claude-autorouter 0.5.0 → 0.5.1

package/.env.example

@@ -3,7 +3,7 @@ AUTOROUTER_AUTH_MODE=subscription
 AUTOROUTER_CLIENT_PROFILE=compatible
 # Local Ollama is the default evaluator (experimental; see settings below).
 # Set jev to use TypeSafe's hosted evaluator, which needs TYPESAFE_API_KEY.
-AUTOROUTER_EVALUATOR=jev
+AUTOROUTER_EVALUATOR=ollama
 # The launcher enables the router status line for this session. Set 0 to keep your own.
 AUTOROUTER_STATUSLINE=1
 # Claude's Auto permission mode needs a supported Sonnet or Opus client.
@@ -14,10 +14,12 @@ AUTOROUTER_STATUSLINE=1
 # Optional metadata logs on stderr. Redirect stderr to a file when using the UI.
 # AUTOROUTER_DEBUG=1
 # Optional persistent JSONL decisions/outcomes, one file per session per launch.
-# Includes up to 500 characters of user prompt text; keep the directory local.
+# Defaults to metadata only. Set AUTOROUTER_SESSION_LOG_MODE=prompts to include
+# up to 500 characters of user prompt text; keep the directory local.
 # Unset or empty disables logging. This does not print prompts in the terminal.
 # AUTOROUTER_SESSION_LOG_DIR=/absolute/path/to/autorouter-sessions
-# Omit all prompt excerpt fields (does not enable logging by itself).
+# metadata (default) omits prompt excerpt fields; prompts includes them.
+# Setting a mode does not enable logging by itself.
 # AUTOROUTER_SESSION_LOG_MODE=metadata
 # Optional: allow two tool-free Stop-hook continuations, then end the turn on
 # the third block. Applies to /goal and all Stop/SubagentStop hooks.

package/README.md

@@ -4,7 +4,7 @@ An independent local model-routing gateway for Claude Code. AutoRouter is not af
 
 Use Haiku, Sonnet and Opus in one Claude Code session. AutoRouter evaluates each coding request, checks model compatibility and context capacity, and forwards it through a local gateway. Native Ollama `/v1/systemone` models are the default, experimental local evaluator, so task excerpts stay on your machine; [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is an optional hosted evaluator (`setup --evaluator jev`). Claude owns authentication, tool permissions and safety review.
 
-Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The default evaluator also needs a [TypeSafe API key](https://console.typesafe.ai). The installed CLI has no runtime dependencies.
+Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The optional Jev evaluator needs a [TypeSafe API key](https://console.typesafe.ai). The installed CLI has no runtime dependencies.
 
 Version 0.4.0 adds `config`, `sessions` and `doctor --evaluate-local`, durable task continuity, and clearer model outcomes. Upgrade from 0.3.x to use these commands. The [contributor guide](CONTRIBUTING.md) explains local verification, and the [release guide](docs/releasing.md) covers the changes and verified publication.
 

package/SECURITY.md

@@ -16,8 +16,10 @@ Relevant reports include credential exposure, unauthorized access to the local g
 
 ## Handling diagnostic data
 
+Organizations can enforce the evaluator, authentication mode, upstream and log mode with a root-owned policy file that environment variables and saved settings cannot override. See [organization policy](docs/reference.md#organization-policy).
+
 AutoRouter's default evaluator is local Ollama, which keeps classification on loopback. The optional hosted Jev evaluator (`--evaluator jev`) receives bounded task/history excerpts, which may contain private code or tool results. Recognizable credentials and personal identifiers are redacted from those excerpts first; this pattern-based filter reduces, but does not eliminate, disclosure. Anthropic still receives the full inference request. See [data flow and authentication](docs/reference.md#data-flow-and-authentication).
 
 New macOS setups keep saved keys in the login Keychain. Existing and non-macOS configurations keep plaintext keys in the private configuration file until you run `claude-autorouter config set AUTOROUTER_SECRET_STORE keychain` (macOS only). See [credential storage](docs/reference.md#credential-storage).
 
-Session logging is optional. Enabling only a log directory uses the default `prompts` mode, which includes bounded human-task excerpts with recognizable credentials and personal identifiers redacted (pattern-based, so not exhaustive). Select `AUTOROUTER_SESSION_LOG_MODE=metadata` before enabling a directory to omit those excerpts. Inspect even metadata-only output before sharing it; identifiers, paths or environment details can still be sensitive. Saved logs have no automatic deletion policy. See [history and privacy](docs/reference.md#session-decision-logs).
+Session logging is optional. Enabling a log directory uses the default `metadata` mode, which omits prompt excerpts. Opting into `AUTOROUTER_SESSION_LOG_MODE=prompts` includes bounded human-task excerpts with recognizable credentials and personal identifiers redacted (pattern-based, so not exhaustive). Inspect even metadata-only output before sharing it; identifiers, paths or environment details can still be sensitive. Saved logs have no automatic deletion policy. See [history and privacy](docs/reference.md#session-decision-logs).

package/bin/autorouter.mjs

@@ -7,6 +7,7 @@ import { createRouterServer, listen } from '../src/server.mjs';
 import { buildClaudeEnv, clientProfileForLaunch, conflictingProviders } from '../src/auth.mjs';
 import { dirname } from 'node:path';
 import { createStatusState } from '../src/status-state.mjs';
+import { removeStaleStatusDirectories } from '../src/status-cleanup.mjs';
 import { addStatusLineSettings } from '../src/status-settings.mjs';
 import { createSessionLog } from '../src/session-log.mjs';
 import { loadUserConfig } from '../src/user-config.mjs';
@@ -100,6 +101,7 @@ if (['--version', '-v', 'version'].includes(command)) {
     const statusEnabled = command === 'claude' && runtimeEnv.AUTOROUTER_STATUSLINE !== '0';
     let claudeArgs = args;
     if (statusEnabled) {
+      await removeStaleStatusDirectories();
       status = createStatusState({ baselineModel: config.models.opus });
       await status.ready;
       if (status.path) {

package/docs/reference.md

@@ -70,7 +70,7 @@ For an environment-only subscription launch, set `AUTOROUTER_AUTH_MODE=subscript
 | `AUTOROUTER_STATUSLINE` | enabled | `0` retains your existing status line |
 | `AUTOROUTER_DEBUG` | off | `1` enables launcher metadata logs on stderr |
 | `AUTOROUTER_SESSION_LOG_DIR` | off | Write per-session JSONL decisions and outcomes into this directory; unset or empty disables it |
-| `AUTOROUTER_SESSION_LOG_MODE` | `prompts` | `metadata` omits prompt excerpts; setting a mode alone does not enable logging |
+| `AUTOROUTER_SESSION_LOG_MODE` | `metadata` | `metadata` omits prompt excerpts; `prompts` includes bounded human-task excerpts; setting a mode alone does not enable logging |
 | `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` | unset; Claude currently uses `8` | Optional cap on consecutive Stop/SubagentStop continuations without tool use; `0` disables the cap |
 | `ENABLE_TOOL_SEARCH` | `true` in launcher when unset | Load MCP tool definitions on demand; explicit values are preserved |
 | `AUTOROUTER_HAIKU_MODEL` | `claude-haiku-4-5-20251001` | Routine tier |
@@ -105,6 +105,24 @@ claude-autorouter config set TYPESAFE_API_KEY
 
 Normal startup validates the selected evaluator; stale settings for the inactive evaluator do not prevent it from starting. `show --check-all` explicitly checks both. Blank numeric settings fail with their setting name; zero retains its documented meaning. `claude-autorouter help COMMAND` gives focused command help. `claude-autorouter claude --help` and `--version` call Claude directly without router setup or credentials.
 
+### Organization policy
+
+An administrator can restrict what users may configure with a policy file at a fixed system path: `/Library/Application Support/claude-autorouter/policy.json` on macOS and `/etc/claude-autorouter/policy.json` on Linux. No environment variable changes this path. The file and its directory must be regular, owned by root, and not writable by group or others; otherwise AutoRouter refuses to start. An invalid or unreadable file also stops it, so a broken policy never silently turns off.
+
+```json
+{
+  "allowed_evaluators": ["ollama"],
+  "allowed_auth_modes": ["subscription"],
+  "session_log_mode": "metadata",
+  "upstream_url": "https://api.anthropic.com",
+  "jev_url": "https://api.typesafe.ai/v1/systemone"
+}
+```
+
+All keys are optional. `allowed_evaluators` and `allowed_auth_modes` reject any other choice, including an unset default, with an error that names the setting. `session_log_mode`, `upstream_url` and `jev_url` replace whatever the saved file or environment supplies; `config show` reports them with source `policy`. `doctor` prints the policy path and the locked settings. `setup` and `config set` refuse to save a disallowed value, but still let a user correct a setting that the policy now forbids.
+
+The policy guards against configuration drift and environment-driven changes such as direnv, devcontainer or CI variables. It does not stop someone who can run modified code, or run Claude Code without AutoRouter. Deploy it with device management, and use it with an allowlist of approved package versions.
+
 ## Ollama evaluator
 
 The local configuration documented here requires AutoRouter 0.3.2 or newer and remains experimental. It uses Ollama's native `/v1/systemone` decision endpoint for every model, replacing the chat backend from 0.2.0. Jev is the optional hosted evaluator, using TypeSafe's `/v1/systemone` endpoint and a TypeSafe API key. Selecting Ollama never silently switches back to Jev. Haiku, Sonnet, or Opus still completes the task through Anthropic.
@@ -145,7 +163,7 @@ claude-autorouter setup --evaluator ollama --ollama-model tev1:4b-q4_K_M --pull
 
 For Nimble, the explicit Q4_K_M tag avoids `nimble:latest`, which currently selects an approximately 9.5 GB Q8 model. For Tev1, `tev1:latest` and `tev1:4b` select approximately 4.5 GB Q8 weights; the explicit `tev1:4b-q4_K_M` tag selects the smaller 4B download. Download size is not resident memory: runtime and context allocations add to it, and other applications need memory too. Downloaded models have their own licenses and are not bundled in this package. In historical tests before 0.3.2 on a 16 GiB M4, Tev1 0.8B matched 18/24 held-out labels at 450 ms median latency within 1,500 ms; 4B matched 22/24 at 3.15 seconds with a separate 10-second deadline. See the [local measurements](ollama-evaluation.md) before choosing a latency deadline.
 
-The endpoint must be loopback (`127.0.0.1`, `localhost`, or `::1`), without a path, credentials, query, or fragment. Cloud model tags and metadata identifying a remote model are rejected before sending task text. Claude and Jev credentials are never attached to Ollama requests.
+The endpoint must be loopback (`127.0.0.1`, `localhost`, or `::1`); `localhost` is converted to `127.0.0.1` so the connection does not depend on name resolution, without a path, credentials, query, or fragment. Cloud model tags and metadata identifying a remote model are rejected before sending task text. Claude and Jev credentials are never attached to Ollama requests.
 
 ### Classification and fallback
 
@@ -210,7 +228,7 @@ In API-key mode, the upstream key stays in the proxy and Claude receives a tempo
 
 The proxy processes authenticated requests in memory, including their authorization headers. Preserving Claude's login flow does not by itself establish that every deployment is permitted. The [provider-policy note](subscription-integration.md#provider-guidance-and-unresolved-scope) records the current documentation and the unresolved scope of model-rewriting subscription forwarding. Jev requires its own TypeSafe credentials and billing, separate from Anthropic authentication.
 
-Routine diagnostic logs contain route, model, timing, usage, and error-category metadata, not prompts, raw responses, or credentials. Opt-in session history is separate and includes task excerpts in its default `prompts` mode. Status snapshots contain routing metadata and token counts in a private temporary directory and are deleted on normal launcher exit. Classification, turn, and token-count caches are held in memory. Claude Code and the external providers have their own storage and logging behavior.
+Routine diagnostic logs contain route, model, timing, usage, and error-category metadata, not prompts, raw responses, or credentials. Opt-in session history is separate and includes task excerpts only in `prompts` mode; the default is `metadata` (changed from `prompts` in 0.5.1; set `AUTOROUTER_SESSION_LOG_MODE=prompts` to keep excerpts). Status snapshots contain routing metadata and token counts in a private temporary directory and are deleted on normal launcher exit. After a hard kill, the next launch removes directories whose process is gone (only your own, owner-only `autorouter-status-*` directories in the temporary directory). Classification, turn, and token-count caches are held in memory. Claude Code and the external providers have their own storage and logging behavior.
 
 ## Routing policy
 
@@ -321,7 +339,7 @@ claude-autorouter sessions show autorouter-session-EXAMPLE --json
 
 Use the exact `id` printed by `sessions list`. Commands need no evaluator credentials and do not contact providers. Human summaries distinguish selected models, observed serving models, confirmed completions, failures, cancellations, and pending/unconfirmed requests. They report routing latency, fallback and override counts, and API-equivalent savings coverage. A selected model or an HTTP 200 alone does not prove successful inference. Old schema-1 decision logs remain readable and explicitly lack outcome evidence.
 
-`prompts` mode preserves the existing excerpt behavior when a log directory is enabled. Main requests retain at most 500 Unicode characters of the human task; recognized tool and goal continuations retain the originating task. Auxiliary, subagent, compaction, workflow, and attachment-only requests have empty excerpts. Metadata mode omits the excerpt fields entirely. Neither mode logs authentication headers, provider replies, full transcripts, or tool payloads. Text entered directly in a prompt can appear in an enabled prompt excerpt.
+`prompts` mode (opt-in) records excerpts when a log directory is enabled. Main requests retain at most 500 Unicode characters of the human task; recognized tool and goal continuations retain the originating task. Auxiliary, subagent, compaction, workflow, and attachment-only requests have empty excerpts. Metadata mode omits the excerpt fields entirely. Neither mode logs authentication headers, provider replies, full transcripts, or tool payloads. Text entered directly in a prompt can appear in an enabled prompt excerpt.
 
 The settings also work with `serve` and every client profile. `setup --session-log-dir DIR --session-log-mode metadata --force` updates an existing configuration. Setup resolves relative directories at setup time; environment-only paths resolve from the launch directory. `AUTOROUTER_SESSION_LOG_DIR=''` disables a saved directory for one launch. Setting only the mode never enables logging. `doctor` reports preferences without creating files.
 

package/docs/releasing.md

@@ -20,6 +20,8 @@ Version `0.4.0` completes the routing, configuration, history and performance im
 
 Version `0.5.0` makes local Ollama the default evaluator and TypeSafe Jev an explicit option (`setup --evaluator jev`), so evaluator excerpts stay on the machine unless the user opts in. **Breaking for environment-only launches** that relied on the implicit Jev default; configurations created by `setup` record their evaluator and are unchanged. Evaluator excerpts and opt-in session-log prompt excerpts are now redacted for recognizable credentials and personal identifiers (pattern-based, not exhaustive). On macOS, new `setup` runs keep saved keys in the login Keychain by default; existing plaintext configurations are not moved implicitly, and `doctor` prints the `config set AUTOROUTER_SECRET_STORE keychain` command to move them. See [credential storage](reference.md#credential-storage) and the [data flow](reference.md#data-flow-and-authentication).
 
+Version `0.5.1` hardens defaults and adds an optional organization policy. **Behavior change:** enabling `AUTOROUTER_SESSION_LOG_DIR` now records metadata only; set `AUTOROUTER_SESSION_LOG_MODE=prompts` to keep prompt excerpts. Saved configurations that already record a mode are unchanged. A root-owned policy file can restrict the evaluator and authentication mode and lock the log mode and service URLs; see [organization policy](reference.md#organization-policy). The next launch removes status directories left by a hard-killed launcher, an Ollama `localhost` endpoint now connects to `127.0.0.1`, an oversized request body closes its connection after the 413 response, and `.env.example` selects the local evaluator to match the default.
+
 The GitHub repository became public on October 6, 2026, after preparation PR #1 merged. That launch created no release tag and published no new npm version. npm publication remains a separate release operation. Its tarball includes runtime source, README, configuration example, license, and shipped documentation; model weights, user configuration, credentials, transcripts, session logs, local artifacts, and test fixtures are excluded. Review each release archive, especially when the package allowlist changes. The public Git repository also exposes history, development scripts and tests; the npm archive allowlist does not govern that material.
 
 ## What runs automatically

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-autorouter",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "license": "Apache-2.0",
   "type": "module",
   "description": "AutoRouter: a local model-routing gateway for Claude Code with Jev and Ollama System One evaluators",

package/src/config-command.mjs

@@ -2,6 +2,7 @@ import { readConfig, parseSessionLogDir, parseStopHookBlockCap } from './config.
 import { CONFIG_KEYS, SECRET_CONFIG_KEYS, SECRET_STORES, keychainRemovals, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { modelCapabilities } from './model-catalog.mjs';
 import { askSecret } from './onboarding.mjs';
+import { applyPolicy } from './policy.mjs';
 
 const secretKey = key => SECRET_CONFIG_KEYS.includes(key);
 const providerFor = key => key.startsWith('AUTOROUTER_OLLAMA_') ? 'ollama'
@@ -35,7 +36,8 @@ export function configReport(loaded, env, { checkAll = false } = {}) {
   for (const key of CONFIG_KEYS) {
     const saved = loaded.keychainSecrets?.includes(key) ? 'keychain' : 'file';
     // The saved store setting governs saved secrets; the environment cannot redirect it.
-    const source = env[key] !== undefined && key !== 'AUTOROUTER_SECRET_STORE' ? 'environment'
+    const source = loaded.policyLocked?.includes(key) ? 'policy'
+      : env[key] !== undefined && key !== 'AUTOROUTER_SECRET_STORE' ? 'environment'
       : Object.hasOwn(loaded.values, key) ? saved : 'default';
     const provider = providerFor(key);
     const active = (!provider || provider === config.evaluator)
@@ -57,7 +59,8 @@ export function configReport(loaded, env, { checkAll = false } = {}) {
     try { readConfig(loaded.env, { validateAll: true }); }
     catch (failure) { valid = false; error = failure.message; }
   }
-  return { schema_version: 1, config_path: loaded.path, config_exists: loaded.exists, valid,
+  return { schema_version: 1, config_path: loaded.path, config_exists: loaded.exists,
+    ...(loaded.policyPath ? { policy_path: loaded.policyPath } : {}), valid,
     checked: checkAll ? 'all_evaluators' : 'active_evaluator', settings, warnings,
     ...(error ? { error } : {}),
   };
@@ -94,9 +97,9 @@ function normalizedValue(key, value) {
 }
 
 export async function configCommand(args, {
-  env = process.env, write = console.log, input = process.stdin, promptSecret = askSecret, keychain,
+  env = process.env, write = console.log, input = process.stdin, promptSecret = askSecret, keychain, policy,
 } = {}) {
-  const store = keychain ? { keychain } : {};
+  const store = { ...(keychain ? { keychain } : {}), ...(policy ? { policy } : {}) };
   const [operation, ...rest] = args;
   if (operation === 'show') {
     if (rest.some(arg => !['--json', '--check-all'].includes(arg))) throw new Error('Usage: claude-autorouter config show [--json] [--check-all]');
@@ -130,7 +133,7 @@ export async function configCommand(args, {
     throw new Error('Secret values are not accepted as command arguments. Use --stdin or the hidden prompt.');
   }
   if (operation === 'set' && !secretKey(key) && (value === undefined || value === '--stdin')) throw new Error('Nonsecret settings require a value argument.');
-  const loaded = loadUserConfig(env, { allowMissing: true, ...store });
+  const loaded = loadUserConfig(env, { allowMissing: true, enforcePolicy: false, ...store });
   const next = { ...loaded.values };
   if (operation === 'unset') delete next[key];
   else next[key] = normalizedValue(key, secretKey(key)
@@ -140,6 +143,7 @@ export async function configCommand(args, {
   // mask it. An explicitly edited inactive provider is checked too.
   const provider = operation === 'set' ? providerFor(key) : undefined;
   readConfig({ ...next, ...(provider ? { AUTOROUTER_EVALUATOR: provider } : {}) });
+  if (loaded.policy) applyPolicy(next, loaded.policy);
   const nextStore = next.AUTOROUTER_SECRET_STORE ?? 'file';
   // Changing the store moves saved secrets; unsetting a secret deletes its item.
   const removeSecrets = key === 'AUTOROUTER_SECRET_STORE' ? keychainRemovals(loaded, nextStore)

package/src/config.mjs

@@ -58,7 +58,7 @@ function modelName(value, name) {
  * @returns {import('./contracts.mjs').RouterConfig}
  */
 export function readConfig(env = process.env, { validateAll = false } = {}) {
-  const sessionLogMode = env.AUTOROUTER_SESSION_LOG_MODE === undefined ? 'prompts' : env.AUTOROUTER_SESSION_LOG_MODE;
+  const sessionLogMode = env.AUTOROUTER_SESSION_LOG_MODE === undefined ? 'metadata' : env.AUTOROUTER_SESSION_LOG_MODE;
   if (sessionLogMode !== 'metadata' && sessionLogMode !== 'prompts') throw new Error('AUTOROUTER_SESSION_LOG_MODE must be metadata or prompts');
   for (const key of ['AUTOROUTER_STATUSLINE', 'AUTOROUTER_DEBUG']) {
     if (env[key] !== undefined && !['0', '1'].includes(env[key])) throw new Error(`${key} must be 0 or 1`);

package/src/ollama-models.mjs

@@ -23,6 +23,9 @@ export function validateOllamaEndpoint(value) {
     || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== '/') {
     throw new Error('Ollama must use a loopback base URL without a path, credentials, a query, or a fragment.');
   }
+  // Connect to the loopback address itself. Where `localhost` resolves comes
+  // from /etc/hosts and the resolver, which are not part of this check.
+  if (endpoint.hostname === 'localhost') endpoint.hostname = '127.0.0.1';
   return endpoint.origin;
 }
 

package/src/onboarding.mjs

@@ -3,6 +3,7 @@ import { createInterface } from 'node:readline';
 import { Writable } from 'node:stream';
 import { promisify } from 'node:util';
 import { CLIENT_PROFILES, readConfig, requireKeys, parseStopHookBlockCap, parseSessionLogDir } from './config.mjs';
+import { applyPolicy } from './policy.mjs';
 import { buildClaudeEnv, conflictingProviders, LOCAL_AUTH_HEADER } from './auth.mjs';
 import { CONFIG_KEYS, SECRET_CONFIG_KEYS, SECRET_STORES, keychainRemovals, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { DEFAULT_OLLAMA_MODEL, validateOllamaModel } from './ollama-models.mjs';
@@ -38,11 +39,11 @@ export async function askSecret(label, { input = process.stdin, output = process
 
 export async function setup(args, {
   env = process.env, write = console.log, prompt = askSecret, fetchImpl = fetch, signal, keychain,
-  platform = process.platform,
+  platform = process.platform, policy,
 } = {}) {
   if (signal?.aborted) throw new Error('Setup cancelled');
-  const store = keychain ? { keychain } : {};
-  const loaded = loadUserConfig(env, { allowMissing: true, ...store });
+  const store = { ...(keychain ? { keychain } : {}), ...(policy ? { policy } : {}) };
+  const loaded = loadUserConfig(env, { allowMissing: true, enforcePolicy: false, ...store });
   const replace = args.includes('--replace');
   const mergeExisting = loaded.exists && !replace;
   // Updating one preference must not turn unrelated runtime overrides into
@@ -131,6 +132,7 @@ export async function setup(args, {
   const keys = [...(evaluator === 'jev' ? ['TYPESAFE_API_KEY'] : []), ...(authMode === 'api-key' ? ['ANTHROPIC_API_KEY'] : [])];
   // Reject invalid settings before inviting secret input or making local calls.
   readConfig(values);
+  if (loaded.policy) applyPolicy(values, loaded.policy);
   if (values.AUTOROUTER_SECRET_STORE === 'keychain' && platform !== 'darwin') {
     throw new Error('--secret-store keychain is available only on macOS');
   }
@@ -224,6 +226,7 @@ export async function doctor({ env = process.env, write = console.log, run = exe
     const loaded = loadUserConfig(env, keychain ? { keychain } : {});
     effectiveEnv = loaded.env;
     write(`Config: ${loaded.path}${loaded.exists ? '' : ' (absent; using environment)'}`);
+    if (loaded.policyPath) write(`Organization policy: ${loaded.policyPath} (locks: ${loaded.policyLocked.map(key => key.replace('AUTOROUTER_', '')).join(', ') || 'none'}).`);
     if (loaded.secretStore === 'keychain') write(`Saved secrets: macOS Keychain (${loaded.keychainSecrets.length} found).`);
     else if (platform === 'darwin' && SECRET_CONFIG_KEYS.some(key => Object.hasOwn(loaded.values, key))) {
       write('WARN  Saved keys are plaintext in the configuration file. Move them into the macOS Keychain: claude-autorouter config set AUTOROUTER_SECRET_STORE keychain');

package/src/policy.mjs

@@ -0,0 +1,116 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+// Optional organization policy. It lives at a fixed system path that no
+// environment variable can redirect, must be owned by root and not writable by
+// anyone else, and is applied after the saved file and the environment, so
+// neither can override it. This guards against configuration drift and
+// environment-driven changes (direnv, devcontainers, CI variables). It does not
+// stop someone who can run modified code; pair it with device management.
+const ALLOWLISTS = Object.freeze({
+  allowed_evaluators: { key: 'AUTOROUTER_EVALUATOR', fallback: 'ollama', values: ['jev', 'ollama'] },
+  allowed_auth_modes: { key: 'AUTOROUTER_AUTH_MODE', fallback: 'api-key', values: ['api-key', 'subscription'] },
+});
+const LOCKS = Object.freeze({
+  session_log_mode: { key: 'AUTOROUTER_SESSION_LOG_MODE', values: ['metadata', 'prompts'] },
+  upstream_url: { key: 'AUTOROUTER_UPSTREAM_URL' },
+  jev_url: { key: 'AUTOROUTER_JEV_URL' },
+});
+export const POLICY_KEYS = Object.freeze([...Object.keys(ALLOWLISTS), ...Object.keys(LOCKS)]);
+
+function policyError(message) {
+  const error = new Error(message);
+  error.code = 'AUTOROUTER_CONFIG_ERROR';
+  return error;
+}
+
+export function defaultPolicyPath(platform = process.platform) {
+  return platform === 'darwin'
+    ? '/Library/Application Support/claude-autorouter/policy.json'
+    : '/etc/claude-autorouter/policy.json';
+}
+
+function checkTrusted(path, trustedUid) {
+  for (const [target, kind] of [[path, 'file'], [dirname(path), 'directory']]) {
+    const stat = lstatSync(target);
+    const typeOk = kind === 'file' ? stat.isFile() : stat.isDirectory();
+    if (stat.isSymbolicLink() || !typeOk || stat.uid !== trustedUid || (stat.mode & 0o022) !== 0) {
+      throw policyError(`The AutoRouter organization policy ${kind} must be a regular ${kind} owned by root and not writable by group or others. Refusing to start.`);
+    }
+  }
+}
+
+function validate(parsed) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw policyError('The AutoRouter organization policy must be a JSON object.');
+  const policy = {};
+  for (const name of Object.keys(parsed)) {
+    if (!POLICY_KEYS.includes(name)) throw policyError('The AutoRouter organization policy contains an unsupported key.');
+  }
+  for (const [name, { values }] of Object.entries(ALLOWLISTS)) {
+    if (parsed[name] === undefined) continue;
+    const list = parsed[name];
+    if (!Array.isArray(list) || !list.length || list.some(value => !values.includes(value))) {
+      throw policyError(`Policy ${name} must be a nonempty list of: ${values.join(', ')}.`);
+    }
+    policy[name] = [...new Set(list)];
+  }
+  for (const [name, { values }] of Object.entries(LOCKS)) {
+    if (parsed[name] === undefined) continue;
+    const value = parsed[name];
+    const valid = values ? values.includes(value)
+      : typeof value === 'string' && /^https?:\/\/[^\s]+$/.test(value) && !/[\u0000-\u001f\u007f]/.test(value);
+    if (!valid) throw policyError(`Policy ${name} has an invalid value.`);
+    policy[name] = value;
+  }
+  return policy;
+}
+
+/**
+ * Returns undefined when no policy file exists. A file that exists but cannot
+ * be trusted or parsed is an error: policy fails closed.
+ */
+export function loadPolicy({ path = defaultPolicyPath(), trustedUid = 0 } = {}) {
+  let content;
+  try {
+    lstatSync(path);
+  } catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return undefined;
+    throw policyError(`Could not read the AutoRouter organization policy (${error.code ?? 'error'}). Refusing to start.`);
+  }
+  try {
+    checkTrusted(path, trustedUid);
+    content = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'AUTOROUTER_CONFIG_ERROR') throw error;
+    throw policyError('Could not read the AutoRouter organization policy. Refusing to start.');
+  }
+  let parsed;
+  try { parsed = JSON.parse(content); }
+  catch { throw policyError('The AutoRouter organization policy must contain valid JSON.'); }
+  return { path, values: validate(parsed) };
+}
+
+/**
+ * Enforce allowlists (an unlisted choice is an error) and apply locks (the
+ * policy value replaces whatever the file or environment supplied). Commands
+ * that repair a configuration pass allowlists: false and check new values
+ * themselves, so a disallowed saved setting can still be corrected.
+ */
+export function applyPolicy(env, policy, { allowlists = true } = {}) {
+  const result = { ...env };
+  const locked = [];
+  for (const [name, { key, fallback }] of Object.entries(ALLOWLISTS)) {
+    const allowed = policy[name];
+    if (!allowed || !allowlists) continue;
+    const value = result[key] ?? fallback;
+    if (!allowed.includes(value)) {
+      throw policyError(`${key} is not permitted by the AutoRouter organization policy. Allowed: ${allowed.join(', ')}.`);
+    }
+  }
+  for (const [name, { key }] of Object.entries(LOCKS)) {
+    if (policy[name] === undefined) continue;
+    result[key] = policy[name];
+    locked.push(key);
+  }
+  return { env: result, locked };
+}

package/src/server.mjs

@@ -47,8 +47,10 @@ function readBody(req, limit) {
 
 function jsonError(res, status, message) {
   if (res.headersSent || res.destroyed) { res.destroy(); return; }
-  res.writeHead(status, { 'content-type': 'application/json' });
+  // An oversized body is no longer read; close rather than keep the socket.
+  res.writeHead(status, { 'content-type': 'application/json', ...(status === 413 ? { connection: 'close' } : {}) });
   res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message } }));
+  if (status === 413) res.once('finish', () => res.socket?.destroy());
 }
 
 function upstreamHeaders(incoming, config) {

package/src/session-history.mjs

@@ -232,7 +232,7 @@ export async function sessionsCommand(args, { env = process.env, write = console
     throw new Error('Usage: claude-autorouter sessions list [--json] | sessions show ID [--json]');
   }
   // History needs only the log directory; never prompt for keychain access.
-  const loaded = loadUserConfig(env, { allowMissing: true, readSecrets: false });
+  const loaded = loadUserConfig(env, { allowMissing: true, readSecrets: false, enforcePolicy: false });
   const directory = parseSessionLogDir(loaded.env.AUTOROUTER_SESSION_LOG_DIR);
   if (!directory) {
     const report = { schema_version: 1, type: 'session_history', logging_enabled: false, sessions: [],

package/src/status-cleanup.mjs

@@ -0,0 +1,65 @@
+import * as fileSystem from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// A launcher that is killed hard (SIGKILL, power loss) cannot delete its
+// private status directory, which also holds the rewritten Claude settings.
+// The next launch removes directories whose owning process is gone. Only
+// directories this user created, with owner-only permissions, are considered.
+const PREFIX = 'autorouter-status-';
+const MAX_ENTRIES = 200;
+const SNAPSHOT_LIMIT = 1024 * 1024;
+// Without a readable snapshot, wait before treating a directory as abandoned so
+// a launch that is still starting is never removed.
+const UNREADABLE_GRACE_MS = 10 * 60 * 1000;
+// A reused process ID can look alive. The heartbeat is written every few
+// seconds, so a snapshot this old belongs to an earlier process even if a
+// sleeping machine suspended the real one for a while.
+const HEARTBEAT_STALE_MS = 24 * 60 * 60 * 1000;
+
+const defaultAlive = pid => {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+};
+
+async function readSnapshot(io, path) {
+  let handle;
+  try {
+    handle = await io.open(path, 'r');
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > SNAPSHOT_LIMIT) return undefined;
+    return JSON.parse(await handle.readFile('utf8'));
+  } catch { return undefined; }
+  finally { try { await handle?.close(); } catch {} }
+}
+
+/**
+ * Best effort and never throws. Returns the number of directories removed.
+ * @param {{directory?:string,io?:typeof fileSystem,alive?:(pid:number)=>boolean,now?:number,uid?:number}} [options]
+ */
+export async function removeStaleStatusDirectories({
+  directory = tmpdir(), io = fileSystem, alive = defaultAlive, now = Date.now(), uid = process.getuid?.(),
+} = {}) {
+  let removed = 0;
+  try {
+    if (uid === undefined) return 0;
+    const names = (await io.readdir(directory)).filter(name => name.startsWith(PREFIX)).slice(0, MAX_ENTRIES);
+    for (const name of names) {
+      try {
+        const path = join(directory, name);
+        const stat = await io.lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== uid || (stat.mode & 0o077) !== 0) continue;
+        const snapshot = await readSnapshot(io, join(path, 'state.json'));
+        const pid = snapshot?.pid;
+        let stale;
+        if (Number.isSafeInteger(pid) && pid > 0) {
+          const heartbeat = Number.isFinite(snapshot.heartbeat_at) ? snapshot.heartbeat_at : 0;
+          stale = !alive(pid) || now - heartbeat > HEARTBEAT_STALE_MS;
+        } else stale = now - stat.mtimeMs > UNREADABLE_GRACE_MS;
+        if (!stale) continue;
+        await io.rm(path, { recursive: true, force: true });
+        removed++;
+      } catch {}
+    }
+  } catch {}
+  return removed;
+}

package/src/user-config.mjs

@@ -6,6 +6,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { createKeychain } from './keychain.mjs';
+import { applyPolicy, loadPolicy } from './policy.mjs';
 
 export const CONFIG_KEYS = Object.freeze([
   'AUTOROUTER_AUTH_MODE', 'AUTOROUTER_CLIENT_PROFILE', 'AUTOROUTER_SECRET_STORE',
@@ -87,7 +88,7 @@ export function getConfigPath(env = process.env) {
 // The saved store setting decides where saved secrets live; the environment
 // only overrides values. With the keychain store, `values` includes secrets
 // read from the keychain so callers can update settings without losing them.
-export function loadUserConfig(env = process.env, { allowMissing = false, readSecrets = true, keychain = defaultKeychain } = {}) {
+function readUserConfig(env, { allowMissing = false, readSecrets = true, keychain = defaultKeychain } = {}) {
   const path = getConfigPath(env);
   let content;
   try {
@@ -126,6 +127,18 @@ export function loadUserConfig(env = process.env, { allowMissing = false, readSe
     secretStore, keychainSecrets, unavailableSecrets };
 }
 
+// An organization policy, when present, is applied last. Its allowlists reject
+// a disallowed choice and its locks replace file and environment values, so
+// every consumer of the effective environment sees the enforced settings.
+// `policy` options exist for tests; production always uses the system path.
+export function loadUserConfig(env = process.env, { policy: policyOptions, enforcePolicy = true, ...options } = {}) {
+  const policy = loadPolicy(policyOptions);
+  const loaded = readUserConfig(env, options);
+  if (!policy) return loaded;
+  const applied = applyPolicy(loaded.env, policy.values, { allowlists: enforcePolicy });
+  return { ...loaded, env: applied.env, policy: policy.values, policyPath: policy.path, policyLocked: applied.locked };
+}
+
 // Keychain items to delete when saving `nextStore`, given what was loaded.
 // Moving between stores needs every saved secret, so refuse while one could
 // not be read; deleting it unseen would lose it.