auto-model-router 0.6.3 → 0.7.1

package/.omp-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "auto-model-router: a local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
-    "version": "0.6.3",
+    "version": "0.7.1",
     "pluginRoot": "."
   },
   "plugins": [
     {
       "name": "auto-model-router",
       "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter. Runs in-process, routes per turn by price and task complexity, with budget caps, mid-stream escalation, and cache-aware hysteresis.",
-      "version": "0.6.3",
+      "version": "0.7.1",
       "author": {
         "name": "drewappling",
         "email": "drewappling@gmail.com"

package/README.md

@@ -1162,6 +1162,35 @@ router handles for you: no `models[]` fallback cascade, no `tool_choice`,
 `reasoning_effort` instead of the `reasoning` object, and no `cache_control`
 markers (they are stripped before dispatch).
 
+## Changing the config while it runs
+
+Ranking knobs have always hot-reloaded: every consumer reads the shared config
+object at call time, so editing `config.yml` changes the next turn. Since
+v0.7.0 that covers the settings that used to be captured at construction — the
+**OpenRouter key**, the whole **`ollama` block** (including turning it on or
+off), and the **agentdox bridge**. The clients read them per call, the catalogs
+re-fetch in the background, and the bridge is re-pointed in place. Only the
+bound socket (`server.*`) and the ledger file (`ledger.path`) still need a
+restart, because the process is built around them.
+
+An embedder gets the same thing as a call. `startServer` returns
+`reconfigure(patch)`:
+
+```ts
+const router = startServer(cfg);
+const { changed, rejected, catalogRefreshing } = await router.reconfigure({
+  openrouter: { apiKey: "sk-or-…" },
+  ollama: { enabled: true, apiKey: "…", baseUrl: "https://ollama.com/v1" },
+  context: { enabled: true, baseUrl: "http://agentdox:3003", token: "…" },
+});
+```
+
+`changed` lists the dotted paths that actually moved, `rejected` the ones that
+need a restart, and `catalogRefreshing` says whether an upstream change started
+a catalog re-fetch. No socket closes and no turn in flight is cut: the config
+object keeps its identity and only its leaves are written, which is what lets a
+client that bound `cfg.ollama` at construction see the new key.
+
 ## Harness-side model switch (experimental)
 
 Most engineers reach Claude through a subscription, not an API key, and a
@@ -1267,10 +1296,21 @@ adds the Codex provider and the Aider settings, and prints (or with `--profile`
 the environment lines for Claude Code. `--harness omp,hermes` restricts it; `--dry-run`
 shows the changes. Delete `remote.json` to go back to a local router. (`join` is an alias.)
 
+`connect` also writes omp's `models.yml` (a managed block, other providers untouched, the
+previous file backed up). That entry is what makes `auto-model-router/auto` resolvable at
+**startup**: omp builds the main model's handle before extensions load, so without it only
+the late-resolved roles (`smol`, `tiny`) reach the router and the main turns fall back to
+whatever else is authenticated. A local router deliberately gets no such entry — its port
+is ephemeral, so a persisted one names a dead socket next launch — but a remote's URL and
+key are stable. **The file then holds the member key: treat it as a secret.**
+
 In remote mode omp sends `X-Agentdox-Scope` derived from the workspace folder, so one
 remote router serves every repo on the machine with that repo's shared context. The remote
 decides what to do with it: a team edition that pins a scope on the member's group
-overrides it, and one that pins none follows the workspace.
+overrides it, and one that pins none follows the workspace. That header rides on the roles
+the extensions register; the **main** model's handle comes from `models.yml`, which is
+machine-wide, so it carries a scope only if you pass `--scope <slug>` to `connect` — right
+for a single-project machine, wrong for one with several repos.
 
 ## Multiple coding harnesses, one router
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.6.3",
+  "version": "0.7.1",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/catalog/composite.ts

@@ -83,7 +83,8 @@ export function createCompositeCatalog(
 	return {
 		async get(): Promise<CatalogSnapshot> {
 			const base = await openrouter.get();
-			const models = await ollama.get(base.models);
+			// Nothing to fetch while Ollama cannot serve (off, or its breaker open).
+			const models = availability.available() ? await ollama.get(base.models) : ollama.peek();
 			// Refreshes on its own poll interval; a cached reading returns at once.
 			await bias.usage.get();
 			return combine(base, models);
@@ -91,7 +92,7 @@ export function createCompositeCatalog(
 		async refresh(): Promise<CatalogSnapshot> {
 			const base = await openrouter.refresh();
 			ollama.invalidate();
-			const models = await ollama.get(base.models);
+			const models = availability.available() ? await ollama.get(base.models) : ollama.peek();
 			await bias.usage.get();
 			return combine(base, models);
 		},

package/src/catalog/ollama-catalog.ts

@@ -218,10 +218,11 @@ export function loadOllamaCatalogCache(db: Database): { models: CatalogModel[];
 }
 
 export function createOllamaCatalog(cfg: OllamaConfig, log: Logger, fetchImpl: FetchLike = fetch, db?: Database): OllamaCatalogSource {
-	const root = ollamaApiRoot(cfg.baseUrl);
-	const direct = isOllamaDotCom(cfg.baseUrl);
-	const headers: Record<string, string> = {};
-	if (cfg.apiKey !== "") headers.authorization = `Bearer ${cfg.apiKey}`;
+	// `cfg` is the live config block: resolve per call so a changed base URL or
+	// key applies without a restart.
+	const root = (): string => ollamaApiRoot(cfg.baseUrl);
+	const direct = (): boolean => isOllamaDotCom(cfg.baseUrl);
+	const headers = (): Record<string, string> => (cfg.apiKey === "" ? {} : { authorization: `Bearer ${cfg.apiKey}` });
 	// Hydrate from disk so a restart peeks a real set before the first listing;
 	// listedAtMs stays 0 so the first get() still refreshes.
 	let models: CatalogModel[] = db === undefined ? [] : loadOllamaCatalogCache(db).models;
@@ -237,23 +238,23 @@ export function createOllamaCatalog(cfg: OllamaConfig, log: Logger, fetchImpl: F
 	const shown = new Map<string, { contextLength: number | null; capabilities: string[] }>();
 
 	async function list(): Promise<OllamaListing[]> {
-		const res = await fetchImpl(`${root}/api/tags`, { headers, signal: AbortSignal.timeout(cfg.timeoutMs) });
+		const res = await fetchImpl(`${root()}/api/tags`, { headers: headers(), signal: AbortSignal.timeout(cfg.timeoutMs) });
 		if (!res.ok) throw new Error(`ollama /api/tags HTTP ${res.status}`);
 		const json = asRec(await res.json());
 		const raw = json !== null && Array.isArray(json.models) ? json.models : [];
 		const out: OllamaListing[] = [];
 		for (const r of raw) {
-			const l = parseOllamaListing(r, direct ? "ollama.com" : "daemon");
+			const l = parseOllamaListing(r, direct() ? "ollama.com" : "daemon");
 			if (l !== null) out.push(l);
 		}
 		// ollama.com's listing has no context/capabilities; ask per model, once.
-		if (direct) {
+		if (direct()) {
 			for (const l of out) {
 				if (l.contextLength !== null && l.capabilities.length > 0) continue;
 				let s = shown.get(l.id);
 				if (s === undefined) {
 					try {
-						const r = await fetchImpl(`${root}/api/show`, {
+						const r = await fetchImpl(`${root()}/api/show`, {
 							method: "POST",
 							headers: { ...headers, "content-type": "application/json" },
 							body: JSON.stringify({ model: l.id }),

package/src/cli/connect.ts

@@ -4,7 +4,12 @@
  * `<router home>/remote.json` (the omp extensions then run in remote mode and
  * never bind a local router), and configures every harness it finds:
  *
- *   omp         the four extensions are added to ~/.omp/agent/config.yml
+ *   omp         the four extensions are added to ~/.omp/agent/config.yml, and
+ *               the remote is written into ~/.omp/agent/models.yml so
+ *               `auto-model-router/auto` resolves at STARTUP — omp builds the
+ *               main model's handle before extensions load, so without that
+ *               entry only the late-resolved roles (smol, tiny) reach the
+ *               router and the main turns fall back to another provider
  *   Hermes      the provider plugin and the native plugin are copied into
  *               $HERMES_HOME/plugins and .env points them at the remote
  *   Codex       ~/.codex/config.toml gains the auto-model-router provider
@@ -37,6 +42,10 @@ export interface ConnectOptions {
 	home: string;
 	/** Where this package lives (the extensions are referenced from here). */
 	packageDir: string;
+	/** Cost figures omp shows for the remote's virtual models, USD per million tokens. */
+	blend?: { inputPerMtok: number; outputPerMtok: number };
+	/** Adds `X-Agentdox-Scope` to omp's models.yml entry. Machine-wide: only for a single-project machine. */
+	agentdoxScope?: string;
 	platform: string;
 	pathHas: (bin: string) => boolean;
 }
@@ -103,6 +112,90 @@ http_headers = { "X-Omp-Harness" = "codex" }
 `;
 }
 
+/** The models a remote router advertises, and what omp should believe they cost. */
+const REMOTE_MODEL_ROWS: readonly { id: string; name: string }[] = [
+	{ id: "auto", name: "Auto (auto-model-router)" },
+	{ id: "auto-cheap", name: "Auto Cheap (auto-model-router)" },
+	{ id: "auto-max", name: "Auto Max (auto-model-router)" },
+];
+
+const MODELS_YML_BEGIN = "  # BEGIN auto-model-router (remote)";
+const MODELS_YML_END = "  # END auto-model-router (remote)";
+
+/**
+ * omp's `models.yml` entry for a remote router.
+ *
+ * A LOCAL router deliberately never writes this file: its port is ephemeral, so
+ * a persisted entry names a dead socket on the next launch. A remote router has
+ * neither problem — the URL and the key are stable — and the entry is what makes
+ * omp's main model resolvable at startup, before extensions load.
+ *
+ * `scope` adds `X-Agentdox-Scope` to every request through this provider. It is
+ * off by default on purpose: the file is machine-wide, so a scope here would
+ * label turns from every workspace with one project. The extensions still send
+ * the workspace's own scope on the roles that resolve after they load.
+ */
+export function renderRemoteModelsYml(url: string, key: string, blend: { inputPerMtok: number; outputPerMtok: number }, scope = ""): string {
+	const round = (v: number): number => Math.round(v * 1e4) / 1e4;
+	const cost = {
+		input: round(blend.inputPerMtok),
+		output: round(blend.outputPerMtok),
+		cacheRead: round(blend.inputPerMtok * 0.1),
+		cacheWrite: round(blend.inputPerMtok * 1.25),
+	};
+	const lines = [
+		MODELS_YML_BEGIN,
+		"  # Managed by `auto-model-router connect`. Remove this block to stop routing omp through the remote.",
+		"  auto-model-router:",
+		`    baseUrl: ${url.replace(/\/+$/, "")}/v1`,
+		"    api: openai-completions",
+		`    apiKey: ${key}`,
+	];
+	if (scope !== "") lines.push("    headers:", `      X-Agentdox-Scope: ${scope}`);
+	lines.push("    models:");
+	for (const m of REMOTE_MODEL_ROWS) {
+		lines.push(
+			`      - id: ${m.id}`,
+			`        name: ${m.name}`,
+			"        contextWindow: 200000",
+			"        maxTokens: 32000",
+			"        input: [text, image]",
+			`        cost: { input: ${cost.input}, output: ${cost.output}, cacheRead: ${cost.cacheRead}, cacheWrite: ${cost.cacheWrite} }`,
+		);
+	}
+	lines.push(MODELS_YML_END);
+	return lines.join("\n");
+}
+
+/**
+ * Merges the remote block into an existing `models.yml`, replacing a previous
+ * one and leaving every other provider alone. Returns the new file text.
+ */
+export function mergeModelsYml(before: string, blockText: string): string {
+	const eol = before.includes("\r\n") ? "\r\n" : "\n";
+	const body = before.replace(/^\uFEFF/, "");
+	const block = blockText.split("\n").join(eol);
+	const begin = body.indexOf(MODELS_YML_BEGIN);
+	if (begin >= 0) {
+		const endIdx = body.indexOf(MODELS_YML_END, begin);
+		const end = endIdx < 0 ? body.length : endIdx + MODELS_YML_END.length;
+		return `${body.slice(0, begin)}${block}${body.slice(end)}`;
+	}
+	// A provider entry for the same id from an earlier local install would shadow
+	// ours; the caller reports it rather than editing a block it does not own.
+	if (body.trim() === "") return `providers:${eol}${block}${eol}`;
+	if (/^providers:\s*$/m.test(body)) {
+		return body.replace(/^providers:\s*$/m, (m) => `${m}${eol}${block}`);
+	}
+	return `${body.replace(/\s*$/, "")}${eol}providers:${eol}${block}${eol}`;
+}
+
+/** True when the file already defines our provider outside a block we manage. */
+export function hasForeignRouterProvider(text: string): boolean {
+	if (text.includes(MODELS_YML_BEGIN)) return false;
+	return /^\s{2,}auto-model-router:\s*$/m.test(text);
+}
+
 export function connectRemote(o: ConnectOptions): ConnectReport {
 	const report: ConnectReport = { remoteFile: "", configured: [], skipped: [], envLines: [], notes: [] };
 	const write = (path: string, content: string): void => {
@@ -124,7 +217,22 @@ export function connectRemote(o: ConnectOptions): ConnectReport {
 		const before = existsSync(cfgPath) ? readFileSync(cfgPath, "utf8") : "";
 		const after = addExtensions(before, ext);
 		if (after !== before) write(cfgPath, after);
-		report.configured.push(`omp (${cfgPath}; pick auto-model-router/auto as the model)`);
+		// models.yml: what makes the MAIN model resolvable, since omp builds that
+		// handle at startup, before the extensions register anything.
+		const modelsPath = join(agentDir, "models.yml");
+		const modelsBefore = existsSync(modelsPath) ? readFileSync(modelsPath, "utf8") : "";
+		if (hasForeignRouterProvider(modelsBefore)) {
+			report.notes.push(`${modelsPath} already defines an auto-model-router provider by hand; left alone — remove it to let connect manage the remote entry`);
+			report.configured.push(`omp (${cfgPath}; extensions only)`);
+		} else {
+			const modelsAfter = mergeModelsYml(modelsBefore, renderRemoteModelsYml(o.url, o.key, o.blend ?? { inputPerMtok: 1.1, outputPerMtok: 4.4 }, o.agentdoxScope ?? ""));
+			if (modelsAfter !== modelsBefore) {
+				// Never overwrite another provider's work without a way back.
+				if (modelsBefore !== "" && !o.dryRun) writeFileSync(`${modelsPath}.${new Date().toISOString().replaceAll(":", "-")}.bak`, modelsBefore, "utf8");
+				write(modelsPath, modelsAfter);
+			}
+			report.configured.push(`omp (${cfgPath} + ${modelsPath}; auto-model-router/auto is ready to pick)`);
+		}
 	} else report.skipped.push("omp (no ~/.omp/agent)");
 
 	// 3. Hermes
@@ -183,6 +291,7 @@ export function connectRemote(o: ConnectOptions): ConnectReport {
 			report.notes.push(`environment appended to ${rc}; open a new shell or source it`);
 		}
 	} else report.notes.push("add the environment lines to your shell profile, or re-run with --profile");
+	report.notes.push("omp's models.yml now carries the member key; treat that file as a secret");
 	return report;
 }
 
@@ -205,7 +314,10 @@ export async function connectCommand(args: CliArgs): Promise<void> {
 	}
 	// HOME wins when set (Git Bash, WSL, CI) so a caller can redirect every write; the OS profile otherwise.
 	const home = process.env.HOME !== undefined && process.env.HOME !== "" ? process.env.HOME : homedir();
-	const report = connectRemote({ url, key, userId, name, profile: args.flags.has("profile"), dryRun: args.flags.has("dry-run"), only, env: process.env, home, packageDir, platform: process.platform, pathHas });
+	// A single-project machine can label every request; a machine with several
+	// repos should leave it off and let the extensions send the workspace's own.
+	const agentdoxScope = flagString(args, "scope") ?? "";
+	const report = connectRemote({ url, key, userId, name, profile: args.flags.has("profile"), dryRun: args.flags.has("dry-run"), only, env: process.env, home, packageDir, platform: process.platform, pathHas, agentdoxScope });
 	console.log(`${args.flags.has("dry-run") ? "would write" : "wrote"} ${report.remoteFile}${name === "" ? "" : ` for ${name}`}`);
 	for (const c of report.configured) console.log(`  configured ${c}`);
 	for (const s of report.skipped) console.log(`  skipped    ${s}`);

package/src/config/apply.ts

@@ -0,0 +1,66 @@
+/**
+ * Applying config changes to a RUNNING router, in place.
+ *
+ * The rule that makes live reconfiguration possible: every block object keeps
+ * its identity. Consumers hold references into the config — the Ollama client
+ * binds `cfg.ollama`, the OpenRouter client reads `cfg.openrouter.apiKey` per
+ * request — so a change must be written INTO those objects, never by replacing
+ * them. Assigning `cfg.ollama = next` would leave every holder on the old
+ * object, which is exactly why those blocks used to be restart-only.
+ *
+ * Arrays are replaced wholesale: they are read through their parent
+ * (`cfg.filters.allow`) rather than captured, and element-wise patching would
+ * make a shorter list impossible to express.
+ */
+
+import type { RouterConfig } from "./types.ts";
+import type { DeepPartial } from "./load.ts";
+
+type Rec = Record<string, unknown>;
+
+const isPlainObject = (v: unknown): v is Rec => typeof v === "object" && v !== null && !Array.isArray(v);
+
+/**
+ * Writes `source` into `target`, keeping every existing object's identity, and
+ * returns the dotted paths whose value actually changed. Keys absent from
+ * `source` are left alone, so this works for both a full config (a file reload)
+ * and a patch (one dashboard setting).
+ */
+export function assignInPlace(target: Rec, source: Rec, prefix = "", opts: { prune?: boolean } = {}): string[] {
+	const changed: string[] = [];
+	// A whole-config apply (a file reload) must mirror a restart: a knob deleted
+	// from the file goes away rather than lingering at its last live value. A
+	// patch (one setting from a dashboard) touches only what it names.
+	if (opts.prune === true) {
+		for (const key of Object.keys(target)) {
+			if (key in source) continue;
+			delete target[key];
+			changed.push(prefix === "" ? key : `${prefix}.${key}`);
+		}
+	}
+	for (const key of Object.keys(source)) {
+		const path = prefix === "" ? key : `${prefix}.${key}`;
+		const next = source[key];
+		const current = target[key];
+		if (isPlainObject(next) && isPlainObject(current)) {
+			changed.push(...assignInPlace(current, next, path, opts));
+			continue;
+		}
+		if (JSON.stringify(current) === JSON.stringify(next)) continue;
+		// A fresh object (or array) is cloned in, so the caller's patch cannot
+		// alias live config and mutate it from outside later.
+		target[key] = isPlainObject(next) || Array.isArray(next) ? structuredClone(next) : next;
+		changed.push(path);
+	}
+	return changed;
+}
+
+/** `assignInPlace` over a typed config. Returns the dotted paths that changed. */
+export function applyConfigPatch(live: RouterConfig, patch: DeepPartial<RouterConfig>): string[] {
+	return assignInPlace(live as unknown as Rec, patch as Rec);
+}
+
+/** True when any changed path falls inside `block` (`"ollama"` matches `ollama.apiKey`). */
+export function touched(changed: readonly string[], ...blocks: readonly string[]): boolean {
+	return changed.some((c) => blocks.some((b) => c === b || c.startsWith(`${b}.`)));
+}

package/src/config/hot-reload.ts

@@ -29,6 +29,7 @@
 import { existsSync, readFileSync, watch, type FSWatcher } from "node:fs";
 import { parse as parseYaml } from "yaml";
 import { configInputSchema } from "./schema.ts";
+import { assignInPlace } from "./apply.ts";
 import { DEFAULT_CONFIG } from "./defaults.ts";
 import { deepMerge, resolveTilde } from "./load.ts";
 import type { RouterConfig } from "./types.ts";
@@ -97,26 +98,21 @@ export interface WatchConfigOptions {
  * is read at call time and hot-reloads. A bare block name pins the whole
  * block; `block.key` pins one key and lets its siblings through.
  */
+/**
+ * Config a RUNNING router cannot change, because the process is built around it:
+ * the bound socket and the ledger file it opened.
+ *
+ * Everything else now applies live. The upstream keys, the Ollama block and the
+ * agentdox bridge used to be pinned here because they were captured by
+ * construction; they are read (or re-pointed) at call time instead, and the
+ * server re-fetches the catalogs and rebuilds the bridge when they change.
+ */
 export const PINNED_CONFIG_PATHS: readonly string[] = [
 	"server.host",
 	"server.port",
 	"server.apiKey",
 	"server.harnessId",
 	"server.maxConcurrentTurns",
-	"openrouter",
-	"ollama.enabled",
-	"ollama.baseUrl",
-	"ollama.apiKey",
-	"ollama.timeoutMs",
-	"ollama.catalogTtlMs",
-	"ollama.includeLocal",
-	"ollama.prices",
-	"ollama.twins",
-	"ollama.usagePollMs",
-	"ollama.quotaCooldownMs",
-	"ollama.rateLimitCooldownMs",
-	"ollama.planCreditsUsd",
-	"context",
 	"ledger.path",
 ];
 
@@ -125,6 +121,11 @@ export const PINNED_CONFIG_PATHS: readonly string[] = [
  * entries are re-copied from `pinned` after every reload so file edits to
  * construction-captured settings cannot silently diverge: a top-level name
  * pins the whole block, `block.key` pins one key of it.
+ *
+ * "In place" is load-bearing, not an optimisation: consumers hold references
+ * INTO the config (the Ollama client binds `cfg.ollama`), so blocks keep their
+ * identity and only leaves are written. Replacing a block would leave every
+ * holder on the old object — which is what made those blocks restart-only.
  */
 export function watchConfig(
 	path: string,
@@ -159,8 +160,8 @@ export function watchConfig(
 			const block = f.slice(0, dot);
 			frozenKeys.set(block, [...(frozenKeys.get(block) ?? []), f.slice(dot + 1)]);
 		}
-		const changed: string[] = [];
 		const next = result.cfg as unknown as Record<string, unknown>;
+		const staged: Record<string, unknown> = {};
 		const pinnedRec = pinned as unknown as Record<string, unknown>;
 		for (const key of Object.keys(next)) {
 			// Frozen blocks belong to construction: keep the pinned values. A
@@ -176,11 +177,11 @@ export function watchConfig(
 				}
 				value = merged;
 			}
-			const before = JSON.stringify((live as unknown as Record<string, unknown>)[key]);
-			const after = JSON.stringify(value);
-			if (before !== after) changed.push(key);
-			(live as unknown as Record<string, unknown>)[key] = value;
+			staged[key] = value;
 		}
+		// One in-place pass over the whole config: block identity survives, and a
+		// knob deleted from the file reverts, exactly as a restart would leave it.
+		const changed = assignInPlace(live as unknown as Record<string, unknown>, staged, "", { prune: true });
 		if (changed.length > 0) opts.onReload?.({ changed });
 	};
 

package/src/context/index.ts

@@ -1,6 +1,7 @@
 /**
  * Bridge factory. Returns the inert bridge unless agentdox is fully
- * configured, so every call site can stay unconditional.
+ * configured, so every call site can stay unconditional — and stays
+ * reconfigurable, so those settings can change while the router runs.
  */
 
 import type { Database } from "bun:sqlite";
@@ -17,7 +18,47 @@ export { createContextBridge, createDisabledBridge } from "./bridge.ts";
 export { createContextStore } from "./store.ts";
 export { createAgentDoxClient } from "./agentdox.ts";
 
-export function createBridgeFromConfig(cfg: RouterConfig, db: Database): ContextBridge {
+/** A bridge that can be pointed at different agentdox settings while the router runs. */
+export interface ReloadableContextBridge extends ContextBridge {
+	/**
+	 * Applies the config's current `context` block: the URL, token, limits or the
+	 * enabled flag may all have changed. Queued write-backs are drained first, so
+	 * nothing recorded against the old settings is lost.
+	 */
+	reconfigure(): Promise<void>;
+}
+
+/**
+ * The bridge the server runs with. It follows `cfg.context` for the life of the
+ * process: `reconfigure()` rebuilds the inner bridge from whatever the config
+ * now says, including off→on and on→off, so agentdox settings never need a
+ * restart. The block store is the database, not the bridge, so a rebuild keeps
+ * every pinned block and session binding.
+ */
+export function createBridgeFromConfig(cfg: RouterConfig, db: Database): ReloadableContextBridge {
+	let inner = buildBridge(cfg, db);
+	return {
+		get enabled() {
+			return inner.enabled;
+		},
+		resolve: (input) => inner.resolve(input),
+		recordTurn: (rec) => {
+			inner.recordTurn(rec);
+		},
+		flush: () => inner.flush(),
+		pruneBlocks: (maxAgeMs) => inner.pruneBlocks(maxAgeMs),
+		close: () => {
+			inner.close();
+		},
+		async reconfigure() {
+			await inner.flush();
+			inner.close();
+			inner = buildBridge(cfg, db);
+		},
+	};
+}
+
+function buildBridge(cfg: RouterConfig, db: Database): ContextBridge {
 	const c = cfg.context;
 	if (!c.enabled || c.baseUrl === "" || c.token === "") return createDisabledBridge();
 	const log = createLogger(cfg.logLevel);

package/src/index.ts

@@ -26,7 +26,7 @@ Usage: auto-model-router <command> [options]
   stats      Show routed spend, per-model share, and escalation rates
   report     Usage analytics: providers, models, tiers, cost, speed, cache hit rate
   export     One row per day, harness and model as CSV (--json for rows)
-  connect    Point this machine at a remote router (--url, --key; --profile persists the environment)
+  connect    Point this machine at a remote router (--url, --key; --scope labels a single-project machine; --profile persists the environment)
   models     Show what each complexity tier would consider, and why
   explain    Route a saved request without dispatching it, and explain the decision
   config     Interactive wizard over the router's own config.yml

package/src/lib.ts

@@ -12,10 +12,11 @@
  *   await router.stop();
  */
 
-export { startServer, type StartedServer } from "./server/http.ts";
+export { startServer, type ReconfigureResult, type StartedServer } from "./server/http.ts";
 export { loadConfig, apiKeySource } from "./config/load.ts";
 export { DEFAULT_CONFIG } from "./config/defaults.ts";
 export type { RouterConfig } from "./config/types.ts";
+export type { DeepPartial } from "./config/load.ts";
 export { buildUsageReport, renderUsageReport, type UsageReport, type ReportTotals } from "./cost/report.ts";
 export { buildDailySummary, renderDailySummary, type DailySummary } from "./cost/summary.ts";
 export { openDb } from "./util/sqlite.ts";

package/src/server/http.ts

@@ -20,6 +20,8 @@ import { UpstreamError } from "../upstream/types.ts";
 import { apiKeySource, ollamaKeySource } from "../config/load.ts";
 import { ollamaMeter } from "../upstream/ollama-usage.ts";
 import { routerConfigPath } from "../cli/config-cmd.ts";
+import { applyConfigPatch, touched } from "../config/apply.ts";
+import type { DeepPartial } from "../config/load.ts";
 import { PINNED_CONFIG_PATHS, watchConfig } from "../config/hot-reload.ts";
 import type { RouterConfig } from "../config/types.ts";
 import { createLogger } from "../util/log.ts";
@@ -35,9 +37,33 @@ import { runTurn } from "./turn.ts";
 export interface StartedServer {
 	// No websocket upgrade path, so the Server payload type is `undefined`.
 	server: Server<undefined>;
+	/**
+	 * Applies a config change to the RUNNING router and reports the dotted paths
+	 * that changed. Everything a turn reads through the config (tiers, filters,
+	 * budgets, provider keys) takes effect on the next turn; the pieces built
+	 * from config — the agentdox bridge, the catalogs — are re-pointed here. No
+	 * socket closes and no turn in flight is cut.
+	 *
+	 * `server.*` and `ledger.path` are the exceptions: the listener and the
+	 * database file are the process. Changing those still means a restart, and
+	 * they are rejected rather than half-applied.
+	 */
+	reconfigure(patch: DeepPartial<RouterConfig>): Promise<ReconfigureResult>;
 	stop(): Promise<void>;
 }
 
+export interface ReconfigureResult {
+	/** Dotted config paths whose value changed. */
+	changed: string[];
+	/** Paths that were refused because they belong to construction (`server.*`, `ledger.path`). */
+	rejected: string[];
+	/** True when an upstream changed and a catalog re-fetch was started in the background. */
+	catalogRefreshing: boolean;
+}
+
+/** Config a running router cannot change: the bound socket and the ledger file. */
+const RESTART_ONLY_PATHS: readonly string[] = ["server", "ledger.path"];
+
 export interface ModelSpendRow {
 	slug: string;
 	requests: number;
@@ -200,7 +226,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 	if (cfg.ledger.path !== ":memory:") mkdirSync(dirname(cfg.ledger.path), { recursive: true });
 	const db = openDb(cfg.ledger.path);
 	const ledger = createLedger(db, cfg);
-	const { upstream, catalog, ollama, ollamaUsage, ollamaCostScale } = createProviders(cfg, db, log);
+	const { upstream, catalog, ollama, ollamaServing, ollamaUsage, ollamaCostScale } = createProviders(cfg, db, log);
 	const conversations = createConversationStore(db);
 	const router = createRouter({ config: cfg, catalog, ledger, conversations, upstream });
 	const context = createBridgeFromConfig(cfg, db);
@@ -225,6 +251,8 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		{
 			onReload: ({ changed }) => {
 				log.info("config reloaded", { changed: changed.join(", ") });
+				// The file is a config change like any other: same live application.
+				void applyLive(changed).catch((err: unknown) => log.warn("applying the reloaded config failed", { error: err instanceof Error ? err.message : String(err) }));
 			},
 			onError: (message) => {
 				log.warn("config reload rejected; keeping the running config", { error: message });
@@ -241,10 +269,10 @@ export function startServer(cfg: RouterConfig): StartedServer {
 	}
 
 	if (cfg.openrouter.apiKey === "") {
-		if (ollama !== null) log.warn("no OpenRouter key: routing over Ollama Cloud models only (OpenRouter's catalog is read for metadata, never served)");
+		if (cfg.ollama.enabled) log.warn("no OpenRouter key: routing over Ollama Cloud models only (OpenRouter's catalog is read for metadata, never served)");
 		else log.warn("OPENROUTER_API_KEY is not set and Ollama is off; /v1/chat/completions will fail at dispatch time");
 	}
-	if (ollama !== null) {
+	if (cfg.ollama.enabled) {
 		log.info("ollama cloud upstream enabled", {
 			baseUrl: cfg.ollama.baseUrl,
 			// Provenance only; never the key itself.
@@ -509,7 +537,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 					const meter = ollamaMeter(ollamaUsage.peek(), cfg.ollama.planCreditsUsd);
 					const runway = ollamaRunway(meter, ledger.providerSpendSince?.("ollama/", Date.now() - 7 * 86_400_000) ?? 0, ollamaUsage.calibration()?.factor ?? 1);
 					const ollamaSummary: SummaryOllama | null =
-						ollama === null || meter === null ? null : { plan: meter.plan ?? null, usedUsd: meter.usedUsd, creditsUsd: meter.creditsUsd, runwayDays: runway?.days ?? null };
+						!cfg.ollama.enabled || meter === null ? null : { plan: meter.plan ?? null, usedUsd: meter.usedUsd, creditsUsd: meter.creditsUsd, runwayDays: runway?.days ?? null };
 					const summary = buildDailySummary(db, {
 						harnessId,
 						baselines: baselinePrices(cfg.report.baselines, (s) => catalog.find(s)),
@@ -611,7 +639,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 						apiKeyConfigured: cfg.openrouter.apiKey !== "",
 						// Which upstreams turns can actually be served from: OpenRouter needs
 						// its key; Ollama needs to be on and out of cooldown.
-						serving: [...(cfg.openrouter.apiKey !== "" ? ["openrouter"] : []), ...(ollama !== null && ollama.available() ? ["ollama"] : [])],
+						serving: [...(cfg.openrouter.apiKey !== "" ? ["openrouter"] : []), ...(ollamaServing() ? ["ollama"] : [])],
 						// Provenance only; never the key itself.
 						apiKeySource: apiKeySource(cfg).source,
 						// Provenance only; never the agentdox token itself.
@@ -621,7 +649,7 @@ export function startServer(cfg: RouterConfig): StartedServer {
 						// Never the key. `available` is the circuit breaker: false while a
 						// 402/429 cooldown routes every turn around Ollama.
 						ollama:
-							ollama === null
+							!cfg.ollama.enabled
 								? null
 								: {
 										baseUrl: cfg.ollama.baseUrl,
@@ -665,8 +693,57 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		},
 	});
 
+	/**
+	 * The one place that turns a config change into a live router. The watcher
+	 * (file edits) and `reconfigure` (an embedder, e.g. the team edition) both
+	 * come through here, so the two can never drift apart.
+	 */
+	async function applyLive(changed: readonly string[]): Promise<boolean> {
+		if (changed.length === 0) return false;
+		if (touched(changed, "context")) {
+			await context.reconfigure();
+			log.info("agentdox bridge reconfigured", {
+				enabled: context.enabled,
+				url: cfg.context.baseUrl === "" ? "(none)" : cfg.context.baseUrl,
+				defaultScope: cfg.context.defaultScope === "" ? "(per-request header only)" : cfg.context.defaultScope,
+			});
+		}
+		if (!touched(changed, "openrouter", "ollama")) return false;
+		// A key change makes the catalog key-scoped (or not), and enabling Ollama adds
+		// its models: the snapshot is rebuilt before the next turn ranks. Started, not
+		// awaited — the caller is a settings save, not a network client, and the
+		// previous snapshot serves turns until the new one lands.
+		void catalog
+			.refresh()
+			.then((snap) => log.info("catalog refreshed after an upstream change", { models: snap.models.length, ollama: cfg.ollama.enabled }))
+			.catch((err: unknown) => log.warn("catalog refresh after an upstream change failed; the previous snapshot stands", { error: err instanceof Error ? err.message : String(err) }));
+		return true;
+	}
+
 	return {
 		server,
+		async reconfigure(patch) {
+			const rejected: string[] = [];
+			const rec = patch as Record<string, unknown>;
+			for (const block of RESTART_ONLY_PATHS) {
+				const [head, key] = block.split(".") as [string, string | undefined];
+				const value = rec[head];
+				if (value === undefined) continue;
+				if (key === undefined) rejected.push(head);
+				else if ((value as Record<string, unknown>)[key] !== undefined) rejected.push(block);
+			}
+			const safe = structuredClone(rec);
+			for (const block of rejected) {
+				const [head, key] = block.split(".") as [string, string | undefined];
+				if (key === undefined) delete safe[head];
+				else delete (safe[head] as Record<string, unknown>)[key];
+			}
+			const changed = applyConfigPatch(cfg, safe as DeepPartial<RouterConfig>);
+			const catalogRefreshing = await applyLive(changed);
+			if (changed.length > 0) log.info("config reconfigured", { changed: changed.join(", ") });
+			if (rejected.length > 0) log.warn("config change needs a restart; not applied", { paths: rejected.join(", ") });
+			return { changed, rejected, catalogRefreshing };
+		},
 		stop: async () => {
 			configWatcher.close();
 			clearInterval(pruneTimer);

package/src/server/providers.ts

@@ -13,7 +13,7 @@ import type { RouterConfig } from "../config/types.ts";
 import { createMultiUpstream } from "../upstream/multi.ts";
 import { createOllamaClient, type OllamaClient } from "../upstream/ollama.ts";
 import { createLedger } from "../cost/ledger.ts";
-import { createOllamaUsageSource, NO_USAGE, type OllamaUsageSource } from "../upstream/ollama-usage.ts";
+import { createOllamaUsageSource, type OllamaUsageSource } from "../upstream/ollama-usage.ts";
 import { createOpenRouterClient } from "../upstream/openrouter.ts";
 import type { UpstreamClient } from "../upstream/types.ts";
 import { createLogger, type Logger } from "../util/log.ts";
@@ -21,8 +21,10 @@ import { createLogger, type Logger } from "../util/log.ts";
 export interface Providers {
 	upstream: UpstreamClient;
 	catalog: CatalogSource & { ollamaModels?(): unknown[]; ollamaBias?(): number };
-	/** Non-null when Ollama Cloud is enabled; carries the circuit breaker. */
-	ollama: OllamaClient | null;
+	/** Always present: it carries the circuit breaker. Whether it SERVES follows `cfg.ollama.enabled`. */
+	ollama: OllamaClient;
+	/** True while Ollama Cloud is enabled and out of cooldown, read live. */
+	ollamaServing(): boolean;
 	/** Plan usage reader; inert without a key. */
 	ollamaUsage: OllamaUsageSource;
 	/** Multiplier that brings the ledger's Ollama estimate in line with the plan meter; 1 until calibrated. */
@@ -32,15 +34,18 @@ export interface Providers {
 export function createProviders(cfg: RouterConfig, db: Database, log: Logger = createLogger(cfg.logLevel)): Providers {
 	const openrouter = createOpenRouterClient(cfg);
 	const openrouterCatalog = createCatalog(cfg, openrouter, db);
-	if (!cfg.ollama.enabled) return { upstream: openrouter, catalog: openrouterCatalog, ollama: null, ollamaUsage: NO_USAGE, ollamaCostScale: () => 1 };
 	// Ollama Cloud is a second upstream ranked in the same catalog: `ollama/…`
-	// slugs dispatch to it, everything else to OpenRouter.
+	// slugs dispatch to it, everything else to OpenRouter. It is always built, and
+	// `ollama.enabled` decides per call whether it serves — so turning it on or off
+	// in a running router is a config change, not a restart. Nothing is fetched
+	// from it while it is off.
 	const ollama = createOllamaClient(cfg);
+	const ollamaServing = (): boolean => cfg.ollama.enabled && ollama.available();
 	// Plan usage lives on ollama.com whichever base URL dispatches; it needs the
 	// key, so the daemon path without `/login ollama-cloud` keeps a static bias.
 	const ledgerForCalibration = createLedger(db, cfg);
 	const ollamaUsage = createOllamaUsageSource({
-		apiKey: cfg.ollama.apiKey,
+		apiKey: () => cfg.ollama.apiKey,
 		pollMs: cfg.ollama.usagePollMs,
 		timeoutMs: Math.min(cfg.ollama.timeoutMs, 15_000),
 		log,
@@ -50,7 +55,7 @@ export function createProviders(cfg: RouterConfig, db: Database, log: Logger = c
 	});
 	return {
 		upstream: createMultiUpstream(openrouter, ollama),
-		catalog: createCompositeCatalog(openrouterCatalog, createOllamaCatalog(cfg.ollama, log, fetch, db), ollama, {
+		catalog: createCompositeCatalog(openrouterCatalog, createOllamaCatalog(cfg.ollama, log, fetch, db), { available: ollamaServing, cooldownUntilMs: () => ollama.cooldownUntilMs(), lastTrip: () => ollama.lastTrip() }, {
 			costBias: cfg.ollama.costBias,
 			biasUntilUsage: cfg.ollama.biasUntilUsage,
 			usage: ollamaUsage,
@@ -58,6 +63,7 @@ export function createProviders(cfg: RouterConfig, db: Database, log: Logger = c
 			serveOpenRouter: () => cfg.openrouter.apiKey !== "",
 		}),
 		ollama,
+		ollamaServing,
 		ollamaUsage,
 		ollamaCostScale: () => ollamaUsage.calibration()?.factor ?? 1,
 	};

package/src/server/turn.ts

@@ -93,13 +93,21 @@ function lastUserText(req: NormRequest): string {
 	return "";
 }
 
-/** Session title: the conversation's opening ask, truncated. */
+/**
+ * Session title: the conversation's opening ask, truncated.
+ *
+ * Read through `userContent`, the same filter the recorded user message uses:
+ * a harness wraps the first message in reminders (omp opens with a
+ * `<system-reminder>` naming the date and cwd), and titling a session with that
+ * wrapper both reads as noise in agentdox and is re-injected into later context
+ * assembly, which lists session titles.
+ */
 function sessionTitle(req: NormRequest): string {
 	for (const m of req.messages) {
-		if (m.role === "user" && m.text.trim() !== "") {
-			const t = m.text.trim().replace(/\s+/g, " ");
-			return t.length > 80 ? `${t.slice(0, 79)}…` : t;
-		}
+		if (m.role !== "user") continue;
+		const t = userContent(m.text);
+		if (t === "") continue;
+		return t.length > 80 ? `${t.slice(0, 79)}…` : t;
 	}
 	return `omp ${req.conversationKey.slice(0, 8)}`;
 }

package/src/upstream/ollama-usage.ts

@@ -166,9 +166,11 @@ export interface CalibrationDeps {
 }
 
 export function createOllamaUsageSource(
-	opts: { apiKey: string; pollMs: number; timeoutMs: number; log: Logger; fetchImpl?: FetchLike; root?: string; calibration?: CalibrationDeps },
+	opts: { apiKey: () => string; pollMs: number; timeoutMs: number; log: Logger; fetchImpl?: FetchLike; root?: string; calibration?: CalibrationDeps },
 ): OllamaUsageSource {
-	if (opts.apiKey === "" || opts.pollMs <= 0) return NO_USAGE;
+	// Only the poll interval is structural. A key that is empty now may be set from
+	// the dashboard later, so the reader stays live and simply idles until it is.
+	if (opts.pollMs <= 0) return NO_USAGE;
 	const cal = opts.calibration;
 	const insertSample = cal === undefined ? null : cal.db.query("INSERT OR REPLACE INTO ollama_meter_samples (at_ms, meter_usd, ledger_usd) VALUES (?, ?, ?)");
 	const readSamples = cal === undefined ? null : cal.db.query("SELECT at_ms, meter_usd, ledger_usd FROM ollama_meter_samples WHERE at_ms >= ? ORDER BY at_ms ASC");
@@ -199,7 +201,7 @@ export function createOllamaUsageSource(
 		try {
 			const res = await fetchImpl(`${root}/api/me`, {
 				method: "POST",
-				headers: { authorization: `Bearer ${opts.apiKey}` },
+				headers: { authorization: `Bearer ${opts.apiKey()}` },
 				signal: AbortSignal.timeout(opts.timeoutMs),
 			});
 			if (res.ok) {
@@ -222,7 +224,7 @@ export function createOllamaUsageSource(
 		await refreshPlan();
 		try {
 			const res = await fetchImpl(`${root}/api/usage`, {
-				headers: { authorization: `Bearer ${opts.apiKey}` },
+				headers: { authorization: `Bearer ${opts.apiKey()}` },
 				signal: AbortSignal.timeout(opts.timeoutMs),
 			});
 			if (res.ok) {
@@ -253,6 +255,7 @@ export function createOllamaUsageSource(
 
 	return {
 		async get() {
+			if (opts.apiKey() === "") return null;
 			if (Date.now() - checkedAtMs < opts.pollMs) return current;
 			inflight ??= refresh().finally(() => {
 				inflight = null;

package/src/upstream/ollama.ts

@@ -129,7 +129,9 @@ export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>
 
 export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fetch): OllamaClient {
 	const o = cfg.ollama;
-	const baseUrl = o.baseUrl.replace(/\/+$/, "");
+	// Read per call, not captured: `o` is the live config block, so a base URL
+	// changed while the router runs takes effect on the next dispatch.
+	const baseUrl = (): string => o.baseUrl.replace(/\/+$/, "");
 	const log = createLogger(cfg.logLevel);
 	let cooldownUntil = 0;
 	let lastTrip: { kind: UpstreamErrorKind; atMs: number; message: string } | null = null;
@@ -189,7 +191,7 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 			const body = toOllamaBody({ ...opts.body, stream: true });
 			let res: Response;
 			try {
-				res = await fetchImpl(`${baseUrl}/chat/completions`, {
+				res = await fetchImpl(`${baseUrl()}/chat/completions`, {
 					method: "POST",
 					headers: headers(),
 					body: JSON.stringify(body),
@@ -237,7 +239,7 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 		async complete(body: Record<string, unknown>, signal: AbortSignal): Promise<{ text: string; costUsd: number | null }> {
 			let res: Response;
 			try {
-				res = await fetchImpl(`${baseUrl}/chat/completions`, {
+				res = await fetchImpl(`${baseUrl()}/chat/completions`, {
 					method: "POST",
 					headers: headers(),
 					body: JSON.stringify(toOllamaBody({ ...body, stream: false })),
@@ -258,7 +260,7 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 		async fetchModels(signal?: AbortSignal): Promise<unknown[]> {
 			let res: Response;
 			try {
-				res = await fetchImpl(`${baseUrl}/models`, { headers: headers(), signal: composeSignal(signal) });
+				res = await fetchImpl(`${baseUrl()}/models`, { headers: headers(), signal: composeSignal(signal) });
 			} catch (err) {
 				throw transportError(err);
 			}

package/test/hot-reload.test.ts

@@ -87,7 +87,7 @@ describe("watchConfig", () => {
 		writeFileSync(CFG, yamlOf({ tiers: { hard: { capabilityFloorUsd: 0.35 } } }));
 		await settle();
 		expect(live.tiers.hard.capabilityFloorUsd).toBe(0.35);
-		expect(reloads.flat()).toContain("tiers");
+		expect(reloads.flat()).toContain("tiers.hard.capabilityFloorUsd");
 	});
 
 	test("a second edit replaces the value and reverting restores the default", async () => {
@@ -138,7 +138,7 @@ describe("watchConfig pins by path", () => {
 	beforeAll(() => {
 		writeFileSync(CFG2, "");
 		const pinned = structuredClone(DEFAULT_CONFIG);
-		pinned.ollama.apiKey = "pinned-key";
+		pinned.server.port = 8788;
 		watcher = watchConfig(CFG2, live, pinned, PINNED_CONFIG_PATHS);
 	});
 	afterAll(() => watcher?.close());
@@ -148,7 +148,8 @@ describe("watchConfig pins by path", () => {
 		await settle();
 		expect(live.ollama.costBias).toBe(0.25);
 		expect(live.ollama.biasUntilUsage).toBe(0.5);
-		expect(live.ollama.apiKey).toBe("pinned-key");
+		// The upstream key is no longer pinned: the router re-points its clients instead.
+		expect(live.ollama.apiKey).toBe("from-file");
 		expect(live.server.port).toBe(DEFAULT_CONFIG.server.port);
 		expect(live.server.subagentProfile).toBe("auto");
 		expect(live.ledger.retentionDays).toBe(30);

package/test/ollama.test.ts

@@ -521,7 +521,7 @@ describe("ollama plan usage (credit-aware bias)", () => {
 			if (fail) return new Response("down", { status: 503 });
 			return Response.json({ ...PAYLOAD, limits: { monthly: { usage: 42, models: [] } } });
 		};
-		const src = createOllamaUsageSource({ apiKey: "k", pollMs: 20, timeoutMs: 1000, log, fetchImpl });
+		const src = createOllamaUsageSource({ apiKey: () => "k", pollMs: 20, timeoutMs: 1000, log, fetchImpl });
 		expect(src.peek()).toBeNull();
 		expect((await src.get())?.monthlyUsedFraction).toBeCloseTo(0.42, 6);
 		expect(src.peek()?.plan).toBe("pro");
@@ -531,7 +531,21 @@ describe("ollama plan usage (credit-aware bias)", () => {
 		await new Promise((r) => setTimeout(r, 120)); // well past the 20ms poll interval
 		expect((await src.get())?.monthlyUsedFraction).toBeCloseTo(0.42, 6); // last good reading survives a 503
 		expect(calls).toBe(2);
-		expect(createOllamaUsageSource({ apiKey: "", pollMs: 50, timeoutMs: 1000, log, fetchImpl })).toBe(NO_USAGE);
+		expect(createOllamaUsageSource({ apiKey: () => "k", pollMs: 0, timeoutMs: 1000, log, fetchImpl })).toBe(NO_USAGE);
+		// A key that is empty NOW is not structural: the reader idles and starts polling once one is set,
+		// which is what lets a key added from a dashboard work without restarting the router.
+		let liveKey = "";
+		let polls = 0;
+		const laterFetch = async (url: string): Promise<Response> => {
+			polls++;
+			if (url === "https://ollama.com/api/me") return Response.json({ ID: "x", Email: "e", Plan: "Pro" });
+			return Response.json({ ...PAYLOAD, limits: { monthly: { usage: 42, models: [] } } });
+		};
+		const later = createOllamaUsageSource({ apiKey: () => liveKey, pollMs: 1, timeoutMs: 1000, log, fetchImpl: laterFetch });
+		expect(await later.get()).toBeNull();
+		expect(polls).toBe(0); // no key, no network
+		liveKey = "k";
+		expect((await later.get())?.monthlyUsedFraction).toBeCloseTo(0.42, 5);
 	});
 
 	test("the composite snapshot carries the live bias and re-merges when it flips", async () => {
@@ -623,7 +637,7 @@ describe("ollama calibration", () => {
 			if (url.endsWith("/api/me")) return Response.json({ Plan: "pro" });
 			return Response.json({ limits: { monthly: { usage: frac, models: [] } } });
 		};
-		const src = createOllamaUsageSource({ apiKey: "k", pollMs: 5, timeoutMs: 1000, log, fetchImpl, calibration: { db, ledgerUsd: () => ledgerUsd, planCreditsOverrideUsd: 0 } });
+		const src = createOllamaUsageSource({ apiKey: () => "k", pollMs: 5, timeoutMs: 1000, log, fetchImpl, calibration: { db, ledgerUsd: () => ledgerUsd, planCreditsOverrideUsd: 0 } });
 		await src.get(); // meter $6 (10% of $60), ledger $1
 		expect(src.calibration()).toBeNull(); // one sample
 		await new Promise((r) => setTimeout(r, 20));

package/test/reconfigure.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, test } from "bun:test";
+import { applyConfigPatch, assignInPlace, touched } from "../src/config/apply.ts";
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import type { RouterConfig } from "../src/config/types.ts";
+import { startServer } from "../src/server/http.ts";
+
+/**
+ * Live reconfiguration: a running router follows a config change without a
+ * restart. The socket stays bound, turns in flight are untouched, and the
+ * pieces that used to be captured at construction (upstream clients, the
+ * catalogs, the agentdox bridge) are re-pointed instead.
+ */
+
+describe("applying config in place", () => {
+	test("blocks keep their identity, only leaves change, and the changed paths come back dotted", () => {
+		const cfg = structuredClone(DEFAULT_CONFIG);
+		const ollamaRef = cfg.ollama; // what a client binds at construction
+		const changed = applyConfigPatch(cfg, { ollama: { enabled: true, apiKey: "k" } });
+		expect(changed.sort()).toEqual(["ollama.apiKey", "ollama.enabled"]);
+		expect(cfg.ollama).toBe(ollamaRef); // the holder sees the new values
+		expect(ollamaRef.apiKey).toBe("k");
+		// An unchanged value is not reported, so nothing rebuilds for nothing.
+		expect(applyConfigPatch(cfg, { ollama: { apiKey: "k" } })).toEqual([]);
+	});
+
+	test("a patch touches only what it names; a full apply prunes what the source dropped", () => {
+		const target: Record<string, unknown> = { a: { x: 1, y: 2 }, b: 3 };
+		expect(assignInPlace(target, { a: { x: 9 } })).toEqual(["a.x"]);
+		expect(target).toEqual({ a: { x: 9, y: 2 }, b: 3 });
+		expect(assignInPlace(target, { a: { x: 9 } }, "", { prune: true }).sort()).toEqual(["a.y", "b"]);
+		expect(target).toEqual({ a: { x: 9 } });
+	});
+
+	test("a patch cannot alias live config", () => {
+		const cfg = structuredClone(DEFAULT_CONFIG);
+		const patch = { filters: { allow: ["a/b"] } };
+		applyConfigPatch(cfg, patch);
+		patch.filters.allow.push("c/d");
+		expect(cfg.filters.allow).toEqual(["a/b"]);
+	});
+
+	test("touched matches a block and its keys", () => {
+		expect(touched(["ollama.apiKey"], "ollama")).toBe(true);
+		expect(touched(["context"], "context")).toBe(true);
+		expect(touched(["filters.allow"], "openrouter", "ollama")).toBe(false);
+	});
+});
+
+describe("a running server reconfigures", () => {
+	const base = (): RouterConfig => ({
+		...structuredClone(DEFAULT_CONFIG),
+		server: { ...DEFAULT_CONFIG.server, host: "127.0.0.1", port: 0, apiKey: "rk" },
+		ledger: { ...DEFAULT_CONFIG.ledger, path: ":memory:" },
+		// No network at boot: an empty key keeps the catalog fetch keyless and cheap,
+		// and this test never dispatches a turn.
+		openrouter: { ...DEFAULT_CONFIG.openrouter, apiKey: "" },
+	});
+
+	test("provider keys, Ollama and the agentdox bridge all change while the socket stays bound", async () => {
+		const cfg = base();
+		const started = startServer(cfg);
+		const port = started.server.port;
+		const H = { authorization: "Bearer rk" };
+		try {
+			const health1 = (await (await fetch(`http://127.0.0.1:${port}/health`, { headers: H })).json()) as { apiKeyConfigured: boolean; serving: string[]; agentdox: unknown; ollama: unknown };
+			expect(health1.apiKeyConfigured).toBe(false);
+			expect(health1.serving).toEqual([]);
+			expect(health1.agentdox).toBeNull();
+			expect(health1.ollama).toBeNull();
+
+			// One call turns on both upstreams and the bridge.
+			const r = await started.reconfigure({
+				openrouter: { apiKey: "sk-or-live" },
+				ollama: { enabled: true, apiKey: "ol-live", baseUrl: "https://ollama.com/v1" },
+				context: { enabled: true, baseUrl: "http://127.0.0.1:1/never", token: "t", defaultScope: "demo" },
+			});
+			expect(r.rejected).toEqual([]);
+			expect(r.catalogRefreshing).toBe(true); // started in the background, not awaited
+			expect(r.changed).toContain("openrouter.apiKey");
+			expect(r.changed).toContain("ollama.enabled");
+			expect(r.changed).toContain("context.enabled");
+			expect(cfg.openrouter.apiKey).toBe("sk-or-live");
+
+			const health2 = (await (await fetch(`http://127.0.0.1:${port}/health`, { headers: H })).json()) as { apiKeyConfigured: boolean; serving: string[]; agentdox: { url: string; defaultScope: string } | null; ollama: { baseUrl: string } | null };
+			expect(started.server.port).toBe(port); // same socket, never rebound
+			expect(health2.apiKeyConfigured).toBe(true);
+			expect(health2.serving).toContain("openrouter");
+			expect(health2.serving).toContain("ollama");
+			expect(health2.agentdox).toMatchObject({ url: "http://127.0.0.1:1/never", defaultScope: "demo" });
+			expect(health2.ollama).toMatchObject({ baseUrl: "https://ollama.com/v1" });
+
+			// And back off again: the bridge goes inert and Ollama stops serving.
+			const off = await started.reconfigure({ ollama: { enabled: false }, context: { enabled: false } });
+			expect(off.changed.sort()).toEqual(["context.enabled", "ollama.enabled"]);
+			const health3 = (await (await fetch(`http://127.0.0.1:${port}/health`, { headers: H })).json()) as { serving: string[]; agentdox: unknown; ollama: unknown };
+			expect(health3.serving).toEqual(["openrouter"]);
+			expect(health3.agentdox).toBeNull();
+			expect(health3.ollama).toBeNull();
+		} finally {
+			await started.stop();
+		}
+	});
+
+	test("the socket and the ledger file are refused rather than half-applied", async () => {
+		const cfg = base();
+		const started = startServer(cfg);
+		const port = started.server.port;
+		try {
+			const r = await started.reconfigure({ server: { port: 1 }, ledger: { path: "/tmp/other.db", retentionDays: 9 }, filters: { latencyWeight: 0.42 } });
+			expect(r.rejected.sort()).toEqual(["ledger.path", "server"]);
+			expect(cfg.server.port).toBe(0);
+			expect(cfg.ledger.path).toBe(":memory:");
+			expect(started.server.port).toBe(port);
+			// Everything else in the same call still applied.
+			expect(cfg.filters.latencyWeight).toBe(0.42);
+			expect(cfg.ledger.retentionDays).toBe(9);
+			expect(r.changed).toContain("filters.latencyWeight");
+		} finally {
+			await started.stop();
+		}
+	});
+});

package/test/remote.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 
 import { addExtensions, codexBlock, connectRemote, setDotenv, type ConnectOptions } from "../src/cli/connect.ts";
 import { parseRemoteRouter, readRemoteRouter, remoteProviderRegistration } from "../omp-extension/remote-logic.ts";
+import { hasForeignRouterProvider, mergeModelsYml, renderRemoteModelsYml } from "../src/cli/connect.ts";
 
 /**
  * Remote mode: remote.json puts the omp extensions on a router elsewhere,
@@ -102,3 +103,47 @@ describe("connect", () => {
 		rmSync(h2, { recursive: true, force: true });
 	});
 });
+
+describe("omp models.yml for a remote router", () => {
+	const BLEND = { inputPerMtok: 1.1, outputPerMtok: 4.4 };
+	const NL = String.fromCharCode(10);
+	const yaml = (...lines: string[]): string => lines.join(NL) + NL;
+
+	test("the block names the remote, the key and the three virtual models; a scope is opt-in", () => {
+		const block = renderRemoteModelsYml("https://team.example/", "amrt_k", BLEND);
+		expect(block).toContain("baseUrl: https://team.example/v1");
+		expect(block).toContain("apiKey: amrt_k");
+		expect(block).toContain("- id: auto");
+		expect(block).toContain("- id: auto-cheap");
+		expect(block).toContain("- id: auto-max");
+		expect(block).toContain("cost: { input: 1.1, output: 4.4, cacheRead: 0.11, cacheWrite: 1.375 }");
+		// Machine-wide file: no scope unless the caller asks for one.
+		expect(block).not.toContain("X-Agentdox-Scope");
+		expect(renderRemoteModelsYml("https://team.example", "k", BLEND, "omp-router")).toContain("X-Agentdox-Scope: omp-router");
+	});
+
+	test("merging keeps other providers, replaces our own block, and is idempotent", () => {
+		const block = renderRemoteModelsYml("https://team.example", "k1", BLEND);
+		const empty = mergeModelsYml("", block);
+		expect(empty.startsWith("providers:")).toBe(true);
+		expect(mergeModelsYml(empty, block)).toBe(empty);
+
+		const existing = yaml("providers:", "  openai:", "    apiKey: sk-x");
+		const merged = mergeModelsYml(existing, block);
+		expect(merged).toContain("openai:");
+		expect(merged).toContain("baseUrl: https://team.example/v1");
+
+		// A later connect with a new key replaces the block in place, not a second copy.
+		const rekeyed = mergeModelsYml(merged, renderRemoteModelsYml("https://team.example", "k2", BLEND));
+		expect(rekeyed).toContain("apiKey: k2");
+		expect(rekeyed).not.toContain("apiKey: k1");
+		expect(rekeyed.match(/auto-model-router:/g)).toHaveLength(1);
+		expect(rekeyed).toContain("openai:");
+	});
+
+	test("a hand-written provider of the same name is left alone", () => {
+		expect(hasForeignRouterProvider(yaml("providers:", "  auto-model-router:", "    baseUrl: http://127.0.0.1:1/v1"))).toBe(true);
+		expect(hasForeignRouterProvider(mergeModelsYml("", renderRemoteModelsYml("https://t", "k", BLEND)))).toBe(false);
+		expect(hasForeignRouterProvider(yaml("providers:", "  openai: {}"))).toBe(false);
+	});
+});