Proxy and Governance

Proxy and Governance

Local OpenAI-compatible proxy

Code: app/src/main/proxy/
Default: http://127.0.0.1:3227/v1
Settings: proxyEnabled, proxyPort in llmeter-settings.json

Endpoints

• GET /v1/models
• POST /v1/chat/completions (streaming where implemented)

Auth

Clients use anylm_ API keys created in the app/org settings — not the Firebase session cookie. Keys are stored hashed in Firestore (apiKeys collection).

What the proxy is for

Other local tools (IDEs, scripts, OpenAI-compatible clients) can hit AnyLM-governed models on loopback.

What it is not

• Not a public internet server (bind loopback).
• Does not execute AnyLM tools or skills.
• Does not assemble project RAG the same way as the desktop chat UI (keep expectations clear in docs/UI copy).

Governance inside desktop chat

Separate from the proxy:

Piece	Role
governance.ts	Preflight / evaluate prompts
policy-engine.ts	Policy interpretation
api/usage, limits helpers	Record usage, check quotas
Org policies in Firestore	Model allowlists, content rules

On Spark, enforcement is honest-client. Rules stop privilege escalation in Firestore but cannot force usage telemetry.

API keys UX

• Create/revoke in settings / org admin surfaces
• Used by proxy clients as Authorization: Bearer anylm_…
• Never commit real keys; examples stay placeholders

Contributor notes

• When adding proxy routes, keep OpenAI shape where possible.
• Reuse identity/org checks already used for key verification.
• Document clearly that tool calling in external clients ≠ AnyLM tool runtime.