@jsonstudio/llms 0.6.802 → 0.6.954

package/dist/filters/builtin/add-fields-filter.d.ts

@@ -0,0 +1,8 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+export declare class AddFieldsFilter implements Filter<JsonObject> {
+    readonly name = "add_fields";
+    readonly stage: any;
+    private readonly fields;
+    constructor(stage: FilterContext['stage'], fields: Record<string, unknown>);
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/builtin/blacklist-filter.d.ts

@@ -0,0 +1,8 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+export declare class BlacklistFilter implements Filter<JsonObject> {
+    readonly name = "blacklist";
+    readonly stage: any;
+    private readonly deny;
+    constructor(stage: FilterContext['stage'], deny: string[]);
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/builtin/whitelist-filter.d.ts

@@ -0,0 +1,8 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+export declare class WhitelistFilter implements Filter<JsonObject> {
+    readonly name = "whitelist";
+    readonly stage: any;
+    private readonly allow;
+    constructor(stage: FilterContext['stage'], allow: string[]);
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/engine.d.ts

@@ -0,0 +1,16 @@
+import type { Filter, FilterContext, FieldMapConfig, JsonObject } from './types.js';
+export declare class FilterEngine {
+    private readonly filters;
+    private fieldMap?;
+    private readonly transforms;
+    registerFilter(filter: Filter): void;
+    setFieldMap(config: FieldMapConfig): void;
+    registerTransform(name: string, fn: (v: unknown) => unknown): void;
+    run(stage: FilterContext['stage'], payload: JsonObject, ctxBase: Omit<FilterContext, 'stage'>): Promise<JsonObject>;
+    private applyFieldMap;
+    private coerce;
+    private deepClone;
+    private mutateWildcardPath;
+    private getByPath;
+    private setByPath;
+}

package/dist/filters/special/request-tool-choice-policy.d.ts

@@ -0,0 +1,11 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+/**
+ * Tool choice policy:
+ * - If tools exist and no tool_choice, set tool_choice='auto'
+ * - If no tools, remove tool_choice
+ */
+export declare class RequestToolChoicePolicyFilter implements Filter<JsonObject> {
+    readonly name = "request_tool_choice_policy";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/special/response-finish-invariants.d.ts

@@ -0,0 +1,11 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+/**
+ * Ensure finish_reason and content invariants on response side:
+ * - If tool_calls present, finish_reason defaults to 'tool_calls'
+ * - If tool_calls present, message.content=null (Chat path)
+ */
+export declare class ResponseFinishInvariantsFilter implements Filter<JsonObject> {
+    readonly name = "response_finish_invariants";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/special/response-openai-to-responses-bridge.d.ts

@@ -0,0 +1,13 @@
+import type { Filter, FilterContext, JsonObject, FilterResult } from '../types.js';
+/**
+ * ResponseOpenAIToResponsesBridgeFilter
+ * - 将 OpenAI Chat 形状的响应桥接为 OpenAI Responses 形状
+ * - 与 Anthropic 并行：使用 filter 进行形状/协议转换（而非 endpoint 分支）
+ * - 阶段：response_post（在基础规范化之后执行）
+ */
+export declare class ResponseOpenAIToResponsesBridgeFilter implements Filter<JsonObject> {
+    readonly name = "response_openai_to_responses_bridge";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject, ctx: FilterContext): Promise<FilterResult<JsonObject>>;
+}
+export default ResponseOpenAIToResponsesBridgeFilter;

package/dist/filters/special/response-tool-arguments-blacklist.d.ts

@@ -0,0 +1,12 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+/**
+ * ResponseToolArgumentsBlacklistFilter
+ * - Remove keys listed in ROUTECODEX_TOOLARGS_BLACKLIST from tool_calls[].function.arguments (after decode).
+ * - Default: empty blacklist (no-op). Enables incremental hardening without risking valid params.
+ * Stage: response_pre
+ */
+export declare class ResponseToolArgumentsBlacklistFilter implements Filter<JsonObject> {
+    readonly name = "response_tool_arguments_blacklist";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/special/response-tool-arguments-schema-converge.d.ts

@@ -0,0 +1,13 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+/**
+ * ResponseToolArgumentsSchemaConvergeFilter
+ * - If tool schemas are available on context (context.toolSchemas[name] = JSONSchema),
+ *   keep only keys defined in schema.properties for each tool call arguments.
+ * - Does not validate or coerce types; only converges keys to schema surface.
+ * - Stage: response_pre
+ */
+export declare class ResponseToolArgumentsSchemaConvergeFilter implements Filter<JsonObject> {
+    readonly name = "response_tool_arguments_schema_converge";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject, context?: FilterContext): FilterResult<JsonObject>;
+}

package/dist/filters/special/response-tool-arguments-stringify.d.ts

@@ -0,0 +1,9 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+/**
+ * Ensure choices[*].message.tool_calls[].function.arguments is a JSON string.
+ */
+export declare class ResponseToolArgumentsStringifyFilter implements Filter<JsonObject> {
+    readonly name = "response_tool_arguments_stringify";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject): FilterResult<JsonObject>;
+}

package/dist/filters/special/response-tool-arguments-whitelist.d.ts

@@ -0,0 +1,11 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+/**
+ * Whitelist tool function arguments keys after decode to match schema (e.g., keep only 'command'/'workdir').
+ * Stage: response_pre. Runs after TOON decode and before stringify.
+ */
+export declare class ResponseToolArgumentsWhitelistFilter implements Filter<JsonObject> {
+    readonly name = "response_tool_arguments_whitelist";
+    readonly stage: FilterContext['stage'];
+    private getWhitelist;
+    apply(input: JsonObject, context?: FilterContext): FilterResult<JsonObject>;
+}

package/dist/filters/special/tool-filter-hooks.d.ts

@@ -0,0 +1,19 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+interface ToolFilterConfigCategoryPolicy {
+    mode?: 'allow' | 'block' | 'require_content';
+    requireContentTypes?: string[];
+}
+interface ToolFilterConfig {
+    categories?: {
+        vision?: ToolFilterConfigCategoryPolicy;
+        mcp?: ToolFilterConfigCategoryPolicy;
+    };
+}
+export declare function setGlobalToolFilterConfig(cfg: ToolFilterConfig | undefined): void;
+export declare function getGlobalToolFilterConfig(): ToolFilterConfig;
+export declare class ToolFilterHookFilter implements Filter<JsonObject> {
+    readonly name = "tool_filter_hook";
+    readonly stage: FilterContext['stage'];
+    apply(input: JsonObject, ctx: FilterContext): FilterResult<JsonObject>;
+}
+export {};

package/dist/filters/special/tool-post-constraints.d.ts

@@ -0,0 +1,31 @@
+import type { Filter, FilterContext, FilterResult, JsonObject } from '../types.js';
+type ConstraintMatchCondition = 'missing' | 'empty' | 'missingOrEmpty';
+interface ToolConstraintRule {
+    id: string;
+    direction: 'request' | 'response' | 'both';
+    providerProtocol?: string;
+    providerId?: string;
+    modelId?: string;
+    toolNamePattern?: string;
+    path: string;
+    when: ConstraintMatchCondition;
+    action: 'warn' | 'patch' | 'drop';
+    patchText?: string;
+}
+interface ToolGovernanceConstraintsConfig {
+    rules: ToolConstraintRule[];
+}
+/**
+ * Tool post-constraints filter（请求/响应阶段的最后一小步约束）：
+ * - 默认只记录（warn），不修改 payload；
+ * - 修剪/修复行为完全由配置驱动（ToolGovernanceConstraintsConfig）；
+ * - 当前仅实现缺失/空 description 的简单场景，后续可按配置扩展。
+ */
+export declare class ToolPostConstraintsFilter implements Filter<JsonObject> {
+    readonly name = "tool_post_constraints";
+    readonly stage: FilterContext['stage'];
+    private readonly config;
+    constructor(stage: FilterContext['stage'], config?: ToolGovernanceConstraintsConfig);
+    apply(input: JsonObject, ctx: FilterContext): FilterResult<JsonObject>;
+}
+export {};

package/dist/filters/types.d.ts

@@ -0,0 +1,68 @@
+export type JsonObject = Record<string, unknown>;
+export type FilterStage = 'request_pre' | 'request_map' | 'request_post' | 'request_finalize' | 'response_pre' | 'response_map' | 'response_post' | 'response_finalize';
+export interface FilterContext {
+    requestId?: string;
+    model?: string;
+    endpoint?: string;
+    provider?: string;
+    profile?: string;
+    stage: FilterStage;
+    stream?: boolean;
+    toolFilterHints?: ToolFilterHints;
+    debug?: {
+        emit?: (event: string, data: unknown) => void;
+    };
+}
+export interface FilterResult<T = JsonObject> {
+    ok: boolean;
+    data: T;
+    warnings?: string[];
+    metrics?: Record<string, unknown>;
+}
+export interface Filter<T = JsonObject> {
+    readonly name: string;
+    readonly stage: FilterStage;
+    apply(input: T, ctx: FilterContext): Promise<FilterResult<T>> | FilterResult<T>;
+}
+export type ToolFilterAction = 'allow' | 'block' | 'rewrite';
+export interface ToolFilterDecision {
+    name: string;
+    action: ToolFilterAction;
+    reason?: string;
+    category?: string;
+}
+export interface ToolFilterHints {
+    requestedDecisions?: ToolFilterDecision[];
+    categories?: {
+        vision?: boolean;
+        mcp?: boolean;
+        webSearch?: boolean;
+        codeExecution?: boolean;
+        fileSearch?: boolean;
+        dataAnalysis?: boolean;
+    };
+    categoryOverrides?: {
+        vision?: 'allow' | 'block' | 'require_content';
+        mcp?: 'allow' | 'block';
+    };
+    decided?: ToolFilterDecision[];
+}
+export interface FieldMapRule {
+    sourcePath: string;
+    targetPath: string;
+    type?: 'string' | 'number' | 'boolean' | 'object' | 'array';
+    transform?: string;
+}
+export interface FieldMapConfig {
+    request?: FieldMapRule[];
+    response?: FieldMapRule[];
+}
+export interface WhitelistConfig {
+    allow: string[];
+}
+export interface BlacklistConfig {
+    deny: string[];
+}
+export interface AddFieldsConfig {
+    fields: Record<string, unknown>;
+}

package/dist/filters/utils/fieldmap-loader.d.ts

@@ -0,0 +1,2 @@
+import type { FieldMapConfig } from '../types.js';
+export declare function loadFieldMapConfig(relativeJsonPath: string): Promise<FieldMapConfig | null>;

package/dist/filters/utils/snapshot-writer.d.ts

@@ -0,0 +1,10 @@
+import type { FilterStage } from '../types.js';
+export declare function writeFilterSnapshot(options: {
+    requestId?: string;
+    endpoint?: string;
+    profile?: string;
+    stage: FilterStage;
+    name?: string;
+    tag?: string;
+    data: unknown;
+}): Promise<void>;

package/dist/guidance/index.d.ts

@@ -0,0 +1,3 @@
+export declare function augmentOpenAITools(tools: unknown[]): unknown[];
+export declare function augmentAnthropicTools(tools: unknown[]): unknown[];
+export declare function buildSystemToolGuidance(): string;

package/dist/guidance/index.js

@@ -19,6 +19,58 @@ function appendOnce(desc, guidance, marker) {
         return base;
     return base ? `${base}\n\n${guidance}` : guidance;
 }
+function buildApplyPatchGuidanceText() {
+    const marker = '[Codex ApplyPatch Guidance]';
+    const text = [
+        marker,
+        'Send ONLY patch text (do not describe tools in prose).',
+        '',
+        '✅ Supported patch text formats:',
+        '  A) Internal patch format: "*** Begin Patch" / "*** End Patch" + "*** Update/Add/Delete File"',
+        '  B) GNU unified diff: "diff --git", "---/+++", "@@" hunks, /dev/null for new files',
+        '',
+        '✅ Create vs update:',
+        '  - "*** Update File" MUST target an existing file (no implicit create).',
+        '  - To create a file, use "*** Add File:" (or GNU diff with --- /dev/null).',
+        '',
+        '✅ Common pitfalls:',
+        '  - In "*** Add File", EVERY content line must start with "+".',
+        '  - In "*** Update File" hunks, EVERY line must start with one of: " " (context), "-" (remove), "+" (add), or "@@" (hunk header).',
+        '',
+        '✅ Minimal examples (patch text):',
+        '',
+        '1) Create a new file',
+        '```patch',
+        '*** Begin Patch',
+        '*** Add File: path/to/new.txt',
+        '+Line 1',
+        '+Line 2',
+        '*** End Patch',
+        '```',
+        '',
+        '2) Replace one line in an existing file (keep surrounding context)',
+        '```patch',
+        '*** Begin Patch',
+        '*** Update File: path/to/existing.txt',
+        '@@',
+        ' Line 1',
+        '-Line 2',
+        '+Modified Line 2',
+        ' Line 3',
+        '*** End Patch',
+        '```',
+        '',
+        '3) Delete a file',
+        '```patch',
+        '*** Begin Patch',
+        '*** Delete File: path/to/obsolete.txt',
+        '*** End Patch',
+        '```',
+        '',
+        'Paths must stay relative to the workspace root (no leading "/" or drive letters).'
+    ].join('\n');
+    return { marker, text };
+}
 function augmentShell(fn) {
     const marker = '[Codex Shell Guidance]';
     const guidance = [
@@ -59,53 +111,20 @@ function augmentShell(fn) {
     fn.description = appendOnce(fn.description, guidance, marker);
 }
 function augmentApplyPatch(fn) {
-    const marker = '[Codex ApplyPatch Guidance]';
-    const guidance = [
-        marker,
-        'Provide structured edits instead of raw diff text. Always send JSON arguments with a `changes` array.',
-        'Each change describes one operation, e.g. `{ "file": "src/foo.ts", "kind": "insert_after", "anchor": "const foo = 1;", "lines": ["const bar = 2;"] }`.',
-        'Supported kinds: insert_after, insert_before, replace, delete, create_file, delete_file.',
-        'Paths must stay relative to the workspace root (no leading "/" or drive letters).',
-        'Insert operations require `anchor` text; replace/delete require exact `target` snippets; `lines` omit "+/-" prefixes.',
-        'If you must emit raw patch text, use "*** Begin Patch" / "*** End Patch" with "*** Update/Add/Delete File" headers (no "diff --git").',
-        'Do not output "*** Create File:"; use "*** Add File:".'
-    ].join('\n');
+    const { marker, text: guidance } = buildApplyPatchGuidanceText();
     const params = ensureObjectSchema(fn.parameters);
     const props = params.properties;
-    props.file = { type: 'string', description: 'Optional default file path (relative) for changes' };
-    props.instructions = { type: 'string', description: 'Optional human-readable summary' };
-    props.changes = {
-        type: 'array',
-        minItems: 1,
-        items: {
-            type: 'object',
-            additionalProperties: false,
-            required: ['kind'],
-            properties: {
-                file: { type: 'string', description: 'Relative path for this change (overrides top-level file)' },
-                kind: {
-                    type: 'string',
-                    description: 'insert_after | insert_before | replace | delete | create_file | delete_file'
-                },
-                anchor: { type: 'string', description: 'Required for insert_before / insert_after' },
-                target: { type: 'string', description: 'Snippet to replace/delete' },
-                lines: {
-                    description: 'New content for insert/replace/create operations',
-                    oneOf: [
-                        { type: 'string' },
-                        { type: 'array', items: { type: 'string' } }
-                    ]
-                },
-                use_anchor_indent: {
-                    type: 'boolean',
-                    description: 'Reapply the indentation of the anchor snippet to inserted lines'
-                }
-            }
-        }
+    props.patch = {
+        type: 'string',
+        description: 'Patch text. Supports "*** Begin Patch" format or GNU unified diff. Paths must be workspace-relative.'
+    };
+    props.input = {
+        type: 'string',
+        description: 'Alias of patch (patch text). Prefer using patch.'
     };
     params.required = Array.isArray(params.required) ? params.required : [];
-    if (!params.required.includes('changes')) {
-        params.required.push('changes');
+    if (!params.required.includes('patch')) {
+        params.required.push('patch');
     }
     params.additionalProperties = false;
     fn.parameters = params;
@@ -161,8 +180,11 @@ export function augmentOpenAITools(tools) {
             try {
                 if (n === 'shell')
                     augmentShell(fn);
-                else if (n === 'apply_patch')
+                else if (n === 'apply_patch') {
+                    const { marker, text } = buildApplyPatchGuidanceText();
+                    fn.description = appendOnce(fn.description, text, marker);
                     augmentApplyPatch(fn);
+                }
                 else if (n === 'update_plan')
                     augmentUpdatePlan(fn);
                 else if (n === 'view_image')
@@ -194,49 +216,22 @@ export function augmentAnthropicTools(tools) {
             const n = name.trim();
             try {
                 if (n === 'apply_patch') {
-                    if (!isObject(schema.properties?.changes)) {
-                        schema.properties.file = { type: 'string', description: 'Optional default file path' };
-                        schema.properties.instructions = { type: 'string', description: 'Optional summary' };
-                        schema.properties.changes = {
-                            type: 'array',
-                            minItems: 1,
-                            items: {
-                                type: 'object',
-                                additionalProperties: false,
-                                required: ['kind'],
-                                properties: {
-                                    file: { type: 'string' },
-                                    kind: { type: 'string' },
-                                    anchor: { type: 'string' },
-                                    target: { type: 'string' },
-                                    lines: {
-                                        oneOf: [
-                                            { type: 'string' },
-                                            { type: 'array', items: { type: 'string' } }
-                                        ]
-                                    },
-                                    use_anchor_indent: { type: 'boolean' }
-                                }
-                            }
-                        };
-                    }
+                    schema.properties.patch = {
+                        type: 'string',
+                        description: 'Patch text (*** Begin Patch / *** End Patch or GNU unified diff).'
+                    };
+                    schema.properties.input = {
+                        type: 'string',
+                        description: 'Alias of patch (patch text). Prefer patch.'
+                    };
                     if (!Array.isArray(schema.required))
                         schema.required = [];
-                    if (!schema.required.includes('changes'))
-                        schema.required.push('changes');
+                    if (!schema.required.includes('patch'))
+                        schema.required.push('patch');
                     schema.additionalProperties = false;
                     copy.input_schema = schema;
                     const marker = '[Codex ApplyPatch Guidance]';
-                    const guidance = [
-                        marker,
-                        'Before using apply_patch, always read the latest content of the target file (via shell or another tool) and base your changes on that content.',
-                        'Provide structured changes (insert_after / insert_before / replace / delete / create_file / delete_file) instead of raw patch text.',
-                        'Each change must include the target file (relative path) plus anchor/target snippets and the replacement lines.',
-                        '所有路径必须相对工作区根目录，禁止输出以 / 或盘符开头的绝对路径。',
-                        'Example: {\"changes\":[{\"file\":\"src/app.ts\",\"kind\":\"replace\",\"target\":\"const answer = 41;\",\"lines\":[\"const answer = 42;\"]}]}（修改同一文件时尽量只修改一段连续区域，多处不相邻修改请拆成多次 apply_patch 调用）.',
-                        'Raw patch text must use "*** Begin Patch" / "*** End Patch" + "*** Update/Add/Delete File" headers（不要输出 "diff --git"）。',
-                        '不要输出 "*** Create File:"；请使用 "*** Add File:".'
-                    ].join('\n');
+                    const guidance = buildApplyPatchGuidanceText().text;
                     copy.description = appendOnce(desc, guidance, marker);
                 }
                 if (n === 'shell') {
@@ -271,7 +266,7 @@ export function buildSystemToolGuidance() {
     lines.push(bullet('shell: Place ALL intent into the command argv array only; do not invent extra keys. / shell 所有意图写入 command 数组，不要添加额外键名。'));
     lines.push(bullet('File writes are FORBIDDEN via shell (no redirection, no here-doc, no sed -i, no ed -s, no tee). Use apply_patch ONLY. / 通过 shell 写文件一律禁止（不得使用重定向、heredoc、sed -i、ed -s、tee）；必须使用 apply_patch。'));
     lines.push(bullet('apply_patch: Before writing, always read the target file first and compute changes against the latest content using appropriate tools. / apply_patch 在写入前必须先通过合适的工具读取目标文件最新内容，并基于该内容生成变更。'));
-    lines.push(bullet('apply_patch: Provide structured JSON arguments with a `changes` array (insert_after / insert_before / replace / delete / create_file / delete_file); omit "+/-" prefixes in `lines`; file paths必须是相对路径。 / apply_patch 仅接受结构化 JSON。'));
+    lines.push(bullet('apply_patch: Send patch text only. Supported formats: "*** Begin Patch" OR GNU unified diff. "*** Update File" never implicitly creates files—use "*** Add File:" (or /dev/null diff). / apply_patch：仅发送补丁文本，支持 "*** Begin Patch" 或 GNU diff；"*** Update File" 不会隐式创建文件。'));
     lines.push(bullet('apply_patch: For a given file, prefer one contiguous change block per call; if you need to touch non-adjacent regions, split them into multiple apply_patch calls. / apply_patch 修改同一文件时尽量只提交一段连续补丁，多个不相邻位置请拆成多次调用。'));
     lines.push(bullet('update_plan: Keep exactly one step in_progress; others pending/completed. / 仅一个 in_progress 步骤。'));
     lines.push(bullet('view_image: Path must be an image file (.png .jpg .jpeg .gif .webp .bmp .svg). / 仅图片路径。'));

package/dist/http/sse-response.d.ts

@@ -0,0 +1,22 @@
+import type { ServerResponse } from 'node:http';
+import type { Readable } from 'node:stream';
+type AnyObj = Record<string, unknown>;
+/**
+ * Pipe an SSE Readable to Node http.ServerResponse
+ */
+export declare function sendNodeSSE(res: ServerResponse, stream: Readable): void;
+/**
+ * Express response variant (duck-typed): res.set, res.write, res.end
+ */
+export declare function sendExpressSSE(res: AnyObj, stream: Readable): void;
+/**
+ * Fastify reply variant: reply.raw is ServerResponse
+ */
+export declare function sendFastifySSE(reply: AnyObj, stream: Readable): void;
+/**
+ * If the given payload contains __sse_responses or sseStream, stream it via the provided response object.
+ * Otherwise, send JSON.
+ * - Supported responders: Node ServerResponse, Express res, Fastify reply
+ */
+export declare function sendSSEOrJSON(resOrReply: AnyObj, payload: AnyObj): any;
+export {};

package/dist/router/virtual-router/bootstrap.d.ts

@@ -0,0 +1,6 @@
+import { type VirtualRouterBootstrapInput, type VirtualRouterBootstrapResult } from './types.js';
+/**
+ * 将用户提供的 Virtual Router 配置（或包含 virtualrouter 字段的整体配置）
+ * 规范化为 VirtualRouterConfig，供 HubPipeline / VirtualRouterEngine 直接使用。
+ */
+export declare function bootstrapVirtualRouterConfig(input: VirtualRouterBootstrapInput): VirtualRouterBootstrapResult;

package/dist/router/virtual-router/bootstrap.js

@@ -29,12 +29,32 @@ export function bootstrapVirtualRouterConfig(input) {
     }
     const webSearch = normalizeWebSearch(section.webSearch, routingSource);
     validateWebSearchRouting(webSearch, routingSource);
-    const { runtimeEntries, aliasIndex } = buildProviderRuntimeEntries(providersSource);
+    const execCommandGuard = normalizeExecCommandGuard(section.execCommandGuard);
+    const { runtimeEntries, aliasIndex, modelIndex } = buildProviderRuntimeEntries(providersSource);
     const { routing, targetKeys } = expandRoutingTable(routingSource, aliasIndex);
     if (!routing.default || routing.default.length === 0) {
         throw new VirtualRouterError('Virtual Router default route must contain at least one provider target', VirtualRouterErrorCode.CONFIG_ERROR);
     }
-    const { profiles: providerProfiles, targetRuntime } = buildProviderProfiles(targetKeys, runtimeEntries);
+    // Build provider profiles for:
+    // - routing targets (targetKeys), and
+    // - all declared provider models across all auth aliases (modelIndex × aliasIndex),
+    // so that "direct model" and "prefer model" routing can bypass route pools when needed.
+    const expandedTargetKeys = new Set(targetKeys);
+    for (const [providerId, aliases] of aliasIndex.entries()) {
+        const models = modelIndex.get(providerId) ?? [];
+        if (!models.length || !aliases.length) {
+            continue;
+        }
+        for (const alias of aliases) {
+            const runtimeKey = buildRuntimeKey(providerId, alias);
+            for (const modelId of models) {
+                if (modelId && typeof modelId === 'string') {
+                    expandedTargetKeys.add(`${runtimeKey}.${modelId}`);
+                }
+            }
+        }
+    }
+    const { profiles: providerProfiles, targetRuntime } = buildProviderProfiles(expandedTargetKeys, runtimeEntries);
     const classifier = normalizeClassifier(section.classifier);
     const loadBalancing = section.loadBalancing ?? DEFAULT_LOAD_BALANCING;
     const health = section.health ?? DEFAULT_HEALTH;
@@ -46,7 +66,8 @@ export function bootstrapVirtualRouterConfig(input) {
         loadBalancing,
         health,
         contextRouting,
-        ...(webSearch ? { webSearch } : {})
+        ...(webSearch ? { webSearch } : {}),
+        ...(execCommandGuard ? { execCommandGuard } : {})
     };
     return {
         config,
@@ -68,13 +89,17 @@ function extractVirtualRouterSection(input) {
     const health = normalizeHealth(section.health ?? root.health);
     const contextRouting = normalizeContextRouting(section.contextRouting ?? root.contextRouting);
     const webSearch = section.webSearch ?? root.webSearch;
-    return { providers, routing, classifier, loadBalancing, health, contextRouting, webSearch };
+    const execCommandGuard = section.execCommandGuard ?? root.execCommandGuard;
+    return { providers, routing, classifier, loadBalancing, health, contextRouting, webSearch, execCommandGuard };
 }
 function buildProviderRuntimeEntries(providers) {
     const runtimeEntries = {};
     const aliasIndex = new Map();
+    const modelIndex = new Map();
     for (const [providerId, providerRaw] of Object.entries(providers)) {
         const normalizedProvider = normalizeProvider(providerId, providerRaw);
+        const modelsNode = asRecord(providerRaw?.models);
+        modelIndex.set(providerId, modelsNode ? Object.keys(modelsNode).filter(Boolean) : []);
         const authEntries = extractProviderAuthEntries(providerId, providerRaw);
         if (!authEntries.length) {
             throw new VirtualRouterError(`Provider ${providerId} requires at least one auth entry`, VirtualRouterErrorCode.CONFIG_ERROR);
@@ -126,7 +151,7 @@ function buildProviderRuntimeEntries(providers) {
             };
         }
     }
-    return { runtimeEntries, aliasIndex };
+    return { runtimeEntries, aliasIndex, modelIndex };
 }
 function expandRoutingTable(routingSource, aliasIndex) {
     const routing = {};
@@ -690,6 +715,25 @@ function normalizeWebSearch(input, routingSource) {
         ...(force ? { force } : {})
     };
 }
+function normalizeExecCommandGuard(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        return undefined;
+    }
+    const record = input;
+    const enabledRaw = record.enabled;
+    const enabled = enabledRaw === true ||
+        (typeof enabledRaw === 'string' && enabledRaw.trim().toLowerCase() === 'true') ||
+        (typeof enabledRaw === 'number' && enabledRaw === 1);
+    if (!enabled) {
+        return undefined;
+    }
+    const policyFileRaw = record.policyFile ?? record?.policy_file;
+    const policyFile = typeof policyFileRaw === 'string' && policyFileRaw.trim().length ? policyFileRaw.trim() : undefined;
+    return {
+        enabled: true,
+        ...(policyFile ? { policyFile } : {})
+    };
+}
 function extractProviderAuthEntries(providerId, raw) {
     const provider = asRecord(raw);
     const auth = asRecord(provider.auth);

package/dist/router/virtual-router/classifier.d.ts

@@ -0,0 +1,10 @@
+import type { ClassificationResult, RoutingFeatures, VirtualRouterClassifierConfig } from './types.js';
+export declare class RoutingClassifier {
+    private readonly config;
+    constructor(config: VirtualRouterClassifierConfig);
+    classify(features: RoutingFeatures): ClassificationResult;
+    private buildResult;
+    private ensureDefaultCandidate;
+    private orderRoutes;
+    private routeWeight;
+}