OriginRouter CLIConfiguration

Configuration

Configuration is split across OriginRouter global settings, native agent configuration, providers and routes, Local API, and session launch options. Identify the owning layer before making a change.

For interactive management of providers, models, and device state, start with App Provider Control.

This reference applies to OriginRouter CLI 0.2.2. CLI state lives under ORIGINROUTER_HOME, or .originrouter in the user directory when the environment variable is unset.

Configuration files

File	Purpose	Sensitivity
`$ORIGINROUTER_HOME/config.json`	Providers, routes, update policy, and Agent defaults	Private, readable and writable by the current user
`$ORIGINROUTER_HOME/local-api.json`	Local API port, bind address, LAN, and relay mode	Private, readable and writable by the current user
`$ORIGINROUTER_HOME/local-api.token`	Local API bearer token	Secret; never copy it into logs or a repository
`$ORIGINROUTER_HOME/device.json`	Random installation device identity	Private; it is not a hardware fingerprint
`$ORIGINROUTER_HOME/daemon.state.json`	Current daemon runtime state	Runtime state; do not edit it manually

Do not manually edit tokens, device identity, or runtime state. Prefer CLI commands for writable configuration so validation, private file permissions, and migrations remain intact.

Writable configuration keys

Key / option	Type	Default	Write path	Purpose
`updates.mode`	`prompt \| auto \| off`	`prompt`	`config set` / `config unset`	Controls the CLI update policy
`agent.detailProfile`	`concise \| standard \| detailed`	`concise`	`agent detail set`	Controls display-safe Agent activity detail, not permission
`claude.baseUrl`	URL	unset	`config set claude.baseUrl`	Legacy direct Claude configuration; migrate to providers and routes
`claude.apiKey`	string	unset	`config set claude.apiKey`	Legacy secret field; avoid entering literals into shell history
`claude.model`	string	unset	`config set claude.model`	Legacy primary model
`claude.smallFastModel`	string	unset	`config set claude.smallFastModel`	Legacy fast model
`local-api.port` / `--port`	integer	`7437`	`local config set`	Local API listen port; restart the service after changing it
`local-api.bindAddress` / `--bind`	IP / host	`127.0.0.1`	`local config set`	A non-loopback address also requires explicit LAN access
`local-api.allowLan` / `--allow-lan`	`on \| off`	`off`	`local config set`	Exposes LAN access and requires a valid token
`local-api.relayMode` / `--relay-mode`	`auto \| cloud \| local \| custom`	`auto`	`local config set`	Selects account relay and local connection behavior
`local-api.relayUrl` / `--relay-url`	URL	official relay	`local config set`	Normally changed only for a custom relay

Provider fields and model routes are not arbitrary JSON keys. Use provider add/update and route set/clear; the CLI validates fields against the Provider Catalog and masks secrets.

Precedence

When the same dimension has multiple values, the active session resolves them in this order:

Wrapper options for the current launch, such as --originrouter-autonomy, --originrouter-detail, and --native-config.
Agent slot routes such as claude.main, claude.small, or codex.main.
Model and authentication settings saved by the selected Provider, Cloud, or Remote route source.
OriginRouter global defaults and built-in defaults.

Use originrouter env print --agent claude|codex to inspect the redacted merged environment. It shows the result without revealing original secrets.

Inspect configuration

originrouter config show
originrouter local config show
originrouter route list
originrouter provider list
originrouter env print --agent claude

Run these checks in order: inspect global configuration, Local API configuration, routes, providers, and finally Claude's redacted runtime environment.

env print shows the redacted effective agent environment for inspecting merged configuration. It is not a secret-retrieval command.

Update policy

Prompt before updating:

originrouter config set updates.mode prompt

Enable automatic updates:

originrouter config set updates.mode auto

Disable automatic updates:

originrouter config set updates.mode off

Inspect the current update status:

originrouter update status

Automatic update runs only when the installation method is supported, the global directory is writable, and no session is active. The updater does not invoke sudo automatically.

Local API and relay

originrouter local config set --port 7437 --bind 127.0.0.1
originrouter local config set --relay-mode auto
originrouter service restart

Run these commands in order: set the port and bind address, set the relay mode, then restart the service to apply the configuration.

auto uses the account connection while signed in and remains local while signed out. Use local only when the device must not access the account relay.

Confirm that the network is trusted before enabling LAN access:

originrouter local config set --bind 0.0.0.0 --allow-lan on
originrouter service restart

Run these commands in order: enable LAN access, then restart the service to apply the setting.

Agent launch options

Launch Claude with native configuration:

originrouter claude --native-config

Launch Codex with guarded approvals:

originrouter codex --originrouter-autonomy guarded

Launch Claude with detailed activity output:

originrouter claude --originrouter-detail detailed

Model source, presentation detail, and approval mode are independent dimensions. A presentation setting is not a permission setting.

Prefer os.environ/NAME references for provider secrets. The CLI and Local API mask secret fields, but shell history, debug output, and third-party tools may still record literal values entered directly.