solrouter 0.1.0

package/src/secrets.js

@@ -0,0 +1,48 @@
+// secrets.js — detectors for the things a coding agent leaks that pseudonymise.js
+// does not look for: API keys, tokens, private keys, connection strings, internal
+// hosts. Same shape as pseudonymise's `patterns` option, so they compose: pass
+// SECRET_PATTERNS through and they share one overlap-resolution pass.
+//
+// Zero-dependency by design. This file ships into someone else's machine.
+
+export const SECRET_PATTERNS = [
+  // Provider keys — specific prefixes first so the generic rule never eats them.
+  { label: "OPENAI_KEY", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+  { label: "ANTHROPIC_KEY", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { label: "SOLROUTER_KEY", re: /\bsk_solrouter_[A-Za-z0-9]{16,}\b/ },
+  { label: "AWS_KEY", re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/ },
+  { label: "GITHUB_TOKEN", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
+  { label: "GOOGLE_KEY", re: /\bAIza[A-Za-z0-9_-]{35}\b/ },
+  { label: "SLACK_TOKEN", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+  { label: "STRIPE_KEY", re: /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}\b/ },
+
+  // PEM private keys — grab the whole block, not just the header.
+  { label: "PRIVATE_KEY",
+    re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----/ },
+
+  // JWTs — three base64url segments.
+  { label: "JWT", re: /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/ },
+
+  // Connection strings with an embedded password.
+  { label: "DB_URL",
+    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s:@/]+:[^\s@/]+@[^\s/]+/i },
+
+  // Bearer header values.
+  { label: "BEARER", re: /\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*\b/ },
+
+  // Internal hostnames a model has no business seeing.
+  { label: "INTERNAL_HOST",
+    re: /\b[a-z0-9][a-z0-9.-]*\.(?:internal|corp|local|intranet|lan|svc\.cluster\.local)\b/i },
+
+  // "SECRET=…", "api_key: …", "token=…" — a labelled assignment. Captures the
+  // value; validated to skip obvious placeholders like "your-key-here".
+  { label: "ASSIGNED_SECRET",
+    re: /\b(?:[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|API_KEY|PRIVATE_KEY|ACCESS_KEY))\b\s*[:=]\s*["']?([^\s"',}]{8,})/i,
+    check: v => {
+      const val = (v.split(/[:=]/).slice(1).join("=") || v).replace(/["']/g, "").trim();
+      return !/^(?:your|my|the|example|changeme|placeholder|xxx+|<[^>]+>|\.\.\.)/i.test(val)
+        && !/^\$\{?[A-Z0-9_]+\}?$/.test(val); // not itself an env-var reference
+    } },
+];
+
+export default SECRET_PATTERNS;

package/src/server.js

@@ -0,0 +1,81 @@
+// server.js — the local HTTP endpoint a coding tool points at. Exposes the two
+// dialects a coding tool speaks:
+//   POST /v1/chat/completions   (OpenAI)
+//   POST /v1/messages           (Anthropic)
+//   GET  /health
+// It masks, routes, restores, and receipts each call via index.js. Binds to
+// localhost only — nothing here should be reachable off the machine.
+
+import { createServer } from "node:http";
+import { handle, handleStream } from "./index.js";
+import { writeReceipt } from "./receipt.js";
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    req.on("data", c => { data += c; if (data.length > 25 * 1024 * 1024) req.destroy(); });
+    req.on("end", () => { try { resolve(data ? JSON.parse(data) : {}); } catch (e) { reject(e); } });
+    req.on("error", reject);
+  });
+}
+
+const lower = h => Object.fromEntries(Object.entries(h).map(([k, v]) => [k.toLowerCase(), v]));
+
+export function startServer(cfg) {
+  const server = createServer(async (req, res) => {
+    const send = (code, obj) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(obj)); };
+
+    if (req.method === "GET" && req.url === "/health") return send(200, { ok: true, proxy: "solrouter", mode: cfg.mode });
+    if (req.method !== "POST" || !/^\/(v1\/chat\/completions|v1\/messages)$/.test(req.url)) {
+      return send(404, { error: "not found" });
+    }
+
+    let body;
+    try { body = await readBody(req); } catch { return send(400, { error: "invalid JSON body" }); }
+    const ctx = { path: req.url, headers: lower(req.headers) };
+
+    try {
+      if (body.stream) {
+        const s = await handleStream(body, ctx, cfg);
+        // Private leg can't stream yet — it returns a prebuilt body (receipt
+        // already written inside handle()). Send it as a normal JSON 200.
+        if (s.prebuilt) return send(s.status || 200, s.json);
+        if (!s.ok || !s.stream) return send(s.status || 502, { error: "upstream error", leg: s.leg });
+        res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", "connection": "keep-alive" });
+        const restorer = cfg.masking?.enabled === false ? null : s.masker.streamingUnmasker();
+        const reader = s.stream.getReader();
+        const dec = new TextDecoder();
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          const chunk = dec.decode(value, { stream: true });
+          res.write(restorer ? restorer.push(chunk) : chunk);
+        }
+        if (restorer) res.write(restorer.flush());
+        res.end();
+        if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
+          leg: s.leg, reason: s.reason, model: s.model,
+          entities: s.masker.entities(), refused: false, sentToProvider: s.sent,
+        });
+        return;
+      }
+
+      const out = await handle(body, ctx, cfg);
+      res.writeHead(out.status || 200, { "content-type": "application/json" });
+      res.end(JSON.stringify(out.json ?? { error: "no response" }));
+    } catch (e) {
+      send(502, { error: "proxy error", detail: String(e?.message || e) });
+    }
+  });
+
+  server.listen(cfg.port, "127.0.0.1", () => {
+    console.log(`SolRouter proxy on http://127.0.0.1:${cfg.port}`);
+    console.log(`  mode=${cfg.mode}  frontier=${cfg.frontier.model || "(client's model)"} [${cfg.frontier.auth || "passthrough"}]  private=${cfg.private.model}`);
+    console.log(`  point your tool's base URL here:`);
+    console.log(`    OpenAI-style:    http://127.0.0.1:${cfg.port}/v1`);
+    console.log(`    Anthropic-style: http://127.0.0.1:${cfg.port}`);
+  });
+  return server;
+}
+
+export default { startServer };

package/src/surrogates.js

@@ -0,0 +1,130 @@
+// surrogates.js — turn a detected identifier into a realistic, type-consistent fake
+// value, deterministically. "Marcus Bishop", not «PERSON_1».
+//
+// Why realistic and not a token: placeholder tokens make the model reason worse —
+// it loses the anchors it thinks with — and it mangles them on the way back
+// («PERSON_1» → "Person 1"). Type-consistent surrogates keep the model coherent
+// and survive the round-trip because the model tracks them by reference.
+// (SurrogateShield arXiv:2606.29567: +13 BERTScore over placeholders.)
+//
+// Deterministic: the same original value always yields the same surrogate, so a
+// value stays consistent across a whole conversation without needing to remember
+// every one — and re-identification is a plain reverse lookup.
+//
+// Zero dependency, pure JS, no node builtins — this ships into the user's machine
+// and must run identically in Node and a browser.
+
+// ── a tiny seeded PRNG so a value hashes to a stable surrogate ────────────────
+function seedFrom(str) {
+  // xmur3
+  let h = 1779033703 ^ str.length;
+  for (let i = 0; i < str.length; i++) {
+    h = Math.imul(h ^ str.charCodeAt(i), 3432918353);
+    h = (h << 13) | (h >>> 19);
+  }
+  return () => {
+    h = Math.imul(h ^ (h >>> 16), 2246822507);
+    h = Math.imul(h ^ (h >>> 13), 3266489909);
+    h ^= h >>> 16;
+    return h >>> 0;
+  };
+}
+function rngFor(value) {
+  const next = seedFrom(value);
+  return {
+    int: n => next() % n,
+    pick: arr => arr[next() % arr.length],
+  };
+}
+
+const FIRST = "James Mary Robert Patricia John Jennifer Michael Linda David Susan Marcus Elena Omar Priya Sofia Lukas Anna Tomas Nadia Felix Clara Ivan Rosa Karl Maya Leon Greta Nils Aisha Diego".split(" ");
+const LAST = "Bishop Carver Delgado Fenn Harlow Iverson Keller Mercer Novak Rhodes Stroud Vance Whitlock Ashby Brenner Cato Dane Ellison Frost Garza Holt Krause Lindqvist Moreau Petrov Quinn Sato Vogel".split(" ");
+const ORG_HEAD = "Meridian Northgate Alderman Brightwater Crossley Halcyon Ironwood Kestrel Lumen Oberon Solstice Vantage Westford".split(" ");
+const ORG_TAIL = "Systems Partners Holdings Labs Group Industries Analytics Ventures Solutions Dynamics".split(" ");
+const STREET = "Kingfisher Maple Sycamore Belmont Ashford Cranmer Downing Everett Faraday Granville Hawthorn".split(" ");
+const CITY_DE = "Bergstraße Lindenweg Rosenplatz Marktgasse Domallee Uferring Parkdamm".split(" ");
+
+const pad = (n, w) => String(n).padStart(w, "0");
+
+// Build an IBAN with a valid mod-97 check digit, so the fake passes the same
+// validator that caught the real one and downstream code stays happy.
+function fakeIban(r) {
+  const country = r.pick(["DE", "FR", "NL", "ES", "GB"]);
+  const bban = Array.from({ length: 18 }, () => r.int(10)).join("");
+  const rearranged = bban + country + "00";
+  let rem = 0;
+  for (const ch of rearranged) {
+    const v = /\d/.test(ch) ? ch : String(ch.charCodeAt(0) - 55);
+    for (const d of v) rem = (rem * 10 + Number(d)) % 97;
+  }
+  const check = pad(98 - rem, 2);
+  return country + check + bban;
+}
+
+// Luhn-valid fake card.
+function fakeCard(r) {
+  const body = Array.from({ length: 15 }, () => r.int(10));
+  let sum = 0, dbl = true;
+  for (let i = body.length - 1; i >= 0; i--) {
+    let d = body[i];
+    if (dbl) { d *= 2; if (d > 9) d -= 9; }
+    sum += d; dbl = !dbl;
+  }
+  const check = (10 - (sum % 10)) % 10;
+  return [...body, check].join("").replace(/(\d{4})(?=\d)/g, "$1 ");
+}
+
+// Keep a secret's shape (prefix + length class) but randomise the body, so the
+// model sees a plausible key and never the real one.
+function fakeLikeShape(value, r) {
+  const alnum = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  // Keep a leading prefix so the type stays recognizable (sk-proj-, sk-ant-, AKIA…)
+  // without leaking a short secret: proportional, capped at 8 chars.
+  const keep = Math.min(8, Math.max(3, Math.floor(value.length * 0.3)));
+  let seen = 0;
+  return value.replace(/[A-Za-z0-9]/g, ch =>
+    seen++ < keep ? ch : alnum[r.int(alnum.length)]);
+}
+
+const GENERATORS = {
+  PERSON: r => `${r.pick(FIRST)} ${r.pick(LAST)}`,
+  ORG: r => `${r.pick(ORG_HEAD)} ${r.pick(ORG_TAIL)}`,
+  EMAIL: r => `${r.pick(FIRST).toLowerCase()}.${r.pick(LAST).toLowerCase()}@${r.pick(["example.com", "mail.test", "acme.co"])}`,
+  PHONE: r => `+${r.int(89) + 10} ${r.int(900) + 100} ${pad(r.int(1e6), 6)}`,
+  IBAN: r => fakeIban(r),
+  CARD: r => fakeCard(r),
+  IP: r => `${r.int(223) + 1}.${r.int(256)}.${r.int(256)}.${r.int(254) + 1}`,
+  DOB: r => `${pad(r.int(28) + 1, 2)}.${pad(r.int(12) + 1, 2)}.${1950 + r.int(55)}`,
+  DATE: r => `${pad(r.int(28) + 1, 2)}.${pad(r.int(12) + 1, 2)}.${2018 + r.int(8)}`,
+  ADDRESS: (r, v) => /stra|weg|platz|gasse|ring|damm|allee/i.test(v)
+    ? `${r.pick(CITY_DE)} ${r.int(120) + 1}`
+    : `${r.int(200) + 1} ${r.pick(STREET)} Street`,
+  TAXID: r => `${r.int(90) + 10}/${pad(r.int(1000), 3)}/${pad(r.int(1e5), 5)}`,
+  VATID: r => `DE${pad(r.int(1e9), 9)}`,
+  CASEREF: r => `${r.int(90) + 10} O ${pad(r.int(1000), 3)}/${20 + r.int(6)}`,
+  MRN: r => `MRN ${pad(r.int(1e8), 8)}`,
+  INTERNAL_HOST: r => `${r.pick(["db", "api", "cache", "auth", "vault", "gw", "svc"])}.${r.pick(ORG_HEAD).toLowerCase()}.internal`,
+  DB_URL: r => `postgresql://svc:${fakeLikeShape("xxxxxxxxxxxxxxxx", r)}@${r.pick(["db", "pg"])}.${r.pick(ORG_HEAD).toLowerCase()}.internal:5432/app`,
+};
+
+// Secret labels all keep their shape; anything unknown falls back to a shaped fake.
+const SHAPE_LABELS = new Set([
+  "OPENAI_KEY", "ANTHROPIC_KEY", "SOLROUTER_KEY", "AWS_KEY", "GITHUB_TOKEN",
+  "GOOGLE_KEY", "SLACK_TOKEN", "STRIPE_KEY", "JWT", "BEARER", "PRIVATE_KEY",
+  "DB_URL", "INTERNAL_HOST", "ASSIGNED_SECRET",
+]);
+
+/**
+ * Deterministic surrogate for one detected value.
+ * @param label  entity label (PERSON, IBAN, OPENAI_KEY, …)
+ * @param value  the real value
+ * @returns a realistic, type-consistent fake
+ */
+export function surrogateFor(label, value) {
+  const r = rngFor(label + ":" + value);
+  if (GENERATORS[label]) return GENERATORS[label](r, value);
+  if (SHAPE_LABELS.has(label)) return fakeLikeShape(value, r);
+  return fakeLikeShape(value, r); // safe default: shape-preserving
+}
+
+export default { surrogateFor };

package/src/wire.js

@@ -0,0 +1,79 @@
+// wire.js — read and rewrite the two request shapes the proxy accepts:
+// OpenAI /v1/chat/completions and Anthropic /v1/messages. We only touch the
+// text the user wrote; system prompts, roles and every other field pass through.
+//
+// Kept separate from routing so the two API dialects live in one place.
+
+/** Detect which dialect a request body is. */
+export function dialect(body, path = "") {
+  if (/\/messages\b/.test(path) || Array.isArray(body?.messages) && body?.max_tokens && body?.model && !("choices" in body) && body?.system !== undefined)
+    return "anthropic";
+  if (/messages/.test(path) && body?.anthropic_version) return "anthropic";
+  return "openai"; // default; chat/completions is the common case
+}
+
+/** Pull the concatenated user-authored text out of a request body. */
+export function extractText(body, kind) {
+  const parts = [];
+  const pushContent = c => {
+    if (typeof c === "string") parts.push(c);
+    else if (Array.isArray(c)) for (const seg of c) {
+      if (typeof seg === "string") parts.push(seg);
+      else if (seg?.type === "text" && typeof seg.text === "string") parts.push(seg.text);
+    }
+  };
+  if (kind === "anthropic") {
+    if (typeof body?.system === "string") parts.push(body.system);
+    else if (Array.isArray(body?.system)) pushContent(body.system);
+  }
+  for (const m of body?.messages || []) pushContent(m?.content);
+  return parts.join("\n");
+}
+
+/** Apply a (text -> text) transform to every user-authored string in the body. */
+export function rewriteText(body, kind, fn) {
+  const out = structuredClone(body);
+  const mapContent = c => {
+    if (typeof c === "string") return fn(c);
+    if (Array.isArray(c)) return c.map(seg =>
+      seg?.type === "text" && typeof seg.text === "string" ? { ...seg, text: fn(seg.text) }
+        : typeof seg === "string" ? fn(seg) : seg);
+    return c;
+  };
+  if (kind === "anthropic" && out.system != null) out.system = mapContent(out.system);
+  if (Array.isArray(out.messages)) out.messages = out.messages.map(m => ({ ...m, content: mapContent(m.content) }));
+  return out;
+}
+
+/** Pull the assistant's text out of a (non-streaming) response body. */
+export function extractResponseText(body, kind) {
+  if (kind === "anthropic") {
+    return (body?.content || []).filter(b => b?.type === "text").map(b => b.text).join("");
+  }
+  return (body?.choices || []).map(c => c?.message?.content || "").join("");
+}
+
+/** Rewrite the assistant's text in a (non-streaming) response body. */
+export function rewriteResponseText(body, kind, fn) {
+  const out = structuredClone(body);
+  if (kind === "anthropic") {
+    out.content = (out.content || []).map(b => b?.type === "text" ? { ...b, text: fn(b.text) } : b);
+  } else {
+    out.choices = (out.choices || []).map(c =>
+      c?.message ? { ...c, message: { ...c.message, content: fn(c.message.content || "") } } : c);
+  }
+  return out;
+}
+
+/** Build a complete response body in the given dialect from a plain answer string. */
+export function buildResponse(kind, text, model) {
+  if (kind === "anthropic") {
+    return { id: "msg_proxy", type: "message", role: "assistant",
+      content: [{ type: "text", text }], model: model || "solrouter",
+      stop_reason: "end_turn", usage: {} };
+  }
+  return { id: "chatcmpl-proxy", object: "chat.completion", model: model || "solrouter",
+    choices: [{ index: 0, message: { role: "assistant", content: text }, finish_reason: "stop" }] };
+}
+
+export default { dialect, extractText, rewriteText, extractResponseText, rewriteResponseText, buildResponse };