@worca/app 1.5.0 → 1.6.0-rc.2

package/src/core/bridge/provider-ops.mjs

@@ -15,9 +15,50 @@ import { modelEnvRef, maskModelEnvValue, COPILOT_TERMS_VERSION, UPSTREAM_PROVIDE
 import {
   startDeviceFlow, pollDeviceFlow, githubLogin, copilotToken, invalidateCopilotToken,
   listCopilotModels, copilotUsage, catalogEntryForCopilotModel, copilotApiFor,
+  copilotHeaders, normalizeCopilotModel,
 } from './providers/copilot.mjs';
 import { keyOptional } from './registry.mjs';
 import { listEndpointModels, catalogEntryForEndpointModel, importableModel } from './providers/endpoint.mjs';
+import { brokerEnabled, brokerInfo, cachedBrokerInfo, mintSpawnToken, revokeSpawnToken, slotBaseUrl, personSlots } from '../broker-client.mjs';
+import { routeUpstream } from '../broker-routing.mjs';
+import { resolveBillTo } from '../billing.mjs';
+
+// ── credential broker (docs/credential-broker.md) ────────────────────────────
+
+/** With the broker on, provider keys and sign-ins live on its key page, never in worca. */
+function refuseWithBroker(what) {
+  if (!brokerEnabled()) return;
+  const keyPage = cachedBrokerInfo()?.publicUrl;
+  throw Object.assign(new Error(`worca can't ${what}: with the credential broker, each person does that on the key page${keyPage ? ` (${keyPage})` : ''}`), { code: 'BROKER' });
+}
+
+/**
+ * Run `fn(token)` with a short-lived broker token for `slot`, billed to the person behind
+ * the current request (billing.mjs), revoked afterwards. Model discovery and imports use it.
+ */
+async function withAuxBrokerToken(slot, fn) {
+  const info = await brokerInfo();
+  let billTo = resolveBillTo(null);
+  if (info.mode === 'multi' && (!billTo || billTo === 'local')) {
+    throw Object.assign(new Error('sign in through the identity proxy first: the provider is asked with your own key'), { code: 'BROKER' });
+  }
+  const minted = await mintSpawnToken({ billTo: billTo || 'local', slots: [slot], kind: 'aux' });
+  try { return await fn(minted.token); } finally { revokeSpawnToken(minted.spawnId); }
+}
+
+/** A broker refusal's own words (`worca-broker: …`), else a generic status line. */
+async function brokerFailure(res, what) {
+  try {
+    const j = await res.json();
+    const m = j?.error?.message;
+    if (typeof m === 'string' && m) return m;
+  } catch { /* not JSON */ }
+  return `${what} answered ${res.status}`;
+}
+import { isOpenRouter } from './openrouter.mjs';
+
+/** The OpenRouter API base a preset / `worca models set openrouter` points the openai provider at. */
+export const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 
 // ── Copilot sign-in sessions (in memory; a device code lives ~15 min) ────────
 const sessions = new Map();   // deviceCode -> { startedAt, expiresAt, interval, lastPoll }
@@ -32,6 +73,7 @@ function sweepSessions(now = Date.now()) {
  * @returns {Promise<{deviceCode, userCode, verificationUri, interval, expiresIn}>}
  */
 export async function beginCopilotLogin({ fetch: f } = {}) {
+  refuseWithBroker('sign in to GitHub Copilot');
   if (!copilotTermsAcknowledged()) {
     throw Object.assign(new Error('acknowledge the GitHub Copilot notice before signing in'), { code: 'TERMS' });
   }
@@ -87,7 +129,7 @@ const secretSource = (v) => (!v ? null : modelEnvRef(v) ? 'env' : 'stored');
  * a network call to GitHub — and is null when the account exposes none.
  * @param {{quota?:boolean, fetch?:typeof fetch}} [opts]
  */
-export async function providersState({ quota = false, fetch: f } = {}) {
+export async function providersState({ quota = false, fetch: f, person = resolveBillTo(null) } = {}) {
   const all = allProviders();
   const c = all.copilot;
   const token = resolveProviderSecret(c.githubToken);
@@ -119,7 +161,45 @@ export async function providersState({ quota = false, fetch: f } = {}) {
       maxConcurrent: p.maxConcurrent,
     };
   };
-  return { copilot, openai: keyed('openai'), anthropic: keyed('anthropic') };
+  // With the credential broker on, keys and the Copilot sign-in are per person on its key page:
+  // each provider's state is the viewer's own slot there, not worca's (empty) settings.
+  const broker = brokerEnabled() ? await brokerProviders(all, person) : { enabled: false };
+  return { copilot, openai: keyed('openai'), anthropic: keyed('anthropic'), broker };
+}
+
+/**
+ * The Providers card's view of the broker: which slot each provider spends from and the viewer's
+ * state in it — {slot, state:'set'|'missing'|'invalid'|'operator'|'keyless'|'none', suffix?, error?}.
+ * Never throws: an unreachable broker leaves the states out and says why.
+ */
+async function brokerProviders(all, person) {
+  const info = cachedBrokerInfo() || await brokerInfo().catch(() => null);
+  const out = { enabled: true, keyPage: info?.publicUrl || null, mode: info?.mode || null, providers: {} };
+  const slots = info?.slots || [];
+  const route = (name) => {
+    if (name === 'copilot') {
+      const s = slots.find((x) => x.auth === 'copilot');
+      return s ? { slot: s.id } : { state: 'none', error: 'the credential broker has no GitHub Copilot slot' };
+    }
+    const r = routeUpstream({ provider: name, baseUrl: all[name].baseUrl || null }, { slots });
+    return r.slot ? { slot: r.slot } : r.keyless ? { state: 'keyless' } : { state: 'none', error: r.error };
+  };
+  for (const name of ['copilot', 'openai', 'anthropic']) out.providers[name] = route(name);
+  const who = out.mode === 'multi' ? person : 'local';
+  if (!who || (out.mode === 'multi' && who === 'local')) { out.signInNeeded = true; return out; }
+  try {
+    const mine = new Map(((await personSlots(who)).slots || []).map((x) => [x.id, x]));
+    for (const p of Object.values(out.providers)) {
+      if (!p.slot) continue;
+      const s = mine.get(p.slot);
+      p.state = s ? s.state : 'missing';
+      if (s && s.suffix) p.suffix = s.suffix;
+      if (s && s.label) p.label = s.label;
+    }
+  } catch (err) {
+    out.error = err.message;
+  }
+  return out;
 }
 
 /** Patch a provider from the UI/CLI; masked key echoes are dropped ("keep"). */
@@ -127,6 +207,8 @@ export async function patchProvider(name, patch = {}) {
   if (!UPSTREAM_PROVIDERS.includes(name)) throw new Error(`unknown provider ${JSON.stringify(name)}`);
   const p = { ...patch };
   for (const k of ['apiKey', 'githubToken']) if (typeof p[k] === 'string' && p[k].startsWith('••')) delete p[k];
+  // Credential broker: keys are per person, on the key page; worca stores none.
+  if (brokerEnabled() && ['apiKey', 'githubToken'].some((k) => typeof p[k] === 'string' && p[k].trim())) refuseWithBroker('store a provider key');
   return updateProvider(name, p);
 }
 
@@ -134,10 +216,24 @@ export async function patchProvider(name, patch = {}) {
 
 /** Copilot's models for the import sheet, each with `inCatalog` (§8.4). */
 export async function copilotModelsForImport({ fetch: f } = {}) {
-  const c = providerConfig('copilot');
-  const token = resolveProviderSecret(c.githubToken);
-  if (!token) throw Object.assign(new Error('not signed in to GitHub Copilot'), { code: 'NOT_SIGNED_IN' });
-  const list = await listCopilotModels(token, { accountType: c.accountType, fetch: f });
+  let list;
+  if (brokerEnabled()) {
+    // The signed-in person's Copilot, through the broker (their GitHub sign-in lives there).
+    const route = routeUpstream({ provider: 'copilot' }, { slots: (await brokerInfo()).slots || [] });
+    if (route.error) throw new Error(route.error);
+    list = await withAuxBrokerToken(route.slot, async (token) => {
+      const r = await (f || globalThis.fetch)(`${slotBaseUrl(route.slot)}/models`, { headers: copilotHeaders(token) });
+      if (!r.ok) throw Object.assign(new Error(await brokerFailure(r, 'Copilot /models')), { status: r.status });
+      const j = await r.json();
+      const data = Array.isArray(j.data) ? j.data : (Array.isArray(j) ? j : []);
+      return data.map(normalizeCopilotModel).filter((m) => m && (!m.type || m.type === 'chat'));
+    });
+  } else {
+    const c = providerConfig('copilot');
+    const token = resolveProviderSecret(c.githubToken);
+    if (!token) throw Object.assign(new Error('not signed in to GitHub Copilot'), { code: 'NOT_SIGNED_IN' });
+    list = await listCopilotModels(token, { accountType: c.accountType, fetch: f });
+  }
   const have = new Set(listGlobalModels().map((m) => m.id.toLowerCase()));
   return list.map((m) => ({ ...m, api: copilotApiFor(m), catalogId: `copilot-${m.id}`, inCatalog: have.has(`copilot-${m.id}`.toLowerCase()) }))
     .sort((a, b) => (Number(b.pickerEnabled) - Number(a.pickerEnabled)) || a.name.localeCompare(b.name));
@@ -204,19 +300,47 @@ function endpointBase(baseUrl) {
 export async function endpointModelsForImport({ baseUrl, fetch: f } = {}) {
   const base = endpointBase(baseUrl);
   const p = providerConfig('openai');
-  const key = resolveProviderSecret(p.apiKey);
-  const out = await listEndpointModels(base, { apiKey: key, fetch: f });
+  let out;
+  const route = brokerEnabled() ? routeUpstream({ provider: 'openai', baseUrl: base }, { slots: (await brokerInfo()).slots || [] }) : null;
+  if (route && route.error) throw new Error(route.error);
+  if (route && route.slot) {
+    // An endpoint behind a broker slot is asked with the clicking person's key; the listing
+    // then names the REAL base URL, so the imported entries point at it.
+    out = await withAuxBrokerToken(route.slot, (token) => listEndpointModels(`${slotBaseUrl(route.slot)}${route.prefix}`, { apiKey: token, fetch: f, realBaseUrl: base }));
+    out = { ...out, baseUrl: base };
+  } else {
+    // Keyless local endpoints are reached directly, as without the broker.
+    const key = brokerEnabled() ? '' : resolveProviderSecret(p.apiKey);
+    out = await listEndpointModels(base, { apiKey: key, fetch: f });
+  }
   const have = new Set(listGlobalModels().map((m) => m.id.toLowerCase()));
   return {
     ...out,
     models: out.models.map((m) => {
       const entry = catalogEntryForEndpointModel(m, { server: out.server, baseUrl: out.baseUrl, providerBaseUrl: p.baseUrl });
       const usable = importableModel(m);
-      return { ...m, catalogId: entry.id, inCatalog: have.has(entry.id.toLowerCase()), importable: usable.ok, ...(usable.ok ? {} : { blocked: usable.why }) };
+      const existing = existingEndpointEntry(m.id, out.baseUrl, p.baseUrl);
+      const catalogId = existing ? existing.id : entry.id;
+      return { ...m, catalogId, inCatalog: !!existing || have.has(entry.id.toLowerCase()), importable: usable.ok, ...(usable.ok ? {} : { blocked: usable.why }) };
     }),
   };
 }
 
+const trimUrl = (u) => String(u || '').trim().replace(/\/+$/, '').toLowerCase();
+
+/**
+ * The catalog entry that already imports `upstreamId` from this endpoint, whatever its id says.
+ * Ids are derived (and their prefix changed: a remote endpoint's models were `local-…`), so a
+ * re-import matches on what the entry POINTS AT — the openai provider, this upstream id, and this
+ * base URL (its own, or the provider's when it carries none) — and refreshes the entry the user
+ * already has instead of adding a twin under the new id.
+ */
+function existingEndpointEntry(upstreamId, baseUrl, providerBaseUrl) {
+  const want = trimUrl(baseUrl);
+  return listGlobalModels().find((x) => x.upstream && x.upstream.provider === 'openai'
+    && x.upstream.model === upstreamId && trimUrl(x.upstream.baseUrl || providerBaseUrl) === want) || null;
+}
+
 /**
  * Import endpoint models into the catalog. A new id gets the full entry; an existing one keeps the
  * label, efforts and pricing you edited and only has its upstream refreshed.
@@ -235,7 +359,8 @@ export async function importEndpointModels(ids, { baseUrl, fetch: f } = {}) {
     if (!m) { skipped.push({ id, why: 'the endpoint does not serve it' }); continue; }
     if (!m.importable) { skipped.push({ id, why: m.blocked || 'not usable in a pipeline' }); continue; }
     const entry = catalogEntryForEndpointModel(m, { server: out.server, baseUrl: out.baseUrl, providerBaseUrl: p.baseUrl });
-    const current = listGlobalModels().find((x) => x.id.toLowerCase() === entry.id.toLowerCase());
+    const current = existingEndpointEntry(m.id, out.baseUrl, p.baseUrl)
+      || listGlobalModels().find((x) => x.id.toLowerCase() === entry.id.toLowerCase());
     if (current) {
       if (!current.upstream || current.upstream.provider !== 'openai') { skipped.push({ id, why: `"${current.id}" already exists and is not an OpenAI-compatible entry` }); continue; }
       await updateGlobalModel(current.id, { upstream: { ...current.upstream, model: entry.upstream.model, ...(entry.upstream.baseUrl ? { baseUrl: entry.upstream.baseUrl } : {}), ...(entry.upstream.capabilities ? { capabilities: entry.upstream.capabilities } : {}) } });
@@ -248,6 +373,60 @@ export async function importEndpointModels(ids, { baseUrl, fetch: f } = {}) {
   return { created, updated, skipped, server: out.server, serverLabel: out.serverLabel, baseUrl: out.baseUrl, warnings: out.warnings };
 }
 
+// ── OpenRouter: the key's own limits ────────────────────────────────────────
+
+const finiteOrNull = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null);
+
+/**
+ * What OpenRouter says about the key (GET {base}/key): credit limit and what is left, spend, the
+ * free-model daily allowance and the rate limit. The `label` is dropped — OpenRouter builds it from
+ * the key itself (`sk-or-v1-abc…xyz`). Never throws: null when there is no key or no answer.
+ * @returns {Promise<null|{limit:number|null, limitRemaining:number|null, usage:number|null, usageDaily:number|null,
+ *   isFreeTier:boolean, freeDaily:{used:number,limit:number,remaining:number}|null, rateLimit:object|null}>}
+ */
+export async function openRouterKeyInfo(baseUrl, apiKey, { fetch: f = globalThis.fetch, timeoutMs = 10_000 } = {}) {
+  if (!apiKey) return null;
+  try {
+    const r = await f(`${String(baseUrl || '').replace(/\/+$/, '')}/key`, { headers: { authorization: `Bearer ${apiKey}` }, signal: AbortSignal.timeout(timeoutMs) });
+    if (!r.ok) return null;
+    const j = await r.json();
+    const d = j && j.data;
+    if (!d || typeof d !== 'object') return null;
+    const fd = d.free_model_daily_requests;
+    const rl = d.rate_limit;
+    return {
+      limit: finiteOrNull(d.limit),
+      limitRemaining: finiteOrNull(d.limit_remaining),
+      usage: finiteOrNull(d.usage),
+      usageDaily: finiteOrNull(d.usage_daily),
+      isFreeTier: d.is_free_tier === true,
+      freeDaily: fd && typeof fd === 'object' && finiteOrNull(fd.limit) !== null
+        ? { used: finiteOrNull(fd.used) ?? 0, limit: fd.limit, remaining: finiteOrNull(fd.remaining) ?? Math.max(0, fd.limit - (finiteOrNull(fd.used) ?? 0)) }
+        : null,
+      // OpenRouter answers `requests: -1` for a key with no request-rate limit of its own.
+      rateLimit: rl && typeof rl === 'object' && finiteOrNull(rl.requests) > 0 ? { requests: rl.requests, interval: String(rl.interval || '') } : null,
+    };
+  } catch { return null; }
+}
+
+/** One line for the Providers card and `worca models test`. Pure. */
+export function formatOpenRouterKeyInfo(info) {
+  if (!info) return '';
+  const usd = (n) => `$${n.toFixed(2)}`;
+  const bits = [];
+  if (info.limit !== null && info.limit !== undefined) {
+    const left = info.limitRemaining ?? (info.usage !== null && info.usage !== undefined ? Math.max(0, info.limit - info.usage) : null);
+    bits.push(left !== null ? `credit ${usd(left)} of ${usd(info.limit)} left` : `credit limit ${usd(info.limit)}`);
+  } else {
+    bits.push('no credit limit');
+    if (info.usage !== null && info.usage !== undefined) bits.push(`${usd(info.usage)} used`);
+  }
+  if (info.freeDaily) bits.push(`free-model requests today ${info.freeDaily.remaining} / ${info.freeDaily.limit}`);
+  if (info.isFreeTier) bits.push('free tier');
+  if (info.rateLimit) bits.push(`rate limit ${info.rateLimit.requests} per ${info.rateLimit.interval}`);
+  return bits.join(' · ');
+}
+
 // ── key-based providers: connection test ────────────────────────────────────
 
 /**
@@ -261,6 +440,11 @@ export async function importEndpointModels(ids, { baseUrl, fetch: f } = {}) {
  * @returns {Promise<{ok:true, models?:number}|{ok:false, message:string}>}
  */
 export async function testProviderConnection(name, { fetch: f = globalThis.fetch, baseUrl = '', apiKey } = {}) {
+  // Credential broker: keys are per person and tested where they are saved.
+  if (brokerEnabled()) {
+    const keyPage = cachedBrokerInfo()?.publicUrl;
+    return { ok: false, message: `keys are held by the credential broker: test yours on the key page${keyPage ? ` (${keyPage})` : ''}` };
+  }
   if (name === 'copilot') {
     const c = providerConfig('copilot');
     const token = resolveProviderSecret(c.githubToken);
@@ -287,6 +471,14 @@ export async function testProviderConnection(name, { fetch: f = globalThis.fetch
     if (!r.ok) return { ok: false, message: `endpoint answered ${r.status}` };
     const j = await r.json().catch(() => null);
     const n = j && Array.isArray(j.data) ? j.data.length : undefined;
+    // OpenRouter lists its models without a key, so a reachable list proves nothing about the key:
+    // its /key does, and says what the key may still spend. A key it rejects fails the test.
+    if (name === 'openai' && isOpenRouter(base)) {
+      if (!key) return { ok: false, message: 'no API key configured — OpenRouter lists models without one, but every call needs it' };
+      const info = await openRouterKeyInfo(base, key, { fetch: f });
+      if (!info) return { ok: false, message: 'authentication failed — OpenRouter did not accept the key (its /key check failed)' };
+      return { ok: true, ...(n !== undefined ? { models: n } : {}), openrouter: info, detail: formatOpenRouterKeyInfo(info) };
+    }
     return { ok: true, ...(n !== undefined ? { models: n } : {}) };
   } catch (err) {
     return { ok: false, message: `endpoint unreachable — ${err && err.message ? err.message : String(err)}` };

package/src/core/bridge/providers/endpoint.mjs

@@ -18,6 +18,10 @@
 //   LM Studio   GET {root}/api/v0/models  type (llm | vlm | embeddings), state, max_context_length,
 //                                       loaded_context_length.
 //   vLLM / other  GET {base}/models     ids, plus max_model_len where the server sets it.
+//   OpenRouter  GET {base}/models       recognised by its host and never probed: context_length and
+//                                       top_provider (the window it serves, the output cap),
+//                                       supported_parameters (tools, reasoning), modalities and
+//                                       per-token pricing — everything the generic list lacks.
 //
 // The window a model is SERVED with and the one it was TRAINED for are different numbers, and only
 // the served one may become a prompt limit: Ollama serves 4096 by default however large the model
@@ -25,11 +29,33 @@
 // built WITHOUT a prompt limit and the caller's warning says so — a wrong window is worse than
 // none, because the CLI would compact against a number the endpoint never had.
 
+import { isLocalBaseUrl } from '../../model-env.mjs';
+import { isOpenRouter } from '../openrouter.mjs';
+
 const SERVERS = Object.freeze({
-  'llama.cpp': 'llama.cpp', ollama: 'Ollama', lmstudio: 'LM Studio', vllm: 'vLLM', 'openai-compatible': 'OpenAI-compatible',
+  'llama.cpp': 'llama.cpp', ollama: 'Ollama', lmstudio: 'LM Studio', vllm: 'vLLM', openrouter: 'OpenRouter', 'openai-compatible': 'OpenAI-compatible',
 });
 /** The catalog-id prefix per server, so two endpoints' models never collide. */
-const ID_PREFIX = Object.freeze({ 'llama.cpp': 'llama', ollama: 'ollama', lmstudio: 'lmstudio', vllm: 'vllm', 'openai-compatible': 'local' });
+const ID_PREFIX = Object.freeze({ 'llama.cpp': 'llama', ollama: 'ollama', lmstudio: 'lmstudio', vllm: 'vllm', openrouter: 'openrouter', 'openai-compatible': 'local' });
+
+// Re-exported for the import's callers; the one host rule lives in model-env (via ../openrouter.mjs).
+export { isOpenRouter };
+
+/**
+ * The catalog-id prefix for a server at a base URL. A generic list used to be `local-` wherever it
+ * lived, so a model on a hosted gateway read as a local one; a remote host now names its own
+ * prefix (`api.groq.com` → `groq`), and only a local / private URL keeps `local`.
+ */
+export function endpointIdPrefix(server, baseUrl) {
+  if (server !== 'openai-compatible') return ID_PREFIX[server] || 'local';
+  if (isLocalBaseUrl(baseUrl)) return 'local';
+  let host = '';
+  try { host = new URL(String(baseUrl || '').trim()).hostname.toLowerCase(); } catch { return 'local'; }
+  const labels = host.split('.').filter(Boolean);
+  if (labels.length < 2) return 'local';   // a single-label name (`http://gw/v1`) is on your network
+  while (labels.length > 2 && ['api', 'www', 'llm', 'inference'].includes(labels[0])) labels.shift();
+  return (labels[0] || '').replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 16) || 'remote';
+}
 /** Below this a pipeline thrashes the CLI's auto-compact (docs/models.md Troubleshooting). */
 export const MIN_PIPELINE_WINDOW = 65536;
 const DEFAULT_TIMEOUT_MS = 10_000;
@@ -142,6 +168,56 @@ function openAiModels(list) {
   })).filter((m) => m.id);
 }
 
+/** A USD-per-token price string → USD per million tokens; null for a missing or negative one. */
+function perMillion(v) {
+  const n = Number.parseFloat(v);
+  if (!Number.isFinite(n) || n < 0) return null;
+  return Math.round(n * 1e12) / 1e6;   // 0.000003 × 1e6 is 3.0000000000000004 in floating point
+}
+
+/**
+ * OpenRouter's listed price as a catalog `cost`: `{free:true}` for a zero price, `{perMtok}` for a
+ * real one, null when the listing has none or a variable one (the Auto router lists -1) — an
+ * unknown price is left unset ("cost not verified"), never claimed free.
+ */
+function openRouterPricing(p) {
+  if (!p || typeof p !== 'object') return null;
+  const input = perMillion(p.prompt); const output = perMillion(p.completion);
+  if (input === null || output === null) return null;
+  const cacheRead = perMillion(p.input_cache_read); const cacheWrite = perMillion(p.input_cache_write);
+  if (!input && !output && !cacheRead && !cacheWrite) return { free: true };
+  return { perMtok: { input, output, ...(cacheRead ? { cacheRead } : {}), ...(cacheWrite ? { cacheWrite } : {}) } };
+}
+
+const money = (n) => `$${Number(n.toFixed(2))}`;
+
+function openRouterModels(list) {
+  return (Array.isArray(list && list.data) ? list.data : []).map((m) => {
+    const arch = m.architecture || {};
+    const top = m.top_provider || {};
+    const params = Array.isArray(m.supported_parameters) ? m.supported_parameters : [];
+    const outputs = Array.isArray(arch.output_modalities) ? arch.output_modalities : ['text'];
+    const pricing = openRouterPricing(m.pricing);
+    const ctx = num(top.context_length) ?? num(m.context_length);
+    return {
+      id: String(m.id ?? ''),
+      name: String(m.name || m.id || ''),
+      kind: outputs.includes('text') ? 'llm' : 'other',
+      // OpenRouter serves the window it lists — unlike Ollama, there is no smaller default behind it.
+      servedContext: ctx,
+      trainedContext: null,
+      maxOutputTokens: num(top.max_completion_tokens),
+      toolCalls: params.includes('tools'),
+      vision: has(arch.input_modalities, 'image'),
+      reasoning: params.includes('reasoning') || params.includes('reasoning_effort'),
+      loaded: null,
+      pricing,
+      free: !!(pricing && pricing.free),
+      detail: !pricing ? 'variable price' : pricing.free ? 'free' : `${money(pricing.perMtok.input)} / ${money(pricing.perMtok.output)} per M`,
+    };
+  }).filter((m) => m.id);
+}
+
 /** What the caller must know before pinning a prompt limit on what this server reports. */
 function warningsFor(server, models, props) {
   const w = [];
@@ -157,6 +233,9 @@ function warningsFor(server, models, props) {
   if (server === 'lmstudio' && models.some((m) => m.kind !== 'embedding' && !m.servedContext)) {
     w.push('LM Studio reports a model\'s real window only while it is loaded; for the others the number shown is what the model supports, and the prompt limit is left unset.');
   }
+  if (server === 'openrouter' && models.some((m) => m.free)) {
+    w.push(':free models run on a pool OpenRouter shares with every user: while it is busy EVERY request gets a 429, however few you send — Max concurrent requests cannot help. For pipelines use the paid variant, add your own provider key on OpenRouter (BYOK), or give the model a fallback in its Connection.');
+  }
   if (server === 'openai-compatible' && models.every((m) => !m.servedContext)) {
     w.push('This endpoint does not report context windows — set each model\'s prompt limit by hand after importing.');
   }
@@ -172,7 +251,7 @@ function warningsFor(server, models, props) {
  * @returns {Promise<{server:string, serverLabel:string, baseUrl:string, models:Array<object>, warnings:string[]}>}
  * @throws {Error} when nothing answers at all (the caller shows it as the connection failure it is)
  */
-export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS, realBaseUrl = null } = {}) {
   const base = String(baseUrl || '').trim().replace(/\/+$/, '');
   if (!base) throw new Error('baseUrl is required');
   const root = endpointRoot(base);
@@ -182,6 +261,18 @@ export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = glob
   let models = [];
   let props = null;
 
+  // `realBaseUrl`: the provider URL when `baseUrl` is the credential broker's slot for it —
+  // what the server IS (OpenRouter or not) is decided by the real one.
+  if (isOpenRouter(realBaseUrl || base)) {
+    // A hosted API: probing it for llama.cpp / Ollama / LM Studio would cost three requests for
+    // three 404s. Its own /models is the whole answer.
+    const list = await json(f, `${base}/models`, opt);
+    if (!list) throw new Error(`no OpenAI-compatible model list at ${base}/models — is the base URL right?`);
+    models = openRouterModels(list);
+    models.sort((a, b) => (Number(b.kind === 'llm') - Number(a.kind === 'llm')) || a.id.localeCompare(b.id));
+    return { server: 'openrouter', serverLabel: SERVERS.openrouter, baseUrl: base, models, warnings: warningsFor('openrouter', models, null) };
+  }
+
   const props0 = await json(f, `${root}/props`, opt);
   if (props0 && (props0.default_generation_settings || props0.chat_template_caps)) {
     server = 'llama.cpp';
@@ -221,21 +312,34 @@ export async function listEndpointModels(baseUrl, { apiKey = '', fetch: f = glob
  * A discovered model as a catalog entry (§8.4's Copilot shape, for a server you run).
  * `baseUrl` rides the ENTRY when it differs from the provider's, so one catalog can hold an Ollama
  * and a llama.cpp model at once. A prompt limit is pinned only from a window the server really
- * serves; `maxOutputTokens` is never guessed — no local server reports one.
+ * serves; `maxOutputTokens` is never guessed — no local server reports one. OpenRouter does, and
+ * its cap is pinned only while it leaves at least half the window for the prompt: a cap that is
+ * most of the window (235929 of 262144) becomes the CLI's max_tokens, and prompt + max_tokens
+ * then overflows the window on the first large turn.
  * @param {object} m           a row from listEndpointModels
  * @param {{server:string, baseUrl:string, providerBaseUrl?:string}} ctx
  */
 export function catalogEntryForEndpointModel(m, { server = 'openai-compatible', baseUrl, providerBaseUrl = '' } = {}) {
+  const window = num(m.servedContext);
+  const outCap = num(m.maxOutputTokens);
   const capabilities = {
     ...(m.toolCalls === true || m.toolCalls === false ? { toolCalls: m.toolCalls } : {}),
     ...(m.vision === true ? { vision: true } : {}),
     ...(m.reasoning === true ? { reasoning: true } : {}),
-    ...(num(m.servedContext) ? { maxPromptTokens: num(m.servedContext) } : {}),
+    ...(window ? { maxPromptTokens: window } : {}),
+    ...(outCap && window && outCap <= window / 2 ? { maxOutputTokens: outCap } : {}),
   };
   const own = String(baseUrl || '').replace(/\/+$/, '');
   const provider = String(providerBaseUrl || '').replace(/\/+$/, '');
+  const hosted = server === 'openrouter';
+  // A hosted catalog keeps the vendor in the id (`qwen/…`, `anthropic/…`): the last path segment
+  // alone collides across vendors there. A local server's ids stay as they were.
+  const stem = hosted ? String(m.id).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 64) || 'model' : slugModelId(m.id);
+  // A model on your own machine bills nothing; OpenRouter lists its price, and one it lists as
+  // variable is left unset rather than claimed free.
+  const cost = hosted ? (m.pricing || undefined) : { free: true };
   return {
-    id: `${ID_PREFIX[server] || 'local'}-${slugModelId(m.id)}`,
+    id: `${endpointIdPrefix(server, own)}-${stem}`,
     label: `${m.name || m.id} (${SERVERS[server] || 'local'})`,
     ...(m.reasoning === true ? {} : { efforts: ['medium'] }),
     upstream: {
@@ -243,13 +347,14 @@ export function catalogEntryForEndpointModel(m, { server = 'openai-compatible',
       ...(own && own !== provider ? { baseUrl: own } : {}),
       ...(Object.keys(capabilities).length ? { capabilities } : {}),
     },
-    cost: { free: true },       // a model on your own machine bills nothing; never "cost not verified"
+    ...(cost ? { cost } : {}),
   };
 }
 
 /** Whether a discovered model can carry a pipeline at all (the sheet greys the rest). */
 export function importableModel(m) {
   if (!m || m.kind === 'embedding') return { ok: false, why: 'an embedding model — not a chat model' };
+  if (m.kind === 'other') return { ok: false, why: 'does not reply in text — not a chat model' };
   if (m.toolCalls === false) return { ok: false, why: 'no tool calls — a pipeline agent cannot run without them' };
   return { ok: true };
 }

package/src/core/bridge/registry.mjs

@@ -9,6 +9,8 @@ import { listGlobalModels, providerConfig, providerSecretSet, resolveProviderSec
 import { listPluginModels } from '../plugin-models.mjs';
 import { policyCatalogModels } from '../policy/cache.mjs';
 import { isLocalBaseUrl } from '../model-env.mjs';
+import { brokerEnabled } from '../broker-client.mjs';
+import { routeBridgedUpstream } from '../broker-routing.mjs';
 
 /** An OpenAI-compatible endpoint on this machine / a private network needs no key. */
 export function keyOptional(provider, baseUrl) {
@@ -42,6 +44,16 @@ export function findBridgedEntry(id) {
 export function providerReadiness(upstream) {
   if (!upstream) return { ok: true };
   const p = upstream.provider;
+  // Credential broker: worca holds no provider key or GitHub sign-in. Ready when the model
+  // maps to a broker slot (or is a keyless local endpoint); whether the PERSON has a key
+  // is the broker's question, answered per spawn. Copilot's terms stay an install setting.
+  if (brokerEnabled()) {
+    if (p === 'copilot' && !copilotTermsAcknowledged()) {
+      return { ok: false, reason: 'terms', message: 'provider copilot: terms not acknowledged — open Settings › Providers' };
+    }
+    const r = routeBridgedUpstream(upstream);
+    return r.error ? { ok: false, reason: 'no_key', message: `provider ${p}: ${r.error}` } : { ok: true };
+  }
   if (p === 'copilot') {
     if (!copilotTermsAcknowledged()) {
       return { ok: false, reason: 'terms', message: 'provider copilot: terms not acknowledged — open Settings › Providers' };
@@ -83,6 +95,7 @@ export function upstreamSettings(upstream) {
     accountType: p === 'copilot' ? cfg.accountType : null,
     headers: upstream.headers || {},
     capabilities: upstream.capabilities || {},
+    ...(upstream.openrouter ? { openrouter: upstream.openrouter } : {}),
     maxConcurrent: cfg.maxConcurrent,
   };
 }

package/src/core/bridge/server.mjs

@@ -18,6 +18,7 @@ import { findBridgedEntry } from './registry.mjs';
 import { handleMessages } from './upstream.mjs';
 import { estimateInputTokens } from './translate/response.mjs';
 import { bridgeErrors, PAYLOAD_CEILING_BYTES } from './errors.mjs';
+import { brokerEnabled } from '../broker-client.mjs';
 
 let state = null;   // { server, port, secret, listening: Promise<number>, log }
 const ROUTE_RE = /^\/m\/([^/]+)(?:\/r\/([^/]+))?\/v1\/(messages|messages\/count_tokens|models)\/?$/;
@@ -132,18 +133,30 @@ function sendJson(res, status, obj, headers) {
   res.end(JSON.stringify(obj));
 }
 
+const BROKER_TOKEN_RE = /^wbt_[A-Za-z0-9_-]{43}$/;
+
+/**
+ * The caller's credential: the bridge's own secret, or — with the credential broker on —
+ * the spawn's broker token, which the bridge forwards to the broker (it is the broker
+ * that checks it; the bridge never holds a provider key then). null = refused.
+ * @returns {{brokerToken:string|null}|null}
+ */
 function authorized(req) {
   const h = req.headers;
   const bearer = typeof h.authorization === 'string' && /^bearer\s+/i.test(h.authorization) ? h.authorization.replace(/^bearer\s+/i, '').trim() : '';
   const key = typeof h['x-api-key'] === 'string' ? h['x-api-key'].trim() : '';
-  return (bearer && bearer === state.secret) || (key && key === state.secret);
+  if ((bearer && bearer === state.secret) || (key && key === state.secret)) return { brokerToken: null };
+  const tok = bearer || key;
+  if (brokerEnabled() && BROKER_TOKEN_RE.test(tok)) return { brokerToken: tok };
+  return null;
 }
 
 async function handle(req, res) {
   const url = new URL(req.url || '/', 'http://127.0.0.1');
   const m = ROUTE_RE.exec(url.pathname);
   if (!m) { const e = bridgeErrors.notFound(); return sendJson(res, e.status, e.body); }
-  if (!authorized(req)) { const e = bridgeErrors.unauthorized(); return sendJson(res, e.status, e.body); }
+  const auth = authorized(req);
+  if (!auth) { const e = bridgeErrors.unauthorized(); return sendJson(res, e.status, e.body); }
   const catalogId = decodeURIComponent(m[1]);
   const tag = m[2] ? decodeURIComponent(m[2]) : '';
   const route = m[3];
@@ -180,5 +193,5 @@ async function handle(req, res) {
   };
   const headers = {};
   for (const [k, v] of Object.entries(req.headers)) if (typeof v === 'string') headers[k.toLowerCase()] = v;
-  await handleMessages({ entry, body, requestHeaders: headers, tag, signal: ctrl.signal, fetch: state.fetch, log: state.log }, reply);
+  await handleMessages({ entry, body, requestHeaders: headers, tag, signal: ctrl.signal, fetch: state.fetch, log: state.log, brokerToken: auth.brokerToken }, reply);
 }