  denied:           ${current.deny.join(", ") || "none"}`,
-    `  approved now:     ${active.join(", ") || "none"}`,
-  ].join("\n");
+  policySummary(): string {
+    const current = loadPolicy();
+    const active = this.approvalStates().filter((entry) => entry.approved).map((entry) =>
+      `${entry.provider}${entry.provider === "openrouter" && this.openRouterZdrRequired() ? " (ZDR)" : ""}`
+      + (entry.until ? ` (until ${new Date(entry.until).toLocaleTimeString()})` : " (session)"));
+    return [
+      "Model approval policy",
+      `  auto-approved:    ${current.autoApprove.join(", ") || "none"}`,
+      `  needs approval:   ${current.requireApproval.join(", ") || "none"}`,
+      `  denied:           ${current.deny.join(", ") || "none"}`,
+      `  approved now:     ${active.join(", ") || "none"}`,
+    ].join("\n");
+  }
 }

package/src/domains/claude-remote/index.ts

@@ -2,7 +2,7 @@ import { basename } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { ClaudeRemoteBridge, type BridgeOptions } from "../../core/claude-remote/bridge.ts";
 import { mirrorMessage } from "../../core/claude-remote/protocol.ts";
-import { env, setEnv } from "../../core/env.ts";
+import { env } from "../../core/env.ts";
 import { createTokenSource } from "./auth.ts";
 import { remoteControlPicker } from "./picker.ts";
 
@@ -30,6 +30,7 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
   let enabled = false;
   let current: ExtensionContext | undefined;
   let generation = 0;
+  let sessionEpoch = 0;
   // Counts rather than a TTL: follow-ups can wait longer than 30 seconds.
   const echoes: string[] = [];
 
@@ -48,6 +49,7 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
   }
 
   function stop(): void {
+    enabled = false;
     ++generation;
     active?.stop();
     active = undefined;
@@ -55,12 +57,18 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
     setConnectionStatus("off");
   }
 
+  function endSession(): void {
+    ++sessionEpoch;
+    stop();
+  }
+
   function start(ctx: ExtensionContext): void {
     if (active) {
       notify(ctx, `Claude Remote: ${status}. Open https://claude.ai/code`);
       return;
     }
     current = ctx;
+    enabled = true;
     const gen = ++generation;
     const title = `pi: ${pi.getSessionName() || basename(ctx.cwd) || "session"}`.slice(0, 100);
     setConnectionStatus("connecting");
@@ -115,14 +123,8 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
   }
 
   function setEnabled(next: boolean, ctx: ExtensionContext): boolean {
-    enabled = next;
-    const saved = setEnv("PI_CLAUDE_REMOTE", next ? "1" : "0");
     if (next) start(ctx);
     else stop();
-    if (!saved) notify(ctx, "Could not save preference; changed this session only.", true);
-    else if ((env("PI_CLAUDE_REMOTE") === "1") !== next) {
-      notify(ctx, "PI_CLAUDE_REMOTE overrides this preference after reload.", true);
-    }
     return enabled;
   }
 
@@ -132,28 +134,33 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
       .filter((value) => value.startsWith(prefix)).map((value) => ({ value, label: value })),
     handler: async (args, ctx) => {
       const action = args.trim().toLowerCase();
+      const session = sessionEpoch;
       if (!action && ctx.mode === "tui") {
         await ctx.ui.custom((_tui, theme, _keys, done) => remoteControlPicker(
-          theme, enabled, (next) => setEnabled(next, ctx), () => done(undefined),
+          theme, () => session === sessionEpoch && enabled,
+          (next) => session === sessionEpoch && setEnabled(next, ctx), () => done(undefined),
         ));
       } else if (action === "on" || action === "off") {
         if (action === "on" && ctx.hasUI && !enabled && !await ctx.ui.confirm("Enable Remote Control?",
-          "Share sessions with Anthropic and control pi from the Claude app. Auto-starts in interactive sessions.")) return;
+          "Share this session with Anthropic and control it from the Claude app. New sessions and reloads start Off.")) return;
+        if (session !== sessionEpoch) return;
         setEnabled(action === "on", ctx);
       } else notify(ctx, "Usage: /claude-remote [on|off]", true);
     },
   });
 
+  // Stop before pi changes the active session, including cancelled switches.
+  pi.on("session_before_switch", () => { endSession(); });
+  pi.on("session_before_fork", () => { endSession(); });
   pi.on("session_start", (_event, ctx) => {
-    stop();
+    endSession();
     current = ctx;
     setConnectionStatus("off");
-    enabled = env("PI_CLAUDE_REMOTE") === "1";
-    // Never spawn remote mirrors for workflow/SDK/print subagents by default.
-    if (ctx.mode === "tui" && enabled) start(ctx);
+    // Intentionally ignore legacy PI_CLAUDE_REMOTE preferences. Every session,
+    // including resumes, forks, reloads and workflow children, starts Off.
   });
   pi.on("session_shutdown", (_event, ctx) => {
-    stop();
+    endSession();
     if (ctx.hasUI) ctx.ui.setStatus("claude-remote", undefined);
     current = undefined;
   });

package/src/domains/claude-remote/picker.ts

@@ -5,11 +5,11 @@ import { frameSettings, settingsTheme } from "../../ui/settings-picker.ts";
 /** Same dot, colors and in-place SettingsList toggle as /provider. */
 export function remoteControlPicker(
   theme: any,
-  initial: boolean,
+  readEnabled: () => boolean,
   toggle: (enabled: boolean) => boolean,
   done: () => void,
 ): Component {
-  let enabled = initial;
+  let enabled = readEnabled();
   const color = (value: boolean, text: string) => hasTruecolor()
     ? levelColor(value ? 100 : 0)(text) : theme.fg(value ? "success" : "error", text);
   const label = () => `${color(enabled, "●")} Remote Control`;
@@ -19,13 +19,22 @@ export function remoteControlPicker(
     values: [color(true, "On"), color(false, "Off")],
   };
   const list = new SettingsList([item], 1, settingsTheme(theme), () => {
-    enabled = toggle(!enabled);
+    enabled = toggle(!readEnabled());
     item.label = label();
     list.updateValue(item.id, value());
   }, done, { enableSearch: false });
   const frame = frameSettings(theme, list, "Remote Control");
   return {
     ...frame,
+    render(width: number) {
+      const next = readEnabled();
+      if (next !== enabled) {
+        enabled = next;
+        item.label = label();
+        list.updateValue(item.id, value());
+      }
+      return frame.render(width);
+    },
     invalidate() {
       item.values = [color(true, "On"), color(false, "Off")];
       item.label = label();

package/src/domains/models/policy-gate.ts

@@ -1,15 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import {
-  approve,
-  checkModel,
-  gatedProviders,
-  isApproved,
-  loadPolicy,
-  providerState,
-  revoke,
-  toggleProvider,
-} from "../../core/policy/policy.ts";
-import { openProviderPicker, STATE_TEXT, type ProviderRow, type StateKey } from "./provider-picker.ts";
+import { gatedProviders, loadPolicy, ProviderPolicy } from "../../core/policy/policy.ts";
+import { withOpenRouterZdr } from "../../core/policy/openrouter.ts";
+import { openProviderPicker, providerStateText, type ProviderRow } from "./provider-picker.ts";
 
 /**
  * Enforces the approval policy at the provider boundary, so it also covers
@@ -20,7 +12,11 @@ class ModelPolicyError extends Error {
   code = "MODEL_POLICY_BLOCKED";
 }
 
-async function providerRows(ctx: any): Promise<ProviderRow[]> {
+// A workflow child inherits the host's live guard, not a second unapproved gate.
+const POLICY_GUARD = Symbol.for("pi-plus.provider-policy");
+
+/** Configured providers plus policy gates, re-read after authentication changes. */
+async function providerRows(ctx: any, policy: ProviderPolicy): Promise<ProviderRow[]> {
   const ids = new Set<string>();
   try {
     for (const model of await ctx.modelRegistry.getAvailable()) ids.add(model.provider);
@@ -47,16 +43,11 @@ async function providerRows(ctx: any): Promise<ProviderRow[]> {
       id: provider,
       provider,
       display,
-      state: providerState(provider) as ProviderRow["state"],
+      state: policy.providerState(provider),
     };
   });
 }
 
-/**
- * Every provider the user actually has credentials for, plus any the policy
- * gates. Derived at call time so a newly authenticated provider shows up
- * without touching config.
- */
 /**
  * Providers are free to decorate their own name. The CortexKit package calls
  * itself "Anthropic (CortexKit OAuth)". The implementation detail is noise in a
@@ -68,57 +59,59 @@ function cleanName(name: string): string {
 
 
 export function registerPolicyGate(pi: ExtensionAPI): void {
+  const policy = new ProviderPolicy();
   let wrapped = false;
 
   const wrapProviders = (ctx: any) => {
     if (wrapped) return;
-    for (const providerId of gatedProviders()) {
+    // OpenRouter must be wrapped even when config auto-approves it: the picker
+    // can still select ZDR (or Off) without changing the installed catalogue.
+    for (const providerId of new Set([...gatedProviders(), "openrouter"])) {
       const provider = ctx.modelRegistry.getProvider(providerId);
-      if (!provider) continue;
+      if (!provider || ctx.modelRegistry.getRegisteredNativeProvider?.(providerId)?.[POLICY_GUARD]) continue;
 
       const guard = (model: any) => {
-        const decision = checkModel(providerId, model?.id ?? "unknown");
+        const decision = policy.checkModel(providerId, model?.id ?? "unknown");
         if (!decision.allowed) throw new ModelPolicyError(decision.message);
       };
 
-      const originalStream = provider.stream?.bind(provider);
-      const originalStreamSimple = provider.streamSimple?.bind(provider);
-
-      pi.registerProvider({
+      const wrapStream = (stream: any) => (model: any, context: any, options: any) => {
+        guard(model);
+        if (providerId === "openrouter" && policy.openRouterZdrRequired()) {
+          const request = withOpenRouterZdr(model, options);
+          return stream.call(provider, request.model, context, request.options);
+        }
+        return stream.call(provider, model, context, options);
+      };
+      const guarded = {
         ...provider,
-        ...(originalStream && {
-          stream: (model: any, ...rest: any[]) => {
-            guard(model);
-            return originalStream(model, ...rest);
-          },
-        }),
-        ...(originalStreamSimple && {
-          streamSimple: (model: any, ...rest: any[]) => {
-            guard(model);
-            return originalStreamSimple(model, ...rest);
-          },
-        }),
-      });
+        [POLICY_GUARD]: true,
+        ...(provider.stream && { stream: wrapStream(provider.stream) }),
+        ...(provider.streamSimple && { streamSimple: wrapStream(provider.streamSimple) }),
+      };
+      pi.registerProvider(guarded);
     }
     wrapped = true;
   };
 
   pi.on("session_start", async (_event, ctx) => {
+    policy.reset();
     loadPolicy();
     wrapProviders(ctx);
   });
+  pi.on("session_shutdown", () => { policy.reset(); });
 
   pi.registerCommand("provider", {
-    description: "Toggle which providers may be used (approve | remove <name>)",
+    description: "Toggle providers (approve | remove <name>; zdr openrouter for ZDR-only routing)",
     getArgumentCompletions: (prefix) => {
       const [action, name = ""] = prefix.split(/\s+/);
       if (!prefix.includes(" ")) {
-        return ["approve", "remove"]
+        return ["approve", "zdr", "remove"]
           .filter((option) => option.startsWith(action))
           .map((option) => ({ value: option, label: option }));
       }
-      if (action !== "approve" && action !== "remove") return [];
-      return gatedProviders()
+      if (action !== "approve" && action !== "remove" && action !== "zdr") return [];
+      return (action === "zdr" ? ["openrouter"] : [...new Set([...gatedProviders(), "openrouter"])])
         .filter((provider) => provider.startsWith(name))
         .map((provider) => ({ value: `${action} ${provider}`, label: provider }));
     },
@@ -126,43 +119,48 @@ export function registerPolicyGate(pi: ExtensionAPI): void {
       const [action, ...rest] = args.trim().split(/\s+/).filter(Boolean);
       const name = rest.join(" ");
 
-      if (action === "approve" || action === "remove") {
+      if (action === "approve" || action === "remove" || action === "zdr") {
         if (!name) {
           ctx.ui.notify(`Usage: /provider ${action} <provider>`, "warning");
           return;
         }
-        if (!gatedProviders().includes(name)) {
+        if (action === "zdr" && name !== "openrouter") {
+          ctx.ui.notify("ZDR mode is supported only for OpenRouter. Use: /provider zdr openrouter", "warning");
+          return;
+        }
+        if (name !== "openrouter" && !gatedProviders().includes(name)) {
           ctx.ui.notify(
             `“${name}” is not a gated provider. Gated: ${gatedProviders().join(", ") || "none"}`,
             "warning",
           );
           return;
         }
-        if (action === "approve") approve(name);
-        else revoke(name);
-        ctx.ui.notify(`${name} is now ${isApproved(name) ? "approved" : "blocked"}.`, "info");
+        if (action === "zdr") policy.approveOpenRouterZdr();
+        else if (action === "approve") policy.approve(name);
+        else policy.revoke(name);
+        ctx.ui.notify(`${name} is now ${providerStateText(name, policy.providerState(name))}.`, "info");
         return;
       }
 
       if (action) {
-        ctx.ui.notify(`Unknown action “${action}”. Use: /provider [approve|remove <name>]`, "warning");
+        ctx.ui.notify(`Unknown action “${action}”. Use: /provider [approve|remove <name>] or /provider zdr openrouter`, "warning");
         return;
       }
 
-      const rows = await providerRows(ctx);
+      const rows = await providerRows(ctx, policy);
 
       // Headless: plain text, no cursor to draw.
       if (!ctx.hasUI) {
         ctx.ui.notify(
-          rows.map((row) => `${row.state === "auto" || row.state === "approved" ? "[on] " : "[off]"} ${row.display}: ${STATE_TEXT[row.state]}`).join("\n"),
+          rows.map((row) => `${row.state === "blocked" || row.state === "denied" ? "[off]" : "[on] "} ${row.display}: ${providerStateText(row.provider, row.state)}`).join("\n"),
           "info",
         );
         return;
       }
 
       await openProviderPicker(ctx, {
-        rows: () => providerRows(ctx),
-        toggle: (provider) => toggleProvider(provider) as StateKey,
+        rows: () => providerRows(ctx, policy),
+        toggle: (provider) => policy.toggleProvider(provider),
       });
     },
   });

package/src/domains/models/provider-picker.ts

@@ -22,12 +22,22 @@ export const STATE_TEXT = {
   approved: "Approved",
   blocked: "Needs Approval",
   denied: "Denied",
+  zdr: "On (ZDR)",
 } as const;
 
 export type StateKey = keyof typeof STATE_TEXT;
 
-/** The two values SettingsList cycles between for a binary toggle. */
-export const TOGGLE_VALUES = [STATE_TEXT.auto, STATE_TEXT.blocked];
+export function providerToggleStates(provider: string): StateKey[] {
+  return provider === "openrouter" ? ["blocked", "approved", "zdr"] : ["auto", "blocked"];
+}
+
+export function providerStateText(provider: string, state: StateKey): string {
+  if (provider === "openrouter") {
+    if (state === "auto" || state === "approved") return "On";
+    if (state === "blocked") return "Off";
+  }
+  return STATE_TEXT[state];
+}
 
 export interface ProviderRow {
   /** Stable id used by SettingsList and by the toggle handler. */
@@ -52,6 +62,7 @@ const STATE_LEVEL: Record<StateKey, number> = {
   approved: 100,
   blocked: 45,
   denied: 0,
+  zdr: 100,
 };
 
 /** Fallback for terminals without truecolor. */
@@ -60,6 +71,7 @@ const STATE_THEME_COLOUR: Record<StateKey, string> = {
   approved: "success",
   blocked: "warning",
   denied: "error",
+  zdr: "success",
 };
 
 /**
@@ -120,13 +132,12 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
     // `values` carries the COLOURED strings, not plain text. SettingsList shows
     // whichever it cycles to immediately, so pre-colouring them means the new
     // text arrives already in the right colour rather than flashing uncoloured.
-    const colouredToggle = [colourState(theme, "auto"), colourState(theme, "blocked")];
-
+    const valueFor = (row: ProviderRow, state = row.state) => colourState(theme, state, providerStateText(row.provider, state));
     const items = rows.map((row) => ({
       id: row.id,
       label: labelFor(theme, row),
-      values: [...colouredToggle],
-      currentValue: colourState(theme, row.state),
+      values: providerToggleStates(row.provider).map((state) => valueFor(row, state)),
+      currentValue: valueFor(row),
     }));
 
     // Synchronous throughout: label, dot and value all change in one render.
@@ -137,7 +148,7 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
 
       if (row.state === "denied") {
         // Undo the value SettingsList optimistically cycled to.
-        list?.updateValue(id, colourState(theme, row.state));
+        list?.updateValue(id, valueFor(row));
         ctx.ui.notify(`${row.display} is denied in policy. Edit pi-plus.json to change that.`, "warning");
         return;
       }
@@ -145,7 +156,7 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
       const next = deps.toggle(row.provider);
       row.state = next;
       item.label = labelFor(theme, row);
-      list?.updateValue(id, colourState(theme, next));
+      list?.updateValue(id, valueFor(row));
       list?.invalidate?.();
     };
 

package/src/domains/setup/index.ts

@@ -94,7 +94,7 @@ async function inspect(ctx: any): Promise<Feature[]> {
     name: "Providers",
     ready: config.policy.requireApproval.length > 0,
     detail: `${config.policy.requireApproval.length} gated pattern(s), ${config.policy.autoApprove.length} auto-approved`,
-    commands: ["/provider", "/provider list", "/provider approve <name>"],
+    commands: ["/provider", "/provider approve <name>", "/provider zdr openrouter"],
     open: "/provider",
   });
 
@@ -131,12 +131,11 @@ async function inspect(ctx: any): Promise<Feature[]> {
     open: "/remote setup",
   });
 
-  /* Claude app remote control (preference only; never connect from the hub). */
-  const claudeRemote = env("PI_CLAUDE_REMOTE") === "1";
+  /* No persisted auto-start preference: connection is opted into per session. */
   features.push({
     name: "Claude Remote",
-    ready: claudeRemote,
-    detail: claudeRemote ? "auto-start enabled for interactive sessions" : "opt-in Claude app mirror; requires Anthropic OAuth",
+    ready: false,
+    detail: "session-only Claude app mirror; defaults Off; requires Anthropic OAuth",
     commands: ["/claude-remote", "/claude-remote on", "/claude-remote off"],
     setup: "/claude-remote",
     open: "/claude-remote",

package/src/domains/workflows/runtime/agent-session-providers.ts

@@ -6,6 +6,7 @@ type HostProviderRegistry = Pick<
   | "getApiKeyForProvider"
   | "getProviderAuthStatus"
   | "getRegisteredProviderConfig"
+  | "getRegisteredNativeProvider"
   | "getRegisteredProviderIds"
   | "isUsingOAuth"
 >;
@@ -27,10 +28,14 @@ export async function synchronizeWorkflowModelRuntime(input: {
   }
 
   for (const providerId of hostProviderIds) {
+    const native = host.getRegisteredNativeProvider(providerId);
     const config = host.getRegisteredProviderConfig(providerId);
-    if (!config) continue;
+    if (!native && !config) continue;
     child.unregisterProvider(providerId);
-    child.registerProvider(providerId, config);
+    // Native registrations carry live auth/policy/stream wrappers. Copying only
+    // legacy config silently drops those guards in workflow child sessions.
+    if (native) child.registerNativeProvider(native);
+    else child.registerProvider(providerId, config!);
   }
 
   const selectedProvider = selectedModel?.provider;