claude-autorouter 0.4.0 → 0.5.1

package/.env.example

@@ -1,8 +1,9 @@
 # Copy to .env and load with: node --env-file=.env bin/autorouter.mjs claude
 AUTOROUTER_AUTH_MODE=subscription
 AUTOROUTER_CLIENT_PROFILE=compatible
-# Jev remains the default evaluator. Ollama is experimental; see settings below.
-AUTOROUTER_EVALUATOR=jev
+# Local Ollama is the default evaluator (experimental; see settings below).
+# Set jev to use TypeSafe's hosted evaluator, which needs TYPESAFE_API_KEY.
+AUTOROUTER_EVALUATOR=ollama
 # The launcher enables the router status line for this session. Set 0 to keep your own.
 AUTOROUTER_STATUSLINE=1
 # Claude's Auto permission mode needs a supported Sonnet or Opus client.
@@ -13,10 +14,12 @@ AUTOROUTER_STATUSLINE=1
 # Optional metadata logs on stderr. Redirect stderr to a file when using the UI.
 # AUTOROUTER_DEBUG=1
 # Optional persistent JSONL decisions/outcomes, one file per session per launch.
-# Includes up to 500 characters of user prompt text; keep the directory local.
+# Defaults to metadata only. Set AUTOROUTER_SESSION_LOG_MODE=prompts to include
+# up to 500 characters of user prompt text; keep the directory local.
 # Unset or empty disables logging. This does not print prompts in the terminal.
 # AUTOROUTER_SESSION_LOG_DIR=/absolute/path/to/autorouter-sessions
-# Omit all prompt excerpt fields (does not enable logging by itself).
+# metadata (default) omits prompt excerpt fields; prompts includes them.
+# Setting a mode does not enable logging by itself.
 # AUTOROUTER_SESSION_LOG_MODE=metadata
 # Optional: allow two tool-free Stop-hook continuations, then end the turn on
 # the third block. Applies to /goal and all Stop/SubagentStop hooks.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,9 @@
+# Code of conduct
+
+Be respectful and constructive in issues, pull requests, reviews and other project spaces. Welcome people with different backgrounds and experience levels, focus criticism on ideas and code, and respect requests to stop unwanted interaction.
+
+Harassment, discriminatory or demeaning remarks, sexualized conduct, threats, personal attacks, and publishing someone's private information without consent are not acceptable. The same expectations apply when representing the project outside its repository.
+
+Report concerns privately to maintainer Fabio Rapposelli at [fabio@rapposelli.org](mailto:fabio@rapposelli.org), with the subject `AutoRouter conduct report`. Include relevant links and enough context to investigate; avoid publishing the report or unrelated private information. Reports will be handled with discretion, sharing information only as needed to investigate and respond.
+
+The maintainer may request changes, remove content, issue warnings, or temporarily or permanently restrict participation according to the severity and pattern of behavior. Requests to review a decision can be sent to the same address. This policy is maintained on a best-effort basis and does not promise a response deadline.

package/CONTRIBUTING.md

@@ -1,6 +1,22 @@
 # Contributing to AutoRouter
 
-Use Node.js 22+ and macOS or Linux. Install pinned development tools, then run the local checks:
+Bug reports, documentation improvements, reproducible routing cases and focused fixes are welcome. Read the [support guide](SUPPORT.md) before opening an issue, and use the [private security reporting process](SECURITY.md) for vulnerabilities. Participation follows the [code of conduct](CODE_OF_CONDUCT.md).
+
+For a substantial behavior change, open an issue describing the problem and proposed scope before implementing it. Fabio Rapposelli ([@frapposelli](https://github.com/frapposelli)) maintains the project and reviews design and release decisions. Review is best effort; there is no guaranteed response time.
+
+Coding agents working in a source checkout should follow [AGENTS.md](https://github.com/frapposelli/claude-autorouter/blob/main/AGENTS.md). [CLAUDE.md](https://github.com/frapposelli/claude-autorouter/blob/main/CLAUDE.md) imports the same guidance for Claude Code.
+
+## Submit a change
+
+Fork the repository, clone your fork and create a branch. While the repository is private, this requires access and permission to fork; existing collaborators can use a branch in their authorized checkout.
+
+```sh
+git clone https://github.com/YOUR-USERNAME/claude-autorouter.git
+cd claude-autorouter
+git switch -c describe-your-change
+```
+
+Use Node.js 22+ and macOS or Linux (including WSL). Install pinned development tools, then run the local checks:
 
 ```sh
 npm ci --ignore-scripts --no-audit --no-fund
@@ -11,6 +27,10 @@ npm run test:package
 
 Tests use synthetic local services and credentials. They require loopback binding, but make no paid provider calls, downloads or user-config changes. The package check installs and exercises the exact distributable archive. Opt-in provider/model canaries are described in [development and validation](docs/development.md).
 
+Open a pull request against `main`. Describe the problem, resulting behavior and relevant validation, linking an issue when one exists. Keep the change focused, include meaningful regressions for behavior changes, and update affected help or documentation. Report any checks you could not run. Real provider calls and model downloads are not required for ordinary contributions; label their results separately if deliberately run.
+
+Use synthetic fixtures. Do not commit credentials, personal configuration, private prompts, transcripts or session logs. Metadata-only logs can still contain identifying information; inspect any material before sharing it. Contributions are accepted under the project's [Apache-2.0 license](LICENSE); submit only work you have the right to contribute. No CLA or sign-off workflow is required.
+
 ## Changing behavior
 
 Follow the [request lifecycle](docs/development.md#request-lifecycle-and-model-continuity). Keep authentication and permission decisions owned by Claude. Preserve provider bytes, signed history and unfamiliar extensions. Routing must check compatibility in every profile; new human tasks remain eligible to switch models. Active task state is separate from disposable classification caches, and only clean, successfully forwarded completion evidence can establish confirmed continuation state.

package/README.md

@@ -1,8 +1,10 @@
-# Claude AutoRouter
+# AutoRouter
 
-Use Haiku, Sonnet and Opus in one Claude Code session. AutoRouter evaluates each coding request, checks model compatibility and context capacity, and forwards it through a local gateway. [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is the default evaluator; native Ollama `/v1/systemone` models provide an experimental local option. Claude owns authentication, tool permissions and safety review.
+An independent local model-routing gateway for Claude Code. AutoRouter is not affiliated with, endorsed by, or sponsored by Anthropic. The existing npm package and command remain `claude-autorouter`.
 
-Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The default evaluator also needs a [TypeSafe API key](https://console.typesafe.ai). The installed CLI has no runtime dependencies.
+Use Haiku, Sonnet and Opus in one Claude Code session. AutoRouter evaluates each coding request, checks model compatibility and context capacity, and forwards it through a local gateway. Native Ollama `/v1/systemone` models are the default, experimental local evaluator, so task excerpts stay on your machine; [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is an optional hosted evaluator (`setup --evaluator jev`). Claude owns authentication, tool permissions and safety review.
+
+Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The optional Jev evaluator needs a [TypeSafe API key](https://console.typesafe.ai). The installed CLI has no runtime dependencies.
 
 Version 0.4.0 adds `config`, `sessions` and `doctor --evaluate-local`, durable task continuity, and clearer model outcomes. Upgrade from 0.3.x to use these commands. The [contributor guide](CONTRIBUTING.md) explains local verification, and the [release guide](docs/releasing.md) covers the changes and verified publication.
 
@@ -16,9 +18,11 @@ cd /path/to/project
 claude-autorouter claude
 ```
 
-Setup defaults to your Claude subscription and prompts privately for the Jev key. Run `claude auth login` if needed. Jev has separate credentials and billing; subscription mode needs no Anthropic API key. For API billing, use `setup --auth-mode api-key`.
+Setup defaults to your Claude subscription and the local Ollama evaluator (Ollama 0.35+ with the default model; add `--pull` to download it), so it asks for no evaluator key. To use hosted Jev instead, run `claude-autorouter setup --evaluator jev`, which prompts privately for its key. Run `claude auth login` if needed. Jev has separate credentials and billing; subscription mode needs no Anthropic API key. For API billing, use `setup --auth-mode api-key`.
+
+AutoRouter launches your installed, unmodified official Claude Code executable. Each user supplies their own login or API credentials. Subscription forwarding is a technical integration, not a claim of provider approval; review the [integration boundaries and current provider-policy notes](docs/subscription-integration.md) for your deployment.
 
-Configuration is saved privately at `~/.config/claude-autorouter/config.json`. Environment variables override it; project `.env` files are not loaded automatically. `setup --force` updates an existing configuration while preserving other settings. Use focused commands for later edits:
+Configuration is saved privately at `~/.config/claude-autorouter/config.json`. On macOS, new setups keep keys in the login Keychain; for an existing plaintext configuration, run `claude-autorouter config set AUTOROUTER_SECRET_STORE keychain` to move them. Environment variables override it; project `.env` files are not loaded automatically. `setup --force` updates an existing configuration while preserving other settings. Use focused commands for later edits:
 
 ```sh
 claude-autorouter config show
@@ -64,7 +68,7 @@ Savings are **API-equivalent estimates using the recorded Opus baseline and toke
 
 ## Local Ollama evaluator
 
-Start Ollama 0.35+ with a model supporting its native decision endpoint, then configure it explicitly:
+Ollama is the default evaluator. Start Ollama 0.35+ with a model supporting its native decision endpoint, then choose a model:
 
 ```sh
 claude-autorouter setup --evaluator ollama --ollama-model tev1:4b-q4_K_M --pull --force
@@ -72,7 +76,7 @@ claude-autorouter doctor --evaluate-local
 claude-autorouter claude
 ```
 
-`--pull` authorizes downloading the chosen model if missing. Setup keeps existing models and settings; ordinary launches download nothing. The default local model is `nimble:9b-q4_K_M`; `tev1:0.8b` is smaller and requires checking its accuracy on your tasks. Local classification needs no Jev key. Claude still answers through Anthropic. [Model choices, deadlines and historical measurements](docs/reference.md#ollama-evaluator).
+`--pull` authorizes downloading the chosen model if missing. Setup keeps existing models and settings; ordinary launches download nothing. The default local model is `nimble:9b-q4_K_M`; `tev1:0.8b` is smaller and requires checking its accuracy on your tasks. Local classification needs no Jev key; Jev remains available with `setup --evaluator jev`. Claude still answers through Anthropic. [Model choices, deadlines and historical measurements](docs/reference.md#ollama-evaluator).
 
 To allow a slower local model to finish without AutoRouter's runtime deadline:
 
@@ -94,6 +98,6 @@ claude-autorouter doctor
 
 Historical integration observations cover Claude Code 2.1.284–2.1.285. The versioned synthetic protocol fixtures test reviewed request/response contracts; they do not certify the current checkout against a live Claude version. Real-provider checks remain explicitly invoked. [Troubleshooting](docs/reference.md#troubleshooting) covers context use, blocked goals and logging. Run ordinary `claude` to bypass routing.
 
-The evaluator receives bounded task/history excerpts that may contain code and tool results: TypeSafe for Jev, or your loopback Ollama service. Anthropic receives the complete request. Model switching can reduce cache reuse. [Data flow and authentication](docs/reference.md#data-flow-and-authentication).
+The evaluator receives bounded task/history excerpts that may contain code and tool results: TypeSafe for Jev, or your loopback Ollama service. Recognizable credentials and personal identifiers are redacted from those excerpts first. Anthropic receives the complete request. Model switching can reduce cache reuse. [Data flow and authentication](docs/reference.md#data-flow-and-authentication).
 
-[Reference](docs/reference.md) · [Contributing](CONTRIBUTING.md) · [Development](docs/development.md) · [Releases](docs/releasing.md) · [Apache-2.0](LICENSE)
+[Reference](docs/reference.md) · [Integration and provider policy](docs/subscription-integration.md) · [Contributing](CONTRIBUTING.md) · [Development](docs/development.md) · [Releases](docs/releasing.md) · [Apache-2.0](LICENSE)

package/SECURITY.md

@@ -0,0 +1,25 @@
+# Security policy
+
+## Report privately
+
+Use GitHub's private [Report a vulnerability](https://github.com/frapposelli/claude-autorouter/security/advisories/new) form. Private vulnerability reporting is enabled for this repository. If the form is unavailable, email maintainer Fabio Rapposelli at [fabio@rapposelli.org](mailto:fabio@rapposelli.org) with the subject `AutoRouter security report`.
+
+Do not open a public issue or pull request with exploit details, credentials or sensitive request data. Include the affected AutoRouter and Claude Code versions, operating system, evaluator/client profile, expected security boundary, observed impact and a minimal synthetic reproduction where possible. Do not include real API keys, OAuth tokens, private source code, prompts or transcripts. The maintainer can coordinate any additional evidence privately.
+
+Reports are handled on a best-effort basis; there is no guaranteed response time or bounty program. We will coordinate investigation, remediation and disclosure with the reporter before publishing details.
+
+## Supported versions and scope
+
+Security fixes target the latest stable release. Older releases are not maintained as separate security branches; users may need to upgrade. Reports against `main` are also welcome.
+
+Relevant reports include credential exposure, unauthorized access to the local gateway or saved configuration, unintended disclosure through logs, and routing or request changes that weaken Claude's authentication or permission boundaries. Provider accounts, billing and vulnerabilities in Claude Code, TypeSafe or Ollama should also be reported to the responsible provider when applicable.
+
+## Handling diagnostic data
+
+Organizations can enforce the evaluator, authentication mode, upstream and log mode with a root-owned policy file that environment variables and saved settings cannot override. See [organization policy](docs/reference.md#organization-policy).
+
+AutoRouter's default evaluator is local Ollama, which keeps classification on loopback. The optional hosted Jev evaluator (`--evaluator jev`) receives bounded task/history excerpts, which may contain private code or tool results. Recognizable credentials and personal identifiers are redacted from those excerpts first; this pattern-based filter reduces, but does not eliminate, disclosure. Anthropic still receives the full inference request. See [data flow and authentication](docs/reference.md#data-flow-and-authentication).
+
+New macOS setups keep saved keys in the login Keychain. Existing and non-macOS configurations keep plaintext keys in the private configuration file until you run `claude-autorouter config set AUTOROUTER_SECRET_STORE keychain` (macOS only). See [credential storage](docs/reference.md#credential-storage).
+
+Session logging is optional. Enabling a log directory uses the default `metadata` mode, which omits prompt excerpts. Opting into `AUTOROUTER_SESSION_LOG_MODE=prompts` includes bounded human-task excerpts with recognizable credentials and personal identifiers redacted (pattern-based, so not exhaustive). Inspect even metadata-only output before sharing it; identifiers, paths or environment details can still be sensitive. Saved logs have no automatic deletion policy. See [history and privacy](docs/reference.md#session-decision-logs).

package/SUPPORT.md

@@ -0,0 +1,18 @@
+# Support
+
+AutoRouter is an independent, community-maintained project. It does not provide official support for Anthropic, TypeSafe or Ollama, and has no response-time guarantee.
+
+For setup and usage, start with the [README](README.md) and [troubleshooting reference](docs/reference.md#troubleshooting). Run `claude-autorouter --version`, `claude --version` and `claude-autorouter doctor` to identify the installation and configuration involved. Ordinary `doctor` performs configuration and local service checks; it does not verify paid-provider access.
+
+Use [GitHub issues](https://github.com/frapposelli/claude-autorouter/issues) for reproducible bugs, feature proposals and questions not answered by the documentation. Repository access is required while the repository is private; if you cannot access it, contact [fabio@rapposelli.org](mailto:fabio@rapposelli.org). For vulnerabilities, follow [SECURITY.md](SECURITY.md) instead of opening an issue. Community conduct reports follow the [code of conduct](CODE_OF_CONDUCT.md).
+
+## Make a report useful
+
+- Include AutoRouter, Claude Code, Node.js and operating-system versions; include the Ollama version and model tag for local evaluation.
+- Identify the authentication mode, evaluator and client profile without sharing credentials or full environment/configuration dumps.
+- Describe expected and actual behavior, and provide minimal steps using a synthetic prompt or fixture when possible. Distinguish the selected model from the provider-confirmed serving model.
+- Share only the relevant, inspected diagnostic excerpt. Remove secrets, private prompts, responses, source code, personal paths and organization identifiers. Screenshots can disclose this information too.
+
+Logging is disabled by default. When enabling optional session history for a reproduction, explicitly choose `AUTOROUTER_SESSION_LOG_MODE=metadata`; the default `prompts` mode includes task excerpts. Metadata-only output still needs review before sharing. Debug stderr can also contain Claude's own diagnostics. See [session logs](docs/reference.md#session-decision-logs) and [troubleshooting](docs/reference.md#troubleshooting).
+
+Account access, subscription/model eligibility, billing and provider outages belong with the responsible provider. AutoRouter reports can investigate how the gateway handles those failures, but cannot change a provider's account policies. Local-model accuracy and performance depend on the workload and hardware; include those conditions when reporting unexpected classifications.

package/bin/autorouter.mjs

@@ -7,6 +7,7 @@ import { createRouterServer, listen } from '../src/server.mjs';
 import { buildClaudeEnv, clientProfileForLaunch, conflictingProviders } from '../src/auth.mjs';
 import { dirname } from 'node:path';
 import { createStatusState } from '../src/status-state.mjs';
+import { removeStaleStatusDirectories } from '../src/status-cleanup.mjs';
 import { addStatusLineSettings } from '../src/status-settings.mjs';
 import { createSessionLog } from '../src/session-log.mjs';
 import { loadUserConfig } from '../src/user-config.mjs';
@@ -100,6 +101,7 @@ if (['--version', '-v', 'version'].includes(command)) {
     const statusEnabled = command === 'claude' && runtimeEnv.AUTOROUTER_STATUSLINE !== '0';
     let claudeArgs = args;
     if (statusEnabled) {
+      await removeStaleStatusDirectories();
       status = createStatusState({ baselineModel: config.models.opus });
       await status.ready;
       if (status.path) {

package/docs/reference.md

@@ -1,5 +1,7 @@
 # Reference
 
+AutoRouter is an independent gateway for Claude Code. Its existing `claude-autorouter` package, command, configuration paths, and repository identity remain unchanged. See [integration boundaries and provider policy](subscription-integration.md) for authentication ownership and the distinction between technical operation and provider authorization.
+
 ## Commands
 
 | Command | Purpose |
@@ -29,7 +31,7 @@ The launcher binds an ephemeral port on `127.0.0.1`, creates a temporary local c
 
 ## Configuration
 
-First setup defaults to subscription mode unless `--auth-mode` or `AUTOROUTER_AUTH_MODE` selects another mode. Jev remains the default evaluator; `--evaluator ollama` selects local classification. An existing configuration updated with `--force` keeps its saved choices unless a command-line flag changes them; unrelated environment overrides remain temporary. Setup prompts for required secrets without echoing them and writes a private JSON file. Stored keys are plaintext; keep the file private and out of source control. Supply keys through the environment when interactive input is unavailable. Subscription mode with Ollama requires no API keys. API-key authentication always requires `ANTHROPIC_API_KEY`, regardless of evaluator.
+First setup defaults to subscription mode unless `--auth-mode` or `AUTOROUTER_AUTH_MODE` selects another mode. Local Ollama is the default evaluator (changed from Jev in 0.5.0; configurations created by `setup` always record their evaluator, so existing ones are unchanged, but an environment-only launch with no `AUTOROUTER_EVALUATOR` now selects Ollama); `--evaluator jev` selects TypeSafe's hosted evaluator. An existing configuration updated with `--force` keeps its saved choices unless a command-line flag changes them; unrelated environment overrides remain temporary. Setup prompts for required secrets without echoing them and writes a private JSON file. On macOS, new and `--replace` setups keep keys in the login Keychain by default (see [credential storage](#credential-storage)); elsewhere, and in existing configurations, stored keys are plaintext in that file, so keep it private and out of source control. Supply keys through the environment when interactive input is unavailable. Subscription mode with Ollama requires no API keys. API-key authentication always requires `ANTHROPIC_API_KEY`, regardless of evaluator.
 
 The config path is selected in this order:
 
@@ -43,6 +45,17 @@ The JSON file uses flat environment-style string keys, such as `AUTOROUTER_AUTH_
 node --env-file=.env bin/autorouter.mjs claude
 ```
 
+### Credential storage
+
+`AUTOROUTER_SECRET_STORE` selects where saved `ANTHROPIC_API_KEY`, `TYPESAFE_API_KEY` and `AUTOROUTER_TOKEN` values live. `file` stores them in the private JSON file; it is used on Linux and by configurations created before this option existed. `keychain`, available on macOS and chosen by default there for new setups, stores each one as a generic password in the login Keychain (service `claude-autorouter`, scoped to the configuration file path); the JSON file then contains only settings. Changing the setting moves saved keys:
+
+```sh
+claude-autorouter config set AUTOROUTER_SECRET_STORE keychain   # file → Keychain
+claude-autorouter config set AUTOROUTER_SECRET_STORE file       # Keychain → file
+```
+
+If the Keychain cannot be used during a default setup (locked or headless), setup says so and saves keys to the file instead; an explicit `--secret-store keychain` fails rather than falling back. An existing plaintext configuration is never moved implicitly: `setup --force` and `doctor` flag plaintext keys on macOS and print the command above. Keys are written to the Keychain before the file is rewritten, so an interrupted move leaves a copy in both places rather than neither. Items are removed only after the file is saved. Values pass to the system `security` tool on standard input, never as process arguments, and each write is read back to confirm it. Keychain values must be printable single-line ASCII. Environment variables still take precedence: when the Keychain is locked (for example over SSH), a key supplied in the environment is used instead, but moving keys between stores waits until every saved key can be read. `sessions` never reads the Keychain.
+
 For an environment-only subscription launch, set `AUTOROUTER_AUTH_MODE=subscription` and either supply `TYPESAFE_API_KEY` or select `AUTOROUTER_EVALUATOR=ollama` with a running local model. For API-key mode, also supply `ANTHROPIC_API_KEY`. The shell variables are read by the router; Jev's key is removed from the Claude child environment.
 
 | Variable | Default | Purpose |
@@ -51,12 +64,13 @@ For an environment-only subscription launch, set `AUTOROUTER_AUTH_MODE=subscript
 | `ANTHROPIC_API_KEY` | required in API-key mode | Upstream Anthropic credential |
 | `AUTOROUTER_CONFIG` | see path order above | Explicit user config path |
 | `AUTOROUTER_AUTH_MODE` | `api-key` without saved config; setup selects `subscription` | Authentication mode |
-| `AUTOROUTER_EVALUATOR` | `jev` | `jev` or local `ollama` classification |
+| `AUTOROUTER_EVALUATOR` | `ollama` | local `ollama` (default) or hosted `jev` classification |
+| `AUTOROUTER_SECRET_STORE` | `keychain` for new macOS setups; otherwise `file` | Saved-config setting: `keychain` keeps saved keys in the macOS login Keychain; the environment cannot redirect it |
 | `AUTOROUTER_CLIENT_PROFILE` | `compatible` | `native` retains client model/thinking settings; `auto` starts with Sonnet when no explicit model is set and excludes Haiku from task routing |
 | `AUTOROUTER_STATUSLINE` | enabled | `0` retains your existing status line |
 | `AUTOROUTER_DEBUG` | off | `1` enables launcher metadata logs on stderr |
 | `AUTOROUTER_SESSION_LOG_DIR` | off | Write per-session JSONL decisions and outcomes into this directory; unset or empty disables it |
-| `AUTOROUTER_SESSION_LOG_MODE` | `prompts` | `metadata` omits prompt excerpts; setting a mode alone does not enable logging |
+| `AUTOROUTER_SESSION_LOG_MODE` | `metadata` | `metadata` omits prompt excerpts; `prompts` includes bounded human-task excerpts; setting a mode alone does not enable logging |
 | `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` | unset; Claude currently uses `8` | Optional cap on consecutive Stop/SubagentStop continuations without tool use; `0` disables the cap |
 | `ENABLE_TOOL_SEARCH` | `true` in launcher when unset | Load MCP tool definitions on demand; explicit values are preserved |
 | `AUTOROUTER_HAIKU_MODEL` | `claude-haiku-4-5-20251001` | Routine tier |
@@ -91,9 +105,27 @@ claude-autorouter config set TYPESAFE_API_KEY
 
 Normal startup validates the selected evaluator; stale settings for the inactive evaluator do not prevent it from starting. `show --check-all` explicitly checks both. Blank numeric settings fail with their setting name; zero retains its documented meaning. `claude-autorouter help COMMAND` gives focused command help. `claude-autorouter claude --help` and `--version` call Claude directly without router setup or credentials.
 
+### Organization policy
+
+An administrator can restrict what users may configure with a policy file at a fixed system path: `/Library/Application Support/claude-autorouter/policy.json` on macOS and `/etc/claude-autorouter/policy.json` on Linux. No environment variable changes this path. The file and its directory must be regular, owned by root, and not writable by group or others; otherwise AutoRouter refuses to start. An invalid or unreadable file also stops it, so a broken policy never silently turns off.
+
+```json
+{
+  "allowed_evaluators": ["ollama"],
+  "allowed_auth_modes": ["subscription"],
+  "session_log_mode": "metadata",
+  "upstream_url": "https://api.anthropic.com",
+  "jev_url": "https://api.typesafe.ai/v1/systemone"
+}
+```
+
+All keys are optional. `allowed_evaluators` and `allowed_auth_modes` reject any other choice, including an unset default, with an error that names the setting. `session_log_mode`, `upstream_url` and `jev_url` replace whatever the saved file or environment supplies; `config show` reports them with source `policy`. `doctor` prints the policy path and the locked settings. `setup` and `config set` refuse to save a disallowed value, but still let a user correct a setting that the policy now forbids.
+
+The policy guards against configuration drift and environment-driven changes such as direnv, devcontainer or CI variables. It does not stop someone who can run modified code, or run Claude Code without AutoRouter. Deploy it with device management, and use it with an allowlist of approved package versions.
+
 ## Ollama evaluator
 
-The local configuration documented here requires AutoRouter 0.3.2 or newer and remains experimental. It uses Ollama's native `/v1/systemone` decision endpoint for every model, replacing the chat backend from 0.2.0. Jev remains the default remote evaluator, using TypeSafe's `/v1/systemone` endpoint and a TypeSafe API key. Selecting Ollama never silently switches back to Jev. Haiku, Sonnet, or Opus still completes the task through Anthropic.
+The local configuration documented here requires AutoRouter 0.3.2 or newer and remains experimental. It uses Ollama's native `/v1/systemone` decision endpoint for every model, replacing the chat backend from 0.2.0. Jev is the optional hosted evaluator, using TypeSafe's `/v1/systemone` endpoint and a TypeSafe API key. Selecting Ollama never silently switches back to Jev. Haiku, Sonnet, or Opus still completes the task through Anthropic.
 
 Version 0.3.2 excludes Claude's executor system instructions from local excerpts, uses model-specific runtime deadlines, and accepts `0` to disable that deadline. Setup, doctor, and startup show the effective model and deadline; setup accepts `--ollama-timeout-ms`. Jev is unchanged.
 
@@ -131,7 +163,7 @@ claude-autorouter setup --evaluator ollama --ollama-model tev1:4b-q4_K_M --pull
 
 For Nimble, the explicit Q4_K_M tag avoids `nimble:latest`, which currently selects an approximately 9.5 GB Q8 model. For Tev1, `tev1:latest` and `tev1:4b` select approximately 4.5 GB Q8 weights; the explicit `tev1:4b-q4_K_M` tag selects the smaller 4B download. Download size is not resident memory: runtime and context allocations add to it, and other applications need memory too. Downloaded models have their own licenses and are not bundled in this package. In historical tests before 0.3.2 on a 16 GiB M4, Tev1 0.8B matched 18/24 held-out labels at 450 ms median latency within 1,500 ms; 4B matched 22/24 at 3.15 seconds with a separate 10-second deadline. See the [local measurements](ollama-evaluation.md) before choosing a latency deadline.
 
-The endpoint must be loopback (`127.0.0.1`, `localhost`, or `::1`), without a path, credentials, query, or fragment. Cloud model tags and metadata identifying a remote model are rejected before sending task text. Claude and Jev credentials are never attached to Ollama requests.
+The endpoint must be loopback (`127.0.0.1`, `localhost`, or `::1`); `localhost` is converted to `127.0.0.1` so the connection does not depend on name resolution, without a path, credentials, query, or fragment. Cloud model tags and metadata identifying a remote model are rejected before sending task text. Claude and Jev credentials are never attached to Ollama requests.
 
 ### Classification and fallback
 
@@ -186,15 +218,17 @@ Claude Code → authenticated local gateway → Jev or local Ollama classificati
                                         → selected Claude model → streamed response
 ```
 
-AutoRouter uses Claude Code's [gateway integration](https://code.claude.com/docs/en/llm-gateway-protocol), so it sees inference requests and tool continuations. It does not rely on a user-prompt hook.
+AutoRouter launches the user's installed official Claude Code binary without patching it and uses Claude Code's [gateway integration](https://code.claude.com/docs/en/llm-gateway-protocol), so it sees inference requests and tool continuations. It does not rely on a user-prompt hook. Each user uses their own provider credentials; AutoRouter does not provide a Claude sign-in service or a shared provider account.
 
-The selected evaluator receives a bounded state containing the latest human request and excerpts of the original task and recent messages: up to 12,000 serialized characters sent to TypeSafe for Jev, or 3,000 UTF-8 bytes sent to the local Ollama service. Jev also receives system-text excerpts. The local path excludes Claude's top-level executor system instructions. These excerpts can include private source code and tool results. Images, document payloads, and signed thinking are omitted. Full tool schemas and full conversation history are not sent to either classifier. Anthropic receives the complete request, including its tools and attachments. Large or multimodal requests may also go to Anthropic's token-count endpoint before inference, including when classification is local.
+The selected evaluator receives a bounded state containing the latest human request and excerpts of the original task and recent messages: up to 12,000 serialized characters sent to TypeSafe for Jev, or 3,000 UTF-8 bytes sent to the local Ollama service. Jev also receives system-text excerpts. The local path excludes Claude's top-level executor system instructions. These excerpts can include private source code and tool results. Before excerpting, recognizable sensitive values are replaced (the same filter applies to opt-in session-log prompt excerpts, including when old logs are read back) with markers such as `[REDACTED:secret]`: private keys, common provider token formats (Anthropic, OpenAI-style `sk-`, AWS, GitHub, GitLab, Slack, Google, Stripe, npm), JWTs, authorization headers, URL credentials, values assigned to password/secret/token/key-like names, email addresses, and checksum-valid IBANs and payment card numbers. Setting names stay visible. Redaction is pattern-based: unrecognized formats can remain, code resembling an assignment can be over-redacted, and it does not make arbitrary private source code safe to share. Images, document payloads, and signed thinking are omitted. Full tool schemas and full conversation history are not sent to either classifier. Anthropic receives the complete request, including its tools and attachments. Large or multimodal requests may also go to Anthropic's token-count endpoint before inference, including when classification is local.
 
 In subscription mode, Claude Code owns login and OAuth refresh. AutoRouter forwards the current request's authorization and beta headers to Anthropic. It does not read keychain or saved login files, persist subscription tokens, or send them to Jev. A separate temporary `X-Autorouter-Token` authenticates the local connection and is stripped upstream. Subscription forwarding is restricted to `https://api.anthropic.com`. See [subscriptions and gateways](https://code.claude.com/docs/en/llm-gateway#subscriptions-and-gateways).
 
 In API-key mode, the upstream key stays in the proxy and Claude receives a temporary local credential. Requests are billed to the supplied API key. Subscription requests remain subject to the subscription's model access and usage limits. AutoRouter never falls back from subscription authentication to API billing.
 
-Routine logs contain route, model, timing, usage, and error-category metadata, not prompts, raw responses, or credentials. Status snapshots contain routing metadata and token counts in a private temporary directory and are deleted on normal launcher exit. Classification, turn, and token-count caches are held in memory. Claude Code and the external providers have their own storage and logging behavior.
+The proxy processes authenticated requests in memory, including their authorization headers. Preserving Claude's login flow does not by itself establish that every deployment is permitted. The [provider-policy note](subscription-integration.md#provider-guidance-and-unresolved-scope) records the current documentation and the unresolved scope of model-rewriting subscription forwarding. Jev requires its own TypeSafe credentials and billing, separate from Anthropic authentication.
+
+Routine diagnostic logs contain route, model, timing, usage, and error-category metadata, not prompts, raw responses, or credentials. Opt-in session history is separate and includes task excerpts only in `prompts` mode; the default is `metadata` (changed from `prompts` in 0.5.1; set `AUTOROUTER_SESSION_LOG_MODE=prompts` to keep excerpts). Status snapshots contain routing metadata and token counts in a private temporary directory and are deleted on normal launcher exit. After a hard kill, the next launch removes directories whose process is gone (only your own, owner-only `autorouter-status-*` directories in the temporary directory). Classification, turn, and token-count caches are held in memory. Claude Code and the external providers have their own storage and logging behavior.
 
 ## Routing policy
 
@@ -305,7 +339,7 @@ claude-autorouter sessions show autorouter-session-EXAMPLE --json
 
 Use the exact `id` printed by `sessions list`. Commands need no evaluator credentials and do not contact providers. Human summaries distinguish selected models, observed serving models, confirmed completions, failures, cancellations, and pending/unconfirmed requests. They report routing latency, fallback and override counts, and API-equivalent savings coverage. A selected model or an HTTP 200 alone does not prove successful inference. Old schema-1 decision logs remain readable and explicitly lack outcome evidence.
 
-`prompts` mode preserves the existing excerpt behavior when a log directory is enabled. Main requests retain at most 500 Unicode characters of the human task; recognized tool and goal continuations retain the originating task. Auxiliary, subagent, compaction, workflow, and attachment-only requests have empty excerpts. Metadata mode omits the excerpt fields entirely. Neither mode logs authentication headers, provider replies, full transcripts, or tool payloads. Text entered directly in a prompt can appear in an enabled prompt excerpt.
+`prompts` mode (opt-in) records excerpts when a log directory is enabled. Main requests retain at most 500 Unicode characters of the human task; recognized tool and goal continuations retain the originating task. Auxiliary, subagent, compaction, workflow, and attachment-only requests have empty excerpts. Metadata mode omits the excerpt fields entirely. Neither mode logs authentication headers, provider replies, full transcripts, or tool payloads. Text entered directly in a prompt can appear in an enabled prompt excerpt.
 
 The settings also work with `serve` and every client profile. `setup --session-log-dir DIR --session-log-mode metadata --force` updates an existing configuration. Setup resolves relative directories at setup time; environment-only paths resolve from the launch directory. `AUTOROUTER_SESSION_LOG_DIR=''` disables a saved directory for one launch. Setting only the mode never enables logging. `doctor` reports preferences without creating files.
 

package/docs/releasing.md

@@ -18,7 +18,11 @@ Version `0.3.7` enables automatic Sonnet/Opus switching for compatible Auto-mode
 
 Version `0.4.0` completes the routing, configuration, history and performance improvement plan. Shared compatibility checks and durable task state preserve valid request features and confirmed tool/goal continuity across evaluator cache expiry, provider fallback and concurrent requests. New `config show/set/unset`, `sessions list/show` and `doctor --evaluate-local` commands support focused configuration edits, private metadata-only history and explicit local diagnostics. `setup --force` now merges saved settings; use `--replace` for deliberate replacement. Optional logging remains disabled by default; new schema-2 decision/outcome records separate selected and observed models, while the reader still accepts schema-1 files. Consumers parsing JSONL directly should account for both event kinds and the new schema. Identical concurrent evaluations are coalesced with independent cancellation, responses are bounded, and status persistence is asynchronous. Releases retain the tested archive and verify public npm availability and installation after submission. Actual 16 GiB/64 GiB Ollama results retain failed quality gates and comparison limits; Jev remains the default. See the [configuration/history reference](reference.md) and [hardware comparison](hardware-comparison.md).
 
-The GitHub repository is private. Publishing to npm makes the tarball's runtime source, README, configuration example, license, and shipped documentation public. Model weights, user configuration, credentials, transcripts, session logs, local artifacts, and test fixtures are excluded. Review the archive before the first publication and whenever the package allowlist changes.
+Version `0.5.0` makes local Ollama the default evaluator and TypeSafe Jev an explicit option (`setup --evaluator jev`), so evaluator excerpts stay on the machine unless the user opts in. **Breaking for environment-only launches** that relied on the implicit Jev default; configurations created by `setup` record their evaluator and are unchanged. Evaluator excerpts and opt-in session-log prompt excerpts are now redacted for recognizable credentials and personal identifiers (pattern-based, not exhaustive). On macOS, new `setup` runs keep saved keys in the login Keychain by default; existing plaintext configurations are not moved implicitly, and `doctor` prints the `config set AUTOROUTER_SECRET_STORE keychain` command to move them. See [credential storage](reference.md#credential-storage) and the [data flow](reference.md#data-flow-and-authentication).
+
+Version `0.5.1` hardens defaults and adds an optional organization policy. **Behavior change:** enabling `AUTOROUTER_SESSION_LOG_DIR` now records metadata only; set `AUTOROUTER_SESSION_LOG_MODE=prompts` to keep prompt excerpts. Saved configurations that already record a mode are unchanged. A root-owned policy file can restrict the evaluator and authentication mode and lock the log mode and service URLs; see [organization policy](reference.md#organization-policy). The next launch removes status directories left by a hard-killed launcher, an Ollama `localhost` endpoint now connects to `127.0.0.1`, an oversized request body closes its connection after the 413 response, and `.env.example` selects the local evaluator to match the default.
+
+The GitHub repository became public on October 6, 2026, after preparation PR #1 merged. That launch created no release tag and published no new npm version. npm publication remains a separate release operation. Its tarball includes runtime source, README, configuration example, license, and shipped documentation; model weights, user configuration, credentials, transcripts, session logs, local artifacts, and test fixtures are excluded. Review each release archive, especially when the package allowlist changes. The public Git repository also exposes history, development scripts and tests; the npm archive allowlist does not govern that material.
 
 ## What runs automatically
 
@@ -35,7 +39,7 @@ Only the publishing job has `id-token: write`; there is no `NPM_TOKEN` or requir
 
 Verification polls uncached version metadata and the package document, checks the downloaded tarball against the tested archive, and installs the exact version from the public registry into a temporary prefix with an empty npm cache/config. It compares the installed file set and bytes with the canonical archive before invoking that executable’s `--version` and `--help` from an unrelated directory, with lifecycle scripts disabled and no evaluator credentials. Only a successful public install and matching artifact produce `verified`.
 
-The project has no package dependencies or lockfile, so CI runs its scripts directly without `npm ci`. Live Claude/Jev calls, Ollama downloads, and private repository probes are not CI checks.
+The installed CLI has no runtime dependencies. Contributor tooling uses pinned development dependencies and a committed `package-lock.json`; CI installs them with `npm ci --ignore-scripts --no-audit --no-fund` before checks. Live Claude/Jev calls, Ollama downloads, and private repository probes are not CI checks.
 
 ## 1. Publish the first version interactively
 
@@ -107,7 +111,7 @@ On npmjs.com, open the `claude-autorouter` package's **Settings → Trusted Publ
 
 Use the filename only, not `.github/workflows/publish.yml`. No GitHub environment or npm token secret needs to be created. The owner, repository, and workflow must match exactly. New trust configurations default to permitting staged publication; **enable direct `npm publish`** for this workflow. See [npm trusted publishers](https://docs.npmjs.com/trusted-publishers/) and [staged publishing](https://docs.npmjs.com/staged-publishing/).
 
-The workflow explicitly disables provenance because npm provenance is unsupported for private source repositories, even when the npm package is public. OIDC authentication still works. If the repository becomes public, review the workflow and metadata before enabling provenance. See [npm provenance requirements](https://docs.npmjs.com/generating-provenance-statements/).
+The publishing workflow selects provenance from repository visibility. With the source now public, the workflow requests provenance on future publication; it would disable provenance for a private source repository. OIDC authentication works independently of provenance. The package preparation job's dry run always disables provenance because it has no OIDC publishing permission. Before the first public-source release, review repository metadata and npm trust settings, then verify the resulting provenance statement. The public launch itself created no attestation, and changing visibility does not add attestations to historical releases. See [npm provenance requirements](https://docs.npmjs.com/generating-provenance-statements/).
 
 After a successful trusted release, npm recommends the optional **Publishing access → Require two-factor authentication and disallow tokens** setting. It does not disable OIDC publishing. See [restricting token access](https://docs.npmjs.com/trusted-publishers/#recommended-restrict-token-access-when-using-trusted-publishers).
 

package/docs/subscription-integration.md

@@ -0,0 +1,27 @@
+# Claude Code integration and provider policy
+
+AutoRouter is an independent, user-operated local gateway for Claude Code. Anthropic does not sponsor or endorse this project. The project name is **AutoRouter**; references to Claude Code describe the software it runs. Existing npm, command, configuration, and repository identifiers remain `claude-autorouter` for compatibility. Those identifiers do not represent provider approval or trademark clearance. Anthropic's names and marks remain subject to its [trademark guidelines](https://www.anthropic.com/legal/trademark-guidelines).
+
+## What the integration does
+
+The launcher starts the official `claude` executable already installed on the user's machine. AutoRouter neither bundles nor patches that binary. It sets a local gateway address and temporary session settings, evaluates eligible inference requests, selects a compatible Claude model, and forwards the provider's response stream. Model-specific request adjustments and continuity checks are described in the [routing reference](reference.md#routing-policy). It does not change Claude's permission verdicts or grant access to unavailable models.
+
+The gateway listens on `127.0.0.1` and authenticates local requests. Standalone `serve` retains that local boundary; it is not a hosted account-sharing service. This project does not supply a shared Anthropic account, resell inference, or pay provider charges on a user's behalf.
+
+## Authentication and data ownership
+
+- **Subscription mode:** each user signs into their own account through Claude Code's official login flow. Claude owns OAuth refresh. AutoRouter receives the authorization header with each proxied request and forwards it to `https://api.anthropic.com`, together with the OAuth capability header. It does not extract login files or keychain entries, persist subscription tokens, or send those tokens to an evaluator. A separate temporary local token is removed before forwarding.
+- **API-key mode:** the user supplies their own Anthropic API key. The proxy forwards that key upstream and gives Claude a separate local credential. API usage is billed to the key owner's account; the router does not switch subscription traffic to API billing after an error.
+- **Evaluation:** the default Ollama evaluator receives bounded, redacted task/history excerpts through its loopback service without Claude or Jev credentials. The optional Jev evaluator uses a separate TypeSafe key and separate billing, and receives the same bounded, redacted excerpts, which can still include private code. Anthropic still receives the complete inference request. See [data flow and authentication](reference.md#data-flow-and-authentication).
+
+Claude Code, Anthropic, TypeSafe, and any downloaded local model have their own terms and data handling. Optional AutoRouter history persists locally when enabled; prompt mode can retain text entered by the user. See [history and privacy](reference.md#session-decision-logs).
+
+## Provider guidance and unresolved scope
+
+Documentation reviewed **October 6, 2026**:
+
+Anthropic's [Claude Code legal guidance](https://code.claude.com/docs/en/legal-and-compliance#authentication-and-credential-use) allows end users to sign into an unmodified Claude Code binary with their own credentials. It also restricts third-party credential collection or intermediation and certain subscription routing. Its [gateway documentation](https://code.claude.com/docs/en/llm-gateway#subscriptions-and-gateways) describes retaining a saved subscription login when configuring a gateway address without replacing authentication, including forwarding the OAuth capability header.
+
+These statements are relevant technical and policy context; they do not specifically approve AutoRouter's model-rewriting OAuth proxy. This project has not established that every use of subscription forwarding meets the applicable restrictions. Successful authentication or a passing test establishes technical behavior, not provider authorization. Enterprise access does not establish a blanket exception.
+
+Review your account agreement and organization requirements before deployment, and seek clarification from Anthropic about this integration when needed. Anthropic identifies [Commercial Terms](https://www.anthropic.com/legal/commercial-terms) for Team, Enterprise, and API use and [Consumer Terms](https://www.anthropic.com/legal/consumer-terms) for consumer plans in its [license guidance](https://code.claude.com/docs/en/legal-and-compliance#license). API-key mode is available with separate billing and remains subject to its applicable terms. No policy-compliance guarantee is made by this project.

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "claude-autorouter",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "license": "Apache-2.0",
   "type": "module",
-  "description": "A Claude Code model router with Jev and local Ollama System One evaluators",
+  "description": "AutoRouter: a local model-routing gateway for Claude Code with Jev and Ollama System One evaluators",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/frapposelli/claude-autorouter.git"
   },
+  "homepage": "https://github.com/frapposelli/claude-autorouter#readme",
+  "bugs": {
+    "url": "https://github.com/frapposelli/claude-autorouter/issues"
+  },
   "bin": {
     "claude-autorouter": "bin/autorouter.mjs"
   },
@@ -39,6 +43,10 @@
     ".env.example",
     "LICENSE",
     "CONTRIBUTING.md",
+    "SECURITY.md",
+    "SUPPORT.md",
+    "CODE_OF_CONDUCT.md",
+    "docs/subscription-integration.md",
     "docs/router-performance.md",
     "docs/router-performance.json",
     "docs/status-performance.md",

package/src/cli-help.mjs

@@ -1,23 +1,25 @@
 const commands = {
   setup: `Usage: claude-autorouter setup [options]
 
-Configure Jev (default) or an installed local Ollama evaluator.
+Configure the local Ollama evaluator (default) or TypeSafe Jev.
   --auth-mode subscription|api-key   Default: subscription
   --client-profile compatible|native|auto
-  --evaluator jev|ollama
+  --evaluator ollama|jev             Default: ollama (local); jev sends excerpts to TypeSafe
   --ollama-model TAG                 Select a /v1/systemone model
   --ollama-timeout-ms N              0 disables the routing deadline
   --pull                            Download the selected missing Ollama model
   --stop-hook-block-cap N            Optional Claude Stop-hook retry limit
   --session-log-dir DIR              Opt in to private logs with prompt excerpts
   --session-log-mode metadata|prompts Choose whether excerpts are included
-  --force                           Update an existing configuration
+  --secret-store file|keychain       default on macOS for new setups; file is plaintext
+  --force                          Update an existing configuration
   --replace                         Explicitly rebuild the saved configuration
 
 First setup reads environment settings and keys, or prompts for missing keys.
 --force retains saved defaults and applies explicit options; unrelated runtime
 overrides stay temporary. Explicit evaluator/auth selection accepts its supplied key.
-Example: claude-autorouter setup --evaluator ollama --ollama-model tev1:0.8b --pull`,
+Examples: claude-autorouter setup --pull
+          claude-autorouter setup --evaluator jev`,
   doctor: `Usage: claude-autorouter doctor [--evaluate-local] [--json]
 
 Check configuration, installed Claude, and local model availability.
@@ -35,6 +37,7 @@ Show effective settings and their source; secrets are always redacted.
 --check-all also validates settings for the inactive evaluator.
 Set/unset changes only the named saved setting. Environment values still win.
 Secret keys require --stdin or a hidden prompt, never a command-line value.
+Setting AUTOROUTER_SECRET_STORE to keychain or file moves saved keys (macOS).
 
 Example: claude-autorouter config set AUTOROUTER_OLLAMA_TIMEOUT_MS 0`,
   serve: `Usage: claude-autorouter serve
@@ -61,7 +64,7 @@ Claude owns permission checks and subscription authentication.
 };
 
 export function helpText(command = 'help') {
-  return commands[command] ?? `Claude AutoRouter — automatic Claude model routing
+  return commands[command] ?? `AutoRouter — automatic model routing for Claude Code
 
 Usage: claude-autorouter <command> [options]
 
@@ -78,8 +81,8 @@ Start: claude-autorouter setup
        claude-autorouter claude --permission-mode auto
 
 Run claude-autorouter help <command> for options and examples.
-Jev is the default; it receives bounded prompt excerpts. Ollama uses only the
-local /v1/systemone evaluator. Complete requests go to Anthropic.
+Local Ollama is the default evaluator and uses only the local /v1/systemone
+endpoint. Jev is optional; it receives bounded, redacted prompt excerpts. Complete requests go to Anthropic.
 Session logging is off unless AUTOROUTER_SESSION_LOG_DIR is configured.
 Environment variables override ~/.config/claude-autorouter/config.json.
 AUTOROUTER_CONFIG selects another file. Project .env files are not auto-loaded.