solrouter 0.3.5 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.3.5",
+  "version": "0.4.1",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {

package/src/index.js

@@ -115,7 +115,16 @@ export async function handleStream(body, ctx = {}, cfg) {
   const toSend = withIntent(masked, kind, intent);
   const r = await streamLeg(cfg.frontier, toSend, ctx.headers);
   return { status: r.status, ok: r.ok, stream: r.stream, masker, leg, reason,
-    model: cfg.frontier.model, sent: JSON.stringify(masked) };
+    model: cfg.frontier.model, sent: JSON.stringify(masked),
+    // context the server needs to reactively reroute a streamed refusal to private:
+    kind, mode, maskedPrompt: extractText(masked, kind) };
+}
+
+/** Call the private leg for a (masked) prompt. Returns { reply, ok }. */
+export async function privateReply(cfg, maskedPrompt) {
+  const { callSolrouterAgent } = await import("./providers.js");
+  const r = await callSolrouterAgent(cfg.private, maskedPrompt);
+  return { reply: r.reply || "", ok: r.ok };
 }
 
 export { createMasker } from "./mask.js";

package/src/route.js

@@ -26,10 +26,13 @@ const LIKELY_REFUSED = [
 ];
 
 const REFUSAL_SIGNATURES = [
-  /\bI (?:can(?:'|no)?t|won'?t|am (?:not able|unable))\b.{0,60}\b(?:help|assist|comply|provide|create|generate|continue)\b/i,
-  /\bI'?m (?:sorry|afraid)\b.{0,40}\b(?:can(?:'|no)?t|won'?t|unable)\b/i,
+  /\bI (?:can(?:'|no)?t|won'?t|am (?:not able|unable))\b.{0,60}\b(?:help|assist|comply|provide|create|generate|continue|do that|with that)\b/i,
+  /\bI'?m not (?:going to|willing to|able to|comfortable)\b.{0,30}\b(?:help|assist|do|provide|create|with that|that)\b/i,
+  /\bI (?:won'?t|will not|am not going to)\b.{0,20}\b(?:help|assist|do that|provide|create)\b/i,
+  /\bI'?m (?:sorry|afraid)\b.{0,40}\b(?:can(?:'|no)?t|won'?t|unable|not able)\b/i,
   /\b(?:against|violates?)\b.{0,30}\b(?:policy|policies|guidelines|content policy)\b/i,
   /\bI (?:must|have to) (?:decline|refuse)\b/i,
+  /\bI (?:can'?t|cannot|won'?t) (?:help|assist) (?:you )?with (?:that|this)\b/i,
 ];
 
 /** Cheap local guess: would the frontier model likely refuse this? */

package/src/server.js

@@ -7,11 +7,38 @@
 // localhost only — nothing here should be reachable off the machine.
 
 import { createServer } from "node:http";
-import { handle, handleStream, createMasker } from "./index.js";
+import { handle, handleStream, createMasker, privateReply } from "./index.js";
 import { forward } from "./providers.js";
 import { dialect, rewriteText } from "./wire.js";
+import { isRefusal } from "./route.js";
 import { writeReceipt } from "./receipt.js";
 
+/** Pull assistant text out of an Anthropic SSE chunk (text_delta events). */
+function extractSseText(chunk) {
+  let out = "";
+  for (const line of String(chunk).split("\n")) {
+    if (!line.startsWith("data:")) continue;
+    try {
+      const d = JSON.parse(line.slice(5).trim());
+      if (d?.type === "content_block_delta" && d.delta?.type === "text_delta") out += d.delta.text || "";
+    } catch {}
+  }
+  return out;
+}
+
+/** Build a complete Anthropic-format SSE message from a plain text answer. */
+function synthAnthropicSse(text, model) {
+  const ev = (e, d) => `event: ${e}\ndata: ${JSON.stringify(d)}\n\n`;
+  return (
+    ev("message_start", { type: "message_start", message: { id: "msg_proxy", type: "message", role: "assistant", model: model || "solrouter", content: [], stop_reason: null, usage: { input_tokens: 0, output_tokens: 0 } } }) +
+    ev("content_block_start", { type: "content_block_start", index: 0, content_block: { type: "text", text: "" } }) +
+    ev("content_block_delta", { type: "content_block_delta", index: 0, delta: { type: "text_delta", text: String(text) } }) +
+    ev("content_block_stop", { type: "content_block_stop", index: 0 }) +
+    ev("message_delta", { type: "message_delta", delta: { stop_reason: "end_turn" }, usage: { output_tokens: 0 } }) +
+    ev("message_stop", { type: "message_stop" })
+  );
+}
+
 function readBody(req) {
   return new Promise((resolve, reject) => {
     let data = "";
@@ -66,19 +93,49 @@ export function startServer(cfg) {
         if (!s.ok || !s.stream) return send(s.status || 502, { error: "upstream error", leg: s.leg });
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", "connection": "keep-alive" });
         const restorer = cfg.masking?.enabled === false ? null : s.masker.streamingUnmasker();
+        const emit = (t) => res.write(restorer ? restorer.push(t) : t);
         const reader = s.stream.getReader();
         const dec = new TextDecoder();
+
+        // Buffer the frontier stream until we can rule out a SHORT refusal. Once
+        // the answer is clearly substantive (past the refusal window) we commit and
+        // stream live. If the whole short response is a refusal and mode is auto,
+        // we discard it and reroute to the private/uncensored leg.
+        const COMMIT_AT = 380;               // chars of answer text that means "real answer"
+        let committed = false, held = "", acc = "", refusalLikely = false;
         for (;;) {
           const { done, value } = await reader.read();
           if (done) break;
           const chunk = dec.decode(value, { stream: true });
-          res.write(restorer ? restorer.push(chunk) : chunk);
+          acc += extractSseText(chunk);
+          if (committed) { emit(chunk); continue; }
+          held += chunk;
+          // Lock onto a refusal as soon as its opening matches — then never commit,
+          // so even a long, multi-paragraph refusal gets fully buffered and rerouted.
+          if (!refusalLikely && isRefusal(acc)) refusalLikely = true;
+          if (!refusalLikely && acc.replace(/\s/g, "").length >= COMMIT_AT) { committed = true; emit(held); held = ""; }
+        }
+
+        let leg = s.leg, refused = false, model = s.model;
+        if (!committed && s.mode === "auto" && refusalLikely) {
+          // Streamed refusal → reroute to the uncensored private leg.
+          const pr = await privateReply(cfg, s.maskedPrompt);
+          if (pr.ok && pr.reply) {
+            leg = "private"; refused = true; model = cfg.private.model;
+            const restored = restorer ? s.masker.unmask(pr.reply) : pr.reply;
+            res.write(synthAnthropicSse(restored, model));
+            res.end();
+            if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
+              leg, reason: "reactive-refusal", model, entities: s.masker.entities(), refused: true, sentToProvider: s.sent });
+            return;
+          }
+          // private leg unavailable → fall through and just relay the refusal
         }
+        if (!committed) emit(held);          // short non-refusal: flush the buffer
         if (restorer) res.write(restorer.flush());
         res.end();
         if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
-          leg: s.leg, reason: s.reason, model: s.model,
-          entities: s.masker.entities(), refused: false, sentToProvider: s.sent,
+          leg, reason: s.reason, model, entities: s.masker.entities(), refused, sentToProvider: s.sent,
         });
         return;
       }