claude-autorouter 0.4.0 → 0.5.1

package/src/config-command.mjs

@@ -1,7 +1,8 @@
 import { readConfig, parseSessionLogDir, parseStopHookBlockCap } from './config.mjs';
-import { CONFIG_KEYS, SECRET_CONFIG_KEYS, loadUserConfig, saveUserConfig } from './user-config.mjs';
+import { CONFIG_KEYS, SECRET_CONFIG_KEYS, SECRET_STORES, keychainRemovals, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { modelCapabilities } from './model-catalog.mjs';
 import { askSecret } from './onboarding.mjs';
+import { applyPolicy } from './policy.mjs';
 
 const secretKey = key => SECRET_CONFIG_KEYS.includes(key);
 const providerFor = key => key.startsWith('AUTOROUTER_OLLAMA_') ? 'ollama'
@@ -30,16 +31,21 @@ function effectiveValues(config, env) {
 /** Redacted effective configuration, independent of Claude launch arguments. */
 export function configReport(loaded, env, { checkAll = false } = {}) {
   const config = readConfig(loaded.env);
-  const values = effectiveValues(config, loaded.env);
+  const values = { ...effectiveValues(config, loaded.env), AUTOROUTER_SECRET_STORE: loaded.secretStore ?? 'file' };
   const settings = {};
   for (const key of CONFIG_KEYS) {
-    const source = env[key] !== undefined ? 'environment' : Object.hasOwn(loaded.values, key) ? 'file' : 'default';
+    const saved = loaded.keychainSecrets?.includes(key) ? 'keychain' : 'file';
+    // The saved store setting governs saved secrets; the environment cannot redirect it.
+    const source = loaded.policyLocked?.includes(key) ? 'policy'
+      : env[key] !== undefined && key !== 'AUTOROUTER_SECRET_STORE' ? 'environment'
+      : Object.hasOwn(loaded.values, key) ? saved : 'default';
     const provider = providerFor(key);
     const active = (!provider || provider === config.evaluator)
       && (key !== 'ANTHROPIC_API_KEY' || config.authMode === 'api-key');
     const secret = secretKey(key);
     settings[key] = { source, active,
       ...(source === 'environment' && Object.hasOwn(loaded.values, key) ? { overrides_file: true } : {}),
+      ...(source === 'environment' && loaded.unavailableSecrets?.includes(key) ? { keychain_unavailable: true } : {}),
       ...(secret ? { secret: true, present: typeof loaded.env[key] === 'string' && Boolean(loaded.env[key].trim()) }
         : { value: active ? values[key] ?? null : null }),
     };
@@ -53,7 +59,8 @@ export function configReport(loaded, env, { checkAll = false } = {}) {
     try { readConfig(loaded.env, { validateAll: true }); }
     catch (failure) { valid = false; error = failure.message; }
   }
-  return { schema_version: 1, config_path: loaded.path, config_exists: loaded.exists, valid,
+  return { schema_version: 1, config_path: loaded.path, config_exists: loaded.exists,
+    ...(loaded.policyPath ? { policy_path: loaded.policyPath } : {}), valid,
     checked: checkAll ? 'all_evaluators' : 'active_evaluator', settings, warnings,
     ...(error ? { error } : {}),
   };
@@ -84,19 +91,21 @@ function normalizedValue(key, value) {
   }
   if (key === 'AUTOROUTER_SESSION_LOG_DIR') return parseSessionLogDir(value) ?? '';
   if (key === 'CLAUDE_CODE_STOP_HOOK_BLOCK_CAP') return String(parseStopHookBlockCap(value));
+  if (key === 'AUTOROUTER_SECRET_STORE' && !SECRET_STORES.includes(value)) throw new Error('AUTOROUTER_SECRET_STORE must be file or keychain.');
   if (/[\r\n\0\u001b]/.test(value)) throw new Error(`${key} must be a single-line setting.`);
   return value;
 }
 
 export async function configCommand(args, {
-  env = process.env, write = console.log, input = process.stdin, promptSecret = askSecret,
+  env = process.env, write = console.log, input = process.stdin, promptSecret = askSecret, keychain, policy,
 } = {}) {
+  const store = { ...(keychain ? { keychain } : {}), ...(policy ? { policy } : {}) };
   const [operation, ...rest] = args;
   if (operation === 'show') {
     if (rest.some(arg => !['--json', '--check-all'].includes(arg))) throw new Error('Usage: claude-autorouter config show [--json] [--check-all]');
     let loaded, report;
     try {
-      loaded = loadUserConfig(env, { allowMissing: true });
+      loaded = loadUserConfig(env, { allowMissing: true, ...store });
       report = configReport(loaded, env, { checkAll: rest.includes('--check-all') });
     }
     catch (error) {
@@ -124,7 +133,7 @@ export async function configCommand(args, {
     throw new Error('Secret values are not accepted as command arguments. Use --stdin or the hidden prompt.');
   }
   if (operation === 'set' && !secretKey(key) && (value === undefined || value === '--stdin')) throw new Error('Nonsecret settings require a value argument.');
-  const loaded = loadUserConfig(env, { allowMissing: true });
+  const loaded = loadUserConfig(env, { allowMissing: true, enforcePolicy: false, ...store });
   const next = { ...loaded.values };
   if (operation === 'unset') delete next[key];
   else next[key] = normalizedValue(key, secretKey(key)
@@ -134,8 +143,20 @@ export async function configCommand(args, {
   // mask it. An explicitly edited inactive provider is checked too.
   const provider = operation === 'set' ? providerFor(key) : undefined;
   readConfig({ ...next, ...(provider ? { AUTOROUTER_EVALUATOR: provider } : {}) });
-  saveUserConfig(next, { env, overwrite: loaded.exists, expectedRevision: loaded.revision });
-  write(`${operation === 'unset' ? 'Removed saved' : 'Saved'} ${key}. Other saved settings are unchanged.`);
+  if (loaded.policy) applyPolicy(next, loaded.policy);
+  const nextStore = next.AUTOROUTER_SECRET_STORE ?? 'file';
+  // Changing the store moves saved secrets; unsetting a secret deletes its item.
+  const removeSecrets = key === 'AUTOROUTER_SECRET_STORE' ? keychainRemovals(loaded, nextStore)
+    : operation === 'unset' && secretKey(key) && loaded.secretStore === 'keychain' ? [key] : [];
+  saveUserConfig(next, { env, overwrite: loaded.exists, expectedRevision: loaded.revision, removeSecrets, ...store });
+  if (key === 'AUTOROUTER_SECRET_STORE') {
+    const moved = SECRET_CONFIG_KEYS.filter(name => Object.hasOwn(next, name)).length;
+    const where = nextStore === 'keychain' ? 'macOS Keychain' : 'configuration file';
+    write(nextStore === loaded.secretStore || !moved ? `Saved ${key}. Saved secrets are stored in the ${where}.`
+      : `Saved ${key}. Moved ${moved} saved secret${moved === 1 ? '' : 's'} to the ${where}.`);
+    return true;
+  }
+  write(`${operation === 'unset' ? 'Removed saved' : 'Saved'} ${key}${secretKey(key) && nextStore === 'keychain' ? ' in the macOS Keychain' : ''}. Other saved settings are unchanged.`);
   if (env[key] !== undefined) write(`The current environment still overrides ${key}; unset that environment variable to use the saved/default value.`);
   return true;
 }

package/src/config.mjs

@@ -58,12 +58,12 @@ function modelName(value, name) {
  * @returns {import('./contracts.mjs').RouterConfig}
  */
 export function readConfig(env = process.env, { validateAll = false } = {}) {
-  const sessionLogMode = env.AUTOROUTER_SESSION_LOG_MODE === undefined ? 'prompts' : env.AUTOROUTER_SESSION_LOG_MODE;
+  const sessionLogMode = env.AUTOROUTER_SESSION_LOG_MODE === undefined ? 'metadata' : env.AUTOROUTER_SESSION_LOG_MODE;
   if (sessionLogMode !== 'metadata' && sessionLogMode !== 'prompts') throw new Error('AUTOROUTER_SESSION_LOG_MODE must be metadata or prompts');
   for (const key of ['AUTOROUTER_STATUSLINE', 'AUTOROUTER_DEBUG']) {
     if (env[key] !== undefined && !['0', '1'].includes(env[key])) throw new Error(`${key} must be 0 or 1`);
   }
-  const evaluator = env.AUTOROUTER_EVALUATOR ?? 'jev';
+  const evaluator = env.AUTOROUTER_EVALUATOR ?? 'ollama';
   if (evaluator !== 'jev' && evaluator !== 'ollama') throw new Error('AUTOROUTER_EVALUATOR must be jev or ollama');
   // A stale inactive backend must not stop the selected evaluator. Config
   // inspection can request validation of both providers explicitly.

package/src/keychain.mjs

@@ -0,0 +1,58 @@
+import { spawnSync } from 'node:child_process';
+
+// macOS Keychain access through the system `security` tool. Secret values are
+// passed on stdin to its interactive mode, never as process arguments, and are
+// read back from stdout. Tool output can describe items, so failures report
+// only a generic category.
+const SECURITY = '/usr/bin/security';
+const SERVICE = 'claude-autorouter';
+const NOT_FOUND = 44;
+const PRINTABLE = /^[\x20-\x7e]+$/;
+
+function keychainError(message) {
+  const error = new Error(message);
+  error.code = 'AUTOROUTER_CONFIG_ERROR';
+  return error;
+}
+
+// Quote for the `security -i` command parser, which accepts backslash escapes
+// inside double quotes. Values are validated as printable single-line ASCII.
+const quote = value => `"${value.replace(/[\\"]/g, '\\$&')}"`;
+
+export function createKeychain({ run = spawnSync, platform = process.platform } = {}) {
+  const available = platform === 'darwin';
+  const call = (args, input) => {
+    if (!available) throw keychainError('The macOS Keychain secret store is available only on macOS.');
+    const result = run(SECURITY, args, {
+      input, encoding: 'utf8', timeout: 15000, maxBuffer: 64 * 1024, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    if (result.error) throw keychainError('Could not run the macOS Keychain tool.');
+    return result;
+  };
+  const read = account => {
+    const result = call(['find-generic-password', '-s', SERVICE, '-a', account, '-w']);
+    if (result.status === NOT_FOUND) return undefined;
+    if (result.status !== 0) {
+      throw keychainError('Could not read an AutoRouter secret from the macOS Keychain. Unlock the login keychain, or set the key in the environment.');
+    }
+    return String(result.stdout).replace(/\n$/, '');
+  };
+  return {
+    available,
+    read,
+    write(account, value, label) {
+      if (typeof value !== 'string' || !PRINTABLE.test(value)) {
+        throw keychainError('Keychain secrets must be printable single-line ASCII.');
+      }
+      call(['-i'], `add-generic-password -U -s ${quote(SERVICE)} -a ${quote(account)} -l ${quote(label)} -w ${quote(value)}\n`);
+      // Interactive mode exits successfully even when a command fails.
+      if (read(account) !== value) throw keychainError('Could not save an AutoRouter secret to the macOS Keychain.');
+    },
+    remove(account) {
+      const result = call(['delete-generic-password', '-s', SERVICE, '-a', account]);
+      if (result.status !== 0 && result.status !== NOT_FOUND) {
+        throw keychainError('Could not remove an AutoRouter secret from the macOS Keychain.');
+      }
+    },
+  };
+}

package/src/ollama-models.mjs

@@ -23,6 +23,9 @@ export function validateOllamaEndpoint(value) {
     || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== '/') {
     throw new Error('Ollama must use a loopback base URL without a path, credentials, a query, or a fragment.');
   }
+  // Connect to the loopback address itself. Where `localhost` resolves comes
+  // from /etc/hosts and the resolver, which are not part of this check.
+  if (endpoint.hostname === 'localhost') endpoint.hostname = '127.0.0.1';
   return endpoint.origin;
 }
 

package/src/onboarding.mjs

@@ -3,8 +3,9 @@ import { createInterface } from 'node:readline';
 import { Writable } from 'node:stream';
 import { promisify } from 'node:util';
 import { CLIENT_PROFILES, readConfig, requireKeys, parseStopHookBlockCap, parseSessionLogDir } from './config.mjs';
+import { applyPolicy } from './policy.mjs';
 import { buildClaudeEnv, conflictingProviders, LOCAL_AUTH_HEADER } from './auth.mjs';
-import { CONFIG_KEYS, SECRET_CONFIG_KEYS, loadUserConfig, saveUserConfig } from './user-config.mjs';
+import { CONFIG_KEYS, SECRET_CONFIG_KEYS, SECRET_STORES, keychainRemovals, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { DEFAULT_OLLAMA_MODEL, validateOllamaModel } from './ollama-models.mjs';
 import { inspectOllama, setupOllama } from './ollama-setup.mjs';
 
@@ -37,10 +38,12 @@ export async function askSecret(label, { input = process.stdin, output = process
 }
 
 export async function setup(args, {
-  env = process.env, write = console.log, prompt = askSecret, fetchImpl = fetch, signal,
+  env = process.env, write = console.log, prompt = askSecret, fetchImpl = fetch, signal, keychain,
+  platform = process.platform, policy,
 } = {}) {
   if (signal?.aborted) throw new Error('Setup cancelled');
-  const loaded = loadUserConfig(env, { allowMissing: true });
+  const store = { ...(keychain ? { keychain } : {}), ...(policy ? { policy } : {}) };
+  const loaded = loadUserConfig(env, { allowMissing: true, enforcePolicy: false, ...store });
   const replace = args.includes('--replace');
   const mergeExisting = loaded.exists && !replace;
   // Updating one preference must not turn unrelated runtime overrides into
@@ -50,12 +53,13 @@ export async function setup(args, {
   let explicitEvaluator = false, explicitAuthMode = false;
   let authMode = effectiveEnv.AUTOROUTER_AUTH_MODE ?? 'subscription';
   let clientProfile = effectiveEnv.AUTOROUTER_CLIENT_PROFILE ?? 'compatible';
-  let evaluator = effectiveEnv.AUTOROUTER_EVALUATOR ?? 'jev';
+  let evaluator = effectiveEnv.AUTOROUTER_EVALUATOR ?? 'ollama';
   let model;
   let ollamaTimeoutMs;
   let stopHookBlockCap = effectiveEnv.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP;
   let sessionLogDir = effectiveEnv.AUTOROUTER_SESSION_LOG_DIR;
   let sessionLogMode = effectiveEnv.AUTOROUTER_SESSION_LOG_MODE;
+  let secretStore;
   let pull = false;
   let overwrite = replace;
   for (let i = 0; i < args.length; i++) {
@@ -82,10 +86,14 @@ export async function setup(args, {
       sessionLogMode = args[++i];
       if (!['metadata', 'prompts'].includes(sessionLogMode)) throw new Error('--session-log-mode must be metadata or prompts');
     }
+    else if (args[i] === '--secret-store') {
+      secretStore = args[++i];
+      if (!SECRET_STORES.includes(secretStore)) throw new Error('--secret-store must be file or keychain');
+    }
     else if (args[i] === '--pull') pull = true;
     else if (args[i] === '--force') overwrite = true;
     else if (args[i] === '--replace') continue;
-    else throw new Error('Usage: claude-autorouter setup [--auth-mode subscription|api-key] [--client-profile compatible|native|auto] [--evaluator jev|ollama] [--ollama-model TAG] [--ollama-timeout-ms N] [--stop-hook-block-cap N] [--session-log-dir DIR] [--session-log-mode metadata|prompts] [--pull] [--force|--replace]');
+    else throw new Error('Usage: claude-autorouter setup [--auth-mode subscription|api-key] [--client-profile compatible|native|auto] [--evaluator jev|ollama] [--ollama-model TAG] [--ollama-timeout-ms N] [--stop-hook-block-cap N] [--session-log-dir DIR] [--session-log-mode metadata|prompts] [--secret-store file|keychain] [--pull] [--force|--replace]');
   }
   if (!['subscription', 'api-key'].includes(authMode)) throw new Error('--auth-mode must be subscription or api-key');
   if (!CLIENT_PROFILES.includes(clientProfile)) throw new Error('--client-profile must be compatible, native or auto');
@@ -108,6 +116,11 @@ export async function setup(args, {
   if (stopHookBlockCap !== undefined) values.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP = String(stopHookBlockCap);
   if (sessionLogDir !== undefined) values.AUTOROUTER_SESSION_LOG_DIR = sessionLogDir;
   if (sessionLogMode !== undefined) values.AUTOROUTER_SESSION_LOG_MODE = sessionLogMode;
+  if (secretStore !== undefined) values.AUTOROUTER_SECRET_STORE = secretStore;
+  // New and rebuilt configurations keep keys in the macOS Keychain. An existing
+  // configuration keeps its store until the user moves it deliberately.
+  const defaultedStore = values.AUTOROUTER_SECRET_STORE === undefined && platform === 'darwin' && (!loaded.exists || replace);
+  if (defaultedStore) values.AUTOROUTER_SECRET_STORE = 'keychain';
   if (evaluator === 'ollama') {
     values.AUTOROUTER_OLLAMA_MODEL = validateOllamaModel(model
       ?? (explicitEvaluator ? env.AUTOROUTER_OLLAMA_MODEL : undefined) ?? effectiveEnv.AUTOROUTER_OLLAMA_MODEL ?? DEFAULT_OLLAMA_MODEL);
@@ -119,6 +132,10 @@ export async function setup(args, {
   const keys = [...(evaluator === 'jev' ? ['TYPESAFE_API_KEY'] : []), ...(authMode === 'api-key' ? ['ANTHROPIC_API_KEY'] : [])];
   // Reject invalid settings before inviting secret input or making local calls.
   readConfig(values);
+  if (loaded.policy) applyPolicy(values, loaded.policy);
+  if (values.AUTOROUTER_SECRET_STORE === 'keychain' && platform !== 'darwin') {
+    throw new Error('--secret-store keychain is available only on macOS');
+  }
   for (const key of keys) {
     if (signal?.aborted) throw new Error('Setup cancelled');
     const explicitlySelected = !mergeExisting || (key === 'TYPESAFE_API_KEY' ? explicitEvaluator : explicitAuthMode);
@@ -140,17 +157,43 @@ export async function setup(args, {
     const cancel = () => controller.abort();
     if (!signal) for (const name of ['SIGINT', 'SIGTERM']) process.once(name, cancel);
     try { await setupOllama(config, { pull, warm: true, write, fetchImpl, signal: signal ?? controller.signal }); }
+    catch (error) {
+      // Local evaluation is the default, not a choice the user made, so a
+      // missing or stopped Ollama should say how to pick another evaluator.
+      if (!explicitEvaluator && !mergeExisting && !signal?.aborted) {
+        error.message = `${error.message} Local Ollama is the default evaluator; add --pull to download its model, or use TypeSafe Jev instead: claude-autorouter setup --evaluator jev`;
+      }
+      throw error;
+    }
     finally { if (!signal) for (const name of ['SIGINT', 'SIGTERM']) process.removeListener(name, cancel); }
   }
   if (signal?.aborted) throw new Error('Setup cancelled');
-  saveUserConfig(values, { env, overwrite, expectedRevision: loaded.revision });
+  let savedStore = values.AUTOROUTER_SECRET_STORE ?? 'file';
+  try {
+    saveUserConfig(values, { env, overwrite, expectedRevision: loaded.revision,
+      removeSecrets: keychainRemovals(loaded, savedStore, { replace, values }), ...store });
+  } catch (error) {
+    // The default must not make setup impossible where the Keychain cannot be
+    // used (locked, headless). An explicit request still fails.
+    if (!defaultedStore || !keys.length || error?.code !== 'AUTOROUTER_CONFIG_ERROR' || !/Keychain/.test(error.message)) throw error;
+    write('The macOS Keychain is unavailable; saving keys in the private configuration file instead. Move them later with: claude-autorouter config set AUTOROUTER_SECRET_STORE keychain');
+    delete values.AUTOROUTER_SECRET_STORE;
+    savedStore = 'file';
+    saveUserConfig(values, { env, overwrite, expectedRevision: loaded.revision,
+      removeSecrets: keychainRemovals(loaded, savedStore, { replace, values }), ...store });
+  }
   write(`Saved ${authMode} configuration to ${path}`);
-  write(`${keys.length ? 'Keys and settings are' : 'Settings are'} stored locally in this file with owner-only permissions. Environment variables take precedence.`);
+  if (keys.length && savedStore === 'keychain') {
+    write('Keys are stored in the macOS Keychain; settings are stored in this file with owner-only permissions. Environment variables take precedence.');
+  } else {
+    write(`${keys.length ? 'Keys and settings are' : 'Settings are'} stored locally in this file with owner-only permissions. Environment variables take precedence.`);
+    if (keys.length && platform === 'darwin' && savedStore === 'file' && !defaultedStore) write('Keys are plaintext in this file. Move them into the macOS Keychain: claude-autorouter config set AUTOROUTER_SECRET_STORE keychain');
+  }
   write('Next: claude-autorouter doctor, then claude-autorouter claude from your project.');
 }
 
 export async function doctor({ env = process.env, write = console.log, run = execute, fetchImpl = fetch, signal,
-  evaluateLocal = false, json = false, diagnosticRunner } = {}) {
+  evaluateLocal = false, json = false, diagnosticRunner, keychain, platform = process.platform } = {}) {
   if (evaluateLocal) {
     try {
       const config = readConfig(loadUserConfig(env).env);
@@ -180,9 +223,14 @@ export async function doctor({ env = process.env, write = console.log, run = exe
   let config;
   let effectiveEnv = env;
   try {
-    const loaded = loadUserConfig(env);
+    const loaded = loadUserConfig(env, keychain ? { keychain } : {});
     effectiveEnv = loaded.env;
     write(`Config: ${loaded.path}${loaded.exists ? '' : ' (absent; using environment)'}`);
+    if (loaded.policyPath) write(`Organization policy: ${loaded.policyPath} (locks: ${loaded.policyLocked.map(key => key.replace('AUTOROUTER_', '')).join(', ') || 'none'}).`);
+    if (loaded.secretStore === 'keychain') write(`Saved secrets: macOS Keychain (${loaded.keychainSecrets.length} found).`);
+    else if (platform === 'darwin' && SECRET_CONFIG_KEYS.some(key => Object.hasOwn(loaded.values, key))) {
+      write('WARN  Saved keys are plaintext in the configuration file. Move them into the macOS Keychain: claude-autorouter config set AUTOROUTER_SECRET_STORE keychain');
+    }
     config = readConfig(effectiveEnv);
     requireKeys(config);
     report(true, `Configuration and required keys present (${config.authMode})`);

package/src/policy.mjs

@@ -0,0 +1,116 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+// Optional organization policy. It lives at a fixed system path that no
+// environment variable can redirect, must be owned by root and not writable by
+// anyone else, and is applied after the saved file and the environment, so
+// neither can override it. This guards against configuration drift and
+// environment-driven changes (direnv, devcontainers, CI variables). It does not
+// stop someone who can run modified code; pair it with device management.
+const ALLOWLISTS = Object.freeze({
+  allowed_evaluators: { key: 'AUTOROUTER_EVALUATOR', fallback: 'ollama', values: ['jev', 'ollama'] },
+  allowed_auth_modes: { key: 'AUTOROUTER_AUTH_MODE', fallback: 'api-key', values: ['api-key', 'subscription'] },
+});
+const LOCKS = Object.freeze({
+  session_log_mode: { key: 'AUTOROUTER_SESSION_LOG_MODE', values: ['metadata', 'prompts'] },
+  upstream_url: { key: 'AUTOROUTER_UPSTREAM_URL' },
+  jev_url: { key: 'AUTOROUTER_JEV_URL' },
+});
+export const POLICY_KEYS = Object.freeze([...Object.keys(ALLOWLISTS), ...Object.keys(LOCKS)]);
+
+function policyError(message) {
+  const error = new Error(message);
+  error.code = 'AUTOROUTER_CONFIG_ERROR';
+  return error;
+}
+
+export function defaultPolicyPath(platform = process.platform) {
+  return platform === 'darwin'
+    ? '/Library/Application Support/claude-autorouter/policy.json'
+    : '/etc/claude-autorouter/policy.json';
+}
+
+function checkTrusted(path, trustedUid) {
+  for (const [target, kind] of [[path, 'file'], [dirname(path), 'directory']]) {
+    const stat = lstatSync(target);
+    const typeOk = kind === 'file' ? stat.isFile() : stat.isDirectory();
+    if (stat.isSymbolicLink() || !typeOk || stat.uid !== trustedUid || (stat.mode & 0o022) !== 0) {
+      throw policyError(`The AutoRouter organization policy ${kind} must be a regular ${kind} owned by root and not writable by group or others. Refusing to start.`);
+    }
+  }
+}
+
+function validate(parsed) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw policyError('The AutoRouter organization policy must be a JSON object.');
+  const policy = {};
+  for (const name of Object.keys(parsed)) {
+    if (!POLICY_KEYS.includes(name)) throw policyError('The AutoRouter organization policy contains an unsupported key.');
+  }
+  for (const [name, { values }] of Object.entries(ALLOWLISTS)) {
+    if (parsed[name] === undefined) continue;
+    const list = parsed[name];
+    if (!Array.isArray(list) || !list.length || list.some(value => !values.includes(value))) {
+      throw policyError(`Policy ${name} must be a nonempty list of: ${values.join(', ')}.`);
+    }
+    policy[name] = [...new Set(list)];
+  }
+  for (const [name, { values }] of Object.entries(LOCKS)) {
+    if (parsed[name] === undefined) continue;
+    const value = parsed[name];
+    const valid = values ? values.includes(value)
+      : typeof value === 'string' && /^https?:\/\/[^\s]+$/.test(value) && !/[\u0000-\u001f\u007f]/.test(value);
+    if (!valid) throw policyError(`Policy ${name} has an invalid value.`);
+    policy[name] = value;
+  }
+  return policy;
+}
+
+/**
+ * Returns undefined when no policy file exists. A file that exists but cannot
+ * be trusted or parsed is an error: policy fails closed.
+ */
+export function loadPolicy({ path = defaultPolicyPath(), trustedUid = 0 } = {}) {
+  let content;
+  try {
+    lstatSync(path);
+  } catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return undefined;
+    throw policyError(`Could not read the AutoRouter organization policy (${error.code ?? 'error'}). Refusing to start.`);
+  }
+  try {
+    checkTrusted(path, trustedUid);
+    content = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'AUTOROUTER_CONFIG_ERROR') throw error;
+    throw policyError('Could not read the AutoRouter organization policy. Refusing to start.');
+  }
+  let parsed;
+  try { parsed = JSON.parse(content); }
+  catch { throw policyError('The AutoRouter organization policy must contain valid JSON.'); }
+  return { path, values: validate(parsed) };
+}
+
+/**
+ * Enforce allowlists (an unlisted choice is an error) and apply locks (the
+ * policy value replaces whatever the file or environment supplied). Commands
+ * that repair a configuration pass allowlists: false and check new values
+ * themselves, so a disallowed saved setting can still be corrected.
+ */
+export function applyPolicy(env, policy, { allowlists = true } = {}) {
+  const result = { ...env };
+  const locked = [];
+  for (const [name, { key, fallback }] of Object.entries(ALLOWLISTS)) {
+    const allowed = policy[name];
+    if (!allowed || !allowlists) continue;
+    const value = result[key] ?? fallback;
+    if (!allowed.includes(value)) {
+      throw policyError(`${key} is not permitted by the AutoRouter organization policy. Allowed: ${allowed.join(', ')}.`);
+    }
+  }
+  for (const [name, { key }] of Object.entries(LOCKS)) {
+    if (policy[name] === undefined) continue;
+    result[key] = policy[name];
+    locked.push(key);
+  }
+  return { env: result, locked };
+}

package/src/prompt-state.mjs

@@ -1,3 +1,5 @@
+import { redactSensitive } from './redaction.mjs';
+
 // Claude Code prepends these as separate text blocks. Ignore only complete
 // wrapper blocks; a user's text that mentions a tag or mixes it with a task
 // must remain part of the classifier's input.
@@ -51,6 +53,16 @@ function excerpt(text, length) {
 
 const textCost = text => JSON.stringify(text).length - 2;
 
+// Redact before excerpting so a value cannot be split into an unrecognizable
+// fragment. Very long text keeps only end windows wider than any retained
+// excerpt; the margin also keeps a value cut at a window edge out of the result.
+const REDACTION_MARGIN = 4096;
+function classifierText(text, limit) {
+  const span = limit + REDACTION_MARGIN;
+  if (text.length > 2 * span) text = `${text.slice(0, span)}\n[... omitted ...]\n${text.slice(-span)}`;
+  return redactSensitive(text);
+}
+
 // Budget serialized characters, including JSON escaping, rather than just
 // raw text length. The two ends keep both an initial instruction and a final
 // question visible when one long text block must be shortened.
@@ -145,6 +157,9 @@ export function promptExcerpt(body, maxChars = 500) {
     const blocks = typeof content === 'string' ? [{ type: 'text', text: content }]
       : Array.isArray(content) ? content : [];
     const characters = [];
+    // Collect past the retained length: redaction must see a value that
+    // straddles the final boundary, and may shorten the text before the cut.
+    const window = maxChars + REDACTION_MARGIN;
     let nonText = false;
     for (const block of blocks) {
       if (block?.type !== 'text' || typeof block.text !== 'string') {
@@ -157,12 +172,12 @@ export function promptExcerpt(body, maxChars = 500) {
       if (!/\S/.test(value) || isReminderBlock(value)) continue;
       if (characters.length) characters.push('\n');
       for (const character of value) {
-        if (characters.length >= maxChars) break;
+        if (characters.length >= window) break;
         characters.push(character);
       }
-      if (characters.length >= maxChars) break;
+      if (characters.length >= window) break;
     }
-    if (characters.length) return characters.join('').toWellFormed();
+    if (characters.length) return [...redactSensitive(characters.join('').toWellFormed())].slice(0, maxChars).join('').toWellFormed();
     // An image/document-only human turn is a new task with no safe excerpt;
     // do not incorrectly label it with the preceding human task's text.
     if (nonText) return '';
@@ -196,9 +211,9 @@ export function buildState(body, limit = 12000) {
   const remaining = () => Math.max(0, limit - JSON.stringify(state).length);
   // Reserve more than half of the budget for the actual latest human task
   // before considering reminders, original instructions, or tool results.
-  state.current_task = fitText(currentTask, Math.min(remaining(), Math.floor(limit * 0.55)));
-  state.original_task = fitText(firstTask, Math.min(2000, Math.floor(remaining() * 0.3)));
-  state.system = fitText(contentText(body.system, true), Math.min(1000, Math.floor(remaining() * 0.3)));
+  state.current_task = fitText(classifierText(currentTask, limit), Math.min(remaining(), Math.floor(limit * 0.55)));
+  state.original_task = fitText(classifierText(firstTask, limit), Math.min(2000, Math.floor(remaining() * 0.3)));
+  state.system = fitText(classifierText(contentText(body.system, true), limit), Math.min(1000, Math.floor(remaining() * 0.3)));
 
   for (let index = messages.length - 1; index >= 0 && state.recent_messages.length < 8; index--) {
     // current_task already contains this message; leave room for actual
@@ -210,7 +225,7 @@ export function buildState(body, limit = 12000) {
     const overhead = JSON.stringify(entry).length + (state.recent_messages.length ? 1 : 0);
     const budget = Math.min(3000, remaining() - overhead);
     if (budget < 1) break;
-    entry.content = fitText(text, budget);
+    entry.content = fitText(classifierText(text, limit), budget);
     state.recent_messages.unshift(entry);
   }
   return state;

package/src/redaction.mjs

@@ -0,0 +1,97 @@
+// @ts-check
+// Pattern-based redaction for evaluator excerpts. Classification needs the
+// shape of a task, not credentials or personal identifiers, so recognizable
+// values are replaced before any excerpt leaves the inference path. This is a
+// best-effort filter: unrecognized formats can remain, and code that merely
+// resembles an assignment can be over-redacted. Every quantifier is bounded or
+// excludes its delimiter, so scanning stays linear in the input length.
+
+const marker = kind => `[REDACTED:${kind}]`;
+
+function ibanValid(value) {
+  const compact = value.replace(/ /g, '');
+  if (compact.length < 15 || compact.length > 34) return false;
+  const rearranged = compact.slice(4) + compact.slice(0, 4);
+  let remainder = 0;
+  for (const character of rearranged) {
+    const digits = /[0-9]/.test(character) ? character : String(character.charCodeAt(0) - 55);
+    for (const digit of digits) remainder = (remainder * 10 + Number(digit)) % 97;
+  }
+  return remainder === 1;
+}
+
+function luhnValid(value) {
+  const digits = value.replace(/[ -]/g, '');
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0;
+  for (let i = 0; i < digits.length; i++) {
+    let digit = Number(digits[digits.length - 1 - i]);
+    if (i % 2 === 1) { digit *= 2; if (digit > 9) digit -= 9; }
+    sum += digit;
+  }
+  return sum % 10 === 0;
+}
+
+const base64 = code => (code >= 48 && code <= 57) || (code >= 65 && code <= 90) || (code >= 97 && code <= 122)
+  || code === 43 || code === 47 || code === 61;
+
+// Key material whose BEGIN line was cut off before the excerpt: walk back from
+// each END line over whole base64 lines. A regex line repetition would
+// backtrack quadratically on a long base64 run that is not followed by END.
+function redactKeyTails(text) {
+  const end = /-----END [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----/g;
+  let output = '', copied = 0;
+  for (let match; (match = end.exec(text));) {
+    let start = match.index;
+    while (start > copied && text[start - 1] === '\n') {
+      let lineEnd = start - 1;
+      if (lineEnd > copied && text[lineEnd - 1] === '\r') lineEnd--;
+      let lineStart = lineEnd;
+      while (lineStart > copied && base64(text.charCodeAt(lineStart - 1))) lineStart--;
+      if (lineEnd - lineStart < 16 || (lineStart > copied && text[lineStart - 1] !== '\n')) break;
+      start = lineStart;
+    }
+    if (start === match.index) continue;
+    output += text.slice(copied, start) + marker('private_key');
+    copied = end.lastIndex;
+  }
+  return copied ? output + text.slice(copied) : text;
+}
+
+/** @type {ReadonlyArray<readonly [RegExp, string | ((...match: string[]) => string)] | ((text: string) => string)>} */
+const RULES = Object.freeze([
+  // A block cut off by excerpting is still redacted through the end of text.
+  [/-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----|$)/g, marker('private_key')],
+  redactKeyTails,
+  [/\b([a-z][a-z0-9+.-]{1,20}:\/\/)[^\s:@/]{1,256}:[^\s@/]{1,256}@/gi, (_, scheme) => `${scheme}${marker('credentials')}@`],
+  [/\bsk-[A-Za-z0-9_-]{20,}/g, marker('secret')],
+  [/\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/g, marker('secret')],
+  [/\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g, marker('secret')],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{22,})/g, marker('secret')],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g, marker('secret')],
+  [/\bxox[abposr]-[A-Za-z0-9-]{10,}/g, marker('secret')],
+  [/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]{8,}/g, marker('secret')],
+  [/\bAIza[0-9A-Za-z_-]{35}/g, marker('secret')],
+  [/\bnpm_[A-Za-z0-9]{36}/g, marker('secret')],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, marker('secret')],
+  [/\b((?:proxy-)?authorization["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:(Bearer|Basic|Token|Digest)[ \t]+)?[^\s"',;]{4,}/gi,
+    (_, prefix, scheme) => `${prefix}${scheme ? `${scheme} ` : ''}${marker('secret')}`],
+  [/\b(Bearer[ \t]+)[A-Za-z0-9._~+/-]{16,}=*/g, (_, prefix) => `${prefix}${marker('secret')}`],
+  // Keep the setting name: it tells the classifier what kind of work this is.
+  [/\b([A-Za-z0-9_.-]{0,40}(?:passw(?:or)?d|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|credentials?)[A-Za-z0-9_.-]{0,40})(["']?[ \t]{0,8}[:=][ \t]{0,8})(["']?)[^\s"',;]{4,}/gi,
+    (_, name, separator, quote) => `${name}${separator}${quote}${marker('secret')}`],
+  [/\b[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g, marker('email')],
+  [/\b[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g, match => ibanValid(match) ? marker('iban') : match],
+  // Major card networks only, so millisecond timestamps and IDs survive.
+  [/\b(?:4|5[1-5]|2[2-7]|3[47]|6)(?:[0-9][ -]?){11,17}[0-9]\b/g, match => luhnValid(match) ? marker('card') : match],
+]);
+
+/** @param {string} text */
+export function redactSensitive(text) {
+  let result = text;
+  for (const rule of RULES) {
+    // @ts-ignore String.replace accepts either replacement form.
+    result = typeof rule === 'function' ? rule(result) : result.replace(rule[0], rule[1]);
+  }
+  return result;
+}

package/src/router.mjs

@@ -191,7 +191,7 @@ export class Router {
     // Include live configuration/rubric facts so configuration changes cannot
     // reuse cached decisions from another evaluator, account or confidence rule.
     const c = this.config;
-    const evaluator = c.evaluator ?? 'jev';
+    const evaluator = c.evaluator ?? 'ollama';
     const settings = evaluator === 'ollama'
       ? { evaluator, ollamaEndpoint: c.ollamaEndpoint, ollamaModel: c.ollamaModel, ollamaTimeoutMs: c.ollamaTimeoutMs,
         ollamaStateChars: c.ollamaStateChars, ollamaKeepAlive: c.ollamaKeepAlive }

package/src/server.mjs

@@ -47,8 +47,10 @@ function readBody(req, limit) {
 
 function jsonError(res, status, message) {
   if (res.headersSent || res.destroyed) { res.destroy(); return; }
-  res.writeHead(status, { 'content-type': 'application/json' });
+  // An oversized body is no longer read; close rather than keep the socket.
+  res.writeHead(status, { 'content-type': 'application/json', ...(status === 413 ? { connection: 'close' } : {}) });
   res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message } }));
+  if (status === 413) res.once('finish', () => res.socket?.destroy());
 }
 
 function upstreamHeaders(incoming, config) {

package/src/session-history.mjs

@@ -231,7 +231,8 @@ export async function sessionsCommand(args, { env = process.env, write = console
     || (operation === 'list' ? positional.length !== 0 : positional.length !== 1)) {
     throw new Error('Usage: claude-autorouter sessions list [--json] | sessions show ID [--json]');
   }
-  const loaded = loadUserConfig(env, { allowMissing: true });
+  // History needs only the log directory; never prompt for keychain access.
+  const loaded = loadUserConfig(env, { allowMissing: true, readSecrets: false, enforcePolicy: false });
   const directory = parseSessionLogDir(loaded.env.AUTOROUTER_SESSION_LOG_DIR);
   if (!directory) {
     const report = { schema_version: 1, type: 'session_history', logging_enabled: false, sessions: [],