om-memory-system 6.2.0-next.243 → 6.2.0

package/dist/config.js

@@ -11,6 +11,7 @@ import { parseIgnoredDirectories, parseImportPathMaps } from "./importer/import-
 import { normaliseSkillConfig, projectSkillOverride, } from "./services/skill-learning/skill-config.js";
 import * as visibleRecall from "./services/visible-recall-config.js";
 import * as injectionOptions from "./services/injection-options-config.js";
+import { keepGlobalProvider } from "./services/openrouter-routing-config.js";
 import { checkedMemoryLimit, MEMORY_LIMITS } from "./utils/memory-limits.js";
 import { defaultSimilarityThreshold } from "./utils/threshold-default.js";
 import { RERANKER_TIMEOUT_DEFAULT_MS } from "./services/request-timeouts.js";
@@ -539,6 +540,8 @@ export function initConfig(directory, options = {}) {
     delete projectOverrides.claudeConfigDir;
     delete projectOverrides.webServerAutoStart;
     delete projectOverrides.webServerEnabled;
+    // The routing choice of the OpenRouter card is global, like the endpoint and the key.
+    keepGlobalProvider(globalConfig, projectOverrides, (message) => log(message, { directory }));
     const merged = { ...globalConfig, ...projectOverrides };
     // The active memory space picks the storage folder unless the project sets its own (ADR-041).
     const globalStoragePath = storagePathFrom(globalConfig);

package/dist/core/memorisation-operations.js

@@ -121,6 +121,8 @@ export async function runRecall(args, linked, rerank = false) {
         includeLinked: true,
         kind: "memorisation",
         reranker: rerank,
+        // A reranked recall still answers "no memorisation matched" when nothing clears the threshold.
+        thresholdAfterRerank: true,
         ...(wanted.length > 0 ? { limit: LABEL_SEARCH_POOL } : {}),
     });
     if (!result.success)

package/dist/services/ai/provider-error-kind.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Sorts a memory-model error into a kind the web page can explain in words.
+ * `no_credit` and `auth` fail the same way for every memory, so a run that
+ * hits one stops instead of calling the model again for each memory.
+ */
+export type ProviderErrorKind = "no_credit" | "auth" | "other";
+export declare function providerErrorKind(message: string): ProviderErrorKind;

package/dist/services/ai/provider-error-kind.js

@@ -0,0 +1,9 @@
+const NO_CREDIT = /\b402\b|insufficient[_ ](balance|credits?|funds|quota)|out of credits?|credit balance/i;
+const AUTH = /\b401\b|\b403\b|invalid[_ ]api[_ ]key|unauthori[sz]ed|incorrect api key/i;
+export function providerErrorKind(message) {
+    if (NO_CREDIT.test(message))
+        return "no_credit";
+    if (AUTH.test(message))
+        return "auth";
+    return "other";
+}

package/dist/services/ai/providers/anthropic-messages.js

@@ -1,4 +1,4 @@
-import { applySafeExtraParams, BaseAIProvider, describeValidationError, isTransportError, } from "./base-provider.js";
+import { applySafeExtraParams, BaseAIProvider, describeValidationError, isTransportError, redactApiKey, } from "./base-provider.js";
 import { AISessionManager } from "../session/ai-session-manager.js";
 import { ToolSchemaConverter } from "../tools/tool-schema.js";
 import { log } from "../../logger.js";
@@ -113,7 +113,8 @@ export class AnthropicMessagesProvider extends BaseAIProvider {
                 });
                 clearTimeout(timeout);
                 if (!response.ok) {
-                    const errorText = await response.text().catch(() => response.statusText);
+                    const rawError = await response.text().catch(() => response.statusText);
+                    const errorText = redactApiKey(rawError, this.config.apiKey);
                     log(this.apiErrorLogLabel(), {
                         provider: this.getProviderName(),
                         model: this.config.model,

package/dist/services/ai/providers/base-provider.d.ts

@@ -54,6 +54,8 @@ export declare function validationLogFields(error: unknown, stopReason: string |
 };
 /** The error a failed tool reply returns. It says when the reply was cut off. */
 export declare function validationFailureMessage(error: unknown, stopReason: string | undefined): string;
+/** An error body from the API with the configured key removed, so it is safe to log and return. */
+export declare function redactApiKey(text: string, apiKey: string | undefined): string;
 export declare function applySafeExtraParams(requestBody: Record<string, any>, extraParams: Record<string, unknown>): void;
 export declare abstract class BaseAIProvider {
     protected config: ProviderConfig;

package/dist/services/ai/providers/base-provider.js

@@ -55,6 +55,10 @@ export function validationFailureMessage(error, stopReason) {
     const cutOff = stopReason === "length" ? " (the reply was cut off)" : "";
     return `Validation failed: ${describeValidationError(error)}${cutOff}`;
 }
+/** An error body from the API with the configured key removed, so it is safe to log and return. */
+export function redactApiKey(text, apiKey) {
+    return apiKey ? text.split(apiKey).join("[redacted]") : text;
+}
 const PROTECTED_KEYS = new Set([
     "model",
     "messages",

package/dist/services/ai/providers/google-gemini.js

@@ -1,4 +1,4 @@
-import { BaseAIProvider, describeValidationError, isTransportError, } from "./base-provider.js";
+import { BaseAIProvider, describeValidationError, isTransportError, redactApiKey, } from "./base-provider.js";
 import { AISessionManager } from "../session/ai-session-manager.js";
 import { log } from "../../logger.js";
 import { UserProfileValidator } from "../validators/user-profile-validator.js";
@@ -147,7 +147,8 @@ export class GoogleGeminiProvider extends BaseAIProvider {
                 });
                 clearTimeout(timeout);
                 if (!response.ok) {
-                    const errorText = await response.text().catch(() => response.statusText);
+                    const rawError = await response.text().catch(() => response.statusText);
+                    const errorText = redactApiKey(rawError, this.config.apiKey);
                     log("Gemini API error", {
                         provider: this.getProviderName(),
                         model: this.config.model,

package/dist/services/ai/providers/openai-chat-completion.js

@@ -1,4 +1,4 @@
-import { BaseAIProvider, applySafeExtraParams, validationFailureMessage, validationLogFields, isTransportError, } from "./base-provider.js";
+import { BaseAIProvider, applySafeExtraParams, validationFailureMessage, validationLogFields, isTransportError, redactApiKey, } from "./base-provider.js";
 import { log } from "../../logger.js";
 import { UserProfileValidator } from "../validators/user-profile-validator.js";
 import { parseRetryAfter } from "../../../core/capture-retry-policy.js";
@@ -205,7 +205,8 @@ export class OpenAIChatCompletionProvider extends BaseAIProvider {
                 });
                 clearTimeout(timeout);
                 if (!response.ok) {
-                    const errorText = await response.text().catch(() => response.statusText);
+                    const rawError = await response.text().catch(() => response.statusText);
+                    const errorText = redactApiKey(rawError, this.config.apiKey);
                     log("OpenAI Chat Completion API error", {
                         provider: this.getProviderName(),
                         model: this.config.model,

package/dist/services/ai/providers/openai-responses.js

@@ -1,4 +1,4 @@
-import { BaseAIProvider, applySafeExtraParams, isTransportError, } from "./base-provider.js";
+import { BaseAIProvider, applySafeExtraParams, isTransportError, redactApiKey, } from "./base-provider.js";
 import { AISessionManager } from "../session/ai-session-manager.js";
 import { ToolSchemaConverter } from "../tools/tool-schema.js";
 import { log } from "../../logger.js";
@@ -62,7 +62,8 @@ export class OpenAIResponsesProvider extends BaseAIProvider {
                 });
                 clearTimeout(timeout);
                 if (!response.ok) {
-                    const errorText = await response.text().catch(() => response.statusText);
+                    const rawError = await response.text().catch(() => response.statusText);
+                    const errorText = redactApiKey(rawError, this.config.apiKey);
                     log("OpenAI Responses API error", {
                         provider: this.getProviderName(),
                         model: this.config.model,

package/dist/services/api-handlers.d.ts

@@ -155,27 +155,6 @@ export declare function handleCategoryCleanupStatus(userId?: string): Promise<Ap
 export declare function handleCategoryCleanupApply(userId?: string, body?: any, deps?: CategoryCleanupDeps): Promise<ApiResponse<any>>;
 export declare function handleCategoryCleanupUndo(userId?: string, deps?: CategoryCleanupDeps): Promise<ApiResponse<any>>;
 export declare function handleUpdateProfileItem(body?: any): Promise<ApiResponse<any>>;
-export declare function handleDetectTagMigration(): Promise<ApiResponse<{
-    needsMigration: boolean;
-    count: number;
-}>>;
-interface MigrationProgress {
-    processed: number;
-    total: number;
-    currentBatch: number;
-    totalBatches: number;
-    isComplete: boolean;
-    errors: string[];
-}
-export declare function handleGetTagMigrationProgress(): Promise<ApiResponse<MigrationProgress>>;
-/**
- * Tag the memories that have no tags, a few per request. Only untagged
- * memories are touched: tagged ones keep their vectors. A memory that fails
- * is recorded and passed over, so one bad row cannot stall the run.
- */
-export declare function handleRunTagMigrationBatch(batchSize?: number): Promise<ApiResponse<{
-    processed: number;
-    total: number;
-    hasMore: boolean;
-}>>;
-export {};
+export { handleDetectTagMigration, handleGetTagMigrationProgress } from "./tag-migration.js";
+/** Tags untagged memories with the memory model. The work lives in tag-migration.ts. */
+export declare function handleRunTagMigrationBatch(batchSize?: number): Promise<import("./tag-migration.js").ApiResponse<import("./tag-migration.js").TagMigrationBatch>>;

package/dist/services/api-handlers.js

@@ -12,7 +12,7 @@ import { userPromptManager } from "./user-prompt/user-prompt-manager.js";
 import { saveProfile } from "./user-profile/merge-and-save.js";
 import { sortProfileItems, stripProfileVectors } from "../utils/profile.js";
 import { resolveWebProfileUserId } from "./profile-identity.js";
-import { UNTAGGED_NORMAL_PREDICATE } from "./memory-kind.js";
+import { runTagMigrationBatch } from "./tag-migration.js";
 import { loadMemoryRows, memorisationIdsAmong, MEMORISATION_EDIT_REFUSAL, MEMORISATION_TYPE_REFUSAL, webUpdateRefusal, } from "./web-memory-rows.js";
 async function getAllMemoryShards() {
     await ensureTursoReady();
@@ -996,118 +996,8 @@ export async function handleUpdateProfileItem(body) {
         return { success: false, error: String(error) };
     }
 }
-export async function handleDetectTagMigration() {
-    try {
-        await ensureTursoReady();
-        let untaggedCount = 0;
-        for (const shard of await tursoShardManager.getAllShards("project", "")) {
-            const db = await tursoConnectionManager.getConnection(shard.dbPath);
-            const row = await db.get(`SELECT COUNT(*) as count FROM memories WHERE ${UNTAGGED_NORMAL_PREDICATE}`);
-            untaggedCount += Number(row?.count ?? 0);
-        }
-        return { success: true, data: { needsMigration: untaggedCount > 0, count: untaggedCount } };
-    }
-    catch (error) {
-        return { success: false, error: String(error) };
-    }
-}
-const idleMigration = () => ({
-    processed: 0,
-    total: 0,
-    currentBatch: 0,
-    totalBatches: 0,
-    isComplete: true,
-    errors: [],
-});
-let migrationProgress = idleMigration();
-/** The untagged memories this migration run covers, fixed when the run starts. */
-let migrationQueue = [];
-export async function handleGetTagMigrationProgress() {
-    return { success: true, data: migrationProgress };
-}
-/**
- * Tag the memories that have no tags, a few per request. Only untagged
- * memories are touched: tagged ones keep their vectors. A memory that fails
- * is recorded and passed over, so one bad row cannot stall the run.
- */
+export { handleDetectTagMigration, handleGetTagMigrationProgress } from "./tag-migration.js";
+/** Tags untagged memories with the memory model. The work lives in tag-migration.ts. */
 export async function handleRunTagMigrationBatch(batchSize = 5) {
-    try {
-        await ensureTursoReady();
-        const { AIProviderFactory } = await import("./ai/ai-provider-factory.js");
-        const { buildMemoryProviderConfig } = await import("./ai/provider-config.js");
-        const providerConfig = buildMemoryProviderConfig(CONFIG, {
-            maxIterations: 1,
-            iterationTimeout: 30000,
-        });
-        const provider = AIProviderFactory.createProvider(CONFIG.memoryProvider, providerConfig);
-        if (migrationProgress.isComplete) {
-            migrationQueue = [];
-            for (const shard of await tursoShardManager.getAllShards("project", "")) {
-                const db = await tursoConnectionManager.getConnection(shard.dbPath);
-                const rows = await db.all(`SELECT id FROM memories WHERE ${UNTAGGED_NORMAL_PREDICATE} ORDER BY id`);
-                for (const row of rows)
-                    migrationQueue.push({ id: String(row.id), dbPath: shard.dbPath });
-            }
-            migrationProgress = {
-                ...idleMigration(),
-                total: migrationQueue.length,
-                totalBatches: Math.ceil(migrationQueue.length / batchSize),
-                isComplete: migrationQueue.length === 0,
-            };
-        }
-        const batch = migrationQueue.slice(migrationProgress.processed, migrationProgress.processed + batchSize);
-        for (const item of batch) {
-            try {
-                const db = await tursoConnectionManager.getConnection(item.dbPath);
-                const m = await db.get("SELECT * FROM memories WHERE id = ?", [item.id]);
-                // Tagged or deleted since the run started: nothing to do.
-                if (!m || (m.tags && String(m.tags).trim()))
-                    continue;
-                const prompt = `Generate 2-4 short technical tags for this memory content:\n\n${m.content}\n\nReturn ONLY a comma-separated list of tags.`;
-                const result = await provider.executeToolCall("You are a technical tagger.", prompt, {
-                    type: "function",
-                    function: {
-                        name: "save_tags",
-                        description: "Save generated tags",
-                        parameters: {
-                            type: "object",
-                            properties: { tags: { type: "array", items: { type: "string" } } },
-                            required: ["tags"],
-                        },
-                    },
-                }, `migration_${m.id}`);
-                const tags = Array.isArray(result.data?.tags)
-                    ? result.data.tags.map((t) => String(t).trim().toLowerCase()).filter(Boolean)
-                    : [];
-                if (!result.success || tags.length === 0) {
-                    throw new Error(result.error ?? "The model returned no tags");
-                }
-                const vector = await embeddingService.embedWithTimeout(m.content, { task: "document" });
-                const tagsVector = await embeddingService.embedWithTimeout(formatTagsForEmbedding(tags), {
-                    task: "document",
-                });
-                // One statement, so a memory never ends up tagged with stale vectors.
-                await tursoVectorSearch.updateVector(db, m.id, vector, tagsVector, tags.join(","));
-            }
-            catch (e) {
-                const errorMsg = String(e);
-                migrationProgress.errors.push(errorMsg);
-                log("Migration error for memory", { id: item.id, error: errorMsg }, "error");
-            }
-            finally {
-                migrationProgress.processed++;
-            }
-        }
-        migrationProgress.currentBatch++;
-        const hasMore = migrationProgress.processed < migrationProgress.total;
-        if (!hasMore)
-            migrationProgress.isComplete = true;
-        return {
-            success: true,
-            data: { processed: migrationProgress.processed, total: migrationProgress.total, hasMore },
-        };
-    }
-    catch (error) {
-        return { success: false, error: String(error) };
-    }
+    return runTagMigrationBatch(CONFIG, batchSize);
 }

package/dist/services/client.js

@@ -101,6 +101,7 @@ export class LocalMemoryClient {
                     maxMemories,
                     similarityThreshold: CONFIG.similarityThreshold,
                     kind: options.kind ?? "normal",
+                    thresholdAfterRerank: options.thresholdAfterRerank,
                 }, reranker, {
                     search: (shardList, vector, tag, limit, threshold, queryText, kind) => tursoVectorSearch.searchAcrossShards(shardList, vector, tag, limit, threshold, queryText, keywordBoost, "boost", undefined, kind),
                     log: (message, meta) => log(message, meta),

package/dist/services/global-config-writer.d.ts

@@ -12,12 +12,19 @@ export declare class ConfigConflictError extends Error {
     constructor();
 }
 export declare function readGlobalConfigRevision(): string;
-/** Write only page-editable keys; reject edits based on a stale config revision. */
-export declare function writeGlobalConfigKeys(edits: Record<string, unknown>, expectedRevision: string, 
-/** A route that owns a separate set of keys passes it; the general save may not touch them. */
-options?: {
+type WriteOptions = {
+    /** A route that owns a separate set of keys passes it; the general save may not touch them. */
     only?: Set<string>;
-}): Promise<{
+    /**
+     * Builds the edits from the config as read inside the save queue, against the
+     * checked revision, so a read-modify-write cannot lose another save. Returning
+     * no edits writes nothing. `edits` is then ignored.
+     */
+    derive?: (current: Record<string, unknown>) => Record<string, unknown>;
+};
+/** Write only page-editable keys; reject edits based on a stale config revision. */
+export declare function writeGlobalConfigKeys(edits: Record<string, unknown>, expectedRevision: string, options?: WriteOptions): Promise<{
     revision: string;
     migratedLegacy: boolean;
 }>;
+export {};

package/dist/services/global-config-writer.js

@@ -103,6 +103,10 @@ const RESETTABLE_KEYS = [
 ];
 const QUERY_RULE = `openingContextQuery must be text of ${OPENING_CONTEXT_QUERY_MAX_LENGTH} characters or fewer`;
 function isValidEdit(key, value) {
+    // Written only by the OpenRouter routing route; `undefined` removes the key.
+    if (key === "memoryExtraParams" || key === "memoryExtraParams.provider") {
+        return (value === undefined || (typeof value === "object" && value !== null && !Array.isArray(value)));
+    }
     // `undefined` removes the key from the file. `null` is the wire form of
     // "reset to default", accepted for the memory limits and the optional reranker keys.
     const memoryLimit = getMemoryLimitRule(key);
@@ -229,12 +233,8 @@ let queue = Promise.resolve();
 let pending = 0;
 let lastBaseRevision;
 let lastWrittenRevision;
-/** Write only page-editable keys; reject edits based on a stale config revision. */
-export async function writeGlobalConfigKeys(edits, expectedRevision, 
-/** A route that owns a separate set of keys passes it; the general save may not touch them. */
-options = {}) {
-    if (!edits || !Object.keys(edits).length)
-        throw new Error("No settings to save");
+/** Refuse an edit to a key the caller may not write, or a value the key does not accept. */
+function checkEdits(edits, options) {
     for (const [key, value] of Object.entries(edits)) {
         const allowed = options.only ? options.only.has(key) : keys.has(key);
         if (!allowed)
@@ -265,6 +265,14 @@ options = {}) {
         if (missing !== null)
             throw new Error(`Skill folder not found: ${missing}`);
     }
+}
+/** Write only page-editable keys; reject edits based on a stale config revision. */
+export async function writeGlobalConfigKeys(edits, expectedRevision, options = {}) {
+    if (!options.derive) {
+        if (!edits || !Object.keys(edits).length)
+            throw new Error("No settings to save");
+        checkEdits(edits, options);
+    }
     const wasQueued = pending > 0;
     pending++;
     const save = queue.then(async () => {
@@ -285,8 +293,15 @@ options = {}) {
         if (errors.length || !current || typeof current !== "object" || Array.isArray(current)) {
             throw new Error("Config contains invalid JSONC");
         }
-        checkMemorisationSettingsEdits(edits, memorisationSettingsFrom(current));
-        for (const [key, value] of Object.entries(edits)) {
+        const applied = options.derive ? options.derive(current) : edits;
+        if (options.derive) {
+            if (!Object.keys(applied).length) {
+                return { revision: original.revision, migratedLegacy: false };
+            }
+            checkEdits(applied, options);
+        }
+        checkMemorisationSettingsEdits(applied, memorisationSettingsFrom(current));
+        for (const [key, value] of Object.entries(applied)) {
             // A nested identifier maps to its JSONC leaf path, so compaction.enabled
             // writes the leaf, never a literal dotted key.
             const jsoncPath = (getMemoryLimitRule(key)?.path ?? key.split("."));

package/dist/services/linked-search.d.ts

@@ -21,6 +21,8 @@ export interface MemoryReadOptions {
     limit?: number;
     /** Search only: rerank this read whatever the general `rerankerEnabled` switch says. */
     reranker?: boolean;
+    /** Search only: with the reranker on, still drop hits below `similarityThreshold`. */
+    thresholdAfterRerank?: boolean;
 }
 /** The settings a linked search needs; the caller snapshots them from CONFIG. */
 export interface LinkedSearchSettings {

package/dist/services/openrouter-providers.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The providers that serve one OpenRouter model, each with a data policy label.
+ * It reads two public OpenRouter lists without an API key: the model's endpoints
+ * and the zero data retention (ZDR) endpoints. `fetch` and the clock come in as
+ * arguments, so the module needs no config and tests need no network.
+ */
+export type ProviderPolicy = "zdr" | "safety" | "unknown";
+export type ProviderRow = {
+    slug: string;
+    name: string;
+    policy: ProviderPolicy;
+};
+export type ProviderFailure = "unknown-model" | "timeout" | "unreachable";
+export type ProvidersResult = {
+    ok: true;
+    providers: ProviderRow[];
+} | {
+    ok: false;
+    reason: ProviderFailure;
+    error: string;
+};
+/** True for `author/slug` model IDs. Dot-only parts are refused so the URL cannot climb out of /models/. */
+export declare function isModelId(value: unknown): value is string;
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export declare function createOpenRouterProviders(deps: {
+    fetch: FetchLike;
+    now: () => number;
+    timeoutMs?: number;
+}): {
+    list: (model: string) => Promise<ProvidersResult>;
+};

package/dist/services/openrouter-providers.js

@@ -0,0 +1,124 @@
+/**
+ * The providers that serve one OpenRouter model, each with a data policy label.
+ * It reads two public OpenRouter lists without an API key: the model's endpoints
+ * and the zero data retention (ZDR) endpoints. `fetch` and the clock come in as
+ * arguments, so the module needs no config and tests need no network.
+ */
+const BASE = "https://openrouter.ai/api/v1";
+const ZDR_TTL_MS = 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 10_000;
+const MODEL_ID = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._:-]+$/;
+/** From least private to most private is unknown, safety, zdr. */
+const PRIVACY_RANK = { unknown: 0, safety: 1, zdr: 2 };
+/** True for `author/slug` model IDs. Dot-only parts are refused so the URL cannot climb out of /models/. */
+export function isModelId(value) {
+    return (typeof value === "string" &&
+        MODEL_ID.test(value) &&
+        value.split("/").every((part) => !/^\.+$/.test(part)));
+}
+class ListError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
+const text = (value) => typeof value === "string" && value.trim() ? value : undefined;
+export function createOpenRouterProviders(deps) {
+    const timeoutMs = deps.timeoutMs ?? FETCH_TIMEOUT_MS;
+    let zdrCache;
+    /** One keyless GET. Returns undefined for a 404, so the caller can name the model. */
+    async function getJson(url) {
+        let response;
+        try {
+            response = await deps.fetch(url, {
+                method: "GET",
+                headers: { Accept: "application/json" },
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "";
+            if (name === "TimeoutError" || name === "AbortError") {
+                throw new ListError("timeout", "OpenRouter did not answer within 10 seconds.");
+            }
+            throw new ListError("unreachable", "OpenRouter could not be reached.");
+        }
+        if (response.status === 404)
+            return undefined;
+        if (!response.ok) {
+            throw new ListError("unreachable", `OpenRouter answered with status ${response.status}.`);
+        }
+        try {
+            return await response.json();
+        }
+        catch {
+            throw new ListError("unreachable", "OpenRouter sent a reply that could not be read.");
+        }
+    }
+    /** `model_id` + `tag` -> safety_retention for every ZDR endpoint. Cached for an hour. */
+    async function zdrFlags() {
+        if (zdrCache && deps.now() - zdrCache.at < ZDR_TTL_MS)
+            return zdrCache.flags;
+        const body = (await getJson(`${BASE}/endpoints/zdr`));
+        if (!body || !Array.isArray(body.data)) {
+            throw new ListError("unreachable", "OpenRouter sent a zero data retention list in an unknown form.");
+        }
+        const flags = new Map();
+        for (const row of body.data) {
+            const model = text(row?.model_id);
+            const tag = text(row?.tag);
+            // A missing or non-boolean flag is not stored, so the endpoint stays `unknown`.
+            if (model && tag && typeof row.safety_retention === "boolean") {
+                flags.set(`${model}\n${tag}`, row.safety_retention);
+            }
+        }
+        // Only a good answer is cached, so a failed fetch is tried again on the next request.
+        zdrCache = { at: deps.now(), flags };
+        return flags;
+    }
+    async function list(model) {
+        try {
+            const [body, flags] = await Promise.all([
+                getJson(`${BASE}/models/${model.split("/").map(encodeURIComponent).join("/")}/endpoints`),
+                zdrFlags(),
+            ]);
+            const endpoints = body?.data?.endpoints;
+            if (body === undefined || (Array.isArray(endpoints) && endpoints.length === 0)) {
+                throw new ListError("unknown-model", "OpenRouter has no providers for that model.");
+            }
+            if (!Array.isArray(endpoints)) {
+                throw new ListError("unreachable", "OpenRouter sent a provider list in an unknown form.");
+            }
+            const bySlug = new Map();
+            for (const endpoint of endpoints) {
+                const tag = text(endpoint?.tag);
+                const name = text(endpoint?.provider_name);
+                const slug = tag ? tag.split("/")[0] : name?.toLowerCase();
+                if (!slug)
+                    continue;
+                const modelId = text(endpoint?.model_id);
+                const flag = tag && modelId ? flags.get(`${modelId}\n${tag}`) : undefined;
+                const policy = flag === undefined ? "unknown" : flag ? "safety" : "zdr";
+                const seen = bySlug.get(slug);
+                if (!seen) {
+                    bySlug.set(slug, { slug, name: name ?? slug, policy });
+                }
+                else if (PRIVACY_RANK[policy] < PRIVACY_RANK[seen.policy]) {
+                    seen.policy = policy;
+                }
+            }
+            const providers = [...bySlug.values()].sort((a, b) => a.name.localeCompare(b.name));
+            if (providers.length === 0) {
+                throw new ListError("unknown-model", "OpenRouter has no providers for that model.");
+            }
+            return { ok: true, providers };
+        }
+        catch (error) {
+            if (error instanceof ListError)
+                return { ok: false, reason: error.reason, error: error.message };
+            return { ok: false, reason: "unreachable", error: "OpenRouter could not be reached." };
+        }
+    }
+    return { list };
+}

package/dist/services/openrouter-routes.d.ts

@@ -0,0 +1,9 @@
+import type { RouteResult } from "./chat/chat-routes.js";
+/**
+ * The OpenRouter routing routes of the External API card: the provider list of a
+ * model with data policy labels, and the save of `memoryExtraParams.provider`.
+ * Returns undefined for paths it does not own.
+ */
+export declare function routeOpenRouter(path: string, method: string, url: URL, readBody: () => Promise<any>, ctx: {
+    cwd: string;
+}): Promise<RouteResult | undefined>;

package/dist/services/openrouter-routes.js

@@ -0,0 +1,68 @@
+import { log } from "./logger.js";
+import { createOpenRouterProviders, isModelId } from "./openrouter-providers.js";
+import { isOpenRouterUrl, parseRouting, removeProviderEdits, routingEdits, } from "./openrouter-routing-config.js";
+const PROVIDERS_PATH = "/api/settings/external-api/openrouter-providers";
+const ROUTING_PATH = "/api/settings/external-api/openrouter-routing";
+/** Reads `globalThis.fetch` at call time, so a test can replace it. */
+const providers = createOpenRouterProviders({
+    fetch: (input, init) => globalThis.fetch(input, init),
+    now: () => Date.now(),
+});
+const NOT_OPENROUTER = "Save the OpenRouter endpoint first. Routing applies only to an OpenRouter API URL.";
+const fail = (status, error) => ({ status, body: { error } });
+/**
+ * The OpenRouter routing routes of the External API card: the provider list of a
+ * model with data policy labels, and the save of `memoryExtraParams.provider`.
+ * Returns undefined for paths it does not own.
+ */
+export async function routeOpenRouter(path, method, url, readBody, ctx) {
+    if (path === PROVIDERS_PATH && method === "GET") {
+        const model = url.searchParams.get("model");
+        if (!isModelId(model)) {
+            return fail(400, "Enter a model ID in the form author/model, for example deepseek/deepseek-chat");
+        }
+        return { status: 200, body: await providers.list(model) };
+    }
+    if (path === ROUTING_PATH && method === "POST") {
+        const body = await readBody();
+        if (typeof body?.revision !== "string")
+            return fail(400, "Revision required");
+        // `routing: null` removes the whole provider object. `{}` clears the managed fields only.
+        const removeAll = body.routing === null;
+        const parsed = removeAll ? { ok: true, routing: {} } : parseRouting(body.routing);
+        if (!parsed.ok)
+            return fail(400, parsed.error);
+        const { writeGlobalConfigKeys, ConfigConflictError } = await import("./global-config-writer.js");
+        let provider;
+        let revision;
+        try {
+            ({ revision } = await writeGlobalConfigKeys({}, body.revision, {
+                only: new Set(["memoryExtraParams", "memoryExtraParams.provider"]),
+                derive: (current) => {
+                    // A clearing save is always allowed, so a stale provider can go after a switch of endpoint.
+                    if (Object.keys(parsed.routing).length > 0 && !isOpenRouterUrl(current.memoryApiUrl)) {
+                        throw new Error(NOT_OPENROUTER);
+                    }
+                    if (removeAll)
+                        return removeProviderEdits(current.memoryExtraParams);
+                    const result = routingEdits(current.memoryExtraParams, parsed.routing);
+                    provider = result.provider;
+                    return result.edits;
+                },
+            }));
+        }
+        catch (error) {
+            return fail(error instanceof ConfigConflictError ? 409 : 400, error instanceof Error ? error.message : "Routing not saved");
+        }
+        // The file is already saved; a reload problem must not report the save as failed.
+        try {
+            const { refreshConfigIfChanged } = await import("../config.js");
+            refreshConfigIfChanged(ctx.cwd);
+        }
+        catch (error) {
+            log("Routing saved, but reloading settings failed", { error: error instanceof Error ? error.message : String(error) }, "error");
+        }
+        return { status: 200, body: { revision, provider: provider ?? null } };
+    }
+    return undefined;
+}