solrouter 0.5.0 → 0.6.1

package/README.md

@@ -19,10 +19,11 @@ Two things happen to every request, **on your machine, before anything leaves**:
 Every call leaves a **receipt**: a hash-chained record of what was masked, which
 model ran it, and a hash of exactly what the provider received. No PII in it.
 
-> **P0 (this version).** Prose masking, reactive refusal detection (send to
-> frontier, detect a refusal, retry on the private leg), fuzzy + streaming-safe
-> restore, receipts. Not yet: tool-call-argument masking, TEE-side classifier,
-> task decomposition. See `SPEC.md`.
+> **P0 (this version).** Prose **and tool-call** masking (message text, tool
+> inputs, tool results, and tool-definition descriptions), reactive refusal
+> detection (send to frontier, detect a refusal, retry on the private leg),
+> streaming-safe restore, receipts. Not yet: fuzzy/paraphrase restore, TEE-side
+> classifier, task decomposition. See `SPEC.md`.
 
 ## Bring your own key — it's a drop-in, not a gateway
 
@@ -56,7 +57,8 @@ straight through: `npx solrouter code --resume`. To run the proxy on its own ins
 `login` opens `solrouter.com/cli/auth`, you sign in with your SolRouter
 subscription, and a key is minted and handed back to the CLI automatically — no
 paste. (`login --token sk_solrouter_...` still works for CI / headless.) The private
-leg then calls the backend's `/agent` route (open-weight model `qwen3.8:27b`).
+leg then seals the pseudonymised prompt with `@solrouter/sdk` and sends only
+ciphertext to the backend's `/tee/process` route (open-weight model `qwen3.8:27b`).
 
 Then point any OpenAI- or Anthropic-compatible tool at it — no code change:
 
@@ -73,6 +75,21 @@ export OPENAI_BASE_URL=http://127.0.0.1:8787/v1
 # ...run your tool as usual
 ```
 
+### Which endpoints it serves
+
+It masks the two request shapes it understands: `POST /v1/chat/completions`
+(OpenAI) and `POST /v1/messages` (Anthropic), streaming included.
+`POST /v1/messages/count_tokens` is masked and forwarded as well, because Claude
+Code calls it before every request.
+
+Anything else under `/v1/` that carries a body returns **404 rather than being
+forwarded**, so nothing can leave the machine unmasked. The one that bites in
+practice is `POST /v1/responses`, OpenAI's Responses API: Codex and the Vercel AI
+SDK's default `openai()` provider use it. Point those at the chat-completions path
+instead (in the AI SDK, `openai.chat("gpt-4o")`). In `--mode private` nothing goes
+to the frontier at all: `count_tokens` is answered locally with a rough estimate
+and `/v1/models` lists the private model.
+
 ## Per-request control (headers)
 
 You keep the agency — override the router per call:
@@ -88,20 +105,42 @@ You keep the agency — override the router per call:
 ## Commands
 
 ```
-solrouter login [--token <key>]   verify account (browser), or paste a key
-solrouter start [--port N] [--mode auto|frontier|private]
+solrouter                         first run: setup, then launch your tool through the proxy
+solrouter code [...claude args]   run the proxy in-process AND launch Claude Code through it
+solrouter login [--token <key>]   verify account (browser), or paste a key for CI/headless
+solrouter start [--port N] [--mode auto|frontier|private]   just the proxy, no tool launch
+solrouter setup                   interactive configuration
 solrouter status                  config + login state
 solrouter verify                  check the receipt hash-chain
+solrouter install / uninstall     macOS: route EVERY Claude Code session (see below)
 solrouter logout
+solrouter demo                    offline masking demo, no account needed
 ```
 
+### `install` changes your machine (macOS only)
+
+`solrouter install` is invasive on purpose — it makes the proxy the default for
+*every* Claude Code session, so there is no "which window is routed" footgun. It:
+
+- writes a LaunchAgent at `~/Library/LaunchAgents/com.solrouter.proxy.plist`
+  (auto-start at login, auto-restart on crash), and
+- edits `~/.claude/settings.json`, adding `env.ANTHROPIC_BASE_URL` and
+  `env.ANTHROPIC_API_KEY` so all Claude Code traffic goes through the proxy.
+
+Heads-up: every Claude Code session then bills to that API key, not a Max/Pro
+subscription (required to use a custom endpoint). It marks the keys it adds, so
+`solrouter uninstall` removes exactly those and unloads the LaunchAgent. macOS only
+(LaunchAgent + `launchctl`); on Linux/Windows run `solrouter start` and point your
+tools at it yourself.
+
 ## Config
 
 Copy `config.example.json` to `~/.solrouter/config.json` or
 `./solrouter.config.json`. Set `frontier` / `private` base URLs, models, and
-your gazetteer of `names`. With `viaSolrouter: true` the legs go through the
-SolRouter backend (which holds provider keys and does x402 billing); otherwise set
-provider keys via `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` / `SOLROUTER_API_KEY`.
+your gazetteer of `names`. Provider keys come from `ANTHROPIC_API_KEY` /
+`OPENAI_API_KEY` / `SOLROUTER_API_KEY` (or a Claude Code subscription login).
+(A `viaSolrouter` backend-proxied billing path is planned but **not wired yet** —
+leave it out.)
 
 ## What this will not do
 

package/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: solrouter
+description: Give any agent private AI through a local SolRouter proxy. It masks names, emails, keys and hostnames on this machine, and it seals prompts for SolRouter's open-weight models so only the enclave can read them. Works with any framework or tool that can set an OpenAI or Anthropic base URL.
+license: MIT
+compatibility: Node >= 22
+---
+
+# SolRouter proxy
+
+A local HTTP proxy on `127.0.0.1:8787`. Your agent keeps its own code. You only
+change its base URL. The proxy speaks the OpenAI and the Anthropic HTTP formats,
+so any client that can set one of those base URLs can use it. Examples: the
+OpenAI or Anthropic SDKs, the Vercel AI SDK, LangChain, Codex, Cursor, Cline.
+
+## 1. Log in (once per machine)
+
+Run this in the agent's shell:
+
+```sh
+npx -y solrouter login
+```
+
+With no terminal attached, the command prints a `solrouter.com/cli/auth` link
+and returns at once. Show the link to the user. The user opens it, signs in to
+their SolRouter account, and clicks Connect. SolRouter mints an API key and
+hands it straight to the proxy on this machine. Nobody copies or pastes a key.
+
+The link works for 10 minutes and only on the machine that ran `login`. To
+confirm, run:
+
+```sh
+npx -y solrouter status    # "logged in : yes (<account>)"
+```
+
+Never ask the user to paste the key into chat. If a key ever appears in a chat
+or a log, tell the user to revoke it at solrouter.com/sdk.
+
+## 2. Start the proxy
+
+Pick one mode. The modes do not mix.
+
+```sh
+npx -y solrouter start --mode private    # SolRouter models only. Needs only the login.
+npx -y solrouter start                   # auto: your own frontier model first, SolRouter when it refuses
+```
+
+Run it in the background and wait for health:
+
+```sh
+curl -s http://127.0.0.1:8787/health   # {"ok":true,"proxy":"solrouter",...}
+```
+
+## 3. Point the agent at it
+
+```sh
+export OPENAI_BASE_URL=http://127.0.0.1:8787/v1
+export ANTHROPIC_BASE_URL=http://127.0.0.1:8787
+```
+
+```js
+new OpenAI({ baseURL: "http://127.0.0.1:8787/v1", apiKey: "solrouter" })
+new Anthropic({ baseURL: "http://127.0.0.1:8787", apiKey: "solrouter" })
+```
+
+In `--mode private`, the client API key is not used. Any non-empty string
+works, because the proxy uses the SolRouter login. In `auto` mode, pass your
+real Anthropic or OpenAI key. The proxy forwards it to that provider.
+
+Streaming works in both modes. To send one request to SolRouter in `auto` mode,
+add the header `x-route: private`.
+
+Use the chat-completions or messages path. The proxy serves
+`POST /v1/chat/completions`, `POST /v1/messages` and `POST /v1/messages/count_tokens`.
+Any other `/v1/` path with a body returns 404, because the masker does not
+understand that shape and nothing leaves the machine unmasked. This includes
+`POST /v1/responses`: if the framework defaults to OpenAI's Responses API (Codex,
+and the Vercel AI SDK's `openai()` provider), switch it to chat completions
+(`openai.chat("gpt-4o")`).
+
+## What each leg protects
+
+- **Private leg (SolRouter models, `qwen3.8:27b`):** the proxy masks identifiers,
+  then `@solrouter/sdk` encrypts the prompt on this machine. The SolRouter
+  backend relays only ciphertext to the TEE. The reply comes back encrypted and
+  is decrypted here.
+- **Frontier leg (your Claude or GPT):** identifiers are masked and restored on
+  this machine. The provider reads the masked prompt. It cannot be encrypted,
+  because the provider must read the prompt to answer it.
+- **Both legs:** the proxy process on this machine sees the real values.
+- **Not yet:** the SDK trusts the TEE key that the backend serves. Attestation
+  checks of that key are not built.
+
+## Errors
+
+- `logged in : no`: run `npx -y solrouter login` and show the user the link.
+- `401` with `no SolRouter API key` from the private leg: the login is missing.
+  Run `login` again.
+- `502` with a `SolRouter API error: ...` message from the private leg: SolRouter
+  refused or failed. Typical causes: a revoked key (run `login` again), no plan
+  allowance or balance left, or the TEE model is offline.
+- `404` with `is not supported by the solrouter proxy`: the client called a path
+  the masker does not understand, almost always `/v1/responses`. Switch the client
+  to chat completions.
+- `404` with `is not available in private mode`: in `--mode private` only the
+  chat-completions and messages paths are served, because nothing may reach the
+  frontier.
+- `ECONNREFUSED 127.0.0.1:8787`: the proxy is not running. Start it.

package/SPEC.md

@@ -109,9 +109,10 @@ pseudonymised.
   LIMITS block — keep it).
 
 ### 5.2 Restorer (local, streaming-safe)
-- **Fuzzy / n-gram matching, never exact replace** — models re-case, split, or paraphrase the
-  value (LangChain graded strategies: exact → case-insensitive → fuzzy → n-gram). Realistic
-  surrogates survive round-trips better than tokens.
+- **Restore ladder: exact → case-insensitive → (planned) fuzzy / n-gram** — models re-case,
+  split, or paraphrase the value (LangChain graded strategies). **Shipped in 0.5.x: exact +
+  case-insensitive.** Fuzzy/n-gram is deferred, so a paraphrased surrogate can still miss;
+  realistic surrogates survive round-trips better than tokens and keep that gap small.
 - **Streaming:** buffer at chunk boundaries; a surrogate can be split across chunks. Restore
   over a reassembled boundary-safe window, not per token. (qaskills.sh streaming-redaction.)
 - Leak check: assert no residual surrogate tokens in assembled output.
@@ -168,11 +169,13 @@ openly, that the user controls.
 
 ## 8. PoC phases (proposed, post-approval)
 1. **P0 — local proxy, prose only:** OpenAI/Anthropic dialects, surrogate masking, reactive
-   refusal detection (substrings), fuzzy restore, receipt. Demo: Claude Code on a repo with a
+   refusal detection (substrings), exact + case-insensitive restore (fuzzy deferred), receipt. Demo: Claude Code on a repo with a
    `.env`; split screen provider-view vs user-view.
 2. **P1 — TEE router:** move detection/prediction into the TEE; add WildGuard-class classifier;
    `x-route` + `x-intent` headers.
-3. **P2 — tool-call + streaming:** structural JSON masking, streaming-safe restore.
+3. **P2 — tool-call + streaming:** structural JSON masking (landed early, in 0.5.2:
+   tool inputs, tool results, tool-call arguments, tool-definition descriptions),
+   streaming-safe restore.
 4. **P3 — decomposition:** conservative orchestrator for independent/permission segments only.
 5. **P4 — SDK middleware:** fold the core into `@solrouter/sdk` as opt-in.
 

package/TESTING.md

@@ -1,8 +1,8 @@
 # Testing the proxy (no account needed)
 
 Everything below runs locally with **no SolRouter login**. The frontier leg uses
-your own key; the private/uncensored leg needs a login (endpoint not built yet — see
-bottom).
+your own key; the private/uncensored leg needs a SolRouter login (browser `login`,
+or `login --token` for CI/headless — see §4).
 
 Requires Node 22+. From `dev/backend/packages/router-proxy/`:
 
@@ -81,8 +81,8 @@ Per-request control:
 
 ## 4. Test the private/uncensored leg (real backend)
 
-The private leg calls the SolRouter backend's `/agent` route with a `sk_solrouter_`
-key — the same key type the backend already issues. No new endpoint needed.
+The private leg seals the pseudonymised prompt with `@solrouter/sdk` and sends
+only ciphertext to the backend's `/tee/process` route, with a `sk_solrouter_` key.
 
 ```bash
 solrouter login --token sk_solrouter_...   # your SolRouter API key
@@ -93,8 +93,9 @@ curl http://127.0.0.1:8787/v1/chat/completions \
   -d '{"model":"x","messages":[{"role":"user","content":"..."}]}'
 ```
 
-It hits `POST {backend}/agent` with `{prompt, model:"qwen3.8:27b", useTools:false}`,
-stateless (no chatId needed for API-key users). `x-route: auto` (the default) tries
+It fetches `GET {backend}/tee/public-key`, then posts `POST {backend}/tee/process`
+with `{encryptedPrompt, model:"nosana:qwen3.8:27b"}`. The reply comes back
+encrypted and is opened on your machine. `x-route: auto` (the default) tries
 the frontier model first and reroutes here if it refuses.
 
 Requires the backend + its Nosana/TEE node to be up (it's the live prod backend by
@@ -106,5 +107,5 @@ default). If the Qwen node is cold, see `scripts/NOSANA_RUNBOOK.md`.
   frontier leg with your own key (§2–3).
 - **Needs a `sk_solrouter_` key + backend up:** the private/uncensored leg (§4).
 
-The only not-yet-built convenience is the browser `login` (loopback OAuth); the
-`--token` path is complete and is what makes the private leg work today.
+Both logins work: the browser `login` (loopback round-trip) and the `--token` path
+for CI/headless. Either mints/saves the `sk_solrouter_` key the private leg uses.

package/bin/proxy.js

@@ -7,17 +7,51 @@
 //   solrouter logout
 
 import { loadConfig, isLoggedIn, loadAuth, HOME_DIR } from "../src/config.js";
-import { browserLogin, loginWithToken } from "../src/auth.js";
+import { browserLogin, loginWithToken, detachedLogin, listenForLogin } from "../src/auth.js";
 import { startServer } from "../src/server.js";
 import { verifyChain } from "../src/receipt.js";
 import { runDemo } from "../src/demo.js";
-import { rmSync, existsSync } from "node:fs";
+import { rmSync, existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 const [, , cmdRaw, ...rest] = process.argv;
 const cmd = cmdRaw || "run";
 const flag = name => { const i = rest.indexOf(name); return i >= 0 ? (rest[i + 1] ?? true) : undefined; };
 
+const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+
+// Every real subcommand. Anything else in the command slot is a typo or a stray
+// flag and must not silently fall through to "launch Claude Code".
+const KNOWN = new Set([
+  "login", "logout", "status", "banner", "demo", "verify",
+  "install", "uninstall", "code", "claude", "setup", "run", "start",
+]);
+
+function usage() {
+  return `solrouter ${VERSION} — local privacy proxy for coding tools
+
+Usage: solrouter [command] [options]
+
+Commands:
+  (none) / run    set up on first run, then launch your tool through the proxy
+  code [args]     start the proxy and launch Claude Code through it (alias: claude)
+  start           run just the proxy, no tool launch
+  setup           interactive configuration
+  install         install as a background service (auto-start); uninstall to remove
+  login           verify your SolRouter account in the browser (login --token <key> to paste).
+                  Without a terminal (an agent's shell), it prints the link and returns at once.
+  logout          sign out
+  status          show config + login state
+  verify          check the receipt hash-chain
+  demo            run the masking demo (no keys needed)
+
+Options:
+  --port <n>      proxy port (default from config)
+  --mode <m>      routing mode
+  -v, --version   print version
+  -h, --help      show this help`;
+}
+
 // Find a genuinely free port starting from `start`. Prevents the footgun where a
 // STALE proxy already on the port gets silently reused, so old code keeps running
 // after a version bump.
@@ -60,14 +94,47 @@ async function startProxyAndLaunch(cfg, tool, launch, passThru = []) {
 }
 
 async function main() {
+  // Version / help, and reject unknown commands, before any command runs — so a
+  // flag or typo never falls through to the default "launch Claude Code" path.
+  if (cmdRaw === "--version" || cmdRaw === "-v") { console.log(VERSION); return; }
+  if (cmdRaw === "--help" || cmdRaw === "-h" || rest.includes("--help") || rest.includes("-h")) {
+    console.log(usage());
+    return;
+  }
+  if (cmdRaw && !KNOWN.has(cmdRaw)) {
+    console.error(`Unknown command: ${cmdRaw}\n`);
+    console.error(usage());
+    process.exit(1);
+  }
+
   switch (cmd) {
     case "login": {
-      const token = flag("--token");
-      if (token && token !== true) {
+      if (rest.includes("--token")) {
+        // Same check as @solrouter/sdk, so a typo fails here, not on the first private call.
+        const token = flag("--token");
+        if (typeof token !== "string" || !token.startsWith("sk_solrouter_") || token.length < 33) {
+          console.error("login --token needs a SolRouter API key: sk_solrouter_ followed by at least 20 characters.");
+          process.exit(1);
+        }
         loginWithToken(token, flag("--account") || null);
         console.log("Saved. You're logged in.");
         return;
       }
+      // Internal: the detached listener behind an agent login.
+      if (flag("--listen")) process.exit(await listenForLogin(Number(flag("--listen")) || 600000));
+      // No terminal: an agent runs this. Print the link now; the listener waits.
+      if (!process.stdout.isTTY) {
+        try {
+          const url = await detachedLogin();
+          console.log("Open this link and approve with your SolRouter account:");
+          console.log("  " + url);
+          console.log("The link works for 10 minutes. Then run `solrouter status` to confirm.");
+        } catch (e) {
+          console.error("Login failed:", e.message);
+          process.exit(1);
+        }
+        return;
+      }
       try {
         const t = await browserLogin();
         console.log(`Logged in${t.account ? " as " + t.account : ""}.`);

package/config.example.json

@@ -7,7 +7,7 @@
     "model": "claude-opus-5"
   },
   "private": {
-    "baseUrl": "https://solrouter-obb4.onrender.com",
+    "baseUrl": "https://api.solrouter.com",
     "dialect": "openai",
     "model": "qwen3.8:27b"
   },
@@ -17,8 +17,6 @@
     "guessNames": true
   },
   "receipt": {
-    "enabled": true,
-    "path": "~/.solrouter/receipts.jsonl"
-  },
-  "viaSolrouter": true
+    "enabled": true
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "bin",
     "src",
     "README.md",
+    "SKILL.md",
     "SPEC.md",
     "TESTING.md",
     "config.example.json"
@@ -32,5 +33,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "dependencies": {
+    "@solrouter/sdk": "1.2.0"
+  }
 }

package/src/auth.js

@@ -6,16 +6,16 @@
 // in the browser, the page redirects back to the loopback with a token, and the
 // CLI saves it. A `state` nonce ties the callback to this attempt.
 //
-// The real auth is a SolRouter API key (`sk_solrouter_...`, bcrypt-verified by the
-// backend). `login --token sk_solrouter_...` saves one and the private leg works.
-// The browser loopback flow below is a future convenience that mints/returns such a
-// key without a paste; it needs a small backend verify page, which is optional —
-// the token path is complete on its own.
+// The /cli/auth page mints a SolRouter API key (`sk_solrouter_...`, bcrypt-verified
+// by the backend) and hands it to the loopback, so nobody pastes a key.
+// `login --token sk_solrouter_...` saves a key directly for CI and headless hosts.
 
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { exec } from "node:child_process";
-import { saveAuth } from "./config.js";
+import { exec, spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { saveAuth, HOME_DIR } from "./config.js";
 
 const VERIFY_BASE = process.env.SOLROUTER_VERIFY_URL || "https://solrouter.com/cli/auth";
 
@@ -60,10 +60,44 @@ export function browserLogin({ timeoutMs = 180000, open = openBrowser, save = sa
   });
 }
 
+// Agent login. An agent's shell tool usually shows output only after the command
+// exits, so a login that blocks on the browser never shows its link. Instead the
+// loopback listener runs detached (`login --listen`), hands its verify link back
+// through a file, and the foreground command prints the link and exits at once.
+const LOGIN_URL_FILE = join(HOME_DIR, "login-url");
+
+/** Start the detached listener. Resolves with the verify link to show the user. */
+export async function detachedLogin({ bin = process.argv[1], timeoutMs = 600000, waitMs = 10000 } = {}) {
+  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true });
+  rmSync(LOGIN_URL_FILE, { force: true });
+  spawn(process.execPath, [bin, "login", "--listen", String(timeoutMs)], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+  for (const end = Date.now() + waitMs; Date.now() < end; await new Promise(r => setTimeout(r, 50))) {
+    if (existsSync(LOGIN_URL_FILE)) return readFileSync(LOGIN_URL_FILE, "utf8");
+  }
+  throw new Error("the login listener did not start");
+}
+
+/** The detached half: wait for the browser, save the minted key, then exit. */
+export async function listenForLogin(timeoutMs) {
+  const publish = (url) => {
+    const tmp = `${LOGIN_URL_FILE}.${process.pid}`;
+    writeFileSync(tmp, url, { mode: 0o600 });
+    renameSync(tmp, LOGIN_URL_FILE); // atomic: the reader never sees a partial link
+  };
+  try {
+    await browserLogin({ timeoutMs, open: publish });
+    return 0;
+  } catch {
+    return 1;
+  } finally {
+    rmSync(LOGIN_URL_FILE, { force: true });
+  }
+}
+
 /** Stopgap: save a pasted token directly. */
 export function loginWithToken(token, account = null) {
   saveAuth({ access_token: token, account, expires_at: null });
   return { access_token: token, account };
 }
 
-export default { browserLogin, loginWithToken };
+export default { browserLogin, loginWithToken, detachedLogin, listenForLogin };

package/src/config.js

@@ -4,7 +4,7 @@
 // ./solrouter.config.json, environment variables. The auth token lives
 // separately in ~/.solrouter/auth.json (written by `login`), chmod 600.
 
-import { readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -23,11 +23,10 @@ const DEFAULTS = {
                                 // so the proxy is a drop-in for existing setups.
                                 // Set apiKey (or auth:"solrouter") to override.
   },
-  // The uncensored leg: the SolRouter backend's /agent route (open-weight model,
-  // sk_solrouter_ key). Stateless for API-key users; prompt is pseudonymised first.
+  // The uncensored leg: SolRouter's open-weight model in the TEE, reached through
+  // @solrouter/sdk (sealed to /tee/process). Prompt is pseudonymised first.
   private: {
-    baseUrl: "https://solrouter-obb4.onrender.com",
-    transport: "solrouter-agent",
+    baseUrl: "https://api.solrouter.com",
     model: "qwen3.8:27b",
     auth: "solrouter",
   },
@@ -73,9 +72,12 @@ export function loadConfig(cliOverrides = {}) {
 
 // ── auth token ────────────────────────────────────────────────────────────────
 export function saveAuth(token) {
-  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true });
-  writeFileSync(AUTH_PATH, JSON.stringify(token, null, 2));
-  try { chmodSync(AUTH_PATH, 0o600); } catch {}
+  if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true, mode: 0o700 });
+  // Write a 0600 temp file, then rename over auth.json: the key is never readable by
+  // others, and a concurrent reader (`status`, the proxy) never sees a partial file.
+  const tmp = `${AUTH_PATH}.${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(token, null, 2), { mode: 0o600 });
+  renameSync(tmp, AUTH_PATH);
 }
 export function loadAuth() { return readJson(AUTH_PATH); }
 export function isLoggedIn() {

package/src/index.js

@@ -5,8 +5,8 @@
 // The two legs speak different backends:
 //   frontier — the dev's own provider (Anthropic/OpenAI), credentials passed
 //              through, so the proxy is a drop-in for an existing setup.
-//   private  — the SolRouter backend's /agent route (uncensored open-weight model,
-//              sk_solrouter_ key). The prompt is pseudonymised before it goes.
+//   private  — SolRouter's uncensored open-weight model in the TEE, via
+//              @solrouter/sdk: pseudonymised, then encrypted on this machine.
 //
 // Streaming note (P0): reactive refusal-retry needs the whole answer, so streaming
 // uses the proactive route decision only. The private leg has no streaming endpoint
@@ -15,7 +15,7 @@
 import { dialect, extractText, rewriteText, extractResponseText, rewriteResponseText, buildResponse } from "./wire.js";
 import { createMasker } from "./mask.js";
 import { decideRoute, isRefusal } from "./route.js";
-import { callLeg, streamLeg, callSolrouterAgent } from "./providers.js";
+import { callLeg, streamLeg, callSolrouterPrivate } from "./providers.js";
 import { writeReceipt } from "./receipt.js";
 
 /** Attach a per-request intent note to the frontier leg only (never the private one). */
@@ -35,15 +35,19 @@ function withIntent(body, kind, intent) {
 async function dispatch(cfg, which, maskedBody, kind, clientHeaders, intent) {
   if (which === "private") {
     const prompt = extractText(maskedBody, kind);
-    const r = await callSolrouterAgent(cfg.private, prompt);
-    return { status: r.status, ok: r.ok, model: cfg.private.model,
+    const r = await callSolrouterPrivate(cfg.private, prompt);
+    // Hash what the private leg seals (the wire carries only its ciphertext),
+    // not the pre-mask object.
+    const sent = JSON.stringify({ prompt, model: cfg.private.model || "qwen3.8:27b" });
+    return { status: r.status, ok: r.ok, model: cfg.private.model, sent,
       json: r.ok ? buildResponse(kind, r.reply, cfg.private.model)
-                 : { error: r.error || "private_leg_error", detail: r.raw } };
+                 : { error: r.error || "private_leg_error" } };
   }
   const leg = cfg.frontier;
   const toSend = withIntent(maskedBody, kind, intent);
   const r = await callLeg(leg, toSend, clientHeaders);
-  return { status: r.status, ok: r.ok, json: r.json, model: leg.model, dialect: leg.dialect || kind };
+  // Hash the actual outgoing body (post-intent) so the receipt matches the wire.
+  return { status: r.status, ok: r.ok, json: r.json, model: leg.model, dialect: leg.dialect || kind, sent: JSON.stringify(toSend) };
 }
 
 /** Handle one non-streaming request. Returns { status, json, receipt, leg, reason, refused }. */
@@ -64,7 +68,7 @@ export async function handle(body, ctx = {}, cfg) {
   // 3. call, with reactive refusal retry: frontier refuses → private
   let refused = false;
   let resp = await dispatch(cfg, which, masked, kind, ctx.headers, intent);
-  if (which === "frontier" && mode === "auto" && resp.ok) {
+  if (which === "frontier" && mode === "auto" && forced !== "frontier" && resp.ok) {
     const answer = extractResponseText(resp.json, resp.dialect || kind);
     if (isRefusal(answer)) {
       refused = true; which = "private"; reason = "reactive-refusal";
@@ -84,7 +88,7 @@ export async function handle(body, ctx = {}, cfg) {
   if (cfg.receipt?.enabled) {
     receipt = writeReceipt(cfg.receipt.path, {
       leg: which, reason, model: resp.model,
-      entities: masker.entities(), refused, sentToProvider: JSON.stringify(masked),
+      entities: masker.entities(), refused, sentToProvider: resp.sent,
     });
   }
   return { status: resp.status, json: outJson, receipt, leg: which, reason, refused };
@@ -115,15 +119,15 @@ export async function handleStream(body, ctx = {}, cfg) {
   const toSend = withIntent(masked, kind, intent);
   const r = await streamLeg(cfg.frontier, toSend, ctx.headers);
   return { status: r.status, ok: r.ok, stream: r.stream, masker, leg, reason,
-    model: cfg.frontier.model, sent: JSON.stringify(masked),
-    // context the server needs to reactively reroute a streamed refusal to private:
-    kind, mode, maskedPrompt: extractText(masked, kind) };
+    model: cfg.frontier.model, sent: JSON.stringify(toSend),
+    // context the server needs to reactively reroute a streamed refusal to private
+    // (x-route: frontier means the caller wants the frontier's answer, refusal or not):
+    kind, mode: forced === "frontier" ? "frontier" : mode, maskedPrompt: extractText(masked, kind) };
 }
 
 /** Call the private leg for a (masked) prompt. Returns { reply, ok, status }. */
 export async function privateReply(cfg, maskedPrompt) {
-  const { callSolrouterAgent } = await import("./providers.js");
-  const r = await callSolrouterAgent(cfg.private, maskedPrompt);
+  const r = await callSolrouterPrivate(cfg.private, maskedPrompt);
   return { reply: r.reply || "", ok: r.ok, status: r.status };
 }
 

package/src/install.js

@@ -85,6 +85,8 @@ function resolveBin() {
 }
 
 export async function install() {
+  if (process.platform !== "darwin")
+    return { ok: false, error: "`install` is macOS-only (LaunchAgent + launchctl). On Linux/Windows, run `solrouter start` and point your tools at http://127.0.0.1:<port>." };
   const cfg = loadConfig();
   const key = cfg.frontier.apiKey || process.env.ANTHROPIC_API_KEY;
   if (!key) return { ok: false, error: "No Anthropic API key configured. Run `solrouter setup` first." };

package/src/mask.js

@@ -24,12 +24,15 @@ export function createMasker(opts = {}) {
   const seen = [];          // every entity masked this session (for the receipt)
 
   function surrogate(label, value) {
-    if (fwd.has(value)) return fwd.get(value);
+    // Key by label:value, not value alone — the same literal string under two
+    // labels (a loose PHONE vs a guessed PERSON, say) must not reuse one shape.
+    const key = label + ":" + value;
+    if (fwd.has(key)) return fwd.get(key);
     let s = surrogateFor(label, value);
     // Deterministic collision (two different originals → same fake): salt until unique.
     let salt = 0;
     while ((used.has(s) && rev.get(s) !== value)) s = surrogateFor(label, value + "#" + ++salt);
-    fwd.set(value, s); rev.set(s, value); used.add(s);
+    fwd.set(key, s); rev.set(s, value); used.add(s);
     return s;
   }
 
@@ -49,7 +52,7 @@ export function createMasker(opts = {}) {
       return { text: out, entities };
     },
 
-    /** Restore a complete string: surrogates → originals, fuzzy for mangled cases. */
+    /** Restore a complete string: surrogates → originals (exact, then case-insensitive). */
     unmask(text) {
       return restore(String(text ?? ""), rev);
     },
@@ -101,6 +104,9 @@ function streamingRestorer(rev) {
     for (const k of keys) {
       const max = Math.min(k.length - 1, buf.length); // proper prefix only
       for (let n = max; n > hold; n--) {
+        // Case-sensitive on purpose: a case-insensitive compare holds back a self-
+        // overlapping surrogate (e.g. "Tomas Cato": tail "to" == prefix "To") even when
+        // the surrogate is already complete in buf, splitting it so restore() misses it.
         if (buf.slice(buf.length - n) === k.slice(0, n)) { hold = n; break; }
       }
     }

package/src/providers.js

@@ -48,13 +48,9 @@ function authHeaders(leg, clientHeaders = {}) {
     return h;
   }
 
-  // 2. pass-through (default): forward the client's own auth too
-  let forwarded = false;
-  for (const k of ["authorization", "x-api-key"]) if (clientHeaders[k]) { h[k] = clientHeaders[k]; forwarded = true; }
-  if (!forwarded) {
-    const auth = loadAuth();
-    if (auth.access_token) h["authorization"] = `Bearer ${auth.access_token}`;
-  }
+  // 2. pass-through (default): forward the client's own auth. Never fall back to
+  //    the saved SolRouter key: this leg goes to a third-party provider.
+  for (const k of ["authorization", "x-api-key"]) if (clientHeaders[k]) h[k] = clientHeaders[k];
   if (leg.dialect === "anthropic" && !h["anthropic-version"]) h["anthropic-version"] = "2023-06-01";
   return h;
 }
@@ -92,23 +88,24 @@ export async function callLeg(leg, body, clientHeaders) {
 }
 
 /**
- * The private/uncensored leg: the SolRouter backend's /agent route. Takes a plain
- * prompt + a sk_solrouter_ key (stateless for API-key users), returns { reply }.
- * The prompt is already pseudonymised upstream.
+ * The private/uncensored leg: SolRouter's open-weight model inside the TEE.
+ * @solrouter/sdk encrypts the (already pseudonymised) prompt on this machine and
+ * POSTs only ciphertext to {backend}/tee/process; the reply comes back encrypted.
+ * The SolRouter backend never sees the prompt. Returns { ok, status, reply }.
  */
-export async function callSolrouterAgent(leg, prompt) {
-  const auth = loadAuth();
-  const key = leg.apiKey || auth.access_token;
-  if (!key) return { ok: false, status: 401, reply: "", error: "no SolRouter API key — run `login --token sk_solrouter_...`" };
-  const base = leg.baseUrl.replace(/\/$/, "");
-  const res = await fetch(`${base}/agent`, {
-    method: "POST",
-    headers: { "content-type": "application/json", "authorization": `Bearer ${key}` },
-    body: JSON.stringify({ prompt, model: leg.model || "qwen3.8:27b", useTools: false }),
-  });
-  let json = null;
-  try { json = await res.json(); } catch {}
-  return { ok: res.ok && json?.success !== false, status: res.status, reply: json?.reply ?? "", raw: json };
+export async function callSolrouterPrivate(leg, prompt) {
+  const key = leg.apiKey || loadAuth().access_token;
+  if (!key) return { ok: false, status: 401, reply: "", error: "no SolRouter API key — run `solrouter login`" };
+  const model = leg.model || "qwen3.8:27b";
+  try {
+    // Lazy: the Arcium crypto tree is heavy, and only this leg needs it.
+    const { SolRouter } = await import("@solrouter/sdk");
+    const client = new SolRouter({ apiKey: key, baseUrl: leg.baseUrl.replace(/\/$/, ""), encrypted: true });
+    const r = await client.chat(prompt, { model: model.startsWith("nosana:") ? model : `nosana:${model}` });
+    return { ok: true, status: 200, reply: r.message ?? "" };
+  } catch (e) {
+    return { ok: false, status: 502, reply: "", error: e instanceof Error ? e.message : String(e) };
+  }
 }
 
 /**

package/src/receipt.js

@@ -1,10 +1,14 @@
 // receipt.js — one hash-chained JSONL line per call. What was detected, what was
-// masked, which leg ran it, and a hash of what the provider actually received.
+// masked, which leg ran it, and a hash of the masked payload that leg was given.
+// For the frontier leg that is the request body on the wire. For the sealed
+// private leg it is the masked prompt before @solrouter/sdk encrypts it, because
+// the ciphertext uses a random nonce per call and its hash would prove nothing.
 // The receipt never contains raw values or the map — only labels, counts, and
 // hashes — so the audit log itself is safe to keep and to show an auditor.
 
 import { createHash } from "node:crypto";
-import { appendFileSync, readFileSync, existsSync } from "node:fs";
+import { appendFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
 
 const sha256 = s => createHash("sha256").update(String(s)).digest("hex");
 
@@ -40,6 +44,7 @@ export function writeReceipt(path, entry) {
   };
   const hash = sha256(prev + JSON.stringify(body));
   const line = JSON.stringify({ ...body, hash });
+  mkdirSync(dirname(path), { recursive: true }); // first run: ~/.solrouter may not exist yet
   appendFileSync(path, line + "\n");
   return { ...body, hash };
 }

package/src/route.js

@@ -63,12 +63,20 @@ const DECLINE_HINTS = [
 export function isRefusal(text) {
   const s = String(text ?? "").trim();
   if (!s) return false;
-  // Strong signatures fire at any length up to ~1500 (refusals are short).
+  // Strong signatures fire at any length up to ~1500 (refusals are short). Raising
+  // this cap misroutes long genuine answers that merely quote "I can't help…", so
+  // it stays at 1500: a false reroute to the weaker leg is worse than missing a rare
+  // 1500+ char refusal (which the reactive path still catches at the next turn).
   if (s.length <= 1500) for (const re of REFUSAL_SIGNATURES) if (re.test(s)) return true;
   // Short + soft decline hints → also a refusal. Short because a real coding answer
   // is long / full of code; a brief prose reply that declines is a refusal.
   if (s.length <= 600) {
-    const hasCode = /```|\bfunction\b|\bconst \b|\bimport \b|=>|\bdef \b|;\n/.test(s);
+    // "Looks like code" = a fenced block, structural punctuation, an indented line,
+    // or SEVERAL code keywords — NOT a single keyword, so a plain refusal that just
+    // says the word "function" is no longer misread as a code answer.
+    const hasCode = /```/.test(s)
+      || /[{};]\s*$|\)\s*\{|=>\s|^\s{2,}\S/m.test(s)
+      || (s.match(/\b(?:function|const|let|import|export|def|class|return|await)\b/g) || []).length >= 2;
     if (!hasCode) for (const re of DECLINE_HINTS) if (re.test(s)) return true;
   }
   return false;

package/src/secrets.js

@@ -30,16 +30,22 @@ export const SECRET_PATTERNS = [
   // Bearer header values.
   { label: "BEARER", re: /\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*\b/ },
 
-  // Internal hostnames a model has no business seeing.
+  // Internal hostnames a model has no business seeing. Case-SENSITIVE on purpose:
+  // /i made it match PascalCase member access in code (cfg.Internal, Acme.Corp) and
+  // corrupt it. Quantifiers are BOUNDED (DNS labels ≤63 chars, ≤8 levels) so each
+  // start position does O(1) work — an unbounded run went quadratic on dotted input
+  // (a.a.a…), blocking the event loop for seconds on a ~32KB string.
   { label: "INTERNAL_HOST",
-    re: /\b[a-z0-9][a-z0-9.-]*\.(?:internal|corp|local|intranet|lan|svc\.cluster\.local)\b/i },
+    re: /\b[a-z0-9][a-z0-9-]{0,62}(?:\.[a-z0-9-]{1,63}){0,8}\.(?:internal|corp|local|intranet|lan|svc\.cluster\.local)\b/ },
 
-  // "SECRET=…", "api_key: …", "token=…" — a labelled assignment. Captures the
-  // value; validated to skip obvious placeholders like "your-key-here".
+  // "SECRET=…", "api_key: …", "token=…" — a labelled assignment. A variable-length
+  // lookbehind matches the label + separator but keeps them OUT of the match, so the
+  // span is the value ALONE — the label never enters the surrogate and its length
+  // can't shift which characters get preserved. Skips obvious placeholders.
   { label: "ASSIGNED_SECRET",
-    re: /\b(?:[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|API_KEY|PRIVATE_KEY|ACCESS_KEY))\b\s*[:=]\s*["']?([^\s"',}]{8,})/i,
+    re: /(?<=\b(?:[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|API_KEY|PRIVATE_KEY|ACCESS_KEY))\b\s*[:=]\s*["']?)[^\s"',}]{8,}/i,
     check: v => {
-      const val = (v.split(/[:=]/).slice(1).join("=") || v).replace(/["']/g, "").trim();
+      const val = v.replace(/["']/g, "").trim();
       return !/^(?:your|my|the|example|changeme|placeholder|xxx+|<[^>]+>|\.\.\.)/i.test(val)
         && !/^\$\{?[A-Z0-9_]+\}?$/.test(val); // not itself an env-var reference
     } },

package/src/server.js

@@ -11,7 +11,7 @@ import { appendFileSync } from "node:fs";
 import { join } from "node:path";
 import { handle, handleStream, createMasker, privateReply } from "./index.js";
 import { forward } from "./providers.js";
-import { dialect, rewriteText } from "./wire.js";
+import { dialect, rewriteText, extractResponseText } from "./wire.js";
 import { isRefusal } from "./route.js";
 import { writeReceipt } from "./receipt.js";
 import { HOME_DIR } from "./config.js";
@@ -29,14 +29,20 @@ function logDecision(o) {
   try { appendFileSync(join(HOME_DIR, "debug.log"), JSON.stringify({ ts: new Date().toISOString(), ...o }) + "\n"); } catch {}
 }
 
-/** Pull assistant text out of an Anthropic SSE chunk (text_delta events). */
-function extractSseText(chunk) {
+/** Pull assistant text out of an SSE chunk, in whichever dialect the leg streams. */
+export function extractSseText(chunk, kind = "anthropic") {
   let out = "";
   for (const line of String(chunk).split("\n")) {
     if (!line.startsWith("data:")) continue;
+    const payload = line.slice(5).trim();
+    if (payload === "[DONE]") continue;
     try {
-      const d = JSON.parse(line.slice(5).trim());
-      if (d?.type === "content_block_delta" && d.delta?.type === "text_delta") out += d.delta.text || "";
+      const d = JSON.parse(payload);
+      if (kind === "openai") {
+        for (const ch of d?.choices || []) out += ch?.delta?.content || "";
+      } else if (d?.type === "content_block_delta" && d.delta?.type === "text_delta") {
+        out += d.delta.text || "";
+      }
     } catch {}
   }
   return out;
@@ -55,12 +61,39 @@ function synthAnthropicSse(text, model) {
   );
 }
 
-function readBody(req) {
+/** Build a complete OpenAI-format SSE stream from a plain text answer. */
+function synthOpenAiSse(text, model) {
+  const ev = d => `data: ${JSON.stringify(d)}\n\n`;
+  const base = { id: "chatcmpl-proxy", object: "chat.completion.chunk", model: model || "solrouter" };
+  return (
+    ev({ ...base, choices: [{ index: 0, delta: { role: "assistant", content: String(text) }, finish_reason: null }] }) +
+    ev({ ...base, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] }) +
+    "data: [DONE]\n\n"
+  );
+}
+
+/** Synthesise an SSE answer in the client's dialect (what the caller will parse). */
+const synthSse = (kind, text, model) => kind === "openai" ? synthOpenAiSse(text, model) : synthAnthropicSse(text, model);
+
+export function readBody(req) {
   return new Promise((resolve, reject) => {
-    let data = "";
-    req.on("data", c => { data += c; if (data.length > 25 * 1024 * 1024) req.destroy(); });
-    req.on("end", () => { try { resolve(data ? JSON.parse(data) : {}); } catch (e) { reject(e); } });
-    req.on("error", reject);
+    let data = "", done = false;
+    const settle = (fn, v) => { if (!done) { done = true; fn(v); } };
+    req.on("data", c => {
+      data += c;
+      if (data.length > 25 * 1024 * 1024) {
+        // pause (don't destroy) the socket so the handler can still write a 413 back;
+        // destroy() tears down the socket and the client gets a reset, not a status.
+        req.pause();
+        settle(reject, Object.assign(new Error("request body too large"), { code: "BODY_TOO_LARGE" }));
+      }
+    });
+    req.on("end", () => { try { settle(resolve, data ? JSON.parse(data) : {}); } catch (e) { settle(reject, e); } });
+    req.on("error", e => settle(reject, e));
+    // destroy() fires 'aborted'/'close', not 'error' — settle here so an oversized or
+    // truncated request rejects instead of leaving the handler awaiting forever.
+    req.on("aborted", () => settle(reject, new Error("request aborted")));
+    req.on("close", () => settle(reject, new Error("connection closed before body completed")));
   });
 }
 
@@ -72,17 +105,30 @@ export function startServer(cfg) {
 
     if (req.method === "GET" && req.url === "/health") return send(200, { ok: true, proxy: "solrouter", version: VERSION, mode: cfg.mode });
 
-    // Transparent passthrough for other Anthropic endpoints the client probes —
-    // notably /v1/messages/count_tokens, which Claude Code calls before every
-    // request and treats a 404 on as "model unavailable". Forward to the frontier.
+    // Other /v1 endpoints the client probes. Claude Code calls
+    // /v1/messages/count_tokens before every request and treats a 404 as "model
+    // unavailable". Only shapes the masker understands may leave the machine:
+    // body-less GETs and count_tokens (a messages body). Anything else (e.g.
+    // /v1/responses) would go out unmasked, so it is refused. In private mode
+    // nothing goes to the frontier at all.
     if (/^\/v1\//.test(req.url) && !/^\/(v1\/chat\/completions|v1\/messages)$/.test(req.url)) {
+      const path = req.url.split("?")[0];
+      const h = lower(req.headers);
+      const privateOnly = h["x-route"] === "private" || (h["x-mode"] || cfg.mode) === "private";
+      const countTokens = req.method === "POST" && path === "/v1/messages/count_tokens";
       let body;
       if (req.method === "POST") {
-        try { body = await readBody(req); } catch { return send(400, { error: "invalid JSON body" }); }
-        if (body && cfg.masking?.enabled !== false) {
-          const m = createMasker(cfg.masking);
-          body = rewriteText(body, dialect(body, req.url), s => m.mask(s).text);
-        }
+        try { body = await readBody(req); } catch (e) { return send(e?.code === "BODY_TOO_LARGE" ? 413 : 400, { error: e?.code === "BODY_TOO_LARGE" ? "request body too large" : "invalid JSON body" }); }
+      }
+      if (privateOnly) {
+        if (countTokens) return send(200, { input_tokens: Math.ceil(JSON.stringify(body?.messages ?? "").length / 4) }); // rough local estimate
+        if (req.method === "GET" && path === "/v1/models") return send(200, { object: "list", data: [{ id: cfg.private.model, object: "model" }] });
+        return send(404, { error: `${path} is not available in private mode` });
+      }
+      if (req.method !== "GET" && !countTokens) return send(404, { error: `${path} is not supported by the solrouter proxy` });
+      if (body && cfg.masking?.enabled !== false) {
+        const m = createMasker(cfg.masking);
+        body = rewriteText(body, dialect(body, req.url), s => m.mask(s).text);
       }
       try {
         const r = await forward(cfg.frontier, { method: req.method, path: req.url, body, clientHeaders: lower(req.headers) });
@@ -97,15 +143,21 @@ export function startServer(cfg) {
     }
 
     let body;
-    try { body = await readBody(req); } catch { return send(400, { error: "invalid JSON body" }); }
+    try { body = await readBody(req); } catch (e) { return send(e?.code === "BODY_TOO_LARGE" ? 413 : 400, { error: e?.code === "BODY_TOO_LARGE" ? "request body too large" : "invalid JSON body" }); }
     const ctx = { path: req.url, headers: lower(req.headers) };
 
     try {
       if (body.stream) {
         const s = await handleStream(body, ctx, cfg);
         // Private leg can't stream yet — it returns a prebuilt body (receipt
-        // already written inside handle()). Send it as a normal JSON 200.
-        if (s.prebuilt) return send(s.status || 200, s.json);
+        // already written inside handle()). The client asked for a stream, so its
+        // parser expects SSE: replay the answer as one SSE stream in its dialect.
+        if (s.prebuilt) {
+          if (s.status !== 200) return send(s.status || 502, s.json);
+          const kind = dialect(body, req.url);
+          res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache" });
+          return res.end(synthSse(kind, extractResponseText(s.json, kind), s.json?.model));
+        }
         if (!s.ok || !s.stream) return send(s.status || 502, { error: "upstream error", leg: s.leg });
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", "connection": "keep-alive" });
         const restorer = cfg.masking?.enabled === false ? null : s.masker.streamingUnmasker();
@@ -118,12 +170,16 @@ export function startServer(cfg) {
         // stream live. If the whole short response is a refusal and mode is auto,
         // we discard it and reroute to the private/uncensored leg.
         const COMMIT_AT = 380;               // chars of answer text that means "real answer"
+        // Parse the frontier's SSE in ITS dialect — an OpenAI frontier streams
+        // choices[].delta.content, not Anthropic text_delta, so a fixed parser would
+        // read "" from every chunk and never detect a refusal or commit to streaming.
+        const frontierKind = cfg.frontier?.dialect || s.kind;
         let committed = false, held = "", acc = "", refusalLikely = false;
         for (;;) {
           const { done, value } = await reader.read();
           if (done) break;
           const chunk = dec.decode(value, { stream: true });
-          acc += extractSseText(chunk);
+          acc += extractSseText(chunk, frontierKind);
           if (committed) { emit(chunk); continue; }
           held += chunk;
           // Lock onto a refusal as soon as its opening matches — then never commit,
@@ -144,7 +200,7 @@ export function startServer(cfg) {
           if (pr.ok && pr.reply) {
             leg = "private"; refused = true; model = cfg.private.model;
             const restored = restorer ? s.masker.unmask(pr.reply) : pr.reply;
-            res.write(synthAnthropicSse(restored, model));
+            res.write(synthSse(s.kind, restored, model));
             res.end();
             if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
               leg, reason: "reactive-refusal", model, entities: s.masker.entities(), refused: true, sentToProvider: s.sent });
@@ -153,9 +209,9 @@ export function startServer(cfg) {
           // Reroute was needed but the uncensored leg failed — say so LOUDLY instead
           // of silently relaying Claude's refusal (this is almost always "not logged
           // in" / an invalid SolRouter key).
-          res.write(synthAnthropicSse(
+          res.write(synthSse(s.kind,
             `⚠️ [solrouter] Claude refused this, and the uncensored leg couldn't be reached (${pr.status || "error"}). ` +
-            `Run \`solrouter login --token sk_solrouter_…\` with a valid key from solrouter.com/sdk, then retry.`,
+            `Run \`solrouter login\`, approve in the browser, then retry.`,
             cfg.private.model));
           res.end();
           if (cfg.receipt?.enabled) writeReceipt(cfg.receipt.path, {
@@ -180,10 +236,27 @@ export function startServer(cfg) {
     }
   });
 
-  server.on("error", (e) => {
+  server.on("error", async (e) => {
     if (e.code === "EADDRINUSE") {
-      // A proxy is already listening here — reuse it rather than crash.
-      console.log(`SolRouter proxy already running on http://127.0.0.1:${cfg.port} — reusing it.`);
+      // Something is already on this port. Only claim "reusing" if it is actually
+      // a SolRouter proxy — otherwise we'd be routing the user's traffic to an
+      // unrelated process while reporting success.
+      let isOurs = false;
+      try {
+        const ctrl = new AbortController();
+        const t = setTimeout(() => ctrl.abort(), 1000);
+        const r = await fetch(`http://127.0.0.1:${cfg.port}/health`, { signal: ctrl.signal });
+        const j = await r.json().catch(() => ({}));
+        clearTimeout(t);
+        isOurs = r.ok && j?.proxy === "solrouter";
+      } catch { /* unreachable or not JSON — not ours */ }
+      if (isOurs) {
+        console.log(`SolRouter proxy already running on http://127.0.0.1:${cfg.port} — reusing it.`);
+      } else {
+        console.error(`Port ${cfg.port} is in use by another process (not a SolRouter proxy).`);
+        console.error(`Free it, or start on a different port:  solrouter start --port <n>`);
+        process.exit(1);
+      }
     } else {
       console.error("proxy server error:", e.message);
       process.exit(1);

package/src/surrogates.js

@@ -74,16 +74,20 @@ function fakeCard(r) {
   return [...body, check].join("").replace(/(\d{4})(?=\d)/g, "$1 ");
 }
 
-// Keep a secret's shape (prefix + length class) but randomise the body, so the
-// model sees a plausible key and never the real one.
+// Recognised PUBLIC key prefixes — non-secret markers, safe to keep so the model
+// still sees the type (sk-proj-, sk-ant-, AKIA, ghp_, …). Everything else keeps
+// NO real characters: the leading bytes of a raw secret are still secret.
+const KEY_PREFIX = /^(?:sk-ant-|sk-proj-|sk-|xox[baprs]-|gh[pousr]_|AKIA|ASIA|AIza|[rs]k_(?:live|test)_|eyJ)/;
+
+// Keep a secret's shape (length + non-alphanumeric layout) but randomise the body,
+// so the model sees a plausible key and never the real one. Only a recognised
+// public prefix is preserved; an unlabelled secret keeps nothing.
 function fakeLikeShape(value, r) {
   const alnum = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-  // Keep a leading prefix so the type stays recognizable (sk-proj-, sk-ant-, AKIA…)
-  // without leaking a short secret: proportional, capped at 8 chars.
-  const keep = Math.min(8, Math.max(3, Math.floor(value.length * 0.3)));
-  let seen = 0;
-  return value.replace(/[A-Za-z0-9]/g, ch =>
-    seen++ < keep ? ch : alnum[r.int(alnum.length)]);
+  const pfx = value.match(KEY_PREFIX);
+  const keep = pfx ? pfx[0].length : 0; // keep by string offset, not alnum count
+  return value.replace(/[A-Za-z0-9]/g, (ch, idx) =>
+    idx < keep ? ch : alnum[r.int(alnum.length)]);
 }
 
 const GENERATORS = {

package/src/wire.js

@@ -1,6 +1,8 @@
 // wire.js — read and rewrite the two request shapes the proxy accepts:
-// OpenAI /v1/chat/completions and Anthropic /v1/messages. We only touch the
-// text the user wrote; system prompts, roles and every other field pass through.
+// OpenAI /v1/chat/completions and Anthropic /v1/messages. We mask every field
+// that can carry the user's data — message text, tool-call inputs, tool results,
+// and tool-definition descriptions — and pass structural fields (names, ids,
+// types, schema keywords) through untouched so function-calling still resolves.
 //
 // Kept separate from routing so the two API dialects live in one place.
 
@@ -12,7 +14,16 @@ export function dialect(body, path = "") {
   return "openai"; // default; chat/completions is the common case
 }
 
-/** Pull the concatenated user-authored text out of a request body. */
+/** Collect every string leaf in an arbitrary JSON value (for tool payloads). */
+function stringsOf(v, out = []) {
+  if (typeof v === "string") out.push(v);
+  else if (Array.isArray(v)) for (const x of v) stringsOf(x, out);
+  else if (v && typeof v === "object") for (const k of Object.keys(v)) stringsOf(v[k], out);
+  return out;
+}
+
+/** Pull the concatenated user-authored text out of a request body — including tool
+ *  inputs and results, so the private leg's prompt is complete, not just message text. */
 export function extractText(body, kind) {
   const parts = [];
   const pushContent = c => {
@@ -20,28 +31,116 @@ export function extractText(body, kind) {
     else if (Array.isArray(c)) for (const seg of c) {
       if (typeof seg === "string") parts.push(seg);
       else if (seg?.type === "text" && typeof seg.text === "string") parts.push(seg.text);
+      else if (seg?.type === "tool_use" && seg.input) parts.push(...stringsOf(seg.input));
+      else if (seg?.type === "tool_result") parts.push(...stringsOf(seg.content));
+      else if (seg?.type === "document") {
+        if (typeof seg.title === "string") parts.push(seg.title);
+        if (typeof seg.context === "string") parts.push(seg.context);
+        const src = seg.source;
+        if (src?.type === "text" && typeof src.data === "string") parts.push(src.data);
+        else if (src?.type === "content") pushContent(src.content);
+      }
     }
   };
   if (kind === "anthropic") {
     if (typeof body?.system === "string") parts.push(body.system);
     else if (Array.isArray(body?.system)) pushContent(body.system);
   }
-  for (const m of body?.messages || []) pushContent(m?.content);
+  for (const m of body?.messages || []) {
+    pushContent(m?.content);
+    if (Array.isArray(m?.tool_calls)) for (const tc of m.tool_calls)
+      if (tc?.function?.arguments != null) parts.push(...stringsOf(tc.function.arguments));
+    if (m?.function_call?.arguments != null) parts.push(...stringsOf(m.function_call.arguments));
+  }
   return parts.join("\n");
 }
 
+// ── deep helpers for tool-call payloads ──────────────────────────────────────
+// Tool inputs and results carry the user's data as arbitrary JSON, not text
+// segments — the biggest silent leak in real redactors (SPEC §5.1). Mask every
+// string VALUE, keep object keys and non-string leaves, so structure survives.
+function maskValues(v, fn) {
+  if (typeof v === "string") return fn(v);
+  if (Array.isArray(v)) return v.map(x => maskValues(x, fn));
+  if (v && typeof v === "object") {
+    const o = {};
+    for (const k of Object.keys(v)) o[k] = maskValues(v[k], fn);
+    return o;
+  }
+  return v;
+}
+
+// A tool_result's content is a string or an array of blocks (Anthropic).
+function maskToolResult(content, fn) {
+  if (typeof content === "string") return fn(content);
+  if (Array.isArray(content)) return content.map(b =>
+    typeof b === "string" ? fn(b)
+      : b?.type === "text" && typeof b.text === "string" ? { ...b, text: fn(b.text) } : b);
+  return content;
+}
+
+// Mask only free-text `description` fields in a tool definition, at any depth,
+// leaving names, types and enum values intact so the model still calls the tool.
+function maskDescriptions(v, fn) {
+  if (Array.isArray(v)) return v.map(x => maskDescriptions(x, fn));
+  if (v && typeof v === "object") {
+    const o = {};
+    for (const k of Object.keys(v))
+      o[k] = (k === "description" && typeof v[k] === "string") ? fn(v[k]) : maskDescriptions(v[k], fn);
+    return o;
+  }
+  return v;
+}
+
+// OpenAI tool_calls carry arguments as a JSON STRING. Parse, mask values, re-emit;
+// if it isn't valid JSON, mask the raw string so nothing slips through unmasked.
+function maskArgsJson(s, fn) {
+  if (typeof s !== "string") return s;
+  try { return JSON.stringify(maskValues(JSON.parse(s), fn)); }
+  catch { return fn(s); }
+}
+
 /** Apply a (text -> text) transform to every user-authored string in the body. */
 export function rewriteText(body, kind, fn) {
   const out = structuredClone(body);
   const mapContent = c => {
     if (typeof c === "string") return fn(c);
-    if (Array.isArray(c)) return c.map(seg =>
-      seg?.type === "text" && typeof seg.text === "string" ? { ...seg, text: fn(seg.text) }
-        : typeof seg === "string" ? fn(seg) : seg);
+    if (Array.isArray(c)) return c.map(seg => {
+      if (typeof seg === "string") return fn(seg);
+      if (seg?.type === "text" && typeof seg.text === "string") return { ...seg, text: fn(seg.text) };
+      if (seg?.type === "tool_use" && seg.input && typeof seg.input === "object") return { ...seg, input: maskValues(seg.input, fn) };
+      if (seg?.type === "tool_result") return { ...seg, content: maskToolResult(seg.content, fn) };
+      // Anthropic documents carry user prose in title, context, and the source —
+      // either source.data (type:"text") or nested text blocks (type:"content").
+      // base64/url/file sources are binary, left alone.
+      if (seg?.type === "document") {
+        const d = { ...seg };
+        if (typeof seg.title === "string") d.title = fn(seg.title);
+        if (typeof seg.context === "string") d.context = fn(seg.context);
+        const src = seg.source;
+        if (src?.type === "text" && typeof src.data === "string") d.source = { ...src, data: fn(src.data) };
+        else if (src?.type === "content" && Array.isArray(src.content)) d.source = { ...src, content: mapContent(src.content) };
+        return d;
+      }
+      return seg;
+    });
     return c;
   };
   if (kind === "anthropic" && out.system != null) out.system = mapContent(out.system);
-  if (Array.isArray(out.messages)) out.messages = out.messages.map(m => ({ ...m, content: mapContent(m.content) }));
+  if (Array.isArray(out.messages)) out.messages = out.messages.map(m => {
+    const mm = { ...m, content: mapContent(m.content) };
+    // OpenAI: an assistant turn's tool calls carry user data in .function.arguments
+    if (Array.isArray(m.tool_calls)) mm.tool_calls = m.tool_calls.map(tc =>
+      tc?.function?.arguments != null
+        ? { ...tc, function: { ...tc.function, arguments: maskArgsJson(tc.function.arguments, fn) } }
+        : tc);
+    // Legacy OpenAI: the deprecated single function_call is still honored upstream.
+    if (m.function_call?.arguments != null)
+      mm.function_call = { ...m.function_call, arguments: maskArgsJson(m.function_call.arguments, fn) };
+    return mm;
+  });
+  // Tool DEFINITIONS (both dialects) — mask their prose descriptions.
+  if (Array.isArray(out.tools)) out.tools = out.tools.map(t => maskDescriptions(t, fn));
   return out;
 }
 
@@ -53,14 +152,26 @@ export function extractResponseText(body, kind) {
   return (body?.choices || []).map(c => c?.message?.content || "").join("");
 }
 
-/** Rewrite the assistant's text in a (non-streaming) response body. */
+/** Rewrite the assistant's text in a (non-streaming) response body. Restores tool
+ *  outputs too — the model echoes surrogates into tool_use/tool_calls, and the client
+ *  would otherwise EXECUTE the tool on fake values. Symmetric with rewriteText's masking. */
 export function rewriteResponseText(body, kind, fn) {
   const out = structuredClone(body);
   if (kind === "anthropic") {
-    out.content = (out.content || []).map(b => b?.type === "text" ? { ...b, text: fn(b.text) } : b);
+    out.content = (out.content || []).map(b =>
+      b?.type === "text" ? { ...b, text: fn(b.text) }
+        : b?.type === "tool_use" && b.input && typeof b.input === "object" ? { ...b, input: maskValues(b.input, fn) }
+        : b);
   } else {
-    out.choices = (out.choices || []).map(c =>
-      c?.message ? { ...c, message: { ...c.message, content: fn(c.message.content || "") } } : c);
+    out.choices = (out.choices || []).map(c => {
+      if (!c?.message) return c;
+      const message = { ...c.message, content: fn(c.message.content || "") };
+      if (Array.isArray(c.message.tool_calls)) message.tool_calls = c.message.tool_calls.map(tc =>
+        tc?.function?.arguments != null
+          ? { ...tc, function: { ...tc.function, arguments: maskArgsJson(tc.function.arguments, fn) } }
+          : tc);
+      return { ...c, message };
+    });
   }
   return out;
 }