claude-autorouter 0.2.0

package/src/status-state.mjs

@@ -0,0 +1,174 @@
+import { closeSync, chmodSync, fchmodSync, mkdtempSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createSavingsTracker } from './savings.mjs';
+
+const EVENTS = new Set(['request_start', 'route', 'upstream_response', 'upstream_model', 'upstream_usage', 'upstream_error', 'request_complete', 'request_error', 'request_cancelled']);
+const CLASSIFIER_ERRORS = new Set(['timeout', 'http_error', 'invalid_response', 'network_error']);
+const UPSTREAM_ERRORS = new Set(['invalid_request_error', 'authentication_error', 'billing_error', 'permission_error', 'not_found_error', 'request_too_large', 'rate_limit_error', 'api_error', 'overloaded_error', 'timeout_error', 'unknown_error', 'http_error', 'request_error']);
+const identifier = value => typeof value === 'string' && /^[\w.:-]{1,200}$/.test(value) ? value : undefined;
+const modelName = value => typeof value === 'string' && /^[\w.:/-]{1,120}$/.test(value) ? value : undefined;
+const code = value => typeof value === 'string' && /^[a-z][a-z0-9_]{0,63}$/.test(value) ? value : undefined;
+const httpStatus = value => Number.isInteger(value) && value >= 100 && value <= 599 ? value : undefined;
+const latency = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 3600000 ? value : undefined;
+const tokenCount = value => Number.isSafeInteger(value) && value >= 0;
+
+function contextUsage(usage, model) {
+  if (!model || !usage || typeof usage !== 'object' || Array.isArray(usage) || usage.pricing_unsupported === true) return;
+  const counts = {};
+  for (const field of ['input_tokens', 'cache_creation_input_tokens', 'cache_read_input_tokens']) {
+    const value = Object.hasOwn(usage, field) ? usage[field] : field === 'input_tokens' ? undefined : 0;
+    if (!tokenCount(value)) return;
+    counts[field] = value;
+  }
+  const total = Object.values(counts).reduce((sum, value) => sum + value, 0);
+  if (!Number.isSafeInteger(total)) return;
+  // Match Claude's context percentage: cached and uncached input, excluding
+  // output. These are the latest response's counts, never session totals.
+  return { model, input_tokens: total };
+}
+
+// All telemetry is best-effort. Never let filesystem or malformed-event
+// failures interrupt routing, and never persist request bodies or raw errors.
+export function createStatusState(options = {}) {
+  let privateDirectory, path = null, pending, heartbeat, closed = false;
+  const sessions = new Map();
+  const savings = createSavingsTracker({ baselineModel: options?.baselineModel });
+
+  function flush() {
+    if (closed) return;
+    if (pending) { clearImmediate(pending); pending = undefined; }
+    if (!path) return;
+    let temporary, fd;
+    try {
+      const snapshot = { version: 1, pid: process.pid, heartbeat_at: Date.now(), sessions: Object.fromEntries(sessions), savings: savings.snapshot() };
+      temporary = join(privateDirectory, `.state-${randomBytes(8).toString('hex')}.tmp`);
+      fd = openSync(temporary, 'wx', 0o600);
+      fchmodSync(fd, 0o600);
+      writeFileSync(fd, JSON.stringify(snapshot));
+      closeSync(fd); fd = undefined;
+      renameSync(temporary, path);
+    } catch {
+      if (fd !== undefined) { try { closeSync(fd); } catch {} }
+      if (temporary) { try { rmSync(temporary, { force: true }); } catch {} }
+    }
+  }
+
+  function schedule() {
+    if (closed || pending || !path) return;
+    try { pending = setImmediate(flush); pending.unref?.(); } catch {}
+  }
+
+  function update(event) {
+    if (closed) return;
+    try {
+      if (!event || !EVENTS.has(event.event)) return;
+      // Account for all session calls, including parallel agents and auxiliary
+      // requests, independently of which foreground request owns the model UI.
+      savings.update(event);
+      schedule();
+      if ((event.agent_id != null && event.agent_id !== '')
+        || (event.request_class != null && event.request_class !== '' && event.request_class !== 'main')) return;
+      const sessionId = event.session_id == null || event.session_id === '' ? '' : identifier(event.session_id);
+      const requestId = identifier(event.request_id);
+      // Invalid IDs must never collapse into an unrelated/anonymous session.
+      if (sessionId === undefined || !requestId) return;
+      const previous = sessions.get(sessionId);
+      if (event.event === 'request_start') {
+        const state = {
+          request_id: requestId,
+          phase: 'routing',
+          updated_at: Date.now(),
+          ...(previous?.last_model ? { last_model: previous.last_model } : {}),
+          ...((previous?.context_usage ?? previous?.last_context_usage)
+            ? { last_context_usage: previous.context_usage ?? previous.last_context_usage } : {}),
+        };
+        const requested = modelName(event.requested_model);
+        const promptId = identifier(event.prompt_id);
+        if (requested) state.requested_model = requested;
+        if (promptId) state.prompt_id = promptId;
+        sessions.delete(sessionId);
+        sessions.set(sessionId, state);
+        while (sessions.size > 100) sessions.delete(sessions.keys().next().value);
+        schedule();
+        return;
+      }
+      if (!previous || previous.request_id !== requestId) return;
+      const state = previous;
+      state.updated_at = Date.now();
+      const status = httpStatus(event.status);
+      const terminal = ['error', 'cancelled', 'ready'].includes(state.phase);
+      switch (event.event) {
+        case 'route': {
+          const fields = { requested_model: modelName(event.requested_model), selected_model: modelName(event.model),
+            source: ['jev', 'ollama', 'cache', 'fallback'].includes(event.source) ? event.source : undefined,
+            evaluator: ['jev', 'ollama'].includes(event.evaluator) ? event.evaluator : undefined,
+            reason: code(event.reason), latency_ms: latency(event.latency_ms),
+            classified_tier: ['haiku', 'sonnet', 'opus'].includes(event.classified_tier) ? event.classified_tier : undefined,
+            context_check: ['within_budget', 'over_budget', 'count_unavailable'].includes(event.context_check) ? event.context_check : undefined,
+            counted_input_tokens: tokenCount(event.counted_input_tokens) ? event.counted_input_tokens : undefined,
+            classifier_error: CLASSIFIER_ERRORS.has(event.classifier_error) ? event.classifier_error : undefined, classifier_status: httpStatus(event.classifier_status) };
+          for (const [key, value] of Object.entries(fields)) if (value !== undefined) state[key] = value;
+          if (!terminal) state.phase = 'connecting';
+          break;
+        }
+        case 'upstream_response':
+          if (status !== undefined) state.status = status;
+          if (status >= 400) { delete state.context_usage; state.phase = 'error'; state.error_type = UPSTREAM_ERRORS.has(event.error_type) ? event.error_type : 'http_error'; }
+          else if (!terminal) state.phase = 'streaming';
+          break;
+        case 'upstream_model': {
+          const model = modelName(event.model);
+          if (model) { state.actual_model = model; state.last_model = model; }
+          if (!terminal) state.phase = 'streaming';
+          break;
+        }
+        case 'upstream_usage': {
+          if (state.phase === 'error' || state.phase === 'cancelled') break;
+          const usage = contextUsage(event.usage, state.actual_model);
+          if (usage) state.context_usage = usage;
+          break;
+        }
+        case 'upstream_error':
+        case 'request_error':
+          delete state.context_usage;
+          state.phase = 'error';
+          state.error_type = UPSTREAM_ERRORS.has(event.error_type) ? event.error_type : (event.event === 'upstream_error' ? 'unknown_error' : 'request_error');
+          if (status !== undefined) state.status = status;
+          break;
+        case 'request_complete':
+          if (!terminal) state.phase = 'ready';
+          break;
+        case 'request_cancelled':
+          delete state.context_usage;
+          if (state.phase !== 'error') state.phase = 'cancelled';
+          break;
+      }
+      schedule();
+    } catch {}
+  }
+
+  function close() {
+    if (closed) return;
+    closed = true;
+    try { clearImmediate(pending); clearInterval(heartbeat); } catch {}
+    sessions.clear();
+    savings.clear();
+    if (privateDirectory) { try { rmSync(privateDirectory, { recursive: true, force: true }); } catch {} }
+  }
+
+  try {
+    const directory = options?.directory ?? tmpdir();
+    privateDirectory = mkdtempSync(join(directory, 'autorouter-status-'));
+    chmodSync(privateDirectory, 0o700);
+    path = join(privateDirectory, 'state.json');
+    flush();
+    heartbeat = setInterval(schedule, 5000);
+    heartbeat.unref();
+  } catch {
+    if (privateDirectory) { try { rmSync(privateDirectory, { recursive: true, force: true }); } catch {} }
+    path = null;
+  }
+  return { path, update, flush, close };
+}

package/src/statusline.mjs

@@ -0,0 +1,185 @@
+const PHASES = new Set(['routing', 'connecting', 'streaming', 'ready', 'error', 'cancelled']);
+const REASONS = {
+  tool_turn_pinned: 'turn pinned', thinking_history: 'thinking pinned', unknown_continuation: 'continuation pinned',
+  mid_conversation_system: 'system features', requires_sonnet_capabilities: 'capability guard',
+  model_specific_features: 'model features', large_or_multimodal_request: 'large request',
+  context_capacity: 'large context',
+  internal_request: 'internal request', unknown_model: 'custom model', low_confidence: 'low confidence',
+};
+const clean = (value, limit = 64) => typeof value === 'string' ? value
+  .replace(/\x1b\][\s\S]*?(?:\x07|\x1b\\)/g, '')
+  .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '')
+  .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, '')
+  .replace(/\s+/g, ' ').trim().slice(0, limit) : '';
+const object = value => value && typeof value === 'object' && !Array.isArray(value);
+const width = value => [...value].reduce((sum, char) => sum + (/[^\u0000-\u10ff\u2000-\u2e7f]/u.test(char) ? 2 : 1), 0);
+function shorten(value, limit) {
+  if (width(value) <= limit) return value;
+  let text = '';
+  for (const char of value) { if (width(text + char) + 1 > limit) break; text += char; }
+  return text + '…';
+}
+function modelName(value) {
+  const name = clean(value, 48);
+  const match = /^claude-(haiku|sonnet|opus)-(\d+)(?:-(\d{1,2})(?=-|$))?/i.exec(name);
+  return match ? `${match[1][0].toUpperCase()}${match[1].slice(1).toLowerCase()} ${match[2]}${match[3] ? '.' + match[3] : ''}` : name;
+}
+
+// Only unambiguous native windows are listed. Custom IDs and models whose
+// subscription window depends on an opt-in cannot safely imply a capacity.
+const CONTEXT_WINDOWS = new Map([
+  ...['claude-haiku-4-5', 'claude-haiku-4-5-20251001', 'claude-sonnet-4-5', 'claude-sonnet-4-5-20250929',
+    'claude-opus-4-5', 'claude-opus-4-5-20251101'].map(model => [model, 200000]),
+  ...['claude-sonnet-5', 'claude-sonnet-5-5', 'claude-opus-4-7', 'claude-opus-4-8',
+    'claude-opus-5', 'claude-opus-5-5'].map(model => [model, 1000000]),
+]);
+const capacityLabel = value => value % 1000000 === 0 ? `${value / 1000000}M` : value % 1000 === 0 ? `${value / 1000}K` : String(value);
+
+function contextLabel(input, state) {
+  const client = object(input?.context_window) ? input.context_window : undefined;
+  const percent = client?.used_percentage;
+  const clientCapacity = Number.isSafeInteger(client?.context_window_size) && client.context_window_size > 0
+    ? client.context_window_size : undefined;
+  const cli = typeof percent === 'number' && Number.isFinite(percent) && percent >= 0 && percent <= 100
+    ? `CLI ctx ${Math.round(percent)}%${clientCapacity ? `/${capacityLabel(clientCapacity)}` : ''}` : '';
+  // Claude resets current_usage to null after /compact. Do not revive the
+  // previous request's count while that reset is waiting for a fresh response.
+  if (client && Object.hasOwn(client, 'current_usage') && client.current_usage === null) return cli;
+  const current = object(state?.context_usage) && state.context_usage.model === state.actual_model
+    && ['streaming', 'ready'].includes(state.phase) ? state.context_usage : undefined;
+  const historical = !current && ['routing', 'connecting', 'streaming', 'error', 'cancelled'].includes(state?.phase)
+    && object(state.last_context_usage) ? state.last_context_usage : undefined;
+  const usage = current ?? historical;
+  const capacity = CONTEXT_WINDOWS.get(usage?.model);
+  if (!capacity || !Number.isSafeInteger(usage.input_tokens) || usage.input_tokens < 0) return cli;
+  const api = `${historical ? 'last ' : ''}API ctx ${Math.round(usage.input_tokens * 100 / capacity)}%/${capacityLabel(capacity)}`;
+  // Keep the client limit visible when it differs: the API window does not
+  // change Claude Code's own compaction threshold or remaining-context UI.
+  return cli && clientCapacity !== capacity ? `${api} · ${cli}` : api;
+}
+
+function savingsLabels(entry) {
+  if (!object(entry)) return;
+  const count = value => Number.isSafeInteger(value) && value >= 0;
+  const dollars = value => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+  const unavailable = { full: 'savings unavailable', compact: 'savings unavailable', color: '33' };
+  if (!count(entry.requests) || !count(entry.unpriced_requests)) return unavailable;
+  if (entry.requests === 0) return entry.unpriced_requests > 0 ? unavailable : undefined;
+  if (!dollars(entry.actual_usd) || !dollars(entry.baseline_usd)
+    || typeof entry.saved_usd !== 'number' || !Number.isFinite(entry.saved_usd)) return unavailable;
+  const extra = entry.saved_usd < 0;
+  const amount = Math.abs(entry.saved_usd);
+  const money = amount > 0 && amount < 0.01 ? '<$0.01' : `$${amount.toFixed(2)}`;
+  const percent = entry.baseline_usd > 0 && typeof entry.percent === 'number' && Number.isFinite(entry.percent)
+    ? `${Math.round(Math.abs(entry.percent))}%` : '';
+  const partial = entry.partial === true || entry.unpriced_requests > 0;
+  const label = `est ${extra ? 'extra' : 'saved'}`;
+  const ending = ` vs Opus${partial ? ' partial' : ''}`;
+  return {
+    full: `${label} ${money}${percent ? ` (${percent})` : ''}${ending}`,
+    compact: percent ? `${label} ${percent}${ending}` : `${label} ${money}${ending}`,
+    color: extra || partial ? '33' : '32',
+  };
+}
+
+export function renderStatusLine(input, snapshot, { now = Date.now(), color = true, columns = process.env.COLUMNS, alive } = {}) {
+  const paint = (value, code) => color ? `\x1b[${code}m${value}\x1b[0m` : value;
+  const numericColumns = Number(columns);
+  const available = Number.isFinite(numericColumns) && numericColumns > 0 ? Math.max(1, Math.floor(numericColumns)) : 120;
+  let online = object(snapshot) && snapshot.version === 1 && Number.isSafeInteger(snapshot.pid) && snapshot.pid > 0
+    && Number.isFinite(snapshot.heartbeat_at) && snapshot.heartbeat_at > 0
+    && snapshot.heartbeat_at <= now + 5000 && now - snapshot.heartbeat_at <= 20000;
+  if (online && alive !== undefined) {
+    try { online = typeof alive === 'function' ? alive(snapshot.pid) !== false : alive !== false; } catch { online = false; }
+  }
+  if (!online) {
+    if (width('● AutoRouter offline') > available) return paint(shorten('AutoRouter offline', available), '2;31');
+    return `${paint('●', '31')} ${paint('AutoRouter', '1')} ${paint('offline', '2;31')}`;
+  }
+
+  const sessionId = object(input) && (input.session_id === undefined || typeof input.session_id === 'string') ? input.session_id ?? '' : undefined;
+  const candidate = sessionId !== undefined && object(snapshot.sessions) && Object.hasOwn(snapshot.sessions, sessionId) ? snapshot.sessions[sessionId] : undefined;
+  const savingsEntry = sessionId !== undefined && object(snapshot.savings) && Object.hasOwn(snapshot.savings, sessionId) ? snapshot.savings[sessionId] : undefined;
+  const savings = savingsLabels(savingsEntry);
+  const state = object(candidate) && PHASES.has(candidate.phase) ? candidate : undefined;
+  const phase = state?.phase;
+  let status = phase ?? 'awaiting request';
+  let model = '';
+  let prefix = '';
+  let suffix = '';
+  let confirmed = false;
+  const last = modelName(state?.last_model);
+  const actual = modelName(state?.actual_model);
+  const selected = modelName(state?.selected_model);
+  if (phase === 'streaming' && actual) { model = actual; confirmed = true; }
+  else if (phase === 'connecting' && selected) { model = selected; suffix = ' selected'; }
+  else if (phase === 'streaming' && selected) { model = selected; suffix = ' unconfirmed'; }
+  else if (phase === 'ready' && actual) { model = actual; prefix = 'last '; confirmed = true; }
+  else if (phase === 'ready' && selected) { model = selected; suffix = ' unconfirmed'; }
+  else if (['ready', 'error', 'cancelled'].includes(phase) && (last || actual)) { model = last || actual; prefix = 'last '; confirmed = true; }
+  else if (last) { model = last; prefix = 'last '; confirmed = true; }
+  if (phase === 'ready' && !model) status = 'awaiting request';
+  const errorType = clean(state?.error_type, 32);
+  if (phase === 'error') status = Number.isInteger(state.status) && state.status >= 400 && state.status <= 599
+    ? `error ${state.status}` : errorType ? `error ${errorType}` : 'error';
+
+  const details = [];
+  const source = ['jev', 'ollama', 'cache', 'fallback'].includes(state?.source) ? state.source : undefined;
+  if (source) {
+    const evaluator = ['jev', 'ollama'].includes(state.evaluator) ? state.evaluator : undefined;
+    const evaluatorLabel = evaluator === 'ollama' ? 'Ollama' : evaluator === 'jev' ? 'Jev' : '';
+    const sourceLabel = source === 'jev' ? 'Jev' : source === 'ollama' ? 'Ollama'
+      : evaluatorLabel ? `${evaluatorLabel} ${source}` : source;
+    const timing = Number.isFinite(state.latency_ms) && state.latency_ms >= 0 ? ` ${Math.round(Math.min(state.latency_ms, 999999))}ms` : '';
+    const classified = ['haiku', 'sonnet', 'opus'].includes(state.classified_tier) ? state.classified_tier : undefined;
+    const chosenFamily = /^claude-(haiku|sonnet|opus)-/.exec(state.selected_model ?? '')?.[1];
+    const override = classified && chosenFamily && classified !== chosenFamily
+      ? `→${classified[0].toUpperCase()}${classified.slice(1)}` : '';
+    details.push(`${sourceLabel}${override}${timing}`);
+  }
+  if (source === 'fallback') {
+    const classifierError = clean(state.classifier_error, 24);
+    if (classifierError) details.push(classifierError.replaceAll('_', ' '));
+  }
+  if (Object.hasOwn(REASONS, state?.reason)) details.push(state.reason === 'context_capacity' && state.context_check === 'count_unavailable'
+    ? 'size unverified' : REASONS[state.reason]);
+  if (phase === 'error' && errorType && !status.includes(errorType)) details.push(errorType);
+  let context = contextLabel(input, state);
+  let detail = details.join(' · ');
+  let saving = savings?.full ?? '';
+  let brand = '● AutoRouter';
+  const modelLabel = () => model ? prefix + model + suffix : '';
+  const plain = () => [brand, modelLabel(), status, detail, saving, context].filter(Boolean).join(' · ');
+  if (width(plain()) > available) context = '';
+  // Routine routing details can yield to the estimate, while errors and
+  // fallback explanations have priority over savings. Never shorten away
+  // "est" or "partial": hide the whole metric when its qualifiers cannot fit.
+  if (width(plain()) > available && source !== 'fallback' && phase !== 'error') detail = '';
+  if (width(plain()) > available && saving) saving = savings.compact;
+  if (width(plain()) > available) saving = '';
+  if (width(plain()) > available) detail = '';
+  if (width(plain()) > available) brand = '● AR';
+  if (width(plain()) > available) brand = '';
+  if (width(plain()) > available && model) {
+    if (phase === 'streaming') status = 'stream';
+    const room = available - width(prefix + suffix + status) - 3;
+    if (room >= 1) model = shorten(model, room);
+    else {
+      // A selection's qualifier is essential. If it cannot fit, show only the
+      // router phase instead of making an unconfirmed model look confirmed.
+      model = ''; prefix = ''; suffix = '';
+      if (width('● AutoRouter · ' + status) <= available) brand = '● AutoRouter';
+      else if (width('● AR · ' + status) <= available) brand = '● AR';
+    }
+  }
+  if (width(plain()) > available) status = shorten(status, Math.max(1, available - width(modelLabel()) - (model ? 3 : 0)));
+  const attention = phase === 'error' ? '31' : source === 'fallback' ? '33' : phase === 'cancelled' ? '2' : phase === 'streaming' || phase === 'ready' ? '32' : '36';
+  const chunks = [];
+  if (brand) chunks.push(`${paint('●', attention)} ${paint(brand.slice(2), '1')}`);
+  if (model) chunks.push(paint(modelLabel(), confirmed ? '37' : '33'));
+  chunks.push(paint(status, attention));
+  if (detail) chunks.push(paint(detail, source === 'fallback' ? '33' : '2'));
+  if (saving) chunks.push(paint(saving, savings.color));
+  if (context) chunks.push(paint(context, '2'));
+  return chunks.join(paint(' · ', '2'));
+}

package/src/token-counter.mjs

@@ -0,0 +1,127 @@
+import { createHash } from 'node:crypto';
+
+// Count-token API fields, including the beta fields used by Claude Code.
+// Keep unknown extensions out of the count path: dropping new input context
+// could produce an incorrectly low count and an unsafe routing decision.
+const COUNT_FIELDS = new Set([
+  'model', 'messages', 'system', 'tools', 'tool_choice', 'thinking',
+  'cache_control', 'context_management', 'compaction', 'output_config',
+  'output_format', 'speed',
+]);
+const GENERATION_FIELDS = new Set([
+  'max_tokens', 'stream', 'temperature', 'top_p', 'top_k', 'stop_sequences',
+  'metadata', 'service_tier', 'inference_geo',
+]);
+const CACHE_HEADERS = [
+  'authorization', 'x-api-key', 'anthropic-beta', 'anthropic-version',
+  'anthropic-workspace-id', 'anthropic-user-profile-id',
+];
+
+function canCount(body) {
+  if (!body || !Array.isArray(body.messages)) return false;
+  if (Object.keys(body).some(key => !COUNT_FIELDS.has(key) && !GENERATION_FIELDS.has(key))) return false;
+  if (body.tools !== undefined && !Array.isArray(body.tools)) return false;
+  if (body.tools?.some(tool => !tool || (tool.type && tool.type !== 'custom'
+    && !/^(?:bash|text_editor|computer|memory)_\d{8}$/.test(tool.type)
+    && tool.type !== 'advisor_20260301'))) return false;
+
+  const pending = [body.system, ...body.messages.map(message => message?.content)];
+  while (pending.length) {
+    const content = pending.pop();
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      if (!block || typeof block !== 'object') continue;
+      // The count endpoint cannot fetch URL/File API sources. Do not drop
+      // them or turn their tiny JSON representation into a token estimate.
+      if (['image', 'document'].includes(block.type)) {
+        if (['url', 'file'].includes(block.source?.type)) return false;
+        if (block.source?.type === 'content') pending.push(block.source.content);
+      }
+      pending.push(block.content);
+    }
+  }
+  return true;
+}
+
+async function readCount(response) {
+  if (!response.ok) {
+    await response.body?.cancel();
+    return undefined;
+  }
+  if (!response.body) return undefined;
+  // A successful response is tiny. Bound parsing even if an upstream gateway
+  // returns an unexpected body; none of its content enters logs or the cache.
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 65536) { await reader.cancel(); return undefined; }
+      chunks.push(value);
+    }
+    const count = JSON.parse(Buffer.concat(chunks, size).toString('utf8'))?.input_tokens;
+    return Number.isSafeInteger(count) && count >= 0 ? count : undefined;
+  } finally { reader.releaseLock(); }
+}
+
+// Credentials are supplied for this one request by the server. The cache
+// retains only hashes, token counts, and expiry times; never prompts or keys.
+export function createTokenCounter(config, { fetchImpl = fetch } = {}) {
+  const timeoutMs = config.tokenCountTimeoutMs ?? 1500;
+  const cacheEntries = config.tokenCountCacheEntries ?? 100;
+  const cacheTtlMs = config.tokenCountCacheTtlMs ?? 5 * 60 * 1000;
+  const cache = new Map();
+  return async function countTokens(body, model, { headers = {}, signal, search = '' } = {}) {
+    if (signal?.aborted || !canCount(body) || typeof model !== 'string' || !model) return undefined;
+    let timer;
+    let onAbort;
+    const controller = new AbortController();
+    try {
+      const payload = { ...Object.fromEntries(Object.entries(body).filter(([key]) => COUNT_FIELDS.has(key))), model };
+      const serialized = JSON.stringify(payload);
+      const requestHeaders = new Headers(headers);
+      requestHeaders.delete('content-length');
+      requestHeaders.set('content-type', 'application/json');
+      requestHeaders.set('accept', 'application/json');
+      const url = new URL(`${config.upstream.replace(/\/$/, '')}/v1/messages/count_tokens`);
+      url.search = search;
+      const key = createHash('sha256').update(JSON.stringify([
+        url.href, CACHE_HEADERS.map(name => requestHeaders.get(name)), serialized,
+      ])).digest('hex');
+      const cached = cache.get(key);
+      if (cached) {
+        cache.delete(key);
+        if (cached.expires > Date.now()) { cache.set(key, cached); return cached.count; }
+      }
+      const cancelled = new Promise(resolve => {
+        onAbort = () => { controller.abort(); resolve(undefined); };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        timer = setTimeout(onAbort, timeoutMs);
+      });
+      const pending = (async () => {
+        try {
+          const response = await fetchImpl(url.href, {
+            method: 'POST', redirect: 'error', headers: requestHeaders,
+            body: serialized, signal: controller.signal,
+          });
+          const count = await readCount(response);
+          if (controller.signal.aborted || count === undefined) return undefined;
+          cache.set(key, { count, expires: Date.now() + cacheTtlMs });
+          while (cache.size > cacheEntries) cache.delete(cache.keys().next().value);
+          return count;
+        } catch { return undefined; }
+      })();
+      // Cover response-body consumption and implementations that do not reject
+      // promptly on abort. Unknown counts simply leave the router's fallback
+      // policy in charge; no count failure can fail an inference request.
+      return await Promise.race([pending, cancelled]);
+    } catch { return undefined; }
+    finally {
+      clearTimeout(timer);
+      if (onAbort) signal?.removeEventListener('abort', onAbort);
+    }
+  };
+}

package/src/user-config.mjs

@@ -0,0 +1,145 @@
+import {
+  closeSync, constants, fchmodSync, fsyncSync, linkSync, lstatSync,
+  mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync,
+} from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+
+const CONFIG_KEYS = new Set([
+  'AUTOROUTER_AUTH_MODE', 'AUTOROUTER_CLIENT_PROFILE',
+  'ANTHROPIC_API_KEY', 'TYPESAFE_API_KEY', 'AUTOROUTER_TOKEN',
+  'AUTOROUTER_UPSTREAM_URL', 'AUTOROUTER_JEV_URL', 'AUTOROUTER_JEV_MODEL',
+  'AUTOROUTER_HAIKU_MODEL', 'AUTOROUTER_SONNET_MODEL', 'AUTOROUTER_OPUS_MODEL',
+  'AUTOROUTER_PORT', 'AUTOROUTER_JEV_TIMEOUT_MS', 'AUTOROUTER_TOKEN_COUNT_TIMEOUT_MS',
+  'AUTOROUTER_MIN_CONFIDENCE', 'AUTOROUTER_STATUSLINE', 'AUTOROUTER_DEBUG',
+  'ENABLE_TOOL_SEARCH',
+  'AUTOROUTER_EVALUATOR', 'AUTOROUTER_OLLAMA_URL', 'AUTOROUTER_OLLAMA_MODEL',
+  'AUTOROUTER_OLLAMA_TIMEOUT_MS', 'AUTOROUTER_OLLAMA_KEEP_ALIVE',
+]);
+const SAFE_FS_CODES = new Set([
+  'EACCES', 'EPERM', 'ENOENT', 'ENOTDIR', 'EISDIR', 'ENOSPC', 'EROFS',
+  'EMFILE', 'ENFILE', 'ELOOP', 'EIO', 'EEXIST',
+]);
+
+function configError(message) {
+  const error = new Error(message);
+  error.code = 'AUTOROUTER_CONFIG_ERROR';
+  return error;
+}
+
+function filesystemError(error, operation) {
+  if (error?.code === 'AUTOROUTER_CONFIG_ERROR') return error;
+  // Native filesystem errors include paths; JSON errors can include values.
+  // Neither is needed to explain the failure, and either might hold a secret.
+  const code = SAFE_FS_CODES.has(error?.code) ? ` (${error.code})` : '';
+  return configError(`Could not ${operation} AutoRouter configuration${code}.`);
+}
+
+function validate(values) {
+  if (!values || typeof values !== 'object' || Array.isArray(values)
+    || ![Object.prototype, null].includes(Object.getPrototypeOf(values))) {
+    throw configError('AutoRouter configuration must be a JSON object of string values.');
+  }
+  const validated = {};
+  for (const key of Reflect.ownKeys(values)) {
+    if (!CONFIG_KEYS.has(key)) {
+      // An unknown key can itself contain a pasted credential.
+      throw configError('AutoRouter configuration contains an unsupported key.');
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(values, key);
+    if (!descriptor || !('value' in descriptor) || typeof descriptor.value !== 'string') {
+      throw configError('AutoRouter configuration values must be strings.');
+    }
+    validated[key] = descriptor.value;
+  }
+  return validated;
+}
+
+export function getConfigPath(env = process.env) {
+  if (env.AUTOROUTER_CONFIG !== undefined) {
+    if (typeof env.AUTOROUTER_CONFIG !== 'string' || !env.AUTOROUTER_CONFIG.trim()) {
+      throw configError('AUTOROUTER_CONFIG must be a non-empty path.');
+    }
+    return resolve(env.AUTOROUTER_CONFIG);
+  }
+  const xdg = env.XDG_CONFIG_HOME;
+  if (xdg !== undefined && (typeof xdg !== 'string' || (xdg && !isAbsolute(xdg)))) {
+    throw configError('XDG_CONFIG_HOME must be an absolute path when set.');
+  }
+  return join(xdg || join(homedir(), '.config'), 'claude-autorouter', 'config.json');
+}
+
+export function loadUserConfig(env = process.env) {
+  const path = getConfigPath(env);
+  let content;
+  try {
+    content = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      if (env.AUTOROUTER_CONFIG === undefined) return { env: { ...env }, path, exists: false };
+      throw configError('AUTOROUTER_CONFIG points to a missing configuration file.');
+    }
+    throw filesystemError(error, 'read');
+  }
+  let parsed;
+  try { parsed = JSON.parse(content); }
+  catch { throw configError('AutoRouter configuration must contain valid JSON.'); }
+  const values = validate(parsed);
+  return { env: { ...values, ...env }, path, exists: true };
+}
+
+function existingFile(path) {
+  let stat;
+  try { stat = lstatSync(path); }
+  catch (error) { if (error.code === 'ENOENT') return undefined; throw error; }
+  if (stat.isSymbolicLink()) throw configError('Refusing to write a symbolic-link AutoRouter configuration.');
+  if (!stat.isFile()) throw configError('AutoRouter configuration must be a regular file.');
+  return stat;
+}
+
+export function saveUserConfig(values, { env = process.env, overwrite = false } = {}) {
+  const validated = validate(values);
+  const path = getConfigPath(env);
+  const parent = dirname(path);
+  let temporary;
+  let descriptor;
+  try {
+    if (existingFile(path) && !overwrite) {
+      throw configError('AutoRouter configuration already exists; use overwrite to replace it.');
+    }
+    // mkdir leaves existing directory permissions unchanged. Only directories
+    // created for this configuration receive the private creation mode.
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    temporary = join(parent, `.${basename(path)}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`);
+    descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+    fchmodSync(descriptor, 0o600);
+    writeFileSync(descriptor, `${JSON.stringify(validated, null, 2)}\n`, 'utf8');
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = undefined;
+
+    // Check again after preparing the replacement. Renaming replaces the
+    // directory entry rather than following a target that changes to a link.
+    if (existingFile(path) && !overwrite) {
+      throw configError('AutoRouter configuration already exists; use overwrite to replace it.');
+    }
+    if (overwrite) {
+      renameSync(temporary, path);
+      temporary = undefined;
+    } else {
+      // A hard link makes creation exclusive and atomic: a concurrent file or
+      // symlink can never be replaced by the default save operation.
+      linkSync(temporary, path);
+    }
+    return path;
+  } catch (error) {
+    if (error?.code === 'EEXIST') {
+      throw configError('AutoRouter configuration already exists; use overwrite to replace it.');
+    }
+    throw filesystemError(error, 'save');
+  } finally {
+    if (descriptor !== undefined) { try { closeSync(descriptor); } catch {} }
+    if (temporary) { try { unlinkSync(temporary); } catch {} }
+  }
+}