claude-autorouter 0.3.4 → 0.3.6

package/.env.example

@@ -5,8 +5,20 @@ AUTOROUTER_CLIENT_PROFILE=compatible
 AUTOROUTER_EVALUATOR=jev
 # The launcher enables the router status line for this session. Set 0 to keep your own.
 AUTOROUTER_STATUSLINE=1
+# Claude's Auto permission mode needs a supported Sonnet or Opus client.
+# This profile defaults to Sonnet and excludes Haiku from task routing.
+# AutoRouter also selects it for: claude-autorouter claude --permission-mode auto
+# AUTOROUTER_CLIENT_PROFILE=auto
 # Optional metadata logs on stderr. Redirect stderr to a file when using the UI.
 # AUTOROUTER_DEBUG=1
+# Optional persistent JSONL decision logs, one file per session per launch.
+# Includes up to 500 characters of user prompt text; keep the directory local.
+# Unset or empty disables logging. This does not print prompts in the terminal.
+# AUTOROUTER_SESSION_LOG_DIR=/absolute/path/to/autorouter-sessions
+# Optional: allow two tool-free Stop-hook continuations, then end the turn on
+# the third block. Applies to /goal and all Stop/SubagentStop hooks.
+# Unset keeps Claude's default (currently 8); 0 DISABLES the cap.
+# CLAUDE_CODE_STOP_HOOK_BLOCK_CAP=2
 # Required for Jev only; subscription + Ollama needs no API keys.
 TYPESAFE_API_KEY=
 # For API billing instead, set AUTOROUTER_AUTH_MODE=api-key and fill this in.

package/README.md

@@ -1,6 +1,6 @@
 # Claude AutoRouter
 
-Use Haiku, Sonnet, and Opus in one Claude Code session. A local gateway classifies each inference request with the selected evaluator, applies compatibility and context checks, and streams the selected model's response back to Claude Code. [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is the default; an experimental Ollama backend evaluates requests locally.
+Use Haiku, Sonnet, and Opus in one Claude Code session. A local gateway classifies coding requests with the selected evaluator, applies compatibility and context checks, and streams the selected model's response back to Claude Code. Claude's internal classifiers and server safety-review requests pass through unchanged. [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is the default; an experimental Ollama backend evaluates requests locally.
 
 Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The default evaluator also requires a [TypeSafe API key](https://console.typesafe.ai). There are no runtime package dependencies. Native Windows is not supported in this release.
 
@@ -35,6 +35,14 @@ claude-autorouter --version
 
 For API billing, use `claude-autorouter setup --auth-mode api-key`. Use `--force` to replace an existing config. Automation can supply `TYPESAFE_API_KEY` and, in API-key mode, `ANTHROPIC_API_KEY` through the environment; keys are never command-line arguments. `doctor` checks local configuration and Claude installation/login state without paid requests. See the [configuration reference](docs/reference.md#configuration).
 
+To use Claude's Auto permission mode (AutoRouter 0.3.6+):
+
+```sh
+claude-autorouter claude --permission-mode auto
+```
+
+This selects the Auto-compatible profile: a Sonnet starting model, native thinking, and Sonnet/Opus task routing. Haiku does not support Auto mode. Claude's own permission classifiers and requests carrying server safety-review settings pass through with their selected model unchanged. Organization policies still apply. Use `AUTOROUTER_CLIENT_PROFILE=auto` for sessions where you select Auto in Claude's UI or saved settings. [Auto-mode support and limitations](docs/reference.md#auto-permission-mode).
+
 ## What you see
 
 The launcher adds a temporary status line and leaves saved Claude Code settings unchanged:
@@ -46,6 +54,15 @@ The launcher adds a temporary status line and leaves saved Claude Code settings
 
 The confirmed model comes from Anthropic's response. Claude's own model label can still show its Haiku starting model. `API ctx` measures input against the actual model's known window; a different client limit remains visible as `CLI ctx`.
 
+For a separate decision log per session (optional, disabled by default; AutoRouter 0.3.6+):
+
+```sh
+env AUTOROUTER_SESSION_LOG_DIR="$HOME/.local/state/claude-autorouter/sessions" \
+  claude-autorouter claude
+```
+
+Each JSONL record includes a bounded prompt excerpt, selected model, decision latency, and routing reason. Files persist after Claude exits; terminal output stays quiet. [Session logs](docs/reference.md#session-decision-logs).
+
 Savings are an **API-equivalent estimate for the same token counts**, using Opus as the baseline. They do not measure subscription bill reductions or quota credits and exclude Jev and local compute costs. [Status line and savings details](docs/reference.md#status-line-and-savings).
 
 ## Experimental local evaluator
@@ -104,5 +121,6 @@ Historical measurements before 0.3.2, on a 16 GiB M4: Tev1 0.8B matched 18/24 he
 - The selected evaluator receives bounded excerpts that can contain source code and tool results: TypeSafe with Jev, or the local service with Ollama. Jev also receives system-text excerpts; the local path excludes Claude's executor system instructions. Anthropic receives the complete request. Images, document payloads, and private thinking are omitted from classifier input. [Data flow and authentication](docs/reference.md#data-flow-and-authentication).
 - Subscription access and usage limits still apply. Model switches can reduce cache reuse; cheaper token prices do not guarantee cheaper completed tasks. Run ordinary `claude` to bypass routing.
 - The launcher is quiet by default. Use `AUTOROUTER_DEBUG=1` for metadata diagnostics or `AUTOROUTER_STATUSLINE=0` to retain your existing status line. [Troubleshooting](docs/reference.md#troubleshooting).
+- For blocked `/goal` loops, optionally launch with `env CLAUDE_CODE_STOP_HOOK_BLOCK_CAP=2 claude-autorouter claude`. Claude then ends the turn on the third consecutive blocking verdict without tool use, leaving the goal unmet. This also affects other Stop/SubagentStop hooks; defaults are unchanged. [Scope and saved configuration](docs/reference.md#shorter-stop-hook-loops-opt-in).
 
 [Reference](docs/reference.md) · [Development and validation](docs/development.md) · [CI and npm release setup](docs/releasing.md) · [Apache-2.0 license](LICENSE)

package/bin/autorouter.mjs

@@ -4,10 +4,11 @@ import { spawn } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readConfig, requireKeys } from '../src/config.mjs';
 import { createRouterServer, listen } from '../src/server.mjs';
-import { buildClaudeEnv, conflictingProviders } from '../src/auth.mjs';
+import { buildClaudeEnv, clientProfileForLaunch, conflictingProviders } from '../src/auth.mjs';
 import { dirname } from 'node:path';
 import { createStatusState } from '../src/status-state.mjs';
 import { addStatusLineSettings } from '../src/status-settings.mjs';
+import { createSessionLog } from '../src/session-log.mjs';
 import { loadUserConfig } from '../src/user-config.mjs';
 import { setup, doctor, ollamaDeadlineText } from '../src/onboarding.mjs';
 import { setupOllama } from '../src/ollama-setup.mjs';
@@ -21,8 +22,11 @@ if (['--version', '-v', 'version'].includes(command)) {
 
 Usage:
   claude-autorouter setup [--auth-mode subscription|api-key] [--force]
+    [--client-profile compatible|native|auto]
     [--evaluator jev|ollama]
     [--ollama-model MODEL] [--ollama-timeout-ms N] [--pull]
+    [--stop-hook-block-cap N]
+    [--session-log-dir DIR]
   claude-autorouter doctor
   claude-autorouter claude [Claude Code arguments]
   claude-autorouter serve
@@ -47,10 +51,18 @@ AUTOROUTER_AUTH_MODE=subscription uses your saved Claude Code login.
 Without setup, AUTOROUTER_AUTH_MODE defaults to api-key and also requires ANTHROPIC_API_KEY.
 AUTOROUTER_CLIENT_PROFILE=compatible (default) enables all three routing tiers.
 Use AUTOROUTER_CLIENT_PROFILE=native to retain Claude Code's own model/thinking settings.
+Use AUTOROUTER_CLIENT_PROFILE=auto for Auto permission mode: Sonnet/Opus routing, native thinking.
+An explicit claude --permission-mode auto selects the auto profile for that launch.
+Claude's permission checks and organization policies still apply; Haiku does not support Auto mode.
+Optional CLAUDE_CODE_STOP_HOOK_BLOCK_CAP=N limits consecutive tool-free Stop-hook continuations.
+Use 2 to stop on the third block; applies to /goal and all Stop/SubagentStop hooks.
+Unset preserves Claude's default; 0 disables the cap. Setup --stop-hook-block-cap N saves it.
 Standalone serve also requires AUTOROUTER_TOKEN (at least 16 characters).
 The claude launcher creates a temporary credential and an ephemeral port.
 It enables an AutoRouter status line for this session (AUTOROUTER_STATUSLINE=0 to opt out).
 Launcher logs are quiet by default; AUTOROUTER_DEBUG=1 enables diagnostic logs on stderr.
+AUTOROUTER_SESSION_LOG_DIR writes private per-session JSONL decision logs with prompt excerpts.
+Unset or empty disables session logs. Setup --session-log-dir DIR saves the directory.
 Jev sends prompt excerpts to TypeSafe; Ollama keeps classification on this machine.
 Complete inference requests still go to Anthropic. See README.md.`);
 } else if (command === 'setup' || command === 'doctor') {
@@ -67,14 +79,24 @@ Complete inference requests still go to Anthropic. See README.md.`);
 } else {
   let server;
   let status;
+  let sessionLog;
+  let stopping;
   const stop = () => {
+    if (stopping) return stopping;
     if (server) { server.close(); server.closeAllConnections(); }
     status?.close();
+    // Drain accepted decision records before normal process exit. Pending
+    // filesystem writes keep Node alive; no timer or fire-and-forget buffer.
+    stopping = Promise.resolve().then(() => sessionLog?.close()).catch(() => {});
+    return stopping;
   };
   try {
     if (command === 'serve' && args.length) throw new Error('Usage: claude-autorouter serve');
     const runtimeEnv = loadUserConfig().env;
-    const config = readConfig(runtimeEnv);
+    const config = readConfig(command === 'claude' ? {
+      ...runtimeEnv,
+      AUTOROUTER_CLIENT_PROFILE: clientProfileForLaunch(runtimeEnv.AUTOROUTER_CLIENT_PROFILE ?? 'compatible', args),
+    } : runtimeEnv);
     requireKeys(config);
     const diagnosticLogs = command === 'serve' || runtimeEnv.AUTOROUTER_DEBUG === '1';
     if (command === 'claude') {
@@ -105,11 +127,15 @@ Complete inference requests still go to Anthropic. See README.md.`);
         }
       } else console.error('AutoRouter status line unavailable: could not create local status storage.');
     }
+    if (config.sessionLogDir) sessionLog = await createSessionLog(config.sessionLogDir, {
+      warn: message => console.error(message),
+    });
     // Claude owns the terminal while its UI is running. Status updates use the
     // local snapshot independently; proxy JSON must not write over the UI.
     server = createRouterServer(config, {
       log: diagnosticLogs ? undefined : () => {},
       onStatus: event => status?.update(event),
+      onDecision: sessionLog ? entry => sessionLog.record(entry) : undefined,
     });
     const address = await listen(server, command === 'claude' ? 0 : config.port);
     const baseUrl = `http://127.0.0.1:${address.port}`;

package/docs/reference.md

@@ -6,6 +6,9 @@
 | --- | --- |
 | `claude-autorouter setup` | Save subscription-mode configuration and a Jev key |
 | `claude-autorouter setup --auth-mode api-key` | Configure Jev and Anthropic API-key billing |
+| `claude-autorouter setup --client-profile auto` | Save a Sonnet/Opus profile compatible with Claude's Auto permission mode |
+| `claude-autorouter setup --stop-hook-block-cap 2` | Opt into a shorter native Stop-hook continuation cap during setup |
+| `claude-autorouter setup --session-log-dir DIR` | Save an opt-in directory for per-session JSONL decision logs |
 | `claude-autorouter setup --evaluator ollama --pull` | Configure the native local evaluator and download its selected model if missing |
 | `claude-autorouter setup --evaluator ollama --ollama-timeout-ms 0 --force` | Save a disabled runtime evaluator deadline |
 | `claude-autorouter setup --force` | Replace an existing user config |
@@ -42,9 +45,11 @@ For an environment-only subscription launch, set `AUTOROUTER_AUTH_MODE=subscript
 | `AUTOROUTER_CONFIG` | see path order above | Explicit user config path |
 | `AUTOROUTER_AUTH_MODE` | `api-key` without saved config; setup selects `subscription` | Authentication mode |
 | `AUTOROUTER_EVALUATOR` | `jev` | `jev` or local `ollama` classification |
-| `AUTOROUTER_CLIENT_PROFILE` | `compatible` | `native` retains Claude's own model and thinking settings |
+| `AUTOROUTER_CLIENT_PROFILE` | `compatible` | `native` retains client model/thinking settings; `auto` starts with Sonnet when no explicit model is set and excludes Haiku from task routing |
 | `AUTOROUTER_STATUSLINE` | enabled | `0` retains your existing status line |
 | `AUTOROUTER_DEBUG` | off | `1` enables launcher metadata logs on stderr |
+| `AUTOROUTER_SESSION_LOG_DIR` | off | Write per-session JSONL decision logs with prompt excerpts into this directory; unset or empty disables it |
+| `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` | unset; Claude currently uses `8` | Optional cap on consecutive Stop/SubagentStop continuations without tool use; `0` disables the cap |
 | `ENABLE_TOOL_SEARCH` | `true` in launcher when unset | Load MCP tool definitions on demand; explicit values are preserved |
 | `AUTOROUTER_HAIKU_MODEL` | `claude-haiku-4-5-20251001` | Routine tier |
 | `AUTOROUTER_SONNET_MODEL` | `claude-sonnet-5` | Standard tier |
@@ -170,7 +175,7 @@ The following policy applies after classification:
 - Claude's local `/goal` command can omit the prompt-ID header. For that path, an exact feedback label matching a preceding expanded `/goal` command keeps the original task and conversation anchor. This narrow text fallback also recognizes Claude's repeated-goal truncation format; arbitrary hook text is not treated as a goal. Feedback remains in the evaluator's recent conversation and the full API request. A new human message becomes the current task normally. The status line shows `prompt pinned` or `goal pinned` when either text-continuation rule applies.
 - Thinking history, fixed-budget thinking, server tools, context management, and other recognized model-specific features preserve the current model. Adaptive thinking, effort, and output above 64K prevent a Haiku choice. Fields are never stripped to force a downgrade.
 - Mid-conversation `system` messages preserve the requested model and pass through unchanged. They do not count as a tool continuation by themselves.
-- Recognized compaction and auxiliary requests otherwise preserve their requested model. Token counting and model discovery pass through without classification.
+- Auxiliary requests, including Claude's Auto permission classifier, pass through on their requested model without Jev/Ollama evaluation, token checks, or turn-state changes. Compaction retains its existing model and context-capacity policy. Requests containing `safeguards` also pass through unchanged so the server's safety-review contract is preserved. Token counting and model discovery pass through without classification.
 
 The default `compatible` profile starts Claude with Haiku-compatible requests and client-requested thinking disabled. AutoRouter uses adaptive thinking when upgrading these requests to Opus 5/5.5. Starting with 0.3.3, routing to exact `claude-sonnet-5-5` translates disabled thinking to `between_tools`, which skips up-front thinking but permits progress updates between tool calls. At `xhigh`/`max` effort, or when per-message effort differs from the top-level setting (default `high`), it uses adaptive thinking while preserving the effort settings. Token counting uses the same adaptation. Sonnet 5 still accepts disabled thinking and is unchanged. See [Sonnet 5.5 thinking requirements](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide).
 
@@ -178,6 +183,28 @@ Explicit native `between_tools` and unknown thinking modes retain the incoming m
 
 The launcher enables `ENABLE_TOOL_SEARCH=true` when unset. Claude can otherwise disable on-demand MCP discovery when using a custom API address, loading connected-tool schemas into even a fresh conversation. Explicit values, including `false` or `auto:5`, are preserved. Managed settings and always-loaded tools can still affect deferral. See [Claude Code tool search](https://code.claude.com/docs/en/mcp#configure-tool-search).
 
+### Auto permission mode
+
+The default `compatible` profile starts Claude as Haiku to permit three-tier routing. Claude's Auto permission mode does not support Haiku, even if AutoRouter routes an API request to Sonnet. Eligibility is based on Claude's selected client model. Gateways themselves are supported. See [Claude's Auto-mode requirements](https://code.claude.com/docs/en/permission-modes#eliminate-permission-prompts-with-auto-mode).
+
+AutoRouter 0.3.6 adds an `auto` client profile. Launch with:
+
+```sh
+claude-autorouter claude --permission-mode auto
+```
+
+An explicit `--permission-mode auto` (or `--permission-mode=auto`) selects the profile for that launch, including when your saved profile is `native`. All arguments still go to Claude unchanged. For Auto chosen from Claude's UI or existing settings instead, use:
+
+```sh
+env AUTOROUTER_CLIENT_PROFILE=auto claude-autorouter claude
+```
+
+The profile defaults the client to the configured Sonnet model and preserves native thinking and explicit model choices. It promotes a routine Haiku routing decision to Sonnet, while other model-feature and conversation-continuity guards still apply. Configured Sonnet/Opus targets must be known Auto-capable models. An explicit client `--model` or `ANTHROPIC_MODEL` can still make Auto unavailable if it selects Haiku or another unsupported model; choose a supported Sonnet or Opus instead.
+
+Claude remains responsible for enabling the permission mode and enforcing organization settings, account availability, and tool rules. The profile does not enable Auto by itself or override `disableAutoMode`. AutoRouter does not reproduce Claude's settings precedence to infer a mode from settings files. For new saved configurations, `setup --client-profile auto` persists the profile; for an existing config, change only `AUTOROUTER_CLIENT_PROFILE` to `"auto"` to retain your other settings. `setup --force` replaces the config.
+
+**Routing limits:** Claude's permission-classifier requests retain their exact requested model and skip AutoRouter's evaluator. Requests with server-side `safeguards` also retain their model and full body, and safety verdicts stream back unchanged. The status line shows `pass-through · Auto safety` for these requests. Recent Claude versions normally request server-side review through gateways, so Auto-mode sessions can stay on their client-selected model rather than switching between Sonnet and Opus. Ordinary routable requests use the Sonnet/Opus floor, shown as `Auto mode floor` when it changes a Haiku choice. AutoRouter does not disable server review to enable routing. See [server-side classifier review](https://code.claude.com/docs/en/permission-modes#server-side-classifier-review).
+
 ### Context capacity
 
 Context-relevant JSON above 150KB, or image/document blocks including those inside tool results, trigger a token check for otherwise compatible small models. This byte threshold is a trigger, not a token estimate. The check includes system instructions and active tool schemas. Unused deferred schemas are excluded from the trigger; discovered references and historical tool calls add them back. Unknown shapes are counted conservatively.
@@ -216,6 +243,40 @@ This estimate does not measure subscription bill savings or quota credits. It ex
 
 Set `AUTOROUTER_STATUSLINE=0` to retain an existing status line. Other `--settings` values are retained in the temporary overlay; source-relative Read/Edit rules keep their anchors. Ambiguous relative sandbox paths cause the launcher to skip the overlay and pass original settings through with a notice. Safe mode disables custom status lines; print mode has no status-line UI. Standalone `serve` does not install one.
 
+## Session decision logs
+
+AutoRouter 0.3.6 adds optional persistent logs, separate from stderr and the temporary status-line snapshot. Logging is disabled by default. Enable it for one launch:
+
+```sh
+env AUTOROUTER_SESSION_LOG_DIR="$HOME/.local/state/claude-autorouter/sessions" \
+  claude-autorouter claude
+```
+
+The setting also works with `serve` and the Auto-compatible profile. For a new saved configuration, add `--session-log-dir DIR` to `setup`. For an existing config, add `AUTOROUTER_SESSION_LOG_DIR` with an absolute directory path to preserve your other settings. Setup resolves relative paths at setup time; an environment-only relative path resolves from the launch directory. Environment values override saved values; `AUTOROUTER_SESSION_LOG_DIR=''` disables a saved preference for one launch. `doctor` reports the setting without creating log files.
+
+Files are named `autorouter-session-*.jsonl`: one file per observed Claude session within a router launch, with a timestamp, random launch identifier, and hashed session identifier in the name. A resumed session in a new launch creates a new file. Requests without a session header share an anonymous file for that launch. Subagents with the same session ID share its file and retain their agent ID. Files are created only when a decision is recorded, and remain after the session ends.
+
+Every line is a standalone JSON object. The key fields look like this (additional IDs and routing metadata are included):
+
+```json
+{"schema_version":1,"event":"decision","timestamp":"2026-09-30T12:00:00.000Z","session_id":"example-session","prompt_excerpt":"Fix the typo in README.md","prompt_truncated":false,"requested_model":"claude-haiku-4-5-20251001","selected_model":"claude-sonnet-5","decision_latency_ms":214.37,"source":"jev","reason":"classified"}
+```
+
+- `prompt_excerpt`: up to 500 Unicode characters of the current human task for main requests or requests without a class header. Tool continuations and recognized `/goal` feedback keep the originating human task. System instructions, standalone reminder blocks, tool results, images, documents, and thinking are omitted. Auxiliary classifiers, compaction, subagents, and workflows have empty excerpts; a new attachment-only task also has an empty excerpt. `prompt_truncated` indicates that text exceeded the limit.
+- `selected_model`: AutoRouter's final selected model after compatibility checks, before the upstream response. It does not confirm which model successfully answered.
+- `decision_latency_ms`: time spent making the routing decision, including evaluator waiting, cache lookup, and any context checks. It excludes Claude generation time and log writing. A `passthrough` entry can be near zero because no evaluator was called.
+- `source` and `reason`: distinguish evaluator choices, cache hits, fallbacks, turn/model constraints, and native safety pass-through. `classified_tier` is included when an evaluator returned a tier, which may differ from the final selected model.
+
+Inspect a file with:
+
+```sh
+jq -c '{prompt_excerpt, selected_model, decision_latency_ms, source, reason}' /path/to/autorouter-session-EXAMPLE.jsonl
+```
+
+There is one record per completed routing decision, including requests whose upstream call later fails. Requests rejected before routing or cancelled before a decision are not recorded. Logs contain user text and are local plaintext: the feature is disabled by default, new directories use `0700`, and files use `0600`. Existing directory permissions are left unchanged. Authentication headers, provider replies, full transcripts, and tool payloads are not logged; text you put directly in a prompt can appear in its excerpt.
+
+Writes run asynchronously through a bounded 1 MiB queue and support up to 128 session files per router process. Normal shutdown drains accepted records. Filesystem failure or a queue/session limit disables further logging with one generic warning while routing continues. An abrupt process kill or storage failure can lose unwritten records. Logs are retained without automatic rotation or deletion; manage them in your chosen directory. Log filenames are ignored by this repository and excluded from the npm package.
+
 ## Troubleshooting
 
 Run `claude-autorouter doctor` first. It performs local checks without Claude generations or Jev calls, including local HTTP checks for the selected Ollama model. It cannot establish Anthropic/TypeSafe availability, current quota, or whether a key will be accepted remotely.
@@ -238,6 +299,26 @@ The launcher is quiet by default. Standalone `serve` logs to stderr by default.
 
 If the worker reports a blocker but the checker keeps returning “not yet met,” Claude can repeat its answer until its no-progress guard pauses the goal. Repeated tool calls can keep the loop running longer. Use `/goal clear` to end the loop, resolve the external blocker, and set the goal again. For tasks that may require human action, explicitly allow reporting a blocker as an alternative end condition, for example: `/goal Verify the discrepancy against upstream main and run the relevant tests, or report an external authorization blocker and stop.` This changes what counts as completion; AutoRouter does not declare blocked work successful or rewrite goal instructions. See [Claude Code goal evaluation](https://code.claude.com/docs/en/goal#how-evaluation-works).
 
+### Shorter Stop-hook loops (opt-in)
+
+To return control sooner when a goal keeps reporting the same unmet condition, set Claude's native continuation cap for one launch:
+
+```sh
+env CLAUDE_CODE_STOP_HOOK_BLOCK_CAP=2 claude-autorouter claude
+```
+
+This permits two consecutive continuations without tool use; the third blocking verdict ends the turn. The goal remains set and unmet, and a new message can resume it. Tool activity resets the counter, so this is not a total turn or request limit and cannot bound repeated failed tool calls. It applies to **all Stop and SubagentStop hooks**, including `/goal`. A smaller cap can pause useful work sooner. Unset preserves Claude's default (currently `8`); **`0` disables the guard**. AutoRouter does not install a Stop hook or change completion verdicts. See [Claude's environment-variable reference](https://code.claude.com/docs/en/env-vars) and [Stop-hook loop behavior](https://code.claude.com/docs/en/hooks#stop).
+
+The environment-only command also works on AutoRouter 0.3.4. Saved configuration and the setup flag require AutoRouter 0.3.5 or newer. To save the preference, add the following property to your existing AutoRouter config JSON, preserving its other values:
+
+```json
+"CLAUDE_CODE_STOP_HOOK_BLOCK_CAP": "2"
+```
+
+For a new configuration, use `claude-autorouter setup --stop-hook-block-cap 2`; the flag works with either evaluator and overrides the environment during setup. Runtime environment values override saved configuration. `setup --force` replaces the entire config, so keep your existing evaluator/authentication options if using it. `doctor` reports the cap when configured. AutoRouter accepts nonnegative safe integers and leaves the setting absent unless you opt in.
+
+### Other session issues
+
 **After restarting mid-conversation:** turn state is in memory and expires after 30 minutes. Unknown continuations preserve the incoming model. Start a fresh conversation when restarting around signed thinking; AutoRouter cannot reconstruct the prior actual model from lost turn state.
 
 Switching models can lose prompt-cache reuse. A cheaper price per token does not guarantee a cheaper or faster task. Only requests using Claude's configured base URL are visible to this proxy. Alternate provider modes such as Bedrock, Vertex, Foundry, Mantle, and `ANTHROPIC_AWS` are unsupported; unset their enable flags before launching. Use ordinary `claude` to bypass routing.

package/docs/releasing.md

@@ -10,7 +10,11 @@ Version `0.3.3` fixes HTTP 400 errors when a compatible request with disabled th
 
 Version `0.3.4` preserves the selected model across Stop-hook feedback for the same prompt, including `/goal` commands that omit the gateway prompt-ID header. Recognized goal feedback remains conversation context rather than replacing the human task in evaluator excerpts. Goal-checker verdicts remain unchanged; external authorization blockers can still cause Claude's own goal loop to repeat. See [goal troubleshooting](reference.md#troubleshooting).
 
-The GitHub repository is private. Publishing to npm makes the tarball's runtime source, README, configuration example, license, and shipped documentation public. Model weights, user configuration, credentials, transcripts, local artifacts, and test fixtures are excluded. Review the archive before the first publication and whenever the package allowlist changes.
+Version `0.3.5` adds opt-in saved configuration for Claude's native `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`, with `setup --stop-hook-block-cap N`, validation, and `doctor` reporting. A value of `2` permits two consecutive Stop-hook continuations without tool use and ends the turn on the third blocking verdict, leaving an unmet goal set. This affects all Stop/SubagentStop hooks, and tool activity resets the counter. Defaults and completion verdicts are unchanged; `0` disables the guard. See [shorter Stop-hook loops](reference.md#shorter-stop-hook-loops-opt-in).
+
+Version `0.3.6` fixes Auto permission-mode launches with an Auto-compatible Sonnet/Opus profile while preserving Claude's permission classifiers and server safety-review requests. It also adds optional per-session JSONL decision logs containing a bounded human prompt excerpt, selected model, and routing latency. Logging is disabled by default; set `AUTOROUTER_SESSION_LOG_DIR` or use `setup --session-log-dir DIR` to enable it. See [Auto permission mode](reference.md#auto-permission-mode) and [session decision logs](reference.md#session-decision-logs).
+
+The GitHub repository is private. Publishing to npm makes the tarball's runtime source, README, configuration example, license, and shipped documentation public. Model weights, user configuration, credentials, transcripts, session logs, local artifacts, and test fixtures are excluded. Review the archive before the first publication and whenever the package allowlist changes.
 
 ## What runs automatically
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-autorouter",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "license": "Apache-2.0",
   "type": "module",
   "description": "A Claude Code model router with Jev and local Ollama System One evaluators",

package/src/auth.mjs

@@ -1,5 +1,17 @@
 export const LOCAL_AUTH_HEADER = 'x-autorouter-token';
 
+// Leave Claude's permission selection and policy enforcement to Claude. This
+// only chooses a compatible routing profile for an explicit Auto-mode launch.
+export function clientProfileForLaunch(profile, args) {
+  let permissionMode;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--') break;
+    if (args[i] === '--permission-mode') permissionMode = args[++i];
+    else if (args[i].startsWith('--permission-mode=')) permissionMode = args[i].slice('--permission-mode='.length);
+  }
+  return permissionMode === 'auto' ? 'auto' : profile;
+}
+
 export function conflictingProviders(env = process.env) {
   return ['CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY',
     'CLAUDE_CODE_USE_MANTLE', 'CLAUDE_CODE_USE_ANTHROPIC_AWS']
@@ -16,6 +28,11 @@ export function isSubscriptionRequest(headers) {
 
 export function buildClaudeEnv(config, baseUrl, parent = process.env) {
   const env = { ...parent, ANTHROPIC_BASE_URL: baseUrl, CLAUDE_CODE_GATEWAY_HINT_HEADERS: '1' };
+  // Opt into Claude's own loop guard without installing hooks or altering
+  // their verdicts. An unset cap leaves Claude's default in control.
+  if (env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP === undefined && config.stopHookBlockCap !== undefined) {
+    env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP = String(config.stopHookBlockCap);
+  }
   // Claude Code otherwise disables MCP tool search for a non-first-party
   // base URL and loads every schema into context. This proxy preserves both
   // tool_reference blocks and their beta headers. Respect explicit choices.
@@ -25,6 +42,10 @@ export function buildClaudeEnv(config, baseUrl, parent = process.env) {
   if (config.clientProfile === 'compatible') {
     env.ANTHROPIC_MODEL = config.models.haiku;
     env.MAX_THINKING_TOKENS = '0';
+  } else if (config.clientProfile === 'auto') {
+    // Haiku cannot run Auto permission mode. Leave explicit client choices
+    // and thinking settings to Claude; it still enforces account/admin gates.
+    env.ANTHROPIC_MODEL ??= config.models.sonnet;
   }
   const subscription = config.authMode === 'subscription';
   // Keep unrelated custom headers. Remove stale router credentials and, in

package/src/config.mjs

@@ -1,6 +1,31 @@
 import { DEFAULT_OLLAMA_MODEL, defaultOllamaTimeoutMs, validateOllamaEndpoint, validateOllamaModel } from './ollama-models.mjs';
+import { resolve } from 'node:path';
 
 export const TIERS = ['haiku', 'sonnet', 'opus'];
+export const CLIENT_PROFILES = ['compatible', 'native', 'auto'];
+// Exact Anthropic models whose Auto permission-mode support is documented.
+// Custom aliases are not proof of the capabilities of their upstream model.
+const AUTO_MODE_MODELS = new Set([
+  'claude-sonnet-4-6', 'claude-sonnet-5', 'claude-sonnet-5-5',
+  'claude-opus-4-6', 'claude-opus-4-7', 'claude-opus-4-8', 'claude-opus-5', 'claude-opus-5-5',
+]);
+
+export function parseStopHookBlockCap(value, name = 'CLAUDE_CODE_STOP_HOOK_BLOCK_CAP') {
+  if (!['string', 'number'].includes(typeof value)
+    || (typeof value === 'string' && !/^[0-9]+$/.test(value.trim()))
+    || !Number.isSafeInteger(Number(value)) || Number(value) < 0) {
+    throw new Error(`${name} requires a nonnegative safe integer (0 disables the Stop-hook continuation cap)`);
+  }
+  return Number(value);
+}
+
+export function parseSessionLogDir(value, name = 'AUTOROUTER_SESSION_LOG_DIR') {
+  if (value === undefined || value === '') return undefined;
+  if (typeof value !== 'string' || !value.trim() || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${name} must be a directory path, or an empty string to disable session logging`);
+  }
+  return resolve(value);
+}
 
 function number(env, key, fallback, min, max, integer = true) {
   const value = Number(env[key] ?? fallback);
@@ -39,8 +64,20 @@ export function readConfig(env = process.env) {
     throw new Error('AUTOROUTER_AUTH_MODE must be api-key or subscription');
   }
   const clientProfile = env.AUTOROUTER_CLIENT_PROFILE ?? 'compatible';
-  if (!['compatible', 'native'].includes(clientProfile)) {
-    throw new Error('AUTOROUTER_CLIENT_PROFILE must be compatible or native');
+  if (!CLIENT_PROFILES.includes(clientProfile)) {
+    throw new Error('AUTOROUTER_CLIENT_PROFILE must be compatible, native or auto');
+  }
+  const models = {
+    haiku: env.AUTOROUTER_HAIKU_MODEL ?? 'claude-haiku-4-5-20251001',
+    sonnet: env.AUTOROUTER_SONNET_MODEL ?? 'claude-sonnet-5',
+    opus: env.AUTOROUTER_OPUS_MODEL ?? 'claude-opus-5-5',
+  };
+  if (clientProfile === 'auto') {
+    for (const tier of ['sonnet', 'opus']) {
+      if (!AUTO_MODE_MODELS.has(models[tier])) {
+        throw new Error(`AUTOROUTER_${tier.toUpperCase()}_MODEL must be a known Auto-mode-capable Sonnet or Opus model for the auto profile`);
+      }
+    }
   }
   const upstream = endpoint(env.AUTOROUTER_UPSTREAM_URL ?? 'https://api.anthropic.com', 'AUTOROUTER_UPSTREAM_URL');
   if (authMode === 'subscription' && upstream !== 'https://api.anthropic.com') {
@@ -50,6 +87,9 @@ export function readConfig(env = process.env) {
     evaluator,
     authMode,
     clientProfile,
+    sessionLogDir: parseSessionLogDir(env.AUTOROUTER_SESSION_LOG_DIR),
+    stopHookBlockCap: env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP === undefined
+      ? undefined : parseStopHookBlockCap(env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP),
     anthropicKey: authMode === 'api-key' ? env.ANTHROPIC_API_KEY : undefined,
     jevKey: env.TYPESAFE_API_KEY,
     localToken: env.AUTOROUTER_TOKEN,
@@ -61,11 +101,7 @@ export function readConfig(env = process.env) {
     ollamaTimeoutMs: number(env, 'AUTOROUTER_OLLAMA_TIMEOUT_MS', defaultOllamaTimeoutMs(ollamaModel), 0, 30000),
     ollamaStateChars: 3000,
     ollamaKeepAlive,
-    models: {
-      haiku: env.AUTOROUTER_HAIKU_MODEL ?? 'claude-haiku-4-5-20251001',
-      sonnet: env.AUTOROUTER_SONNET_MODEL ?? 'claude-sonnet-5',
-      opus: env.AUTOROUTER_OPUS_MODEL ?? 'claude-opus-5-5',
-    },
+    models,
     port: number(env, 'AUTOROUTER_PORT', 8787, 0, 65535),
     jevTimeoutMs: number(env, 'AUTOROUTER_JEV_TIMEOUT_MS', 1500, 1, 10000),
     tokenCountTimeoutMs: number(env, 'AUTOROUTER_TOKEN_COUNT_TIMEOUT_MS', 1500, 1, 10000),

package/src/onboarding.mjs

@@ -3,7 +3,7 @@ import { existsSync } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { Writable } from 'node:stream';
 import { promisify } from 'node:util';
-import { readConfig, requireKeys } from './config.mjs';
+import { CLIENT_PROFILES, readConfig, requireKeys, parseStopHookBlockCap, parseSessionLogDir } from './config.mjs';
 import { buildClaudeEnv, conflictingProviders, LOCAL_AUTH_HEADER } from './auth.mjs';
 import { getConfigPath, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { DEFAULT_OLLAMA_MODEL, validateOllamaModel } from './ollama-models.mjs';
@@ -14,6 +14,10 @@ const execute = promisify(execFile);
 export const ollamaDeadlineText = timeoutMs => timeoutMs === 0
   ? 'routing deadline disabled' : `routing deadline ${timeoutMs} ms per request`;
 
+const stopHookCapText = cap => cap === 0
+  ? 'Claude Stop/SubagentStop continuation cap disabled (0).'
+  : `Claude Stop/SubagentStop cap: ${cap} continuations without tool use.`;
+
 // Readline manages editing and restores terminal state; its output is discarded
 // so neither typing nor pasted credentials are echoed to the terminal.
 export async function askSecret(label, { input = process.stdin, output = process.stderr } = {}) {
@@ -37,13 +41,17 @@ export async function setup(args, {
   env = process.env, write = console.log, prompt = askSecret, fetchImpl = fetch, signal,
 } = {}) {
   let authMode = env.AUTOROUTER_AUTH_MODE ?? 'subscription';
+  let clientProfile = env.AUTOROUTER_CLIENT_PROFILE ?? 'compatible';
   let evaluator = env.AUTOROUTER_EVALUATOR ?? 'jev';
   let model;
   let ollamaTimeoutMs;
+  let stopHookBlockCap = env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP;
+  let sessionLogDir = env.AUTOROUTER_SESSION_LOG_DIR;
   let pull = false;
   let overwrite = false;
   for (let i = 0; i < args.length; i++) {
     if (args[i] === '--auth-mode') authMode = args[++i];
+    else if (args[i] === '--client-profile') clientProfile = args[++i];
     else if (args[i] === '--evaluator') evaluator = args[++i];
     else if (args[i] === '--ollama-model') { model = args[++i]; if (model === undefined) throw new Error('--ollama-model requires a model tag'); }
     else if (args[i] === '--ollama-timeout-ms') {
@@ -53,19 +61,32 @@ export async function setup(args, {
       }
       ollamaTimeoutMs = String(Number(value));
     }
+    else if (args[i] === '--stop-hook-block-cap') {
+      stopHookBlockCap = parseStopHookBlockCap(args[++i], '--stop-hook-block-cap');
+    }
+    else if (args[i] === '--session-log-dir') {
+      sessionLogDir = args[++i];
+      if (sessionLogDir === undefined || sessionLogDir.startsWith('--')) throw new Error('--session-log-dir requires a directory path');
+      parseSessionLogDir(sessionLogDir, '--session-log-dir');
+    }
     else if (args[i] === '--pull') pull = true;
     else if (args[i] === '--force') overwrite = true;
-    else throw new Error('Usage: claude-autorouter setup [--auth-mode subscription|api-key] [--evaluator jev|ollama] [--ollama-model TAG] [--ollama-timeout-ms N] [--pull] [--force]');
+    else throw new Error('Usage: claude-autorouter setup [--auth-mode subscription|api-key] [--client-profile compatible|native|auto] [--evaluator jev|ollama] [--ollama-model TAG] [--ollama-timeout-ms N] [--stop-hook-block-cap N] [--session-log-dir DIR] [--pull] [--force]');
   }
   if (!['subscription', 'api-key'].includes(authMode)) throw new Error('--auth-mode must be subscription or api-key');
+  if (!CLIENT_PROFILES.includes(clientProfile)) throw new Error('--client-profile must be compatible, native or auto');
   if (!['jev', 'ollama'].includes(evaluator)) throw new Error('--evaluator must be jev or ollama');
   if (evaluator !== 'ollama' && (model !== undefined || ollamaTimeoutMs !== undefined || pull)) throw new Error('Ollama model, deadline and download options require --evaluator ollama');
+  if (stopHookBlockCap !== undefined) stopHookBlockCap = parseStopHookBlockCap(stopHookBlockCap);
+  if (sessionLogDir !== undefined) sessionLogDir = parseSessionLogDir(sessionLogDir) ?? '';
   const path = getConfigPath(env);
   if (!overwrite && existsSync(path)) throw new Error('AutoRouter configuration already exists. Use setup --force to replace it.');
   write(evaluator === 'ollama'
     ? 'AutoRouter evaluates bounded prompt excerpts locally with Ollama. Complete requests still go to Anthropic.'
     : 'AutoRouter sends bounded prompt excerpts to TypeSafe Jev and complete requests to Anthropic.');
-  const values = { AUTOROUTER_AUTH_MODE: authMode, AUTOROUTER_CLIENT_PROFILE: 'compatible', AUTOROUTER_EVALUATOR: evaluator };
+  const values = { AUTOROUTER_AUTH_MODE: authMode, AUTOROUTER_CLIENT_PROFILE: clientProfile, AUTOROUTER_EVALUATOR: evaluator };
+  if (stopHookBlockCap !== undefined) values.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP = String(stopHookBlockCap);
+  if (sessionLogDir !== undefined) values.AUTOROUTER_SESSION_LOG_DIR = sessionLogDir;
   if (evaluator === 'ollama') {
     values.AUTOROUTER_OLLAMA_MODEL = validateOllamaModel(model ?? env.AUTOROUTER_OLLAMA_MODEL ?? DEFAULT_OLLAMA_MODEL);
     for (const key of ['AUTOROUTER_OLLAMA_URL', 'AUTOROUTER_OLLAMA_TIMEOUT_MS', 'AUTOROUTER_OLLAMA_KEEP_ALIVE']) {
@@ -81,6 +102,9 @@ export async function setup(args, {
   }
   const config = readConfig(values);
   requireKeys(config);
+  if (config.clientProfile === 'auto') write('Auto-compatible profile: Sonnet/Opus task routing. Claude controls permission-mode availability and safety checks.');
+  if (config.stopHookBlockCap !== undefined) write(stopHookCapText(config.stopHookBlockCap));
+  if (config.sessionLogDir) write('Session decision logs enabled; files include up to 500 characters of user prompt text per decision.');
   if (evaluator === 'ollama') {
     write(`Local evaluator: ${config.ollamaModel}; ${ollamaDeadlineText(config.ollamaTimeoutMs)}.`);
     const controller = new AbortController();
@@ -115,6 +139,9 @@ export async function doctor({ env = process.env, write = console.log, run = exe
   for (const key of conflictingProviders(effectiveEnv)) {
     report(false, `Unset ${key}; AutoRouter uses the Anthropic Messages API`);
   }
+  if (config?.stopHookBlockCap !== undefined) write(stopHookCapText(config.stopHookBlockCap));
+  if (config?.clientProfile === 'auto') write('Auto-compatible profile: Sonnet/Opus task routing. Claude controls permission-mode availability and safety checks.');
+  if (config?.sessionLogDir) write('Session decision logs enabled; files include up to 500 characters of user prompt text per decision.');
   if (config?.evaluator === 'ollama') {
     write(`Local evaluator: ${config.ollamaModel}; ${ollamaDeadlineText(config.ollamaTimeoutMs)}.`);
     write('Model availability is checked below; classification speed and accuracy are not tested.');

package/src/prompt-state.mjs

@@ -122,6 +122,54 @@ export function goalFeedbackIndexes(messages) {
   return indexes;
 }
 
+// Optional diagnostic logs need only the current human text, not evaluator
+// history or non-text placeholders. Bound collection before joining strings,
+// and never visit tool input/output, attachments, or reasoning payloads.
+export function promptExcerpt(body, maxChars = 500) {
+  if (!Number.isSafeInteger(maxChars) || maxChars < 0) throw new TypeError('maxChars must be a nonnegative safe integer');
+  const messages = body?.messages;
+  if (!maxChars || !Array.isArray(messages)) return '';
+  let feedbackIndexes;
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index];
+    if (message?.role !== 'user') continue;
+    const content = message.content;
+    if (Array.isArray(content) && content.some(block => block?.type === 'tool_result')) continue;
+    const standalone = typeof content === 'string' ? content
+      : Array.isArray(content) && content.length === 1 && content[0]?.type === 'text'
+        && typeof content[0].text === 'string' ? content[0].text : undefined;
+    if (standalone?.startsWith('Stop hook feedback:\n[')) {
+      feedbackIndexes ??= goalFeedbackIndexes(messages);
+      if (feedbackIndexes.has(index)) continue;
+    }
+    const blocks = typeof content === 'string' ? [{ type: 'text', text: content }]
+      : Array.isArray(content) ? content : [];
+    const characters = [];
+    let nonText = false;
+    for (const block of blocks) {
+      if (block?.type !== 'text' || typeof block.text !== 'string') {
+        nonText = true;
+        continue;
+      }
+      const value = block.text;
+      // Also omit complete wrappers in string messages. Unlike classifier
+      // input, a diagnostic excerpt should never log a reminder-only turn.
+      if (!/\S/.test(value) || isReminderBlock(value)) continue;
+      if (characters.length) characters.push('\n');
+      for (const character of value) {
+        if (characters.length >= maxChars) break;
+        characters.push(character);
+      }
+      if (characters.length >= maxChars) break;
+    }
+    if (characters.length) return characters.join('').toWellFormed();
+    // An image/document-only human turn is a new task with no safe excerpt;
+    // do not incorrectly label it with the preceding human task's text.
+    if (nonText) return '';
+  }
+  return '';
+}
+
 export function buildState(body, limit = 12000) {
   const messages = body.messages ?? [];
   const feedbackIndexes = goalFeedbackIndexes(messages);

package/src/router.mjs

@@ -226,6 +226,26 @@ export class Router {
   async route(body, { scope = '', signal, requestClass = '', promptId = '', countTokens } = {}) {
     const start = performance.now();
     const c = this.config;
+    // Claude owns auxiliary permission checks and the server-side safeguards
+    // contract. Never evaluate, adapt, or count these requests: changing
+    // their model can change the safety decision or invalidate its context.
+    if (requestClass === 'auxiliary' || body.safeguards !== undefined) {
+      // A safeguarded main request still produces the next tool turn. Replace
+      // any older routing pin with the actual preserved model so a later
+      // request that omits safeguards cannot restore that stale model. Side
+      // classifiers and compaction never take ownership of the main turn.
+      if (!['auxiliary', 'compaction'].includes(requestClass)) {
+        const turn = turnInfo(body, scope, promptId);
+        if (turn.index >= 0 || promptId) {
+          const pin = { model: body.model, requestedModel: body.model };
+          this.turns.set(turn.key, pin);
+          if (turn.contentKey !== turn.key) this.turns.set(turn.contentKey, pin);
+        }
+      }
+      return { model: body.model, source: 'passthrough',
+        reason: requestClass === 'auxiliary' ? 'internal_request' : 'auto_mode_safeguards',
+        latency_ms: Math.round((performance.now() - start) * 100) / 100 };
+    }
     const hasSystemMessage = body.messages.some(m => m.role === 'system');
     const unknownModel = rank(body.model) < 0 && !Object.values(c.models).includes(body.model);
     const modelSpecificThinking = body.thinking && !['disabled', 'adaptive'].includes(body.thinking.type);
@@ -243,12 +263,19 @@ export class Router {
     // Check suspicious input in parallel with Jev. Byte size only triggers a
     // check: common tool catalogs can be 200KB yet occupy far less than 200K
     // tokens. Tiny requests keep the one-call fast path.
-    const earlyCount = !capacityLocked && countTokens && CAPACITY_UPGRADE_MODELS.has(c.models.haiku)
+    const earlyCount = c.clientProfile !== 'auto' && !capacityLocked && countTokens && CAPACITY_UPGRADE_MODELS.has(c.models.haiku)
       && (contextSizeBytes(body, c.models.haiku) > 150000 || hasAttachments)
       ? safelyCount(c.models.haiku) : undefined;
     const decision = await this.classify(body, signal);
     let model = c.models[decision.tier];
     let reason = decision.reason;
+    // Auto permission mode requires a supported execution model. Retain the
+    // evaluator's verdict for observability; stronger compatibility and turn
+    // constraints below still decide whether this ordinary choice can apply.
+    if (c.clientProfile === 'auto' && decision.tier === 'haiku') {
+      model = c.models.sonnet;
+      reason = 'auto_mode_floor';
+    }
     const turn = turnInfo(body, scope, promptId);
     const promptPin = promptId ? this.turns.get(turn.key) : undefined;
     const turnPin = promptPin ?? this.turns.get(turn.contentKey);
@@ -269,7 +296,7 @@ export class Router {
 
     // A tool result belongs to the model that requested it. Do not bounce the
     // agent between models partway through one human turn.
-    if (requestClass === 'compaction' || requestClass === 'auxiliary') preserve(body.model, 'internal_request');
+    if (requestClass === 'compaction') preserve(body.model, 'internal_request');
     // Mid-conversation system messages are only supported by certain models.
     // Keep the client's capable model and all message fields (including
     // clear_at, tool changes, and output_config) instead of down-routing.
@@ -336,7 +363,7 @@ export class Router {
       }
     }
     const identifiableUpgrade = capacityUpgraded && (turn.index >= 0 || promptId);
-    if ((!turn.continuation || previous || identifiableUpgrade || reason === 'mid_conversation_system') && !['compaction', 'auxiliary'].includes(requestClass)) {
+    if ((!turn.continuation || previous || identifiableUpgrade || reason === 'mid_conversation_system') && requestClass !== 'compaction') {
       const pin = { model, requestedModel: body.model };
       this.turns.set(turn.key, pin);
       // Keep the content key too: later human turns carry signed thinking but

package/src/server.mjs

@@ -7,6 +7,7 @@ import { LOCAL_AUTH_HEADER, isSubscriptionRequest } from './auth.mjs';
 import { prepareRequest } from './model-request.mjs';
 import { createResponseObserver } from './response-observer.mjs';
 import { createTokenCounter } from './token-counter.mjs';
+import { promptExcerpt } from './prompt-state.mjs';
 
 function cleanHeaders(headers) {
   const blocked = new Set(['host', 'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'content-length']);
@@ -101,7 +102,7 @@ async function forward(url, req, res, body, config, signal, log, status) {
   }
 }
 
-export function createRouterServer(config, { router = new Router(config), tokenCounter = createTokenCounter(config), log = entry => process.stderr.write(`${JSON.stringify(entry)}\n`), onStatus = () => {} } = {}) {
+export function createRouterServer(config, { router = new Router(config), tokenCounter = createTokenCounter(config), log = entry => process.stderr.write(`${JSON.stringify(entry)}\n`), onStatus = () => {}, onDecision } = {}) {
   if (!config.localToken || config.localToken.length < 16) throw new Error('AUTOROUTER_TOKEN must contain at least 16 characters');
   const server = http.createServer(async (req, res) => {
     const controller = new AbortController();
@@ -175,6 +176,21 @@ export function createRouterServer(config, { router = new Router(config), tokenC
           if (controller.signal.aborted) { status('request_cancelled'); return; }
           const prepared = prepareRequest(parsed, decision.model);
           body = Buffer.from(JSON.stringify(prepared.request));
+          // Prompt excerpts go only to this explicit opt-in sink, never to
+          // ordinary diagnostics or the status snapshot. Optional logging
+          // cannot delay or fail forwarding, including an async sink failure.
+          if (onDecision) {
+            try {
+              const chars = [...(!context.request_class || context.request_class === 'main' ? promptExcerpt(parsed, 501) : '')];
+              Promise.resolve(onDecision({
+                schema_version: 1, event: 'decision', timestamp: new Date().toISOString(), ...context,
+                prompt_excerpt: chars.slice(0, 500).join(''), prompt_truncated: chars.length > 500,
+                requested_model: parsed.model, selected_model: decision.model, decision_latency_ms: decision.latency_ms,
+                source: decision.source, reason: decision.reason, evaluator: decision.evaluator,
+                classified_tier: decision.classified_tier, classifier_error: decision.classifier_error,
+              })).catch(() => {});
+            } catch {}
+          }
           log({ event: 'route', requested_model: parsed.model, ...decision, request_adjustments: prepared.adjustments });
           const { model, source, evaluator, reason, latency_ms, classifier_error, classifier_status, classified_tier, context_check, counted_input_tokens } = decision;
           const pricingValue = (field, allowed, fallback) => prepared.request[field] === undefined ? fallback

package/src/session-log.mjs

@@ -0,0 +1,171 @@
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import { createHash, randomBytes } from 'node:crypto';
+import { join, resolve } from 'node:path';
+
+const MAX_PENDING_BYTES = 1024 * 1024;
+const MAX_SESSIONS = 128;
+const WARNING = 'AutoRouter session logging disabled.';
+const SOURCES = new Set(['jev', 'ollama', 'cache', 'fallback', 'passthrough']);
+const ERRORS = new Set(['timeout', 'http_error', 'invalid_response', 'network_error']);
+const identifier = value => typeof value === 'string' && /^[A-Za-z0-9_.:-]{1,200}$/.test(value) ? value : undefined;
+const model = value => typeof value === 'string' && /^[A-Za-z0-9_.:/-]{1,120}$/.test(value) ? value : undefined;
+const code = value => typeof value === 'string' && /^[a-z][a-z0-9_]{0,79}$/.test(value) ? value : undefined;
+
+function excerpt(value) {
+  if (typeof value !== 'string') return { text: '', truncated: false };
+  let text = '', count = 0;
+  for (const character of value) {
+    if (count++ === 500) return { text: text.toWellFormed(), truncated: true };
+    text += character;
+  }
+  return { text: text.toWellFormed(), truncated: false };
+}
+
+function normalize(entry) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry) || entry.event !== 'decision') return;
+  const requestId = identifier(entry.request_id);
+  const selectedModel = model(entry.selected_model);
+  const requestedModel = model(entry.requested_model);
+  if (!requestId || !selectedModel || !requestedModel) return;
+  const anonymous = entry.session_id === undefined || entry.session_id === null || entry.session_id === '';
+  const sessionId = anonymous ? undefined : identifier(entry.session_id);
+  // An invalid explicit identity must not mix records into an anonymous file.
+  if (!anonymous && !sessionId) return;
+  const requestClass = code(entry.request_class);
+  const foreground = entry.request_class === undefined || entry.request_class === null || entry.request_class === '' || entry.request_class === 'main';
+  const prompt = foreground ? excerpt(entry.prompt_excerpt) : { text: '', truncated: false };
+  const timestamp = typeof entry.timestamp === 'string' && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(entry.timestamp)
+    && Number.isFinite(Date.parse(entry.timestamp)) ? entry.timestamp : new Date().toISOString();
+  const row = { schema_version: 1, event: 'decision', timestamp, request_id: requestId,
+    ...(sessionId ? { session_id: sessionId } : {}),
+    prompt_excerpt: prompt.text, prompt_truncated: prompt.truncated || (foreground && entry.prompt_truncated === true),
+    requested_model: requestedModel, selected_model: selectedModel };
+  for (const field of ['agent_id', 'prompt_id']) {
+    const value = identifier(entry[field]);
+    if (value) row[field] = value;
+  }
+  if (requestClass) row.request_class = requestClass;
+  if (typeof entry.decision_latency_ms === 'number' && Number.isFinite(entry.decision_latency_ms)
+    && entry.decision_latency_ms >= 0) row.decision_latency_ms = entry.decision_latency_ms;
+  if (SOURCES.has(entry.source)) row.source = entry.source;
+  const reason = code(entry.reason);
+  if (reason) row.reason = reason;
+  if (['jev', 'ollama'].includes(entry.evaluator)) row.evaluator = entry.evaluator;
+  if (['haiku', 'sonnet', 'opus'].includes(entry.classified_tier)) row.classified_tier = entry.classified_tier;
+  if (ERRORS.has(entry.classifier_error)) row.classifier_error = entry.classifier_error;
+  return { sessionKey: sessionId ? `session:${sessionId}` : 'anonymous', row };
+}
+
+// Inference never waits on this writer. Each launch creates new files; only
+// accepted, bounded JSON lines are retained until the serialized writer drains.
+export async function createSessionLog(directory, { warn = () => {} } = {}) {
+  let accepting = true, failed = false, warned = false, pendingBytes = 0;
+  let root, directoryIdentity, pump, closePromise;
+  const sessions = new Map(), queue = [];
+  const launch = `${new Date().toISOString().replace(/[-:.]/g, '')}-${randomBytes(12).toString('hex')}`;
+  const disable = () => {
+    accepting = false;
+    if (warned) return;
+    warned = true;
+    try { Promise.resolve(warn(WARNING)).catch(() => {}); } catch {}
+  };
+  async function checkDirectory() {
+    const current = await fs.lstat(root);
+    if (!current.isDirectory() || current.isSymbolicLink()
+      || (directoryIdentity && (current.dev !== directoryIdentity.dev || current.ino !== directoryIdentity.ino))) {
+      throw new Error('Invalid session log directory');
+    }
+    return current;
+  }
+  try {
+    if (typeof directory !== 'string' || !directory.trim() || typeof constants.O_NOFOLLOW !== 'number') throw new Error('Invalid session log directory');
+    root = resolve(directory);
+    try { await checkDirectory(); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    await fs.mkdir(root, { recursive: true, mode: 0o700 });
+    directoryIdentity = await checkDirectory();
+  } catch { failed = true; disable(); }
+
+  async function handleFor(session) {
+    if (session.handle) return session.handle;
+    await checkDirectory();
+    const handle = await fs.open(session.path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    // Track immediately, including when a subsequent check fails, so shutdown
+    // always closes the descriptor. Never reopen or follow an existing path.
+    session.handle = handle;
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.nlink !== 1) throw new Error('Invalid session log file');
+    await handle.chmod(0o600);
+    await checkDirectory();
+    return handle;
+  }
+  async function drain() {
+    let index = 0;
+    try {
+      while (index < queue.length && !failed) {
+        const item = queue[index];
+        queue[index++] = undefined;
+        const handle = await handleFor(item.session);
+        await handle.writeFile(item.line);
+        pendingBytes -= item.bytes;
+        // A steady producer can keep the queue nonempty indefinitely. Bound
+        // processed slots as well as the pending strings they once held.
+        if (index >= 256) { queue.splice(0, index); index = 0; }
+      }
+    } catch {
+      failed = true;
+      disable();
+    } finally {
+      queue.length = 0;
+      pendingBytes = 0;
+    }
+  }
+  function schedule() {
+    if (pump || failed || !queue.length) return;
+    pump = Promise.resolve().then(drain).finally(() => {
+      pump = undefined;
+      // A record can arrive between drain resolving and this continuation.
+      // Keep it scheduled even if shutdown has already stopped new records.
+      schedule();
+    });
+  }
+  function record(entry) {
+    if (!accepting) return false;
+    try {
+      const normalized = normalize(entry);
+      if (!normalized) return false;
+      const line = `${JSON.stringify(normalized.row)}\n`;
+      const bytes = Buffer.byteLength(line);
+      let session = sessions.get(normalized.sessionKey);
+      if (pendingBytes + bytes > MAX_PENDING_BYTES || (!session && sessions.size >= MAX_SESSIONS)) {
+        disable();
+        return false;
+      }
+      if (!session) {
+        const sessionHash = createHash('sha256').update(normalized.sessionKey).digest('hex');
+        session = { path: join(root, `autorouter-session-${launch}-${sessionHash}.jsonl`) };
+        sessions.set(normalized.sessionKey, session);
+      }
+      queue.push({ session, line, bytes });
+      pendingBytes += bytes;
+      schedule();
+      return true;
+    } catch { return false; }
+  }
+  function close() {
+    if (!closePromise) {
+      accepting = false;
+      closePromise = (async () => {
+        while (pump) await pump;
+        for (const session of sessions.values()) {
+          if (!session.handle) continue;
+          try { await session.handle.close(); } catch { disable(); }
+          session.handle = undefined;
+        }
+      })().catch(() => { disable(); });
+    }
+    return closePromise;
+  }
+  return { record, close };
+}

package/src/status-state.mjs

@@ -102,7 +102,7 @@ export function createStatusState(options = {}) {
       switch (event.event) {
         case 'route': {
           const fields = { requested_model: modelName(event.requested_model), selected_model: modelName(event.model),
-            source: ['jev', 'ollama', 'cache', 'fallback'].includes(event.source) ? event.source : undefined,
+            source: ['jev', 'ollama', 'cache', 'fallback', 'passthrough'].includes(event.source) ? event.source : undefined,
             evaluator: ['jev', 'ollama'].includes(event.evaluator) ? event.evaluator : undefined,
             reason: code(event.reason), latency_ms: latency(event.latency_ms),
             classified_tier: ['haiku', 'sonnet', 'opus'].includes(event.classified_tier) ? event.classified_tier : undefined,

package/src/statusline.mjs

@@ -6,6 +6,7 @@ const REASONS = {
   model_specific_features: 'model features', large_or_multimodal_request: 'large request',
   context_capacity: 'large context',
   internal_request: 'internal request', unknown_model: 'custom model', low_confidence: 'low confidence',
+  auto_mode_floor: 'Auto mode floor', auto_mode_safeguards: 'Auto safety',
 };
 const CLASSIFIER_ERRORS = {
   timeout: 'timeout', http_error: 'HTTP error', invalid_response: 'invalid response', network_error: 'network error',
@@ -128,14 +129,14 @@ export function renderStatusLine(input, snapshot, { now = Date.now(), color = tr
     ? `error ${state.status}` : errorType ? `error ${errorType}` : 'error';
 
   const details = [];
-  const source = ['jev', 'ollama', 'cache', 'fallback'].includes(state?.source) ? state.source : undefined;
+  const source = ['jev', 'ollama', 'cache', 'fallback', 'passthrough'].includes(state?.source) ? state.source : undefined;
   const evaluator = ['jev', 'ollama'].includes(state?.evaluator) ? state.evaluator : undefined;
   const evaluatorLabel = evaluator === 'ollama' ? 'Ollama' : evaluator === 'jev' ? 'Jev' : '';
   let fallbackCause = '';
   let fallbackPhase = '';
   let compactFallback = false;
   if (source) {
-    const sourceLabel = source === 'jev' ? 'Jev' : source === 'ollama' ? 'Ollama'
+    const sourceLabel = source === 'passthrough' ? 'pass-through' : source === 'jev' ? 'Jev' : source === 'ollama' ? 'Ollama'
       : evaluatorLabel ? `${evaluatorLabel} ${source}` : source;
     const timing = Number.isFinite(state.latency_ms) && state.latency_ms >= 0 ? ` ${Math.round(Math.min(state.latency_ms, 999999))}ms` : '';
     const classified = ['haiku', 'sonnet', 'opus'].includes(state.classified_tier) ? state.classified_tier : undefined;

package/src/user-config.mjs

@@ -13,7 +13,8 @@ const CONFIG_KEYS = new Set([
   'AUTOROUTER_HAIKU_MODEL', 'AUTOROUTER_SONNET_MODEL', 'AUTOROUTER_OPUS_MODEL',
   'AUTOROUTER_PORT', 'AUTOROUTER_JEV_TIMEOUT_MS', 'AUTOROUTER_TOKEN_COUNT_TIMEOUT_MS',
   'AUTOROUTER_MIN_CONFIDENCE', 'AUTOROUTER_STATUSLINE', 'AUTOROUTER_DEBUG',
-  'ENABLE_TOOL_SEARCH',
+  'AUTOROUTER_SESSION_LOG_DIR',
+  'ENABLE_TOOL_SEARCH', 'CLAUDE_CODE_STOP_HOOK_BLOCK_CAP',
   'AUTOROUTER_EVALUATOR', 'AUTOROUTER_OLLAMA_URL', 'AUTOROUTER_OLLAMA_MODEL',
   'AUTOROUTER_OLLAMA_TIMEOUT_MS', 'AUTOROUTER_OLLAMA_KEEP_ALIVE',
 ]);