auto-model-router 0.19.0 → 0.21.0

package/src/server/http.ts

@@ -5,6 +5,8 @@ import { createProviders } from "./providers.ts";
 import { createBridgeFromConfig } from "../context/index.ts";
 import { createFeedbackStore, type Verdict } from "../cost/feedback.ts";
 import { createLedger } from "../cost/ledger.ts";
+import { createRetentionRunner } from "../cost/retention.ts";
+import { redactionRulesFor } from "../config/redaction.ts";
 import { createSessionOverrides } from "./overrides.ts";
 import { catalogView } from "./catalog-view.ts";
 import { buildUpstreamModels } from "../catalog/static-catalog.ts";
@@ -265,6 +267,18 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		},
 	);
 
+	// Compile the redaction rules before the listener exists: a rule that does
+	// not load is a hole in the guard, and an operator who configured redaction
+	// must not get a router that started and forwarded anyway. Programmatic
+	// overrides (an embedder's) never pass through the config schema, so this is
+	// the only place their rules are checked.
+	const redactionRules = redactionRulesFor(cfg.redaction);
+	if (redactionRules.length > 0) {
+		// Names only. The patterns describe the secrets and the matches are the
+		// secrets; neither belongs in a log line.
+		log.info("redaction enabled", { rules: redactionRules.map((r) => r.name).join(","), scanTools: cfg.redaction.scanTools });
+	}
+
 	if (context.enabled) {
 		log.info("agentdox context bridge enabled", {
 			url: cfg.context.baseUrl,
@@ -296,8 +310,24 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		log.warn("initial catalog fetch failed", { error: err instanceof Error ? err.message : String(err) });
 	});
 
-	// One housekeeping timer for both tables. `unref`'d so it never holds the
-	// process open.
+	// Ledger retention. The runner owns the once-an-hour floor, so the minute
+	// timer below, the boot run and `POST /v1/router/prune` cannot between them
+	// run a whole-ledger delete more often than that. It reads the window live,
+	// so a hot reload that lowers it applies on the next tick.
+	const retention = createRetentionRunner({ ledger, retentionDays: () => cfg.ledger.retentionDays });
+	const retain = (): void => {
+		try {
+			const result = retention.maybeRun();
+			if (result !== null && result.deleted > 0) {
+				log.info("pruned ledger rows past retention", { deleted: result.deleted, retentionDays: cfg.ledger.retentionDays });
+			}
+		} catch (err) {
+			log.warn("ledger retention prune failed", { error: err instanceof Error ? err.message : String(err) });
+		}
+	};
+
+	// One housekeeping timer for all three tables. `unref`'d so it never holds
+	// the process open.
 	const pruneTimer = setInterval(() => {
 		try {
 			const dropped = conversations.prune(cfg.ledger.conversationTtlMs);
@@ -315,21 +345,12 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		} catch (err) {
 			log.warn("context block prune failed", { error: err instanceof Error ? err.message : String(err) });
 		}
+		retain();
 	}, 60_000);
 	pruneTimer.unref();
 
-	// Ledger retention: hourly, and once at boot so a lowered setting takes
-	// effect without waiting. Reads the live config, so it hot-reloads.
-	const retain = (): void => {
-		try {
-			const dropped = ledger.prune?.(cfg.ledger.retentionDays) ?? 0;
-			if (dropped > 0) log.info("pruned ledger rows past retention", { dropped, retentionDays: cfg.ledger.retentionDays });
-		} catch (err) {
-			log.warn("ledger retention prune failed", { error: err instanceof Error ? err.message : String(err) });
-		}
-	};
-	const retentionTimer = setInterval(retain, 3_600_000);
-	retentionTimer.unref();
+	// Once shortly after boot, so a lowered window takes effect without waiting
+	// out an hour; the runner's own floor governs everything after that.
 	setTimeout(retain, 5_000).unref();
 
 	// Periodically refetch the (key-scoped) catalog in the background so
@@ -665,6 +686,15 @@ export function startServer(cfg: RouterConfig): StartedServer {
 						}),
 					);
 				}
+				if (req.method === "POST" && url.pathname === "/v1/router/prune") {
+					// A front door of the team edition holds a READ-ONLY handle on the
+					// ledger file by design, so this route is the only way it can act
+					// on its own retention policy — and the once-an-hour floor is the
+					// runner's, not the caller's, so calling it in a loop is harmless.
+					const result = retention.runNow();
+					if (result.deleted > 0) log.info("pruned ledger rows past retention", { deleted: result.deleted, retentionDays: cfg.ledger.retentionDays });
+					return json({ ...result, retentionDays: cfg.ledger.retentionDays });
+				}
 				if (req.method === "POST" && url.pathname === "/v1/router/feedback") {
 					// A user verdict on the newest routed turn of an omp session.
 					const body = (await req.json().catch(() => null)) as Record<string, unknown> | null;

package/src/server/redact.ts

@@ -0,0 +1,104 @@
+/**
+ * Redaction: strings an operator forbids from leaving the process.
+ *
+ * An operator with a compliance obligation needs two things a router can
+ * actually give: certainty that certain shapes of text never reach a provider,
+ * and evidence that the guard ran. This module is the first half; the ledger's
+ * `redactions` count is the second. Neither ever records WHAT was matched — a
+ * redaction log that quotes the secret is just a second copy of the secret.
+ *
+ * `runTurn` applies this to the rendered upstream body, which is the
+ * chat-completions shape every front end normalises to and every provider
+ * client renders from, so the guard sits between the router and ALL of them:
+ * a new upstream cannot bypass it by construction.
+ */
+
+import type { CompiledRedactionRule } from "../config/redaction.ts";
+
+/** Applies every rule to one string. Returns the text and how many matches were replaced. */
+export function redactText(text: string, rules: readonly CompiledRedactionRule[]): { text: string; count: number } {
+	let out = text;
+	let count = 0;
+	for (const rule of rules) {
+		// `replace` with a global regex resets and advances `lastIndex` itself,
+		// including over a zero-width position — which compilation refuses anyway.
+		out = out.replace(rule.regex, () => {
+			count++;
+			return rule.replacement;
+		});
+	}
+	return { text: out, count };
+}
+
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** Redacts a message's `content`, whether it is a string or an array of parts. Returns matches replaced. */
+function redactContent(message: Rec, rules: readonly CompiledRedactionRule[]): number {
+	const content = message.content;
+	if (typeof content === "string") {
+		const r = redactText(content, rules);
+		if (r.count > 0) message.content = r.text;
+		return r.count;
+	}
+	if (!Array.isArray(content)) return 0;
+	let count = 0;
+	for (const part of content) {
+		// Text parts only: an `image_url` part carries a data URI, which no
+		// redaction rule can meaningfully read and every rule would be slow over.
+		if (!isRec(part) || part.type !== "text" || typeof part.text !== "string") continue;
+		const r = redactText(part.text, rules);
+		if (r.count > 0) part.text = r.text;
+		count += r.count;
+	}
+	return count;
+}
+
+/**
+ * Redacts the rendered upstream body in place and returns how many matches
+ * were replaced.
+ *
+ * The body is the chat-completions shape: every front end (chat completions,
+ * Responses, Anthropic Messages) translates into it before parsing, and every
+ * upstream client renders its own protocol FROM it, so this one pass covers
+ * every wire in and every provider out.
+ *
+ * What is scanned:
+ *  - the text content of every message that is not a tool result — the system
+ *    prompt (including the injected agentdox block), the user's words, the
+ *    assistant's replay;
+ *  - with `scanTools`, tool-call arguments and tool-result content as well.
+ *    Off by default because tool results are where the bytes are: a turn's
+ *    prompt is mostly file content, so scanning them is most of the cost — and
+ *    also, for an operator who cares about a secret in a file the agent read,
+ *    most of the point.
+ *
+ * Tool NAMES, ids and the tool schemas are left alone: they are the harness's
+ * own vocabulary, not conversation content, and rewriting one breaks the
+ * call/result pairing the model needs.
+ */
+export function redactUpstreamBody(
+	body: Rec,
+	rules: readonly CompiledRedactionRule[],
+	opts: { scanTools: boolean },
+): number {
+	if (rules.length === 0) return 0;
+	const messages = body.messages;
+	if (!Array.isArray(messages)) return 0;
+	let count = 0;
+	for (const message of messages) {
+		if (!isRec(message)) continue;
+		const isToolResult = message.role === "tool";
+		if (!isToolResult || opts.scanTools) count += redactContent(message, rules);
+		if (!opts.scanTools || !Array.isArray(message.tool_calls)) continue;
+		for (const call of message.tool_calls) {
+			if (!isRec(call) || !isRec(call.function)) continue;
+			const args = call.function.arguments;
+			if (typeof args !== "string") continue;
+			const r = redactText(args, rules);
+			if (r.count > 0) call.function.arguments = r.text;
+			count += r.count;
+		}
+	}
+	return count;
+}

package/src/server/turn.ts

@@ -29,6 +29,8 @@ import {
 import { UpstreamError, type Dispatch, type UpstreamClient } from "../upstream/types.ts";
 import type { SessionOverrides } from "./overrides.ts";
 import { digestCompactionEdits, type CompactionDigester } from "./compaction-digest.ts";
+import { redactUpstreamBody } from "./redact.ts";
+import { redactionRulesFor } from "../config/redaction.ts";
 import { createLogger } from "../util/log.ts";
 import type { NormRequest, ResponseSink, TurnSummary, UpstreamChunk } from "../wire/types.ts";
 
@@ -165,6 +167,10 @@ export async function runTurn(
 	let pendingDecision: Decision | null = null;
 	// Digests made this turn, by edit; a retry re-plans and must not pay twice.
 	const digestMemo = new Map<string, string>();
+	// Compiled once per turn (and memoised across turns on the rules' own text),
+	// never per attempt: a retry renders the same request again and would
+	// otherwise recompile every pattern.
+	const redactionRules = redactionRulesFor(config.redaction);
 
 	for (let attempt = 0; attempt < maxAttempts; attempt++) {
 		// Client disconnected before anything was dispatched: spend nothing.
@@ -261,6 +267,18 @@ export async function runTurn(
 			...(decision.compactionPlan.length > 0 ? { compactionPlan: decision.compactionPlan } : {}),
 		});
 
+		// Redaction, immediately after the body is rendered and before ANYTHING
+		// can dispatch it. This is the only choke point that covers every path:
+		// all three front ends normalise to this shape, and every upstream client
+		// renders its own protocol from it, so a provider added later is covered
+		// without being told. The count is recorded on the ledger row below; the
+		// matched text is never logged, at any level.
+		let redactions = 0;
+		if (redactionRules.length > 0) {
+			redactions = redactUpstreamBody(body, redactionRules, { scanTools: config.redaction.scanTools });
+			if (redactions > 0) log.debug("redacted outgoing request", { matches: redactions, rules: redactionRules.length });
+		}
+
 		// Calibrate the token estimate against the bytes that actually go out —
 		// after compaction shrank the prompt and the context block was appended
 		// — not the raw request the estimate was taken from.
@@ -333,6 +351,9 @@ export async function runTurn(
 				upstreamGenerationId: generationId,
 				error: fields.error,
 				promptTokensSaved: decision.promptTokensSaved,
+				// Evidence that the guard ran, as a count and nothing more. Absent
+				// while redaction is off, so an untouched row stays NULL.
+				...(redactionRules.length === 0 ? {} : { redactions }),
 				// The ledger prices OpenRouter slugs from its own cached payload; any
 				// other provider's model exists only in the live catalog.
 				...(priceModel === undefined ? {} : { priceModel }),

package/src/util/sqlite.ts

@@ -18,7 +18,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
 /** Bump when a migration is added; guarded below so reopening never regresses it. */
-const USER_VERSION = 18;
+const USER_VERSION = 19;
 
 const MIGRATIONS = `
 CREATE TABLE IF NOT EXISTS catalog_cache (
@@ -296,6 +296,16 @@ const MIGRATE_V18 = `
 ALTER TABLE ledger ADD COLUMN scope TEXT;
 `;
 
+// v19: ledger records how many strings redaction removed from the turn's
+// outgoing request (see `redaction` in the config). A COUNT and nothing else:
+// the whole point of redaction is that the matched text does not exist outside
+// the client, so the evidence that it ran must not reintroduce it. NULL on
+// every row written before this and on every turn with redaction off; 0 means
+// the rules ran and matched nothing.
+const MIGRATE_V19 = `
+ALTER TABLE ledger ADD COLUMN redactions INTEGER;
+`;
+
 // v9: benchmark_cache holds the external benchmark feeds (Artificial Analysis,
 // BenchLM) that backfill quality scores OpenRouter leaves unpublished. It is a
 // whole new table, created idempotently by the MIGRATIONS block above, so there
@@ -320,6 +330,17 @@ export function openDb(path: string): Database {
 	// ":memory:" has no parent directory to create.
 	if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });
 	const db = new Database(path);
+	// Incremental auto-vacuum so retention can hand freed pages back to the
+	// filesystem (`PRAGMA incremental_vacuum` after a prune). SQLite only honours
+	// a change of vacuum mode on an empty database or across a full VACUUM, so
+	// this takes effect for NEW ledgers; an existing one keeps its mode and
+	// simply reuses freed pages instead of releasing them. Must precede the
+	// journal-mode change, and is best-effort: never fail an open over it.
+	try {
+		db.exec("PRAGMA auto_vacuum = INCREMENTAL");
+	} catch {
+		/* an existing database in another mode; freed pages are reused instead */
+	}
 	// WAL + NORMAL: single-writer local service; favours read latency on the turn hot path.
 	db.exec("PRAGMA journal_mode = WAL");
 	db.exec("PRAGMA synchronous = NORMAL");
@@ -338,6 +359,7 @@ export function openDb(path: string): Database {
 		if (!ledgerCols.some((c) => c.name === "hold_arm")) db.exec(MIGRATE_V8);
 		if (!ledgerCols.some((c) => c.name === "prompt_tokens_saved")) db.exec(MIGRATE_V12);
 		if (!ledgerCols.some((c) => c.name === "scope")) db.exec(MIGRATE_V18);
+		if (!ledgerCols.some((c) => c.name === "redactions")) db.exec(MIGRATE_V19);
 		const convCols = db.query("PRAGMA table_info(conversations)").all() as { name: string }[];
 		if (!convCols.some((c) => c.name === "context_version")) db.exec(MIGRATE_V11);
 		if (!convCols.some((c) => c.name === "compaction_plan")) db.exec(MIGRATE_V13);

package/test/config-wizard.test.ts

@@ -142,7 +142,7 @@ describe("validateField", () => {
 
 describe("WIZARD_SECTIONS coverage", () => {
 	/** Leaves that are edited as whole records/arrays rather than fields. */
-	const RECORD_PATHS = new Set(["ollama.prices", "ollama.twins", "digest.toolAliases", "profiles", "upstreams"]);
+	const RECORD_PATHS = new Set(["ollama.prices", "ollama.twins", "digest.toolAliases", "profiles", "upstreams", "redaction.rules"]);
 
 	function leaves(obj: unknown, prefix = ""): string[] {
 		if (typeof obj !== "object" || obj === null || Array.isArray(obj)) return [prefix];

package/test/connect-harnesses.test.ts

@@ -0,0 +1,299 @@
+import { describe, expect, test } from "bun:test";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { connectRemote, type ConnectOptions, type ConnectReport } from "../src/cli/connect.ts";
+import { mergeClineProviders, mergeContinueConfig, mergeOpenCodeConfig } from "../src/cli/harnesses.ts";
+
+/**
+ * The harnesses `connect` reaches beyond omp, Hermes, Codex, Aider and Claude
+ * Code. Each automated one starts from a fixture in the shape its harness
+ * actually writes (`test/fixtures/connect/`), so the assertions are about
+ * merging into a REAL file rather than into an empty one: the user's other keys,
+ * providers and comments must survive, a second run must change nothing,
+ * `--harness <id>` must select exactly one, and a machine without the harness
+ * must be told it was skipped rather than have a file invented for it.
+ *
+ * The two manual harnesses are held to the other half of that promise — they
+ * print and write nothing at all.
+ */
+
+const FIXTURES = join(import.meta.dir, "fixtures", "connect");
+
+/** A temp HOME with nothing in it: every harness is absent until a test plants one. */
+function bare(extra: Partial<ConnectOptions> = {}): { home: string; o: ConnectOptions } {
+	const home = mkdtempSync(join(tmpdir(), "amr-harness-"));
+	const o: ConnectOptions = {
+		url: "https://team.example",
+		key: "amrt_key",
+		userId: "u_ada",
+		name: "Ada",
+		profile: false,
+		dryRun: false,
+		only: [],
+		// Point every harness this suite does not exercise at a path that does not exist.
+		env: { HOME: home, PI_CODING_AGENT_DIR: join(home, "no-omp"), HERMES_HOME: join(home, "no-hermes"), AUTO_MODEL_ROUTER_HOME: join(home, ".auto-model-router"), XDG_CONFIG_HOME: join(home, ".config") },
+		home,
+		packageDir: process.cwd(),
+		platform: "linux",
+		pathHas: () => false,
+		...extra,
+	};
+	return { home, o };
+}
+
+/** Plants a captured config file for a harness under the temp HOME. */
+function plant(home: string, fixture: string, ...rel: string[]): string {
+	const target = join(home, ...rel);
+	mkdirSync(join(target, ".."), { recursive: true });
+	cpSync(join(FIXTURES, fixture), target);
+	return target;
+}
+
+const configuredFor = (r: ConnectReport, prefix: string): string | undefined => r.configured.find((c) => c.startsWith(prefix));
+const backupsIn = (dir: string): string[] => readdirSync(dir).filter((f) => f.endsWith(".bak"));
+
+describe("OpenCode", () => {
+	test("the provider block is merged into opencode.json, the plugin is copied, and a second run changes nothing", () => {
+		const { home, o } = bare();
+		const dir = join(home, ".config", "opencode");
+		const cfg = plant(home, "opencode.json", ".config", "opencode", "opencode.json");
+		try {
+			const r = connectRemote(o);
+			expect(configuredFor(r, "OpenCode (")).toContain("opencode.json");
+			// The exact file: our provider added, `model` pointed at it, and every
+			// other key — the schema, the MCP server, the user's own Ollama provider — kept.
+			expect(JSON.parse(readFileSync(cfg, "utf8"))).toEqual({
+				$schema: "https://opencode.ai/config.json",
+				model: "auto-model-router/auto",
+				mcp: { unityMCP: { type: "remote", url: "http://127.0.0.1:8080/mcp", enabled: true } },
+				provider: {
+					ollama: {
+						npm: "@ai-sdk/openai-compatible",
+						name: "Ollama",
+						options: { baseURL: "http://localhost:11434/v1" },
+						models: { "qwen2.5:7b": { name: "Qwen2.5 7B (local)" } },
+					},
+					"auto-model-router": {
+						npm: "@ai-sdk/openai-compatible",
+						name: "auto-model-router",
+						options: { baseURL: "https://team.example/v1", apiKey: "amrt_key", headers: { "X-Omp-Harness": "opencode" } },
+						models: { auto: { name: "auto" }, "auto-cheap": { name: "auto-cheap" }, "auto-max": { name: "auto-max" } },
+					},
+				},
+			});
+			// The plugin is what gives OpenCode session identity, the toast and the digest.
+			expect(readFileSync(join(dir, "plugin", "auto-model-router.ts"), "utf8")).toContain("chat.headers");
+			expect(backupsIn(dir)).toHaveLength(1); // the previous file was kept
+			const after = readFileSync(cfg, "utf8");
+			connectRemote(o);
+			expect(readFileSync(cfg, "utf8")).toBe(after);
+			expect(backupsIn(dir)).toHaveLength(1); // and a no-op run backs nothing up
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("--harness opencode selects it alone, and an absent OpenCode is reported as skipped", () => {
+		const { home, o } = bare({ only: ["opencode"] });
+		plant(home, "opencode.json", ".config", "opencode", "opencode.json");
+		try {
+			expect(connectRemote(o).configured.map((c) => c.split(" (")[0])).toEqual(["OpenCode"]);
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+		const { home: h2, o: o2 } = bare();
+		try {
+			expect(connectRemote(o2).skipped).toContain("OpenCode (not on PATH and no ~/.config/opencode)");
+			expect(existsSync(join(h2, ".config", "opencode"))).toBe(false);
+		} finally {
+			rmSync(h2, { recursive: true, force: true });
+		}
+	});
+
+	test("a pinned scope rides in the provider's headers; a file we cannot parse is left alone", () => {
+		expect(JSON.parse(mergeOpenCodeConfig("", "https://t", "k", "omp-router")!).provider["auto-model-router"].options.headers).toEqual({ "X-Omp-Harness": "opencode", "X-Agentdox-Scope": "omp-router" });
+		expect(mergeOpenCodeConfig("[]", "https://t", "k")).toBeNull();
+		expect(mergeOpenCodeConfig("{ not json", "https://t", "k")).toBeNull();
+		expect(mergeOpenCodeConfig(mergeOpenCodeConfig("", "https://t", "k")!, "https://t", "k")).toBeNull();
+	});
+});
+
+describe("Cline", () => {
+	const REL = [".cline", "data", "settings"];
+
+	test("the openai-compatible provider is merged into providers.json beside the user's own, and a second run changes nothing", () => {
+		const { home, o } = bare();
+		const dir = join(home, ...REL);
+		const cfg = plant(home, "cline-providers.json", ...REL, "providers.json");
+		try {
+			const r = connectRemote(o);
+			expect(configuredFor(r, "Cline (")).toContain("providers.json");
+			const written = JSON.parse(readFileSync(cfg, "utf8")) as Record<string, unknown>;
+			// The harness id can only travel in `settings.headers`: cline's own auth
+			// command has no flag for it, which is why connect writes the file itself.
+			expect((written.providers as Record<string, { settings: unknown }>)["openai-compatible"]!.settings).toEqual({
+				provider: "openai-compatible",
+				apiKey: "amrt_key",
+				model: "auto",
+				baseUrl: "https://team.example/v1",
+				headers: { "X-Omp-Harness": "cline" },
+			});
+			expect(written.lastUsedProvider).toBe("openai-compatible");
+			expect(written.version).toBe(1);
+			// The user's other provider is untouched, key and stamp included.
+			expect((written.providers as Record<string, unknown>).anthropic).toEqual({
+				settings: { provider: "anthropic", apiKey: "sk-ant-existing", model: "claude-sonnet-4-5" },
+				updatedAt: "2026-09-10T05:27:55.818Z",
+				tokenSource: "manual",
+			});
+			expect(backupsIn(dir)).toHaveLength(1);
+			const after = readFileSync(cfg, "utf8");
+			connectRemote(o);
+			expect(readFileSync(cfg, "utf8")).toBe(after);
+			expect(backupsIn(dir)).toHaveLength(1);
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("--harness cline selects it alone, and an absent Cline is reported as skipped", () => {
+		const { home, o } = bare({ only: ["cline"] });
+		plant(home, "cline-providers.json", ...REL, "providers.json");
+		try {
+			expect(connectRemote(o).configured.map((c) => c.split(" (")[0])).toEqual(["Cline"]);
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+		const { home: h2, o: o2 } = bare();
+		try {
+			expect(connectRemote(o2).skipped).toContain("Cline (not on PATH and no ~/.cline)");
+			expect(existsSync(join(h2, ".cline"))).toBe(false);
+		} finally {
+			rmSync(h2, { recursive: true, force: true });
+		}
+	});
+
+	test("the stamp only moves when the settings do, a pinned scope rides along, and an unreadable file is left alone", () => {
+		const first = mergeClineProviders("", "https://t", "k", "2026-01-01T00:00:00.000Z", "omp-router")!;
+		expect(JSON.parse(first).providers["openai-compatible"].settings.headers).toEqual({ "X-Omp-Harness": "cline", "X-Agentdox-Scope": "omp-router" });
+		expect(mergeClineProviders(first, "https://t", "k", "2027-01-01T00:00:00.000Z", "omp-router")).toBeNull();
+		// A new key is a real change, so the stamp does move.
+		const rekeyed = mergeClineProviders(first, "https://t", "k2", "2027-01-01T00:00:00.000Z", "omp-router")!;
+		expect(JSON.parse(rekeyed).providers["openai-compatible"].updatedAt).toBe("2027-01-01T00:00:00.000Z");
+		expect(mergeClineProviders("nope", "https://t", "k", "2026-01-01T00:00:00.000Z")).toBeNull();
+	});
+});
+
+describe("Continue", () => {
+	test("the three profiles become model entries in config.yaml, keeping the file's comments, and a second run changes nothing", () => {
+		const { home, o } = bare();
+		const dir = join(home, ".continue");
+		const cfg = plant(home, "continue-config.yaml", ".continue", "config.yaml");
+		try {
+			const r = connectRemote(o);
+			expect(configuredFor(r, "Continue (")).toContain("config.yaml");
+			const text = readFileSync(cfg, "utf8");
+			// The document is edited, not re-serialised: comments, the user's own model
+			// and the context blocks are all still there, in their original order.
+			expect(text).toContain("# My Continue assistant — hand-edited, comments and all.");
+			expect(text).toContain("name: Local Assistant");
+			expect(text).toContain("  - name: Ollama Qwen");
+			expect(text.indexOf("context:")).toBeGreaterThan(text.indexOf("auto-model-router-max"));
+			for (const [name, model] of [
+				["auto-model-router", "auto"],
+				["auto-model-router-cheap", "auto-cheap"],
+				["auto-model-router-max", "auto-max"],
+			]) {
+				expect(text).toContain(`  - name: ${name}\n    provider: openai\n    model: ${model}\n    apiBase: https://team.example/v1\n    apiKey: amrt_key\n`);
+			}
+			expect(text).toContain("        X-Omp-Harness: continue");
+			expect(backupsIn(dir)).toHaveLength(1);
+			connectRemote(o);
+			expect(readFileSync(cfg, "utf8")).toBe(text);
+			expect(backupsIn(dir)).toHaveLength(1);
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("--harness continue selects it alone, and an absent Continue is reported as skipped", () => {
+		const { home, o } = bare({ only: ["continue"] });
+		plant(home, "continue-config.yaml", ".continue", "config.yaml");
+		try {
+			expect(connectRemote(o).configured.map((c) => c.split(" (")[0])).toEqual(["Continue"]);
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+		const { home: h2, o: o2 } = bare();
+		try {
+			expect(connectRemote(o2).skipped).toContain("Continue (no ~/.continue)");
+			expect(existsSync(join(h2, ".continue"))).toBe(false);
+		} finally {
+			rmSync(h2, { recursive: true, force: true });
+		}
+	});
+
+	test("a fresh file gets the schema's required fields first, a re-key replaces entries in place, and broken YAML is left alone", () => {
+		const fresh = mergeContinueConfig("", "https://t", "k")!;
+		expect(fresh.startsWith("name: auto-model-router\nversion: 0.0.1\nschema: v1\nmodels:\n  - name:")).toBe(true);
+		expect(mergeContinueConfig(fresh, "https://t", "k")).toBeNull();
+		const rekeyed = mergeContinueConfig(fresh, "https://t", "k2")!;
+		expect(rekeyed.match(/- name: auto-model-router\n/g)).toHaveLength(1); // replaced, not appended
+		expect(rekeyed).toContain("apiKey: k2");
+		expect(rekeyed).not.toContain("apiKey: k\n");
+		expect(mergeContinueConfig("models:\n  - [unclosed\n", "https://t", "k")).toBeNull();
+		expect(mergeContinueConfig("- a\n- b\n", "https://t", "k")).toBeNull(); // a sequence is not an assistant file
+	});
+});
+
+describe("Cursor and Windsurf keep their provider settings where no file can reach them", () => {
+	test("connect prints what to set and writes nothing under either home", () => {
+		const { home, o } = bare({ only: ["cursor", "windsurf"] });
+		mkdirSync(join(home, ".cursor"), { recursive: true });
+		mkdirSync(join(home, ".codeium", "windsurf"), { recursive: true });
+		try {
+			const r = connectRemote(o);
+			expect(r.configured).toEqual([]);
+			expect(r.manual.map((m) => m.harness)).toEqual(["Cursor", "Windsurf"]);
+			const cursor = r.manual[0]!.lines.join("\n");
+			expect(cursor).toContain("base URL: https://team.example/v1");
+			expect(cursor).toContain("API key:  amrt_key");
+			// Windsurf has no base-URL field of its own, so the useful answer is the extension.
+			expect(r.manual[1]!.lines.join("\n")).toContain("Cline extension");
+			// Nothing was written into either harness's directory.
+			expect(readdirSync(join(home, ".cursor"))).toEqual([]);
+			expect(readdirSync(join(home, ".codeium", "windsurf"))).toEqual([]);
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("a loopback router is called out for Cursor, which proxies chat through its own servers", () => {
+		const { home, o } = bare({ only: ["cursor"], url: "http://127.0.0.1:8788" });
+		mkdirSync(join(home, ".cursor"), { recursive: true });
+		try {
+			expect(connectRemote(o).manual[0]!.lines.join("\n")).toContain("reachable from the internet");
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+		// A public remote gets no such warning, and an uninstalled Cursor gets no recipe.
+		const { home: h2, o: o2 } = bare({ only: ["cursor"] });
+		mkdirSync(join(h2, ".cursor"), { recursive: true });
+		try {
+			expect(connectRemote(o2).manual[0]!.lines.join("\n")).not.toContain("reachable from the internet");
+		} finally {
+			rmSync(h2, { recursive: true, force: true });
+		}
+		const { home: h3, o: o3 } = bare();
+		try {
+			const r = connectRemote(o3);
+			expect(r.manual).toEqual([]);
+			expect(r.skipped).toContain("Cursor (no ~/.cursor)");
+			expect(r.skipped).toContain("Windsurf (no ~/.codeium)");
+		} finally {
+			rmSync(h3, { recursive: true, force: true });
+		}
+	});
+});

package/test/failover.test.ts

@@ -83,6 +83,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 		digest: { enabled: false, minBytes: 12_000, maxBytes: 400_000, tools: ["read"], fromTier: "moderate", tier: "simple", model: "", maxOutputTokens: 700, maxCostUsd: 0.02, timeoutMs: 25_000, toolAliases: {} },
 		profiles: [],
 		ledger: { path: ":memory:", blendWindowDays: 7, blendMinSamples: 20, fallbackBlend: { inputPerMtok: 1, outputPerMtok: 4 }, conversationTtlMs: 86_400_000 , retentionDays: 0,},
+		redaction: { enabled: false, rules: [], scanTools: false },
 		adaptiveTierFloors: true,
 		adaptivePriceCeilings: false,
 		logLevel: "silent",

package/test/fixtures/connect/cline-providers.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "lastUsedProvider": "anthropic",
+  "modes": {},
+  "providers": {
+    "anthropic": {
+      "settings": {
+        "provider": "anthropic",
+        "apiKey": "sk-ant-existing",
+        "model": "claude-sonnet-4-5"
+      },
+      "updatedAt": "2026-09-10T05:27:55.818Z",
+      "tokenSource": "manual"
+    }
+  }
+}

package/test/fixtures/connect/continue-config.yaml

@@ -0,0 +1,14 @@
+# My Continue assistant — hand-edited, comments and all.
+name: Local Assistant
+version: 0.0.1
+schema: v1
+models:
+  - name: Ollama Qwen
+    provider: ollama
+    model: qwen2.5-coder:7b
+    roles:
+      - chat
+      - edit
+context:
+  - provider: code
+  - provider: diff