solrouter 0.4.5 → 0.6.1

package/README.md

@@ -19,10 +19,11 @@ Two things happen to every request, **on your machine, before anything leaves**:
 Every call leaves a **receipt**: a hash-chained record of what was masked, which
 model ran it, and a hash of exactly what the provider received. No PII in it.
 
-> **P0 (this version).** Prose masking, reactive refusal detection (send to
-> frontier, detect a refusal, retry on the private leg), fuzzy + streaming-safe
-> restore, receipts. Not yet: tool-call-argument masking, TEE-side classifier,
-> task decomposition. See `SPEC.md`.
+> **P0 (this version).** Prose **and tool-call** masking (message text, tool
+> inputs, tool results, and tool-definition descriptions), reactive refusal
+> detection (send to frontier, detect a refusal, retry on the private leg),
+> streaming-safe restore, receipts. Not yet: fuzzy/paraphrase restore, TEE-side
+> classifier, task decomposition. See `SPEC.md`.
 
 ## Bring your own key — it's a drop-in, not a gateway
 
@@ -56,7 +57,8 @@ straight through: `npx solrouter code --resume`. To run the proxy on its own ins
 `login` opens `solrouter.com/cli/auth`, you sign in with your SolRouter
 subscription, and a key is minted and handed back to the CLI automatically — no
 paste. (`login --token sk_solrouter_...` still works for CI / headless.) The private
-leg then calls the backend's `/agent` route (open-weight model `qwen3.8:27b`).
+leg then seals the pseudonymised prompt with `@solrouter/sdk` and sends only
+ciphertext to the backend's `/tee/process` route (open-weight model `qwen3.8:27b`).
 
 Then point any OpenAI- or Anthropic-compatible tool at it — no code change:
 
@@ -73,6 +75,21 @@ export OPENAI_BASE_URL=http://127.0.0.1:8787/v1
 # ...run your tool as usual
 ```
 
+### Which endpoints it serves
+
+It masks the two request shapes it understands: `POST /v1/chat/completions`
+(OpenAI) and `POST /v1/messages` (Anthropic), streaming included.
+`POST /v1/messages/count_tokens` is masked and forwarded as well, because Claude
+Code calls it before every request.
+
+Anything else under `/v1/` that carries a body returns **404 rather than being
+forwarded**, so nothing can leave the machine unmasked. The one that bites in
+practice is `POST /v1/responses`, OpenAI's Responses API: Codex and the Vercel AI
+SDK's default `openai()` provider use it. Point those at the chat-completions path
+instead (in the AI SDK, `openai.chat("gpt-4o")`). In `--mode private` nothing goes
+to the frontier at all: `count_tokens` is answered locally with a rough estimate
+and `/v1/models` lists the private model.
+
 ## Per-request control (headers)
 
 You keep the agency — override the router per call:
@@ -88,20 +105,42 @@ You keep the agency — override the router per call:
 ## Commands
 
 ```
-solrouter login [--token <key>]   verify account (browser), or paste a key
-solrouter start [--port N] [--mode auto|frontier|private]
+solrouter                         first run: setup, then launch your tool through the proxy
+solrouter code [...claude args]   run the proxy in-process AND launch Claude Code through it
+solrouter login [--token <key>]   verify account (browser), or paste a key for CI/headless
+solrouter start [--port N] [--mode auto|frontier|private]   just the proxy, no tool launch
+solrouter setup                   interactive configuration
 solrouter status                  config + login state
 solrouter verify                  check the receipt hash-chain
+solrouter install / uninstall     macOS: route EVERY Claude Code session (see below)
 solrouter logout
+solrouter demo                    offline masking demo, no account needed
 ```
 
+### `install` changes your machine (macOS only)
+
+`solrouter install` is invasive on purpose — it makes the proxy the default for
+*every* Claude Code session, so there is no "which window is routed" footgun. It:
+
+- writes a LaunchAgent at `~/Library/LaunchAgents/com.solrouter.proxy.plist`
+  (auto-start at login, auto-restart on crash), and
+- edits `~/.claude/settings.json`, adding `env.ANTHROPIC_BASE_URL` and
+  `env.ANTHROPIC_API_KEY` so all Claude Code traffic goes through the proxy.
+
+Heads-up: every Claude Code session then bills to that API key, not a Max/Pro
+subscription (required to use a custom endpoint). It marks the keys it adds, so
+`solrouter uninstall` removes exactly those and unloads the LaunchAgent. macOS only
+(LaunchAgent + `launchctl`); on Linux/Windows run `solrouter start` and point your
+tools at it yourself.
+
 ## Config
 
 Copy `config.example.json` to `~/.solrouter/config.json` or
 `./solrouter.config.json`. Set `frontier` / `private` base URLs, models, and
-your gazetteer of `names`. With `viaSolrouter: true` the legs go through the
-SolRouter backend (which holds provider keys and does x402 billing); otherwise set
-provider keys via `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` / `SOLROUTER_API_KEY`.
+your gazetteer of `names`. Provider keys come from `ANTHROPIC_API_KEY` /
+`OPENAI_API_KEY` / `SOLROUTER_API_KEY` (or a Claude Code subscription login).
+(A `viaSolrouter` backend-proxied billing path is planned but **not wired yet** —
+leave it out.)
 
 ## What this will not do
 

package/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: solrouter
+description: Give any agent private AI through a local SolRouter proxy. It masks names, emails, keys and hostnames on this machine, and it seals prompts for SolRouter's open-weight models so only the enclave can read them. Works with any framework or tool that can set an OpenAI or Anthropic base URL.
+license: MIT
+compatibility: Node >= 22
+---
+
+# SolRouter proxy
+
+A local HTTP proxy on `127.0.0.1:8787`. Your agent keeps its own code. You only
+change its base URL. The proxy speaks the OpenAI and the Anthropic HTTP formats,
+so any client that can set one of those base URLs can use it. Examples: the
+OpenAI or Anthropic SDKs, the Vercel AI SDK, LangChain, Codex, Cursor, Cline.
+
+## 1. Log in (once per machine)
+
+Run this in the agent's shell:
+
+```sh
+npx -y solrouter login
+```
+
+With no terminal attached, the command prints a `solrouter.com/cli/auth` link
+and returns at once. Show the link to the user. The user opens it, signs in to
+their SolRouter account, and clicks Connect. SolRouter mints an API key and
+hands it straight to the proxy on this machine. Nobody copies or pastes a key.
+
+The link works for 10 minutes and only on the machine that ran `login`. To
+confirm, run:
+
+```sh
+npx -y solrouter status    # "logged in : yes (<account>)"
+```
+
+Never ask the user to paste the key into chat. If a key ever appears in a chat
+or a log, tell the user to revoke it at solrouter.com/sdk.
+
+## 2. Start the proxy
+
+Pick one mode. The modes do not mix.
+
+```sh
+npx -y solrouter start --mode private    # SolRouter models only. Needs only the login.
+npx -y solrouter start                   # auto: your own frontier model first, SolRouter when it refuses
+```
+
+Run it in the background and wait for health:
+
+```sh
+curl -s http://127.0.0.1:8787/health   # {"ok":true,"proxy":"solrouter",...}
+```
+
+## 3. Point the agent at it
+
+```sh
+export OPENAI_BASE_URL=http://127.0.0.1:8787/v1
+export ANTHROPIC_BASE_URL=http://127.0.0.1:8787
+```
+
+```js
+new OpenAI({ baseURL: "http://127.0.0.1:8787/v1", apiKey: "solrouter" })
+new Anthropic({ baseURL: "http://127.0.0.1:8787", apiKey: "solrouter" })
+```
+
+In `--mode private`, the client API key is not used. Any non-empty string
+works, because the proxy uses the SolRouter login. In `auto` mode, pass your
+real Anthropic or OpenAI key. The proxy forwards it to that provider.
+
+Streaming works in both modes. To send one request to SolRouter in `auto` mode,
+add the header `x-route: private`.
+
+Use the chat-completions or messages path. The proxy serves
+`POST /v1/chat/completions`, `POST /v1/messages` and `POST /v1/messages/count_tokens`.
+Any other `/v1/` path with a body returns 404, because the masker does not
+understand that shape and nothing leaves the machine unmasked. This includes
+`POST /v1/responses`: if the framework defaults to OpenAI's Responses API (Codex,
+and the Vercel AI SDK's `openai()` provider), switch it to chat completions
+(`openai.chat("gpt-4o")`).
+
+## What each leg protects
+
+- **Private leg (SolRouter models, `qwen3.8:27b`):** the proxy masks identifiers,
+  then `@solrouter/sdk` encrypts the prompt on this machine. The SolRouter
+  backend relays only ciphertext to the TEE. The reply comes back encrypted and
+  is decrypted here.
+- **Frontier leg (your Claude or GPT):** identifiers are masked and restored on
+  this machine. The provider reads the masked prompt. It cannot be encrypted,
+  because the provider must read the prompt to answer it.
+- **Both legs:** the proxy process on this machine sees the real values.
+- **Not yet:** the SDK trusts the TEE key that the backend serves. Attestation
+  checks of that key are not built.
+
+## Errors
+
+- `logged in : no`: run `npx -y solrouter login` and show the user the link.
+- `401` with `no SolRouter API key` from the private leg: the login is missing.
+  Run `login` again.
+- `502` with a `SolRouter API error: ...` message from the private leg: SolRouter
+  refused or failed. Typical causes: a revoked key (run `login` again), no plan
+  allowance or balance left, or the TEE model is offline.
+- `404` with `is not supported by the solrouter proxy`: the client called a path
+  the masker does not understand, almost always `/v1/responses`. Switch the client
+  to chat completions.
+- `404` with `is not available in private mode`: in `--mode private` only the
+  chat-completions and messages paths are served, because nothing may reach the
+  frontier.
+- `ECONNREFUSED 127.0.0.1:8787`: the proxy is not running. Start it.

package/SPEC.md

@@ -109,9 +109,10 @@ pseudonymised.
   LIMITS block — keep it).
 
 ### 5.2 Restorer (local, streaming-safe)
-- **Fuzzy / n-gram matching, never exact replace** — models re-case, split, or paraphrase the
-  value (LangChain graded strategies: exact → case-insensitive → fuzzy → n-gram). Realistic
-  surrogates survive round-trips better than tokens.
+- **Restore ladder: exact → case-insensitive → (planned) fuzzy / n-gram** — models re-case,
+  split, or paraphrase the value (LangChain graded strategies). **Shipped in 0.5.x: exact +
+  case-insensitive.** Fuzzy/n-gram is deferred, so a paraphrased surrogate can still miss;
+  realistic surrogates survive round-trips better than tokens and keep that gap small.
 - **Streaming:** buffer at chunk boundaries; a surrogate can be split across chunks. Restore
   over a reassembled boundary-safe window, not per token. (qaskills.sh streaming-redaction.)
 - Leak check: assert no residual surrogate tokens in assembled output.
@@ -168,11 +169,13 @@ openly, that the user controls.
 
 ## 8. PoC phases (proposed, post-approval)
 1. **P0 — local proxy, prose only:** OpenAI/Anthropic dialects, surrogate masking, reactive
-   refusal detection (substrings), fuzzy restore, receipt. Demo: Claude Code on a repo with a
+   refusal detection (substrings), exact + case-insensitive restore (fuzzy deferred), receipt. Demo: Claude Code on a repo with a
    `.env`; split screen provider-view vs user-view.
 2. **P1 — TEE router:** move detection/prediction into the TEE; add WildGuard-class classifier;
    `x-route` + `x-intent` headers.
-3. **P2 — tool-call + streaming:** structural JSON masking, streaming-safe restore.
+3. **P2 — tool-call + streaming:** structural JSON masking (landed early, in 0.5.2:
+   tool inputs, tool results, tool-call arguments, tool-definition descriptions),
+   streaming-safe restore.
 4. **P3 — decomposition:** conservative orchestrator for independent/permission segments only.
 5. **P4 — SDK middleware:** fold the core into `@solrouter/sdk` as opt-in.
 

package/TESTING.md

@@ -1,8 +1,8 @@
 # Testing the proxy (no account needed)
 
 Everything below runs locally with **no SolRouter login**. The frontier leg uses
-your own key; the private/uncensored leg needs a login (endpoint not built yet — see
-bottom).
+your own key; the private/uncensored leg needs a SolRouter login (browser `login`,
+or `login --token` for CI/headless — see §4).
 
 Requires Node 22+. From `dev/backend/packages/router-proxy/`:
 
@@ -81,8 +81,8 @@ Per-request control:
 
 ## 4. Test the private/uncensored leg (real backend)
 
-The private leg calls the SolRouter backend's `/agent` route with a `sk_solrouter_`
-key — the same key type the backend already issues. No new endpoint needed.
+The private leg seals the pseudonymised prompt with `@solrouter/sdk` and sends
+only ciphertext to the backend's `/tee/process` route, with a `sk_solrouter_` key.
 
 ```bash
 solrouter login --token sk_solrouter_...   # your SolRouter API key
@@ -93,8 +93,9 @@ curl http://127.0.0.1:8787/v1/chat/completions \
   -d '{"model":"x","messages":[{"role":"user","content":"..."}]}'
 ```
 
-It hits `POST {backend}/agent` with `{prompt, model:"qwen3.8:27b", useTools:false}`,
-stateless (no chatId needed for API-key users). `x-route: auto` (the default) tries
+It fetches `GET {backend}/tee/public-key`, then posts `POST {backend}/tee/process`
+with `{encryptedPrompt, model:"nosana:qwen3.8:27b"}`. The reply comes back
+encrypted and is opened on your machine. `x-route: auto` (the default) tries
 the frontier model first and reroutes here if it refuses.
 
 Requires the backend + its Nosana/TEE node to be up (it's the live prod backend by
@@ -106,5 +107,5 @@ default). If the Qwen node is cold, see `scripts/NOSANA_RUNBOOK.md`.
   frontier leg with your own key (§2–3).
 - **Needs a `sk_solrouter_` key + backend up:** the private/uncensored leg (§4).
 
-The only not-yet-built convenience is the browser `login` (loopback OAuth); the
-`--token` path is complete and is what makes the private leg work today.
+Both logins work: the browser `login` (loopback round-trip) and the `--token` path
+for CI/headless. Either mints/saves the `sk_solrouter_` key the private leg uses.

package/bin/proxy.js

@@ -7,17 +7,51 @@
 //   solrouter logout
 
 import { loadConfig, isLoggedIn, loadAuth, HOME_DIR } from "../src/config.js";
-import { browserLogin, loginWithToken } from "../src/auth.js";
+import { browserLogin, loginWithToken, detachedLogin, listenForLogin } from "../src/auth.js";
 import { startServer } from "../src/server.js";
 import { verifyChain } from "../src/receipt.js";
 import { runDemo } from "../src/demo.js";
-import { rmSync, existsSync } from "node:fs";
+import { rmSync, existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 const [, , cmdRaw, ...rest] = process.argv;
 const cmd = cmdRaw || "run";
 const flag = name => { const i = rest.indexOf(name); return i >= 0 ? (rest[i + 1] ?? true) : undefined; };
 
+const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+
+// Every real subcommand. Anything else in the command slot is a typo or a stray
+// flag and must not silently fall through to "launch Claude Code".
+const KNOWN = new Set([
+  "login", "logout", "status", "banner", "demo", "verify",
+  "install", "uninstall", "code", "claude", "setup", "run", "start",
+]);
+
+function usage() {
+  return `solrouter ${VERSION} — local privacy proxy for coding tools
+
+Usage: solrouter [command] [options]
+
+Commands:
+  (none) / run    set up on first run, then launch your tool through the proxy
+  code [args]     start the proxy and launch Claude Code through it (alias: claude)
+  start           run just the proxy, no tool launch
+  setup           interactive configuration
+  install         install as a background service (auto-start); uninstall to remove
+  login           verify your SolRouter account in the browser (login --token <key> to paste).
+                  Without a terminal (an agent's shell), it prints the link and returns at once.
+  logout          sign out
+  status          show config + login state
+  verify          check the receipt hash-chain
+  demo            run the masking demo (no keys needed)
+
+Options:
+  --port <n>      proxy port (default from config)
+  --mode <m>      routing mode
+  -v, --version   print version
+  -h, --help      show this help`;
+}
+
 // Find a genuinely free port starting from `start`. Prevents the footgun where a
 // STALE proxy already on the port gets silently reused, so old code keeps running
 // after a version bump.
@@ -60,14 +94,47 @@ async function startProxyAndLaunch(cfg, tool, launch, passThru = []) {
 }
 
 async function main() {
+  // Version / help, and reject unknown commands, before any command runs — so a
+  // flag or typo never falls through to the default "launch Claude Code" path.
+  if (cmdRaw === "--version" || cmdRaw === "-v") { console.log(VERSION); return; }
+  if (cmdRaw === "--help" || cmdRaw === "-h" || rest.includes("--help") || rest.includes("-h")) {
+    console.log(usage());
+    return;
+  }
+  if (cmdRaw && !KNOWN.has(cmdRaw)) {
+    console.error(`Unknown command: ${cmdRaw}\n`);
+    console.error(usage());
+    process.exit(1);
+  }
+
   switch (cmd) {
     case "login": {
-      const token = flag("--token");
-      if (token && token !== true) {
+      if (rest.includes("--token")) {
+        // Same check as @solrouter/sdk, so a typo fails here, not on the first private call.
+        const token = flag("--token");
+        if (typeof token !== "string" || !token.startsWith("sk_solrouter_") || token.length < 33) {
+          console.error("login --token needs a SolRouter API key: sk_solrouter_ followed by at least 20 characters.");
+          process.exit(1);
+        }
         loginWithToken(token, flag("--account") || null);
         console.log("Saved. You're logged in.");
         return;
       }
+      // Internal: the detached listener behind an agent login.
+      if (flag("--listen")) process.exit(await listenForLogin(Number(flag("--listen")) || 600000));
+      // No terminal: an agent runs this. Print the link now; the listener waits.
+      if (!process.stdout.isTTY) {
+        try {
+          const url = await detachedLogin();
+          console.log("Open this link and approve with your SolRouter account:");
+          console.log("  " + url);
+          console.log("The link works for 10 minutes. Then run `solrouter status` to confirm.");
+        } catch (e) {
+          console.error("Login failed:", e.message);
+          process.exit(1);
+        }
+        return;
+      }
       try {
         const t = await browserLogin();
         console.log(`Logged in${t.account ? " as " + t.account : ""}.`);
@@ -119,6 +186,26 @@ async function main() {
       return;
     }
 
+    case "install": {
+      const { install } = await import("../src/install.js");
+      const r = await install();
+      if (!r.ok) { console.error("Install failed:", r.error); process.exit(1); }
+      console.log(`\n✓ SolRouter installed as a background service on http://127.0.0.1:${r.port}`);
+      console.log(`  EVERY Claude Code session now routes through the proxy automatically —`);
+      console.log(`  no special window, no special command. Just open Claude Code.`);
+      console.log(`  (auto-starts at login, restarts on crash)\n`);
+      console.log(`  Heads up: all Claude Code now bills to your API key, not your Max subscription`);
+      console.log(`  — that's required to use a custom endpoint. Undo anytime:  solrouter uninstall\n`);
+      return;
+    }
+
+    case "uninstall": {
+      const { uninstall } = await import("../src/install.js");
+      uninstall();
+      console.log("✓ SolRouter uninstalled. Claude Code goes straight to Anthropic again.");
+      return;
+    }
+
     // `solrouter code [claude args...]` — the one-command path: start the proxy
     // in THIS process, then launch Claude Code already pointed at it, in the same
     // tab. When Claude Code exits, so does the proxy. (`claude` is the alias.)

package/config.example.json

@@ -7,7 +7,7 @@
     "model": "claude-opus-5"
   },
   "private": {
-    "baseUrl": "https://solrouter-obb4.onrender.com",
+    "baseUrl": "https://api.solrouter.com",
     "dialect": "openai",
     "model": "qwen3.8:27b"
   },
@@ -17,8 +17,6 @@
     "guessNames": true
   },
   "receipt": {
-    "enabled": true,
-    "path": "~/.solrouter/receipts.jsonl"
-  },
-  "viaSolrouter": true
+    "enabled": true
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.4.5",
+  "version": "0.6.1",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "bin",
     "src",
     "README.md",
+    "SKILL.md",
     "SPEC.md",
     "TESTING.md",
     "config.example.json"
@@ -32,5 +33,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "dependencies": {
+    "@solrouter/sdk": "1.2.0"
+  }
 }

package/src/auth.js

@@ -6,16 +6,16 @@
 // in the browser, the page redirects back to the loopback with a token, and the
 // CLI saves it. A `state` nonce ties the callback to this attempt.
 //
-// The real auth is a SolRouter API key (`sk_solrouter_...`, bcrypt-verified by the
-// backend). `login --token sk_solrouter_...` saves one and the private leg works.
-// The browser loopback flow below is a future convenience that mints/returns such a
-// key without a paste; it needs a small backend verify page, which is optional —
-// the token path is complete on its own.
+// The /cli/auth page mints a SolRouter API key (`sk_solrouter_...`, bcrypt-verified
+// by the backend) and hands it to the loopback, so nobody pastes a key.
+// `login --token sk_solrouter_...` saves a key directly for CI and headless hosts.
 
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { exec } from "node:child_process";
-import { saveAuth } from "./config.js";
+import { exec, spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { saveAuth, HOME_DIR } from "./config.js";
 
 const VERIFY_BASE = process.env.SOLROUTER_VERIFY_URL || "https://solrouter.com/cli/auth";
 
@@ -60,10 +60,44 @@ export function browserLogin({ timeoutMs = 180000, open = openBrowser, save = sa
   });
 }
 
+// Agent login. An agent's shell tool usually shows output only after the command
+// exits, so a login that blocks on the browser never shows its link. Instead the
+// loopback listener runs detached (`login --listen`), hands its verify link back
+// through a file, and the foreground command prints the link and exits at once.
+const LOGIN_URL_FILE = join(HOME_DIR, "login-url");
+
+/** Start the detached listener. Resolves with the verify link to show the user. */
+export async function detachedLogin({ bin = process.argv[1], timeoutMs = 600000, waitMs = 10000 } = {}) {
+  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true });
+  rmSync(LOGIN_URL_FILE, { force: true });
+  spawn(process.execPath, [bin, "login", "--listen", String(timeoutMs)], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+  for (const end = Date.now() + waitMs; Date.now() < end; await new Promise(r => setTimeout(r, 50))) {
+    if (existsSync(LOGIN_URL_FILE)) return readFileSync(LOGIN_URL_FILE, "utf8");
+  }
+  throw new Error("the login listener did not start");
+}
+
+/** The detached half: wait for the browser, save the minted key, then exit. */
+export async function listenForLogin(timeoutMs) {
+  const publish = (url) => {
+    const tmp = `${LOGIN_URL_FILE}.${process.pid}`;
+    writeFileSync(tmp, url, { mode: 0o600 });
+    renameSync(tmp, LOGIN_URL_FILE); // atomic: the reader never sees a partial link
+  };
+  try {
+    await browserLogin({ timeoutMs, open: publish });
+    return 0;
+  } catch {
+    return 1;
+  } finally {
+    rmSync(LOGIN_URL_FILE, { force: true });
+  }
+}
+
 /** Stopgap: save a pasted token directly. */
 export function loginWithToken(token, account = null) {
   saveAuth({ access_token: token, account, expires_at: null });
   return { access_token: token, account };
 }
 
-export default { browserLogin, loginWithToken };
+export default { browserLogin, loginWithToken, detachedLogin, listenForLogin };

package/src/config.js

@@ -4,7 +4,7 @@
 // ./solrouter.config.json, environment variables. The auth token lives
 // separately in ~/.solrouter/auth.json (written by `login`), chmod 600.
 
-import { readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -23,11 +23,10 @@ const DEFAULTS = {
                                 // so the proxy is a drop-in for existing setups.
                                 // Set apiKey (or auth:"solrouter") to override.
   },
-  // The uncensored leg: the SolRouter backend's /agent route (open-weight model,
-  // sk_solrouter_ key). Stateless for API-key users; prompt is pseudonymised first.
+  // The uncensored leg: SolRouter's open-weight model in the TEE, reached through
+  // @solrouter/sdk (sealed to /tee/process). Prompt is pseudonymised first.
   private: {
-    baseUrl: "https://solrouter-obb4.onrender.com",
-    transport: "solrouter-agent",
+    baseUrl: "https://api.solrouter.com",
     model: "qwen3.8:27b",
     auth: "solrouter",
   },
@@ -73,9 +72,12 @@ export function loadConfig(cliOverrides = {}) {
 
 // ── auth token ────────────────────────────────────────────────────────────────
 export function saveAuth(token) {
-  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true });
-  writeFileSync(AUTH_PATH, JSON.stringify(token, null, 2));
-  try { chmodSync(AUTH_PATH, 0o600); } catch {}
+  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true, mode: 0o700 });
+  // Write a 0600 temp file, then rename over auth.json: the key is never readable by
+  // others, and a concurrent reader (`status`, the proxy) never sees a partial file.
+  const tmp = `${AUTH_PATH}.${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(token, null, 2), { mode: 0o600 });
+  renameSync(tmp, AUTH_PATH);
 }
 export function loadAuth() { return readJson(AUTH_PATH); }
 export function isLoggedIn() {

package/src/index.js

@@ -5,8 +5,8 @@
 // The two legs speak different backends:
 //   frontier — the dev's own provider (Anthropic/OpenAI), credentials passed
 //              through, so the proxy is a drop-in for an existing setup.
-//   private  — the SolRouter backend's /agent route (uncensored open-weight model,
-//              sk_solrouter_ key). The prompt is pseudonymised before it goes.
+//   private  — SolRouter's uncensored open-weight model in the TEE, via
+//              @solrouter/sdk: pseudonymised, then encrypted on this machine.
 //
 // Streaming note (P0): reactive refusal-retry needs the whole answer, so streaming
 // uses the proactive route decision only. The private leg has no streaming endpoint
@@ -15,7 +15,7 @@
 import { dialect, extractText, rewriteText, extractResponseText, rewriteResponseText, buildResponse } from "./wire.js";
 import { createMasker } from "./mask.js";
 import { decideRoute, isRefusal } from "./route.js";
-import { callLeg, streamLeg, callSolrouterAgent } from "./providers.js";
+import { callLeg, streamLeg, callSolrouterPrivate } from "./providers.js";
 import { writeReceipt } from "./receipt.js";
 
 /** Attach a per-request intent note to the frontier leg only (never the private one). */
@@ -35,15 +35,19 @@ function withIntent(body, kind, intent) {
 async function dispatch(cfg, which, maskedBody, kind, clientHeaders, intent) {
   if (which === "private") {
     const prompt = extractText(maskedBody, kind);
-    const r = await callSolrouterAgent(cfg.private, prompt);
-    return { status: r.status, ok: r.ok, model: cfg.private.model,
+    const r = await callSolrouterPrivate(cfg.private, prompt);
+    // Hash what the private leg seals (the wire carries only its ciphertext),
+    // not the pre-mask object.
+    const sent = JSON.stringify({ prompt, model: cfg.private.model || "qwen3.8:27b" });
+    return { status: r.status, ok: r.ok, model: cfg.private.model, sent,
       json: r.ok ? buildResponse(kind, r.reply, cfg.private.model)
-                 : { error: r.error || "private_leg_error", detail: r.raw } };
+                 : { error: r.error || "private_leg_error" } };
   }
   const leg = cfg.frontier;
   const toSend = withIntent(maskedBody, kind, intent);
   const r = await callLeg(leg, toSend, clientHeaders);
-  return { status: r.status, ok: r.ok, json: r.json, model: leg.model, dialect: leg.dialect || kind };
+  // Hash the actual outgoing body (post-intent) so the receipt matches the wire.
+  return { status: r.status, ok: r.ok, json: r.json, model: leg.model, dialect: leg.dialect || kind, sent: JSON.stringify(toSend) };
 }
 
 /** Handle one non-streaming request. Returns { status, json, receipt, leg, reason, refused }. */
@@ -64,7 +68,7 @@ export async function handle(body, ctx = {}, cfg) {
   // 3. call, with reactive refusal retry: frontier refuses → private
   let refused = false;
   let resp = await dispatch(cfg, which, masked, kind, ctx.headers, intent);
-  if (which === "frontier" && mode === "auto" && resp.ok) {
+  if (which === "frontier" && mode === "auto" && forced !== "frontier" && resp.ok) {
     const answer = extractResponseText(resp.json, resp.dialect || kind);
     if (isRefusal(answer)) {
       refused = true; which = "private"; reason = "reactive-refusal";
@@ -84,7 +88,7 @@ export async function handle(body, ctx = {}, cfg) {
   if (cfg.receipt?.enabled) {
     receipt = writeReceipt(cfg.receipt.path, {
       leg: which, reason, model: resp.model,
-      entities: masker.entities(), refused, sentToProvider: JSON.stringify(masked),
+      entities: masker.entities(), refused, sentToProvider: resp.sent,
     });
   }
   return { status: resp.status, json: outJson, receipt, leg: which, reason, refused };
@@ -115,15 +119,15 @@ export async function handleStream(body, ctx = {}, cfg) {
   const toSend = withIntent(masked, kind, intent);
   const r = await streamLeg(cfg.frontier, toSend, ctx.headers);
   return { status: r.status, ok: r.ok, stream: r.stream, masker, leg, reason,
-    model: cfg.frontier.model, sent: JSON.stringify(masked),
-    // context the server needs to reactively reroute a streamed refusal to private:
-    kind, mode, maskedPrompt: extractText(masked, kind) };
+    model: cfg.frontier.model, sent: JSON.stringify(toSend),
+    // context the server needs to reactively reroute a streamed refusal to private
+    // (x-route: frontier means the caller wants the frontier's answer, refusal or not):
+    kind, mode: forced === "frontier" ? "frontier" : mode, maskedPrompt: extractText(masked, kind) };
 }
 
 /** Call the private leg for a (masked) prompt. Returns { reply, ok, status }. */
 export async function privateReply(cfg, maskedPrompt) {
-  const { callSolrouterAgent } = await import("./providers.js");
-  const r = await callSolrouterAgent(cfg.private, maskedPrompt);
+  const r = await callSolrouterPrivate(cfg.private, maskedPrompt);
   return { reply: r.reply || "", ok: r.ok, status: r.status };
 }