claude-autorouter 0.5.0 → 0.5.2

package/.env.example

@@ -3,7 +3,7 @@ AUTOROUTER_AUTH_MODE=subscription
 AUTOROUTER_CLIENT_PROFILE=compatible
 # Local Ollama is the default evaluator (experimental; see settings below).
 # Set jev to use TypeSafe's hosted evaluator, which needs TYPESAFE_API_KEY.
-AUTOROUTER_EVALUATOR=jev
+AUTOROUTER_EVALUATOR=ollama
 # The launcher enables the router status line for this session. Set 0 to keep your own.
 AUTOROUTER_STATUSLINE=1
 # Claude's Auto permission mode needs a supported Sonnet or Opus client.
@@ -14,10 +14,12 @@ AUTOROUTER_STATUSLINE=1
 # Optional metadata logs on stderr. Redirect stderr to a file when using the UI.
 # AUTOROUTER_DEBUG=1
 # Optional persistent JSONL decisions/outcomes, one file per session per launch.
-# Includes up to 500 characters of user prompt text; keep the directory local.
+# Defaults to metadata only. Set AUTOROUTER_SESSION_LOG_MODE=prompts to include
+# up to 500 characters of user prompt text; keep the directory local.
 # Unset or empty disables logging. This does not print prompts in the terminal.
 # AUTOROUTER_SESSION_LOG_DIR=/absolute/path/to/autorouter-sessions
-# Omit all prompt excerpt fields (does not enable logging by itself).
+# metadata (default) omits prompt excerpt fields; prompts includes them.
+# Setting a mode does not enable logging by itself.
 # AUTOROUTER_SESSION_LOG_MODE=metadata
 # Optional: allow two tool-free Stop-hook continuations, then end the turn on
 # the third block. Applies to /goal and all Stop/SubagentStop hooks.

package/README.md

@@ -4,7 +4,7 @@ An independent local model-routing gateway for Claude Code. AutoRouter is not af
 
 Use Haiku, Sonnet and Opus in one Claude Code session. AutoRouter evaluates each coding request, checks model compatibility and context capacity, and forwards it through a local gateway. Native Ollama `/v1/systemone` models are the default, experimental local evaluator, so task excerpts stay on your machine; [TypeSafe Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) is an optional hosted evaluator (`setup --evaluator jev`). Claude owns authentication, tool permissions and safety review.
 
-Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The default evaluator also needs a [TypeSafe API key](https://console.typesafe.ai). The installed CLI has no runtime dependencies.
+Requires Node.js 22+, macOS or Linux (including WSL), an installed `claude` command, and a Claude subscription login or Anthropic API key. The optional Jev evaluator needs a [TypeSafe API key](https://console.typesafe.ai). The installed CLI has no runtime dependencies.
 
 Version 0.4.0 adds `config`, `sessions` and `doctor --evaluate-local`, durable task continuity, and clearer model outcomes. Upgrade from 0.3.x to use these commands. The [contributor guide](CONTRIBUTING.md) explains local verification, and the [release guide](docs/releasing.md) covers the changes and verified publication.
 

package/SECURITY.md

@@ -16,8 +16,10 @@ Relevant reports include credential exposure, unauthorized access to the local g
 
 ## Handling diagnostic data
 
+Organizations can enforce the evaluator, authentication mode, upstream and log mode with a root-owned policy file that environment variables and saved settings cannot override. See [organization policy](docs/reference.md#organization-policy).
+
 AutoRouter's default evaluator is local Ollama, which keeps classification on loopback. The optional hosted Jev evaluator (`--evaluator jev`) receives bounded task/history excerpts, which may contain private code or tool results. Recognizable credentials and personal identifiers are redacted from those excerpts first; this pattern-based filter reduces, but does not eliminate, disclosure. Anthropic still receives the full inference request. See [data flow and authentication](docs/reference.md#data-flow-and-authentication).
 
 New macOS setups keep saved keys in the login Keychain. Existing and non-macOS configurations keep plaintext keys in the private configuration file until you run `claude-autorouter config set AUTOROUTER_SECRET_STORE keychain` (macOS only). See [credential storage](docs/reference.md#credential-storage).
 
-Session logging is optional. Enabling only a log directory uses the default `prompts` mode, which includes bounded human-task excerpts with recognizable credentials and personal identifiers redacted (pattern-based, so not exhaustive). Select `AUTOROUTER_SESSION_LOG_MODE=metadata` before enabling a directory to omit those excerpts. Inspect even metadata-only output before sharing it; identifiers, paths or environment details can still be sensitive. Saved logs have no automatic deletion policy. See [history and privacy](docs/reference.md#session-decision-logs).
+Session logging is optional. Enabling a log directory uses the default `metadata` mode, which omits prompt excerpts. Opting into `AUTOROUTER_SESSION_LOG_MODE=prompts` includes bounded human-task excerpts with recognizable credentials and personal identifiers redacted (pattern-based, so not exhaustive). Inspect even metadata-only output before sharing it; identifiers, paths or environment details can still be sensitive. Saved logs have no automatic deletion policy. See [history and privacy](docs/reference.md#session-decision-logs).

package/bin/autorouter.mjs

@@ -7,6 +7,7 @@ import { createRouterServer, listen } from '../src/server.mjs';
 import { buildClaudeEnv, clientProfileForLaunch, conflictingProviders } from '../src/auth.mjs';
 import { dirname } from 'node:path';
 import { createStatusState } from '../src/status-state.mjs';
+import { removeStaleStatusDirectories } from '../src/status-cleanup.mjs';
 import { addStatusLineSettings } from '../src/status-settings.mjs';
 import { createSessionLog } from '../src/session-log.mjs';
 import { loadUserConfig } from '../src/user-config.mjs';
@@ -100,6 +101,7 @@ if (['--version', '-v', 'version'].includes(command)) {
     const statusEnabled = command === 'claude' && runtimeEnv.AUTOROUTER_STATUSLINE !== '0';
     let claudeArgs = args;
     if (statusEnabled) {
+      await removeStaleStatusDirectories();
       status = createStatusState({ baselineModel: config.models.opus });
       await status.ready;
       if (status.path) {

package/docs/development.md

@@ -94,7 +94,7 @@ For a classifier-only rubric evaluation:
 npm run eval
 ```
 
-The bundled evaluation makes 19 classifier calls and no Claude generations. Jev is the default and incurs TypeSafe usage; set `AUTOROUTER_EVALUATOR=ollama` to evaluate an installed local model. It reports agreement with the starting rubric, fallback count, and p50/p95 routing latency. Edit `test/fixtures/routing.json` to represent the tasks you want to measure. Rubric agreement alone does not establish answer quality or net savings; compare completed tasks against fixed-model baselines.
+The bundled evaluation makes 19 classifier calls and no Claude generations. The evaluation uses the configured evaluator, which defaults to a local Ollama model and needs an installed one; set `AUTOROUTER_EVALUATOR=jev` to evaluate with Jev, which incurs TypeSafe usage and sends redacted excerpts to TypeSafe. It reports agreement with the starting rubric, fallback count, and p50/p95 routing latency. Edit `test/fixtures/routing.json` to represent the tasks you want to measure. Rubric agreement alone does not establish answer quality or net savings; compare completed tasks against fixed-model baselines.
 
 For local evaluator measurements, use Ollama 0.35+ and a model compatible with `/v1/systemone`. Distinguish cold model loading from warmed classification, and record the model tag, hardware, Ollama version, context size, prompt length, and resident memory. The launcher primes the classifier with a synthetic task before opening the UI, with a separate deadline of up to 60 seconds. Runtime and benchmark share the 3,000-character/3,000-UTF-8-byte state limit, so include non-ASCII cases and excerpts that fill the budget. Also measure the first request after keep-alive expiration: its reload can hit the normal deadline even when warm requests pass. Repeat on realistic prompt distributions instead of selecting a model from a single easy request. Disk download size is not resident RAM. Keep model downloads opt-in and respect each model's license.
 

package/docs/reference.md

@@ -70,7 +70,7 @@ For an environment-only subscription launch, set `AUTOROUTER_AUTH_MODE=subscript
 | `AUTOROUTER_STATUSLINE` | enabled | `0` retains your existing status line |
 | `AUTOROUTER_DEBUG` | off | `1` enables launcher metadata logs on stderr |
 | `AUTOROUTER_SESSION_LOG_DIR` | off | Write per-session JSONL decisions and outcomes into this directory; unset or empty disables it |
-| `AUTOROUTER_SESSION_LOG_MODE` | `prompts` | `metadata` omits prompt excerpts; setting a mode alone does not enable logging |
+| `AUTOROUTER_SESSION_LOG_MODE` | `metadata` | `metadata` omits prompt excerpts; `prompts` includes bounded human-task excerpts; setting a mode alone does not enable logging |
 | `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` | unset; Claude currently uses `8` | Optional cap on consecutive Stop/SubagentStop continuations without tool use; `0` disables the cap |
 | `ENABLE_TOOL_SEARCH` | `true` in launcher when unset | Load MCP tool definitions on demand; explicit values are preserved |
 | `AUTOROUTER_HAIKU_MODEL` | `claude-haiku-4-5-20251001` | Routine tier |
@@ -105,6 +105,24 @@ claude-autorouter config set TYPESAFE_API_KEY
 
 Normal startup validates the selected evaluator; stale settings for the inactive evaluator do not prevent it from starting. `show --check-all` explicitly checks both. Blank numeric settings fail with their setting name; zero retains its documented meaning. `claude-autorouter help COMMAND` gives focused command help. `claude-autorouter claude --help` and `--version` call Claude directly without router setup or credentials.
 
+### Organization policy
+
+An administrator can restrict what users may configure with a policy file at a fixed system path: `/Library/Application Support/claude-autorouter/policy.json` on macOS and `/etc/claude-autorouter/policy.json` on Linux. No environment variable changes this path. The file and its directory must be regular, owned by root, and not writable by group or others; otherwise AutoRouter refuses to start. An invalid or unreadable file also stops it, so a broken policy never silently turns off.
+
+```json
+{
+  "allowed_evaluators": ["ollama"],
+  "allowed_auth_modes": ["subscription"],
+  "session_log_mode": "metadata",
+  "upstream_url": "https://api.anthropic.com",
+  "jev_url": "https://api.typesafe.ai/v1/systemone"
+}
+```
+
+All keys are optional. `allowed_evaluators` and `allowed_auth_modes` reject any other choice, including an unset default, with an error that names the setting. `session_log_mode`, `upstream_url` and `jev_url` replace whatever the saved file or environment supplies; `config show` reports them with source `policy`. `doctor` prints the policy path and the locked settings. `setup` and `config set` refuse to save a disallowed value, but still let a user correct a setting that the policy now forbids.
+
+The policy guards against configuration drift and environment-driven changes such as direnv, devcontainer or CI variables. It does not stop someone who can run modified code, or run Claude Code without AutoRouter. Deploy it with device management, and use it with an allowlist of approved package versions.
+
 ## Ollama evaluator
 
 The local configuration documented here requires AutoRouter 0.3.2 or newer and remains experimental. It uses Ollama's native `/v1/systemone` decision endpoint for every model, replacing the chat backend from 0.2.0. Jev is the optional hosted evaluator, using TypeSafe's `/v1/systemone` endpoint and a TypeSafe API key. Selecting Ollama never silently switches back to Jev. Haiku, Sonnet, or Opus still completes the task through Anthropic.
@@ -145,7 +163,7 @@ claude-autorouter setup --evaluator ollama --ollama-model tev1:4b-q4_K_M --pull
 
 For Nimble, the explicit Q4_K_M tag avoids `nimble:latest`, which currently selects an approximately 9.5 GB Q8 model. For Tev1, `tev1:latest` and `tev1:4b` select approximately 4.5 GB Q8 weights; the explicit `tev1:4b-q4_K_M` tag selects the smaller 4B download. Download size is not resident memory: runtime and context allocations add to it, and other applications need memory too. Downloaded models have their own licenses and are not bundled in this package. In historical tests before 0.3.2 on a 16 GiB M4, Tev1 0.8B matched 18/24 held-out labels at 450 ms median latency within 1,500 ms; 4B matched 22/24 at 3.15 seconds with a separate 10-second deadline. See the [local measurements](ollama-evaluation.md) before choosing a latency deadline.
 
-The endpoint must be loopback (`127.0.0.1`, `localhost`, or `::1`), without a path, credentials, query, or fragment. Cloud model tags and metadata identifying a remote model are rejected before sending task text. Claude and Jev credentials are never attached to Ollama requests.
+The endpoint must be loopback (`127.0.0.1`, `localhost`, or `::1`); `localhost` is converted to `127.0.0.1` so the connection does not depend on name resolution, without a path, credentials, query, or fragment. Cloud model tags and metadata identifying a remote model are rejected before sending task text. Claude and Jev credentials are never attached to Ollama requests.
 
 ### Classification and fallback
 
@@ -202,7 +220,7 @@ Claude Code → authenticated local gateway → Jev or local Ollama classificati
 
 AutoRouter launches the user's installed official Claude Code binary without patching it and uses Claude Code's [gateway integration](https://code.claude.com/docs/en/llm-gateway-protocol), so it sees inference requests and tool continuations. It does not rely on a user-prompt hook. Each user uses their own provider credentials; AutoRouter does not provide a Claude sign-in service or a shared provider account.
 
-The selected evaluator receives a bounded state containing the latest human request and excerpts of the original task and recent messages: up to 12,000 serialized characters sent to TypeSafe for Jev, or 3,000 UTF-8 bytes sent to the local Ollama service. Jev also receives system-text excerpts. The local path excludes Claude's top-level executor system instructions. These excerpts can include private source code and tool results. Before excerpting, recognizable sensitive values are replaced (the same filter applies to opt-in session-log prompt excerpts, including when old logs are read back) with markers such as `[REDACTED:secret]`: private keys, common provider token formats (Anthropic, OpenAI-style `sk-`, AWS, GitHub, GitLab, Slack, Google, Stripe, npm), JWTs, authorization headers, URL credentials, values assigned to password/secret/token/key-like names, email addresses, and checksum-valid IBANs and payment card numbers. Setting names stay visible. Redaction is pattern-based: unrecognized formats can remain, code resembling an assignment can be over-redacted, and it does not make arbitrary private source code safe to share. Images, document payloads, and signed thinking are omitted. Full tool schemas and full conversation history are not sent to either classifier. Anthropic receives the complete request, including its tools and attachments. Large or multimodal requests may also go to Anthropic's token-count endpoint before inference, including when classification is local.
+The selected evaluator receives a bounded state containing the latest human request and excerpts of the original task and recent messages: up to 12,000 serialized characters sent to TypeSafe for Jev, or 3,000 UTF-8 bytes sent to the local Ollama service. Jev also receives system-text excerpts. The local path excludes Claude's top-level executor system instructions. These excerpts can include private source code and tool results. Before excerpting, recognizable sensitive values are replaced (the same filter applies to opt-in session-log prompt excerpts, including when old logs are read back) with markers such as `[REDACTED:secret]`: private keys, common provider token formats (Anthropic, OpenAI-style `sk-`, AWS, GitHub, GitLab, Slack, Google, Stripe, npm, PyPI, SendGrid, Shopify, Hugging Face, DigitalOcean, Linear, Notion, Databricks, Atlassian, Mailgun, Twilio, Telegram, Azure storage keys), JWTs, authorization and cookie headers, URL credentials (including an empty user or a password containing `@`), values assigned to password/secret/token/key-like names (including quoted values with spaces and upper-case `*_KEY` names), credentials on command lines (`curl -u`, `--password`, `--api-key`, `sshpass -p`, `mysql -p`), email addresses, international phone numbers with a leading `+`, checksum-valid Italian tax codes, US social security numbers, and checksum-valid IBANs and payment card numbers. Names, postal addresses, other national ID formats, customer identifiers and source code are not detected. Setting names stay visible. Redaction is pattern-based: unrecognized formats can remain, code resembling an assignment can be over-redacted, and it does not make arbitrary private source code safe to share. Images, document payloads, and signed thinking are omitted. Full tool schemas and full conversation history are not sent to either classifier. Anthropic receives the complete request, including its tools and attachments. Large or multimodal requests may also go to Anthropic's token-count endpoint before inference, including when classification is local.
 
 In subscription mode, Claude Code owns login and OAuth refresh. AutoRouter forwards the current request's authorization and beta headers to Anthropic. It does not read keychain or saved login files, persist subscription tokens, or send them to Jev. A separate temporary `X-Autorouter-Token` authenticates the local connection and is stripped upstream. Subscription forwarding is restricted to `https://api.anthropic.com`. See [subscriptions and gateways](https://code.claude.com/docs/en/llm-gateway#subscriptions-and-gateways).
 
@@ -210,7 +228,7 @@ In API-key mode, the upstream key stays in the proxy and Claude receives a tempo
 
 The proxy processes authenticated requests in memory, including their authorization headers. Preserving Claude's login flow does not by itself establish that every deployment is permitted. The [provider-policy note](subscription-integration.md#provider-guidance-and-unresolved-scope) records the current documentation and the unresolved scope of model-rewriting subscription forwarding. Jev requires its own TypeSafe credentials and billing, separate from Anthropic authentication.
 
-Routine diagnostic logs contain route, model, timing, usage, and error-category metadata, not prompts, raw responses, or credentials. Opt-in session history is separate and includes task excerpts in its default `prompts` mode. Status snapshots contain routing metadata and token counts in a private temporary directory and are deleted on normal launcher exit. Classification, turn, and token-count caches are held in memory. Claude Code and the external providers have their own storage and logging behavior.
+Routine diagnostic logs contain route, model, timing, usage, and error-category metadata, not prompts, raw responses, or credentials. Opt-in session history is separate and includes task excerpts only in `prompts` mode; the default is `metadata` (changed from `prompts` in 0.5.1; set `AUTOROUTER_SESSION_LOG_MODE=prompts` to keep excerpts). Status snapshots contain routing metadata and token counts in a private temporary directory and are deleted on normal launcher exit. After a hard kill, the next launch removes directories whose process is gone (only your own, owner-only `autorouter-status-*` directories in the temporary directory). Classification, turn, and token-count caches are held in memory. Claude Code and the external providers have their own storage and logging behavior.
 
 ## Routing policy
 
@@ -321,7 +339,7 @@ claude-autorouter sessions show autorouter-session-EXAMPLE --json
 
 Use the exact `id` printed by `sessions list`. Commands need no evaluator credentials and do not contact providers. Human summaries distinguish selected models, observed serving models, confirmed completions, failures, cancellations, and pending/unconfirmed requests. They report routing latency, fallback and override counts, and API-equivalent savings coverage. A selected model or an HTTP 200 alone does not prove successful inference. Old schema-1 decision logs remain readable and explicitly lack outcome evidence.
 
-`prompts` mode preserves the existing excerpt behavior when a log directory is enabled. Main requests retain at most 500 Unicode characters of the human task; recognized tool and goal continuations retain the originating task. Auxiliary, subagent, compaction, workflow, and attachment-only requests have empty excerpts. Metadata mode omits the excerpt fields entirely. Neither mode logs authentication headers, provider replies, full transcripts, or tool payloads. Text entered directly in a prompt can appear in an enabled prompt excerpt.
+`prompts` mode (opt-in) records excerpts when a log directory is enabled. Main requests retain at most 500 Unicode characters of the human task; recognized tool and goal continuations retain the originating task. Auxiliary, subagent, compaction, workflow, and attachment-only requests have empty excerpts. Metadata mode omits the excerpt fields entirely. Neither mode logs authentication headers, provider replies, full transcripts, or tool payloads. Text entered directly in a prompt can appear in an enabled prompt excerpt.
 
 The settings also work with `serve` and every client profile. `setup --session-log-dir DIR --session-log-mode metadata --force` updates an existing configuration. Setup resolves relative directories at setup time; environment-only paths resolve from the launch directory. `AUTOROUTER_SESSION_LOG_DIR=''` disables a saved directory for one launch. Setting only the mode never enables logging. `doctor` reports preferences without creating files.
 

package/docs/releasing.md

@@ -20,6 +20,10 @@ Version `0.4.0` completes the routing, configuration, history and performance im
 
 Version `0.5.0` makes local Ollama the default evaluator and TypeSafe Jev an explicit option (`setup --evaluator jev`), so evaluator excerpts stay on the machine unless the user opts in. **Breaking for environment-only launches** that relied on the implicit Jev default; configurations created by `setup` record their evaluator and are unchanged. Evaluator excerpts and opt-in session-log prompt excerpts are now redacted for recognizable credentials and personal identifiers (pattern-based, not exhaustive). On macOS, new `setup` runs keep saved keys in the login Keychain by default; existing plaintext configurations are not moved implicitly, and `doctor` prints the `config set AUTOROUTER_SECRET_STORE keychain` command to move them. See [credential storage](reference.md#credential-storage) and the [data flow](reference.md#data-flow-and-authentication).
 
+Version `0.5.1` hardens defaults and adds an optional organization policy. **Behavior change:** enabling `AUTOROUTER_SESSION_LOG_DIR` now records metadata only; set `AUTOROUTER_SESSION_LOG_MODE=prompts` to keep prompt excerpts. Saved configurations that already record a mode are unchanged. A root-owned policy file can restrict the evaluator and authentication mode and lock the log mode and service URLs; see [organization policy](reference.md#organization-policy). The next launch removes status directories left by a hard-killed launcher, an Ollama `localhost` endpoint now connects to `127.0.0.1`, an oversized request body closes its connection after the 413 response, and `.env.example` selects the local evaluator to match the default.
+
+Version `0.5.2` widens secret redaction and closes a Keychain command-injection path. Redaction now also covers URL credentials with an empty user or a password containing `@`, passwords containing `;` or spaces in quotes, `*_KEY`, `*_PASS` and `*_AUTH` names, cookies, command-line credentials (`curl -u`, `--password`, `--api-key`, `sshpass -p`, `mysql -p`), about fifteen more provider token formats, international phone numbers, checksum-validated Italian tax codes and US social security numbers. **Behavior change:** evaluator excerpts and prompt-mode logs contain more `[REDACTED:...]` markers than before, and recognizable personal identifiers now appear as `[REDACTED:phone]` or `[REDACTED:national_id]`. A configuration path containing control or line-separator characters is now rejected, and Keychain item names are validated before they reach the `security` tool. Contributor documentation no longer names Jev as the default evaluator. See the [data flow](reference.md#data-flow-and-authentication).
+
 The GitHub repository became public on October 6, 2026, after preparation PR #1 merged. That launch created no release tag and published no new npm version. npm publication remains a separate release operation. Its tarball includes runtime source, README, configuration example, license, and shipped documentation; model weights, user configuration, credentials, transcripts, session logs, local artifacts, and test fixtures are excluded. Review each release archive, especially when the package allowlist changes. The public Git repository also exposes history, development scripts and tests; the npm archive allowlist does not govern that material.
 
 ## What runs automatically

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-autorouter",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "license": "Apache-2.0",
   "type": "module",
   "description": "AutoRouter: a local model-routing gateway for Claude Code with Jev and Ollama System One evaluators",

package/src/config-command.mjs

@@ -2,6 +2,7 @@ import { readConfig, parseSessionLogDir, parseStopHookBlockCap } from './config.
 import { CONFIG_KEYS, SECRET_CONFIG_KEYS, SECRET_STORES, keychainRemovals, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { modelCapabilities } from './model-catalog.mjs';
 import { askSecret } from './onboarding.mjs';
+import { applyPolicy } from './policy.mjs';
 
 const secretKey = key => SECRET_CONFIG_KEYS.includes(key);
 const providerFor = key => key.startsWith('AUTOROUTER_OLLAMA_') ? 'ollama'
@@ -35,7 +36,8 @@ export function configReport(loaded, env, { checkAll = false } = {}) {
   for (const key of CONFIG_KEYS) {
     const saved = loaded.keychainSecrets?.includes(key) ? 'keychain' : 'file';
     // The saved store setting governs saved secrets; the environment cannot redirect it.
-    const source = env[key] !== undefined && key !== 'AUTOROUTER_SECRET_STORE' ? 'environment'
+    const source = loaded.policyLocked?.includes(key) ? 'policy'
+      : env[key] !== undefined && key !== 'AUTOROUTER_SECRET_STORE' ? 'environment'
       : Object.hasOwn(loaded.values, key) ? saved : 'default';
     const provider = providerFor(key);
     const active = (!provider || provider === config.evaluator)
@@ -57,7 +59,8 @@ export function configReport(loaded, env, { checkAll = false } = {}) {
     try { readConfig(loaded.env, { validateAll: true }); }
     catch (failure) { valid = false; error = failure.message; }
   }
-  return { schema_version: 1, config_path: loaded.path, config_exists: loaded.exists, valid,
+  return { schema_version: 1, config_path: loaded.path, config_exists: loaded.exists,
+    ...(loaded.policyPath ? { policy_path: loaded.policyPath } : {}), valid,
     checked: checkAll ? 'all_evaluators' : 'active_evaluator', settings, warnings,
     ...(error ? { error } : {}),
   };
@@ -94,9 +97,9 @@ function normalizedValue(key, value) {
 }
 
 export async function configCommand(args, {
-  env = process.env, write = console.log, input = process.stdin, promptSecret = askSecret, keychain,
+  env = process.env, write = console.log, input = process.stdin, promptSecret = askSecret, keychain, policy,
 } = {}) {
-  const store = keychain ? { keychain } : {};
+  const store = { ...(keychain ? { keychain } : {}), ...(policy ? { policy } : {}) };
   const [operation, ...rest] = args;
   if (operation === 'show') {
     if (rest.some(arg => !['--json', '--check-all'].includes(arg))) throw new Error('Usage: claude-autorouter config show [--json] [--check-all]');
@@ -130,7 +133,7 @@ export async function configCommand(args, {
     throw new Error('Secret values are not accepted as command arguments. Use --stdin or the hidden prompt.');
   }
   if (operation === 'set' && !secretKey(key) && (value === undefined || value === '--stdin')) throw new Error('Nonsecret settings require a value argument.');
-  const loaded = loadUserConfig(env, { allowMissing: true, ...store });
+  const loaded = loadUserConfig(env, { allowMissing: true, enforcePolicy: false, ...store });
   const next = { ...loaded.values };
   if (operation === 'unset') delete next[key];
   else next[key] = normalizedValue(key, secretKey(key)
@@ -140,6 +143,7 @@ export async function configCommand(args, {
   // mask it. An explicitly edited inactive provider is checked too.
   const provider = operation === 'set' ? providerFor(key) : undefined;
   readConfig({ ...next, ...(provider ? { AUTOROUTER_EVALUATOR: provider } : {}) });
+  if (loaded.policy) applyPolicy(next, loaded.policy);
   const nextStore = next.AUTOROUTER_SECRET_STORE ?? 'file';
   // Changing the store moves saved secrets; unsetting a secret deletes its item.
   const removeSecrets = key === 'AUTOROUTER_SECRET_STORE' ? keychainRemovals(loaded, nextStore)

package/src/config.mjs

@@ -58,7 +58,7 @@ function modelName(value, name) {
  * @returns {import('./contracts.mjs').RouterConfig}
  */
 export function readConfig(env = process.env, { validateAll = false } = {}) {
-  const sessionLogMode = env.AUTOROUTER_SESSION_LOG_MODE === undefined ? 'prompts' : env.AUTOROUTER_SESSION_LOG_MODE;
+  const sessionLogMode = env.AUTOROUTER_SESSION_LOG_MODE === undefined ? 'metadata' : env.AUTOROUTER_SESSION_LOG_MODE;
   if (sessionLogMode !== 'metadata' && sessionLogMode !== 'prompts') throw new Error('AUTOROUTER_SESSION_LOG_MODE must be metadata or prompts');
   for (const key of ['AUTOROUTER_STATUSLINE', 'AUTOROUTER_DEBUG']) {
     if (env[key] !== undefined && !['0', '1'].includes(env[key])) throw new Error(`${key} must be 0 or 1`);

package/src/keychain.mjs

@@ -16,8 +16,15 @@ function keychainError(message) {
 }
 
 // Quote for the `security -i` command parser, which accepts backslash escapes
-// inside double quotes. Values are validated as printable single-line ASCII.
-const quote = value => `"${value.replace(/[\\"]/g, '\\$&')}"`;
+// inside double quotes and reads one command per line. The secret is validated
+// as printable single-line ASCII; the account and label (which can carry a
+// user-chosen path) must contain no control or line-separator characters, since
+// a newline would start another command.
+const UNSAFE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+const quote = value => {
+  if (typeof value !== 'string' || UNSAFE.test(value)) throw keychainError('Keychain item names must not contain control characters.');
+  return `"${value.replace(/[\\"]/g, '\\$&')}"`;
+};
 
 export function createKeychain({ run = spawnSync, platform = process.platform } = {}) {
   const available = platform === 'darwin';

package/src/ollama-models.mjs

@@ -23,6 +23,9 @@ export function validateOllamaEndpoint(value) {
     || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== '/') {
     throw new Error('Ollama must use a loopback base URL without a path, credentials, a query, or a fragment.');
   }
+  // Connect to the loopback address itself. Where `localhost` resolves comes
+  // from /etc/hosts and the resolver, which are not part of this check.
+  if (endpoint.hostname === 'localhost') endpoint.hostname = '127.0.0.1';
   return endpoint.origin;
 }
 

package/src/onboarding.mjs

@@ -3,6 +3,7 @@ import { createInterface } from 'node:readline';
 import { Writable } from 'node:stream';
 import { promisify } from 'node:util';
 import { CLIENT_PROFILES, readConfig, requireKeys, parseStopHookBlockCap, parseSessionLogDir } from './config.mjs';
+import { applyPolicy } from './policy.mjs';
 import { buildClaudeEnv, conflictingProviders, LOCAL_AUTH_HEADER } from './auth.mjs';
 import { CONFIG_KEYS, SECRET_CONFIG_KEYS, SECRET_STORES, keychainRemovals, loadUserConfig, saveUserConfig } from './user-config.mjs';
 import { DEFAULT_OLLAMA_MODEL, validateOllamaModel } from './ollama-models.mjs';
@@ -38,11 +39,11 @@ export async function askSecret(label, { input = process.stdin, output = process
 
 export async function setup(args, {
   env = process.env, write = console.log, prompt = askSecret, fetchImpl = fetch, signal, keychain,
-  platform = process.platform,
+  platform = process.platform, policy,
 } = {}) {
   if (signal?.aborted) throw new Error('Setup cancelled');
-  const store = keychain ? { keychain } : {};
-  const loaded = loadUserConfig(env, { allowMissing: true, ...store });
+  const store = { ...(keychain ? { keychain } : {}), ...(policy ? { policy } : {}) };
+  const loaded = loadUserConfig(env, { allowMissing: true, enforcePolicy: false, ...store });
   const replace = args.includes('--replace');
   const mergeExisting = loaded.exists && !replace;
   // Updating one preference must not turn unrelated runtime overrides into
@@ -131,6 +132,7 @@ export async function setup(args, {
   const keys = [...(evaluator === 'jev' ? ['TYPESAFE_API_KEY'] : []), ...(authMode === 'api-key' ? ['ANTHROPIC_API_KEY'] : [])];
   // Reject invalid settings before inviting secret input or making local calls.
   readConfig(values);
+  if (loaded.policy) applyPolicy(values, loaded.policy);
   if (values.AUTOROUTER_SECRET_STORE === 'keychain' && platform !== 'darwin') {
     throw new Error('--secret-store keychain is available only on macOS');
   }
@@ -224,6 +226,7 @@ export async function doctor({ env = process.env, write = console.log, run = exe
     const loaded = loadUserConfig(env, keychain ? { keychain } : {});
     effectiveEnv = loaded.env;
     write(`Config: ${loaded.path}${loaded.exists ? '' : ' (absent; using environment)'}`);
+    if (loaded.policyPath) write(`Organization policy: ${loaded.policyPath} (locks: ${loaded.policyLocked.map(key => key.replace('AUTOROUTER_', '')).join(', ') || 'none'}).`);
     if (loaded.secretStore === 'keychain') write(`Saved secrets: macOS Keychain (${loaded.keychainSecrets.length} found).`);
     else if (platform === 'darwin' && SECRET_CONFIG_KEYS.some(key => Object.hasOwn(loaded.values, key))) {
       write('WARN  Saved keys are plaintext in the configuration file. Move them into the macOS Keychain: claude-autorouter config set AUTOROUTER_SECRET_STORE keychain');

package/src/policy.mjs

@@ -0,0 +1,116 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+// Optional organization policy. It lives at a fixed system path that no
+// environment variable can redirect, must be owned by root and not writable by
+// anyone else, and is applied after the saved file and the environment, so
+// neither can override it. This guards against configuration drift and
+// environment-driven changes (direnv, devcontainers, CI variables). It does not
+// stop someone who can run modified code; pair it with device management.
+const ALLOWLISTS = Object.freeze({
+  allowed_evaluators: { key: 'AUTOROUTER_EVALUATOR', fallback: 'ollama', values: ['jev', 'ollama'] },
+  allowed_auth_modes: { key: 'AUTOROUTER_AUTH_MODE', fallback: 'api-key', values: ['api-key', 'subscription'] },
+});
+const LOCKS = Object.freeze({
+  session_log_mode: { key: 'AUTOROUTER_SESSION_LOG_MODE', values: ['metadata', 'prompts'] },
+  upstream_url: { key: 'AUTOROUTER_UPSTREAM_URL' },
+  jev_url: { key: 'AUTOROUTER_JEV_URL' },
+});
+export const POLICY_KEYS = Object.freeze([...Object.keys(ALLOWLISTS), ...Object.keys(LOCKS)]);
+
+function policyError(message) {
+  const error = new Error(message);
+  error.code = 'AUTOROUTER_CONFIG_ERROR';
+  return error;
+}
+
+export function defaultPolicyPath(platform = process.platform) {
+  return platform === 'darwin'
+    ? '/Library/Application Support/claude-autorouter/policy.json'
+    : '/etc/claude-autorouter/policy.json';
+}
+
+function checkTrusted(path, trustedUid) {
+  for (const [target, kind] of [[path, 'file'], [dirname(path), 'directory']]) {
+    const stat = lstatSync(target);
+    const typeOk = kind === 'file' ? stat.isFile() : stat.isDirectory();
+    if (stat.isSymbolicLink() || !typeOk || stat.uid !== trustedUid || (stat.mode & 0o022) !== 0) {
+      throw policyError(`The AutoRouter organization policy ${kind} must be a regular ${kind} owned by root and not writable by group or others. Refusing to start.`);
+    }
+  }
+}
+
+function validate(parsed) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw policyError('The AutoRouter organization policy must be a JSON object.');
+  const policy = {};
+  for (const name of Object.keys(parsed)) {
+    if (!POLICY_KEYS.includes(name)) throw policyError('The AutoRouter organization policy contains an unsupported key.');
+  }
+  for (const [name, { values }] of Object.entries(ALLOWLISTS)) {
+    if (parsed[name] === undefined) continue;
+    const list = parsed[name];
+    if (!Array.isArray(list) || !list.length || list.some(value => !values.includes(value))) {
+      throw policyError(`Policy ${name} must be a nonempty list of: ${values.join(', ')}.`);
+    }
+    policy[name] = [...new Set(list)];
+  }
+  for (const [name, { values }] of Object.entries(LOCKS)) {
+    if (parsed[name] === undefined) continue;
+    const value = parsed[name];
+    const valid = values ? values.includes(value)
+      : typeof value === 'string' && /^https?:\/\/[^\s]+$/.test(value) && !/[\u0000-\u001f\u007f]/.test(value);
+    if (!valid) throw policyError(`Policy ${name} has an invalid value.`);
+    policy[name] = value;
+  }
+  return policy;
+}
+
+/**
+ * Returns undefined when no policy file exists. A file that exists but cannot
+ * be trusted or parsed is an error: policy fails closed.
+ */
+export function loadPolicy({ path = defaultPolicyPath(), trustedUid = 0 } = {}) {
+  let content;
+  try {
+    lstatSync(path);
+  } catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return undefined;
+    throw policyError(`Could not read the AutoRouter organization policy (${error.code ?? 'error'}). Refusing to start.`);
+  }
+  try {
+    checkTrusted(path, trustedUid);
+    content = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'AUTOROUTER_CONFIG_ERROR') throw error;
+    throw policyError('Could not read the AutoRouter organization policy. Refusing to start.');
+  }
+  let parsed;
+  try { parsed = JSON.parse(content); }
+  catch { throw policyError('The AutoRouter organization policy must contain valid JSON.'); }
+  return { path, values: validate(parsed) };
+}
+
+/**
+ * Enforce allowlists (an unlisted choice is an error) and apply locks (the
+ * policy value replaces whatever the file or environment supplied). Commands
+ * that repair a configuration pass allowlists: false and check new values
+ * themselves, so a disallowed saved setting can still be corrected.
+ */
+export function applyPolicy(env, policy, { allowlists = true } = {}) {
+  const result = { ...env };
+  const locked = [];
+  for (const [name, { key, fallback }] of Object.entries(ALLOWLISTS)) {
+    const allowed = policy[name];
+    if (!allowed || !allowlists) continue;
+    const value = result[key] ?? fallback;
+    if (!allowed.includes(value)) {
+      throw policyError(`${key} is not permitted by the AutoRouter organization policy. Allowed: ${allowed.join(', ')}.`);
+    }
+  }
+  for (const [name, { key }] of Object.entries(LOCKS)) {
+    if (policy[name] === undefined) continue;
+    result[key] = policy[name];
+    locked.push(key);
+  }
+  return { env: result, locked };
+}

package/src/redaction.mjs

@@ -5,6 +5,10 @@
 // best-effort filter: unrecognized formats can remain, and code that merely
 // resembles an assignment can be over-redacted. Every quantifier is bounded or
 // excludes its delimiter, so scanning stays linear in the input length.
+//
+// This is deliberately not a dependency. Scanner libraries such as secretlint
+// detect provider token formats only; they miss the assignment, URL and command
+// forms below, and would add dozens of packages to a CLI that ships none.
 
 const marker = kind => `[REDACTED:${kind}]`;
 
@@ -32,6 +36,25 @@ function luhnValid(value) {
   return sum % 10 === 0;
 }
 
+const CF_ODD = [1, 0, 5, 7, 9, 13, 15, 17, 19, 21, 2, 4, 18, 20, 11, 3, 6, 8, 12, 14, 16, 10, 22, 25, 24, 23];
+function codiceFiscaleValid(value) {
+  const text = value.toUpperCase();
+  if (text.length !== 16) return false;
+  let sum = 0;
+  for (let i = 0; i < 15; i++) {
+    const code = text.charCodeAt(i);
+    const index = code >= 65 ? code - 65 : code - 48;
+    if (index < 0 || index > 25) return false;
+    sum += i % 2 === 0 ? CF_ODD[index] : index;
+  }
+  return text.charCodeAt(15) === 65 + (sum % 26);
+}
+
+function phoneValid(value) {
+  const digits = value.replace(/[^0-9]/g, '').length;
+  return digits >= 8 && digits <= 15;
+}
+
 const base64 = code => (code >= 48 && code <= 57) || (code >= 65 && code <= 90) || (code >= 97 && code <= 122)
   || code === 43 || code === 47 || code === 61;
 
@@ -58,32 +81,81 @@ function redactKeyTails(text) {
   return copied ? output + text.slice(copied) : text;
 }
 
+// Setting names that hold a secret. "pass", "auth" and "key" are too common in
+// ordinary names (tests_pass, AUTH_MODE, primary_key), so they are matched only
+// as upper-case environment names or as the whole word, further below.
+const SECRET_NAME = '(?:passw(?:or)?d|pwd|passphrase|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|signing[_-]?key|encryption[_-]?key|credentials?)';
+// Characters that may follow an unquoted value. A comma or semicolon ends it
+// only before whitespace, so a password such as a;b is not cut after one letter.
+const VALUE = '(?:[^\\s"\'&,;]|[,;](?=[^\\s"\'&]))';
+const SEPARATOR = '(["\']?[ \\t]{0,8}[:=][ \\t]{0,8})';
+const FLAG_NAME = '(?:password|passwd|pwd|passphrase|pass|token|secret|api-?key|access-?key|private-?key|client-?secret|auth-?token|auth)';
+
 /** @type {ReadonlyArray<readonly [RegExp, string | ((...match: string[]) => string)] | ((text: string) => string)>} */
 const RULES = Object.freeze([
   // A block cut off by excerpting is still redacted through the end of text.
   [/-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----|$)/g, marker('private_key')],
   redactKeyTails,
-  [/\b([a-z][a-z0-9+.-]{1,20}:\/\/)[^\s:@/]{1,256}:[^\s@/]{1,256}@/gi, (_, scheme) => `${scheme}${marker('credentials')}@`],
+  // The userinfo may have an empty user (redis://:pw@host) and a password that
+  // contains "@": the match runs to the last "@" before the host.
+  [/\b([a-z][a-z0-9+.-]{1,20}:\/\/)[^\s:@/]{0,256}:[^\s/]{1,256}@/gi, (_, scheme) => `${scheme}${marker('credentials')}@`],
+  // Provider token formats with distinctive prefixes.
   [/\bsk-[A-Za-z0-9_-]{20,}/g, marker('secret')],
   [/\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/g, marker('secret')],
+  [/\bwhsec_[A-Za-z0-9]{16,}/g, marker('secret')],
   [/\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g, marker('secret')],
   [/\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{22,})/g, marker('secret')],
   [/\bglpat-[A-Za-z0-9_-]{20,}/g, marker('secret')],
   [/\bxox[abposr]-[A-Za-z0-9-]{10,}/g, marker('secret')],
   [/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]{8,}/g, marker('secret')],
   [/\bAIza[0-9A-Za-z_-]{35}/g, marker('secret')],
+  [/\bya29\.[A-Za-z0-9_-]{20,}/g, marker('secret')],
   [/\bnpm_[A-Za-z0-9]{36}/g, marker('secret')],
+  [/\bpypi-[A-Za-z0-9_-]{50,}/g, marker('secret')],
+  [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g, marker('secret')],
+  [/\bshp(?:at|ca|pa|ss)_[a-f0-9]{32}\b/g, marker('secret')],
+  [/\bhf_[A-Za-z0-9]{30,}/g, marker('secret')],
+  [/\bdo[por]_v1_[a-f0-9]{64}\b/g, marker('secret')],
+  [/\blin_api_[A-Za-z0-9]{30,}/g, marker('secret')],
+  [/\bntn_[A-Za-z0-9]{30,}/g, marker('secret')],
+  [/\bdapi[a-f0-9]{32}\b/g, marker('secret')],
+  [/\bATATT3[A-Za-z0-9_=-]{20,}/g, marker('secret')],
+  [/\bkey-[0-9a-f]{32}\b/g, marker('secret')],
+  [/\bSK[0-9a-f]{32}\b/g, marker('secret')],
+  [/\b[0-9]{8,10}:[A-Za-z0-9_-]{35}\b/g, marker('secret')],
   [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, marker('secret')],
+  [/\b((?:AccountKey|SharedAccessKey|SharedAccessSignature)=)[^;\s"']{8,}/g, (_, prefix) => `${prefix}${marker('secret')}`],
   [/\b((?:proxy-)?authorization["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:(Bearer|Basic|Token|Digest)[ \t]+)?[^\s"',;]{4,}/gi,
     (_, prefix, scheme) => `${prefix}${scheme ? `${scheme} ` : ''}${marker('secret')}`],
+  [/\b((?:set-)?cookie["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)[^\r\n"']{8,}/gi, (_, prefix) => `${prefix}${marker('secret')}`],
   [/\b(Bearer[ \t]+)[A-Za-z0-9._~+/-]{16,}=*/g, (_, prefix) => `${prefix}${marker('secret')}`],
+  // Command lines: curl -u user:pass, --password value, sshpass -p, mysql -pvalue.
+  [/((?:^|\s)(?:-u|--user|--proxy-user)(?:[ \t]+|=)["']?)[^\s:"']{0,64}:[^\s"']+/g, (_, prefix) => `${prefix}${marker('credentials')}`],
+  [new RegExp(`((?:^|\\s)--?[a-z0-9-]{0,31}?${FLAG_NAME})([ \\t]+|=)(?!-)(["']?)[^\\s"']{4,}`, 'gi'),
+    (_, flag, separator, quote) => `${flag}${separator}${quote}${marker('secret')}`],
+  [/\b(sshpass[ \t]+-p[ \t]*["']?)[^\s"']+/g, (_, prefix) => `${prefix}${marker('secret')}`],
+  [/\b((?:mysql|mysqldump|mysqladmin|mariadb)\b[^\n]{0,200}?[ \t]-p)\S{3,}/g, (_, prefix) => `${prefix}${marker('secret')}`],
   // Keep the setting name: it tells the classifier what kind of work this is.
-  [/\b([A-Za-z0-9_.-]{0,40}(?:passw(?:or)?d|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|credentials?)[A-Za-z0-9_.-]{0,40})(["']?[ \t]{0,8}[:=][ \t]{0,8})(["']?)[^\s"',;]{4,}/gi,
+  // A quoted value may contain spaces and delimiters.
+  [new RegExp(`\\b([A-Za-z0-9_.-]{0,40}${SECRET_NAME}[A-Za-z0-9_.-]{0,40})${SEPARATOR}(["'])(?:(?!\\3)[^\\r\\n]){4,512}\\3`, 'gi'),
+    (_, name, separator, quote) => `${name}${separator}${quote}${marker('secret')}${quote}`],
+  [new RegExp(`\\b([A-Za-z0-9_.-]{0,40}${SECRET_NAME}[A-Za-z0-9_.-]{0,40})${SEPARATOR}(["']?)${VALUE}{4,}`, 'gi'),
+    (_, name, separator, quote) => `${name}${separator}${quote}${marker('secret')}`],
+  // Upper-case environment names ending in _KEY, _PASS or _AUTH (STRIPE_KEY,
+  // DB_PASS), and the bare lowercase words pass and auth. Booleans stay readable.
+  [new RegExp(`\\b([A-Z][A-Z0-9_]{0,40}[_-]KEY|(?:[A-Z][A-Z0-9_]{0,40}[_-])?(?:PASS|AUTH))${SEPARATOR}(["']?)${VALUE}{4,}`, 'g'),
     (_, name, separator, quote) => `${name}${separator}${quote}${marker('secret')}`],
+  [new RegExp(`(?<![A-Za-z0-9_-])((?:pass|auth)["']?[ \\t]{0,8}[:=][ \\t]{0,8})(["']?)(?!(?:true|false|null|none|undefined)\\b)${VALUE}{4,}`, 'gi'),
+    (_, prefix, quote) => `${prefix}${quote}${marker('secret')}`],
   [/\b[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g, marker('email')],
   [/\b[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g, match => ibanValid(match) ? marker('iban') : match],
   // Major card networks only, so millisecond timestamps and IDs survive.
   [/\b(?:4|5[1-5]|2[2-7]|3[47]|6)(?:[0-9][ -]?){11,17}[0-9]\b/g, match => luhnValid(match) ? marker('card') : match],
+  // Italian tax code (checksum-validated) and US social security numbers.
+  [/\b[A-Z]{6}[0-9LMNPQRSTUV]{2}[A-EHLMPRST][0-9LMNPQRSTUV]{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z]\b/g, match => codiceFiscaleValid(match) ? marker('national_id') : match],
+  [/\b(?!000|666|9[0-9]{2})[0-9]{3}-(?!00)[0-9]{2}-(?!0000)[0-9]{4}\b/g, marker('national_id')],
+  // International phone numbers need a leading plus sign and 8 to 15 digits.
+  [/(?<![\w+])\+[0-9][0-9 .()-]{6,20}[0-9]/g, match => phoneValid(match) ? marker('phone') : match],
 ]);
 
 /** @param {string} text */

package/src/server.mjs

@@ -47,8 +47,10 @@ function readBody(req, limit) {
 
 function jsonError(res, status, message) {
   if (res.headersSent || res.destroyed) { res.destroy(); return; }
-  res.writeHead(status, { 'content-type': 'application/json' });
+  // An oversized body is no longer read; close rather than keep the socket.
+  res.writeHead(status, { 'content-type': 'application/json', ...(status === 413 ? { connection: 'close' } : {}) });
   res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message } }));
+  if (status === 413) res.once('finish', () => res.socket?.destroy());
 }
 
 function upstreamHeaders(incoming, config) {

package/src/session-history.mjs

@@ -232,7 +232,7 @@ export async function sessionsCommand(args, { env = process.env, write = console
     throw new Error('Usage: claude-autorouter sessions list [--json] | sessions show ID [--json]');
   }
   // History needs only the log directory; never prompt for keychain access.
-  const loaded = loadUserConfig(env, { allowMissing: true, readSecrets: false });
+  const loaded = loadUserConfig(env, { allowMissing: true, readSecrets: false, enforcePolicy: false });
   const directory = parseSessionLogDir(loaded.env.AUTOROUTER_SESSION_LOG_DIR);
   if (!directory) {
     const report = { schema_version: 1, type: 'session_history', logging_enabled: false, sessions: [],

package/src/status-cleanup.mjs

@@ -0,0 +1,65 @@
+import * as fileSystem from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// A launcher that is killed hard (SIGKILL, power loss) cannot delete its
+// private status directory, which also holds the rewritten Claude settings.
+// The next launch removes directories whose owning process is gone. Only
+// directories this user created, with owner-only permissions, are considered.
+const PREFIX = 'autorouter-status-';
+const MAX_ENTRIES = 200;
+const SNAPSHOT_LIMIT = 1024 * 1024;
+// Without a readable snapshot, wait before treating a directory as abandoned so
+// a launch that is still starting is never removed.
+const UNREADABLE_GRACE_MS = 10 * 60 * 1000;
+// A reused process ID can look alive. The heartbeat is written every few
+// seconds, so a snapshot this old belongs to an earlier process even if a
+// sleeping machine suspended the real one for a while.
+const HEARTBEAT_STALE_MS = 24 * 60 * 60 * 1000;
+
+const defaultAlive = pid => {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+};
+
+async function readSnapshot(io, path) {
+  let handle;
+  try {
+    handle = await io.open(path, 'r');
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > SNAPSHOT_LIMIT) return undefined;
+    return JSON.parse(await handle.readFile('utf8'));
+  } catch { return undefined; }
+  finally { try { await handle?.close(); } catch {} }
+}
+
+/**
+ * Best effort and never throws. Returns the number of directories removed.
+ * @param {{directory?:string,io?:typeof fileSystem,alive?:(pid:number)=>boolean,now?:number,uid?:number}} [options]
+ */
+export async function removeStaleStatusDirectories({
+  directory = tmpdir(), io = fileSystem, alive = defaultAlive, now = Date.now(), uid = process.getuid?.(),
+} = {}) {
+  let removed = 0;
+  try {
+    if (uid === undefined) return 0;
+    const names = (await io.readdir(directory)).filter(name => name.startsWith(PREFIX)).slice(0, MAX_ENTRIES);
+    for (const name of names) {
+      try {
+        const path = join(directory, name);
+        const stat = await io.lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== uid || (stat.mode & 0o077) !== 0) continue;
+        const snapshot = await readSnapshot(io, join(path, 'state.json'));
+        const pid = snapshot?.pid;
+        let stale;
+        if (Number.isSafeInteger(pid) && pid > 0) {
+          const heartbeat = Number.isFinite(snapshot.heartbeat_at) ? snapshot.heartbeat_at : 0;
+          stale = !alive(pid) || now - heartbeat > HEARTBEAT_STALE_MS;
+        } else stale = now - stat.mtimeMs > UNREADABLE_GRACE_MS;
+        if (!stale) continue;
+        await io.rm(path, { recursive: true, force: true });
+        removed++;
+      } catch {}
+    }
+  } catch {}
+  return removed;
+}

package/src/user-config.mjs

@@ -6,6 +6,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { createKeychain } from './keychain.mjs';
+import { applyPolicy, loadPolicy } from './policy.mjs';
 
 export const CONFIG_KEYS = Object.freeze([
   'AUTOROUTER_AUTH_MODE', 'AUTOROUTER_CLIENT_PROFILE', 'AUTOROUTER_SECRET_STORE',
@@ -70,24 +71,34 @@ function validate(values) {
   return validated;
 }
 
+// The path is printed, stored in Keychain item labels and sent to the macOS
+// `security -i` command parser, which reads one command per line. Control
+// characters (including line and paragraph separators) can therefore split a
+// command or inject terminal escapes, and no real configuration path needs them.
+const UNSAFE_PATH = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/;
+
 export function getConfigPath(env = process.env) {
+  let path;
   if (env.AUTOROUTER_CONFIG !== undefined) {
     if (typeof env.AUTOROUTER_CONFIG !== 'string' || !env.AUTOROUTER_CONFIG.trim()) {
       throw configError('AUTOROUTER_CONFIG must be a non-empty path.');
     }
-    return resolve(env.AUTOROUTER_CONFIG);
-  }
-  const xdg = env.XDG_CONFIG_HOME;
-  if (xdg !== undefined && (typeof xdg !== 'string' || (xdg && !isAbsolute(xdg)))) {
-    throw configError('XDG_CONFIG_HOME must be an absolute path when set.');
+    path = resolve(env.AUTOROUTER_CONFIG);
+  } else {
+    const xdg = env.XDG_CONFIG_HOME;
+    if (xdg !== undefined && (typeof xdg !== 'string' || (xdg && !isAbsolute(xdg)))) {
+      throw configError('XDG_CONFIG_HOME must be an absolute path when set.');
+    }
+    path = join(xdg || join(homedir(), '.config'), 'claude-autorouter', 'config.json');
   }
-  return join(xdg || join(homedir(), '.config'), 'claude-autorouter', 'config.json');
+  if (UNSAFE_PATH.test(path)) throw configError('The AutoRouter configuration path must not contain control characters.');
+  return path;
 }
 
 // The saved store setting decides where saved secrets live; the environment
 // only overrides values. With the keychain store, `values` includes secrets
 // read from the keychain so callers can update settings without losing them.
-export function loadUserConfig(env = process.env, { allowMissing = false, readSecrets = true, keychain = defaultKeychain } = {}) {
+function readUserConfig(env, { allowMissing = false, readSecrets = true, keychain = defaultKeychain } = {}) {
   const path = getConfigPath(env);
   let content;
   try {
@@ -126,6 +137,18 @@ export function loadUserConfig(env = process.env, { allowMissing = false, readSe
     secretStore, keychainSecrets, unavailableSecrets };
 }
 
+// An organization policy, when present, is applied last. Its allowlists reject
+// a disallowed choice and its locks replace file and environment values, so
+// every consumer of the effective environment sees the enforced settings.
+// `policy` options exist for tests; production always uses the system path.
+export function loadUserConfig(env = process.env, { policy: policyOptions, enforcePolicy = true, ...options } = {}) {
+  const policy = loadPolicy(policyOptions);
+  const loaded = readUserConfig(env, options);
+  if (!policy) return loaded;
+  const applied = applyPolicy(loaded.env, policy.values, { allowlists: enforcePolicy });
+  return { ...loaded, env: applied.env, policy: policy.values, policyPath: policy.path, policyLocked: applied.locked };
+}
+
 // Keychain items to delete when saving `nextStore`, given what was loaded.
 // Moving between stores needs every saved secret, so refuse while one could
 // not be read; deleting it unseen would lose it.