claude-autorouter 0.4.0 → 0.5.1

package/src/status-cleanup.mjs

@@ -0,0 +1,65 @@
+import * as fileSystem from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// A launcher that is killed hard (SIGKILL, power loss) cannot delete its
+// private status directory, which also holds the rewritten Claude settings.
+// The next launch removes directories whose owning process is gone. Only
+// directories this user created, with owner-only permissions, are considered.
+const PREFIX = 'autorouter-status-';
+const MAX_ENTRIES = 200;
+const SNAPSHOT_LIMIT = 1024 * 1024;
+// Without a readable snapshot, wait before treating a directory as abandoned so
+// a launch that is still starting is never removed.
+const UNREADABLE_GRACE_MS = 10 * 60 * 1000;
+// A reused process ID can look alive. The heartbeat is written every few
+// seconds, so a snapshot this old belongs to an earlier process even if a
+// sleeping machine suspended the real one for a while.
+const HEARTBEAT_STALE_MS = 24 * 60 * 60 * 1000;
+
+const defaultAlive = pid => {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+};
+
+async function readSnapshot(io, path) {
+  let handle;
+  try {
+    handle = await io.open(path, 'r');
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > SNAPSHOT_LIMIT) return undefined;
+    return JSON.parse(await handle.readFile('utf8'));
+  } catch { return undefined; }
+  finally { try { await handle?.close(); } catch {} }
+}
+
+/**
+ * Best effort and never throws. Returns the number of directories removed.
+ * @param {{directory?:string,io?:typeof fileSystem,alive?:(pid:number)=>boolean,now?:number,uid?:number}} [options]
+ */
+export async function removeStaleStatusDirectories({
+  directory = tmpdir(), io = fileSystem, alive = defaultAlive, now = Date.now(), uid = process.getuid?.(),
+} = {}) {
+  let removed = 0;
+  try {
+    if (uid === undefined) return 0;
+    const names = (await io.readdir(directory)).filter(name => name.startsWith(PREFIX)).slice(0, MAX_ENTRIES);
+    for (const name of names) {
+      try {
+        const path = join(directory, name);
+        const stat = await io.lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== uid || (stat.mode & 0o077) !== 0) continue;
+        const snapshot = await readSnapshot(io, join(path, 'state.json'));
+        const pid = snapshot?.pid;
+        let stale;
+        if (Number.isSafeInteger(pid) && pid > 0) {
+          const heartbeat = Number.isFinite(snapshot.heartbeat_at) ? snapshot.heartbeat_at : 0;
+          stale = !alive(pid) || now - heartbeat > HEARTBEAT_STALE_MS;
+        } else stale = now - stat.mtimeMs > UNREADABLE_GRACE_MS;
+        if (!stale) continue;
+        await io.rm(path, { recursive: true, force: true });
+        removed++;
+      } catch {}
+    }
+  } catch {}
+  return removed;
+}

package/src/telemetry-event.mjs

@@ -1,4 +1,5 @@
 // @ts-check
+import { redactSensitive } from './redaction.mjs';
 // Shared, bounded telemetry contract. Never copy request bodies, headers, raw
 // errors or arbitrary provider fields into status snapshots or saved history.
 export const TELEMETRY_SCHEMA_VERSION = 2;
@@ -161,6 +162,9 @@ export function normalizeTelemetryEvent(entry) {
 function excerpt(value) {
   let text = '', length = 0;
   if (typeof value !== 'string') return { text, truncated: false };
+  // Defense in depth, and it also covers records written before redaction
+  // existed when they are read back. Already-redacted text is unchanged.
+  value = redactSensitive(value);
   for (const character of value) {
     if (length++ === 500) return { text: text.toWellFormed(), truncated: true };
     text += character;

package/src/user-config.mjs

@@ -5,9 +5,11 @@ import {
 import { createHash, randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { createKeychain } from './keychain.mjs';
+import { applyPolicy, loadPolicy } from './policy.mjs';
 
 export const CONFIG_KEYS = Object.freeze([
-  'AUTOROUTER_AUTH_MODE', 'AUTOROUTER_CLIENT_PROFILE',
+  'AUTOROUTER_AUTH_MODE', 'AUTOROUTER_CLIENT_PROFILE', 'AUTOROUTER_SECRET_STORE',
   'ANTHROPIC_API_KEY', 'TYPESAFE_API_KEY', 'AUTOROUTER_TOKEN',
   'AUTOROUTER_UPSTREAM_URL', 'AUTOROUTER_JEV_URL', 'AUTOROUTER_JEV_MODEL',
   'AUTOROUTER_HAIKU_MODEL', 'AUTOROUTER_SONNET_MODEL', 'AUTOROUTER_OPUS_MODEL',
@@ -19,7 +21,13 @@ export const CONFIG_KEYS = Object.freeze([
   'AUTOROUTER_OLLAMA_TIMEOUT_MS', 'AUTOROUTER_OLLAMA_KEEP_ALIVE',
 ]);
 export const SECRET_CONFIG_KEYS = Object.freeze(['ANTHROPIC_API_KEY', 'TYPESAFE_API_KEY', 'AUTOROUTER_TOKEN']);
+export const SECRET_STORES = Object.freeze(['file', 'keychain']);
 const allowedKeys = new Set(CONFIG_KEYS);
+const defaultKeychain = createKeychain();
+// Items are scoped to one configuration file, so separate configurations
+// (including test fixtures) never share or overwrite each other's secrets.
+const keychainAccount = (path, key) => `${key}:${createHash('sha256').update(path).digest('hex').slice(0, 16)}`;
+const keychainLabel = (path, key) => `AutoRouter ${key} (${path})`;
 const revision = content => createHash('sha256').update(content).digest('hex');
 const SAFE_FS_CODES = new Set([
   'EACCES', 'EPERM', 'ENOENT', 'ENOTDIR', 'EISDIR', 'ENOSPC', 'EROFS',
@@ -57,6 +65,9 @@ function validate(values) {
     }
     validated[key] = descriptor.value;
   }
+  if (validated.AUTOROUTER_SECRET_STORE !== undefined && !SECRET_STORES.includes(validated.AUTOROUTER_SECRET_STORE)) {
+    throw configError('AUTOROUTER_SECRET_STORE must be file or keychain.');
+  }
   return validated;
 }
 
@@ -74,14 +85,20 @@ export function getConfigPath(env = process.env) {
   return join(xdg || join(homedir(), '.config'), 'claude-autorouter', 'config.json');
 }
 
-export function loadUserConfig(env = process.env, { allowMissing = false } = {}) {
+// The saved store setting decides where saved secrets live; the environment
+// only overrides values. With the keychain store, `values` includes secrets
+// read from the keychain so callers can update settings without losing them.
+function readUserConfig(env, { allowMissing = false, readSecrets = true, keychain = defaultKeychain } = {}) {
   const path = getConfigPath(env);
   let content;
   try {
     content = readFileSync(path, 'utf8');
   } catch (error) {
     if (error.code === 'ENOENT') {
-      if (env.AUTOROUTER_CONFIG === undefined || allowMissing) return { env: { ...env }, values: {}, path, exists: false, revision: null };
+      if (env.AUTOROUTER_CONFIG === undefined || allowMissing) {
+        return { env: { ...env }, values: {}, path, exists: false, revision: null,
+          secretStore: 'file', keychainSecrets: [], unavailableSecrets: [] };
+      }
       throw configError('AUTOROUTER_CONFIG points to a missing configuration file.');
     }
     throw filesystemError(error, 'read');
@@ -90,7 +107,48 @@ export function loadUserConfig(env = process.env, { allowMissing = false } = {})
   try { parsed = JSON.parse(content); }
   catch { throw configError('AutoRouter configuration must contain valid JSON.'); }
   const values = validate(parsed);
-  return { env: { ...values, ...env }, values, path, exists: true, revision: revision(content) };
+  const secretStore = values.AUTOROUTER_SECRET_STORE ?? 'file';
+  const keychainSecrets = [], unavailableSecrets = [];
+  if (secretStore === 'keychain' && readSecrets) {
+    for (const key of SECRET_CONFIG_KEYS) {
+      if (Object.hasOwn(values, key)) continue;
+      let value;
+      try { value = keychain.read(keychainAccount(path, key)); }
+      catch (error) {
+        // An environment value can stand in for a locked keychain, such as
+        // over SSH. Only a missing required value stops the caller.
+        if (env[key] !== undefined) { unavailableSecrets.push(key); continue; }
+        throw error;
+      }
+      if (value !== undefined) { values[key] = value; keychainSecrets.push(key); }
+    }
+  }
+  return { env: { ...values, ...env }, values, path, exists: true, revision: revision(content),
+    secretStore, keychainSecrets, unavailableSecrets };
+}
+
+// An organization policy, when present, is applied last. Its allowlists reject
+// a disallowed choice and its locks replace file and environment values, so
+// every consumer of the effective environment sees the enforced settings.
+// `policy` options exist for tests; production always uses the system path.
+export function loadUserConfig(env = process.env, { policy: policyOptions, enforcePolicy = true, ...options } = {}) {
+  const policy = loadPolicy(policyOptions);
+  const loaded = readUserConfig(env, options);
+  if (!policy) return loaded;
+  const applied = applyPolicy(loaded.env, policy.values, { allowlists: enforcePolicy });
+  return { ...loaded, env: applied.env, policy: policy.values, policyPath: policy.path, policyLocked: applied.locked };
+}
+
+// Keychain items to delete when saving `nextStore`, given what was loaded.
+// Moving between stores needs every saved secret, so refuse while one could
+// not be read; deleting it unseen would lose it.
+export function keychainRemovals(loaded, nextStore, { replace = false, values = {} } = {}) {
+  if (loaded.secretStore !== 'keychain') return [];
+  if (nextStore !== 'keychain' && loaded.unavailableSecrets?.length) {
+    throw configError('Could not read every saved secret from the macOS Keychain. Unlock the login keychain and retry.');
+  }
+  if (nextStore !== 'keychain') return [...loaded.keychainSecrets];
+  return replace ? loaded.keychainSecrets.filter(key => !Object.hasOwn(values, key)) : [];
 }
 
 function existingFile(path) {
@@ -102,8 +160,17 @@ function existingFile(path) {
   return stat;
 }
 
-export function saveUserConfig(values, { env = process.env, overwrite = false, expectedRevision } = {}) {
+// With the keychain store, secrets are written to the keychain before the file
+// (an interrupted move leaves both copies, never neither) and stale items are
+// removed only after the file is saved.
+export function saveUserConfig(values, {
+  env = process.env, overwrite = false, expectedRevision, removeSecrets = [], keychain = defaultKeychain,
+} = {}) {
   const validated = validate(values);
+  const store = validated.AUTOROUTER_SECRET_STORE ?? 'file';
+  const keychainKeys = store === 'keychain' ? SECRET_CONFIG_KEYS.filter(key => Object.hasOwn(validated, key)) : [];
+  const fileValues = { ...validated };
+  for (const key of keychainKeys) delete fileValues[key];
   const path = getConfigPath(env);
   const parent = dirname(path);
   let temporary;
@@ -118,13 +185,17 @@ export function saveUserConfig(values, { env = process.env, overwrite = false, e
       throw configError('AutoRouter configuration already exists; use overwrite to replace it.');
     }
     checkRevision();
+    if (store === 'keychain' && !keychain.available) {
+      throw configError('The macOS Keychain secret store is available only on macOS.');
+    }
+    for (const key of keychainKeys) keychain.write(keychainAccount(path, key), validated[key], keychainLabel(path, key));
     // mkdir leaves existing directory permissions unchanged. Only directories
     // created for this configuration receive the private creation mode.
     mkdirSync(parent, { recursive: true, mode: 0o700 });
     temporary = join(parent, `.${basename(path)}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`);
     descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
     fchmodSync(descriptor, 0o600);
-    writeFileSync(descriptor, `${JSON.stringify(validated, null, 2)}\n`, 'utf8');
+    writeFileSync(descriptor, `${JSON.stringify(fileValues, null, 2)}\n`, 'utf8');
     fsyncSync(descriptor);
     closeSync(descriptor);
     descriptor = undefined;
@@ -143,6 +214,9 @@ export function saveUserConfig(values, { env = process.env, overwrite = false, e
       // symlink can never be replaced by the default save operation.
       linkSync(temporary, path);
     }
+    for (const key of removeSecrets) {
+      if (SECRET_CONFIG_KEYS.includes(key) && !keychainKeys.includes(key)) keychain.remove(keychainAccount(path, key));
+    }
     return path;
   } catch (error) {
     if (error?.code === 'EEXIST') {