create-oke 0.18.4 → 0.19.0

package/src/cli.test.ts

@@ -282,24 +282,24 @@ describe("wizard ← Back", () => {
 });
 
 describe("aiSetupProviderFor", () => {
-  test("prefers ollama when prod/dev is ollama even if menu is mock", () => {
+  test("maps mock menu to custom when openai-compatible is pinned", () => {
     expect(
       aiSetupProviderFor("mock", {
-        dev: "mock",
+        dev: "openai-compatible",
         test: "mock",
-        prod: "ollama",
+        prod: "openai-compatible",
       }),
-    ).toBe("ollama");
+    ).toBe("custom");
   });
 
-  test("keeps menu ollama", () => {
+  test("keeps menu lmstudio", () => {
     expect(
-      aiSetupProviderFor("ollama", {
-        dev: "ollama",
+      aiSetupProviderFor("lmstudio", {
+        dev: "openai-compatible",
         test: "mock",
-        prod: "anthropic",
+        prod: "openai-compatible",
       }),
-    ).toBe("ollama");
+    ).toBe("lmstudio");
   });
 });
 
@@ -339,7 +339,7 @@ describe("interactive branches", () => {
       expect(existsSync(join(dir, "src", "flows", "notes", "digest.ts"))).toBe(true);
       expect(existsSync(join(dir, "src", "flows", "notes", "[id]", "attach.ts"))).toBe(true);
       const digest = readFileSync(join(dir, "src", "flows", "notes", "digest.ts"), "utf8");
-      expect(digest).toContain('every("1d")');
+      expect(digest).toContain('clock("notes.digest", { every: "1d" })');
       const attach = readFileSync(join(dir, "src", "flows", "notes", "[id]", "attach.ts"), "utf8");
       expect(attach).toContain("export const attach");
       expect(readFileSync(join(dir, "oke.config.ts"), "utf8")).toMatch(
@@ -616,7 +616,11 @@ describe("scaffold structure", () => {
         expect(appTs).toMatch(/oke\(\{\s*name:\s*["']notes["']/);
         const pkg = JSON.parse(readFileSync(join(result.targetDir, "package.json"), "utf8")) as {
           name: string;
-          dependencies: { okengine: string; "@duckdb/node-api"?: string };
+          dependencies: {
+            okengine: string;
+            "@duckdb/node-api"?: string;
+            "oxc-parser"?: string;
+          };
           trustedDependencies?: readonly string[];
           scripts: { typecheck?: string; test?: string; web?: string; "web:build"?: string };
           devDependencies: {
@@ -628,7 +632,8 @@ describe("scaffold structure", () => {
         };
         expect(pkg.name).toBe(`app-${id}`);
         expect(pkg.dependencies.okengine).not.toMatch(/^file:\.\./);
-        expect(pkg.dependencies["@duckdb/node-api"]).toBe("^1.5.5-r.2");
+        expect(pkg.dependencies["@duckdb/node-api"]).toBe("^1.5.5-r.4");
+        expect(pkg.dependencies["oxc-parser"]).toBe("^0.149.0");
         expect(pkg.trustedDependencies).toContain("@duckdb/node-api");
         expect(pkg.scripts.typecheck).toContain("tsc --noEmit");
         expect(pkg.scripts.typecheck).toContain("tsc -b -p web/tsconfig.json");
@@ -638,9 +643,9 @@ describe("scaffold structure", () => {
         expect(result.files).toContain("web/vite.config.ts");
         expect(result.files).toContain("web/src/client.ts");
         expect(pkg.devDependencies.typescript).toBeTruthy();
-        expect(pkg.devDependencies.vite).toBe("^8.2.0");
-        expect(pkg.devDependencies["@electric-sql/pglite"]).toBe("^0.5.4");
-        expect(pkg.devDependencies["@electric-sql/pglite-pgvector"]).toBe("^0.0.5");
+        expect(pkg.devDependencies.vite).toBe("^8.3.0");
+        expect(pkg.devDependencies["@electric-sql/pglite"]).toBe("^0.5.8");
+        expect(pkg.devDependencies["@electric-sql/pglite-pgvector"]).toBe("^0.0.9");
         const drizzle = readFileSync(join(result.targetDir, "drizzle.config.ts"), "utf8");
         expect(drizzle).toContain('dialect: "postgresql"');
         expect(drizzle).toContain("DATABASE_URL");
@@ -667,6 +672,7 @@ describe("scaffold structure", () => {
       });
       for (const path of [
         "src/core.ts",
+        "src/vault.ts",
         "src/locales/en.ts",
         "src/locales/index.ts",
         "src/flows/main/shapes.ts",

package/src/cli.ts

@@ -16,6 +16,7 @@ import {
   log,
   note,
   outro,
+  password,
   select,
   spinner,
   text,
@@ -494,7 +495,7 @@ export function scaffoldArgsFromCli(args: CliArgs): ScaffoldCallArgs {
     source: sourceFromArgs(args),
     agentsMd: args.agentsMd,
     sqlDriver: args.sqlDriver,
-    aiApply: args.ai === "force" ? nonInteractiveAiApply("llama-cpp") : null,
+    aiApply: args.ai === "force" ? nonInteractiveAiApply("openrouter") : null,
     locales: args.locales,
     pgdog: args.pgdog ?? false,
     proxy: args.proxy ?? "none",
@@ -715,6 +716,17 @@ export async function askInteractiveAnswers(
             ai: aiPrefWithModels(prev.ai, picked),
             updatedAt: new Date().toISOString(),
           });
+        } else if (aiApply?.apiKeyEnv && !aiApply.apiKey) {
+          // Prefs never store the token — ask again so `.env.local` + Vault get it.
+          const token = await password({
+            message: `API token (${aiApply.apiKeyEnv})`,
+            validate: (v) => {
+              if (!v?.trim()) return "API token is required";
+              return undefined;
+            },
+          });
+          if (isCancel(token)) return null;
+          aiApply = { ...aiApply, apiKey: String(token).trim() };
         }
       }
       note(`Reusing settings from ${io.path}`, "Previous settings");
@@ -724,10 +736,12 @@ export async function askInteractiveAnswers(
     const customized = await askCustomizeFlow(template);
     if (customized === null) return null;
     if (customized === WIZARD_BACK) continue;
-    createDefaults = customized;
+    createDefaults = customized.defaults;
     persistDefaults = true;
-    if (customized.ai.enabled && partial.ai !== "skip") {
-      aiApply = applyInputFromAiPref(customized.ai);
+    // Use the live apply payload (includes apiKey). Never rebuild from prefs
+    // alone — that drops the token and leaves `# OPENROUTER_API_KEY=` empty.
+    if (partial.ai !== "skip") {
+      aiApply = customized.aiApply;
     }
     break;
   }
@@ -893,21 +907,16 @@ async function askProxy(initial: CreateProxyId = "none"): Promise<CreateProxyId
 }
 
 /**
- * Provider passed to `oke ai setup` — prefer native Ollama when either env uses it.
+ * Provider passed to `oke ai setup` — map mock pins to a concrete menu id.
  *
  * @param menuProvider - Menu id chosen in the wizard
  * @param pins - Resolved driver pins
  */
 export function aiSetupProviderFor(menuProvider: string, pins: EnvDriverPins): string {
-  if (menuProvider === "ollama" || pins.dev === "ollama" || pins.prod === "ollama") {
-    return "ollama";
-  }
-  if (menuProvider === "llama-cpp") return "llama-cpp";
-  if (menuProvider === "vllm" || menuProvider === "sglang") return menuProvider;
   if (menuProvider === "mock") {
     if (pins.dev === "anthropic" || pins.prod === "anthropic") return "anthropic";
     if (pins.dev === "openai-compatible" || pins.prod === "openai-compatible") {
-      return "llama-cpp";
+      return "custom";
     }
   }
   return menuProvider;

package/src/create-defaults.test.ts

@@ -73,9 +73,9 @@ describe("read/write round-trip", () => {
           clock: pinsDockerReady("file", "frozen"),
           vault: pinsDockerReady("vault", "memory"),
           channel: { email: pinsDockerReady("smtp", "console") },
-          ai: pinsDockerReady("ollama", "mock"),
+          ai: pinsDockerReady("openai-compatible", "mock"),
         },
-        ai: { enabled: true, provider: "ollama", driver: "ollama" },
+        ai: { enabled: true, provider: "openrouter", driver: "openai-compatible" },
         locales: ["ar"],
         pgdog: true,
         proxy: "caddy",
@@ -85,8 +85,8 @@ describe("read/write round-trip", () => {
       expect(loaded).not.toBeNull();
       expect(loaded!.template).toBe("advanced");
       expect(loaded!.drivers.store.sql.dev).toBe("postgres");
-      expect(loaded!.drivers.ai?.dev).toBe("ollama");
-      expect(loaded!.ai.provider).toBe("ollama");
+      expect(loaded!.drivers.ai?.dev).toBe("openai-compatible");
+      expect(loaded!.ai.provider).toBe("openrouter");
       expect(loaded!.profile).toBe("docker-ready");
       expect(loaded!.locales).toEqual(["ar"]);
       expect(loaded!.pgdog).toBe(true);

package/src/create-defaults.ts

@@ -26,15 +26,15 @@ export type EnvDriverPins = {
 /** Optional AI preference saved with create defaults. */
 export type CreateAiPref = {
   readonly enabled: boolean;
-  /** Menu id: ollama · openai · anthropic · gemini · lmstudio · openrouter · custom · mock */
+  /** Menu id: openrouter · openai · anthropic · gemini · lmstudio · custom · mock · … */
   readonly provider: string | null;
   /** Protocol driver id written to `drivers.ai`. */
   readonly driver: string | null;
   /** Chat model id (from wizard / `oke ai setup`). */
   readonly chatModel?: string | null;
-  /** Vision model id (ollama). */
+  /** Vision model id. */
   readonly visionModel?: string | null;
-  /** Embedding model id (ollama). */
+  /** Embedding model id. */
   readonly embedModel?: string | null;
   /** Optional OpenAI-compatible base URL. */
   readonly baseUrl?: string | null;

package/src/customize-flow.test.ts

@@ -47,21 +47,15 @@ describe("catalog labels", () => {
 });
 
 describe("recommendedAiApply", () => {
-  test("returns llama.cpp (openai-compatible) with curated ai/ model", () => {
-    const prev = process.env.OKE_AI_URL;
-    delete process.env.OKE_AI_URL;
-    try {
-      const apply = recommendedAiApply();
-      expect(apply.driver).toBe("openai-compatible");
-      expect(apply.chatModel).toBe("granite3.3:2b");
-      expect(apply.baseUrl).toContain("8080");
-      expect(apply.image).toContain("llama.cpp");
-      expect(apply.image).not.toContain("latest");
-      expect(apply.visionModel).toBeNull();
-    } finally {
-      if (prev !== undefined) process.env.OKE_AI_URL = prev;
-      else delete process.env.OKE_AI_URL;
-    }
+  test("returns OpenRouter with openrouter/free (no Docker image)", () => {
+    const apply = recommendedAiApply();
+    expect(apply.driver).toBe("openai-compatible");
+    expect(apply.provider).toBe("openrouter");
+    expect(apply.chatModel).toBe("openrouter/free");
+    expect(apply.baseUrl).toBeUndefined();
+    expect(apply.apiKeyEnv).toBe("OPENROUTER_API_KEY");
+    expect(apply.image).toBeUndefined();
+    expect(apply.visionModel).toBeNull();
   });
 });
 

package/src/customize-flow.ts

@@ -2,6 +2,7 @@
  * Customize wizard — walk Docker-first facets once, assemble `{ dev, test, prod }`.
  */
 
+import { isCancel, password } from "@clack/prompts";
 import { toCreateDefaults, type CreateDefaults, type EnvDriverPins } from "./create-defaults.ts";
 import {
   CLOCK_CHOICES,
@@ -14,20 +15,18 @@ import {
   TEMPLATE_DEV,
   TEMPLATE_TEST,
   VAULT_CHOICES,
-  AI_PROVIDERS,
-  LLAMA_CPP_IMAGE,
-  OLLAMA_IMAGE,
-  SGLANG_IMAGE,
-  VLLM_IMAGE,
-  aiDriverForProvider,
   customizeFacetsFor,
   pinsDockerReady,
   pinsEnv,
-  type AiProviderId,
   type CustomizeFacetId,
   type DriverChoice,
 } from "./drivers-catalog.ts";
 import type { AiSetupApplyInput } from "./ai-setup/apply.ts";
+import {
+  aiDriverForMenuProvider,
+  aiProviderSelectOptions,
+  cloudApplyDefaults,
+} from "./ai-setup/catalog.ts";
 import { aiPrefWithModels } from "./ai-setup/from-pref.ts";
 import { askAiSetup } from "./ai-setup/prompts.ts";
 import type { TemplateId } from "./templates.ts";
@@ -95,54 +94,42 @@ export function assembleDriverDefaults(picked: SidePins): CreateDefaults["driver
 }
 
 /**
- * Balanced llama.cpp defaults for "AI setup → Recommended" (no quiz).
- * openai-compatible + curated Docker Hub `ai/` model (`granite3.3:2b`).
+ * Cloud defaults for "AI setup → Recommended" (no quiz).
+ * OpenRouter registry provider + `openrouter/free` (zero Docker).
  */
 export function recommendedAiApply(): AiSetupApplyInput {
-  return {
-    driver: "openai-compatible",
-    baseUrl: process.env.OKE_AI_URL ?? "http://127.0.0.1:8080/v1",
-    chatModel: "granite3.3:2b",
-    visionModel: null,
-    embedModel: null,
-    image: LLAMA_CPP_IMAGE,
-  };
+  return cloudApplyDefaults("openrouter");
 }
 
 /**
- * Attach the compose image pin for a local/self-hosted AI provider menu id.
+ * Recommended path — OpenRouter defaults, then prompt for `OPENROUTER_API_KEY`.
  *
- * @param input - Apply input from prompts
- * @param provider - Menu provider id
+ * @returns Apply input with token, or null on cancel
  */
-export function withLocalAiImage(input: AiSetupApplyInput, provider: string): AiSetupApplyInput {
-  if (provider === "llama-cpp") {
-    return {
-      ...input,
-      image: LLAMA_CPP_IMAGE,
-      baseUrl: input.baseUrl ?? "http://127.0.0.1:8080/v1",
-    };
-  }
-  if (provider === "ollama") {
-    return { ...input, image: OLLAMA_IMAGE };
-  }
-  if (provider === "vllm") {
-    return {
-      ...input,
-      image: VLLM_IMAGE,
-      baseUrl: input.baseUrl ?? "http://127.0.0.1:8000/v1",
-    };
-  }
-  if (provider === "sglang") {
-    return {
-      ...input,
-      image: SGLANG_IMAGE,
-      baseUrl: input.baseUrl ?? "http://127.0.0.1:30000/v1",
-    };
-  }
-  return input;
+export async function askRecommendedAiApply(): Promise<AiSetupApplyInput | null> {
+  const base = recommendedAiApply();
+  const apiKeyEnv = base.apiKeyEnv ?? "OPENROUTER_API_KEY";
+  const token = await password({
+    message: `API token (${apiKeyEnv})`,
+    validate: (v) => {
+      if (!v?.trim()) return "API token is required";
+      return undefined;
+    },
+  });
+  if (isCancel(token)) return null;
+  return { ...base, apiKey: String(token).trim() };
 }
 
+/**
+ * Result of a completed Customize pass — defaults for persistence plus the
+ * live {@link AiSetupApplyInput} (includes the API token; never write the
+ * token into `create-defaults.json`).
+ */
+export type CustomizeFlowResult = {
+  readonly defaults: CreateDefaults;
+  readonly aiApply: AiSetupApplyInput | null;
+};
+
 /**
  * Customize drivers for one template.
  *
@@ -150,7 +137,7 @@ export function withLocalAiImage(input: AiSetupApplyInput, provider: string): Ai
  */
 export async function askCustomizeFlow(
   template: TemplateId,
-): Promise<CreateDefaults | WizardBack | null> {
+): Promise<CustomizeFlowResult | WizardBack | null> {
   const facets = customizeFacetsFor(template);
   const primaryPins = await walkFacets(facets);
   if (primaryPins === null) return null;
@@ -163,14 +150,14 @@ export async function askCustomizeFlow(
   let aiPref: CreateDefaults["ai"] = { enabled: false, provider: null, driver: null };
   let aiApply: AiSetupApplyInput | null = null;
 
-  aiSetup: for (;;) {
+  for (;;) {
     const aiSetup = await selectWithBack(
       "AI setup",
       [
         {
           value: "recommended",
           label: "Recommended",
-          hint: "llama.cpp · openai-compatible · granite3.3:2b",
+          hint: "openrouter · openrouter/free",
         },
         {
           value: "customize",
@@ -193,11 +180,13 @@ export async function askCustomizeFlow(
     if (aiSetup === "off") break;
     if (aiSetup === "recommended") {
       aiPins = pinsDockerReady("openai-compatible", "mock");
-      aiApply = recommendedAiApply();
+      const picked = await askRecommendedAiApply();
+      if (picked === null) return null;
+      aiApply = picked;
       aiPref = aiPrefWithModels(
         {
           enabled: true,
-          provider: "llama-cpp",
+          provider: "openrouter",
           driver: "openai-compatible",
         },
         aiApply,
@@ -205,21 +194,21 @@ export async function askCustomizeFlow(
       break;
     }
 
-    const options = AI_PROVIDERS.map((p) => ({ value: p.value, label: p.label }));
-    const providerValue = await selectWithBack("AI Provider", options, "llama-cpp", {
+    const options = aiProviderSelectOptions({ includeMock: true });
+    const providerValue = await selectWithBack("AI Provider", options, "openrouter", {
       allowBack: true,
     });
     if (providerValue === null) return null;
     if (providerValue === WIZARD_BACK) continue;
 
-    const provider = providerValue as AiProviderId;
-    const driver = aiDriverForProvider(provider);
+    const provider = providerValue;
+    const driver = aiDriverForMenuProvider(provider);
     aiPins = pinsDockerReady(driver, "mock");
 
     if (provider !== "mock") {
       const picked = await askAiSetup({ provider });
       if (picked === null) return null;
-      aiApply = withLocalAiImage(picked, provider);
+      aiApply = picked;
     } else {
       aiApply = { driver: "mock" };
     }
@@ -235,16 +224,20 @@ export async function askCustomizeFlow(
     break;
   }
 
-  return toCreateDefaults({
-    template,
-    profile: "docker-ready",
-    drivers: { ...drivers, ai: aiPins },
-    ai: aiPref,
-    // Locales / PgDog / proxy are asked once in the main wizard (not per customize pass).
-    locales: [],
-    pgdog: false,
-    proxy: "none",
-  });
+  return {
+    defaults: toCreateDefaults({
+      template,
+      profile: "docker-ready",
+      drivers: { ...drivers, ai: aiPins },
+      ai: aiPref,
+      // Locales / PgDog / proxy are asked once in the main wizard (not per customize pass).
+      locales: [],
+      pgdog: false,
+      proxy: "none",
+    }),
+    // Keep the live token here — prefs persist only `apiKeyEnv`, never the value.
+    aiApply,
+  };
 }
 
 /**

package/src/drivers-catalog.ts

@@ -108,29 +108,25 @@ export const EMAIL_CHOICES: readonly DriverChoice[] = [
   { value: "taqnyat-mail", label: "taqnyat" },
 ];
 
-/**
- * Pinned local-inference images — must match `src/docker/recipes/*` pins.
- * Never `latest` (GGUF-parser CVE floors: llama.cpp ≥ b8146, Ollama ≥ 0.17.1).
- */
-export const LLAMA_CPP_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b10450";
-/** @see LLAMA_CPP_IMAGE */
-export const OLLAMA_IMAGE = "ollama/ollama:0.32.13";
-/** @see LLAMA_CPP_IMAGE */
-export const VLLM_IMAGE = "vllm/vllm-openai:v0.27.1";
-/** @see LLAMA_CPP_IMAGE */
-export const SGLANG_IMAGE = "lmsysorg/sglang:v0.5.17-runtime";
-
-/** AI menu providers → protocol driver. */
+/** AI menu providers → protocol driver (kept for call-site compat). */
 export const AI_PROVIDERS = [
-  { value: "llama-cpp", label: "llama.cpp (Local)", driver: "openai-compatible" },
-  { value: "ollama", label: "Ollama (Local)", driver: "ollama" },
-  { value: "vllm", label: "vLLM (self-hosted GPU)", driver: "openai-compatible" },
-  { value: "sglang", label: "SGLang (self-hosted GPU)", driver: "openai-compatible" },
+  {
+    value: "openrouter",
+    label: "OpenRouter",
+    driver: "openai-compatible",
+    hint: "recommended · zero Docker · openrouter/free",
+  },
   { value: "openai", label: "OpenAI", driver: "openai-compatible" },
   { value: "anthropic", label: "Anthropic", driver: "anthropic" },
-  { value: "gemini", label: "Gemini", driver: "openai-compatible" },
+  { value: "groq", label: "Groq", driver: "openai-compatible" },
+  { value: "together", label: "Together AI", driver: "openai-compatible" },
+  { value: "deepseek", label: "DeepSeek", driver: "openai-compatible" },
+  { value: "mistral", label: "Mistral", driver: "openai-compatible" },
+  { value: "xai", label: "xAI (Grok)", driver: "openai-compatible" },
+  { value: "deepinfra", label: "DeepInfra", driver: "openai-compatible" },
+  { value: "vercel", label: "Vercel AI Gateway", driver: "openai-compatible" },
+  { value: "gemini", label: "Google Gemini", driver: "openai-compatible" },
   { value: "lmstudio", label: "LM Studio", driver: "openai-compatible" },
-  { value: "openrouter", label: "OpenRouter", driver: "openai-compatible" },
   { value: "custom", label: "Custom OpenAI Compatible", driver: "openai-compatible" },
   { value: "mock", label: "Mock (dev only)", driver: "mock" },
 ] as const;
@@ -230,12 +226,11 @@ export function aiDriverForProvider(provider: string): string {
 /** Default image pins keyed by role (standard template). */
 export const DEFAULT_IMAGES: Readonly<Record<string, string>> = {
   "store.sql": "postgres:18-alpine",
-  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
+  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
   "store.kv": "redis:8-alpine",
-  "store.files": "rustfs/rustfs:1.0.0-rc.2",
-  "channel.email": "axllent/mailpit:v1.30.7",
+  "store.files": "rustfs/rustfs:1.0.0-rc.5",
+  "channel.email": "axllent/mailpit:v1.31.1",
   "store.index": "getmeili/meilisearch:v1.53",
-  ai: LLAMA_CPP_IMAGE,
   proxy: "caddy:2-alpine",
 };
 

package/src/transform.test.ts

@@ -104,6 +104,23 @@ describe("vault backend defaults", () => {
       const env = readFileSync(join(resolveTemplateDir(id), ".env.example"), "utf8");
       expect(env, id).toContain("OKE_VAULT_MASTER_KEY");
       expect(env, id).toContain("oke vault init");
+      expect(env, id).toContain("src/vault.ts");
+    }
+  });
+
+  test("both templates declare stack vault.secret / vault.config contracts", () => {
+    for (const id of ["standard", "advanced"] as const) {
+      const vault = readFileSync(join(resolveTemplateDir(id), "src/vault.ts"), "utf8");
+      expect(vault, id).toContain('vault.secret("APP_WEBHOOK_SECRET"');
+      expect(vault, id).toContain('vault.secret("DATABASE_URL"');
+      expect(vault, id).toContain('vault.config("OKE_APP_URL"');
+      expect(vault, id).toContain('vault.config("PUBLIC_API_URL"');
+      expect(vault, id).toContain('dev: "http://127.0.0.1:6530"');
+      expect(vault, id).not.toMatch(/PUBLIC_API_URL[\s\S]*?dev:\s*""/);
+      expect(vault, id).toContain("export const NOTES_VAULT");
+      expect(vault, id).toContain("vault.fromDocker");
+      const app = readFileSync(join(resolveTemplateDir(id), "src/app.ts"), "utf8");
+      expect(app, id).toContain("secrets: NOTES_VAULT");
     }
   });
 
@@ -138,24 +155,24 @@ describe("vault backend defaults", () => {
 });
 
 describe("upsertAiDrivers", () => {
-  const ollamaPins: EnvDriverPins = {
-    dev: "ollama",
+  const localAiPins: EnvDriverPins = {
+    dev: "openai-compatible",
     test: "mock",
-    prod: "ollama",
+    prod: "openai-compatible",
   };
 
   test("inserts drivers.ai inside drivers (not images / channel)", () => {
-    const next = upsertAiDrivers(templateConfig("advanced"), ollamaPins);
+    const next = upsertAiDrivers(templateConfig("advanced"), localAiPins);
     const config = evalConfig(next);
-    expect(config.drivers?.ai).toEqual(ollamaPins);
+    expect(config.drivers?.ai).toEqual(localAiPins);
     expect(config.drivers?.channel?.ai).toBeUndefined();
     // Sparse templates omit drivers.channel — images.channel stays a string pin.
-    expect(config.images?.channel?.email).toBe("axllent/mailpit:v1.30.7");
+    expect(config.images?.channel?.email).toBe("axllent/mailpit:v1.31.1");
     expect(config.images?.ai).toBeUndefined();
   });
 
   test("applyCreateAnswers with ai pins keeps top-level drivers.ai", () => {
-    const llamaPins = pinsDockerReady("openai-compatible", "mock");
+    const aiPins = pinsDockerReady("openai-compatible", "mock");
     for (const id of ["standard", "advanced"] as const) {
       const next = applyCreateAnswers(
         templateConfig(id),
@@ -173,9 +190,9 @@ describe("upsertAiDrivers", () => {
             clock: pinsDockerReady("postgres", "frozen"),
             vault: pinsDockerReady("vault", "memory"),
             channel: { email: pinsDockerReady("smtp", "console") },
-            ai: llamaPins,
+            ai: aiPins,
           },
-          ai: { enabled: true, provider: "llama-cpp", driver: "openai-compatible" },
+          ai: { enabled: true, provider: "openrouter", driver: "openai-compatible" },
           locales: [],
           pgdog: false,
           proxy: "none",
@@ -188,7 +205,49 @@ describe("upsertAiDrivers", () => {
         prod: "openai-compatible",
       });
       expect(config.drivers?.channel?.ai, id).toBeUndefined();
-      expect(config.images?.ai, id).toBe("ghcr.io/ggml-org/llama.cpp:server-b10450");
+      expect(config.images?.ai, id).toBeUndefined();
     }
   });
+
+  test("applyCreateAnswers with OpenRouter does not pin images.ai", () => {
+    const cloudPins = pinsDockerReady("openai-compatible", "mock");
+    const next = applyCreateAnswers(
+      templateConfig("advanced"),
+      toCreateDefaults({
+        template: "advanced",
+        profile: "docker-ready",
+        drivers: {
+          store: {
+            sql: pinsDockerReady("postgres", "pglite"),
+            kv: pinsDockerReady("redis", "memory"),
+            files: pinsDockerReady("s3", "memory"),
+            index: null,
+          },
+          signal: pinsDockerReady("redis", "memory"),
+          clock: pinsDockerReady("postgres", "frozen"),
+          vault: pinsDockerReady("vault", "memory"),
+          channel: { email: pinsDockerReady("smtp", "console") },
+          ai: cloudPins,
+        },
+        ai: {
+          enabled: true,
+          provider: "openrouter",
+          driver: "openai-compatible",
+          chatModel: "openrouter/free",
+          apiKeyEnv: "OPENROUTER_API_KEY",
+        },
+        locales: [],
+        pgdog: false,
+        proxy: "none",
+      }),
+    );
+    const config = evalConfig(next);
+    expect(config.drivers?.ai).toEqual({
+      dev: "openai-compatible",
+      test: "mock",
+      prod: "openai-compatible",
+    });
+    expect(config.images?.ai).toBeUndefined();
+    expect(extractImages(next).ai).toBeUndefined();
+  });
 });