auto-model-router 0.16.0 → 0.18.0

package/.claude/skills/agentdox/SKILL.md

@@ -5,7 +5,7 @@ description: "Use agentdox — the shared memory, docs, and context server — t
 
 # agentdox — the standard interaction protocol
 
-agentdox is a shared memory + docs + conversation store at `http://localhost:3003`. It is what
+agentdox is a shared memory + docs + conversation store at `http://localhost:8790/agentdox`. It is what
 stops you rediscovering the same project facts every session.
 
 **Follow this protocol identically every time.** Consistency is the point: the value of the
@@ -55,7 +55,7 @@ Deterministic, so the same folder always resolves to the same slug:
    repo root:
 
    ```ini
-   AGENTDOX_URL=http://localhost:3003
+   AGENTDOX_URL=http://localhost:8790/agentdox
    AGENTDOX_SCOPE=<slug>
    AGENTDOX_TOKEN=<the global PAT>
    ```
@@ -104,6 +104,16 @@ determine the scope, ask — do not guess, and do not fall back to a default.
 
 ## 1. Pick your transport — MCP or REST
 
+> **Where the store lives (since 2026-09-10).** The store is the team edition's embedded agentdox,
+> reached through the team: REST at `http://localhost:8790/agentdox/...` and MCP at
+> `http://localhost:8790/mcp`, with a **team member key** (`amrt_…`) as `AGENTDOX_TOKEN`. The team maps
+> the key to the member's grants (write on every project of their groups, read on the group's
+> context), so a 401 means the key and a 403 means the project belongs to another group — not a PAT.
+> agentdox's own `/auth` routes are not reachable through the team; projects are created on the
+> team's Groups page or appear on a workspace's first turn. The old dev container on :3003 is retired.
+> A member key updates entries (`PATCH /memory/:id`) but cannot delete them (agentdox wants admin on the
+> scope for that): to retire a fact, lower its importance or leave it to the team's retention pass.
+
 Both hit the same live store with the same RBAC. **Check which you have, then use it:**
 
 - **MCP tools present** — use them. Claude Code and Cursor mount them as `memory_add`,
@@ -129,7 +139,7 @@ inline JSON and avoids quoting pain in `curl`:
 ```ts
 const tok = /AGENTDOX_TOKEN=(.+)/.exec(await Bun.file(".env.agentdox").text())?.[1]?.trim() ?? "";
 const H = { Authorization: `Bearer ${tok}`, "content-type": "application/json" };
-await fetch("http://localhost:3003/memory", { method: "POST", headers: H,
+await fetch("http://localhost:8790/agentdox/memory", { method: "POST", headers: H,
   body: JSON.stringify({ content: "…", category: "<scope>", importance: 0.9 }) });
 ```
 

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "agentdox": {
       "type": "http",
-      "url": "http://localhost:3003/mcp",
+      "url": "http://localhost:8790/mcp",
       "headers": {
         "Authorization": "Bearer ${AGENTDOX_TOKEN}"
       }

package/.omp-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "auto-model-router: a local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
-    "version": "0.16.0",
+    "version": "0.18.0",
     "pluginRoot": "."
   },
   "plugins": [
     {
       "name": "auto-model-router",
       "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter. Runs in-process, routes per turn by price and task complexity, with budget caps, mid-stream escalation, and cache-aware hysteresis.",
-      "version": "0.16.0",
+      "version": "0.18.0",
       "author": {
         "name": "drewappling",
         "email": "drewappling@gmail.com"

package/CLAUDE.md

@@ -24,7 +24,7 @@ tips). Read it before using agentdox; do not improvise from this summary.
 | --- | --- |
 | Token, URL, scope | `.env.agentdox` in this repo root (gitignored — never commit) |
 | What `.mcp.json` reads | the `AGENTDOX_TOKEN` **environment variable** (Windows *User* scope; shells opened before it was set lack it) |
-| Server | `http://localhost:3003` — Docker container `agentdox-server`; endpoints in `E:/projects/agentdox/packages/server/src/index.ts` |
+| Server | `http://localhost:8790/agentdox` — the team edition's embedded agentdox (the `agentdox-server` container is retired); endpoints in `E:/projects/agentdox/packages/server/src/index.ts` |
 | Admin token (re-mint) | `E:/projects/agentdox/deploy/.env` |
 
 Two rules that cause silent mistakes: **memory calls take `category`, everything else takes
@@ -46,7 +46,7 @@ behind them are recorded there as they are made.
 Turning the bridge on for the router itself (distinct from the MCP wiring above):
 
 ```bash
-export AGENTDOX_URL=http://localhost:3003
+export AGENTDOX_URL=http://localhost:8790/agentdox
 export AGENTDOX_TOKEN=<the global PAT, same value .mcp.json uses>
 export AGENTDOX_SCOPE=omp-router
 ```

package/README.md

@@ -716,6 +716,16 @@ escalation signal, error. Three views aggregate it, all from the same
   bill, escalation signal and verdicts (`?session=` narrows to one omp session, as `/router
   why` does). These are what a front door such as the team edition reads instead of the
   ledger file.
+- `GET /v1/router/catalog[?policy=<X-Omp-Policy JSON>]` — the model catalog as data: every
+  model the router knows, sorted by slug, with provider (`openrouter`, `ollama`, a named
+  upstream's id), vendor, context, capabilities, prices in USD per million tokens and quality
+  scores; a model whose upstream cannot serve right now (no key, disabled, in cooldown) is
+  listed too. With `policy` every model also carries `admitted` and, when out, `reason`
+  (`not in the allow list`, `denied by <glob>`, `pinned to <slug>`, the router's own filters,
+  or the upstream's state), judged by the same matcher a turn uses, so the view never drifts
+  from what a turn gets; tiers are per turn and do not take part. A malformed policy is a
+  400; before the first fetch it answers `{ "fetchedAtMs": 0, "models": [] }` rather than
+  waiting. A team front door reads it for its model governance views.
 - `GET /v1/router/report?days=7&harness=<id>` for dashboards (`harness` may be
   a comma-separated set of ids, for a group).
 - `GET /v1/router/summary?harness=<id>` — the daily summary as JSON (`auto=1`
@@ -1287,7 +1297,8 @@ request allow list replaces the configured one, a deny list adds to it.
 widen it. `pin` forces one model the way `/router pin` does, unless a session
 override already pinned one. Every field is optional; a malformed header is
 ignored rather than failing the turn. The decision trail records what the
-policy changed (`policy: …`).
+policy changed (`policy: …`), and `GET /v1/router/catalog?policy=…` shows what a
+policy admits, model by model, without routing a turn.
 
 ## Using a remote router
 
@@ -1343,6 +1354,9 @@ the embed extension sets it from the workspace as it loads. If the variable is u
 sends the name itself, which the router does not accept as a scope (a scope is a
 lowercase slug) and falls back to its default. `--scope <slug>` pins one project for the
 whole machine instead; a refresh keeps a pin, and `connect --scope ""` removes it.
+`X-Agentdox-Origin` rides the same way under `AUTO_MODEL_ROUTER_ORIGIN`, set from the
+workspace's git remote; a pinned scope does not pin it, because the repository a turn
+came from is still the workspace's. See [the origin fingerprint](#the-origin-fingerprint).
 
 ### One file to install
 
@@ -1541,6 +1555,23 @@ a team posts exactly what it always did, so its block is byte-identical; an olde
 agentdox ignores the keys it does not know. `context.layers: false` is the kill
 switch — the headers are still parsed but nothing new goes to agentdox.
 
+### The origin fingerprint
+
+The scope is the folder's name, and folder names collide: two unrelated repositories
+checked out as `api` would share one project, and one repository cloned into `~/work/api`
+and `~/src/backend-api` would split into two. So the embed extension also sends
+`X-Agentdox-Origin`: the workspace's git remote `origin`, normalised to `<host>/<path>` —
+lowercase, no scheme, credentials, port, `.git` or trailing slash — so
+`https://github.com/DrewAppling/omp-router.git` and `git@github.com:drewappling/omp-router.git`
+are both `github.com/drewappling/omp-router`. It is read from `.git/config` (or through a
+worktree's `.git` file) with the filesystem alone, never by running git, and a workspace
+outside a repository or with a local-path remote sends none. Like the scope it reaches the
+main model through an environment variable, `AUTO_MODEL_ROUTER_ORIGIN`, that the managed
+`models.yml` entry names and the extension sets. A team edition uses it to find the
+project a workspace belongs to whatever the folder is called; a router on its own has no
+project registry and ignores it — the header is parsed and validated (a raw URL or the
+variable's name is dropped) and nothing else changes.
+
 ### It does not cost you a cache miss per turn
 
 The context block sits at the front of the prompt, so re-fetching it every turn

package/docs/AGENTDOX-BRIDGE.md

@@ -32,7 +32,8 @@ unchanged re-assembly keeps the same bytes and the cache survives.
 | `src/context/store.ts` | `context_blocks` (content-addressed) + `agentdox_sessions` |
 | `src/context/index.ts` | `createBridgeFromConfig` — returns an inert bridge when unconfigured |
 | `src/server/turn.ts` | Resolve → inject → pin → record. Two `log.debug("agentdox …")` lines |
-| `src/wire/openai/request.ts` | `injectContextBlock` + `x-agentdox-scope` header parsing |
+| `src/wire/openai/request.ts` | `injectContextBlock` + the `x-agentdox-*` header parsing (the Anthropic path delegates to it) |
+| `src/context/scope.ts` | The slug and origin rules, and the env-var names the managed provider entries carry |
 | `src/util/sqlite.ts` | `USER_VERSION` 11, `MIGRATE_V11` |
 | `test/context-bridge.test.ts` | 14 tests: every refresh trigger, restart survival, degradation |
 | `tools/agentdox-e2e.ts` | Live check against a running agentdox server |
@@ -41,6 +42,22 @@ Injection appends to the **last system message** rather than inserting one — i
 shift every `cacheBreakpointMessageIndices` entry the core computed, and appending lands the
 block inside the prefix `planCacheBreakpoints` already marks.
 
+### The request headers
+
+Every one is optional; absent or invalid ⇒ empty, and an empty value sends nothing new to
+agentdox, so a router without a front door behaves as it always did.
+
+| Header | Since | Value | Who sends it | What the router does |
+| --- | --- | --- | --- | --- |
+| `X-Agentdox-Scope` | 0.2 | a project slug (`isScopeSlug`) | the embed extension, from the workspace folder; the managed `models.yml` entry names `AUTO_MODEL_ROUTER_SCOPE` and the extension sets it | selects the project whose context is injected and whose sessions the turn is recorded into; empty ⇒ `context.defaultScope` |
+| `X-Agentdox-Group` | 0.16.0 | a slug | a front door (the team edition), per request | the group's brief and top memory render **first**; sent to `assemble` as `group` |
+| `X-Agentdox-Personal` | 0.16.0 | a slug | a front door, per request | the member's own thread renders **last**; sent as `personal`. When either layer is named the harness id goes as `user` too |
+| `X-Agentdox-Origin` | 0.17.0 | `<host>/<path>` of the git remote (`isOrigin`) | the embed extension, from `.git/config`; `models.yml` names `AUTO_MODEL_ROUTER_ORIGIN` | parsed and validated only (`NormRequest.agentdoxOrigin`); the bridge never reads it — a front door with a project registry resolves the project from it |
+
+omp resolves a header value that names an environment variable per request, and sends the
+literal name when the variable is unset. Both names are uppercase and neither rule accepts
+uppercase, so a sentinel can never become a project or a fingerprint.
+
 ## 3. Running it
 
 ```bash

package/omp-extension/embed-logic.ts

@@ -13,7 +13,9 @@
  */
 
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+
+import { normalizeOrigin } from "../src/context/scope.ts";
 
 /**
  * The provider id registered into omp. Kept stable so a `models.yml` that
@@ -58,6 +60,13 @@ export interface EmbedConfig {
 	 * models never loses the project's memory/docs/brief.
 	 */
 	agentdoxScope?: string;
+	/**
+	 * The workspace's repository fingerprint (its git remote `origin`,
+	 * normalised) sent as `X-Agentdox-Origin`. A front door with a project
+	 * registry uses it to find the project whatever the folder is called; a
+	 * router alone ignores it.
+	 */
+	agentdoxOrigin?: string;
 }
 
 /**
@@ -79,6 +88,81 @@ export function deriveAgentdoxScope(cwd: string): string {
 		.replace(/^-+|-+$/g, "");
 }
 
+/** The first `url` under `[remote "origin"]` in a git config, or "" when there is none. */
+function originUrlOf(config: string): string {
+	let inOrigin = false;
+	for (const line of config.split(/\r?\n/)) {
+		const t = line.trim();
+		if (t.startsWith("[")) {
+			inOrigin = /^\[remote\s+"origin"\]$/i.test(t);
+			continue;
+		}
+		if (!inOrigin) continue;
+		const m = /^url\s*=\s*(.+)$/i.exec(t);
+		if (m !== null) return m[1]!.trim().replace(/^"(.*)"$/, "$1");
+	}
+	return "";
+}
+
+/**
+ * Derives the workspace's repository fingerprint: the git remote `origin` of
+ * the repository holding `cwd`, normalised by `normalizeOrigin`.
+ *
+ * The scope (`deriveAgentdoxScope`) is the FOLDER's name, which two unrelated
+ * repositories can share and one repository cloned twice does not. The origin
+ * is what a project registry needs to tell them apart, so it travels beside
+ * the scope; the scope itself is untouched by this.
+ *
+ * Walks up from `cwd` to the filesystem root looking for `.git`. A directory
+ * holds `config` directly; a file (a worktree or a submodule) names the real
+ * git dir with `gitdir: <path>`, relative to the folder holding the file, and
+ * a worktree's own dir keeps the shared config one hop further in `commondir`.
+ * Read with the filesystem only — never git itself, which may be absent, slow,
+ * or prompt — and total: any failure, including no repository at all, is "".
+ * `readFile` is injectable so the walk can be tested on hand-built files.
+ */
+export function deriveWorkspaceOrigin(cwd: string, readFile: (path: string) => string = (p) => readFileSync(p, "utf8")): string {
+	const read = (path: string): string | null => {
+		try {
+			return readFile(path);
+		} catch {
+			return null;
+		}
+	};
+	try {
+		if (cwd.trim() === "") return "";
+		let dir = resolve(cwd);
+		for (;;) {
+			const dotGit = join(dir, ".git");
+			// A directory: the config sits inside it. (Reading a directory throws.)
+			let config = read(join(dotGit, "config"));
+			if (config === null) {
+				// A file: `gitdir: <path>`; that dir has its own config (a
+				// submodule) or points at the shared one through `commondir`.
+				const pointer = read(dotGit);
+				const m = pointer === null ? null : /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
+				if (m !== null) {
+					const gitDir = resolve(dir, m[1]!);
+					config = read(join(gitDir, "config"));
+					if (config === null) {
+						const common = read(join(gitDir, "commondir"));
+						if (common !== null) config = read(join(resolve(gitDir, common.trim()), "config"));
+					}
+					// A `.git` file that leads nowhere is still the repository's
+					// boundary: nothing above it is this workspace's origin.
+					return config === null ? "" : normalizeOrigin(originUrlOf(config));
+				}
+			}
+			if (config !== null) return normalizeOrigin(originUrlOf(config));
+			const parent = dirname(dir);
+			if (parent === dir) return "";
+			dir = parent;
+		}
+	} catch {
+		return "";
+	}
+}
+
 /**
  * Resolves the desired bind port: an explicit `AUTO_MODEL_ROUTER_PORT` when set
  * and valid, else 0 so the OS assigns a free ephemeral port.
@@ -189,6 +273,8 @@ export function buildProviderConfig(
 	},
 	/** omp's workspace directory, used to derive a scope when none is configured. */
 	cwd?: string,
+	/** The workspace's repository fingerprint (`deriveWorkspaceOrigin`); "" or absent sends none. */
+	origin?: string,
 ): EmbedConfig {
 	const host = cfg.server.host === "0.0.0.0" || cfg.server.host === "::" ? "127.0.0.1" : cfg.server.host;
 	const round = (v: number): number => Math.round(v * 1e4) / 1e4;
@@ -224,6 +310,10 @@ export function buildProviderConfig(
 		const derived = deriveAgentdoxScope(cwd ?? "");
 		const scope = derived !== "" ? derived : cfg.context.defaultScope;
 		if (scope !== "") out.agentdoxScope = scope;
+		// The repository beside the folder: one value for every clone of it,
+		// whatever each is called. Only a registry can use it, so it is sent
+		// only where the scope is.
+		if (origin !== undefined && origin !== "") out.agentdoxOrigin = origin;
 	}
 	return out;
 }

package/omp-extension/remote-logic.ts

@@ -112,7 +112,7 @@ export const REMOTE_MODELS: readonly { id: string; name: string }[] = [
  * the session and subagent tags, and the virtual models. Costs are USD per
  * million tokens, like the embedded config.
  */
-export function remoteProviderRegistration(remote: RemoteRouter, sessionId: string, subagent: boolean, blend: { inputPerMtok: number; outputPerMtok: number }, agentdoxScope = ""): {
+export function remoteProviderRegistration(remote: RemoteRouter, sessionId: string, subagent: boolean, blend: { inputPerMtok: number; outputPerMtok: number }, agentdoxScope = "", agentdoxOrigin = ""): {
 	baseUrl: string;
 	api: string;
 	apiKey: string;
@@ -126,6 +126,9 @@ export function remoteProviderRegistration(remote: RemoteRouter, sessionId: stri
 	// router, so this is sent whatever the local config says; the remote decides what to do with
 	// it (a team that pins a scope for the group overrides it, and one that pins none follows it).
 	if (agentdoxScope !== "") headers["X-Agentdox-Scope"] = agentdoxScope;
+	// The repository behind that folder: the same value from every clone, so a remote with a
+	// project registry finds the project when two folders share a name or one repo has two.
+	if (agentdoxOrigin !== "") headers["X-Agentdox-Origin"] = agentdoxOrigin;
 	const round = (v: number): number => Math.round(v * 1e4) / 1e4;
 	return {
 		baseUrl: `${remote.url}/v1`,

package/omp-extension/router-embed.ts

@@ -33,8 +33,8 @@ import type { RouterConfig } from "../src/config/types.ts";
 
 import type { ExtensionAPI } from "@oh-my-pi/pi-coding-agent";
 
-import { EMBED_DUMMY_API_KEY, EMBED_PROVIDER_ID, buildProviderConfig, deriveAgentdoxScope, embedPortPath, modelsYmlPort, probeEmbed, readEmbedPort, resolveEmbedPort, writeEmbedPort } from "./embed-logic.ts";
-import { SCOPE_ENV } from "../src/context/scope.ts";
+import { EMBED_DUMMY_API_KEY, EMBED_PROVIDER_ID, buildProviderConfig, deriveAgentdoxScope, deriveWorkspaceOrigin, embedPortPath, modelsYmlPort, probeEmbed, readEmbedPort, resolveEmbedPort, writeEmbedPort } from "./embed-logic.ts";
+import { ORIGIN_ENV, SCOPE_ENV } from "../src/context/scope.ts";
 
 // The workspace's scope for the MAIN model. omp builds that handle from
 // models.yml before this file loads, so its X-Agentdox-Scope cannot come from
@@ -43,9 +43,17 @@ import { SCOPE_ENV } from "../src/context/scope.ts";
 // and this module runs inside omp's process — so setting it here reaches
 // every turn of this session, main and side roles alike. A workspace that
 // derives no scope (no folder name) leaves whatever the shell set.
+//
+// The workspace's ORIGIN (its git remote, normalised) rides the same way under
+// ORIGIN_ENV: the folder name is the scope, the repository is the fingerprint
+// a team uses to find the project when folder names collide. Read once — the
+// remote does not change during a session — and shared with the providers
+// registered below. A workspace outside a repository sets nothing.
+const workspaceOrigin = deriveWorkspaceOrigin(process.cwd());
 {
 	const workspaceScope = deriveAgentdoxScope(process.cwd());
 	if (workspaceScope !== "") process.env[SCOPE_ENV] = workspaceScope;
+	if (workspaceOrigin !== "") process.env[ORIGIN_ENV] = workspaceOrigin;
 }
 
 /** omp's models.yml as text, or "" when it does not exist / cannot be read. */
@@ -97,7 +105,7 @@ function trackProcessExit(): void {
 function registerRouterProvider(pi: ExtensionAPI, port: number, cfg: RouterConfig, sessionId: string, subagent: boolean): void {
 	// cwd is omp's workspace, which is what the agentdox scope is derived from
 	// when none is configured explicitly.
-	const providerConfig = buildProviderConfig(port, cfg, process.cwd());
+	const providerConfig = buildProviderConfig(port, cfg, process.cwd(), workspaceOrigin);
 	const headers: Record<string, string> = {};
 	if (providerConfig.harnessId !== undefined && providerConfig.harnessId !== "") {
 		headers["X-Omp-Harness"] = providerConfig.harnessId;
@@ -112,6 +120,10 @@ function registerRouterProvider(pi: ExtensionAPI, port: number, cfg: RouterConfi
 	if (providerConfig.agentdoxScope !== undefined && providerConfig.agentdoxScope !== "") {
 		headers["X-Agentdox-Scope"] = providerConfig.agentdoxScope;
 	}
+	// The repository behind that folder, for a front door that keeps a registry.
+	if (providerConfig.agentdoxOrigin !== undefined && providerConfig.agentdoxOrigin !== "") {
+		headers["X-Agentdox-Origin"] = providerConfig.agentdoxOrigin;
+	}
 	pi.registerProvider(EMBED_PROVIDER_ID, {
 		baseUrl: providerConfig.baseUrl,
 		api: "openai-completions",
@@ -190,7 +202,7 @@ export default function (pi: ExtensionAPI): void {
 					writeEmbedLog(`remote credential refresh failed: ${err instanceof Error ? err.message : String(err)}`);
 				}
 			}
-			pi.registerProvider(EMBED_PROVIDER_ID, remoteProviderRegistration(remote, sessionId, !ctx.hasUI, cfg.ledger.fallbackBlend, deriveAgentdoxScope(process.cwd())));
+			pi.registerProvider(EMBED_PROVIDER_ID, remoteProviderRegistration(remote, sessionId, !ctx.hasUI, cfg.ledger.fallbackBlend, deriveAgentdoxScope(process.cwd()), workspaceOrigin));
 			pi.setLabel(`auto-model-router remote (${remote.url.replace(/^https?:\/\//, "")})`);
 			writeEmbedLog(`remote mode url=${remote.url} user=${remote.userId} session=${sessionId}`);
 			return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/catalog/composite.ts

@@ -46,7 +46,7 @@ export function createCompositeCatalog(
 	ollama: OllamaCatalogSource,
 	availability: OllamaAvailability,
 	bias: CompositeBias = { costBias: 1, biasUntilUsage: 1, usage: NO_USAGE },
-): CatalogSource & { ollamaModels(): CatalogModel[]; ollamaBias(): number } {
+): CatalogSource & { ollamaModels(): CatalogModel[]; ollamaBias(): number; peekAll(): CatalogSnapshot | null } {
 	let lastBase: CatalogSnapshot | null = null;
 	let lastOllama: readonly CatalogModel[] = [];
 	let lastAvailable = true;
@@ -118,6 +118,17 @@ export function createCompositeCatalog(
 			return combine(base, ollama.peek());
 		},
 		find,
+		/**
+		 * Every model the catalog knows, whether or not its upstream can take a
+		 * turn now: OpenRouter's without a key, Ollama's in cooldown, a named
+		 * upstream's in cooldown. `peek()` is what routes; this is what a front
+		 * door lists so it can say why a model is out. No network.
+		 */
+		peekAll(): CatalogSnapshot | null {
+			const base = openrouter.peek();
+			if (base === null) return null;
+			return { ...base, models: [...base.models, ...ollama.peek(), ...(bias.named?.models(base.models) ?? NO_NAMED)] };
+		},
 		lastShrink(): CatalogShrink | null {
 			return openrouter.lastShrink?.() ?? null;
 		},

package/src/cli/config-cmd.ts

@@ -15,7 +15,7 @@
  * keys survive.
  */
 
-import { SCOPE_ENV } from "../context/scope.ts";
+import { ORIGIN_ENV, SCOPE_ENV } from "../context/scope.ts";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -65,7 +65,9 @@ export interface SpliceResult {
  * the embed extension sets from the workspace folder, so the MAIN model's turns
  * carry the repository's own scope rather than one for the whole machine. When
  * the variable is unset the router ignores the literal and falls back to its
- * own `context.defaultScope`.
+ * own `context.defaultScope`. The origin (`ORIGIN_ENV`, set by the extension
+ * from the workspace's git remote) rides the same way; a router on its own
+ * ignores it, a front door with a project registry does not.
  */
 function providerHeaders(cfg: RouterConfig): Record<string, string> {
 	const headers: Record<string, string> = {};
@@ -74,6 +76,7 @@ function providerHeaders(cfg: RouterConfig): Record<string, string> {
 	}
 	if (cfg.context.enabled) {
 		headers["X-Agentdox-Scope"] = SCOPE_ENV;
+		headers["X-Agentdox-Origin"] = ORIGIN_ENV;
 	}
 	return headers;
 }

package/src/cli/connect.ts

@@ -29,7 +29,7 @@ import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { refreshAccountOf, remoteFilePath } from "../../omp-extension/remote-logic.ts";
-import { SCOPE_ENV } from "../context/scope.ts";
+import { ORIGIN_ENV, SCOPE_ENV } from "../context/scope.ts";
 import { executablePath, materializePackage, readEmbeddedPackage } from "./embedded.ts";
 import { fetchSkills, installSkills, type SkillsBundle, type SkillsInstallReport, type SkillsTarget } from "./skills.ts";
 import { pickStore, saveRefreshToken, type StoreDeps, type StoreKind } from "./credential-store.ts";
@@ -200,6 +200,10 @@ const MODELS_YML_END = "  # END auto-model-router (remote)";
  * `SCOPE_ENV`, which omp resolves from its environment per request, and the
  * embed extension sets that variable from the workspace folder as it loads.
  * `scope` pins a literal slug instead, for a single-project machine.
+ *
+ * `X-Agentdox-Origin` always names `ORIGIN_ENV`, which the extension sets from
+ * the workspace's git remote: a pinned scope says which project's context to
+ * draw on, and the origin still says which repository the turn came from.
  */
 export function renderRemoteModelsYml(url: string, key: string, blend: { inputPerMtok: number; outputPerMtok: number }, scope = ""): string {
 	const round = (v: number): number => Math.round(v * 1e4) / 1e4;
@@ -217,7 +221,7 @@ export function renderRemoteModelsYml(url: string, key: string, blend: { inputPe
 		"    api: openai-completions",
 		`    apiKey: ${key}`,
 	];
-	lines.push("    headers:", `      X-Agentdox-Scope: ${scope !== "" ? scope : SCOPE_ENV}`);
+	lines.push("    headers:", `      X-Agentdox-Scope: ${scope !== "" ? scope : SCOPE_ENV}`, `      X-Agentdox-Origin: ${ORIGIN_ENV}`);
 	lines.push("    models:");
 	for (const m of REMOTE_MODEL_ROWS) {
 		lines.push(

package/src/context/scope.ts

@@ -27,3 +27,66 @@ export function acceptScope(raw: string | null | undefined): string {
 	const s = (raw ?? "").trim();
 	return isScopeSlug(s) ? s : "";
 }
+
+/**
+ * The workspace's ORIGIN travels the same road as the scope: `connect` and
+ * `config --write` put this NAME in the managed provider entry, the embed
+ * extension sets the variable from the workspace's git remote as it loads, and
+ * omp resolves it per request. Where the scope names a FOLDER, the origin
+ * names the REPOSITORY, so a front door with a project registry (the team
+ * edition) can tell two unrelated `api` folders apart and recognise one repo
+ * cloned into two differently named folders. A router on its own has no such
+ * registry and ignores it.
+ */
+export const ORIGIN_ENV = "AUTO_MODEL_ROUTER_ORIGIN";
+
+/**
+ * A repository fingerprint: `<host>/<path>` — lowercase, no scheme, no
+ * credentials, no port, no trailing `.git`, no trailing slash — so the same
+ * repository cloned over https and over ssh yields one value. Uppercase never
+ * passes, so `ORIGIN_ENV` itself, which omp sends verbatim when the variable is
+ * unset, can never become a fingerprint.
+ */
+export function isOrigin(value: string): boolean {
+	return /^[a-z0-9][a-z0-9.-]{0,127}(\/[a-z0-9._~-]{1,64}){1,8}$/.test(value);
+}
+
+/**
+ * Reduces a git remote URL to its fingerprint, or "" when it names no host —
+ * a local path (`/srv/repo`, `C:\repo`) or `file://` — or does not reduce to a
+ * valid origin. Every form git accepts for `origin` is covered: `scheme://`
+ * with optional credentials and port, and the scp-like `[user@]host:path`.
+ */
+export function normalizeOrigin(url: string): string {
+	const raw = url.trim();
+	let host: string;
+	let path: string;
+	const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(raw);
+	if (scheme !== null) {
+		if (scheme[1]!.toLowerCase() === "file") return "";
+		const rest = raw.slice(scheme[0].length);
+		const slash = rest.search(/[/\\]/);
+		host = slash < 0 ? rest : rest.slice(0, slash);
+		path = slash < 0 ? "" : rest.slice(slash + 1);
+	} else {
+		// scp-like `[user@]host:path`. A Windows drive (`C:\repo`, `C:/repo`)
+		// has the same shape with a one-letter "host" and is a local path.
+		const scp = /^(?:[^@/\\:]+@)?([^/\\:]+):(.*)$/.exec(raw);
+		if (scp === null || /^[a-z]$/i.test(scp[1]!)) return "";
+		host = scp[1]!;
+		path = scp[2]!;
+	}
+	// Credentials first (a password may contain digits and a colon), then the port.
+	host = host.slice(host.lastIndexOf("@") + 1).replace(/:\d+$/, "");
+	const segments = path.split(/[/\\]/).filter((s) => s !== "");
+	const last = segments.length - 1;
+	if (last >= 0) segments[last] = segments[last]!.replace(/\.git$/i, "");
+	const value = [host, ...segments.filter((s) => s !== "")].join("/").toLowerCase();
+	return isOrigin(value) ? value : "";
+}
+
+/** The origin to trust from a request header: a fingerprint, or "" for anything else. */
+export function acceptOrigin(raw: string | null | undefined): string {
+	const s = (raw ?? "").trim();
+	return isOrigin(s) ? s : "";
+}

package/src/lib.ts

@@ -28,4 +28,5 @@ export { createFeedbackStore, type FeedbackStore, type FeedbackRecord } from "./
 export { buildExecutable, collectPackageFiles, executableFileName, hostTarget, isExecutableTarget, EXECUTABLE_TARGETS, type ExecutableTarget, type BuildExecutableResult } from "./cli/build-executable.ts";
 export { parseSkillsBundle, type SkillsBundle } from "./cli/skills.ts";
 export type { RequestPolicy } from "./wire/types.ts";
+export type { CatalogView, CatalogViewModel } from "./server/catalog-view.ts";
 export type { Ledger, LedgerEntry } from "./cost/types.ts";

package/src/router/candidates.ts

@@ -48,12 +48,37 @@ export interface BuildCandidatesArgs {
 	excludeSlugs?: readonly string[];
 }
 
-/** Tiny glob: `*` matches any run of characters; everything else is literal. */
-function globToRe(glob: string): RegExp {
+/**
+ * Tiny glob: `*` matches any run of characters; everything else is literal.
+ * The one matcher behind `filters.allow`/`filters.deny` and a request
+ * policy's lists; the catalog view (`GET /v1/router/catalog`) judges with it
+ * too, so what a front door shows never drifts from what a turn gets.
+ */
+export function globToRe(glob: string): RegExp {
 	const escaped = glob.replace(/[.*+?^${}()|[\]\\]/g, (ch) => (ch === "*" ? ".*" : `\\${ch}`));
 	return new RegExp(`^${escaped}$`);
 }
 
+/**
+ * The denials that precede any user configuration, as the reason text, or
+ * null when the model may be a candidate. These slugs can never serve an
+ * interactive turn:
+ *  - "~vendor/model-latest": floating aliases whose identity changes
+ *    underneath us, poisoning ledger trust statistics.
+ *  - ":batch": asynchronous batch endpoints, unusable for streaming.
+ *  - "stealth/": cloaked models with no stable identity.
+ *  - "openrouter/": their meta-routers do our job at unknown cost.
+ *  - a negative price: OpenRouter's unknown/dynamic sentinel (-1), never a discount.
+ */
+export function builtInDenial(model: CatalogModel): string | null {
+	const slug = model.slug;
+	if (slug.startsWith("~") || slug.endsWith(":batch") || slug.startsWith("stealth/") || model.author === "openrouter") {
+		return "built-in deny: floating alias, batch endpoint, stealth, or meta-router";
+	}
+	if (model.price.prompt < 0 || model.price.completion < 0) return "dynamic pricing sentinel";
+	return null;
+}
+
 /**
  * Quality fallback chain: score the preferred axis first, then the general
  * intelligence index (the most widely published), then the remaining axis.
@@ -182,20 +207,10 @@ export function buildCandidates(args: BuildCandidatesArgs): { candidates: Candid
 			continue;
 		}
 
-		// Hard-coded denials, before any user configuration. These slugs can
-		// never serve an interactive turn:
-		//  - "~vendor/model-latest": floating aliases whose identity changes
-		//    underneath us, poisoning ledger trust statistics.
-		//  - ":batch": asynchronous batch endpoints, unusable for streaming.
-		//  - "stealth/": cloaked models with no stable identity.
-		//  - "openrouter/": their meta-routers do our job at unknown cost.
-		if (slug.startsWith("~") || slug.endsWith(":batch") || slug.startsWith("stealth/") || model.author === "openrouter") {
-			rejected.push({ slug, reason: "denylisted", detail: "built-in deny: floating alias, batch endpoint, stealth, or meta-router" });
-			continue;
-		}
-		// A negative price is OpenRouter's unknown/dynamic sentinel (-1), never a discount.
-		if (model.price.prompt < 0 || model.price.completion < 0) {
-			rejected.push({ slug, reason: "denylisted", detail: "dynamic pricing sentinel" });
+		// Hard-coded denials, before any user configuration.
+		const builtIn = builtInDenial(model);
+		if (builtIn !== null) {
+			rejected.push({ slug, reason: "denylisted", detail: builtIn });
 			continue;
 		}
 		if (allowRes.length > 0 && !allowRes.some((re) => re.test(slug))) {

package/src/server/advise.ts

@@ -52,6 +52,7 @@ function requestOf(req: AdviseRequest): NormRequest {
 		agentdoxScope: "",
 		agentdoxGroup: "",
 		agentdoxPersonal: "",
+		agentdoxOrigin: "",
 		isSubagent: false,
 		requestedModel: "auto",
 		messages: [