solrouter 0.4.5 → 0.6.1

package/src/install.js

@@ -0,0 +1,115 @@
+// install.js — make the proxy the default for EVERY Claude Code session, so there's
+// no "which window routes through it" footgun. Two pieces:
+//   1. a macOS LaunchAgent that keeps the proxy running on a fixed port (auto-start
+//      at login, auto-restart on crash);
+//   2. ~/.claude/settings.json `env` pointing all Claude Code at that port (+ an API
+//      key, which Claude Code requires to use a custom base URL — see the README).
+//
+// `uninstall` reverses both, touching only the keys we added.
+
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync, readFileSync, rmSync, realpathSync } from "node:fs";
+import { loadConfig, HOME_DIR } from "./config.js";
+
+const LABEL = "com.solrouter.proxy";
+const PLIST = join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
+const CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
+const MARK = "__solrouter"; // marks which env keys we own, for a clean uninstall
+
+async function freePort(start) {
+  const net = await import("node:net");
+  for (let p = start; p < start + 25; p++) {
+    const ok = await new Promise(res => {
+      const s = net.createServer();
+      s.once("error", () => res(false));
+      s.once("listening", () => s.close(() => res(true)));
+      s.listen(p, "127.0.0.1");
+    });
+    if (ok) return p;
+  }
+  return start;
+}
+
+function plistXml({ node, binPath, port }) {
+  const log = join(HOME_DIR, "daemon.log");
+  const args = [node, binPath, "start", "--port", String(port)]
+    .map(a => `    <string>${a}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${log}</string>
+  <key>StandardErrorPath</key><string>${log}</string>
+</dict>
+</plist>
+`;
+}
+
+/** Merge our env into ~/.claude/settings.json, preserving everything else. */
+function writeClaudeEnv(port, key) {
+  let s = {};
+  try { s = JSON.parse(readFileSync(CLAUDE_SETTINGS, "utf8")); } catch {}
+  if (!existsSync(join(homedir(), ".claude"))) mkdirSync(join(homedir(), ".claude"), { recursive: true });
+  s.env = s.env || {};
+  s.env.ANTHROPIC_BASE_URL = `http://127.0.0.1:${port}`;
+  s.env.ANTHROPIC_API_KEY = key;
+  s.env[MARK] = "1"; // our marker
+  writeFileSync(CLAUDE_SETTINGS, JSON.stringify(s, null, 2));
+}
+
+function removeClaudeEnv() {
+  let s;
+  try { s = JSON.parse(readFileSync(CLAUDE_SETTINGS, "utf8")); } catch { return; }
+  if (s.env?.[MARK]) {
+    delete s.env.ANTHROPIC_BASE_URL;
+    delete s.env.ANTHROPIC_API_KEY;
+    delete s.env[MARK];
+    if (Object.keys(s.env).length === 0) delete s.env;
+    writeFileSync(CLAUDE_SETTINGS, JSON.stringify(s, null, 2));
+  }
+}
+
+/** Resolve a stable path to this proxy's bin (npx caches are ephemeral → warn). */
+function resolveBin() {
+  const p = realpathSync(process.argv[1]);
+  return { binPath: p, ephemeral: /[/\\]_npx[/\\]/.test(p) };
+}
+
+export async function install() {
+  if (process.platform !== "darwin")
+    return { ok: false, error: "`install` is macOS-only (LaunchAgent + launchctl). On Linux/Windows, run `solrouter start` and point your tools at http://127.0.0.1:<port>." };
+  const cfg = loadConfig();
+  const key = cfg.frontier.apiKey || process.env.ANTHROPIC_API_KEY;
+  if (!key) return { ok: false, error: "No Anthropic API key configured. Run `solrouter setup` first." };
+
+  const { binPath, ephemeral } = resolveBin();
+  if (ephemeral) return { ok: false, error: "Run `npm i -g solrouter` first — an npx cache path can't back a persistent service." };
+
+  const port = await freePort(cfg.port || 8787);
+  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true });
+  if (!existsSync(join(homedir(), "Library", "LaunchAgents"))) mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
+
+  writeFileSync(PLIST, plistXml({ node: process.execPath, binPath, port }));
+  try { execSync(`launchctl unload "${PLIST}" 2>/dev/null`); } catch {}
+  execSync(`launchctl load "${PLIST}"`);
+  writeClaudeEnv(port, key);
+  return { ok: true, port, plist: PLIST };
+}
+
+export function uninstall() {
+  try { execSync(`launchctl unload "${PLIST}" 2>/dev/null`); } catch {}
+  if (existsSync(PLIST)) rmSync(PLIST);
+  removeClaudeEnv();
+  return { ok: true };
+}
+
+export default { install, uninstall };

package/src/mask.js

@@ -24,12 +24,15 @@ export function createMasker(opts = {}) {
   const seen = [];          // every entity masked this session (for the receipt)
 
   function surrogate(label, value) {
-    if (fwd.has(value)) return fwd.get(value);
+    // Key by label:value, not value alone — the same literal string under two
+    // labels (a loose PHONE vs a guessed PERSON, say) must not reuse one shape.
+    const key = label + ":" + value;
+    if (fwd.has(key)) return fwd.get(key);
     let s = surrogateFor(label, value);
     // Deterministic collision (two different originals → same fake): salt until unique.
     let salt = 0;
     while ((used.has(s) && rev.get(s) !== value)) s = surrogateFor(label, value + "#" + ++salt);
-    fwd.set(value, s); rev.set(s, value); used.add(s);
+    fwd.set(key, s); rev.set(s, value); used.add(s);
     return s;
   }
 
@@ -49,7 +52,7 @@ export function createMasker(opts = {}) {
       return { text: out, entities };
     },
 
-    /** Restore a complete string: surrogates → originals, fuzzy for mangled cases. */
+    /** Restore a complete string: surrogates → originals (exact, then case-insensitive). */
     unmask(text) {
       return restore(String(text ?? ""), rev);
     },
@@ -101,6 +104,9 @@ function streamingRestorer(rev) {
     for (const k of keys) {
       const max = Math.min(k.length - 1, buf.length); // proper prefix only
       for (let n = max; n > hold; n--) {
+        // Case-sensitive on purpose: a case-insensitive compare holds back a self-
+        // overlapping surrogate (e.g. "Tomas Cato": tail "to" == prefix "To") even when
+        // the surrogate is already complete in buf, splitting it so restore() misses it.
         if (buf.slice(buf.length - n) === k.slice(0, n)) { hold = n; break; }
       }
     }

package/src/providers.js

@@ -48,13 +48,9 @@ function authHeaders(leg, clientHeaders = {}) {
     return h;
   }
 
-  // 2. pass-through (default): forward the client's own auth too
-  let forwarded = false;
-  for (const k of ["authorization", "x-api-key"]) if (clientHeaders[k]) { h[k] = clientHeaders[k]; forwarded = true; }
-  if (!forwarded) {
-    const auth = loadAuth();
-    if (auth.access_token) h["authorization"] = `Bearer ${auth.access_token}`;
-  }
+  // 2. pass-through (default): forward the client's own auth. Never fall back to
+  //    the saved SolRouter key: this leg goes to a third-party provider.
+  for (const k of ["authorization", "x-api-key"]) if (clientHeaders[k]) h[k] = clientHeaders[k];
   if (leg.dialect === "anthropic" && !h["anthropic-version"]) h["anthropic-version"] = "2023-06-01";
   return h;
 }
@@ -92,23 +88,24 @@ export async function callLeg(leg, body, clientHeaders) {
 }
 
 /**
- * The private/uncensored leg: the SolRouter backend's /agent route. Takes a plain
- * prompt + a sk_solrouter_ key (stateless for API-key users), returns { reply }.
- * The prompt is already pseudonymised upstream.
+ * The private/uncensored leg: SolRouter's open-weight model inside the TEE.
+ * @solrouter/sdk encrypts the (already pseudonymised) prompt on this machine and
+ * POSTs only ciphertext to {backend}/tee/process; the reply comes back encrypted.
+ * The SolRouter backend never sees the prompt. Returns { ok, status, reply }.
  */
-export async function callSolrouterAgent(leg, prompt) {
-  const auth = loadAuth();
-  const key = leg.apiKey || auth.access_token;
-  if (!key) return { ok: false, status: 401, reply: "", error: "no SolRouter API key — run `login --token sk_solrouter_...`" };
-  const base = leg.baseUrl.replace(/\/$/, "");
-  const res = await fetch(`${base}/agent`, {
-    method: "POST",
-    headers: { "content-type": "application/json", "authorization": `Bearer ${key}` },
-    body: JSON.stringify({ prompt, model: leg.model || "qwen3.8:27b", useTools: false }),
-  });
-  let json = null;
-  try { json = await res.json(); } catch {}
-  return { ok: res.ok && json?.success !== false, status: res.status, reply: json?.reply ?? "", raw: json };
+export async function callSolrouterPrivate(leg, prompt) {
+  const key = leg.apiKey || loadAuth().access_token;
+  if (!key) return { ok: false, status: 401, reply: "", error: "no SolRouter API key — run `solrouter login`" };
+  const model = leg.model || "qwen3.8:27b";
+  try {
+    // Lazy: the Arcium crypto tree is heavy, and only this leg needs it.
+    const { SolRouter } = await import("@solrouter/sdk");
+    const client = new SolRouter({ apiKey: key, baseUrl: leg.baseUrl.replace(/\/$/, ""), encrypted: true });
+    const r = await client.chat(prompt, { model: model.startsWith("nosana:") ? model : `nosana:${model}` });
+    return { ok: true, status: 200, reply: r.message ?? "" };
+  } catch (e) {
+    return { ok: false, status: 502, reply: "", error: e instanceof Error ? e.message : String(e) };
+  }
 }
 
 /**

package/src/receipt.js

@@ -1,10 +1,14 @@
 // receipt.js — one hash-chained JSONL line per call. What was detected, what was
-// masked, which leg ran it, and a hash of what the provider actually received.
+// masked, which leg ran it, and a hash of the masked payload that leg was given.
+// For the frontier leg that is the request body on the wire. For the sealed
+// private leg it is the masked prompt before @solrouter/sdk encrypts it, because
+// the ciphertext uses a random nonce per call and its hash would prove nothing.
 // The receipt never contains raw values or the map — only labels, counts, and
 // hashes — so the audit log itself is safe to keep and to show an auditor.
 
 import { createHash } from "node:crypto";
-import { appendFileSync, readFileSync, existsSync } from "node:fs";
+import { appendFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
 
 const sha256 = s => createHash("sha256").update(String(s)).digest("hex");
 
@@ -40,6 +44,7 @@ export function writeReceipt(path, entry) {
   };
   const hash = sha256(prev + JSON.stringify(body));
   const line = JSON.stringify({ ...body, hash });
+  mkdirSync(dirname(path), { recursive: true }); // first run: ~/.solrouter may not exist yet
   appendFileSync(path, line + "\n");
   return { ...body, hash };
 }

package/src/route.js

@@ -63,12 +63,20 @@ const DECLINE_HINTS = [
 export function isRefusal(text) {
   const s = String(text ?? "").trim();
   if (!s) return false;
-  // Strong signatures fire at any length up to ~1500 (refusals are short).
+  // Strong signatures fire at any length up to ~1500 (refusals are short). Raising
+  // this cap misroutes long genuine answers that merely quote "I can't help…", so
+  // it stays at 1500: a false reroute to the weaker leg is worse than missing a rare
+  // 1500+ char refusal (which the reactive path still catches at the next turn).
   if (s.length <= 1500) for (const re of REFUSAL_SIGNATURES) if (re.test(s)) return true;
   // Short + soft decline hints → also a refusal. Short because a real coding answer
   // is long / full of code; a brief prose reply that declines is a refusal.
   if (s.length <= 600) {
-    const hasCode = /```|\bfunction\b|\bconst \b|\bimport \b|=>|\bdef \b|;\n/.test(s);
+    // "Looks like code" = a fenced block, structural punctuation, an indented line,
+    // or SEVERAL code keywords — NOT a single keyword, so a plain refusal that just
+    // says the word "function" is no longer misread as a code answer.
+    const hasCode = /```/.test(s)
+      || /[{};]\s*$|\)\s*\{|=>\s|^\s{2,}\S/m.test(s)
+      || (s.match(/\b(?:function|const|let|import|export|def|class|return|await)\b/g) || []).length >= 2;
     if (!hasCode) for (const re of DECLINE_HINTS) if (re.test(s)) return true;
   }
   return false;

package/src/secrets.js

@@ -30,16 +30,22 @@ export const SECRET_PATTERNS = [
   // Bearer header values.
   { label: "BEARER", re: /\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*\b/ },
 
-  // Internal hostnames a model has no business seeing.
+  // Internal hostnames a model has no business seeing. Case-SENSITIVE on purpose:
+  // /i made it match PascalCase member access in code (cfg.Internal, Acme.Corp) and
+  // corrupt it. Quantifiers are BOUNDED (DNS labels ≤63 chars, ≤8 levels) so each
+  // start position does O(1) work — an unbounded run went quadratic on dotted input
+  // (a.a.a…), blocking the event loop for seconds on a ~32KB string.
   { label: "INTERNAL_HOST",
-    re: /\b[a-z0-9][a-z0-9.-]*\.(?:internal|corp|local|intranet|lan|svc\.cluster\.local)\b/i },
+    re: /\b[a-z0-9][a-z0-9-]{0,62}(?:\.[a-z0-9-]{1,63}){0,8}\.(?:internal|corp|local|intranet|lan|svc\.cluster\.local)\b/ },
 
-  // "SECRET=…", "api_key: …", "token=…" — a labelled assignment. Captures the
-  // value; validated to skip obvious placeholders like "your-key-here".
+  // "SECRET=…", "api_key: …", "token=…" — a labelled assignment. A variable-length
+  // lookbehind matches the label + separator but keeps them OUT of the match, so the
+  // span is the value ALONE — the label never enters the surrogate and its length
+  // can't shift which characters get preserved. Skips obvious placeholders.
   { label: "ASSIGNED_SECRET",
-    re: /\b(?:[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|API_KEY|PRIVATE_KEY|ACCESS_KEY))\b\s*[:=]\s*["']?([^\s"',}]{8,})/i,
+    re: /(?<=\b(?:[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|API_KEY|PRIVATE_KEY|ACCESS_KEY))\b\s*[:=]\s*["']?)[^\s"',}]{8,}/i,
     check: v => {
-      const val = (v.split(/[:=]/).slice(1).join("=") || v).replace(/["']/g, "").trim();
+      const val = v.replace(/["']/g, "").trim();
       return !/^(?:your|my|the|example|changeme|placeholder|xxx+|<[^>]+>|\.\.\.)/i.test(val)
         && !/^\$\{?[A-Z0-9_]+\}?$/.test(val); // not itself an env-var reference
     } },

package/src/server.js

@@ -11,7 +11,7 @@ import { appendFileSync } from "node:fs";
 import { join } from "node:path";
 import { handle, handleStream, createMasker, privateReply } from "./index.js";
 import { forward } from "./providers.js";
-import { dialect, rewriteText } from "./wire.js";
+import { dialect, rewriteText, extractResponseText } from "./wire.js";
 import { isRefusal } from "./route.js";
 import { writeReceipt } from "./receipt.js";
 import { HOME_DIR } from "./config.js";
@@ -29,14 +29,20 @@ function logDecision(o) {
   try { appendFileSync(join(HOME_DIR, "debug.log"), JSON.stringify({ ts: new Date().toISOString(), ...o }) + "\n"); } catch {}
 }
 
-/** Pull assistant text out of an Anthropic SSE chunk (text_delta events). */
-function extractSseText(chunk) {
+/** Pull assistant text out of an SSE chunk, in whichever dialect the leg streams. */
+export function extractSseText(chunk, kind = "anthropic") {
   let out = "";
   for (const line of String(chunk).split("\n")) {
     if (!line.startsWith("data:")) continue;
+    const payload = line.slice(5).trim();
+    if (payload === "[DONE]") continue;
     try {
-      const d = JSON.parse(line.slice(5).trim());
-      if (d?.type === "content_block_delta" && d.delta?.type === "text_delta") out += d.delta.text || "";
+      const d = JSON.parse(payload);
+      if (kind === "openai") {
+        for (const ch of d?.choices || []) out += ch?.delta?.content || "";
+      } else if (d?.type === "content_block_delta" && d.delta?.type === "text_delta") {
+        out += d.delta.text || "";
+      }
     } catch {}
   }
   return out;
@@ -55,12 +61,39 @@ function synthAnthropicSse(text, model) {
   );
 }
 
-function readBody(req) {
+/** Build a complete OpenAI-format SSE stream from a plain text answer. */
+function synthOpenAiSse(text, model) {
+  const ev = d => `data: ${JSON.stringify(d)}\n\n`;
+  const base = { id: "chatcmpl-proxy", object: "chat.completion.chunk", model: model || "solrouter" };
+  return (
+    ev({ ...base, choices: [{ index: 0, delta: { role: "assistant", content: String(text) }, finish_reason: null }] }) +
+    ev({ ...base, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] }) +
+    "data: [DONE]\n\n"
+  );
+}
+
+/** Synthesise an SSE answer in the client's dialect (what the caller will parse). */
+const synthSse = (kind, text, model) => kind === "openai" ? synthOpenAiSse(text, model) : synthAnthropicSse(text, model);
+
+export function readBody(req) {
   return new Promise((resolve, reject) => {
-    let data = "";
-    req.on("data", c => { data += c; if (data.length > 25 * 1024 * 1024) req.destroy(); });
-    req.on("end", () => { try { resolve(data ? JSON.parse(data) : {}); } catch (e) { reject(e); } });
-    req.on("error", reject);
+    let data = "", done = false;
+    const settle = (fn, v) => { if (!done) { done = true; fn(v); } };
+    req.on("data", c => {
+      data += c;
+      if (data.length > 25 * 1024 * 1024) {
+        // pause (don't destroy) the socket so the handler can still write a 413 back;
+        // destroy() tears down the socket and the client gets a reset, not a status.
+        req.pause();
+        settle(reject, Object.assign(new Error("request body too large"), { code: "BODY_TOO_LARGE" }));
+      }
+    });
+    req.on("end", () => { try { settle(resolve, data ? JSON.parse(data) : {}); } catch (e) { settle(reject, e); } });
+    req.on("error", e => settle(reject, e));
+    // destroy() fires 'aborted'/'close', not 'error' — settle here so an oversized or
+    // truncated request rejects instead of leaving the handler awaiting forever.
+    req.on("aborted", () => settle(reject, new Error("request aborted")));
+    req.on("close", () => settle(reject, new Error("connection closed before body completed")));
   });
 }
 
@@ -72,17 +105,30 @@ export function startServer(cfg) {
 
     if (req.method === "GET" && req.url === "/health") return send(200, { ok: true, proxy: "solrouter", version: VERSION, mode: cfg.mode });
 
-    // Transparent passthrough for other Anthropic endpoints the client probes —
-    // notably /v1/messages/count_tokens, which Claude Code calls before every
-    // request and treats a 404 on as "model unavailable". Forward to the frontier.
+    // Other /v1 endpoints the client probes. Claude Code calls
+    // /v1/messages/count_tokens before every request and treats a 404 as "model
+    // unavailable". Only shapes the masker understands may leave the machine:
+    // body-less GETs and count_tokens (a messages body). Anything else (e.g.
+    // /v1/responses) would go out unmasked, so it is refused. In private mode
+    // nothing goes to the frontier at all.
     if (/^\/v1\//.test(req.url) && !/^\/(v1\/chat\/completions|v1\/messages)$/.test(req.url)) {
+      const path = req.url.split("?")[0];
+      const h = lower(req.headers);
+      const privateOnly = h["x-route"] === "private" || (h["x-mode"] || cfg.mode) === "private";
+      const countTokens = req.method === "POST" && path === "/v1/messages/count_tokens";
       let body;
       if (req.method === "POST") {
-        try { body = await readBody(req); } catch { return send(400, { error: "invalid JSON body" }); }
-        if (body && cfg.masking?.enabled !== false) {
-          const m = createMasker(cfg.masking);
-          body = rewriteText(body, dialect(body, req.url), s => m.mask(s).text);
-        }
+        try { body = await readBody(req); } catch (e) { return send(e?.code === "BODY_TOO_LARGE" ? 413 : 400, { error: e?.code === "BODY_TOO_LARGE" ? "request body too large" : "invalid JSON body" }); }
+      }
+      if (privateOnly) {
+        if (countTokens) return send(200, { input_tokens: Math.ceil(JSON.stringify(body?.messages ?? "").length / 4) }); // rough local estimate
+        if (req.method === "GET" && path === "/v1/models") return send(200, { object: "list", data: [{ id: cfg.private.model, object: "model" }] });
+        return send(404, { error: `${path} is not available in private mode` });
+      }
+      if (req.method !== "GET" && !countTokens) return send(404, { error: `${path} is not supported by the solrouter proxy` });
+      if (body && cfg.masking?.enabled !== false) {
+        const m = createMasker(cfg.masking);
+        body = rewriteText(body, dialect(body, req.url), s => m.mask(s).text);
       }
       try {
         const r = await forward(cfg.frontier, { method: req.method, path: req.url, body, clientHeaders: lower(req.headers) });
@@ -97,15 +143,21 @@ export function startServer(cfg) {
     }
 
     let body;
-    try { body = await readBody(req); } catch { return send(400, { error: "invalid JSON body" }); }
+    try { body = await readBody(req); } catch (e) { return send(e?.code === "BODY_TOO_LARGE" ? 413 : 400, { error: e?.code === "BODY_TOO_LARGE" ? "request body too large" : "invalid JSON body" }); }
     const ctx = { path: req.url, headers: lower(req.headers) };
 
     try {
       if (body.stream) {
         const s = await handleStream(body, ctx, cfg);
         // Private leg can't stream yet — it returns a prebuilt body (receipt
-        // already written inside handle()). Send it as a normal JSON 200.
-        if (s.prebuilt) return send(s.status || 200, s.json);
+        // already written inside handle()). The client asked for a stream, so its
+        // parser expects SSE: replay the answer as one SSE stream in its dialect.
+        if (s.prebuilt) {
+          if (s.status !== 200) return send(s.status || 502, s.json);
+          const kind = dialect(body, req.url);
+          res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache" });
+          return res.end(synthSse(kind, extractResponseText(s.json, kind), s.json?.model));
+        }
         if (!s.ok || !s.stream) return send(s.status || 502, { error: "upstream error", leg: s.leg });
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", "connection": "keep-alive" });
         const restorer = cfg.masking?.enabled === false ? null : s.masker.streamingUnmasker();
@@ -118,12 +170,16 @@ export function startServer(cfg) {
         // stream live. If the whole short response is a refusal and mode is auto,
         // we discard it and reroute to the private/uncensored leg.
         const COMMIT_AT = 380;               // chars of answer text that means "real answer"
+        // Parse the frontier's SSE in ITS dialect — an OpenAI frontier streams
+        // choices[].delta.content, not Anthropic text_delta, so a fixed parser would
+        // read "" from every chunk and never detect a refusal or commit to streaming.
+        const frontierKind = cfg.frontier?.dialect || s.kind;
         let committed = false, held = "", acc = "", refusalLikely = false;
         for (;;) {
           const { done, value } = await reader.read();
           if (done) break;
           const chunk = dec.decode(value, { stream: true });
-          acc += extractSseText(chunk);
+          acc += extractSseText(chunk, frontierKind);
           if (committed) { emit(chunk); continue; }
           held += chunk;
           // Lock onto a refusal as soon as its opening matches — then never commit,
@@ -144,7 +200,7 @@ export function startServer(cfg) {
           if (pr.ok && pr.reply) {
             leg = "private"; refused = true; model = cfg.private.model;
             const restored = restorer ? s.masker.unmask(pr.reply) : pr.reply;
-            res.write(synthAnthropicSse(restored, model));
+            res.write(synthSse(s.kind, restored, model));
             res.end();
             if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
               leg, reason: "reactive-refusal", model, entities: s.masker.entities(), refused: true, sentToProvider: s.sent });
@@ -153,9 +209,9 @@ export function startServer(cfg) {
           // Reroute was needed but the uncensored leg failed — say so LOUDLY instead
           // of silently relaying Claude's refusal (this is almost always "not logged
           // in" / an invalid SolRouter key).
-          res.write(synthAnthropicSse(
+          res.write(synthSse(s.kind,
             `⚠️ [solrouter] Claude refused this, and the uncensored leg couldn't be reached (${pr.status || "error"}). ` +
-            `Run \`solrouter login --token sk_solrouter_…\` with a valid key from solrouter.com/sdk, then retry.`,
+            `Run \`solrouter login\`, approve in the browser, then retry.`,
             cfg.private.model));
           res.end();
           if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
@@ -180,10 +236,27 @@ export function startServer(cfg) {
     }
   });
 
-  server.on("error", (e) => {
+  server.on("error", async (e) => {
     if (e.code === "EADDRINUSE") {
-      // A proxy is already listening here — reuse it rather than crash.
-      console.log(`SolRouter proxy already running on http://127.0.0.1:${cfg.port} — reusing it.`);
+      // Something is already on this port. Only claim "reusing" if it is actually
+      // a SolRouter proxy — otherwise we'd be routing the user's traffic to an
+      // unrelated process while reporting success.
+      let isOurs = false;
+      try {
+        const ctrl = new AbortController();
+        const t = setTimeout(() => ctrl.abort(), 1000);
+        const r = await fetch(`http://127.0.0.1:${cfg.port}/health`, { signal: ctrl.signal });
+        const j = await r.json().catch(() => ({}));
+        clearTimeout(t);
+        isOurs = r.ok && j?.proxy === "solrouter";
+      } catch { /* unreachable or not JSON — not ours */ }
+      if (isOurs) {
+        console.log(`SolRouter proxy already running on http://127.0.0.1:${cfg.port} — reusing it.`);
+      } else {
+        console.error(`Port ${cfg.port} is in use by another process (not a SolRouter proxy).`);
+        console.error(`Free it, or start on a different port:  solrouter start --port <n>`);
+        process.exit(1);
+      }
     } else {
       console.error("proxy server error:", e.message);
       process.exit(1);

package/src/surrogates.js

@@ -74,16 +74,20 @@ function fakeCard(r) {
   return [...body, check].join("").replace(/(\d{4})(?=\d)/g, "$1 ");
 }
 
-// Keep a secret's shape (prefix + length class) but randomise the body, so the
-// model sees a plausible key and never the real one.
+// Recognised PUBLIC key prefixes — non-secret markers, safe to keep so the model
+// still sees the type (sk-proj-, sk-ant-, AKIA, ghp_, …). Everything else keeps
+// NO real characters: the leading bytes of a raw secret are still secret.
+const KEY_PREFIX = /^(?:sk-ant-|sk-proj-|sk-|xox[baprs]-|gh[pousr]_|AKIA|ASIA|AIza|[rs]k_(?:live|test)_|eyJ)/;
+
+// Keep a secret's shape (length + non-alphanumeric layout) but randomise the body,
+// so the model sees a plausible key and never the real one. Only a recognised
+// public prefix is preserved; an unlabelled secret keeps nothing.
 function fakeLikeShape(value, r) {
   const alnum = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-  // Keep a leading prefix so the type stays recognizable (sk-proj-, sk-ant-, AKIA…)
-  // without leaking a short secret: proportional, capped at 8 chars.
-  const keep = Math.min(8, Math.max(3, Math.floor(value.length * 0.3)));
-  let seen = 0;
-  return value.replace(/[A-Za-z0-9]/g, ch =>
-    seen++ < keep ? ch : alnum[r.int(alnum.length)]);
+  const pfx = value.match(KEY_PREFIX);
+  const keep = pfx ? pfx[0].length : 0; // keep by string offset, not alnum count
+  return value.replace(/[A-Za-z0-9]/g, (ch, idx) =>
+    idx < keep ? ch : alnum[r.int(alnum.length)]);
 }
 
 const GENERATORS = {