create-workframe 0.1.2 → 0.1.4

package/README.md

@@ -3,7 +3,7 @@
 Published on npm as **create-workframe**.
 
 ```bash
-npx create-workframe@0.1.2 MyProject
+npx create-workframe@0.1.4 MyProject
 ```
 
 Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.
@@ -14,14 +14,27 @@ Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.
 MyProject/
 ├── Agents/
 ├── Files/
+├── scripts/              bootstrap, lifecycle, workframe.mjs CLI
 ├── docker-compose.yml
 ├── workframe-api/
 ├── workframe-ui/
+├── workframe-supervisor/
 └── workframe-manifest.json
 ```
 
+## Project CLI
+
+From the generated project root:
+
+```bash
+node scripts/workframe.mjs doctor
+node scripts/workframe.mjs setup
+```
+
 ## Source
 
 [github.com/npx-workframe/workframe](https://github.com/npx-workframe/workframe)
 
+Documentation: [docs/README.md](https://github.com/npx-workframe/workframe/blob/main/docs/README.md)
+
 Apache-2.0 — see `LICENSE`, `NOTICE`, `SECURITY.md`.

package/SECURITY.md

@@ -16,7 +16,7 @@ direct contact with the repository owner).
 
 Include:
 
-- Affected component (BFF, supervisor, installer, UI, compose)
+- Affected component (workframe-api, supervisor, installer, UI, compose)
 - Steps to reproduce
 - Impact assessment (data exposure, auth bypass, RCE, etc.)
 - Suggested fix if you have one
@@ -26,8 +26,8 @@ We aim to acknowledge reports within a few business days.
 ## Scope notes
 
 - Personal Hermes installs outside a Workframe compose stack are out of scope unless the issue is in shared Workframe source that affects all installs.
-- Production deployments should run with `WORKFRAME_MODE=team`, invite-only access, and
-  without `DEV_LOCAL_UNSAFE`.
+- Production deployments should use `WORKFRAME_DEPLOYMENT_MODE=trusted_team` or
+  `public_multi_user`, invite-only access, and without `DEV_LOCAL_UNSAFE`.
 - BYOK (bring-your-own-key) is the default credential mode; workspace company-pays is an
   explicit admin opt-in.
 

package/bin/create-workframe.js

@@ -2014,15 +2014,15 @@ function nativeConfigYaml(projectName, agentName, personality) {
   const personalityLine = personality ? `# Personality: ${personality}
 ` : "";
   return `${personalityLine}model:
-  default: openrouter/owl-alpha
+  default: google/gemini-2.5-flash
   provider: openrouter
   base_url: https://openrouter.ai/api/v1
   api_mode: chat_completions
 fallback_providers:
 - provider: openrouter
-  model: openrouter/nex-agi
+  model: anthropic/claude-sonnet-4.5
 - provider: openrouter
-  model: openrouter/nvidia/nemotron-3-ultra-550b-a55b:free
+  model: meta-llama/llama-3.3-70b-instruct:free
 providers: {}
 credential_pool_strategies: {}
 toolsets:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-workframe",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Scaffold a Workframe + Hermes workspace with guided onboarding",
   "type": "module",
   "bin": {

package/scripts/bundle-workframe-ui.mjs

@@ -31,18 +31,24 @@ function copyTree(src, dst) {
   }
 }
 
+const skipBuild = process.argv.includes('--skip-build');
+
 if (!fs.existsSync(UI_SRC)) {
   console.error(`apps/web source not found: ${UI_SRC}`);
   process.exit(1);
 }
 
-console.log('Building @workframe/web...');
-const build = spawnSync(npmCmd(), ['run', 'build'], {
-  cwd: UI_SRC,
-  stdio: 'inherit',
-  shell: process.platform === 'win32',
-});
-if (build.status !== 0) process.exit(build.status ?? 1);
+if (!skipBuild) {
+  console.log('Building @workframe/web...');
+  const build = spawnSync(npmCmd(), ['run', 'build'], {
+    cwd: UI_SRC,
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+  });
+  if (build.status !== 0) process.exit(build.status ?? 1);
+} else {
+  console.log('Skipping @workframe/web build (--skip-build)');
+}
 
 const dist = path.join(UI_SRC, 'dist');
 if (!fs.existsSync(path.join(dist, 'index.html'))) {

package/workframe-api/README.md

@@ -1,8 +1,6 @@
 # Workframe API Service
 
-Python BFF for the Workframe UI. See [docs/VERSION.md](../../docs/VERSION.md) for release version.
-
-Canonical implementation — not rewritten into a separate `apps/api` service.
+HTTP API for the Workframe UI. See [docs/VERSION.md](../../docs/VERSION.md) for release version.
 
 ## Local (outside Docker)
 
@@ -21,6 +19,6 @@ HOST=0.0.0.0 PORT=8080 HERMES_DATA=/opt/data WORKSPACE=/workspace python3 server
 
 ## Docs
 
-- [Runtime operations](../../docs/public/runtime-operations.md)
+- [Operations](../../docs/public/operations.md)
 - [Security](../../docs/public/security.md)
-- [BFF route map](../../docs/public/bff-route-map.md)
+- [API reference](../../docs/public/api-reference.md)

package/workframe-api/concierge.py

@@ -0,0 +1,173 @@
+"""Deterministic concierge when LLM is unavailable — keyword intent router, no LLM."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+import llm_error_glossary as glossary
+
+# ponytail: (intent_id, patterns) — first match wins
+_INTENTS: list[tuple[str, tuple[str, ...]]] = [
+    (
+        "add_provider_keys",
+        (
+            "add key",
+            "add keys",
+            "api key",
+            "connect openrouter",
+            "connect provider",
+            "where key",
+            "how do i connect",
+            "how to connect",
+            "openrouter key",
+            "llm key",
+            "provider key",
+        ),
+    ),
+    (
+        "change_model",
+        (
+            "set model",
+            "change model",
+            "pick model",
+            "which model",
+            "how do i set model",
+            "how to set model",
+            "choose model",
+            "switch model",
+            "model picker",
+        ),
+    ),
+    (
+        "provider_credits",
+        (
+            "out of credit",
+            "no credit",
+            "add credit",
+            "billing",
+            "top up",
+            "purchase credit",
+        ),
+    ),
+    (
+        "invalid_key",
+        (
+            "invalid key",
+            "key rejected",
+            "bad key",
+            "wrong key",
+            "401",
+            "unauthorized",
+        ),
+    ),
+    (
+        "diagnose",
+        (
+            "what's wrong",
+            "whats wrong",
+            "why no reply",
+            "not working",
+            "not replying",
+            "help me",
+            "what happened",
+        ),
+    ),
+    (
+        "getting_started",
+        (
+            "get started",
+            "how do i start",
+            "how to start",
+            "new here",
+            "first time",
+        ),
+    ),
+]
+
+_INTENT_PLAYBOOK: dict[str, dict[str, Any]] = {
+    "add_provider_keys": {
+        "message": "Connect an LLM provider to enable chat.",
+        "hint": "OpenRouter is the fastest path — paste your API key under Connected accounts.",
+        "action": {"type": "open_settings", "tab": "providers"},
+        "action_label": "Add API key",
+        "code": "concierge_add_keys",
+    },
+    "change_model": {
+        "message": "Choose which model this agent uses.",
+        "hint": "Open the model picker and select a model your provider supports.",
+        "action": {"type": "open_settings", "tab": "model"},
+        "action_label": "Choose model",
+        "code": "concierge_change_model",
+    },
+    "provider_credits": glossary.playbook_entry("provider_no_credits"),
+    "invalid_key": glossary.playbook_entry("provider_invalid_key"),
+    "diagnose": {
+        "message": "I can help you troubleshoot setup.",
+        "hint": "Connect a provider first, then pick a live model. If chat still fails, check credits and the model name.",
+        "action": {"type": "open_settings", "tab": "providers"},
+        "action_label": "Connected accounts",
+        "secondary_action": {"type": "open_settings", "tab": "model"},
+        "secondary_action_label": "Choose model",
+        "code": "concierge_diagnose",
+    },
+    "getting_started": {
+        "message": "Welcome to Workframe. Three steps to your first agent reply:",
+        "hint": "1) Connect an LLM provider · 2) Pick a model · 3) Send a message in chat.",
+        "action": {"type": "open_settings", "tab": "providers"},
+        "action_label": "Connect provider",
+        "code": "concierge_getting_started",
+    },
+    "fallback_help": glossary.playbook_entry("no_llm_provider"),
+}
+
+
+def _normalize(text: str) -> str:
+    return re.sub(r"\s+", " ", str(text or "").lower().strip())
+
+
+def match_intent(user_text: str) -> str:
+    norm = _normalize(user_text)
+    if not norm:
+        return "fallback_help"
+    for intent_id, patterns in _INTENTS:
+        for pat in patterns:
+            if pat in norm:
+                return intent_id
+    return "fallback_help"
+
+
+def respond(
+    user_text: str,
+    *,
+    situation: str = "",
+    last_error: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Return concierge playbook for user message or classified error."""
+    if last_error and str(last_error.get("code") or "") not in ("", "concierge"):
+        entry = dict(last_error)
+        entry.setdefault("message", entry.get("text") or "")
+        hint = str(entry.get("hint") or "").strip()
+        if hint:
+            entry["hint"] = f"{hint} You can also ask how to connect keys or change models."
+        return glossary.notice_payload(entry)
+
+    if situation == "no_provider":
+        intent = match_intent(user_text)
+        if intent == "fallback_help":
+            return glossary.notice_payload(_INTENT_PLAYBOOK["getting_started"])
+        return glossary.notice_payload(_INTENT_PLAYBOOK.get(intent) or _INTENT_PLAYBOOK["fallback_help"])
+
+    intent = match_intent(user_text)
+    row = dict(_INTENT_PLAYBOOK.get(intent) or _INTENT_PLAYBOOK["fallback_help"])
+    return glossary.notice_payload(row)
+
+
+if __name__ == "__main__":
+    r = respond("how do I add keys?", situation="no_provider")
+    assert r["code"] == "concierge_add_keys"
+    r2 = respond("how do I set model?", situation="no_provider")
+    assert r2["code"] == "concierge_change_model"
+    r3 = respond("hello", situation="no_provider")
+    assert r3["code"] == "concierge_getting_started"
+    print("concierge ok")

package/workframe-api/llm_error_glossary.py

@@ -0,0 +1,236 @@
+"""Classify LLM/provider failures into didactic copy + UI actions."""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+# ponytail: static playbook — extend rows, no LLM generation
+_ACTIONS: dict[str, dict[str, Any]] = {
+    "open_providers": {"type": "open_settings", "tab": "providers"},
+    "open_model": {"type": "open_settings", "tab": "model"},
+    "retry": {"type": "retry"},
+    "openrouter_credits": {
+        "type": "external_link",
+        "url": "https://openrouter.ai/credits",
+        "label": "Add credits",
+    },
+    "openrouter_keys": {
+        "type": "external_link",
+        "url": "https://openrouter.ai/keys",
+        "label": "Manage keys",
+    },
+}
+
+PLAYBOOK: dict[str, dict[str, Any]] = {
+    "no_llm_provider": {
+        "message": "No model provider is connected for your account yet.",
+        "hint": "Connect OpenRouter or another LLM provider under Connected accounts, then try again.",
+        "action": _ACTIONS["open_providers"],
+        "action_label": "Connect provider",
+    },
+    "provider_invalid_key": {
+        "message": "Your API key was rejected by the provider.",
+        "hint": "Reset the key at your provider, then paste it again under Connected accounts.",
+        "action": _ACTIONS["open_providers"],
+        "action_label": "Update API key",
+        "secondary_action": _ACTIONS["openrouter_keys"],
+        "secondary_action_label": "Open provider keys",
+    },
+    "provider_no_credits": {
+        "message": "Your provider account has no credits remaining.",
+        "hint": "Add credits at your provider billing page, then send your message again.",
+        "action": _ACTIONS["openrouter_credits"],
+        "action_label": "Add credits",
+        "secondary_action": _ACTIONS["open_model"],
+        "secondary_action_label": "Choose another model",
+    },
+    "model_unavailable": {
+        "message": "The selected model is not available on your provider right now.",
+        "hint": "Pick a different model in Settings. Free models on OpenRouter rotate often.",
+        "action": _ACTIONS["open_model"],
+        "action_label": "Choose model",
+    },
+    "model_invalid_id": {
+        "message": "That model ID is not valid for your provider.",
+        "hint": "Open the model picker and select a model from the list, or type a known provider/model id.",
+        "action": _ACTIONS["open_model"],
+        "action_label": "Choose model",
+    },
+    "provider_rate_limited": {
+        "message": "The provider rate-limited this request.",
+        "hint": "Wait a minute or switch to another model.",
+        "action": _ACTIONS["open_model"],
+        "action_label": "Choose model",
+    },
+    "invalid_lease": {
+        "message": "Your session credential expired before the model replied.",
+        "hint": "Send the message again — Workframe will issue a fresh credential.",
+        "action": _ACTIONS["retry"],
+        "action_label": "Try again",
+    },
+    "provider_empty_reply": {
+        "message": "The model provider returned no reply.",
+        "hint": "Check your API key, credits, and model selection in Settings.",
+        "action": _ACTIONS["open_model"],
+        "action_label": "Check model",
+        "secondary_action": _ACTIONS["open_providers"],
+        "secondary_action_label": "Check API key",
+    },
+    "provider_gateway_error": {
+        "message": "Workframe could not reach the model gateway.",
+        "hint": "Confirm the stack is running and try again.",
+        "action": _ACTIONS["retry"],
+        "action_label": "Try again",
+    },
+    "unknown_provider_error": {
+        "message": "The model request failed.",
+        "hint": "Check Connected accounts and the model in Settings.",
+        "action": _ACTIONS["open_providers"],
+        "action_label": "Connected accounts",
+        "secondary_action": _ACTIONS["open_model"],
+        "secondary_action_label": "Choose model",
+    },
+}
+
+
+def playbook_entry(code: str, **overrides: Any) -> dict[str, Any]:
+    """Return a copy of a playbook row with optional string format overrides."""
+    base = dict(PLAYBOOK.get(code) or PLAYBOOK["unknown_provider_error"])
+    base["code"] = code
+    for key, value in overrides.items():
+        if value is not None and key in base and isinstance(base[key], str):
+            try:
+                base[key] = base[key].format(**overrides)
+            except (KeyError, ValueError):
+                base[key] = str(value)
+        elif value is not None:
+            base[key] = value
+    return base
+
+
+def _parse_json_blob(raw: str) -> dict[str, Any] | None:
+    text = str(raw or "").strip()
+    if not text or text[0] not in "{[":
+        return None
+    try:
+        data = json.loads(text)
+    except json.JSONDecodeError:
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _extract_error_message(data: dict[str, Any] | None, raw: str = "") -> str:
+    if data:
+        err = data.get("error")
+        if isinstance(err, dict):
+            msg = str(err.get("message") or "").strip()
+            if msg:
+                return msg
+        if isinstance(err, str) and err.strip():
+            return err.strip()
+        for key in ("message", "detail"):
+            val = data.get(key)
+            if isinstance(val, str) and val.strip():
+                return val.strip()
+    return str(raw or "").strip()
+
+
+def _model_from_text(text: str) -> str:
+    m = re.search(r"for\s+([a-z0-9_.:/-]+)", text, re.I)
+    return m.group(1) if m else ""
+
+
+def classify_upstream(
+    status: int,
+    body: bytes | str | None = None,
+    *,
+    provider: str = "openrouter",
+    model: str = "",
+) -> dict[str, Any]:
+    """Map upstream HTTP status + body to playbook entry."""
+    raw = body.decode("utf-8", errors="replace") if isinstance(body, (bytes, bytearray)) else str(body or "")
+    data = _parse_json_blob(raw)
+    msg = _extract_error_message(data, raw)
+    low = msg.lower()
+    model_id = model or _model_from_text(msg)
+
+    if status == 401 or "invalid api key" in low or "incorrect api key" in low or "unauthorized" in low:
+        return playbook_entry("provider_invalid_key", provider=provider)
+    if status == 402 or "insufficient" in low and "credit" in low or "payment required" in low:
+        return playbook_entry("provider_no_credits", provider=provider)
+    if status == 429 or "rate limit" in low:
+        return playbook_entry("provider_rate_limited", provider=provider)
+    if status == 400 and ("not a valid model" in low or "invalid model" in low):
+        entry = playbook_entry("model_invalid_id", model=model_id or "selected model")
+        if model_id:
+            entry["message"] = f"Model `{model_id}` is not a valid id on {provider}."
+        return entry
+    if status == 404 or "no endpoints found" in low or "model not found" in low:
+        entry = playbook_entry("model_unavailable", model=model_id or "selected model")
+        if model_id:
+            entry["message"] = f"Model `{model_id}` has no live endpoints on {provider} right now."
+        return entry
+    if status >= 500:
+        return playbook_entry("provider_gateway_error", provider=provider)
+    return playbook_entry("unknown_provider_error", provider=provider, detail=msg[:200] if msg else "")
+
+
+def classify_exception_text(text: str) -> dict[str, Any]:
+    raw = str(text or "").strip()
+    if not raw:
+        return playbook_entry("provider_empty_reply")
+    if "no_llm_provider_for_user" in raw:
+        return playbook_entry("no_llm_provider")
+    if "invalid_lease" in raw or "credential expired" in raw.lower():
+        return playbook_entry("invalid_lease")
+    m = re.search(r"HTTP (\d{3})", raw)
+    if m:
+        return classify_upstream(int(m.group(1)), raw)
+    low = raw.lower()
+    if "no endpoints found" in low or "model" in low and "not found" in low:
+        return classify_upstream(404, raw)
+    if "not a valid model" in low:
+        return classify_upstream(400, raw)
+    if "rate limit" in low:
+        return classify_upstream(429, raw)
+    if "credit" in low:
+        return classify_upstream(402, raw)
+    if "api key" in low or "unauthorized" in low:
+        return classify_upstream(401, raw)
+    return playbook_entry("unknown_provider_error", detail=raw[:200])
+
+
+def notice_payload(entry: dict[str, Any]) -> dict[str, Any]:
+    """SSE/JSON-safe dict for UI."""
+    out: dict[str, Any] = {
+        "code": str(entry.get("code") or "unknown_provider_error"),
+        "message": str(entry.get("message") or ""),
+        "hint": str(entry.get("hint") or ""),
+        "text": str(entry.get("message") or ""),
+        "error": str(entry.get("message") or ""),
+    }
+    action = entry.get("action")
+    if isinstance(action, dict):
+        out["action"] = action
+    label = entry.get("action_label")
+    if label:
+        out["action_label"] = str(label)
+    sec = entry.get("secondary_action")
+    if isinstance(sec, dict):
+        out["secondary_action"] = sec
+    sec_label = entry.get("secondary_action_label")
+    if sec_label:
+        out["secondary_action_label"] = str(sec_label)
+    return out
+
+
+if __name__ == "__main__":
+    e = classify_upstream(404, b'{"error":{"message":"No endpoints found for openrouter/owl-alpha."}}', model="openrouter/owl-alpha")
+    assert e["code"] == "model_unavailable"
+    e2 = classify_exception_text("no_llm_provider_for_user: Connect an LLM provider")
+    assert e2["code"] == "no_llm_provider"
+    e3 = classify_upstream(401, b'{"error":"Invalid API key"}')
+    assert e3["code"] == "provider_invalid_key"
+    print("llm_error_glossary ok")

package/workframe-api/llm_proxy.py

@@ -144,6 +144,9 @@ def _build_upstream_request(
         }
     }
     upstream_headers.update(upstream_auth_header(provider, secret))
+    if provider == "openrouter":
+        upstream_headers.setdefault("HTTP-Referer", "https://workfra.me")
+        upstream_headers.setdefault("X-Title", "Workframe")
 
     req = urllib.request.Request(url, data=body, headers=upstream_headers, method=method.upper())
     return req, None

package/workframe-api/openrouter_catalog.py

@@ -0,0 +1,114 @@
+"""Live OpenRouter model list with short TTL cache."""
+
+from __future__ import annotations
+
+import json
+import time
+import urllib.error
+import urllib.request
+from typing import Any
+
+_CACHE: dict[str, Any] = {"at": 0.0, "rows": []}
+_TTL_SEC = int(__import__("os").environ.get("WORKFRAME_OPENROUTER_CATALOG_TTL", "3600"))
+
+
+def _fetch_models(api_key: str) -> list[dict[str, str]]:
+    req = urllib.request.Request(
+        "https://openrouter.ai/api/v1/models",
+        headers={
+            "Authorization": f"Bearer {api_key}",
+            "HTTP-Referer": "https://workfra.me",
+            "X-Title": "Workframe",
+        },
+        method="GET",
+    )
+    with urllib.request.urlopen(req, timeout=45) as resp:
+        data = json.loads(resp.read())
+    rows: list[dict[str, str]] = []
+    for item in data.get("data") or []:
+        if not isinstance(item, dict):
+            continue
+        mid = str(item.get("id") or "").strip()
+        if not mid:
+            continue
+        name = str(item.get("name") or mid.rsplit("/", 1)[-1]).strip()
+        pricing = item.get("pricing") if isinstance(item.get("pricing"), dict) else {}
+        prompt = str(pricing.get("prompt") or "0")
+        completion = str(pricing.get("completion") or "0")
+        free = prompt in ("0", "0.0") and completion in ("0", "0.0")
+        rows.append(
+            {
+                "provider": "OpenRouter",
+                "model": mid,
+                "label": name,
+                "description": f"{'Free tier · ' if free else ''}{mid}",
+            },
+        )
+    rows.sort(key=lambda r: (0 if ":free" in r["model"] else 1, r["label"].lower()))
+    return rows[:120]
+
+
+def live_suggestions(api_key: str = "", *, limit: int = 40) -> list[dict[str, str]]:
+    """Return cached OpenRouter suggestions; empty without a key."""
+    key = str(api_key or "").strip()
+    if not key:
+        return []
+    now = time.time()
+    if _CACHE["rows"] and now - float(_CACHE["at"]) < _TTL_SEC:
+        return list(_CACHE["rows"])[:limit]
+    try:
+        rows = _fetch_models(key)
+    except (urllib.error.URLError, urllib.error.HTTPError, json.JSONDecodeError, OSError):
+        return list(_CACHE["rows"])[:limit]
+    _CACHE["at"] = now
+    _CACHE["rows"] = rows
+    return rows[:limit]
+
+
+def probe_account(api_key: str) -> dict[str, Any]:
+    """OpenRouter /key + /credits health for connect-time feedback."""
+    key = str(api_key or "").strip()
+    if not key:
+        return {"ok": False, "error": "missing_key"}
+    headers = {
+        "Authorization": f"Bearer {key}",
+        "HTTP-Referer": "https://workfra.me",
+        "X-Title": "Workframe",
+    }
+    out: dict[str, Any] = {"ok": True, "provider": "openrouter"}
+    try:
+        with urllib.request.urlopen(
+            urllib.request.Request("https://openrouter.ai/api/v1/key", headers=headers, method="GET"),
+            timeout=30,
+        ) as resp:
+            key_data = json.loads(resp.read()).get("data") or {}
+        out["key_valid"] = True
+        out["label"] = str(key_data.get("label") or "")
+        out["usage"] = key_data.get("usage")
+    except urllib.error.HTTPError as exc:
+        out["ok"] = False
+        out["key_valid"] = False
+        out["error"] = f"HTTP {exc.code}"
+        return out
+    except OSError as exc:
+        return {"ok": False, "key_valid": False, "error": str(exc)}
+    try:
+        with urllib.request.urlopen(
+            urllib.request.Request("https://openrouter.ai/api/v1/credits", headers=headers, method="GET"),
+            timeout=30,
+        ) as resp:
+            cred = json.loads(resp.read()).get("data") or {}
+        total = cred.get("total_credits")
+        usage = cred.get("total_usage")
+        out["credits_total"] = total
+        out["credits_usage"] = usage
+        if total is not None and usage is not None:
+            out["credits_remaining"] = max(0.0, float(total) - float(usage))
+    except (urllib.error.HTTPError, OSError, json.JSONDecodeError, TypeError, ValueError):
+        pass
+    return out
+
+
+if __name__ == "__main__":
+    assert live_suggestions("") == []
+    print("openrouter_catalog ok (no network without key)")