auto-model-router 0.6.3 → 0.7.0

package/.omp-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "auto-model-router: a local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
-    "version": "0.6.3",
+    "version": "0.7.0",
     "pluginRoot": "."
   },
   "plugins": [
     {
       "name": "auto-model-router",
       "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter. Runs in-process, routes per turn by price and task complexity, with budget caps, mid-stream escalation, and cache-aware hysteresis.",
-      "version": "0.6.3",
+      "version": "0.7.0",
       "author": {
         "name": "drewappling",
         "email": "drewappling@gmail.com"

package/README.md

@@ -1162,6 +1162,35 @@ router handles for you: no `models[]` fallback cascade, no `tool_choice`,
 `reasoning_effort` instead of the `reasoning` object, and no `cache_control`
 markers (they are stripped before dispatch).
 
+## Changing the config while it runs
+
+Ranking knobs have always hot-reloaded: every consumer reads the shared config
+object at call time, so editing `config.yml` changes the next turn. Since
+v0.7.0 that covers the settings that used to be captured at construction — the
+**OpenRouter key**, the whole **`ollama` block** (including turning it on or
+off), and the **agentdox bridge**. The clients read them per call, the catalogs
+re-fetch in the background, and the bridge is re-pointed in place. Only the
+bound socket (`server.*`) and the ledger file (`ledger.path`) still need a
+restart, because the process is built around them.
+
+An embedder gets the same thing as a call. `startServer` returns
+`reconfigure(patch)`:
+
+```ts
+const router = startServer(cfg);
+const { changed, rejected, catalogRefreshing } = await router.reconfigure({
+  openrouter: { apiKey: "sk-or-…" },
+  ollama: { enabled: true, apiKey: "…", baseUrl: "https://ollama.com/v1" },
+  context: { enabled: true, baseUrl: "http://agentdox:3003", token: "…" },
+});
+```
+
+`changed` lists the dotted paths that actually moved, `rejected` the ones that
+need a restart, and `catalogRefreshing` says whether an upstream change started
+a catalog re-fetch. No socket closes and no turn in flight is cut: the config
+object keeps its identity and only its leaves are written, which is what lets a
+client that bound `cfg.ollama` at construction see the new key.
+
 ## Harness-side model switch (experimental)
 
 Most engineers reach Claude through a subscription, not an API key, and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/catalog/composite.ts

@@ -83,7 +83,8 @@ export function createCompositeCatalog(
 	return {
 		async get(): Promise<CatalogSnapshot> {
 			const base = await openrouter.get();
-			const models = await ollama.get(base.models);
+			// Nothing to fetch while Ollama cannot serve (off, or its breaker open).
+			const models = availability.available() ? await ollama.get(base.models) : ollama.peek();
 			// Refreshes on its own poll interval; a cached reading returns at once.
 			await bias.usage.get();
 			return combine(base, models);
@@ -91,7 +92,7 @@ export function createCompositeCatalog(
 		async refresh(): Promise<CatalogSnapshot> {
 			const base = await openrouter.refresh();
 			ollama.invalidate();
-			const models = await ollama.get(base.models);
+			const models = availability.available() ? await ollama.get(base.models) : ollama.peek();
 			await bias.usage.get();
 			return combine(base, models);
 		},

package/src/catalog/ollama-catalog.ts

@@ -218,10 +218,11 @@ export function loadOllamaCatalogCache(db: Database): { models: CatalogModel[];
 }
 
 export function createOllamaCatalog(cfg: OllamaConfig, log: Logger, fetchImpl: FetchLike = fetch, db?: Database): OllamaCatalogSource {
-	const root = ollamaApiRoot(cfg.baseUrl);
-	const direct = isOllamaDotCom(cfg.baseUrl);
-	const headers: Record<string, string> = {};
-	if (cfg.apiKey !== "") headers.authorization = `Bearer ${cfg.apiKey}`;
+	// `cfg` is the live config block: resolve per call so a changed base URL or
+	// key applies without a restart.
+	const root = (): string => ollamaApiRoot(cfg.baseUrl);
+	const direct = (): boolean => isOllamaDotCom(cfg.baseUrl);
+	const headers = (): Record<string, string> => (cfg.apiKey === "" ? {} : { authorization: `Bearer ${cfg.apiKey}` });
 	// Hydrate from disk so a restart peeks a real set before the first listing;
 	// listedAtMs stays 0 so the first get() still refreshes.
 	let models: CatalogModel[] = db === undefined ? [] : loadOllamaCatalogCache(db).models;
@@ -237,23 +238,23 @@ export function createOllamaCatalog(cfg: OllamaConfig, log: Logger, fetchImpl: F
 	const shown = new Map<string, { contextLength: number | null; capabilities: string[] }>();
 
 	async function list(): Promise<OllamaListing[]> {
-		const res = await fetchImpl(`${root}/api/tags`, { headers, signal: AbortSignal.timeout(cfg.timeoutMs) });
+		const res = await fetchImpl(`${root()}/api/tags`, { headers: headers(), signal: AbortSignal.timeout(cfg.timeoutMs) });
 		if (!res.ok) throw new Error(`ollama /api/tags HTTP ${res.status}`);
 		const json = asRec(await res.json());
 		const raw = json !== null && Array.isArray(json.models) ? json.models : [];
 		const out: OllamaListing[] = [];
 		for (const r of raw) {
-			const l = parseOllamaListing(r, direct ? "ollama.com" : "daemon");
+			const l = parseOllamaListing(r, direct() ? "ollama.com" : "daemon");
 			if (l !== null) out.push(l);
 		}
 		// ollama.com's listing has no context/capabilities; ask per model, once.
-		if (direct) {
+		if (direct()) {
 			for (const l of out) {
 				if (l.contextLength !== null && l.capabilities.length > 0) continue;
 				let s = shown.get(l.id);
 				if (s === undefined) {
 					try {
-						const r = await fetchImpl(`${root}/api/show`, {
+						const r = await fetchImpl(`${root()}/api/show`, {
 							method: "POST",
 							headers: { ...headers, "content-type": "application/json" },
 							body: JSON.stringify({ model: l.id }),

package/src/config/apply.ts

@@ -0,0 +1,66 @@
+/**
+ * Applying config changes to a RUNNING router, in place.
+ *
+ * The rule that makes live reconfiguration possible: every block object keeps
+ * its identity. Consumers hold references into the config — the Ollama client
+ * binds `cfg.ollama`, the OpenRouter client reads `cfg.openrouter.apiKey` per
+ * request — so a change must be written INTO those objects, never by replacing
+ * them. Assigning `cfg.ollama = next` would leave every holder on the old
+ * object, which is exactly why those blocks used to be restart-only.
+ *
+ * Arrays are replaced wholesale: they are read through their parent
+ * (`cfg.filters.allow`) rather than captured, and element-wise patching would
+ * make a shorter list impossible to express.
+ */
+
+import type { RouterConfig } from "./types.ts";
+import type { DeepPartial } from "./load.ts";
+
+type Rec = Record<string, unknown>;
+
+const isPlainObject = (v: unknown): v is Rec => typeof v === "object" && v !== null && !Array.isArray(v);
+
+/**
+ * Writes `source` into `target`, keeping every existing object's identity, and
+ * returns the dotted paths whose value actually changed. Keys absent from
+ * `source` are left alone, so this works for both a full config (a file reload)
+ * and a patch (one dashboard setting).
+ */
+export function assignInPlace(target: Rec, source: Rec, prefix = "", opts: { prune?: boolean } = {}): string[] {
+	const changed: string[] = [];
+	// A whole-config apply (a file reload) must mirror a restart: a knob deleted
+	// from the file goes away rather than lingering at its last live value. A
+	// patch (one setting from a dashboard) touches only what it names.
+	if (opts.prune === true) {
+		for (const key of Object.keys(target)) {
+			if (key in source) continue;
+			delete target[key];
+			changed.push(prefix === "" ? key : `${prefix}.${key}`);
+		}
+	}
+	for (const key of Object.keys(source)) {
+		const path = prefix === "" ? key : `${prefix}.${key}`;
+		const next = source[key];
+		const current = target[key];
+		if (isPlainObject(next) && isPlainObject(current)) {
+			changed.push(...assignInPlace(current, next, path, opts));
+			continue;
+		}
+		if (JSON.stringify(current) === JSON.stringify(next)) continue;
+		// A fresh object (or array) is cloned in, so the caller's patch cannot
+		// alias live config and mutate it from outside later.
+		target[key] = isPlainObject(next) || Array.isArray(next) ? structuredClone(next) : next;
+		changed.push(path);
+	}
+	return changed;
+}
+
+/** `assignInPlace` over a typed config. Returns the dotted paths that changed. */
+export function applyConfigPatch(live: RouterConfig, patch: DeepPartial<RouterConfig>): string[] {
+	return assignInPlace(live as unknown as Rec, patch as Rec);
+}
+
+/** True when any changed path falls inside `block` (`"ollama"` matches `ollama.apiKey`). */
+export function touched(changed: readonly string[], ...blocks: readonly string[]): boolean {
+	return changed.some((c) => blocks.some((b) => c === b || c.startsWith(`${b}.`)));
+}

package/src/config/hot-reload.ts

@@ -29,6 +29,7 @@
 import { existsSync, readFileSync, watch, type FSWatcher } from "node:fs";
 import { parse as parseYaml } from "yaml";
 import { configInputSchema } from "./schema.ts";
+import { assignInPlace } from "./apply.ts";
 import { DEFAULT_CONFIG } from "./defaults.ts";
 import { deepMerge, resolveTilde } from "./load.ts";
 import type { RouterConfig } from "./types.ts";
@@ -97,26 +98,21 @@ export interface WatchConfigOptions {
  * is read at call time and hot-reloads. A bare block name pins the whole
  * block; `block.key` pins one key and lets its siblings through.
  */
+/**
+ * Config a RUNNING router cannot change, because the process is built around it:
+ * the bound socket and the ledger file it opened.
+ *
+ * Everything else now applies live. The upstream keys, the Ollama block and the
+ * agentdox bridge used to be pinned here because they were captured by
+ * construction; they are read (or re-pointed) at call time instead, and the
+ * server re-fetches the catalogs and rebuilds the bridge when they change.
+ */
 export const PINNED_CONFIG_PATHS: readonly string[] = [
 	"server.host",
 	"server.port",
 	"server.apiKey",
 	"server.harnessId",
 	"server.maxConcurrentTurns",
-	"openrouter",
-	"ollama.enabled",
-	"ollama.baseUrl",
-	"ollama.apiKey",
-	"ollama.timeoutMs",
-	"ollama.catalogTtlMs",
-	"ollama.includeLocal",
-	"ollama.prices",
-	"ollama.twins",
-	"ollama.usagePollMs",
-	"ollama.quotaCooldownMs",
-	"ollama.rateLimitCooldownMs",
-	"ollama.planCreditsUsd",
-	"context",
 	"ledger.path",
 ];
 
@@ -125,6 +121,11 @@ export const PINNED_CONFIG_PATHS: readonly string[] = [
  * entries are re-copied from `pinned` after every reload so file edits to
  * construction-captured settings cannot silently diverge: a top-level name
  * pins the whole block, `block.key` pins one key of it.
+ *
+ * "In place" is load-bearing, not an optimisation: consumers hold references
+ * INTO the config (the Ollama client binds `cfg.ollama`), so blocks keep their
+ * identity and only leaves are written. Replacing a block would leave every
+ * holder on the old object — which is what made those blocks restart-only.
  */
 export function watchConfig(
 	path: string,
@@ -159,8 +160,8 @@ export function watchConfig(
 			const block = f.slice(0, dot);
 			frozenKeys.set(block, [...(frozenKeys.get(block) ?? []), f.slice(dot + 1)]);
 		}
-		const changed: string[] = [];
 		const next = result.cfg as unknown as Record<string, unknown>;
+		const staged: Record<string, unknown> = {};
 		const pinnedRec = pinned as unknown as Record<string, unknown>;
 		for (const key of Object.keys(next)) {
 			// Frozen blocks belong to construction: keep the pinned values. A
@@ -176,11 +177,11 @@ export function watchConfig(
 				}
 				value = merged;
 			}
-			const before = JSON.stringify((live as unknown as Record<string, unknown>)[key]);
-			const after = JSON.stringify(value);
-			if (before !== after) changed.push(key);
-			(live as unknown as Record<string, unknown>)[key] = value;
+			staged[key] = value;
 		}
+		// One in-place pass over the whole config: block identity survives, and a
+		// knob deleted from the file reverts, exactly as a restart would leave it.
+		const changed = assignInPlace(live as unknown as Record<string, unknown>, staged, "", { prune: true });
 		if (changed.length > 0) opts.onReload?.({ changed });
 	};
 

package/src/context/index.ts

@@ -1,6 +1,7 @@
 /**
  * Bridge factory. Returns the inert bridge unless agentdox is fully
- * configured, so every call site can stay unconditional.
+ * configured, so every call site can stay unconditional — and stays
+ * reconfigurable, so those settings can change while the router runs.
  */
 
 import type { Database } from "bun:sqlite";
@@ -17,7 +18,47 @@ export { createContextBridge, createDisabledBridge } from "./bridge.ts";
 export { createContextStore } from "./store.ts";
 export { createAgentDoxClient } from "./agentdox.ts";
 
-export function createBridgeFromConfig(cfg: RouterConfig, db: Database): ContextBridge {
+/** A bridge that can be pointed at different agentdox settings while the router runs. */
+export interface ReloadableContextBridge extends ContextBridge {
+	/**
+	 * Applies the config's current `context` block: the URL, token, limits or the
+	 * enabled flag may all have changed. Queued write-backs are drained first, so
+	 * nothing recorded against the old settings is lost.
+	 */
+	reconfigure(): Promise<void>;
+}
+
+/**
+ * The bridge the server runs with. It follows `cfg.context` for the life of the
+ * process: `reconfigure()` rebuilds the inner bridge from whatever the config
+ * now says, including off→on and on→off, so agentdox settings never need a
+ * restart. The block store is the database, not the bridge, so a rebuild keeps
+ * every pinned block and session binding.
+ */
+export function createBridgeFromConfig(cfg: RouterConfig, db: Database): ReloadableContextBridge {
+	let inner = buildBridge(cfg, db);
+	return {
+		get enabled() {
+			return inner.enabled;
+		},
+		resolve: (input) => inner.resolve(input),
+		recordTurn: (rec) => {
+			inner.recordTurn(rec);
+		},
+		flush: () => inner.flush(),
+		pruneBlocks: (maxAgeMs) => inner.pruneBlocks(maxAgeMs),
+		close: () => {
+			inner.close();
+		},
+		async reconfigure() {
+			await inner.flush();
+			inner.close();
+			inner = buildBridge(cfg, db);
+		},
+	};
+}
+
+function buildBridge(cfg: RouterConfig, db: Database): ContextBridge {
 	const c = cfg.context;
 	if (!c.enabled || c.baseUrl === "" || c.token === "") return createDisabledBridge();
 	const log = createLogger(cfg.logLevel);

package/src/lib.ts

@@ -12,10 +12,11 @@
  *   await router.stop();
  */
 
-export { startServer, type StartedServer } from "./server/http.ts";
+export { startServer, type ReconfigureResult, type StartedServer } from "./server/http.ts";
 export { loadConfig, apiKeySource } from "./config/load.ts";
 export { DEFAULT_CONFIG } from "./config/defaults.ts";
 export type { RouterConfig } from "./config/types.ts";
+export type { DeepPartial } from "./config/load.ts";
 export { buildUsageReport, renderUsageReport, type UsageReport, type ReportTotals } from "./cost/report.ts";
 export { buildDailySummary, renderDailySummary, type DailySummary } from "./cost/summary.ts";
 export { openDb } from "./util/sqlite.ts";

package/src/server/http.ts

@@ -20,6 +20,8 @@ import { UpstreamError } from "../upstream/types.ts";
 import { apiKeySource, ollamaKeySource } from "../config/load.ts";
 import { ollamaMeter } from "../upstream/ollama-usage.ts";
 import { routerConfigPath } from "../cli/config-cmd.ts";
+import { applyConfigPatch, touched } from "../config/apply.ts";
+import type { DeepPartial } from "../config/load.ts";
 import { PINNED_CONFIG_PATHS, watchConfig } from "../config/hot-reload.ts";
 import type { RouterConfig } from "../config/types.ts";
 import { createLogger } from "../util/log.ts";
@@ -35,9 +37,33 @@ import { runTurn } from "./turn.ts";
 export interface StartedServer {
 	// No websocket upgrade path, so the Server payload type is `undefined`.
 	server: Server<undefined>;
+	/**
+	 * Applies a config change to the RUNNING router and reports the dotted paths
+	 * that changed. Everything a turn reads through the config (tiers, filters,
+	 * budgets, provider keys) takes effect on the next turn; the pieces built
+	 * from config — the agentdox bridge, the catalogs — are re-pointed here. No
+	 * socket closes and no turn in flight is cut.
+	 *
+	 * `server.*` and `ledger.path` are the exceptions: the listener and the
+	 * database file are the process. Changing those still means a restart, and
+	 * they are rejected rather than half-applied.
+	 */
+	reconfigure(patch: DeepPartial<RouterConfig>): Promise<ReconfigureResult>;
 	stop(): Promise<void>;
 }
 
+export interface ReconfigureResult {
+	/** Dotted config paths whose value changed. */
+	changed: string[];
+	/** Paths that were refused because they belong to construction (`server.*`, `ledger.path`). */
+	rejected: string[];
+	/** True when an upstream changed and a catalog re-fetch was started in the background. */
+	catalogRefreshing: boolean;
+}
+
+/** Config a running router cannot change: the bound socket and the ledger file. */
+const RESTART_ONLY_PATHS: readonly string[] = ["server", "ledger.path"];
+
 export interface ModelSpendRow {
 	slug: string;
 	requests: number;
@@ -200,7 +226,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 	if (cfg.ledger.path !== ":memory:") mkdirSync(dirname(cfg.ledger.path), { recursive: true });
 	const db = openDb(cfg.ledger.path);
 	const ledger = createLedger(db, cfg);
-	const { upstream, catalog, ollama, ollamaUsage, ollamaCostScale } = createProviders(cfg, db, log);
+	const { upstream, catalog, ollama, ollamaServing, ollamaUsage, ollamaCostScale } = createProviders(cfg, db, log);
 	const conversations = createConversationStore(db);
 	const router = createRouter({ config: cfg, catalog, ledger, conversations, upstream });
 	const context = createBridgeFromConfig(cfg, db);
@@ -225,6 +251,8 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		{
 			onReload: ({ changed }) => {
 				log.info("config reloaded", { changed: changed.join(", ") });
+				// The file is a config change like any other: same live application.
+				void applyLive(changed).catch((err: unknown) => log.warn("applying the reloaded config failed", { error: err instanceof Error ? err.message : String(err) }));
 			},
 			onError: (message) => {
 				log.warn("config reload rejected; keeping the running config", { error: message });
@@ -241,10 +269,10 @@ export function startServer(cfg: RouterConfig): StartedServer {
 	}
 
 	if (cfg.openrouter.apiKey === "") {
-		if (ollama !== null) log.warn("no OpenRouter key: routing over Ollama Cloud models only (OpenRouter's catalog is read for metadata, never served)");
+		if (cfg.ollama.enabled) log.warn("no OpenRouter key: routing over Ollama Cloud models only (OpenRouter's catalog is read for metadata, never served)");
 		else log.warn("OPENROUTER_API_KEY is not set and Ollama is off; /v1/chat/completions will fail at dispatch time");
 	}
-	if (ollama !== null) {
+	if (cfg.ollama.enabled) {
 		log.info("ollama cloud upstream enabled", {
 			baseUrl: cfg.ollama.baseUrl,
 			// Provenance only; never the key itself.
@@ -509,7 +537,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 					const meter = ollamaMeter(ollamaUsage.peek(), cfg.ollama.planCreditsUsd);
 					const runway = ollamaRunway(meter, ledger.providerSpendSince?.("ollama/", Date.now() - 7 * 86_400_000) ?? 0, ollamaUsage.calibration()?.factor ?? 1);
 					const ollamaSummary: SummaryOllama | null =
-						ollama === null || meter === null ? null : { plan: meter.plan ?? null, usedUsd: meter.usedUsd, creditsUsd: meter.creditsUsd, runwayDays: runway?.days ?? null };
+						!cfg.ollama.enabled || meter === null ? null : { plan: meter.plan ?? null, usedUsd: meter.usedUsd, creditsUsd: meter.creditsUsd, runwayDays: runway?.days ?? null };
 					const summary = buildDailySummary(db, {
 						harnessId,
 						baselines: baselinePrices(cfg.report.baselines, (s) => catalog.find(s)),
@@ -611,7 +639,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 						apiKeyConfigured: cfg.openrouter.apiKey !== "",
 						// Which upstreams turns can actually be served from: OpenRouter needs
 						// its key; Ollama needs to be on and out of cooldown.
-						serving: [...(cfg.openrouter.apiKey !== "" ? ["openrouter"] : []), ...(ollama !== null && ollama.available() ? ["ollama"] : [])],
+						serving: [...(cfg.openrouter.apiKey !== "" ? ["openrouter"] : []), ...(ollamaServing() ? ["ollama"] : [])],
 						// Provenance only; never the key itself.
 						apiKeySource: apiKeySource(cfg).source,
 						// Provenance only; never the agentdox token itself.
@@ -621,7 +649,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 						// Never the key. `available` is the circuit breaker: false while a
 						// 402/429 cooldown routes every turn around Ollama.
 						ollama:
-							ollama === null
+							!cfg.ollama.enabled
 								? null
 								: {
 										baseUrl: cfg.ollama.baseUrl,
@@ -665,8 +693,57 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		},
 	});
 
+	/**
+	 * The one place that turns a config change into a live router. The watcher
+	 * (file edits) and `reconfigure` (an embedder, e.g. the team edition) both
+	 * come through here, so the two can never drift apart.
+	 */
+	async function applyLive(changed: readonly string[]): Promise<boolean> {
+		if (changed.length === 0) return false;
+		if (touched(changed, "context")) {
+			await context.reconfigure();
+			log.info("agentdox bridge reconfigured", {
+				enabled: context.enabled,
+				url: cfg.context.baseUrl === "" ? "(none)" : cfg.context.baseUrl,
+				defaultScope: cfg.context.defaultScope === "" ? "(per-request header only)" : cfg.context.defaultScope,
+			});
+		}
+		if (!touched(changed, "openrouter", "ollama")) return false;
+		// A key change makes the catalog key-scoped (or not), and enabling Ollama adds
+		// its models: the snapshot is rebuilt before the next turn ranks. Started, not
+		// awaited — the caller is a settings save, not a network client, and the
+		// previous snapshot serves turns until the new one lands.
+		void catalog
+			.refresh()
+			.then((snap) => log.info("catalog refreshed after an upstream change", { models: snap.models.length, ollama: cfg.ollama.enabled }))
+			.catch((err: unknown) => log.warn("catalog refresh after an upstream change failed; the previous snapshot stands", { error: err instanceof Error ? err.message : String(err) }));
+		return true;
+	}
+
 	return {
 		server,
+		async reconfigure(patch) {
+			const rejected: string[] = [];
+			const rec = patch as Record<string, unknown>;
+			for (const block of RESTART_ONLY_PATHS) {
+				const [head, key] = block.split(".") as [string, string | undefined];
+				const value = rec[head];
+				if (value === undefined) continue;
+				if (key === undefined) rejected.push(head);
+				else if ((value as Record<string, unknown>)[key] !== undefined) rejected.push(block);
+			}
+			const safe = structuredClone(rec);
+			for (const block of rejected) {
+				const [head, key] = block.split(".") as [string, string | undefined];
+				if (key === undefined) delete safe[head];
+				else delete (safe[head] as Record<string, unknown>)[key];
+			}
+			const changed = applyConfigPatch(cfg, safe as DeepPartial<RouterConfig>);
+			const catalogRefreshing = await applyLive(changed);
+			if (changed.length > 0) log.info("config reconfigured", { changed: changed.join(", ") });
+			if (rejected.length > 0) log.warn("config change needs a restart; not applied", { paths: rejected.join(", ") });
+			return { changed, rejected, catalogRefreshing };
+		},
 		stop: async () => {
 			configWatcher.close();
 			clearInterval(pruneTimer);

package/src/server/providers.ts

@@ -13,7 +13,7 @@ import type { RouterConfig } from "../config/types.ts";
 import { createMultiUpstream } from "../upstream/multi.ts";
 import { createOllamaClient, type OllamaClient } from "../upstream/ollama.ts";
 import { createLedger } from "../cost/ledger.ts";
-import { createOllamaUsageSource, NO_USAGE, type OllamaUsageSource } from "../upstream/ollama-usage.ts";
+import { createOllamaUsageSource, type OllamaUsageSource } from "../upstream/ollama-usage.ts";
 import { createOpenRouterClient } from "../upstream/openrouter.ts";
 import type { UpstreamClient } from "../upstream/types.ts";
 import { createLogger, type Logger } from "../util/log.ts";
@@ -21,8 +21,10 @@ import { createLogger, type Logger } from "../util/log.ts";
 export interface Providers {
 	upstream: UpstreamClient;
 	catalog: CatalogSource & { ollamaModels?(): unknown[]; ollamaBias?(): number };
-	/** Non-null when Ollama Cloud is enabled; carries the circuit breaker. */
-	ollama: OllamaClient | null;
+	/** Always present: it carries the circuit breaker. Whether it SERVES follows `cfg.ollama.enabled`. */
+	ollama: OllamaClient;
+	/** True while Ollama Cloud is enabled and out of cooldown, read live. */
+	ollamaServing(): boolean;
 	/** Plan usage reader; inert without a key. */
 	ollamaUsage: OllamaUsageSource;
 	/** Multiplier that brings the ledger's Ollama estimate in line with the plan meter; 1 until calibrated. */
@@ -32,15 +34,18 @@ export interface Providers {
 export function createProviders(cfg: RouterConfig, db: Database, log: Logger = createLogger(cfg.logLevel)): Providers {
 	const openrouter = createOpenRouterClient(cfg);
 	const openrouterCatalog = createCatalog(cfg, openrouter, db);
-	if (!cfg.ollama.enabled) return { upstream: openrouter, catalog: openrouterCatalog, ollama: null, ollamaUsage: NO_USAGE, ollamaCostScale: () => 1 };
 	// Ollama Cloud is a second upstream ranked in the same catalog: `ollama/…`
-	// slugs dispatch to it, everything else to OpenRouter.
+	// slugs dispatch to it, everything else to OpenRouter. It is always built, and
+	// `ollama.enabled` decides per call whether it serves — so turning it on or off
+	// in a running router is a config change, not a restart. Nothing is fetched
+	// from it while it is off.
 	const ollama = createOllamaClient(cfg);
+	const ollamaServing = (): boolean => cfg.ollama.enabled && ollama.available();
 	// Plan usage lives on ollama.com whichever base URL dispatches; it needs the
 	// key, so the daemon path without `/login ollama-cloud` keeps a static bias.
 	const ledgerForCalibration = createLedger(db, cfg);
 	const ollamaUsage = createOllamaUsageSource({
-		apiKey: cfg.ollama.apiKey,
+		apiKey: () => cfg.ollama.apiKey,
 		pollMs: cfg.ollama.usagePollMs,
 		timeoutMs: Math.min(cfg.ollama.timeoutMs, 15_000),
 		log,
@@ -50,7 +55,7 @@ export function createProviders(cfg: RouterConfig, db: Database, log: Logger = c
 	});
 	return {
 		upstream: createMultiUpstream(openrouter, ollama),
-		catalog: createCompositeCatalog(openrouterCatalog, createOllamaCatalog(cfg.ollama, log, fetch, db), ollama, {
+		catalog: createCompositeCatalog(openrouterCatalog, createOllamaCatalog(cfg.ollama, log, fetch, db), { available: ollamaServing, cooldownUntilMs: () => ollama.cooldownUntilMs(), lastTrip: () => ollama.lastTrip() }, {
 			costBias: cfg.ollama.costBias,
 			biasUntilUsage: cfg.ollama.biasUntilUsage,
 			usage: ollamaUsage,
@@ -58,6 +63,7 @@ export function createProviders(cfg: RouterConfig, db: Database, log: Logger = c
 			serveOpenRouter: () => cfg.openrouter.apiKey !== "",
 		}),
 		ollama,
+		ollamaServing,
 		ollamaUsage,
 		ollamaCostScale: () => ollamaUsage.calibration()?.factor ?? 1,
 	};

package/src/upstream/ollama-usage.ts

@@ -166,9 +166,11 @@ export interface CalibrationDeps {
 }
 
 export function createOllamaUsageSource(
-	opts: { apiKey: string; pollMs: number; timeoutMs: number; log: Logger; fetchImpl?: FetchLike; root?: string; calibration?: CalibrationDeps },
+	opts: { apiKey: () => string; pollMs: number; timeoutMs: number; log: Logger; fetchImpl?: FetchLike; root?: string; calibration?: CalibrationDeps },
 ): OllamaUsageSource {
-	if (opts.apiKey === "" || opts.pollMs <= 0) return NO_USAGE;
+	// Only the poll interval is structural. A key that is empty now may be set from
+	// the dashboard later, so the reader stays live and simply idles until it is.
+	if (opts.pollMs <= 0) return NO_USAGE;
 	const cal = opts.calibration;
 	const insertSample = cal === undefined ? null : cal.db.query("INSERT OR REPLACE INTO ollama_meter_samples (at_ms, meter_usd, ledger_usd) VALUES (?, ?, ?)");
 	const readSamples = cal === undefined ? null : cal.db.query("SELECT at_ms, meter_usd, ledger_usd FROM ollama_meter_samples WHERE at_ms >= ? ORDER BY at_ms ASC");
@@ -199,7 +201,7 @@ export function createOllamaUsageSource(
 		try {
 			const res = await fetchImpl(`${root}/api/me`, {
 				method: "POST",
-				headers: { authorization: `Bearer ${opts.apiKey}` },
+				headers: { authorization: `Bearer ${opts.apiKey()}` },
 				signal: AbortSignal.timeout(opts.timeoutMs),
 			});
 			if (res.ok) {
@@ -222,7 +224,7 @@ export function createOllamaUsageSource(
 		await refreshPlan();
 		try {
 			const res = await fetchImpl(`${root}/api/usage`, {
-				headers: { authorization: `Bearer ${opts.apiKey}` },
+				headers: { authorization: `Bearer ${opts.apiKey()}` },
 				signal: AbortSignal.timeout(opts.timeoutMs),
 			});
 			if (res.ok) {
@@ -253,6 +255,7 @@ export function createOllamaUsageSource(
 
 	return {
 		async get() {
+			if (opts.apiKey() === "") return null;
 			if (Date.now() - checkedAtMs < opts.pollMs) return current;
 			inflight ??= refresh().finally(() => {
 				inflight = null;

package/src/upstream/ollama.ts

@@ -129,7 +129,9 @@ export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>
 
 export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fetch): OllamaClient {
 	const o = cfg.ollama;
-	const baseUrl = o.baseUrl.replace(/\/+$/, "");
+	// Read per call, not captured: `o` is the live config block, so a base URL
+	// changed while the router runs takes effect on the next dispatch.
+	const baseUrl = (): string => o.baseUrl.replace(/\/+$/, "");
 	const log = createLogger(cfg.logLevel);
 	let cooldownUntil = 0;
 	let lastTrip: { kind: UpstreamErrorKind; atMs: number; message: string } | null = null;
@@ -189,7 +191,7 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 			const body = toOllamaBody({ ...opts.body, stream: true });
 			let res: Response;
 			try {
-				res = await fetchImpl(`${baseUrl}/chat/completions`, {
+				res = await fetchImpl(`${baseUrl()}/chat/completions`, {
 					method: "POST",
 					headers: headers(),
 					body: JSON.stringify(body),
@@ -237,7 +239,7 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 		async complete(body: Record<string, unknown>, signal: AbortSignal): Promise<{ text: string; costUsd: number | null }> {
 			let res: Response;
 			try {
-				res = await fetchImpl(`${baseUrl}/chat/completions`, {
+				res = await fetchImpl(`${baseUrl()}/chat/completions`, {
 					method: "POST",
 					headers: headers(),
 					body: JSON.stringify(toOllamaBody({ ...body, stream: false })),
@@ -258,7 +260,7 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 		async fetchModels(signal?: AbortSignal): Promise<unknown[]> {
 			let res: Response;
 			try {
-				res = await fetchImpl(`${baseUrl}/models`, { headers: headers(), signal: composeSignal(signal) });
+				res = await fetchImpl(`${baseUrl()}/models`, { headers: headers(), signal: composeSignal(signal) });
 			} catch (err) {
 				throw transportError(err);
 			}

package/test/hot-reload.test.ts

@@ -87,7 +87,7 @@ describe("watchConfig", () => {
 		writeFileSync(CFG, yamlOf({ tiers: { hard: { capabilityFloorUsd: 0.35 } } }));
 		await settle();
 		expect(live.tiers.hard.capabilityFloorUsd).toBe(0.35);
-		expect(reloads.flat()).toContain("tiers");
+		expect(reloads.flat()).toContain("tiers.hard.capabilityFloorUsd");
 	});
 
 	test("a second edit replaces the value and reverting restores the default", async () => {
@@ -138,7 +138,7 @@ describe("watchConfig pins by path", () => {
 	beforeAll(() => {
 		writeFileSync(CFG2, "");
 		const pinned = structuredClone(DEFAULT_CONFIG);
-		pinned.ollama.apiKey = "pinned-key";
+		pinned.server.port = 8788;
 		watcher = watchConfig(CFG2, live, pinned, PINNED_CONFIG_PATHS);
 	});
 	afterAll(() => watcher?.close());
@@ -148,7 +148,8 @@ describe("watchConfig pins by path", () => {
 		await settle();
 		expect(live.ollama.costBias).toBe(0.25);
 		expect(live.ollama.biasUntilUsage).toBe(0.5);
-		expect(live.ollama.apiKey).toBe("pinned-key");
+		// The upstream key is no longer pinned: the router re-points its clients instead.
+		expect(live.ollama.apiKey).toBe("from-file");
 		expect(live.server.port).toBe(DEFAULT_CONFIG.server.port);
 		expect(live.server.subagentProfile).toBe("auto");
 		expect(live.ledger.retentionDays).toBe(30);

package/test/ollama.test.ts

@@ -521,7 +521,7 @@ describe("ollama plan usage (credit-aware bias)", () => {
 			if (fail) return new Response("down", { status: 503 });
 			return Response.json({ ...PAYLOAD, limits: { monthly: { usage: 42, models: [] } } });
 		};
-		const src = createOllamaUsageSource({ apiKey: "k", pollMs: 20, timeoutMs: 1000, log, fetchImpl });
+		const src = createOllamaUsageSource({ apiKey: () => "k", pollMs: 20, timeoutMs: 1000, log, fetchImpl });
 		expect(src.peek()).toBeNull();
 		expect((await src.get())?.monthlyUsedFraction).toBeCloseTo(0.42, 6);
 		expect(src.peek()?.plan).toBe("pro");
@@ -531,7 +531,21 @@ describe("ollama plan usage (credit-aware bias)", () => {
 		await new Promise((r) => setTimeout(r, 120)); // well past the 20ms poll interval
 		expect((await src.get())?.monthlyUsedFraction).toBeCloseTo(0.42, 6); // last good reading survives a 503
 		expect(calls).toBe(2);
-		expect(createOllamaUsageSource({ apiKey: "", pollMs: 50, timeoutMs: 1000, log, fetchImpl })).toBe(NO_USAGE);
+		expect(createOllamaUsageSource({ apiKey: () => "k", pollMs: 0, timeoutMs: 1000, log, fetchImpl })).toBe(NO_USAGE);
+		// A key that is empty NOW is not structural: the reader idles and starts polling once one is set,
+		// which is what lets a key added from a dashboard work without restarting the router.
+		let liveKey = "";
+		let polls = 0;
+		const laterFetch = async (url: string): Promise<Response> => {
+			polls++;
+			if (url === "https://ollama.com/api/me") return Response.json({ ID: "x", Email: "e", Plan: "Pro" });
+			return Response.json({ ...PAYLOAD, limits: { monthly: { usage: 42, models: [] } } });
+		};
+		const later = createOllamaUsageSource({ apiKey: () => liveKey, pollMs: 1, timeoutMs: 1000, log, fetchImpl: laterFetch });
+		expect(await later.get()).toBeNull();
+		expect(polls).toBe(0); // no key, no network
+		liveKey = "k";
+		expect((await later.get())?.monthlyUsedFraction).toBeCloseTo(0.42, 5);
 	});
 
 	test("the composite snapshot carries the live bias and re-merges when it flips", async () => {
@@ -623,7 +637,7 @@ describe("ollama calibration", () => {
 			if (url.endsWith("/api/me")) return Response.json({ Plan: "pro" });
 			return Response.json({ limits: { monthly: { usage: frac, models: [] } } });
 		};
-		const src = createOllamaUsageSource({ apiKey: "k", pollMs: 5, timeoutMs: 1000, log, fetchImpl, calibration: { db, ledgerUsd: () => ledgerUsd, planCreditsOverrideUsd: 0 } });
+		const src = createOllamaUsageSource({ apiKey: () => "k", pollMs: 5, timeoutMs: 1000, log, fetchImpl, calibration: { db, ledgerUsd: () => ledgerUsd, planCreditsOverrideUsd: 0 } });
 		await src.get(); // meter $6 (10% of $60), ledger $1
 		expect(src.calibration()).toBeNull(); // one sample
 		await new Promise((r) => setTimeout(r, 20));

package/test/reconfigure.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, test } from "bun:test";
+import { applyConfigPatch, assignInPlace, touched } from "../src/config/apply.ts";
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import type { RouterConfig } from "../src/config/types.ts";
+import { startServer } from "../src/server/http.ts";
+
+/**
+ * Live reconfiguration: a running router follows a config change without a
+ * restart. The socket stays bound, turns in flight are untouched, and the
+ * pieces that used to be captured at construction (upstream clients, the
+ * catalogs, the agentdox bridge) are re-pointed instead.
+ */
+
+describe("applying config in place", () => {
+	test("blocks keep their identity, only leaves change, and the changed paths come back dotted", () => {
+		const cfg = structuredClone(DEFAULT_CONFIG);
+		const ollamaRef = cfg.ollama; // what a client binds at construction
+		const changed = applyConfigPatch(cfg, { ollama: { enabled: true, apiKey: "k" } });
+		expect(changed.sort()).toEqual(["ollama.apiKey", "ollama.enabled"]);
+		expect(cfg.ollama).toBe(ollamaRef); // the holder sees the new values
+		expect(ollamaRef.apiKey).toBe("k");
+		// An unchanged value is not reported, so nothing rebuilds for nothing.
+		expect(applyConfigPatch(cfg, { ollama: { apiKey: "k" } })).toEqual([]);
+	});
+
+	test("a patch touches only what it names; a full apply prunes what the source dropped", () => {
+		const target: Record<string, unknown> = { a: { x: 1, y: 2 }, b: 3 };
+		expect(assignInPlace(target, { a: { x: 9 } })).toEqual(["a.x"]);
+		expect(target).toEqual({ a: { x: 9, y: 2 }, b: 3 });
+		expect(assignInPlace(target, { a: { x: 9 } }, "", { prune: true }).sort()).toEqual(["a.y", "b"]);
+		expect(target).toEqual({ a: { x: 9 } });
+	});
+
+	test("a patch cannot alias live config", () => {
+		const cfg = structuredClone(DEFAULT_CONFIG);
+		const patch = { filters: { allow: ["a/b"] } };
+		applyConfigPatch(cfg, patch);
+		patch.filters.allow.push("c/d");
+		expect(cfg.filters.allow).toEqual(["a/b"]);
+	});
+
+	test("touched matches a block and its keys", () => {
+		expect(touched(["ollama.apiKey"], "ollama")).toBe(true);
+		expect(touched(["context"], "context")).toBe(true);
+		expect(touched(["filters.allow"], "openrouter", "ollama")).toBe(false);
+	});
+});
+
+describe("a running server reconfigures", () => {
+	const base = (): RouterConfig => ({
+		...structuredClone(DEFAULT_CONFIG),
+		server: { ...DEFAULT_CONFIG.server, host: "127.0.0.1", port: 0, apiKey: "rk" },
+		ledger: { ...DEFAULT_CONFIG.ledger, path: ":memory:" },
+		// No network at boot: an empty key keeps the catalog fetch keyless and cheap,
+		// and this test never dispatches a turn.
+		openrouter: { ...DEFAULT_CONFIG.openrouter, apiKey: "" },
+	});
+
+	test("provider keys, Ollama and the agentdox bridge all change while the socket stays bound", async () => {
+		const cfg = base();
+		const started = startServer(cfg);
+		const port = started.server.port;
+		const H = { authorization: "Bearer rk" };
+		try {
+			const health1 = (await (await fetch(`http://127.0.0.1:${port}/health`, { headers: H })).json()) as { apiKeyConfigured: boolean; serving: string[]; agentdox: unknown; ollama: unknown };
+			expect(health1.apiKeyConfigured).toBe(false);
+			expect(health1.serving).toEqual([]);
+			expect(health1.agentdox).toBeNull();
+			expect(health1.ollama).toBeNull();
+
+			// One call turns on both upstreams and the bridge.
+			const r = await started.reconfigure({
+				openrouter: { apiKey: "sk-or-live" },
+				ollama: { enabled: true, apiKey: "ol-live", baseUrl: "https://ollama.com/v1" },
+				context: { enabled: true, baseUrl: "http://127.0.0.1:1/never", token: "t", defaultScope: "demo" },
+			});
+			expect(r.rejected).toEqual([]);
+			expect(r.catalogRefreshing).toBe(true); // started in the background, not awaited
+			expect(r.changed).toContain("openrouter.apiKey");
+			expect(r.changed).toContain("ollama.enabled");
+			expect(r.changed).toContain("context.enabled");
+			expect(cfg.openrouter.apiKey).toBe("sk-or-live");
+
+			const health2 = (await (await fetch(`http://127.0.0.1:${port}/health`, { headers: H })).json()) as { apiKeyConfigured: boolean; serving: string[]; agentdox: { url: string; defaultScope: string } | null; ollama: { baseUrl: string } | null };
+			expect(started.server.port).toBe(port); // same socket, never rebound
+			expect(health2.apiKeyConfigured).toBe(true);
+			expect(health2.serving).toContain("openrouter");
+			expect(health2.serving).toContain("ollama");
+			expect(health2.agentdox).toMatchObject({ url: "http://127.0.0.1:1/never", defaultScope: "demo" });
+			expect(health2.ollama).toMatchObject({ baseUrl: "https://ollama.com/v1" });
+
+			// And back off again: the bridge goes inert and Ollama stops serving.
+			const off = await started.reconfigure({ ollama: { enabled: false }, context: { enabled: false } });
+			expect(off.changed.sort()).toEqual(["context.enabled", "ollama.enabled"]);
+			const health3 = (await (await fetch(`http://127.0.0.1:${port}/health`, { headers: H })).json()) as { serving: string[]; agentdox: unknown; ollama: unknown };
+			expect(health3.serving).toEqual(["openrouter"]);
+			expect(health3.agentdox).toBeNull();
+			expect(health3.ollama).toBeNull();
+		} finally {
+			await started.stop();
+		}
+	});
+
+	test("the socket and the ledger file are refused rather than half-applied", async () => {
+		const cfg = base();
+		const started = startServer(cfg);
+		const port = started.server.port;
+		try {
+			const r = await started.reconfigure({ server: { port: 1 }, ledger: { path: "/tmp/other.db", retentionDays: 9 }, filters: { latencyWeight: 0.42 } });
+			expect(r.rejected.sort()).toEqual(["ledger.path", "server"]);
+			expect(cfg.server.port).toBe(0);
+			expect(cfg.ledger.path).toBe(":memory:");
+			expect(started.server.port).toBe(port);
+			// Everything else in the same call still applied.
+			expect(cfg.filters.latencyWeight).toBe(0.42);
+			expect(cfg.ledger.retentionDays).toBe(9);
+			expect(r.changed).toContain("filters.latencyWeight");
+		} finally {
+			await started.stop();
+		}
+	});
+});