claude-autorouter 0.3.6 → 0.3.7

package/.env.example

@@ -6,7 +6,8 @@ AUTOROUTER_EVALUATOR=jev
 # The launcher enables the router status line for this session. Set 0 to keep your own.
 AUTOROUTER_STATUSLINE=1
 # Claude's Auto permission mode needs a supported Sonnet or Opus client.
-# This profile defaults to Sonnet and excludes Haiku from task routing.
+# This profile switches between Sonnet 5.5 and Opus 5.5 on new human tasks.
+# Haiku decisions become Sonnet; tool continuations keep the selected model.
 # AutoRouter also selects it for: claude-autorouter claude --permission-mode auto
 # AUTOROUTER_CLIENT_PROFILE=auto
 # Optional metadata logs on stderr. Redirect stderr to a file when using the UI.
@@ -24,10 +25,12 @@ TYPESAFE_API_KEY=
 # For API billing instead, set AUTOROUTER_AUTH_MODE=api-key and fill this in.
 # ANTHROPIC_API_KEY=
 
-# Model IDs are configurable independently of the tier policy.
-AUTOROUTER_HAIKU_MODEL=claude-haiku-4-5-20251001
-AUTOROUTER_SONNET_MODEL=claude-sonnet-5
-AUTOROUTER_OPUS_MODEL=claude-opus-5-5
+# Optional overrides; leaving these unset uses each profile's defaults.
+# Auto defaults to Sonnet 5.5; compatible/native default to Sonnet 5.
+# An explicit Sonnet override also applies in Auto mode.
+# AUTOROUTER_HAIKU_MODEL=claude-haiku-4-5-20251001
+# AUTOROUTER_SONNET_MODEL=claude-sonnet-5-5
+# AUTOROUTER_OPUS_MODEL=claude-opus-5-5
 AUTOROUTER_JEV_MODEL=jev-latest
 AUTOROUTER_JEV_TIMEOUT_MS=1500
 # Only suspicious context sizes need counting; this overlaps the evaluator.

package/README.md

@@ -1,6 +1,6 @@
 # Claude AutoRouter
 
-Use Haiku, Sonnet, and Opus in one Claude Code session. A local gateway classifies coding requests with the selected evaluator, applies compatibility and context checks, and streams the selected model's response back to Claude Code. Claude's internal classifiers and server safety-review requests pass through unchanged. [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is the default; an experimental Ollama backend evaluates requests locally.
+Use Haiku, Sonnet, and Opus in one Claude Code session. A local gateway classifies coding requests with the selected evaluator, applies compatibility and context checks, and streams the selected model's response back to Claude Code. Claude's internal permission classifiers retain their selected model; execution requests keep their server safety-review settings and verdicts when routed. [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is the default; an experimental Ollama backend evaluates requests locally.
 
 Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The default evaluator also requires a [TypeSafe API key](https://console.typesafe.ai). There are no runtime package dependencies. Native Windows is not supported in this release.
 
@@ -35,13 +35,13 @@ claude-autorouter --version
 
 For API billing, use `claude-autorouter setup --auth-mode api-key`. Use `--force` to replace an existing config. Automation can supply `TYPESAFE_API_KEY` and, in API-key mode, `ANTHROPIC_API_KEY` through the environment; keys are never command-line arguments. `doctor` checks local configuration and Claude installation/login state without paid requests. See the [configuration reference](docs/reference.md#configuration).
 
-To use Claude's Auto permission mode (AutoRouter 0.3.6+):
+To use automatic Sonnet/Opus routing with Claude's Auto permission mode (AutoRouter 0.3.7+):
 
 ```sh
 claude-autorouter claude --permission-mode auto
 ```
 
-This selects the Auto-compatible profile: a Sonnet starting model, native thinking, and Sonnet/Opus task routing. Haiku does not support Auto mode. Claude's own permission classifiers and requests carrying server safety-review settings pass through with their selected model unchanged. Organization policies still apply. Use `AUTOROUTER_CLIENT_PROFILE=auto` for sessions where you select Auto in Claude's UI or saved settings. [Auto-mode support and limitations](docs/reference.md#auto-permission-mode).
+This selects the Auto profile, defaulting to Sonnet 5.5 and Opus 5.5. The evaluator can choose again for each new human task, while a task's tool calls and goal continuations retain its selected model. A Haiku verdict uses Sonnet. Native safety review stays enabled; organization policies still apply. Use `AUTOROUTER_CLIENT_PROFILE=auto` for sessions where you select Auto in Claude's UI or saved settings. Version 0.3.6 enabled Auto permissions but passed server-reviewed execution through without routing; version 0.3.7 removes that restriction for compatible requests. [Auto-mode support and limitations](docs/reference.md#auto-permission-mode).
 
 ## What you see
 

package/bin/autorouter.mjs

@@ -52,6 +52,7 @@ Without setup, AUTOROUTER_AUTH_MODE defaults to api-key and also requires ANTHRO
 AUTOROUTER_CLIENT_PROFILE=compatible (default) enables all three routing tiers.
 Use AUTOROUTER_CLIENT_PROFILE=native to retain Claude Code's own model/thinking settings.
 Use AUTOROUTER_CLIENT_PROFILE=auto for Auto permission mode: Sonnet/Opus routing, native thinking.
+Auto defaults to Sonnet 5.5 and Opus 5.5, switching on new human tasks and retaining tool turns.
 An explicit claude --permission-mode auto selects the auto profile for that launch.
 Claude's permission checks and organization policies still apply; Haiku does not support Auto mode.
 Optional CLAUDE_CODE_STOP_HOOK_BLOCK_CAP=N limits consecutive tool-free Stop-hook continuations.

package/docs/development.md

@@ -12,6 +12,8 @@ npm run test:package
 
 The test suite uses local mocks and fake credentials. It covers Jev and Ollama routing, bounded prompt extraction, confidence and timeout fallback, token checks, model continuity, authentication forwarding, streaming, cancellation, status state, savings, and launcher behavior. Tests that start HTTP services require loopback binding. Local tests make no paid provider calls or model downloads.
 
+Auto-mode regressions exercise Sonnet → Opus → Opus tool continuation → Sonnet in one conversation, with and without gateway prompt IDs. They retain signed thinking, native context edits, mid-conversation system messages, safety-review settings, and streamed verdicts, including denied actions. Separate capability tests keep unknown review contracts and incompatible model features from being routed.
+
 Package validation checks the distributable and installed command rather than relying on the source checkout's paths. Review the [release procedure](releasing.md) before distributing a tarball.
 
 ## Run from source

package/docs/reference.md

@@ -52,7 +52,7 @@ For an environment-only subscription launch, set `AUTOROUTER_AUTH_MODE=subscript
 | `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` | unset; Claude currently uses `8` | Optional cap on consecutive Stop/SubagentStop continuations without tool use; `0` disables the cap |
 | `ENABLE_TOOL_SEARCH` | `true` in launcher when unset | Load MCP tool definitions on demand; explicit values are preserved |
 | `AUTOROUTER_HAIKU_MODEL` | `claude-haiku-4-5-20251001` | Routine tier |
-| `AUTOROUTER_SONNET_MODEL` | `claude-sonnet-5` | Standard tier |
+| `AUTOROUTER_SONNET_MODEL` | `claude-sonnet-5`; `claude-sonnet-5-5` in the `auto` profile | Standard tier |
 | `AUTOROUTER_OPUS_MODEL` | `claude-opus-5-5` | Demanding tier and savings baseline |
 | `AUTOROUTER_JEV_MODEL` | `jev-latest` | Classifier version |
 | `AUTOROUTER_JEV_TIMEOUT_MS` | `1500` | Classifier deadline in milliseconds |
@@ -173,13 +173,13 @@ The following policy applies after classification:
 - Jev confidence below 0.75 prevents a downgrade below Sonnet or the requested tier. Ollama returns a tier without calibrated confidence; its failure handling and compatibility guards still apply.
 - Tool continuations retain the model chosen at the start of the human turn. Session, agent, and prompt headers identify turns; normalized conversation content provides a fallback. Text feedback from a Stop hook also retains the model when it serves the same gateway prompt ID and the client has not changed its requested model, subject to capability and context checks. Moving prompt-cache markers does not create a new turn.
 - Claude's local `/goal` command can omit the prompt-ID header. For that path, an exact feedback label matching a preceding expanded `/goal` command keeps the original task and conversation anchor. This narrow text fallback also recognizes Claude's repeated-goal truncation format; arbitrary hook text is not treated as a goal. Feedback remains in the evaluator's recent conversation and the full API request. A new human message becomes the current task normally. The status line shows `prompt pinned` or `goal pinned` when either text-continuation rule applies.
-- Thinking history, fixed-budget thinking, server tools, context management, and other recognized model-specific features preserve the current model. Adaptive thinking, effort, and output above 64K prevent a Haiku choice. Fields are never stripped to force a downgrade.
-- Mid-conversation `system` messages preserve the requested model and pass through unchanged. They do not count as a tool continuation by themselves.
-- Auxiliary requests, including Claude's Auto permission classifier, pass through on their requested model without Jev/Ollama evaluation, token checks, or turn-state changes. Compaction retains its existing model and context-capacity policy. Requests containing `safeguards` also pass through unchanged so the server's safety-review contract is preserved. Token counting and model discovery pass through without classification.
+- Thinking history, fixed-budget thinking, server tools, context management, and other recognized model-specific features preserve the current model except for the verified shared capabilities of the modern Auto-mode Sonnet/Opus pair described below. Adaptive thinking, effort, and output above 64K prevent a Haiku choice. Fields are never stripped to force a downgrade.
+- Mid-conversation `system` messages preserve the requested model unless both Auto-mode models support them; they always pass through unchanged. They do not count as a tool continuation by themselves.
+- Auxiliary requests, including Claude's Auto permission classifier, pass through on their requested model without Jev/Ollama evaluation, token checks, or turn-state changes. Compaction retains its existing model and context-capacity policy. Recognized server-reviewed execution requests can route between compatible Sonnet/Opus models while retaining `safeguards` and all verdicts unchanged. Unknown safeguards contracts pass through. Token counting and model discovery pass through without classification.
 
 The default `compatible` profile starts Claude with Haiku-compatible requests and client-requested thinking disabled. AutoRouter uses adaptive thinking when upgrading these requests to Opus 5/5.5. Starting with 0.3.3, routing to exact `claude-sonnet-5-5` translates disabled thinking to `between_tools`, which skips up-front thinking but permits progress updates between tool calls. At `xhigh`/`max` effort, or when per-message effort differs from the top-level setting (default `high`), it uses adaptive thinking while preserving the effort settings. Token counting uses the same adaptation. Sonnet 5 still accepts disabled thinking and is unchanged. See [Sonnet 5.5 thinking requirements](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide).
 
-Explicit native `between_tools` and unknown thinking modes retain the incoming model on new human turns. Signed thinking blocks pass through unchanged and existing tool turns retain their model pin. `AUTOROUTER_CLIENT_PROFILE=native` preserves normal client settings, which can constrain routing. An explicit Claude `--model` argument overrides the starting model, but `/model` and `--model` are requested models, not locks on the routed result. Native same-model requests and unknown model aliases are not rewritten; clients must use settings supported by that model.
+Explicit native `between_tools` and unknown thinking modes retain the incoming model on new human turns outside Auto routing. In Auto routing, a known Sonnet 5.5 `between_tools` request can upgrade to Opus with adaptive thinking. Signed thinking blocks pass through unchanged and existing tool turns retain their model pin. `AUTOROUTER_CLIENT_PROFILE=native` preserves normal client settings, which can constrain routing. An explicit Claude `--model` argument overrides the starting model, but `/model` and `--model` are requested models, not locks on the routed result. Native same-model requests and unknown model aliases are not rewritten; clients must use settings supported by that model.
 
 The launcher enables `ENABLE_TOOL_SEARCH=true` when unset. Claude can otherwise disable on-demand MCP discovery when using a custom API address, loading connected-tool schemas into even a fresh conversation. Explicit values, including `false` or `auto:5`, are preserved. Managed settings and always-loaded tools can still affect deferral. See [Claude Code tool search](https://code.claude.com/docs/en/mcp#configure-tool-search).
 
@@ -187,7 +187,7 @@ The launcher enables `ENABLE_TOOL_SEARCH=true` when unset. Claude can otherwise
 
 The default `compatible` profile starts Claude as Haiku to permit three-tier routing. Claude's Auto permission mode does not support Haiku, even if AutoRouter routes an API request to Sonnet. Eligibility is based on Claude's selected client model. Gateways themselves are supported. See [Claude's Auto-mode requirements](https://code.claude.com/docs/en/permission-modes#eliminate-permission-prompts-with-auto-mode).
 
-AutoRouter 0.3.6 adds an `auto` client profile. Launch with:
+AutoRouter 0.3.6 introduced an `auto` client profile but bypassed evaluation for server-reviewed execution. Version 0.3.7 adds automatic switching on those requests. Launch with:
 
 ```sh
 claude-autorouter claude --permission-mode auto
@@ -199,11 +199,15 @@ An explicit `--permission-mode auto` (or `--permission-mode=auto`) selects the p
 env AUTOROUTER_CLIENT_PROFILE=auto claude-autorouter claude
 ```
 
-The profile defaults the client to the configured Sonnet model and preserves native thinking and explicit model choices. It promotes a routine Haiku routing decision to Sonnet, while other model-feature and conversation-continuity guards still apply. Configured Sonnet/Opus targets must be known Auto-capable models. An explicit client `--model` or `ANTHROPIC_MODEL` can still make Auto unavailable if it selects Haiku or another unsupported model; choose a supported Sonnet or Opus instead.
+The profile defaults to Sonnet 5.5 and Opus 5.5, preserving explicit configured model IDs. The evaluator chooses Sonnet or Opus for each new human task; a routine Haiku verdict uses Sonnet and shows `Auto mode floor`. Tool and `/goal` continuations stay on the selected execution model. Claude's initial client model remains separate from the routed model. An explicit client `--model` or `ANTHROPIC_MODEL` can still make Auto unavailable if it selects Haiku or another unsupported model; choose a supported Sonnet or Opus instead.
 
 Claude remains responsible for enabling the permission mode and enforcing organization settings, account availability, and tool rules. The profile does not enable Auto by itself or override `disableAutoMode`. AutoRouter does not reproduce Claude's settings precedence to infer a mode from settings files. For new saved configurations, `setup --client-profile auto` persists the profile; for an existing config, change only `AUTOROUTER_CLIENT_PROFILE` to `"auto"` to retain your other settings. `setup --force` replaces the config.
 
-**Routing limits:** Claude's permission-classifier requests retain their exact requested model and skip AutoRouter's evaluator. Requests with server-side `safeguards` also retain their model and full body, and safety verdicts stream back unchanged. The status line shows `pass-through · Auto safety` for these requests. Recent Claude versions normally request server-side review through gateways, so Auto-mode sessions can stay on their client-selected model rather than switching between Sonnet and Opus. Ordinary routable requests use the Sonnet/Opus floor, shown as `Auto mode floor` when it changes a Haiku choice. AutoRouter does not disable server review to enable routing. See [server-side classifier review](https://code.claude.com/docs/en/permission-modes#server-side-classifier-review).
+**Safety review:** Claude's permission-classifier requests retain their exact requested model and skip AutoRouter's evaluator. Ordinary execution requests with the known `dangerous_tool_use` version-1 review contract are evaluated and routed, retaining the complete `safeguards` object, beta headers, and streamed safety verdicts. This also detects server review when Auto was selected in Claude's UI rather than through the launch flag. Unknown or malformed review contracts and safeguarded compaction pass through with `Auto safety`; a target that cannot accept the request shows `Auto model guard`. AutoRouter never turns off server review or converts denied actions to approvals. See [server-side classifier review](https://code.claude.com/docs/en/permission-modes#server-side-classifier-review).
+
+**Shared execution capabilities:** automatic Auto routing supports exact Sonnet 5/5.5 and Opus 5/5.5 IDs. The default 5.5 pair shares a native 1M context window, adaptive thinking, native context-editing strategies, and mid-conversation system updates. These fields and existing signed thinking no longer pin every future human task. Sonnet 5 cannot accept mid-conversation system messages, per-message effort, or task budgets; use Sonnet 5.5 for those sessions. Unknown context-editing strategies, specialized server tools, fixed thinking budgets, fast mode, older/custom targets, and other incompatible requests still retain a compatible model. A Sonnet 5.5 `between_tools` request uses adaptive thinking when upgraded to Opus; effort and conversation history remain unchanged.
+
+Thinking blocks stay verbatim in the conversation. Anthropic may drop blocks the selected model cannot read, so switching models does not preserve access to every model's private reasoning on every turn. User text, tool results, and prior answers remain available. Returning to a model can make its preserved thinking readable again. Model changes can also miss the prior model's prompt cache. See [preserved thinking and model switching](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking).
 
 ### Context capacity
 

package/docs/releasing.md

@@ -14,6 +14,8 @@ Version `0.3.5` adds opt-in saved configuration for Claude's native `CLAUDE_CODE
 
 Version `0.3.6` fixes Auto permission-mode launches with an Auto-compatible Sonnet/Opus profile while preserving Claude's permission classifiers and server safety-review requests. It also adds optional per-session JSONL decision logs containing a bounded human prompt excerpt, selected model, and routing latency. Logging is disabled by default; set `AUTOROUTER_SESSION_LOG_DIR` or use `setup --session-log-dir DIR` to enable it. See [Auto permission mode](reference.md#auto-permission-mode) and [session decision logs](reference.md#session-decision-logs).
 
+Version `0.3.7` enables automatic Sonnet/Opus switching for compatible Auto-mode execution requests, including requests carrying the known server safety-review contract. The Auto profile defaults to Sonnet 5.5 and Opus 5.5, floors Haiku decisions to Sonnet, and retains the selected model through tool and goal continuations. Shared native context edits, mid-conversation system messages, and signed thinking history no longer pin new human tasks. Permission-classifier requests and safety verdicts remain unchanged; unknown contracts and incompatible model features still preserve a compatible model. Explicit model overrides remain in effect. See [Auto permission mode](reference.md#auto-permission-mode).
+
 The GitHub repository is private. Publishing to npm makes the tarball's runtime source, README, configuration example, license, and shipped documentation public. Model weights, user configuration, credentials, transcripts, session logs, local artifacts, and test fixtures are excluded. Review the archive before the first publication and whenever the package allowlist changes.
 
 ## What runs automatically

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-autorouter",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "license": "Apache-2.0",
   "type": "module",
   "description": "A Claude Code model router with Jev and local Ollama System One evaluators",

package/src/auto-routing.mjs

@@ -0,0 +1,54 @@
+// Shared execution capabilities, not a replacement for Claude's permission
+// classifier. Keep the complete safeguards contract and signed history on wire.
+const MODELS = new Set(['claude-sonnet-5', 'claude-sonnet-5-5', 'claude-opus-5', 'claude-opus-5-5']);
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const SHARED_TOOLS = new Set(['custom', 'tool_search_tool_regex_20251119', 'tool_search_tool_bm25_20251119',
+  'bash_20250124', 'text_editor_20250728']);
+const CONTEXT_EDITS = new Set(['clear_thinking_20251015', 'clear_tool_uses_20250919']);
+const sharedTool = tool => object(tool) && (tool.type === undefined || SHARED_TOOLS.has(tool.type));
+
+export function hasRoutableSafeguards(body) {
+  return MODELS.has(body.model) && Array.isArray(body.safeguards) && body.safeguards.length > 0
+    && body.safeguards.every(entry => object(entry) && entry.type === 'dangerous_tool_use'
+      && object(entry.classifier_context) && entry.classifier_context.v === 1);
+}
+
+export function canRouteAutoRequest(body, target) {
+  if (!MODELS.has(body.model) || !MODELS.has(target)) return false;
+  if (body.safeguards !== undefined && !hasRoutableSafeguards(body)) return false;
+  if (body.max_tokens !== undefined && (!Number.isSafeInteger(body.max_tokens) || body.max_tokens < 1 || body.max_tokens > 128000)) return false;
+  // Retain model-specific execution facilities whose contracts differ between
+  // models. Ordinary Claude Code tools and native context editing are shared.
+  if (body.speed !== undefined && body.speed !== 'standard') return false;
+  if (body.container !== undefined || body.mcp_servers !== undefined || body.compaction !== undefined) return false;
+  if (body.tools !== undefined && (!Array.isArray(body.tools) || !body.tools.every(sharedTool))) return false;
+  for (const message of body.messages) {
+    if (message.role !== 'system' || !Array.isArray(message.content)) continue;
+    for (const block of message.content) {
+      if (!['tool_addition', 'tool_removal'].includes(block.type)) continue;
+      const tool = block.tool;
+      if (!object(tool) || (tool.type !== 'tool_reference'
+        && !(block.type === 'tool_addition' && tool.type === 'tool_definition' && sharedTool(tool.definition)))) return false;
+    }
+  }
+  if (body.tool_choice !== undefined && (!object(body.tool_choice) || !['auto', 'none'].includes(body.tool_choice.type))) return false;
+  if (body.context_management !== undefined) {
+    const context = body.context_management;
+    if (!object(context) || Object.keys(context).some(key => key !== 'edits') || !Array.isArray(context.edits)
+      || context.edits.some(edit => !object(edit) || !CONTEXT_EDITS.has(edit.type))) return false;
+  }
+  if (body.thinking !== undefined) {
+    const thinking = body.thinking;
+    if (!object(thinking) || !['adaptive', 'disabled', 'between_tools'].includes(thinking.type)) return false;
+    // between_tools is Sonnet 5.5-specific. A routed Opus request uses
+    // adaptive thinking; prepareRequest makes that explicit without touching
+    // any prior thinking blocks or the conversation prefix they sign.
+    if (thinking.type === 'between_tools' && (body.model !== 'claude-sonnet-5-5'
+      || Object.keys(thinking).some(key => key !== 'type') || target === 'claude-sonnet-5')) return false;
+  }
+  // Sonnet 5 lacks mid-conversation system/tool/effort updates. Never flatten
+  // those messages into the top-level prompt: that invalidates signed history.
+  if (target === 'claude-sonnet-5' && (body.output_config?.task_budget !== undefined
+    || body.messages.some(message => message.role === 'system' || message.output_config !== undefined))) return false;
+  return true;
+}

package/src/config.mjs

@@ -69,7 +69,7 @@ export function readConfig(env = process.env) {
   }
   const models = {
     haiku: env.AUTOROUTER_HAIKU_MODEL ?? 'claude-haiku-4-5-20251001',
-    sonnet: env.AUTOROUTER_SONNET_MODEL ?? 'claude-sonnet-5',
+    sonnet: env.AUTOROUTER_SONNET_MODEL ?? (clientProfile === 'auto' ? 'claude-sonnet-5-5' : 'claude-sonnet-5'),
     opus: env.AUTOROUTER_OPUS_MODEL ?? 'claude-opus-5-5',
   };
   if (clientProfile === 'auto') {

package/src/model-request.mjs

@@ -14,6 +14,11 @@ function sonnetNeedsAdaptive(body) {
 export function prepareRequest(body, model) {
   const request = { ...body, model };
   const adjustments = [];
+  if (model !== body.model && body.model === 'claude-sonnet-5-5' && body.thinking?.type === 'between_tools'
+    && Object.keys(body.thinking).length === 1 && ADAPTIVE_TARGETS.has(model)) {
+    request.thinking = { type: 'adaptive' };
+    adjustments.push('adaptive_thinking_required');
+  }
   if (model !== body.model && body.thinking?.type === 'disabled') {
     if (model === 'claude-sonnet-5-5') {
       const type = sonnetNeedsAdaptive(body) ? 'adaptive' : 'between_tools';

package/src/router.mjs

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { TIERS } from './config.mjs';
 import { buildState, goalFeedbackIndexes } from './prompt-state.mjs';
 import { buildOllamaState, evaluateOllama } from './ollama-evaluator.mjs';
+import { canRouteAutoRequest, hasRoutableSafeguards } from './auto-routing.mjs';
 export { buildState } from './prompt-state.mjs';
 
 const hash = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
@@ -226,10 +227,13 @@ export class Router {
   async route(body, { scope = '', signal, requestClass = '', promptId = '', countTokens } = {}) {
     const start = performance.now();
     const c = this.config;
-    // Claude owns auxiliary permission checks and the server-side safeguards
-    // contract. Never evaluate, adapt, or count these requests: changing
-    // their model can change the safety decision or invalidate its context.
-    if (requestClass === 'auxiliary' || body.safeguards !== undefined) {
+    const autoMode = c.clientProfile === 'auto' || hasRoutableSafeguards(body);
+    // Auxiliary permission classifiers keep their model and verdicts. Main
+    // execution requests can switch between compatible Sonnet/Opus models
+    // while retaining the server review contract verbatim. Unknown contracts
+    // still pass through, including any future safeguards version.
+    if (requestClass === 'auxiliary' || (body.safeguards !== undefined
+      && (!hasRoutableSafeguards(body) || requestClass === 'compaction'))) {
       // A safeguarded main request still produces the next tool turn. Replace
       // any older routing pin with the actual preserved model so a later
       // request that omits safeguards cannot restore that stale model. Side
@@ -263,7 +267,7 @@ export class Router {
     // Check suspicious input in parallel with Jev. Byte size only triggers a
     // check: common tool catalogs can be 200KB yet occupy far less than 200K
     // tokens. Tiny requests keep the one-call fast path.
-    const earlyCount = c.clientProfile !== 'auto' && !capacityLocked && countTokens && CAPACITY_UPGRADE_MODELS.has(c.models.haiku)
+    const earlyCount = !autoMode && !capacityLocked && countTokens && CAPACITY_UPGRADE_MODELS.has(c.models.haiku)
       && (contextSizeBytes(body, c.models.haiku) > 150000 || hasAttachments)
       ? safelyCount(c.models.haiku) : undefined;
     const decision = await this.classify(body, signal);
@@ -272,7 +276,7 @@ export class Router {
     // Auto permission mode requires a supported execution model. Retain the
     // evaluator's verdict for observability; stronger compatibility and turn
     // constraints below still decide whether this ordinary choice can apply.
-    if (c.clientProfile === 'auto' && decision.tier === 'haiku') {
+    if (autoMode && decision.tier === 'haiku') {
       model = c.models.sonnet;
       reason = 'auto_mode_floor';
     }
@@ -282,6 +286,9 @@ export class Router {
     let previous = turnPin?.model;
     const textTurn = !turn.continuation || turn.goalFeedback;
     const textPin = promptPin ?? (!promptId && turn.goalFeedback ? turnPin : undefined);
+    const pinnedTarget = (turn.continuation || (textTurn && textPin?.requestedModel === body.model))
+      ? previous : undefined;
+    const sharedAutoRequest = autoMode && canRouteAutoRequest(body, pinnedTarget ?? model);
     // A new human prompt can still carry signed thinking from the preceding
     // turn. Recover that turn's actual routed model when it is known.
     if (!turn.continuation && body.messages.length > 1 && !previous) {
@@ -300,19 +307,20 @@ export class Router {
     // Mid-conversation system messages are only supported by certain models.
     // Keep the client's capable model and all message fields (including
     // clear_at, tool changes, and output_config) instead of down-routing.
-    else if (hasSystemMessage) preserve(body.model, 'mid_conversation_system');
+    else if (hasSystemMessage && !sharedAutoRequest) preserve(body.model, 'mid_conversation_system');
     else if (unknownModel) preserve(body.model, 'unknown_model');
     // A new native request can explicitly select a model-specific thinking
     // mode, including between_tools. An earlier turn's model is not evidence
     // that it accepts that mode. Existing tool turns retain their pin below.
-    else if (modelSpecificThinking && body.thinking.type !== 'enabled' && textTurn) preserve(body.model, 'model_specific_features');
+    else if (modelSpecificThinking && body.thinking.type !== 'enabled' && textTurn && !sharedAutoRequest) preserve(body.model, 'model_specific_features');
     // Stop hooks (including /goal) return feedback as user-role text, even
     // though it still serves the same human prompt. Trust the scoped gateway
     // identity instead of treating that text as a new task. A client model
     // change can be an explicit fallback after a failure; do not undo it.
     // Local /goal commands can omit the gateway prompt ID. Exact feedback for
     // a known goal then uses the original conversation anchor as a fallback.
-    else if (textTurn && textPin?.requestedModel === body.model && !modelSpecificFeatures) {
+    else if (textTurn && textPin?.requestedModel === body.model && (!modelSpecificFeatures
+      || (autoMode && canRouteAutoRequest(body, textPin.model)))) {
       const needsSonnet = body.thinking?.type === 'adaptive' || body.output_config?.effort || body.max_tokens > 64000;
       if (needsSonnet && (textPin.model === c.models.haiku || rank(textPin.model) === 0)) {
         preserve(c.models.sonnet, 'requires_sonnet_capabilities');
@@ -322,10 +330,10 @@ export class Router {
     else if (turn.continuation && !turn.goalFeedback) keep(previous ? 'tool_turn_pinned' : 'unknown_continuation');
     // Unknown or model-specific features are preserved, never silently removed.
     else if (decision.source === 'fallback' && rank(body.model) >= 1) keep('classifier_unavailable');
-    else if (modelSpecificFeatures) keep('model_specific_features');
-    else if (thinkingHistory) keep('thinking_history');
+    else if (modelSpecificFeatures && !sharedAutoRequest) keep('model_specific_features');
+    else if (thinkingHistory && !sharedAutoRequest) keep('thinking_history');
     else if (body.thinking?.type === 'adaptive' || body.output_config?.effort || body.max_tokens > 64000) {
-      if (decision.tier === 'haiku') { model = c.models.sonnet; reason = 'requires_sonnet_capabilities'; }
+      if (decision.tier === 'haiku') { model = c.models.sonnet; if (!autoMode) reason = 'requires_sonnet_capabilities'; }
     }
     // Account for all context, including system instructions and loaded tool
     // schemas that are intentionally omitted from Jev's bounded excerpt.
@@ -344,7 +352,10 @@ export class Router {
       const configured = TIERS.findIndex(tier => c.models[tier] === value);
       return configured >= 0 ? configured : rank(value);
     };
-    if (!preserved && largeContext) {
+    // The verified modern Auto pair shares a native 1M input window. A large
+    // prompt is not a reason to pin Opus forever after the task becomes easy.
+    // This does not assert that the prompt fits the upstream context limit.
+    if (!preserved && largeContext && !sharedAutoRequest) {
       const baseline = previous ?? body.model;
       // Prevent a downgrade; a compatible Haiku client must still be able to
       // upgrade a demanding request to a larger-context, stronger model.
@@ -362,6 +373,9 @@ export class Router {
         capacityUpgraded = true;
       }
     }
+    if (autoMode && model !== body.model && !canRouteAutoRequest(body, model)) {
+      preserve(body.model, 'auto_mode_incompatible');
+    }
     const identifiableUpgrade = capacityUpgraded && (turn.index >= 0 || promptId);
     if ((!turn.continuation || previous || identifiableUpgrade || reason === 'mid_conversation_system') && requestClass !== 'compaction') {
       const pin = { model, requestedModel: body.model };

package/src/statusline.mjs

@@ -6,7 +6,7 @@ const REASONS = {
   model_specific_features: 'model features', large_or_multimodal_request: 'large request',
   context_capacity: 'large context',
   internal_request: 'internal request', unknown_model: 'custom model', low_confidence: 'low confidence',
-  auto_mode_floor: 'Auto mode floor', auto_mode_safeguards: 'Auto safety',
+  auto_mode_floor: 'Auto mode floor', auto_mode_safeguards: 'Auto safety', auto_mode_incompatible: 'Auto model guard',
 };
 const CLASSIFIER_ERRORS = {
   timeout: 'timeout', http_error: 'HTTP error', invalid_response: 'invalid response', network_error: 'network error',