create-workframe 0.1.18 → 0.1.21

package/README.md

@@ -3,7 +3,7 @@
 Published on npm as **create-workframe**.
 
 ```bash
-npx create-workframe@0.1.18 MyProject
+npx create-workframe@0.1.21 MyProject
 ```
 
 Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.

package/bin/create-workframe.js

@@ -1360,10 +1360,27 @@ echo "Done. Mission control and workframe unchanged unless you recreate the full
 `;
 }
 
-function launchPhaseBInstaller(target) {
+function launchPhaseBInstaller(target, { wait = false, noBrowser = false } = {}) {
   if (process.platform === 'win32') {
     const script = path.join(target, 'scripts', 'start-install.ps1');
     if (!fs.existsSync(script)) return false;
+    if (wait) {
+      const args = [
+        '-NoProfile',
+        '-ExecutionPolicy',
+        'Bypass',
+        '-File',
+        script,
+        '-NoPrompt',
+      ];
+      if (noBrowser) args.push('-NoBrowser');
+      const child = spawnSync('powershell.exe', args, { cwd: target, stdio: 'inherit' });
+      if (child.error) throw child.error;
+      if (child.status !== 0) {
+        throw new Error(`Phase B installer failed (${child.status ?? 'unknown exit'})`);
+      }
+      return true;
+    }
     const escaped = script.replace(/'/g, "''");
     const child = spawn(
       'powershell.exe',
@@ -1386,6 +1403,16 @@ function launchPhaseBInstaller(target) {
   }
   const script = path.join(target, 'scripts', 'start-install.sh');
   if (!fs.existsSync(script)) return false;
+  if (wait) {
+    const args = ['--no-prompt'];
+    if (noBrowser) args.push('--no-browser');
+    const child = spawnSync(script, args, { cwd: target, stdio: 'inherit' });
+    if (child.error) throw child.error;
+    if (child.status !== 0) {
+      throw new Error(`Phase B installer failed (${child.status ?? 'unknown exit'})`);
+    }
+    return true;
+  }
   const child = spawn(script, [], {
     cwd: target,
     detached: true,
@@ -1520,7 +1547,12 @@ ${openWorkframeBrowserBlockSh()}
 }
 
 function startInstallPs1(docker, nativeProfile, nativeAgentName, ports) {
-  return `$ErrorActionPreference = 'Stop'
+  return `param(
+  [switch]$NoBrowser,
+  [switch]$NoPrompt
+)
+
+$ErrorActionPreference = 'Stop'
 $Root = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
 Set-Location $Root
 
@@ -1533,7 +1565,9 @@ Write-Host " Project: ${nativeAgentName}" -ForegroundColor Cyan
 Write-Host '========================================' -ForegroundColor Cyan
 Write-Host ''
 
-& "$Root\\scripts\\open-install-ui.ps1"
+if (-not $NoBrowser) {
+  & "$Root\\scripts\\open-install-ui.ps1"
+}
 
 Write-Host 'Step 1/2 - Starting Docker stack...' -ForegroundColor Yellow
 ${composeUpPs1Block()}
@@ -1558,8 +1592,14 @@ Write-Host '  Workframe UI:      http://127.0.0.1:${ports.ui}'
 Write-Host '  Hermes dashboard:  http://127.0.0.1:${ports.dashboard}'
 Write-Host ''
 Write-Host 'LLM keys are configured in the onboarding UI - no Hermes TUI required.' -ForegroundColor DarkGray
-${openInstallBrowserBlockPs1()}
-Read-Host 'Press Enter to close'
+if (-not $NoBrowser) {
+  Write-Host ''
+  Write-Host 'Opening Workframe setup wizard (/install)...' -ForegroundColor Green
+  & "$Root\\scripts\\open-install-ui.ps1"
+}
+if (-not $NoPrompt) {
+  Read-Host 'Press Enter to close'
+}
 `;
 }
 
@@ -1569,6 +1609,15 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
+NO_BROWSER=0
+for arg in "$@"; do
+  case "$arg" in
+    --no-browser) NO_BROWSER=1 ;;
+    --no-prompt) ;;
+    *) echo "Unknown option: $arg" >&2; exit 2 ;;
+  esac
+done
+
 mkdir -p Agents Files
 
 echo ""
@@ -1578,7 +1627,9 @@ echo " Project: ${nativeAgentName}"
 echo "========================================"
 echo ""
 
-"$ROOT/scripts/open-install-ui.sh" || true
+if [ "$NO_BROWSER" -eq 0 ]; then
+  "$ROOT/scripts/open-install-ui.sh" || true
+fi
 
 echo "Step 1/2 — Starting Docker stack..."
 ${composeUpBashBlock()}
@@ -1598,7 +1649,11 @@ echo "  Workframe UI:      http://127.0.0.1:${ports.ui}"
 echo "  Hermes dashboard:  http://127.0.0.1:${ports.dashboard}/"
 echo ""
 echo "LLM keys are configured in the onboarding UI - no Hermes TUI required."
-${openInstallBrowserBlockSh()}
+if [ "$NO_BROWSER" -eq 0 ]; then
+  echo ""
+  echo "Opening Workframe setup wizard (/install)..."
+  "$ROOT/scripts/open-install-ui.sh" || true
+fi
 `;
 }
 
@@ -1827,6 +1882,8 @@ function parseArgs(argv) {
     else if (a === '--run-docker-pull') args.runDockerPull = true;
     else if (a === '--allow-install-actions') args.installGuideOnly = false;
     else if (a === '--no-launch') args.noLaunch = true;
+    else if (a === '--wait') args.waitForInstall = true;
+    else if (a === '--no-browser') args.noBrowser = true;
     else if (a === '--slot') args.slot = Number(argv[++i]);
     else if (a.startsWith('--slot=')) args.slot = Number(a.split('=', 2)[1]);
     else if (a === '--deploy') args.deploy = argv[++i];
@@ -1867,6 +1924,8 @@ Flags:
   --allow-install-actions  Allow installer to execute shell install actions
   -y, --yes                Non-interactive defaults
   --no-launch              Scaffold only; do not open Phase B installer
+  --wait                   Run Phase B here and fail if installation fails
+  --no-browser             With --wait, do not open the system browser
 `);
 }
 
@@ -2799,9 +2858,14 @@ async function main() {
     console.log(`Bootstrap default: bootstrap-native (full pack: ${profiles.length} profiles)`);
     console.log(`SOUL seeds: ${seedProfiles.length} profiles + native SETUP playbook`);
     if (!args.ci && !args.noLaunch) {
-      if (launchPhaseBInstaller(target)) {
+      if (launchPhaseBInstaller(target, {
+        wait: Boolean(args.waitForInstall),
+        noBrowser: Boolean(args.noBrowser),
+      })) {
         console.log('');
-        console.log('Launching installer — browser opens /install immediately.');
+        console.log(args.waitForInstall
+          ? 'Installer completed successfully.'
+          : 'Launching installer — browser opens /install immediately.');
         console.log(`Continue setup at http://127.0.0.1:${ports.ui}/install`);
       }
     } else if (args.noLaunch) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-workframe",
-  "version": "0.1.18",
+  "version": "0.1.21",
   "description": "Scaffold a Workframe + Hermes workspace with guided onboarding",
   "type": "module",
   "bin": {

package/scripts/bundle-workframe-ui.mjs

@@ -61,9 +61,19 @@ copyTree(dist, UI_DEST);
 
 const pkgVersion = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8')).version;
 const gitRef = spawnSync('git', ['rev-parse', '--short', 'HEAD'], { encoding: 'utf8', cwd: REPO_ROOT });
+const bundledAt = new Date().toISOString();
+const assetRevision = `${pkgVersion}-${Date.parse(bundledAt).toString(36)}`;
+const bundledIndexPath = path.join(UI_DEST, 'index.html');
+const bundledIndex = fs.readFileSync(bundledIndexPath, 'utf8').replace(
+  /((?:src|href)=["']\/assets\/[^"'?]+)(["'])/g,
+  `$1?v=${assetRevision}$2`,
+);
+fs.writeFileSync(bundledIndexPath, bundledIndex);
+
 const buildStamp = {
   package_version: pkgVersion,
-  bundled_at: new Date().toISOString(),
+  bundled_at: bundledAt,
+  asset_revision: assetRevision,
   git_ref: gitRef.status === 0 ? gitRef.stdout.trim() : '',
 };
 fs.writeFileSync(path.join(UI_DEST, 'workframe-build.json'), `${JSON.stringify(buildStamp, null, 2)}\n`);

package/workframe-api/action_proxy.py

@@ -82,8 +82,10 @@ def forward_request(
             "content-length",
             "authorization",
             "x-api-key",
+            "accept-encoding",
         }
     }
+    upstream_headers["Accept-Encoding"] = "identity"
     upstream_headers.update(upstream_auth_header(provider, secret))
 
     req = urllib.request.Request(url, data=body, headers=upstream_headers, method=method.upper())
@@ -91,10 +93,16 @@ def forward_request(
         with urllib.request.urlopen(req, timeout=600) as resp:
             resp_body = resp.read()
             out_headers = {"Content-Type": resp.headers.get("Content-Type", "application/octet-stream")}
+            content_encoding = resp.headers.get("Content-Encoding", "").strip()
+            if content_encoding:
+                out_headers["Content-Encoding"] = content_encoding
             return resp.status, out_headers, resp_body
     except urllib.error.HTTPError as exc:
         raw = exc.read()
         out_headers = {"Content-Type": exc.headers.get("Content-Type", "application/json")}
+        content_encoding = exc.headers.get("Content-Encoding", "").strip()
+        if content_encoding:
+            out_headers["Content-Encoding"] = content_encoding
         return exc.code, out_headers, raw
 
 

package/workframe-api/chat_sessions.py

@@ -213,6 +213,34 @@ def _llm_attribution_for_profile(profile: str, session_model: str = "") -> tuple
     return model, str(billing or "").strip()
 
 
+def _session_run_attributions(profile: str, session_id: str) -> list[tuple[str, str]]:
+    """Completed-turn model/provider pairs in the same order as chat turns."""
+    prof = str(profile or "").strip()
+    sid = str(session_id or "").strip()
+    if not prof or not sid:
+        return []
+    conn = _srv()._workframe_db()
+    try:
+        rows = conn.execute(
+            """
+            SELECT li.model, li.provider
+            FROM runs r
+            JOIN run_line_items li ON li.run_id = r.run_id AND li.kind = 'llm_turn'
+            WHERE r.session_id = ? AND r.profile_slug = ? AND r.status = 'completed'
+            ORDER BY r.created_at ASC, li.created_at ASC, li.line_item_id ASC
+            """,
+            (sid, prof),
+        ).fetchall()
+    except sqlite3.Error:
+        return []
+    finally:
+        conn.close()
+    return [
+        (str(row["model"] or "").strip(), str(row["provider"] or "").strip())
+        for row in rows
+    ]
+
+
 def _latest_session_id(profile: str) -> str:
     """Most recent session — prefer active (ended_at IS NULL), then by started_at."""
     db = _srv()._profile_dir(profile) / "state.db"
@@ -441,7 +469,8 @@ def chat_messages(profile: str, session_id: str = "", source_id: str = "ui") ->
         _srv()._runtime_template_slug(profile) if _srv()._is_runtime_profile_slug(profile) else profile
     )
     display = _srv()._profile_display_name(profile)
-    attr_model, attr_provider = _llm_attribution_for_profile(profile)
+    run_attributions = _session_run_attributions(profile, sid)
+    agent_turn_index = 0
     try:
         raw = conn.execute(
             """
@@ -483,12 +512,14 @@ def chat_messages(profile: str, session_id: str = "", source_id: str = "ui") ->
             if current and current["role"] == "agent":
                 current["segments"].extend(segments)
                 current["tokens"] += tokens
-                if attr_model:
-                    current["model"] = attr_model
-                    current["llm_provider"] = attr_provider
             else:
                 if current:
                     turns.append(current)
+                if agent_turn_index < len(run_attributions):
+                    attr_model, attr_provider = run_attributions[agent_turn_index]
+                else:
+                    attr_model, attr_provider = "", ""
+                agent_turn_index += 1
                 current = {
                     "id": f"turn-{m['id']}",
                     "authorId": author_profile,
@@ -497,8 +528,8 @@ def chat_messages(profile: str, session_id: str = "", source_id: str = "ui") ->
                     "segments": list(segments),
                     "timestamp": ts,
                     "tokens": tokens,
-                    "model": attr_model,
-                    "llm_provider": attr_provider,
+                    **({"model": attr_model} if attr_model else {}),
+                    **({"llm_provider": attr_provider} if attr_provider else {}),
                 }
         if current:
             turns.append(current)

package/workframe-api/chat_stream.py

@@ -391,6 +391,22 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
         raise ValueError("session_id required")
     if not text:
         raise ValueError("text required")
+    # Bootstrap before reading the model block. Existing generated profiles may
+    # need provider/model migrations; reading first dispatches one stale turn.
+    bootstrapped = _srv()._bootstrap_profile_providers(prof, _triggering_user, _workspace_id)
+    # Native/template profiles can still contain the installer default
+    # (provider=openrouter + public base_url). A user vault credential must
+    # always be consumed through Workframe's authenticated proxy.
+    if _triggering_user:
+        reconciled = _srv()._reconcile_profile_llm_for_user(
+            prof, _triggering_user, _workspace_id,
+        )
+    else:
+        reconciled = False
+    if bootstrapped and not reconciled:
+        # Hermes caches config.yaml. Reload before dispatching so the first
+        # turn after a repair or model save cannot use stale routing.
+        _srv()._reload_runtime_profile_gateway(prof, wait_healthy=True)
     model_block = _srv()._read_model_block(prof)
     llm_provider = _srv()._llm_billing_provider(
         prof, user_id=_triggering_user, workspace_id=_workspace_id, block=model_block,

package/workframe-api/db_schema.py

@@ -588,6 +588,33 @@ def _migrate_v13_workspace_members_in_spaces(conn: sqlite3.Connection) -> None:
         VALUES ('13', 'workspace members joined to all space rooms', datetime('now'))
         """,
     )
+def _migrate_v15_message_reactions(conn: sqlite3.Connection) -> None:
+    if conn.execute("SELECT 1 FROM schema_migrations WHERE version = '15' LIMIT 1").fetchone():
+        return
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS message_reactions (
+            scope_key  TEXT NOT NULL,
+            message_id TEXT NOT NULL,
+            user_id    TEXT NOT NULL,
+            emoji      TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (scope_key, message_id, user_id, emoji)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_message_reactions_scope_message
+            ON message_reactions(scope_key, message_id, created_at)
+        """
+    )
+    conn.execute(
+        """
+        INSERT INTO schema_migrations (version, description, applied_at)
+        VALUES ('15', 'message reactions for room and agent-DM chat surfaces', datetime('now'))
+        """,
+    )
 def _migrate_v8_room_avatars(conn: sqlite3.Connection) -> None:
     if conn.execute("SELECT 1 FROM schema_migrations WHERE version = '8' LIMIT 1").fetchone():
         return
@@ -738,6 +765,7 @@ def ensure_workframe_db_schema(open_db: OpenDb) -> None:
         _migrate_v11_delegation_kanban_boards(conn)
         _migrate_v12_adopt_install_keys_to_owners(conn)
         _migrate_v13_workspace_members_in_spaces(conn)
+        _migrate_v15_message_reactions(conn)
         conn.commit()
     finally:
         conn.close()
@@ -750,6 +778,7 @@ def ensure_oauth_pending_migrations(open_db: OpenDb) -> None:
         _migrate_v11_delegation_kanban_boards(conn)
         _migrate_v12_adopt_install_keys_to_owners(conn)
         _migrate_v13_workspace_members_in_spaces(conn)
+        _migrate_v15_message_reactions(conn)
         conn.commit()
     finally:
         conn.close()

package/workframe-api/handler_modules/handler_admin.py

@@ -197,6 +197,38 @@ class AdminRoutesMixin:
         content_b64 = str(body.get("content_base64") or body.get("content") or "")
         self._json(200, srv.file_upload_binary(rel, content_b64))
 
+    def _route_post_files_archive(self, body: dict) -> None:
+        srv = _srv()
+        if not srv._check_auth(self):
+            self._json(401, {"error": "unauthorized"})
+            return
+        paths = body.get("paths")
+        try:
+            archive = srv.files_archive(paths)
+        except PermissionError as exc:
+            self._json(403, {"ok": False, "error": "protected_file", "detail": str(exc)})
+            return
+        except ValueError as exc:
+            self._json(400, {"ok": False, "error": "invalid_selection", "detail": str(exc)})
+            return
+        self._send(200, archive, "application/zip")
+
+    def _route_post_files_delete(self, body: dict) -> None:
+        srv = _srv()
+        if not srv._check_auth(self):
+            self._json(401, {"error": "unauthorized"})
+            return
+        paths = body.get("paths")
+        try:
+            result = srv.files_delete(paths)
+        except PermissionError as exc:
+            self._json(403, {"ok": False, "error": "protected_file", "detail": str(exc)})
+            return
+        except ValueError as exc:
+            self._json(400, {"ok": False, "error": "invalid_selection", "detail": str(exc)})
+            return
+        self._json(200, result)
+
     def _route_get_admin_vault_status(self, qs: dict[str, list[str]]) -> None:
         srv = _srv()
         if not srv._role_allows(self, srv.OWNER_ADMIN_ROLES):

package/workframe-api/handler_modules/handler_auth.py

@@ -529,13 +529,16 @@ class AuthRoutesMixin:
         )
         display = str(body.get("display_name") or "").strip() if "display_name" in body else ""
         tagline = str(body.get("tagline") or "").strip() if "tagline" in body else ""
-        srv._seed_native_user_overlay(
-            runtime,
+        srv._apply_profile_identity(
             native_slug,
             display_name=display,
             tagline=tagline,
-            user_soul=soul,
         )
+        if soul:
+            result = srv.profile_soul_set(native_slug, soul)
+            if not result.get("ok"):
+                self._json(400, result)
+                return
         profile_patch: dict[str, Any] = {}
         if display:
             profile_patch["display_name"] = display
@@ -552,6 +555,5 @@ class AuthRoutesMixin:
                 stamp = datetime.now(timezone.utc).isoformat()
                 row_patch = {**avatar_patch, "updated_at": stamp}
                 srv._upsert_agent_registry_row(native_slug, row_patch)
-                srv._upsert_agent_registry_row(runtime, row_patch)
                 srv._sync_agent_profile_db(native_slug, {"avatar_url": avatar_patch.get("avatar_url", "")})
         self._json(200, {"ok": True, "runtime_profile": runtime})

package/workframe-api/handler_modules/handler_chat.py

@@ -223,17 +223,12 @@ class ChatRoutesMixin:
             self._json(400, {"error": "model required"})
             return
         billing_provider = str(body.get("billing_provider", "")).strip()
-        # A member may tune the model used by their proxy, but cannot mutate
-        # the shared agent template.  The template remains the default model
-        # owned by the agent; this maps ordinary member writes to u-* runtime.
-        if profile and not selection_only and not srv._is_runtime_profile_slug(profile):
-            if not srv._role_allows(self, srv.OWNER_ADMIN_ROLES):
-                if not workspace_id:
-                    workspaces = srv._get_user_workspaces(user_id)
-                    current = srv._resolve_current_workspace(user_id, workspaces)
-                    workspace_id = str((current or {}).get("id") or (workspaces[0] or {}).get("id") or "")
-                profile = srv._runtime_profile_slug(user_id, profile)
-                srv.ensure_runtime_profile(profile, srv._runtime_template_slug(profile), user_id, workspace_id)
+        # Provider/model are shared agent settings. Credentials remain scoped
+        # to the acting user or company, so only workspace admins may mutate
+        # the agent template; the backend canonicalizes any stale u-* request.
+        if not selection_only and not srv._role_allows(self, srv.OWNER_ADMIN_ROLES):
+            self._json(403, {"ok": False, "error": "forbidden", "required_role": "owner_or_admin"})
+            return
         self._json(
             200,
             hermes_model_set(
@@ -267,14 +262,7 @@ class ChatRoutesMixin:
         chain = body.get("chain", [])
         selection_only = bool(body.get("selection_only"))
         user_id = str(getattr(self, "auth_user", "") or "")
-        if profile and not selection_only and not srv._is_runtime_profile_slug(profile):
-            if not srv._role_allows(self, srv.OWNER_ADMIN_ROLES):
-                if not workspace_id:
-                    workspaces = srv._get_user_workspaces(user_id)
-                    current = srv._resolve_current_workspace(user_id, workspaces)
-                    workspace_id = str((current or {}).get("id") or (workspaces[0] or {}).get("id") or "")
-                profile = srv._runtime_profile_slug(user_id, profile)
-                srv.ensure_runtime_profile(profile, srv._runtime_template_slug(profile), user_id, workspace_id)
+        workspace_id = str(body.get("workspace_id", "")).strip()
         if not isinstance(chain, list):
             self._json(400, {"error": "chain must be a list"})
             return
@@ -288,6 +276,7 @@ class ChatRoutesMixin:
                 chain,
                 selection_only=selection_only,
                 user_id=user_id,
+                workspace_id=workspace_id,
             ),
         )
 
@@ -546,9 +535,7 @@ class ChatRoutesMixin:
             return
         template = resolve_validated_profile(profile_bootstrap_post.group(1))
         user_id = str(getattr(self, "auth_user", "") or "").strip()
-        if srv._is_native_profile(template) and not srv._role_allows(self, srv.OWNER_ADMIN_ROLES):
-            self._json(403, {"ok": False, "error": "native_agent_identity_owner_only"})
-            return
+        can_manage_identity = srv._role_allows(self, srv.OWNER_ADMIN_ROLES)
         workspace_id = str(body.get("workspace_id") or "").strip()
         if not workspace_id and user_id:
             workspaces = srv._get_user_workspaces(user_id)
@@ -558,10 +545,14 @@ class ChatRoutesMixin:
             self._json(400, {"error": "workspace_id and session required"})
             return
         model = str(body.get("model") or "").strip()
-        soul = str(body.get("soul") or "").strip()
-        display_name = str(body.get("display_name") or body.get("room_name") or "").strip()
-        role = str(body.get("role") or "").strip()
-        tagline = str(body.get("tagline") or "").strip()
+        soul = str(body.get("soul") or "").strip() if can_manage_identity else ""
+        display_name = (
+            str(body.get("display_name") or body.get("room_name") or "").strip()
+            if can_manage_identity
+            else ""
+        )
+        role = str(body.get("role") or "").strip() if can_manage_identity else ""
+        tagline = str(body.get("tagline") or "").strip() if can_manage_identity else ""
         lane = bootstrap_agent_dm_lane(
             user_id,
             workspace_id,

package/workframe-api/handler_modules/handler_provider.py

@@ -8,7 +8,6 @@ from typing import Any
 import action_proxy
 import internal_proxy_auth
 import llm_proxy
-import openrouter_catalog
 import platform_auth
 import run_surface_wiring
 
@@ -125,7 +124,8 @@ class ProviderRoutesMixin:
             self._json(401, {"ok": False, "error": "no_session"})
             return
         workspace_id = qs.get("workspace_id", [""])[0]
-        self._json(200, srv.list_user_providers(user_id, workspace_id))
+        credential_scope = qs.get("credential_scope", ["effective"])[0]
+        self._json(200, srv.list_user_providers(user_id, workspace_id, credential_scope))
 
     def _route_post_me_credentials(self, body: dict) -> None:
         srv = _srv()
@@ -191,19 +191,18 @@ class ProviderRoutesMixin:
             self._json(500, {"ok": False, "error": f"db_error: {exc}"})
             return
         srv._invalidate_user_llm_picker_cache(user_id)
+        srv._revoke_runtime_llm_leases(payer_user_id=user_id, provider=provider)
         self._log_audit("credential_stored", "credential_binding", cred_id, f"provider={provider}")
-        health: dict[str, Any] = {}
-        if provider == "openrouter":
-            secret_probe = srv._credential_secret(
-                {
-                    "credential_ref": cred_ref,
-                    "scope": "user",
-                    "user_id": user_id,
-                },
-                user_id,
-            )
-            if secret_probe:
-                health = openrouter_catalog.probe_account(secret_probe)
+        # Credential persistence must not depend on an upstream network round-trip.
+        # OpenRouter's account endpoints can each consume their full timeout when a
+        # self-hosted install has restricted egress, leaving the settings UI stuck
+        # in "Saving…" even though the encrypted credential is already committed.
+        # Model/catalog requests provide the first real provider health signal.
+        health: dict[str, Any] = {
+            "ok": True,
+            "provider": provider,
+            "status": "stored",
+        }
         try:
             srv._bootstrap_model_after_llm_connect(user_id, str(body.get("workspace_id") or ""), provider)
         except (OSError, RuntimeError, ValueError) as exc: