@worca/app 1.5.0 → 1.6.0-rc.1

package/src/core/bridge/provider-ops.mjs

@@ -15,9 +15,50 @@ import { modelEnvRef, maskModelEnvValue, COPILOT_TERMS_VERSION, UPSTREAM_PROVIDE
 import {
   startDeviceFlow, pollDeviceFlow, githubLogin, copilotToken, invalidateCopilotToken,
   listCopilotModels, copilotUsage, catalogEntryForCopilotModel, copilotApiFor,
+  copilotHeaders, normalizeCopilotModel,
 } from './providers/copilot.mjs';
 import { keyOptional } from './registry.mjs';
 import { listEndpointModels, catalogEntryForEndpointModel, importableModel } from './providers/endpoint.mjs';
+import { brokerEnabled, brokerInfo, cachedBrokerInfo, mintSpawnToken, revokeSpawnToken, slotBaseUrl } from '../broker-client.mjs';
+import { routeUpstream } from '../broker-routing.mjs';
+import { resolveBillTo } from '../billing.mjs';
+
+// ── credential broker (docs/credential-broker.md) ────────────────────────────
+
+/** With the broker on, provider keys and sign-ins live on its key page, never in worca. */
+function refuseWithBroker(what) {
+  if (!brokerEnabled()) return;
+  const keyPage = cachedBrokerInfo()?.publicUrl;
+  throw Object.assign(new Error(`worca can't ${what}: with the credential broker, each person does that on the key page${keyPage ? ` (${keyPage})` : ''}`), { code: 'BROKER' });
+}
+
+/**
+ * Run `fn(token)` with a short-lived broker token for `slot`, billed to the person behind
+ * the current request (billing.mjs), revoked afterwards. Model discovery and imports use it.
+ */
+async function withAuxBrokerToken(slot, fn) {
+  const info = await brokerInfo();
+  let billTo = resolveBillTo(null);
+  if (info.mode === 'multi' && (!billTo || billTo === 'local')) {
+    throw Object.assign(new Error('sign in through the identity proxy first: the provider is asked with your own key'), { code: 'BROKER' });
+  }
+  const minted = await mintSpawnToken({ billTo: billTo || 'local', slots: [slot], kind: 'aux' });
+  try { return await fn(minted.token); } finally { revokeSpawnToken(minted.spawnId); }
+}
+
+/** A broker refusal's own words (`worca-broker: …`), else a generic status line. */
+async function brokerFailure(res, what) {
+  try {
+    const j = await res.json();
+    const m = j?.error?.message;
+    if (typeof m === 'string' && m) return m;
+  } catch { /* not JSON */ }
+  return `${what} answered ${res.status}`;
+}
+import { isOpenRouter } from './openrouter.mjs';
+
+/** The OpenRouter API base a preset / `worca models set openrouter` points the openai provider at. */
+export const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 
 // ── Copilot sign-in sessions (in memory; a device code lives ~15 min) ────────
 const sessions = new Map();   // deviceCode -> { startedAt, expiresAt, interval, lastPoll }
@@ -32,6 +73,7 @@ function sweepSessions(now = Date.now()) {
  * @returns {Promise<{deviceCode, userCode, verificationUri, interval, expiresIn}>}
  */
 export async function beginCopilotLogin({ fetch: f } = {}) {
+  refuseWithBroker('sign in to GitHub Copilot');
   if (!copilotTermsAcknowledged()) {
     throw Object.assign(new Error('acknowledge the GitHub Copilot notice before signing in'), { code: 'TERMS' });
   }
@@ -119,7 +161,9 @@ export async function providersState({ quota = false, fetch: f } = {}) {
       maxConcurrent: p.maxConcurrent,
     };
   };
-  return { copilot, openai: keyed('openai'), anthropic: keyed('anthropic') };
+  // With the credential broker on, keys and the Copilot sign-in are per person on its key page.
+  const broker = brokerEnabled() ? { enabled: true, keyPage: cachedBrokerInfo()?.publicUrl || null, mode: cachedBrokerInfo()?.mode || null } : { enabled: false };
+  return { copilot, openai: keyed('openai'), anthropic: keyed('anthropic'), broker };
 }
 
 /** Patch a provider from the UI/CLI; masked key echoes are dropped ("keep"). */
@@ -127,6 +171,8 @@ export async function patchProvider(name, patch = {}) {
   if (!UPSTREAM_PROVIDERS.includes(name)) throw new Error(`unknown provider ${JSON.stringify(name)}`);
   const p = { ...patch };
   for (const k of ['apiKey', 'githubToken']) if (typeof p[k] === 'string' && p[k].startsWith('••')) delete p[k];
+  // Credential broker: keys are per person, on the key page; worca stores none.
+  if (brokerEnabled() && ['apiKey', 'githubToken'].some((k) => typeof p[k] === 'string' && p[k].trim())) refuseWithBroker('store a provider key');
   return updateProvider(name, p);
 }
 
@@ -134,10 +180,24 @@ export async function patchProvider(name, patch = {}) {
 
 /** Copilot's models for the import sheet, each with `inCatalog` (§8.4). */
 export async function copilotModelsForImport({ fetch: f } = {}) {
-  const c = providerConfig('copilot');
-  const token = resolveProviderSecret(c.githubToken);
-  if (!token) throw Object.assign(new Error('not signed in to GitHub Copilot'), { code: 'NOT_SIGNED_IN' });
-  const list = await listCopilotModels(token, { accountType: c.accountType, fetch: f });
+  let list;
+  if (brokerEnabled()) {
+    // The signed-in person's Copilot, through the broker (their GitHub sign-in lives there).
+    const route = routeUpstream({ provider: 'copilot' }, { slots: (await brokerInfo()).slots || [] });
+    if (route.error) throw new Error(route.error);
+    list = await withAuxBrokerToken(route.slot, async (token) => {
+      const r = await (f || globalThis.fetch)(`${slotBaseUrl(route.slot)}/models`, { headers: copilotHeaders(token) });
+      if (!r.ok) throw Object.assign(new Error(await brokerFailure(r, 'Copilot /models')), { status: r.status });
+      const j = await r.json();
+      const data = Array.isArray(j.data) ? j.data : (Array.isArray(j) ? j : []);
+      return data.map(normalizeCopilotModel).filter((m) => m && (!m.type || m.type === 'chat'));
+    });
+  } else {
+    const c = providerConfig('copilot');
+    const token = resolveProviderSecret(c.githubToken);
+    if (!token) throw Object.assign(new Error('not signed in to GitHub Copilot'), { code: 'NOT_SIGNED_IN' });
+    list = await listCopilotModels(token, { accountType: c.accountType, fetch: f });
+  }
   const have = new Set(listGlobalModels().map((m) => m.id.toLowerCase()));
   return list.map((m) => ({ ...m, api: copilotApiFor(m), catalogId: `copilot-${m.id}`, inCatalog: have.has(`copilot-${m.id}`.toLowerCase()) }))
     .sort((a, b) => (Number(b.pickerEnabled) - Number(a.pickerEnabled)) || a.name.localeCompare(b.name));
@@ -204,19 +264,47 @@ function endpointBase(baseUrl) {
 export async function endpointModelsForImport({ baseUrl, fetch: f } = {}) {
   const base = endpointBase(baseUrl);
   const p = providerConfig('openai');
-  const key = resolveProviderSecret(p.apiKey);
-  const out = await listEndpointModels(base, { apiKey: key, fetch: f });
+  let out;
+  const route = brokerEnabled() ? routeUpstream({ provider: 'openai', baseUrl: base }, { slots: (await brokerInfo()).slots || [] }) : null;
+  if (route && route.error) throw new Error(route.error);
+  if (route && route.slot) {
+    // An endpoint behind a broker slot is asked with the clicking person's key; the listing
+    // then names the REAL base URL, so the imported entries point at it.
+    out = await withAuxBrokerToken(route.slot, (token) => listEndpointModels(`${slotBaseUrl(route.slot)}${route.prefix}`, { apiKey: token, fetch: f, realBaseUrl: base }));
+    out = { ...out, baseUrl: base };
+  } else {
+    // Keyless local endpoints are reached directly, as without the broker.
+    const key = brokerEnabled() ? '' : resolveProviderSecret(p.apiKey);
+    out = await listEndpointModels(base, { apiKey: key, fetch: f });
+  }
   const have = new Set(listGlobalModels().map((m) => m.id.toLowerCase()));
   return {
     ...out,
     models: out.models.map((m) => {
       const entry = catalogEntryForEndpointModel(m, { server: out.server, baseUrl: out.baseUrl, providerBaseUrl: p.baseUrl });
       const usable = importableModel(m);
-      return { ...m, catalogId: entry.id, inCatalog: have.has(entry.id.toLowerCase()), importable: usable.ok, ...(usable.ok ? {} : { blocked: usable.why }) };
+      const existing = existingEndpointEntry(m.id, out.baseUrl, p.baseUrl);
+      const catalogId = existing ? existing.id : entry.id;
+      return { ...m, catalogId, inCatalog: !!existing || have.has(entry.id.toLowerCase()), importable: usable.ok, ...(usable.ok ? {} : { blocked: usable.why }) };
     }),
   };
 }
 
+const trimUrl = (u) => String(u || '').trim().replace(/\/+$/, '').toLowerCase();
+
+/**
+ * The catalog entry that already imports `upstreamId` from this endpoint, whatever its id says.
+ * Ids are derived (and their prefix changed: a remote endpoint's models were `local-…`), so a
+ * re-import matches on what the entry POINTS AT — the openai provider, this upstream id, and this
+ * base URL (its own, or the provider's when it carries none) — and refreshes the entry the user
+ * already has instead of adding a twin under the new id.
+ */
+function existingEndpointEntry(upstreamId, baseUrl, providerBaseUrl) {
+  const want = trimUrl(baseUrl);
+  return listGlobalModels().find((x) => x.upstream && x.upstream.provider === 'openai'
+    && x.upstream.model === upstreamId && trimUrl(x.upstream.baseUrl || providerBaseUrl) === want) || null;
+}
+
 /**
  * Import endpoint models into the catalog. A new id gets the full entry; an existing one keeps the
  * label, efforts and pricing you edited and only has its upstream refreshed.
@@ -235,7 +323,8 @@ export async function importEndpointModels(ids, { baseUrl, fetch: f } = {}) {
     if (!m) { skipped.push({ id, why: 'the endpoint does not serve it' }); continue; }
     if (!m.importable) { skipped.push({ id, why: m.blocked || 'not usable in a pipeline' }); continue; }
     const entry = catalogEntryForEndpointModel(m, { server: out.server, baseUrl: out.baseUrl, providerBaseUrl: p.baseUrl });
-    const current = listGlobalModels().find((x) => x.id.toLowerCase() === entry.id.toLowerCase());
+    const current = existingEndpointEntry(m.id, out.baseUrl, p.baseUrl)
+      || listGlobalModels().find((x) => x.id.toLowerCase() === entry.id.toLowerCase());
     if (current) {
       if (!current.upstream || current.upstream.provider !== 'openai') { skipped.push({ id, why: `"${current.id}" already exists and is not an OpenAI-compatible entry` }); continue; }
       await updateGlobalModel(current.id, { upstream: { ...current.upstream, model: entry.upstream.model, ...(entry.upstream.baseUrl ? { baseUrl: entry.upstream.baseUrl } : {}), ...(entry.upstream.capabilities ? { capabilities: entry.upstream.capabilities } : {}) } });
@@ -248,6 +337,60 @@ export async function importEndpointModels(ids, { baseUrl, fetch: f } = {}) {
   return { created, updated, skipped, server: out.server, serverLabel: out.serverLabel, baseUrl: out.baseUrl, warnings: out.warnings };
 }
 
+// ── OpenRouter: the key's own limits ────────────────────────────────────────
+
+const finiteOrNull = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null);
+
+/**
+ * What OpenRouter says about the key (GET {base}/key): credit limit and what is left, spend, the
+ * free-model daily allowance and the rate limit. The `label` is dropped — OpenRouter builds it from
+ * the key itself (`sk-or-v1-abc…xyz`). Never throws: null when there is no key or no answer.
+ * @returns {Promise<null|{limit:number|null, limitRemaining:number|null, usage:number|null, usageDaily:number|null,
+ *   isFreeTier:boolean, freeDaily:{used:number,limit:number,remaining:number}|null, rateLimit:object|null}>}
+ */
+export async function openRouterKeyInfo(baseUrl, apiKey, { fetch: f = globalThis.fetch, timeoutMs = 10_000 } = {}) {
+  if (!apiKey) return null;
+  try {
+    const r = await f(`${String(baseUrl || '').replace(/\/+$/, '')}/key`, { headers: { authorization: `Bearer ${apiKey}` }, signal: AbortSignal.timeout(timeoutMs) });
+    if (!r.ok) return null;
+    const j = await r.json();
+    const d = j && j.data;
+    if (!d || typeof d !== 'object') return null;
+    const fd = d.free_model_daily_requests;
+    const rl = d.rate_limit;
+    return {
+      limit: finiteOrNull(d.limit),
+      limitRemaining: finiteOrNull(d.limit_remaining),
+      usage: finiteOrNull(d.usage),
+      usageDaily: finiteOrNull(d.usage_daily),
+      isFreeTier: d.is_free_tier === true,
+      freeDaily: fd && typeof fd === 'object' && finiteOrNull(fd.limit) !== null
+        ? { used: finiteOrNull(fd.used) ?? 0, limit: fd.limit, remaining: finiteOrNull(fd.remaining) ?? Math.max(0, fd.limit - (finiteOrNull(fd.used) ?? 0)) }
+        : null,
+      // OpenRouter answers `requests: -1` for a key with no request-rate limit of its own.
+      rateLimit: rl && typeof rl === 'object' && finiteOrNull(rl.requests) > 0 ? { requests: rl.requests, interval: String(rl.interval || '') } : null,
+    };
+  } catch { return null; }
+}
+
+/** One line for the Providers card and `worca models test`. Pure. */
+export function formatOpenRouterKeyInfo(info) {
+  if (!info) return '';
+  const usd = (n) => `$${n.toFixed(2)}`;
+  const bits = [];
+  if (info.limit !== null && info.limit !== undefined) {
+    const left = info.limitRemaining ?? (info.usage !== null && info.usage !== undefined ? Math.max(0, info.limit - info.usage) : null);
+    bits.push(left !== null ? `credit ${usd(left)} of ${usd(info.limit)} left` : `credit limit ${usd(info.limit)}`);
+  } else {
+    bits.push('no credit limit');
+    if (info.usage !== null && info.usage !== undefined) bits.push(`${usd(info.usage)} used`);
+  }
+  if (info.freeDaily) bits.push(`free-model requests today ${info.freeDaily.remaining} / ${info.freeDaily.limit}`);
+  if (info.isFreeTier) bits.push('free tier');
+  if (info.rateLimit) bits.push(`rate limit ${info.rateLimit.requests} per ${info.rateLimit.interval}`);
+  return bits.join(' · ');
+}
+
 // ── key-based providers: connection test ────────────────────────────────────
 
 /**
@@ -261,6 +404,11 @@ export async function importEndpointModels(ids, { baseUrl, fetch: f } = {}) {
  * @returns {Promise<{ok:true, models?:number}|{ok:false, message:string}>}
  */
 export async function testProviderConnection(name, { fetch: f = globalThis.fetch, baseUrl = '', apiKey } = {}) {
+  // Credential broker: keys are per person and tested where they are saved.
+  if (brokerEnabled()) {
+    const keyPage = cachedBrokerInfo()?.publicUrl;
+    return { ok: false, message: `keys are held by the credential broker: test yours on the key page${keyPage ? ` (${keyPage})` : ''}` };
+  }
   if (name === 'copilot') {
     const c = providerConfig('copilot');
     const token = resolveProviderSecret(c.githubToken);
@@ -287,6 +435,14 @@ export async function testProviderConnection(name, { fetch: f = globalThis.fetch
     if (!r.ok) return { ok: false, message: `endpoint answered ${r.status}` };
     const j = await r.json().catch(() => null);
     const n = j && Array.isArray(j.data) ? j.data.length : undefined;
+    // OpenRouter lists its models without a key, so a reachable list proves nothing about the key:
+    // its /key does, and says what the key may still spend. A key it rejects fails the test.
+    if (name === 'openai' && isOpenRouter(base)) {
+      if (!key) return { ok: false, message: 'no API key configured — OpenRouter lists models without one, but every call needs it' };
+      const info = await openRouterKeyInfo(base, key, { fetch: f });
+      if (!info) return { ok: false, message: 'authentication failed — OpenRouter did not accept the key (its /key check failed)' };
+      return { ok: true, ...(n !== undefined ? { models: n } : {}), openrouter: info, detail: formatOpenRouterKeyInfo(info) };
+    }
     return { ok: true, ...(n !== undefined ? { models: n } : {}) };
   } catch (err) {
     return { ok: false, message: `endpoint unreachable — ${err && err.message ? err.message : String(err)}` };

package/src/core/bridge/providers/endpoint.mjs

@@ -18,6 +18,10 @@
 //   LM Studio   GET {root}/api/v0/models  type (llm | vlm | embeddings), state, max_context_length,
 //                                       loaded_context_length.
 //   vLLM / other  GET {base}/models     ids, plus max_model_len where the server sets it.
+//   OpenRouter  GET {base}/models       recognised by its host and never probed: context_length and
+//                                       top_provider (the window it serves, the output cap),
+//                                       supported_parameters (tools, reasoning), modalities and
+//                                       per-token pricing — everything the generic list lacks.
 //
 // The window a model is SERVED with and the one it was TRAINED for are different numbers, and only
 // the served one may become a prompt limit: Ollama serves 4096 by default however large the model
@@ -25,11 +29,33 @@
 // built WITHOUT a prompt limit and the caller's warning says so — a wrong window is worse than
 // none, because the CLI would compact against a number the endpoint never had.
 
+import { isLocalBaseUrl } from '../../model-env.mjs';
+import { isOpenRouter } from '../openrouter.mjs';
+
 const SERVERS = Object.freeze({
-  'llama.cpp': 'llama.cpp', ollama: 'Ollama', lmstudio: 'LM Studio', vllm: 'vLLM', 'openai-compatible': 'OpenAI-compatible',
+  'llama.cpp': 'llama.cpp', ollama: 'Ollama', lmstudio: 'LM Studio', vllm: 'vLLM', openrouter: 'OpenRouter', 'openai-compatible': 'OpenAI-compatible',
 });
 /** The catalog-id prefix per server, so two endpoints' models never collide. */
-const ID_PREFIX = Object.freeze({ 'llama.cpp': 'llama', ollama: 'ollama', lmstudio: 'lmstudio', vllm: 'vllm', 'openai-compatible': 'local' });
+const ID_PREFIX = Object.freeze({ 'llama.cpp': 'llama', ollama: 'ollama', lmstudio: 'lmstudio', vllm: 'vllm', openrouter: 'openrouter', 'openai-compatible': 'local' });
+
+// Re-exported for the import's callers; the one host rule lives in model-env (via ../openrouter.mjs).
+export { isOpenRouter };
+
+/**
+ * The catalog-id prefix for a server at a base URL. A generic list used to be `local-` wherever it
+ * lived, so a model on a hosted gateway read as a local one; a remote host now names its own
+ * prefix (`api.groq.com` → `groq`), and only a local / private URL keeps `local`.
+ */
+export function endpointIdPrefix(server, baseUrl) {
+  if (server !== 'openai-compatible') return ID_PREFIX[server] || 'local';
+  if (isLocalBaseUrl(baseUrl)) return 'local';
+  let host = '';
+  try { host = new URL(String(baseUrl || '').trim()).hostname.toLowerCase(); } catch { return 'local'; }
+  const labels = host.split('.').filter(Boolean);
+  if (labels.length < 2) return 'local';   // a single-label name (`http://gw/v1`) is on your network
+  while (labels.length > 2 && ['api', 'www', 'llm', 'inference'].includes(labels[0])) labels.shift();
+  return (labels[0] || '').replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 16) || 'remote';
+}
 /** Below this a pipeline thrashes the CLI's auto-compact (docs/models.md Troubleshooting). */
 export const MIN_PIPELINE_WINDOW = 65536;
 const DEFAULT_TIMEOUT_MS = 10_000;
@@ -142,6 +168,56 @@ function openAiModels(list) {
   })).filter((m) => m.id);
 }
 
+/** A USD-per-token price string → USD per million tokens; null for a missing or negative one. */
+function perMillion(v) {
+  const n = Number.parseFloat(v);
+  if (!Number.isFinite(n) || n < 0) return null;
+  return Math.round(n * 1e12) / 1e6;   // 0.000003 × 1e6 is 3.0000000000000004 in floating point
+}
+
+/**
+ * OpenRouter's listed price as a catalog `cost`: `{free:true}` for a zero price, `{perMtok}` for a
+ * real one, null when the listing has none or a variable one (the Auto router lists -1) — an
+ * unknown price is left unset ("cost not verified"), never claimed free.
+ */
+function openRouterPricing(p) {
+  if (!p || typeof p !== 'object') return null;
+  const input = perMillion(p.prompt); const output = perMillion(p.completion);
+  if (input === null || output === null) return null;
+  const cacheRead = perMillion(p.input_cache_read); const cacheWrite = perMillion(p.input_cache_write);
+  if (!input && !output && !cacheRead && !cacheWrite) return { free: true };
+  return { perMtok: { input, output, ...(cacheRead ? { cacheRead } : {}), ...(cacheWrite ? { cacheWrite } : {}) } };
+}
+
+const money = (n) => `$${Number(n.toFixed(2))}`;
+
+function openRouterModels(list) {
+  return (Array.isArray(list && list.data) ? list.data : []).map((m) => {
+    const arch = m.architecture || {};
+    const top = m.top_provider || {};
+    const params = Array.isArray(m.supported_parameters) ? m.supported_parameters : [];
+    const outputs = Array.isArray(arch.output_modalities) ? arch.output_modalities : ['text'];
+    const pricing = openRouterPricing(m.pricing);
+    const ctx = num(top.context_length) ?? num(m.context_length);
+    return {
+      id: String(m.id ?? ''),
+      name: String(m.name || m.id || ''),
+      kind: outputs.includes('text') ? 'llm' : 'other',
+      // OpenRouter serves the window it lists — unlike Ollama, there is no smaller default behind it.
+      servedContext: ctx,
+      trainedContext: null,
+      maxOutputTokens: num(top.max_completion_tokens),
+      toolCalls: params.includes('tools'),
+      vision: has(arch.input_modalities, 'image'),
+      reasoning: params.includes('reasoning') || params.includes('reasoning_effort'),
+      loaded: null,
+      pricing,
+      free: !!(pricing && pricing.free),
+      detail: !pricing ? 'variable price' : pricing.free ? 'free' : `${money(pricing.perMtok.input)} / ${money(pricing.perMtok.output)} per M`,
+    };
+  }).filter((m) => m.id);
+}
+
 /** What the caller must know before pinning a prompt limit on what this server reports. */
 function warningsFor(server, models, props) {
   const w = [];
@@ -157,6 +233,9 @@ function warningsFor(server, models, props) {
   if (server === 'lmstudio' && models.some((m) => m.kind !== 'embedding' && !m.servedContext)) {
     w.push('LM Studio reports a model\'s real window only while it is loaded; for the others the number shown is what the model supports, and the prompt limit is left unset.');
   }
+  if (server === 'openrouter' && models.some((m) => m.free)) {
+    w.push(':free models run on a pool OpenRouter shares with every user: while it is busy EVERY request gets a 429, however few you send — Max concurrent requests cannot help. For pipelines use the paid variant, add your own provider key on OpenRouter (BYOK), or give the model a fallback in its Connection.');
+  }
   if (server === 'openai-compatible' && models.every((m) => !m.servedContext)) {
     w.push('This endpoint does not report context windows — set each model\'s prompt limit by hand after importing.');
   }
@@ -172,7 +251,7 @@ function warningsFor(server, models, props) {
  * @returns {Promise<{server:string, serverLabel:string, baseUrl:string, models:Array<object>, warnings:string[]}>}
  * @throws {Error} when nothing answers at all (the caller shows it as the connection failure it is)
  */
-export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS, realBaseUrl = null } = {}) {
   const base = String(baseUrl || '').trim().replace(/\/+$/, '');
   if (!base) throw new Error('baseUrl is required');
   const root = endpointRoot(base);
@@ -182,6 +261,18 @@ export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = glob
   let models = [];
   let props = null;
 
+  // `realBaseUrl`: the provider URL when `baseUrl` is the credential broker's slot for it —
+  // what the server IS (OpenRouter or not) is decided by the real one.
+  if (isOpenRouter(realBaseUrl || base)) {
+    // A hosted API: probing it for llama.cpp / Ollama / LM Studio would cost three requests for
+    // three 404s. Its own /models is the whole answer.
+    const list = await json(f, `${base}/models`, opt);
+    if (!list) throw new Error(`no OpenAI-compatible model list at ${base}/models — is the base URL right?`);
+    models = openRouterModels(list);
+    models.sort((a, b) => (Number(b.kind === 'llm') - Number(a.kind === 'llm')) || a.id.localeCompare(b.id));
+    return { server: 'openrouter', serverLabel: SERVERS.openrouter, baseUrl: base, models, warnings: warningsFor('openrouter', models, null) };
+  }
+
   const props0 = await json(f, `${root}/props`, opt);
   if (props0 && (props0.default_generation_settings || props0.chat_template_caps)) {
     server = 'llama.cpp';
@@ -221,21 +312,34 @@ export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = glob
  * A discovered model as a catalog entry (§8.4's Copilot shape, for a server you run).
  * `baseUrl` rides the ENTRY when it differs from the provider's, so one catalog can hold an Ollama
  * and a llama.cpp model at once. A prompt limit is pinned only from a window the server really
- * serves; `maxOutputTokens` is never guessed — no local server reports one.
+ * serves; `maxOutputTokens` is never guessed — no local server reports one. OpenRouter does, and
+ * its cap is pinned only while it leaves at least half the window for the prompt: a cap that is
+ * most of the window (235929 of 262144) becomes the CLI's max_tokens, and prompt + max_tokens
+ * then overflows the window on the first large turn.
  * @param {object} m           a row from listEndpointModels
  * @param {{server:string, baseUrl:string, providerBaseUrl?:string}} ctx
  */
 export function catalogEntryForEndpointModel(m, { server = 'openai-compatible', baseUrl, providerBaseUrl = '' } = {}) {
+  const window = num(m.servedContext);
+  const outCap = num(m.maxOutputTokens);
   const capabilities = {
     ...(m.toolCalls === true || m.toolCalls === false ? { toolCalls: m.toolCalls } : {}),
     ...(m.vision === true ? { vision: true } : {}),
     ...(m.reasoning === true ? { reasoning: true } : {}),
-    ...(num(m.servedContext) ? { maxPromptTokens: num(m.servedContext) } : {}),
+    ...(window ? { maxPromptTokens: window } : {}),
+    ...(outCap && window && outCap <= window / 2 ? { maxOutputTokens: outCap } : {}),
   };
   const own = String(baseUrl || '').replace(/\/+$/, '');
   const provider = String(providerBaseUrl || '').replace(/\/+$/, '');
+  const hosted = server === 'openrouter';
+  // A hosted catalog keeps the vendor in the id (`qwen/…`, `anthropic/…`): the last path segment
+  // alone collides across vendors there. A local server's ids stay as they were.
+  const stem = hosted ? String(m.id).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 64) || 'model' : slugModelId(m.id);
+  // A model on your own machine bills nothing; OpenRouter lists its price, and one it lists as
+  // variable is left unset rather than claimed free.
+  const cost = hosted ? (m.pricing || undefined) : { free: true };
   return {
-    id: `${ID_PREFIX[server] || 'local'}-${slugModelId(m.id)}`,
+    id: `${endpointIdPrefix(server, own)}-${stem}`,
     label: `${m.name || m.id} (${SERVERS[server] || 'local'})`,
     ...(m.reasoning === true ? {} : { efforts: ['medium'] }),
     upstream: {
@@ -243,13 +347,14 @@ export function catalogEntryForEndpointModel(m, { server = 'openai-compatible',
       ...(own && own !== provider ? { baseUrl: own } : {}),
       ...(Object.keys(capabilities).length ? { capabilities } : {}),
     },
-    cost: { free: true },       // a model on your own machine bills nothing; never "cost not verified"
+    ...(cost ? { cost } : {}),
   };
 }
 
 /** Whether a discovered model can carry a pipeline at all (the sheet greys the rest). */
 export function importableModel(m) {
   if (!m || m.kind === 'embedding') return { ok: false, why: 'an embedding model — not a chat model' };
+  if (m.kind === 'other') return { ok: false, why: 'does not reply in text — not a chat model' };
   if (m.toolCalls === false) return { ok: false, why: 'no tool calls — a pipeline agent cannot run without them' };
   return { ok: true };
 }

package/src/core/bridge/registry.mjs

@@ -9,6 +9,8 @@ import { listGlobalModels, providerConfig, providerSecretSet, resolveProviderSec
 import { listPluginModels } from '../plugin-models.mjs';
 import { policyCatalogModels } from '../policy/cache.mjs';
 import { isLocalBaseUrl } from '../model-env.mjs';
+import { brokerEnabled } from '../broker-client.mjs';
+import { routeBridgedUpstream } from '../broker-routing.mjs';
 
 /** An OpenAI-compatible endpoint on this machine / a private network needs no key. */
 export function keyOptional(provider, baseUrl) {
@@ -42,6 +44,16 @@ export function findBridgedEntry(id) {
 export function providerReadiness(upstream) {
   if (!upstream) return { ok: true };
   const p = upstream.provider;
+  // Credential broker: worca holds no provider key or GitHub sign-in. Ready when the model
+  // maps to a broker slot (or is a keyless local endpoint); whether the PERSON has a key
+  // is the broker's question, answered per spawn. Copilot's terms stay an install setting.
+  if (brokerEnabled()) {
+    if (p === 'copilot' && !copilotTermsAcknowledged()) {
+      return { ok: false, reason: 'terms', message: 'provider copilot: terms not acknowledged — open Settings › Providers' };
+    }
+    const r = routeBridgedUpstream(upstream);
+    return r.error ? { ok: false, reason: 'no_key', message: `provider ${p}: ${r.error}` } : { ok: true };
+  }
   if (p === 'copilot') {
     if (!copilotTermsAcknowledged()) {
       return { ok: false, reason: 'terms', message: 'provider copilot: terms not acknowledged — open Settings › Providers' };
@@ -83,6 +95,7 @@ export function upstreamSettings(upstream) {
     accountType: p === 'copilot' ? cfg.accountType : null,
     headers: upstream.headers || {},
     capabilities: upstream.capabilities || {},
+    ...(upstream.openrouter ? { openrouter: upstream.openrouter } : {}),
     maxConcurrent: cfg.maxConcurrent,
   };
 }

package/src/core/bridge/server.mjs

@@ -18,6 +18,7 @@ import { findBridgedEntry } from './registry.mjs';
 import { handleMessages } from './upstream.mjs';
 import { estimateInputTokens } from './translate/response.mjs';
 import { bridgeErrors, PAYLOAD_CEILING_BYTES } from './errors.mjs';
+import { brokerEnabled } from '../broker-client.mjs';
 
 let state = null;   // { server, port, secret, listening: Promise<number>, log }
 const ROUTE_RE = /^\/m\/([^/]+)(?:\/r\/([^/]+))?\/v1\/(messages|messages\/count_tokens|models)\/?$/;
@@ -132,18 +133,30 @@ function sendJson(res, status, obj, headers) {
   res.end(JSON.stringify(obj));
 }
 
+const BROKER_TOKEN_RE = /^wbt_[A-Za-z0-9_-]{43}$/;
+
+/**
+ * The caller's credential: the bridge's own secret, or — with the credential broker on —
+ * the spawn's broker token, which the bridge forwards to the broker (it is the broker
+ * that checks it; the bridge never holds a provider key then). null = refused.
+ * @returns {{brokerToken:string|null}|null}
+ */
 function authorized(req) {
   const h = req.headers;
   const bearer = typeof h.authorization === 'string' && /^bearer\s+/i.test(h.authorization) ? h.authorization.replace(/^bearer\s+/i, '').trim() : '';
   const key = typeof h['x-api-key'] === 'string' ? h['x-api-key'].trim() : '';
-  return (bearer && bearer === state.secret) || (key && key === state.secret);
+  if ((bearer && bearer === state.secret) || (key && key === state.secret)) return { brokerToken: null };
+  const tok = bearer || key;
+  if (brokerEnabled() && BROKER_TOKEN_RE.test(tok)) return { brokerToken: tok };
+  return null;
 }
 
 async function handle(req, res) {
   const url = new URL(req.url || '/', 'http://127.0.0.1');
   const m = ROUTE_RE.exec(url.pathname);
   if (!m) { const e = bridgeErrors.notFound(); return sendJson(res, e.status, e.body); }
-  if (!authorized(req)) { const e = bridgeErrors.unauthorized(); return sendJson(res, e.status, e.body); }
+  const auth = authorized(req);
+  if (!auth) { const e = bridgeErrors.unauthorized(); return sendJson(res, e.status, e.body); }
   const catalogId = decodeURIComponent(m[1]);
   const tag = m[2] ? decodeURIComponent(m[2]) : '';
   const route = m[3];
@@ -180,5 +193,5 @@ async function handle(req, res) {
   };
   const headers = {};
   for (const [k, v] of Object.entries(req.headers)) if (typeof v === 'string') headers[k.toLowerCase()] = v;
-  await handleMessages({ entry, body, requestHeaders: headers, tag, signal: ctrl.signal, fetch: state.fetch, log: state.log }, reply);
+  await handleMessages({ entry, body, requestHeaders: headers, tag, signal: ctrl.signal, fetch: state.fetch, log: state.log, brokerToken: auth.brokerToken }, reply);
 }

package/src/core/bridge/telemetry.mjs

@@ -13,7 +13,7 @@ import { EventEmitter } from 'node:events';
 export const bridgeEvents = new EventEmitter();
 bridgeEvents.setMaxListeners(50);
 
-const calls = new Map();   // tag -> { initiated, continued, errors }
+const calls = new Map();   // tag -> { initiated, continued, errors, free }
 const MAX_TAGS = 5000;
 
 function slot(tag) {
@@ -21,33 +21,65 @@ function slot(tag) {
   let s = calls.get(k);
   if (!s) {
     if (calls.size >= MAX_TAGS) calls.delete(calls.keys().next().value);
-    s = { initiated: 0, continued: 0, errors: 0 };
+    s = { initiated: 0, continued: 0, errors: 0, free: 0 };
     calls.set(k, s);
   }
   return s;
 }
 
-/** Book one upstream call. `initiator` is 'user' | 'agent' (§7.1). */
-export function recordBridgeCall({ tag, catalogId, provider, api, initiator }) {
+/**
+ * Book one upstream call. `initiator` is 'user' | 'agent' (§7.1). `free`: an OpenRouter
+ * `:free` model, where EVERY call (continuations too) spends one of the day's free requests
+ * (openrouter-free.mjs); `account` names the key it spent from, when the bridge knows it.
+ */
+export function recordBridgeCall({ tag, catalogId, provider, api, initiator, free = false, account = null }) {
   const s = slot(tag);
   if (initiator === 'agent') s.continued += 1; else s.initiated += 1;
-  bridgeEvents.emit('call', { tag: tag || '', catalogId, provider, api, initiator });
+  if (free) s.free += 1;
+  bridgeEvents.emit('call', { tag: tag || '', catalogId, provider, api, initiator, free, account });
 }
 
 /** Book one failed upstream call. */
-export function recordBridgeError({ tag, catalogId, provider, status, message }) {
+export function recordBridgeError({ tag, catalogId, provider, status, message, account = null }) {
   slot(tag).errors += 1;
-  bridgeEvents.emit('failure', { tag: tag || '', catalogId, provider, status, message });
+  bridgeEvents.emit('failure', { tag: tag || '', catalogId, provider, status, message, account });
 }
 
-/** Counters for a tag: {initiated, continued, errors}; zeros when unseen. */
+/** Counters for a tag: {initiated, continued, errors, free}; zeros when unseen. */
 export function bridgeCallsFor(tag) {
   const s = calls.get(tag || '');
-  return s ? { ...s } : { initiated: 0, continued: 0, errors: 0 };
+  return s ? { ...s } : { initiated: 0, continued: 0, errors: 0, free: 0 };
 }
 
-/** Forget a tag's counters (a finished run). */
-export function forgetBridgeTag(tag) { calls.delete(tag || ''); }
+// The USD an upstream itself reported for a tag's calls (OpenRouter's
+// usage.cost). Kept apart from the call counters: a priced call is the
+// exception, and the run harness prefers this figure over the CLI's $0.
+const costs = new Map();   // tag -> { costUsd, calls }
+
+/** Book the cost one upstream call reported. Ignores anything but a finite, non-negative number. */
+export function recordBridgeCost({ tag, costUsd }) {
+  const n = Number(costUsd);
+  if (costUsd == null || !Number.isFinite(n) || n < 0) return;
+  const k = tag || '';
+  let c = costs.get(k);
+  if (!c) {
+    if (costs.size >= MAX_TAGS) costs.delete(costs.keys().next().value);
+    c = { costUsd: 0, calls: 0 };
+    costs.set(k, c);
+  }
+  // Rounded to 1e-9 USD: summing float fractions of a cent would otherwise drift.
+  c.costUsd = Math.round((c.costUsd + n) * 1e9) / 1e9;
+  c.calls += 1;
+}
+
+/** The upstream-reported cost for a tag: {costUsd, calls}, or null when no call reported one. */
+export function bridgeCostFor(tag) {
+  const c = costs.get(tag || '');
+  return c ? { ...c } : null;
+}
+
+/** Forget a tag's counters and cost (a finished run). */
+export function forgetBridgeTag(tag) { calls.delete(tag || ''); costs.delete(tag || ''); }
 
 /** Test hook. */
-export function _resetBridgeTelemetry() { calls.clear(); }
+export function _resetBridgeTelemetry() { calls.clear(); costs.clear(); }