auto-model-router 0.4.11 → 0.4.13

package/.omp-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "auto-model-router: a local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
-    "version": "0.4.11",
+    "version": "0.4.13",
     "pluginRoot": "."
   },
   "plugins": [
     {
       "name": "auto-model-router",
       "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter. Runs in-process, routes per turn by price and task complexity, with budget caps, mid-stream escalation, and cache-aware hysteresis.",
-      "version": "0.4.11",
+      "version": "0.4.13",
       "author": {
         "name": "drewappling",
         "email": "drewappling@gmail.com"

package/README.md

@@ -706,7 +706,8 @@ escalation signal, error. Three views aggregate it, all from the same
   transcript. Falls back to reading the ledger directly if the router is
   unreachable.
 - `auto-model-router report --days 7 [--harness <id>] [--json]` on the terminal.
-- `GET /v1/router/report?days=7&harness=<id>` for dashboards.
+- `GET /v1/router/report?days=7&harness=<id>` for dashboards (`harness` may be
+  a comma-separated set of ids, for a group).
 - `GET /v1/router/summary?harness=<id>` — the daily summary as JSON (`auto=1`
   applies the once-a-day gate and returns `due: false` when nothing is due).
 
@@ -1177,6 +1178,24 @@ text, not the conversation, so a hard task that only becomes hard three tool
 calls in stays on the router (the router's own escalation still applies
 there); and the switch happens at prompt boundaries, never mid-turn.
 
+## Per-request routing policy
+
+A front door in front of the router (the team edition, or any proxy that
+knows who is calling) can constrain one turn with an `X-Omp-Policy` header
+carrying JSON:
+
+```json
+{ "allow": ["anthropic/*", "google/*"], "deny": ["openai/gpt-5-pro"], "minTier": "simple", "maxTier": "moderate", "pin": "anthropic/claude-sonnet-5" }
+```
+
+`allow` and `deny` are slug globs like `filters.allow`/`filters.deny`: a
+request allow list replaces the configured one, a deny list adds to it.
+`minTier`/`maxTier` narrow the requested profile's tier envelope and never
+widen it. `pin` forces one model the way `/router pin` does, unless a session
+override already pinned one. Every field is optional; a malformed header is
+ignored rather than failing the turn. The decision trail records what the
+policy changed (`policy: …`).
+
 ## Multiple coding harnesses, one router
 
 **One router process for everything.** omp's embed extension binds a private

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/cost/report.ts

@@ -187,9 +187,20 @@ function toRow(r: RawRow, windowSpend: number): ReportRow {
 	};
 }
 
+/** A harness filter: one id, or several comma-separated (a team's members); empty ⇒ everything. */
+export function harnessFilter(harnessId: string, param = "$harness"): { sql: string[]; bind: Record<string, string> } {
+	const ids = harnessId.split(",").map((s) => s.trim()).filter((s) => s !== "");
+	if (ids.length === 0) return { sql: [], bind: {} };
+	if (ids.length === 1) return { sql: [`harness_id = ${param}`], bind: { [param]: ids[0]! } };
+	const bind: Record<string, string> = {};
+	ids.forEach((id, i) => (bind[`${param}${i}`] = id));
+	return { sql: [`harness_id IN (${ids.map((_, i) => `${param}${i}`).join(", ")})`], bind };
+}
+
 /**
  * Builds the report for the last `windowDays`. `harnessId` narrows to one
- * harness (the `X-Omp-Harness` header); empty means everything.
+ * harness (the `X-Omp-Harness` header) or a comma-separated set of them (a
+ * team edition group); empty means everything.
  */
 export function buildUsageReport(
 	db: Database,
@@ -200,12 +211,9 @@ export function buildUsageReport(
 	const sinceMs = nowMs - windowDays * 86_400_000;
 	const harnessId = opts.harnessId ?? "";
 	const untilMs = opts.untilMs;
-	const where = [
-		"created_at_ms >= $since",
-		...(untilMs === undefined ? [] : ["created_at_ms < $until"]),
-		...(harnessId === "" ? [] : ["harness_id = $harness"]),
-	].join(" AND ");
-	const bind = { $since: sinceMs, ...(untilMs === undefined ? {} : { $until: untilMs }), ...(harnessId === "" ? {} : { $harness: harnessId }) };
+	const hf = harnessFilter(harnessId);
+	const where = ["created_at_ms >= $since", ...(untilMs === undefined ? [] : ["created_at_ms < $until"]), ...hf.sql].join(" AND ");
+	const bind = { $since: sinceMs, ...(untilMs === undefined ? {} : { $until: untilMs }), ...hf.bind };
 
 	const t = db
 		.query(

package/src/cost/summary.ts

@@ -13,7 +13,7 @@
 
 import type { Database } from "bun:sqlite";
 import { TIER_ORDER } from "../router/types.ts";
-import { buildUsageReport, type BaselinePrice, type BaselineRow, type UsageReport } from "./report.ts";
+import { buildUsageReport, harnessFilter, type BaselinePrice, type BaselineRow, type UsageReport } from "./report.ts";
 import type { SoftFailureSpike } from "./types.ts";
 
 /** One 24-hour window's headline numbers. */
@@ -89,8 +89,9 @@ function windowOf(r: UsageReport): SummaryWindow {
 
 /** Counts tier moves up and down between consecutive kept turns of each conversation since `sinceMs`. */
 export function countTierChanges(db: Database, sinceMs: number, harnessId: string): { up: number; down: number } {
-	const where = harnessId === "" ? "created_at_ms >= $since" : "created_at_ms >= $since AND harness_id = $harness";
-	const bind = harnessId === "" ? { $since: sinceMs } : { $since: sinceMs, $harness: harnessId };
+	const hf = harnessFilter(harnessId);
+	const where = ["created_at_ms >= $since", ...hf.sql].join(" AND ");
+	const bind = { $since: sinceMs, ...hf.bind };
 	const seq = db
 		.query(`SELECT conversation_key AS ck, tier FROM ledger WHERE ${where} AND wasted = 0 AND requested_model <> 'digest' ORDER BY conversation_key, created_at_ms`)
 		.all(bind) as { ck: string; tier: string }[];
@@ -155,7 +156,7 @@ function delta(current: number, previous: number): string {
 
 /** Renders the summary as a few plain lines for the transcript. */
 export function renderDailySummary(s: DailySummary): string {
-	const scope = s.harnessId === "" ? "all harnesses" : `harness ${s.harnessId}`;
+	const scope = s.harnessId === "" ? "all harnesses" : s.harnessId.includes(",") ? `${s.harnessId.split(",").length} harnesses` : `harness ${s.harnessId}`;
 	const out: string[] = [`auto-model-router daily summary — last 24h (${scope})`];
 	const c = s.current;
 	if (c.dispatches === 0) {

package/src/lib.ts

@@ -20,4 +20,6 @@ export { buildUsageReport, renderUsageReport, type UsageReport, type ReportTotal
 export { buildDailySummary, renderDailySummary, type DailySummary } from "./cost/summary.ts";
 export { openDb } from "./util/sqlite.ts";
 export { createLedger } from "./cost/ledger.ts";
+export { createFeedbackStore, type FeedbackStore, type FeedbackRecord } from "./cost/feedback.ts";
+export type { RequestPolicy } from "./wire/types.ts";
 export type { Ledger, LedgerEntry } from "./cost/types.ts";

package/src/router/index.ts

@@ -15,7 +15,7 @@ import type { ProfileConfig, RouterConfig } from "../config/types.ts";
 import type { Ledger } from "../cost/types.ts";
 import { estimatePromptTokens } from "../tokens/estimate.ts";
 import type { UpstreamClient } from "../upstream/types.ts";
-import type { NormRequest } from "../wire/types.ts";
+import type { NormRequest, RequestPolicy } from "../wire/types.ts";
 import { classify, classifyTask } from "./classify.ts";
 import { extractFeatures } from "./features.ts";
 import { select } from "./select.ts";
@@ -38,6 +38,43 @@ export interface RouterDeps {
  */
 const NEUTRAL_TOKENIZER = "gpt";
 
+const TIER_RANK: Record<string, number> = { trivial: 0, simple: 1, moderate: 2, hard: 3 };
+
+/**
+ * Applies a request policy on top of the resolved profile and config: the
+ * tier envelope is narrowed (never widened), a request allow list replaces
+ * the configured one, a request deny list adds to it, and a pin becomes a
+ * forced slug unless a session override already forced one.
+ */
+export function applyRequestPolicy(
+	profile: ProfileConfig,
+	cfg: RouterConfig,
+	policy: RequestPolicy | undefined,
+	forceSlug: string | undefined,
+): { profile: ProfileConfig; cfg: RouterConfig; forceSlug: string | undefined; reasons: string[] } {
+	if (policy === undefined) return { profile, cfg, forceSlug, reasons: [] };
+	const reasons: string[] = [];
+	let minTier = profile.minTier;
+	let maxTier = profile.maxTier;
+	if (policy.minTier !== undefined && TIER_RANK[policy.minTier]! > TIER_RANK[minTier]!) minTier = policy.minTier;
+	if (policy.maxTier !== undefined && TIER_RANK[policy.maxTier]! < TIER_RANK[maxTier]!) maxTier = policy.maxTier;
+	if (TIER_RANK[minTier]! > TIER_RANK[maxTier]!) minTier = maxTier;
+	const narrowed = minTier !== profile.minTier || maxTier !== profile.maxTier;
+	const outProfile = narrowed ? { ...profile, id: `${profile.id}+policy`, minTier, maxTier } : profile;
+	if (narrowed) reasons.push(`policy: tiers narrowed to [${minTier}..${maxTier}]`);
+	let outCfg = cfg;
+	if (policy.allow !== undefined || policy.deny !== undefined) {
+		outCfg = { ...cfg, filters: { ...cfg.filters, ...(policy.allow === undefined ? {} : { allow: policy.allow }), ...(policy.deny === undefined ? {} : { deny: [...cfg.filters.deny, ...policy.deny] }) } };
+		reasons.push(`policy: ${policy.allow === undefined ? "" : `allow ${policy.allow.join("|")} `}${policy.deny === undefined ? "" : `deny ${policy.deny.join("|")}`}`.trim());
+	}
+	let outForce = forceSlug;
+	if (forceSlug === undefined && policy.pin !== undefined) {
+		outForce = policy.pin;
+		reasons.push(`policy: pinned to ${policy.pin}`);
+	}
+	return { profile: outProfile, cfg: outCfg, forceSlug: outForce, reasons };
+}
+
 export function resolveProfile(cfg: RouterConfig, requestedModel: string, isSubagent = false): ProfileConfig {
 	const fallback = cfg.profiles[0];
 	if (fallback === undefined) throw new Error("no router profiles configured");
@@ -99,19 +136,22 @@ export function createRouter(deps: RouterDeps): Router {
 				classification = await classify(req, features, config, { upstream, ledger, catalog });
 			}
 
-			return select({
+			const policed = applyRequestPolicy(resolveProfile(config, req.requestedModel, req.isSubagent), config, req.policy, opts.forceSlug);
+			const decision = select({
 				req,
 				features,
 				classification,
-				profile: resolveProfile(config, req.requestedModel, req.isSubagent),
+				profile: policed.profile,
 				state,
 				snapshot,
 				ledger,
-				cfg: config,
+				cfg: policed.cfg,
 				nowMs: Date.now(),
 				...(opts.excludeSlugs === undefined ? {} : { excludeSlugs: opts.excludeSlugs }),
-				...(opts.forceSlug === undefined ? {} : { forceSlug: opts.forceSlug }),
+				...(policed.forceSlug === undefined ? {} : { forceSlug: policed.forceSlug }),
 			});
+			if (policed.reasons.length > 0) decision.reasons.unshift(...policed.reasons);
+			return decision;
 		},
 	};
 }

package/src/wire/openai/request.ts

@@ -1,4 +1,5 @@
 import type {
+	RequestPolicy,
 	CompactionEdit,
 	NormMessage,
 	NormRequest,
@@ -285,6 +286,34 @@ function renderUpstreamBody(
 	return body;
 }
 
+const TIER_NAMES = new Set(["trivial", "simple", "moderate", "hard"]);
+
+/** Parses the X-Omp-Policy header; malformed or empty ⇒ no policy (never a rejected turn). */
+export function parsePolicyHeader(raw: string | null): RequestPolicy | undefined {
+	if (raw === null || raw.trim() === "") return undefined;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return undefined;
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+	const p = parsed as Record<string, unknown>;
+	const strs = (v: unknown): string[] | undefined => (Array.isArray(v) ? v.filter((s): s is string => typeof s === "string" && s.trim() !== "").map((s) => s.trim()) : undefined);
+	const tier = (v: unknown): RequestPolicy["minTier"] => (typeof v === "string" && TIER_NAMES.has(v) ? (v as RequestPolicy["minTier"]) : undefined);
+	const out: RequestPolicy = {};
+	const allow = strs(p.allow);
+	const deny = strs(p.deny);
+	if (allow !== undefined && allow.length > 0) out.allow = allow;
+	if (deny !== undefined && deny.length > 0) out.deny = deny;
+	const min = tier(p.minTier);
+	const max = tier(p.maxTier);
+	if (min !== undefined) out.minTier = min;
+	if (max !== undefined) out.maxTier = max;
+	if (typeof p.pin === "string" && p.pin.trim() !== "") out.pin = p.pin.trim();
+	return Object.keys(out).length === 0 ? undefined : out;
+}
+
 export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 	if (typeof body !== "object" || body === null || Array.isArray(body)) {
 		throw invalidRequest("Request body must be a JSON object");
@@ -306,6 +335,9 @@ export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 	// Subagent marker from the embed extension (sessions without a UI).
 	const isSubagent = (headers.get("x-omp-subagent") ?? "").trim() === "1";
 
+	// Per-request routing policy (team edition): JSON in X-Omp-Policy.
+	const policy = parsePolicyHeader(headers.get("x-omp-policy"));
+
 	if (typeof b.model !== "string" || b.model.length === 0) {
 		throw invalidRequest("model must be a non-empty string");
 	}
@@ -367,6 +399,7 @@ export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 		ompSessionId,
 		agentdoxScope,
 		isSubagent,
+		...(policy === undefined ? {} : { policy }),
 		requestedModel,
 		messages,
 		tools,

package/src/wire/types.ts

@@ -12,6 +12,20 @@ import type { UsageCounts } from "../cost/types.ts";
 
 export type WireProtocol = "openai-chat" | "openai-responses" | "pi-native";
 
+/**
+ * A routing policy attached to one request. `allow`/`deny` are slug globs
+ * like `filters.allow`/`filters.deny` (a request allow list replaces the
+ * configured one; a deny list adds to it); `minTier`/`maxTier` narrow the
+ * profile's tier envelope; `pin` forces one slug, like `/router pin`.
+ */
+export interface RequestPolicy {
+	allow?: string[];
+	deny?: string[];
+	minTier?: "trivial" | "simple" | "moderate" | "hard";
+	maxTier?: "trivial" | "simple" | "moderate" | "hard";
+	pin?: string;
+}
+
 export type Role = "system" | "developer" | "user" | "assistant" | "tool";
 
 /** One tool call requested by an assistant turn. */
@@ -84,6 +98,12 @@ export interface NormRequest {
 	agentdoxScope: string;
 	/** `X-Omp-Subagent: 1`: the caller is an omp subagent (a session without a UI). */
 	isSubagent: boolean;
+	/**
+	 * Per-request routing policy from the `X-Omp-Policy` header (JSON), set by
+	 * a front door such as the team edition: narrows what this turn may route
+	 * to. Absent ⇒ the configured profile and filters alone.
+	 */
+	policy?: RequestPolicy;
 	/** Virtual model the client selected, e.g. `auto`, `auto-cheap`, `auto-max`. */
 	requestedModel: string;
 	messages: NormMessage[];

package/test/policy.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { applyRequestPolicy, resolveProfile } from "../src/router/index.ts";
+import { parseChatRequest, parsePolicyHeader } from "../src/wire/openai/request.ts";
+
+/**
+ * The per-request routing policy (X-Omp-Policy): parsed defensively from the
+ * header, then applied on top of the profile and filters — tiers only narrow,
+ * an allow list replaces the configured one, a deny list adds to it, and a
+ * pin forces a slug unless a session override already did.
+ */
+
+describe("parsePolicyHeader", () => {
+	test("accepts the documented fields, drops junk, and never rejects a turn", () => {
+		expect(parsePolicyHeader(null)).toBeUndefined();
+		expect(parsePolicyHeader("not json")).toBeUndefined();
+		expect(parsePolicyHeader("[]")).toBeUndefined();
+		expect(parsePolicyHeader("{}")).toBeUndefined();
+		expect(parsePolicyHeader(JSON.stringify({ allow: ["anthropic/*", " x/y "], deny: [1, "", "openai/*"], minTier: "simple", maxTier: "nope", pin: " z/w " }))).toEqual({ allow: ["anthropic/*", "x/y"], deny: ["openai/*"], minTier: "simple", pin: "z/w" });
+		const req = parseChatRequest({ model: "auto", messages: [{ role: "user", content: "hi" }] }, new Headers({ "X-Omp-Policy": '{"maxTier":"moderate"}' }));
+		expect(req.policy).toEqual({ maxTier: "moderate" });
+		expect("policy" in parseChatRequest({ model: "auto", messages: [{ role: "user", content: "hi" }] }, new Headers())).toBe(false);
+	});
+});
+
+describe("applyRequestPolicy", () => {
+	const cfg = DEFAULT_CONFIG;
+	const profile = resolveProfile(cfg, "auto");
+
+	test("narrows the tier envelope, never widens it", () => {
+		const r = applyRequestPolicy(profile, cfg, { maxTier: "moderate", minTier: "trivial" }, undefined);
+		expect(r.profile.maxTier).toBe("moderate");
+		expect(r.profile.minTier).toBe(profile.minTier);
+		expect(r.profile.id).toBe(`${profile.id}+policy`);
+		expect(r.reasons[0]).toContain("tiers narrowed");
+		// A cheap profile cannot be raised past its own ceiling.
+		const cheap = resolveProfile(cfg, "auto-cheap");
+		const up = applyRequestPolicy(cheap, cfg, { minTier: "hard" }, undefined);
+		expect(up.profile.minTier).toBe(cheap.maxTier);
+		expect(up.profile.maxTier).toBe(cheap.maxTier);
+	});
+
+	test("allow replaces, deny adds, and a pin forces unless a session override already did", () => {
+		const base = { ...cfg, filters: { ...cfg.filters, allow: ["x/*"], deny: ["bad/*"] } };
+		const r = applyRequestPolicy(profile, base, { allow: ["anthropic/*"], deny: ["openai/*"], pin: "anthropic/claude-sonnet-5" }, undefined);
+		expect(r.cfg.filters.allow).toEqual(["anthropic/*"]);
+		expect(r.cfg.filters.deny).toEqual(["bad/*", "openai/*"]);
+		expect(r.forceSlug).toBe("anthropic/claude-sonnet-5");
+		expect(r.profile).toBe(profile); // tiers untouched ⇒ same object
+		expect(applyRequestPolicy(profile, base, { pin: "a/b" }, "session/pin").forceSlug).toBe("session/pin");
+		expect(applyRequestPolicy(profile, base, undefined, undefined)).toEqual({ profile, cfg: base, forceSlug: undefined, reasons: [] });
+		// Untouched config object when the policy carries no filters.
+		expect(applyRequestPolicy(profile, base, { maxTier: "hard" }, undefined).cfg).toBe(base);
+	});
+});

package/test/report.test.ts

@@ -156,6 +156,20 @@ describe("buildUsageReport", () => {
 		db.close();
 	});
 
+	test("a comma-separated harness list reports the union (a team group)", () => {
+		const { db, ledger } = seeded();
+		try {
+			ledger.record(entry({ harnessId: "u_a", reportedUsd: 1 }));
+			ledger.record(entry({ harnessId: "u_b", reportedUsd: 2 }));
+			ledger.record(entry({ harnessId: "u_c", reportedUsd: 4 }));
+			expect(buildUsageReport(db, { windowDays: 1, nowMs: NOW, harnessId: "u_a,u_b" }).totals.spendUsd).toBeCloseTo(3, 6);
+			expect(buildUsageReport(db, { windowDays: 1, nowMs: NOW, harnessId: " u_c , u_a " }).totals.spendUsd).toBeCloseTo(5, 6);
+			expect(buildUsageReport(db, { windowDays: 1, nowMs: NOW, harnessId: "u_b" }).totals.spendUsd).toBeCloseTo(2, 6);
+		} finally {
+			db.close();
+		}
+	});
+
 	test("prompt anatomy averages the recorded byte shares", () => {
 		const { db, ledger } = seeded();
 		const feat = (tool: number, older: number, stale: number) => ({ toolSchemaBytes: 1000, anatomy: { messages: 30, systemBytes: 1000, userBytes: 500, assistantBytes: 500, toolBytes: tool, olderHalfBytes: older, staleToolBytes: stale } });