coderouter-cli 2.10.0__py3-none-any.whl → 2.11.1__py3-none-any.whl

coderouter/doctor.py

@@ -321,17 +321,32 @@ def _patch_model_capabilities_yaml(*, match: str, kind: str, key: str, value: bo
 
 
 def _patch_providers_yaml_output_filters(provider_name: str, filters: list[str]) -> str:
-    """v1.0-A: Emit a providers.yaml patch adding/extending ``output_filters``.
-
-    Lists the filters verbatim so copy-paste yields a valid YAML list.
-    The comment block above the stanza hints that this is additive with
-    any existing filter chain — users with a bespoke chain should merge
-    rather than replace.
+    """v1.0-A: Emit a providers.yaml patch setting the full ``output_filters`` chain.
+
+    ``filters`` must already be the **complete** post-fix chain — the
+    provider's existing filters in their existing order, plus whatever
+    the probe found missing appended at the end. Callers build that
+    union; see :func:`_union_output_filters`.
+
+    Why the complete chain and not just the additions: ``--apply``
+    merges this patch with ``deep_merge_dicts``, which replaces lists
+    wholesale (documented contract, pinned by
+    ``test_deep_merge_replaces_lists_wholesale``). Emitting only the
+    missing filters would therefore *delete* every filter the operator
+    already had — including ``strip_tool_call_xml`` /
+    ``repair_byte_fallback``, which this probe never recommends and so
+    could never add back. Keeping "patch YAML == the desired end state"
+    also means the copy-paste path and the ``--apply`` path agree, and
+    the ``--dry-run`` diff reads as the literal final value.
     """
     items = "\n".join(f"      - {f}" for f in filters)
     return (
         "# providers.yaml — update the entry for "
-        f"{provider_name!r} (merge if a chain already exists):\n"
+        f"{provider_name!r}. This is the COMPLETE chain (existing filters "
+        "plus the additions) —\n"
+        "# it replaces `output_filters` wholesale rather than appending "
+        "to it. Order is significant:\n"
+        "# filters run left to right.\n"
         "providers:\n"
         f"  - name: {provider_name}\n"
         "    # ... existing fields ...\n"
@@ -340,6 +355,27 @@ def _patch_providers_yaml_output_filters(provider_name: str, filters: list[str])
     )
 
 
+def _union_output_filters(existing: list[str], additions: list[str]) -> list[str]:
+    """Existing chain + the filters it is missing, order-preserving.
+
+    ``OutputFilterChain.feed()`` applies filters left to right, so the
+    chain is a pipeline, not a set: reordering it changes the output
+    (e.g. ``strip_thinking`` before vs. after ``strip_tool_call_xml``
+    decides whether a tool call nested inside ``<think>`` survives).
+    Never sort this — the operator's existing order is authoritative and
+    the additions go on the end, which is the only placement that cannot
+    change the behavior of the filters already there.
+
+    Duplicates are dropped so a re-run of the probe cannot grow the
+    chain unboundedly.
+    """
+    chain = list(existing)
+    for name in additions:
+        if name not in chain:
+            chain.append(name)
+    return chain
+
+
 def _patch_providers_yaml_num_ctx(provider_name: str, desired_ctx: int = 32768) -> str:
     """v1.0-B: Emit a providers.yaml patch setting ``extra_body.options.num_ctx``.
 
@@ -470,6 +506,23 @@ _STREAMING_PROBE_MAX_TOKENS_THINKING = 1024
 # probes (same _is_reasoning_model gate).
 _TOOL_CALLS_PROBE_MAX_TOKENS_DEFAULT = 256
 _TOOL_CALLS_PROBE_MAX_TOKENS_THINKING = 1024
+# How much assistant text the tool_calls probe feeds to
+# ``repair_tool_calls_in_text``. This has to be sized against the token
+# budgets above, not against a "preview" length: 1024 tokens is roughly
+# 3-4k characters, and a thinking model routinely spends several hundred
+# of them on a preamble before writing its JSON call. Scanning only the
+# first 200 characters (the pre-fix behavior) made the probe conclude
+# "nothing tool-shaped at all" for a model that had in fact emitted a
+# perfectly repairable call — and the remediation for that verdict is a
+# ``capabilities.tools: false`` patch, i.e. ``--apply`` would have
+# permanently disabled tool calling for a provider that supports it.
+# Bounded rather than unlimited so a pathological multi-megabyte
+# response cannot turn the probe into a CPU sink; 16 KiB comfortably
+# covers the largest response either budget can produce.
+_TOOL_PROBE_SCAN_CHARS = 16384
+# Length of the human-facing excerpt embedded in probe ``detail`` text.
+# Display only — never the input to a verdict.
+_TOOL_PROBE_DETAIL_PREVIEW_CHARS = 200
 # Default ``num_predict`` suggested in the emitted patch. -1 would be
 # optimal (uncapped) but "4096" communicates intent more clearly to
 # operators unfamiliar with Ollama's sentinel value, and covers Claude
@@ -1191,7 +1244,12 @@ async def _probe_tool_calls(
 
     native_tool_call = False
     text_json_tool_call = False
-    content_sample = ""
+    # ``scan_text`` is what the verdict is computed from — the assistant
+    # text up to _TOOL_PROBE_SCAN_CHARS. ``content_preview`` is a short
+    # excerpt used only inside human-readable ``detail`` strings. Keeping
+    # these two separate is the whole point: they used to be one 200-char
+    # string, so the preview length silently became the detection window.
+    scan_text = ""
     if provider.kind == "anthropic":
         blocks = parsed.get("content")
         if isinstance(blocks, list):
@@ -1199,11 +1257,11 @@ async def _probe_tool_calls(
                 if isinstance(block, dict) and block.get("type") == "tool_use":
                     native_tool_call = True
                     break
-            content_sample = " ".join(
+            scan_text = " ".join(
                 str(b.get("text", ""))
                 for b in blocks
                 if isinstance(b, dict) and b.get("type") == "text"
-            )[:200]
+            )[:_TOOL_PROBE_SCAN_CHARS]
     else:
         msg = _extract_openai_assistant_choice(parsed)
         if msg is not None:
@@ -1211,10 +1269,13 @@ async def _probe_tool_calls(
                 native_tool_call = True
             content = msg.get("content")
             if isinstance(content, str):
-                content_sample = content[:200]
+                scan_text = content[:_TOOL_PROBE_SCAN_CHARS]
+
+    content_preview = scan_text[:_TOOL_PROBE_DETAIL_PREVIEW_CHARS]
+    scanned_chars = len(scan_text)
 
-    if not native_tool_call and content_sample:
-        _, repaired = repair_tool_calls_in_text(content_sample, ["echo"])
+    if not native_tool_call and scan_text:
+        _, repaired = repair_tool_calls_in_text(scan_text, ["echo"])
         text_json_tool_call = bool(repaired)
 
     # Resolve the declared support:
@@ -1293,14 +1354,24 @@ async def _probe_tool_calls(
                 "the model produced no tool-shaped output at all."
             )
         )
+        # State the detection window explicitly. This verdict's
+        # remediation permanently disables tool calling, so an operator
+        # who disagrees with it needs to be able to tell "the model
+        # really emitted nothing" from "the probe only looked at the
+        # first N characters" without reading the source.
+        scan_note = (
+            f"Scanned {scanned_chars} chars of assistant text "
+            f"(window {_TOOL_PROBE_SCAN_CHARS})"
+            + (f"; begins: {content_preview!r}." if content_preview else "; text was empty.")
+        )
         return ProbeResult(
             name="tool_calls",
             verdict=ProbeVerdict.NEEDS_TUNING,
             detail=(
                 "declaration says tools=true but model produced neither "
                 "native `tool_calls` nor repairable tool JSON. "
-                f"{budget_note} Common for quantized small models "
-                "(plan.md §9.4 symptom #2)."
+                f"{budget_note} {scan_note} Common for quantized small "
+                "models (plan.md §9.4 symptom #2)."
             ),
             target_file="providers.yaml",
             suggested_patch=_patch_providers_yaml_capability(provider.name, "tools", False),
@@ -1526,7 +1597,10 @@ async def _probe_reasoning_leak(
     content_text = content if isinstance(content, str) else ""
     has_think = "<think>" in content_text
     leaked_markers: list[str] = [m for m in DEFAULT_STOP_MARKERS if m in content_text]
-    configured_filters = set(provider.output_filters)
+    # Order matters (the chain is a left-to-right pipeline), so keep the
+    # operator's list as a list — a set here would lose the order we have
+    # to reproduce in the patch.
+    configured_filters: list[str] = list(provider.output_filters)
     needs_strip_thinking = has_think and "strip_thinking" not in configured_filters
     needs_strip_markers = bool(leaked_markers) and "strip_stop_markers" not in configured_filters
 
@@ -1542,6 +1616,11 @@ async def _probe_reasoning_leak(
         if needs_strip_markers:
             recommended.append("strip_stop_markers")
 
+        # The patch must carry the WHOLE chain: --apply replaces the
+        # list wholesale, so emitting only ``recommended`` would drop
+        # every filter the operator already configured.
+        merged_chain = _union_output_filters(configured_filters, recommended)
+
         found_desc: list[str] = []
         if has_think:
             found_desc.append("<think>...</think>")
@@ -1555,11 +1634,11 @@ async def _probe_reasoning_leak(
                 "content-embedded leak detected ("
                 + " + ".join(found_desc)
                 + "). v1.0-A `output_filters` would scrub this; current "
-                f"provider chain = {sorted(configured_filters)}. Recommended: "
-                f"add {recommended}."
+                f"provider chain = {configured_filters}. Recommended: "
+                f"add {recommended} → resulting chain {merged_chain}."
             ),
             target_file="providers.yaml",
-            suggested_patch=_patch_providers_yaml_output_filters(provider.name, recommended),
+            suggested_patch=_patch_providers_yaml_output_filters(provider.name, merged_chain),
         )
 
     passthrough_on = (

coderouter/doctor_apply.py

@@ -332,6 +332,18 @@ def merge_capabilities_rule_into_doc(doc: Any, patch_dict: dict[str, Any]) -> bo
 # ---------------------------------------------------------------------------
 
 
+# ruamel's emitter defaults to folding at 80 columns: any quoted scalar
+# longer than that gets wrapped onto a continuation line on dump, even
+# when the operator never touched it. That reformat is invisible to the
+# "did the merge change anything?" bookkeeping, so it used to leak into
+# the written file (and from there into the ``.bak`` on the *next* run,
+# destroying the only pristine copy). Applied on BOTH the load and the
+# dump side — ruamel stores the width on the instance, and an asymmetric
+# setting silently re-introduces the folding whenever a doc travels
+# through two differently-configured instances.
+_YAML_DUMP_WIDTH = 4096
+
+
 def _load_yaml_with_comments(path: Path) -> tuple[Any, str]:
     """Load a YAML file via ruamel preserving comments. Returns (doc, raw_text).
 
@@ -361,6 +373,7 @@ def _load_yaml_with_comments(path: Path) -> tuple[Any, str]:
     # Match the indentation style used in examples/providers.yaml so
     # lines we add line up with hand-written ones in unified diffs.
     yaml_rt.indent(mapping=2, sequence=4, offset=2)
+    yaml_rt.width = _YAML_DUMP_WIDTH
     doc = yaml_rt.load(io.StringIO(raw_text))
     return doc, raw_text
 
@@ -372,6 +385,7 @@ def _dump_yaml_with_comments(doc: Any) -> str:
     yaml_rt = YAML()
     yaml_rt.preserve_quotes = True
     yaml_rt.indent(mapping=2, sequence=4, offset=2)
+    yaml_rt.width = _YAML_DUMP_WIDTH
     out = io.StringIO()
     yaml_rt.dump(doc, out)
     return out.getvalue()
@@ -421,7 +435,10 @@ class ApplyResult:
     diffs
         Per-target unified-diff text. Empty string for a target that
         had only no-op merges. Indexed by str(path) for stable lookup
-        in tests / CLI rendering.
+        in tests / CLI rendering. Only ever non-empty for a target
+        whose merge actually changed something — a pure re-serialization
+        difference goes to ``reformat_only`` instead, so the diff an
+        operator reviews is exactly the diff of their intent.
     changes_applied
         Number of probe patches that produced a change. Zero means
         idempotent re-run.
@@ -434,6 +451,12 @@ class ApplyResult:
         True if at least one file was actually written to disk
         (``--apply`` mode). False for ``--dry-run`` and for cases
         where every patch was a no-op.
+    written_paths
+        The files actually written, in target order. Empty in dry-run
+        mode and on a no-op run. Distinct from ``backups`` because a
+        freshly-created file (user-side model-capabilities.yaml) is
+        written without a backup — the CLI needs the true count for its
+        "N file(s) written" line.
     backups
         Map of original-path → backup-path for every file that was
         written. Empty in dry-run mode.
@@ -442,6 +465,18 @@ class ApplyResult:
         Currently empty (we cover all known target_file values), but
         kept for forward-compat: if a future probe emits a new
         target_file value, we should report it without crashing.
+    reformat_only
+        Per-target unified diff of a *cosmetic* delta — the file
+        re-serializes differently from what is on disk even though no
+        patch changed a value. Purely informational: these bytes are
+        NEVER written (see the ``changed_by_path`` gate in
+        :func:`apply_doctor_patches`), because writing them would
+        silently rewrite an untouched file and, on the next real
+        ``--apply``, hand ``.bak`` a copy that is no longer the
+        operator's original. Surfaced in ``--dry-run`` only, as a
+        heads-up that the file uses a style ruamel does not reproduce
+        byte-for-byte (today: explicit ``key: null``, which ruamel
+        re-emits as an empty scalar).
     """
 
     target_paths: list[Path]
@@ -451,6 +486,8 @@ class ApplyResult:
     written: bool
     backups: dict[str, str] = field(default_factory=dict)
     skipped_unknown_target: list[str] = field(default_factory=list)
+    reformat_only: dict[str, str] = field(default_factory=dict)
+    written_paths: list[str] = field(default_factory=list)
 
     @property
     def is_no_op(self) -> bool:
@@ -502,6 +539,11 @@ def apply_doctor_patches(
     The per-target merge keeps a single in-memory doc per file so two
     probes targeting the same file compose into one final diff.
 
+    A file is written **only** when at least one patch targeting it
+    reported ``changed=True``. A re-dump that differs from disk for
+    purely cosmetic reasons is never written; it is reported through
+    ``ApplyResult.reformat_only`` instead.
+
     ``user_capabilities_path`` is a test-only injection point — leave
     None in production to use the standard
     ``~/.coderouter/model-capabilities.yaml`` resolution.
@@ -513,7 +555,18 @@ def apply_doctor_patches(
 
     docs_by_path: dict[Path, tuple[Any, str]] = {}
     diffs: dict[str, str] = {}
+    reformat_only: dict[str, str] = {}
     target_order: list[Path] = []
+    # Per-target "did any merge actually change a value?". This — NOT
+    # "does the re-dump differ from the bytes on disk" — is what gates
+    # the write below. The two used to be conflated, and any file whose
+    # style ruamel does not reproduce verbatim (an explicit
+    # ``api_key_env: null``, a >80-column quoted scalar) was silently
+    # rewritten on a run that reported "0 changes applied". The next
+    # real ``--apply`` then copied that already-reformatted file into
+    # ``.bak``, so the operator's pristine original no longer existed
+    # anywhere.
+    changed_by_path: dict[Path, bool] = {}
     changes_applied = 0
     no_op_patches = 0
     skipped: list[str] = []
@@ -552,6 +605,7 @@ def apply_doctor_patches(
                 before_text = ""
             docs_by_path[target_path] = (doc, before_text)
             target_order.append(target_path)
+            changed_by_path[target_path] = False
 
         doc, _ = docs_by_path[target_path]
 
@@ -575,11 +629,13 @@ def apply_doctor_patches(
 
         if changed:
             changes_applied += 1
+            changed_by_path[target_path] = True
         else:
             no_op_patches += 1
 
     # Render diffs and write (or just report).
     written = False
+    written_paths: list[str] = []
     backups: dict[str, str] = {}
     for target_path in target_order:
         doc, before_text = docs_by_path[target_path]
@@ -587,8 +643,18 @@ def apply_doctor_patches(
         diff_text = render_unified_diff(
             before=before_text, after=after_text, path=target_path
         )
-        diffs[str(target_path)] = diff_text
-        if write and diff_text:
+        target_changed = changed_by_path.get(target_path, False)
+        if target_changed:
+            diffs[str(target_path)] = diff_text
+        else:
+            # Nothing semantic changed. Whatever ``diff_text`` holds is
+            # pure re-serialization noise; keep it out of ``diffs`` (so
+            # the CLI's "here is what will change" section stays honest)
+            # and park it in ``reformat_only`` for the dry-run notice.
+            diffs[str(target_path)] = ""
+            if diff_text:
+                reformat_only[str(target_path)] = diff_text
+        if write and target_changed:
             # Backup first (only when we have a pre-existing file).
             if target_path.is_file():
                 backup_path = target_path.with_suffix(
@@ -600,6 +666,7 @@ def apply_doctor_patches(
                 target_path.parent.mkdir(parents=True, exist_ok=True)
             target_path.write_text(after_text, encoding="utf-8")
             written = True
+            written_paths.append(str(target_path))
 
     return ApplyResult(
         target_paths=target_order,
@@ -609,4 +676,6 @@ def apply_doctor_patches(
         written=written,
         backups=backups,
         skipped_unknown_target=skipped,
+        reformat_only=reformat_only,
+        written_paths=written_paths,
     )

coderouter/gguf_introspect.py

@@ -34,7 +34,19 @@ The parser treats the file as **untrusted input**:
     :data:`_MAX_STR_BYTES` / :data:`_MAX_ARRAY_LEN` so a corrupt or
     hostile header cannot trigger a multi-GB allocation (DoS).
   * Reads past EOF raise :class:`GGUFParseError`, never an unbounded
-    loop.
+    loop. This includes ``seek`` past EOF: every skip (array element
+    count x element size, or a lone scalar) is checked against the
+    file's actual size *before* the seek happens, so a truncated file
+    that declares a huge array count fails fast instead of spinning a
+    multi-million-iteration loop over bytes that were never written.
+  * Array nesting depth is capped at :data:`_MAX_ARRAY_DEPTH`. Skipping
+    a value uses an explicit work-stack (``_skip_value``), not Python
+    recursion, so there is no ``RecursionError`` failure mode to begin
+    with — the depth cap is a belt-and-suspenders DoS guard (a
+    pathological file can otherwise spend 12 bytes per nesting level to
+    force millions of stack-machine iterations), not a stack-overflow
+    guard. Every llama.cpp-written GGUF array (tokenizer tokens/scores/
+    merges, etc.) nests exactly one level deep.
   * No ``mmap``, no tensor payload read, no code execution path — we
     only seek/read a small prefix.
 """
@@ -86,6 +98,16 @@ _SCALAR: dict[int, tuple[str, int]] = {
 _MAX_STR_BYTES: int = 1 << 20  # 1 MiB key/value string ceiling
 _MAX_ARRAY_LEN: int = 1 << 24  # element-count ceiling for arrays
 _MAX_KV_PAIRS: int = 1 << 20  # metadata pair ceiling
+# Array-of-array nesting ceiling. Every array we've ever seen llama.cpp
+# emit (tokenizer.ggml.tokens / token_type / scores / merges, ...) nests
+# exactly one level deep, and this repo's synthetic test fixtures never
+# exceed that either — real headers are nowhere near this limit. It exists
+# purely as a DoS guard: each extra nesting level costs an attacker only
+# 12 bytes (elem_type u32 + count u64), so an unbounded depth lets a
+# ~12 KiB file blow the interpreter's C stack. ``_skip_value`` walks an
+# explicit work-stack rather than recursing, so this cap is enforced
+# directly (no reliance on hitting Python's recursion limit).
+_MAX_ARRAY_DEPTH: int = 8
 
 # Human-readable names for the GGUF ``general.file_type`` enum (subset).
 _FILE_TYPE_NAMES: dict[int, str] = {
@@ -197,31 +219,97 @@ def _read_gguf_string(fh: BinaryIO) -> str:
     return _read_exact(fh, length).decode("utf-8", errors="replace")
 
 
-def _skip_value(fh: BinaryIO, type_tag: int) -> None:
-    """Consume a metadata value of ``type_tag`` without retaining it."""
-    if type_tag == _GGUF_TYPE_STRING:
-        _read_gguf_string(fh)
-        return
-    if type_tag == _GGUF_TYPE_ARRAY:
-        elem_type = _read_u32(fh)
-        count = _read_u64(fh)
-        if count > _MAX_ARRAY_LEN:
-            raise GGUFParseError(f"array length {count} exceeds cap")
-        for _ in range(count):
-            _skip_value(fh, elem_type)
-        return
-    fmt_size = _SCALAR.get(type_tag)
-    if fmt_size is None:
-        raise GGUFParseError(f"unknown value type tag {type_tag}")
-    fh.seek(fmt_size[1], 1)  # skip scalar bytes
-
+def _seek_checked(fh: BinaryIO, nbytes: int, file_size: int) -> None:
+    """Skip ``nbytes`` forward, refusing to seek past the file's real end.
 
-def _read_scalar_value(fh: BinaryIO, type_tag: int) -> object:
+    ``seek`` never fails on a plain file even when the target offset is
+    past EOF — the OS happily "succeeds" and a subsequent read just
+    returns fewer bytes than expected. That silence is what let a
+    49-byte file with a declared 16M-element array parse "successfully"
+    (see module docstring). Checking the target offset against the
+    ``file_size`` captured once via ``stat()`` at the top of
+    :func:`read_gguf_metadata` turns that into an immediate, cheap
+    :class:`GGUFParseError` instead of either an unbounded loop or a
+    silently-wrong result.
+    """
+    pos = fh.tell()
+    if pos + nbytes > file_size:
+        raise GGUFParseError(
+            f"value extends past EOF (offset {pos} + {nbytes} bytes "
+            f"> file size {file_size})"
+        )
+    fh.seek(nbytes, 1)
+
+
+def _skip_value(fh: BinaryIO, type_tag: int, file_size: int, *, depth: int = 0) -> None:
+    """Consume a metadata value of ``type_tag`` without retaining it.
+
+    Iterative (explicit work-stack), not recursive: a metadata value can
+    be an array of arrays, and a corrupt/hostile file can nest that
+    arbitrarily deep for only 12 bytes per level (``elem_type`` u32 +
+    ``count`` u64). Recursing one Python frame per level let a
+    ~12 KiB file blow the interpreter's stack with an uncaught
+    ``RecursionError`` (see module docstring) — the C-level exception
+    that walks straight through :class:`GGUFParseError`'s ``except``
+    clauses. Doing the walk with a stack of ``(type_tag, remaining,
+    depth)`` frames instead makes ``RecursionError`` structurally
+    impossible here, and :data:`_MAX_ARRAY_DEPTH` still bounds how deep
+    a legitimate-looking nested array is allowed to go (DoS guard,
+    independent of the recursion fix).
+
+    Arrays of fixed-width scalars (the common case: token ids, scores,
+    ``token_type``, ...) are skipped with a single bounds-checked
+    ``seek`` for the whole array rather than one iteration per element —
+    this is what turns an 8s parse of a 150K-element array into a
+    sub-millisecond one.
+    """
+    # Each frame: (type_tag_to_process, how_many_times_left, nesting_depth).
+    stack: list[tuple[int, int, int]] = [(type_tag, 1, depth)]
+    while stack:
+        tag, remaining, d = stack.pop()
+        if remaining > 1:
+            stack.append((tag, remaining - 1, d))
+
+        if tag == _GGUF_TYPE_STRING:
+            _read_gguf_string(fh)
+            continue
+
+        if tag == _GGUF_TYPE_ARRAY:
+            if d >= _MAX_ARRAY_DEPTH:
+                raise GGUFParseError(
+                    f"array nesting depth exceeds cap ({_MAX_ARRAY_DEPTH}); "
+                    "refusing to descend further"
+                )
+            elem_type = _read_u32(fh)
+            count = _read_u64(fh)
+            if count > _MAX_ARRAY_LEN:
+                raise GGUFParseError(f"array length {count} exceeds cap")
+            fmt_size = _SCALAR.get(elem_type)
+            if fmt_size is not None:
+                # Fixed-width elements: one bounds-checked bulk seek,
+                # not a per-element loop.
+                _seek_checked(fh, count * fmt_size[1], file_size)
+            elif elem_type in (_GGUF_TYPE_STRING, _GGUF_TYPE_ARRAY):
+                if count > 0:
+                    stack.append((elem_type, count, d + 1))
+            else:
+                raise GGUFParseError(f"unknown value type tag {elem_type}")
+            continue
+
+        # Lone scalar (only reachable if _skip_value is ever invoked
+        # directly on a scalar type_tag; kept for defense in depth).
+        fmt_size = _SCALAR.get(tag)
+        if fmt_size is None:
+            raise GGUFParseError(f"unknown value type tag {tag}")
+        _seek_checked(fh, fmt_size[1], file_size)
+
+
+def _read_scalar_value(fh: BinaryIO, type_tag: int, file_size: int) -> object:
     """Read (and return) a value, skipping arrays/strings we don't need."""
     if type_tag == _GGUF_TYPE_STRING:
         return _read_gguf_string(fh)
     if type_tag == _GGUF_TYPE_ARRAY:
-        _skip_value(fh, type_tag)
+        _skip_value(fh, type_tag, file_size)
         return None
     return _read_scalar(fh, type_tag)
 
@@ -262,7 +350,16 @@ def read_gguf_metadata(path: str | Path) -> GGUFInfo:
     file_type: int | None = None
     n_nextn: int | None = None
 
-    with p.open("rb") as fh:
+    try:
+        fh = p.open("rb")
+    except OSError as exc:
+        # TOCTOU: the file can vanish (or become unreadable) between the
+        # stat() above and this open() — e.g. a concurrent model-directory
+        # scan racing a download/cleanup. Convert to GGUFParseError so
+        # callers only need to catch one exception type.
+        raise GGUFParseError(f"cannot open {path}: {exc}") from exc
+
+    with fh:
         magic = fh.read(4)
         if magic != _GGUF_MAGIC:
             raise GGUFParseError(f"bad magic {magic!r} (not a GGUF file)")
@@ -277,7 +374,7 @@ def read_gguf_metadata(path: str | Path) -> GGUFInfo:
         for _ in range(kv_count):
             key = _read_gguf_string(fh)
             value_type = _read_u32(fh)
-            value = _read_scalar_value(fh, value_type)
+            value = _read_scalar_value(fh, value_type, file_size)
 
             if key == "general.architecture" and isinstance(value, str):
                 arch = value
@@ -308,10 +405,20 @@ def read_gguf_metadata(path: str | Path) -> GGUFInfo:
 
 def try_read_gguf_metadata(path: str | Path) -> GGUFInfo | None:
     """Like :func:`read_gguf_metadata` but returns None on any parse
-    failure — convenient for best-effort advisory paths."""
+    failure — convenient for best-effort advisory paths.
+
+    Catches ``OSError`` in addition to :class:`GGUFParseError` because a
+    TOCTOU race can still surface a raw ``OSError`` from ``open()`` in
+    principle, and ``RecursionError`` / ``MemoryError`` as defense in
+    depth: with the iterative :func:`_skip_value` walk and the depth cap
+    above, neither should actually be reachable from this module
+    anymore, but a caller in a best-effort advisory path (e.g. scanning
+    every ``.gguf`` in a model directory) should never be taken down by
+    one regardless.
+    """
     try:
         return read_gguf_metadata(path)
-    except GGUFParseError:
+    except (GGUFParseError, OSError, RecursionError, MemoryError):
         return None
 
 

coderouter/guards/drift_detection.py

@@ -260,7 +260,19 @@ def detect_drift(
             mild_flags.append(f"tool_silence_rate={tool_silence_rate:.2f}")
 
     # --- Signal 4: Stop reason anomaly rate ---
-    _EXPECTED_STOP = {"end_turn", "tool_use", "max_tokens"}
+    # H-6: `stop_sequence` (a normal, expected terminator when the caller
+    # configures a stop sequence) was missing here, so every stop-sequence
+    # terminated response counted as an anomaly. `pause_turn` and `refusal`
+    # are legitimate Anthropic stop reasons too (see translation/anthropic.py
+    # for the forward-compat rationale) and are expected, not anomalous.
+    _EXPECTED_STOP = {
+        "end_turn",
+        "tool_use",
+        "max_tokens",
+        "stop_sequence",
+        "pause_turn",
+        "refusal",
+    }
     non_error_obs = [obs for obs in window if not obs.is_error]
     if non_error_obs:
         anomaly_count = sum(