coderouter-cli 2.11.0__py3-none-any.whl → 2.11.1__py3-none-any.whl

coderouter/doctor_apply.py

@@ -332,6 +332,18 @@ def merge_capabilities_rule_into_doc(doc: Any, patch_dict: dict[str, Any]) -> bo
 # ---------------------------------------------------------------------------
 
 
+# ruamel's emitter defaults to folding at 80 columns: any quoted scalar
+# longer than that gets wrapped onto a continuation line on dump, even
+# when the operator never touched it. That reformat is invisible to the
+# "did the merge change anything?" bookkeeping, so it used to leak into
+# the written file (and from there into the ``.bak`` on the *next* run,
+# destroying the only pristine copy). Applied on BOTH the load and the
+# dump side — ruamel stores the width on the instance, and an asymmetric
+# setting silently re-introduces the folding whenever a doc travels
+# through two differently-configured instances.
+_YAML_DUMP_WIDTH = 4096
+
+
 def _load_yaml_with_comments(path: Path) -> tuple[Any, str]:
     """Load a YAML file via ruamel preserving comments. Returns (doc, raw_text).
 
@@ -361,6 +373,7 @@ def _load_yaml_with_comments(path: Path) -> tuple[Any, str]:
     # Match the indentation style used in examples/providers.yaml so
     # lines we add line up with hand-written ones in unified diffs.
     yaml_rt.indent(mapping=2, sequence=4, offset=2)
+    yaml_rt.width = _YAML_DUMP_WIDTH
     doc = yaml_rt.load(io.StringIO(raw_text))
     return doc, raw_text
 
@@ -372,6 +385,7 @@ def _dump_yaml_with_comments(doc: Any) -> str:
     yaml_rt = YAML()
     yaml_rt.preserve_quotes = True
     yaml_rt.indent(mapping=2, sequence=4, offset=2)
+    yaml_rt.width = _YAML_DUMP_WIDTH
     out = io.StringIO()
     yaml_rt.dump(doc, out)
     return out.getvalue()
@@ -421,7 +435,10 @@ class ApplyResult:
     diffs
         Per-target unified-diff text. Empty string for a target that
         had only no-op merges. Indexed by str(path) for stable lookup
-        in tests / CLI rendering.
+        in tests / CLI rendering. Only ever non-empty for a target
+        whose merge actually changed something — a pure re-serialization
+        difference goes to ``reformat_only`` instead, so the diff an
+        operator reviews is exactly the diff of their intent.
     changes_applied
         Number of probe patches that produced a change. Zero means
         idempotent re-run.
@@ -434,6 +451,12 @@ class ApplyResult:
         True if at least one file was actually written to disk
         (``--apply`` mode). False for ``--dry-run`` and for cases
         where every patch was a no-op.
+    written_paths
+        The files actually written, in target order. Empty in dry-run
+        mode and on a no-op run. Distinct from ``backups`` because a
+        freshly-created file (user-side model-capabilities.yaml) is
+        written without a backup — the CLI needs the true count for its
+        "N file(s) written" line.
     backups
         Map of original-path → backup-path for every file that was
         written. Empty in dry-run mode.
@@ -442,6 +465,18 @@ class ApplyResult:
         Currently empty (we cover all known target_file values), but
         kept for forward-compat: if a future probe emits a new
         target_file value, we should report it without crashing.
+    reformat_only
+        Per-target unified diff of a *cosmetic* delta — the file
+        re-serializes differently from what is on disk even though no
+        patch changed a value. Purely informational: these bytes are
+        NEVER written (see the ``changed_by_path`` gate in
+        :func:`apply_doctor_patches`), because writing them would
+        silently rewrite an untouched file and, on the next real
+        ``--apply``, hand ``.bak`` a copy that is no longer the
+        operator's original. Surfaced in ``--dry-run`` only, as a
+        heads-up that the file uses a style ruamel does not reproduce
+        byte-for-byte (today: explicit ``key: null``, which ruamel
+        re-emits as an empty scalar).
     """
 
     target_paths: list[Path]
@@ -451,6 +486,8 @@ class ApplyResult:
     written: bool
     backups: dict[str, str] = field(default_factory=dict)
     skipped_unknown_target: list[str] = field(default_factory=list)
+    reformat_only: dict[str, str] = field(default_factory=dict)
+    written_paths: list[str] = field(default_factory=list)
 
     @property
     def is_no_op(self) -> bool:
@@ -502,6 +539,11 @@ def apply_doctor_patches(
     The per-target merge keeps a single in-memory doc per file so two
     probes targeting the same file compose into one final diff.
 
+    A file is written **only** when at least one patch targeting it
+    reported ``changed=True``. A re-dump that differs from disk for
+    purely cosmetic reasons is never written; it is reported through
+    ``ApplyResult.reformat_only`` instead.
+
     ``user_capabilities_path`` is a test-only injection point — leave
     None in production to use the standard
     ``~/.coderouter/model-capabilities.yaml`` resolution.
@@ -513,7 +555,18 @@ def apply_doctor_patches(
 
     docs_by_path: dict[Path, tuple[Any, str]] = {}
     diffs: dict[str, str] = {}
+    reformat_only: dict[str, str] = {}
     target_order: list[Path] = []
+    # Per-target "did any merge actually change a value?". This — NOT
+    # "does the re-dump differ from the bytes on disk" — is what gates
+    # the write below. The two used to be conflated, and any file whose
+    # style ruamel does not reproduce verbatim (an explicit
+    # ``api_key_env: null``, a >80-column quoted scalar) was silently
+    # rewritten on a run that reported "0 changes applied". The next
+    # real ``--apply`` then copied that already-reformatted file into
+    # ``.bak``, so the operator's pristine original no longer existed
+    # anywhere.
+    changed_by_path: dict[Path, bool] = {}
     changes_applied = 0
     no_op_patches = 0
     skipped: list[str] = []
@@ -552,6 +605,7 @@ def apply_doctor_patches(
                 before_text = ""
             docs_by_path[target_path] = (doc, before_text)
             target_order.append(target_path)
+            changed_by_path[target_path] = False
 
         doc, _ = docs_by_path[target_path]
 
@@ -575,11 +629,13 @@ def apply_doctor_patches(
 
         if changed:
             changes_applied += 1
+            changed_by_path[target_path] = True
         else:
             no_op_patches += 1
 
     # Render diffs and write (or just report).
     written = False
+    written_paths: list[str] = []
     backups: dict[str, str] = {}
     for target_path in target_order:
         doc, before_text = docs_by_path[target_path]
@@ -587,8 +643,18 @@ def apply_doctor_patches(
         diff_text = render_unified_diff(
             before=before_text, after=after_text, path=target_path
         )
-        diffs[str(target_path)] = diff_text
-        if write and diff_text:
+        target_changed = changed_by_path.get(target_path, False)
+        if target_changed:
+            diffs[str(target_path)] = diff_text
+        else:
+            # Nothing semantic changed. Whatever ``diff_text`` holds is
+            # pure re-serialization noise; keep it out of ``diffs`` (so
+            # the CLI's "here is what will change" section stays honest)
+            # and park it in ``reformat_only`` for the dry-run notice.
+            diffs[str(target_path)] = ""
+            if diff_text:
+                reformat_only[str(target_path)] = diff_text
+        if write and target_changed:
             # Backup first (only when we have a pre-existing file).
             if target_path.is_file():
                 backup_path = target_path.with_suffix(
@@ -600,6 +666,7 @@ def apply_doctor_patches(
                 target_path.parent.mkdir(parents=True, exist_ok=True)
             target_path.write_text(after_text, encoding="utf-8")
             written = True
+            written_paths.append(str(target_path))
 
     return ApplyResult(
         target_paths=target_order,
@@ -609,4 +676,6 @@ def apply_doctor_patches(
         written=written,
         backups=backups,
         skipped_unknown_target=skipped,
+        reformat_only=reformat_only,
+        written_paths=written_paths,
     )

coderouter/gguf_introspect.py

@@ -34,7 +34,19 @@ The parser treats the file as **untrusted input**:
     :data:`_MAX_STR_BYTES` / :data:`_MAX_ARRAY_LEN` so a corrupt or
     hostile header cannot trigger a multi-GB allocation (DoS).
   * Reads past EOF raise :class:`GGUFParseError`, never an unbounded
-    loop.
+    loop. This includes ``seek`` past EOF: every skip (array element
+    count x element size, or a lone scalar) is checked against the
+    file's actual size *before* the seek happens, so a truncated file
+    that declares a huge array count fails fast instead of spinning a
+    multi-million-iteration loop over bytes that were never written.
+  * Array nesting depth is capped at :data:`_MAX_ARRAY_DEPTH`. Skipping
+    a value uses an explicit work-stack (``_skip_value``), not Python
+    recursion, so there is no ``RecursionError`` failure mode to begin
+    with — the depth cap is a belt-and-suspenders DoS guard (a
+    pathological file can otherwise spend 12 bytes per nesting level to
+    force millions of stack-machine iterations), not a stack-overflow
+    guard. Every llama.cpp-written GGUF array (tokenizer tokens/scores/
+    merges, etc.) nests exactly one level deep.
   * No ``mmap``, no tensor payload read, no code execution path — we
     only seek/read a small prefix.
 """
@@ -86,6 +98,16 @@ _SCALAR: dict[int, tuple[str, int]] = {
 _MAX_STR_BYTES: int = 1 << 20  # 1 MiB key/value string ceiling
 _MAX_ARRAY_LEN: int = 1 << 24  # element-count ceiling for arrays
 _MAX_KV_PAIRS: int = 1 << 20  # metadata pair ceiling
+# Array-of-array nesting ceiling. Every array we've ever seen llama.cpp
+# emit (tokenizer.ggml.tokens / token_type / scores / merges, ...) nests
+# exactly one level deep, and this repo's synthetic test fixtures never
+# exceed that either — real headers are nowhere near this limit. It exists
+# purely as a DoS guard: each extra nesting level costs an attacker only
+# 12 bytes (elem_type u32 + count u64), so an unbounded depth lets a
+# ~12 KiB file blow the interpreter's C stack. ``_skip_value`` walks an
+# explicit work-stack rather than recursing, so this cap is enforced
+# directly (no reliance on hitting Python's recursion limit).
+_MAX_ARRAY_DEPTH: int = 8
 
 # Human-readable names for the GGUF ``general.file_type`` enum (subset).
 _FILE_TYPE_NAMES: dict[int, str] = {
@@ -197,31 +219,97 @@ def _read_gguf_string(fh: BinaryIO) -> str:
     return _read_exact(fh, length).decode("utf-8", errors="replace")
 
 
-def _skip_value(fh: BinaryIO, type_tag: int) -> None:
-    """Consume a metadata value of ``type_tag`` without retaining it."""
-    if type_tag == _GGUF_TYPE_STRING:
-        _read_gguf_string(fh)
-        return
-    if type_tag == _GGUF_TYPE_ARRAY:
-        elem_type = _read_u32(fh)
-        count = _read_u64(fh)
-        if count > _MAX_ARRAY_LEN:
-            raise GGUFParseError(f"array length {count} exceeds cap")
-        for _ in range(count):
-            _skip_value(fh, elem_type)
-        return
-    fmt_size = _SCALAR.get(type_tag)
-    if fmt_size is None:
-        raise GGUFParseError(f"unknown value type tag {type_tag}")
-    fh.seek(fmt_size[1], 1)  # skip scalar bytes
-
+def _seek_checked(fh: BinaryIO, nbytes: int, file_size: int) -> None:
+    """Skip ``nbytes`` forward, refusing to seek past the file's real end.
 
-def _read_scalar_value(fh: BinaryIO, type_tag: int) -> object:
+    ``seek`` never fails on a plain file even when the target offset is
+    past EOF — the OS happily "succeeds" and a subsequent read just
+    returns fewer bytes than expected. That silence is what let a
+    49-byte file with a declared 16M-element array parse "successfully"
+    (see module docstring). Checking the target offset against the
+    ``file_size`` captured once via ``stat()`` at the top of
+    :func:`read_gguf_metadata` turns that into an immediate, cheap
+    :class:`GGUFParseError` instead of either an unbounded loop or a
+    silently-wrong result.
+    """
+    pos = fh.tell()
+    if pos + nbytes > file_size:
+        raise GGUFParseError(
+            f"value extends past EOF (offset {pos} + {nbytes} bytes "
+            f"> file size {file_size})"
+        )
+    fh.seek(nbytes, 1)
+
+
+def _skip_value(fh: BinaryIO, type_tag: int, file_size: int, *, depth: int = 0) -> None:
+    """Consume a metadata value of ``type_tag`` without retaining it.
+
+    Iterative (explicit work-stack), not recursive: a metadata value can
+    be an array of arrays, and a corrupt/hostile file can nest that
+    arbitrarily deep for only 12 bytes per level (``elem_type`` u32 +
+    ``count`` u64). Recursing one Python frame per level let a
+    ~12 KiB file blow the interpreter's stack with an uncaught
+    ``RecursionError`` (see module docstring) — the C-level exception
+    that walks straight through :class:`GGUFParseError`'s ``except``
+    clauses. Doing the walk with a stack of ``(type_tag, remaining,
+    depth)`` frames instead makes ``RecursionError`` structurally
+    impossible here, and :data:`_MAX_ARRAY_DEPTH` still bounds how deep
+    a legitimate-looking nested array is allowed to go (DoS guard,
+    independent of the recursion fix).
+
+    Arrays of fixed-width scalars (the common case: token ids, scores,
+    ``token_type``, ...) are skipped with a single bounds-checked
+    ``seek`` for the whole array rather than one iteration per element —
+    this is what turns an 8s parse of a 150K-element array into a
+    sub-millisecond one.
+    """
+    # Each frame: (type_tag_to_process, how_many_times_left, nesting_depth).
+    stack: list[tuple[int, int, int]] = [(type_tag, 1, depth)]
+    while stack:
+        tag, remaining, d = stack.pop()
+        if remaining > 1:
+            stack.append((tag, remaining - 1, d))
+
+        if tag == _GGUF_TYPE_STRING:
+            _read_gguf_string(fh)
+            continue
+
+        if tag == _GGUF_TYPE_ARRAY:
+            if d >= _MAX_ARRAY_DEPTH:
+                raise GGUFParseError(
+                    f"array nesting depth exceeds cap ({_MAX_ARRAY_DEPTH}); "
+                    "refusing to descend further"
+                )
+            elem_type = _read_u32(fh)
+            count = _read_u64(fh)
+            if count > _MAX_ARRAY_LEN:
+                raise GGUFParseError(f"array length {count} exceeds cap")
+            fmt_size = _SCALAR.get(elem_type)
+            if fmt_size is not None:
+                # Fixed-width elements: one bounds-checked bulk seek,
+                # not a per-element loop.
+                _seek_checked(fh, count * fmt_size[1], file_size)
+            elif elem_type in (_GGUF_TYPE_STRING, _GGUF_TYPE_ARRAY):
+                if count > 0:
+                    stack.append((elem_type, count, d + 1))
+            else:
+                raise GGUFParseError(f"unknown value type tag {elem_type}")
+            continue
+
+        # Lone scalar (only reachable if _skip_value is ever invoked
+        # directly on a scalar type_tag; kept for defense in depth).
+        fmt_size = _SCALAR.get(tag)
+        if fmt_size is None:
+            raise GGUFParseError(f"unknown value type tag {tag}")
+        _seek_checked(fh, fmt_size[1], file_size)
+
+
+def _read_scalar_value(fh: BinaryIO, type_tag: int, file_size: int) -> object:
     """Read (and return) a value, skipping arrays/strings we don't need."""
     if type_tag == _GGUF_TYPE_STRING:
         return _read_gguf_string(fh)
     if type_tag == _GGUF_TYPE_ARRAY:
-        _skip_value(fh, type_tag)
+        _skip_value(fh, type_tag, file_size)
         return None
     return _read_scalar(fh, type_tag)
 
@@ -262,7 +350,16 @@ def read_gguf_metadata(path: str | Path) -> GGUFInfo:
     file_type: int | None = None
     n_nextn: int | None = None
 
-    with p.open("rb") as fh:
+    try:
+        fh = p.open("rb")
+    except OSError as exc:
+        # TOCTOU: the file can vanish (or become unreadable) between the
+        # stat() above and this open() — e.g. a concurrent model-directory
+        # scan racing a download/cleanup. Convert to GGUFParseError so
+        # callers only need to catch one exception type.
+        raise GGUFParseError(f"cannot open {path}: {exc}") from exc
+
+    with fh:
         magic = fh.read(4)
         if magic != _GGUF_MAGIC:
             raise GGUFParseError(f"bad magic {magic!r} (not a GGUF file)")
@@ -277,7 +374,7 @@ def read_gguf_metadata(path: str | Path) -> GGUFInfo:
         for _ in range(kv_count):
             key = _read_gguf_string(fh)
             value_type = _read_u32(fh)
-            value = _read_scalar_value(fh, value_type)
+            value = _read_scalar_value(fh, value_type, file_size)
 
             if key == "general.architecture" and isinstance(value, str):
                 arch = value
@@ -308,10 +405,20 @@ def read_gguf_metadata(path: str | Path) -> GGUFInfo:
 
 def try_read_gguf_metadata(path: str | Path) -> GGUFInfo | None:
     """Like :func:`read_gguf_metadata` but returns None on any parse
-    failure — convenient for best-effort advisory paths."""
+    failure — convenient for best-effort advisory paths.
+
+    Catches ``OSError`` in addition to :class:`GGUFParseError` because a
+    TOCTOU race can still surface a raw ``OSError`` from ``open()`` in
+    principle, and ``RecursionError`` / ``MemoryError`` as defense in
+    depth: with the iterative :func:`_skip_value` walk and the depth cap
+    above, neither should actually be reachable from this module
+    anymore, but a caller in a best-effort advisory path (e.g. scanning
+    every ``.gguf`` in a model directory) should never be taken down by
+    one regardless.
+    """
     try:
         return read_gguf_metadata(path)
-    except GGUFParseError:
+    except (GGUFParseError, OSError, RecursionError, MemoryError):
         return None
 
 

coderouter/guards/drift_detection.py

@@ -260,7 +260,19 @@ def detect_drift(
             mild_flags.append(f"tool_silence_rate={tool_silence_rate:.2f}")
 
     # --- Signal 4: Stop reason anomaly rate ---
-    _EXPECTED_STOP = {"end_turn", "tool_use", "max_tokens"}
+    # H-6: `stop_sequence` (a normal, expected terminator when the caller
+    # configures a stop sequence) was missing here, so every stop-sequence
+    # terminated response counted as an anomaly. `pause_turn` and `refusal`
+    # are legitimate Anthropic stop reasons too (see translation/anthropic.py
+    # for the forward-compat rationale) and are expected, not anomalous.
+    _EXPECTED_STOP = {
+        "end_turn",
+        "tool_use",
+        "max_tokens",
+        "stop_sequence",
+        "pause_turn",
+        "refusal",
+    }
     non_error_obs = [obs for obs in window if not obs.is_error]
     if non_error_obs:
         anomaly_count = sum(

coderouter/ingress/launcher_routes.py

@@ -51,6 +51,7 @@ from coderouter.launcher_devices import (
     build_auto_sweep_configs,
     build_sweep_steps,
     detect_llama_devices,
+    foreign_device_ids,
     group_by_backend,
     is_port_free,
     load_latest_results,
@@ -58,7 +59,6 @@ from coderouter.launcher_devices import (
     resolve_option_profiles,
     selectable_devices,
     suggest_tensor_split,
-    unknown_device_ids,
     variant_of,
 )
 from coderouter.launcher_speculative import resolve_speculative
@@ -1561,14 +1561,14 @@ async def _assert_device_ids_known(
     前に弾く。
 
     ``--list-devices`` 自体が失敗した環境では検証をスキップする
-    (:func:`unknown_device_ids` の best-effort 契約)。
+    (:func:`foreign_device_ids` の best-effort 契約)。
     """
     if not device_ids:
         return
     configured = _configured_binary_for(launcher_cfg, backend)
     binary = _resolve_binary(backend, configured)
     probe = await asyncio.to_thread(detect_llama_devices, binary)
-    unknown = unknown_device_ids(list(device_ids), probe)
+    unknown = foreign_device_ids(list(device_ids), probe)
     if unknown:
         known = [d.id for d in probe.devices]
         raise HTTPException(

coderouter/launcher_devices.py

@@ -43,6 +43,7 @@ __all__ = [
     "build_cross_variant_sweep_configs",
     "build_sweep_steps",
     "detect_llama_devices",
+    "foreign_device_ids",
     "group_by_backend",
     "is_port_free",
     "is_valid_backend_name",
@@ -55,7 +56,6 @@ __all__ = [
     "selectable_devices",
     "suggest_tensor_split",
     "summarize_results",
-    "unknown_device_ids",
     "variant_of",
 ]
 
@@ -369,22 +369,34 @@ class DeviceSelection:
         return args
 
 
-def unknown_device_ids(device_ids: Sequence[str], probe: DeviceProbe) -> list[str]:
-    """``device_ids`` のうち ``probe`` に存在しないものを返す(空なら健全)。
+def foreign_device_ids(device_ids: Sequence[str], probe: DeviceProbe) -> list[str]:
+    """``device_ids`` のうち **別ビルドの名前空間**に属するものを返す。
 
     バックエンドバリアントを切り替えるとデバイス ID の名前空間も変わる
     (``CUDA0`` と ``Vulkan0`` は同じ GPU を指さない)。CUDA ビルドで
     ``CUDA0`` を選んだまま Vulkan ビルドで起動すると ``--device CUDA0`` が
     Vulkan ビルドに渡って起動失敗するので、spawn 前に弾くための判定。
 
-    ``probe.ok`` が False (``--list-devices`` 自体が失敗) のときは **常に空
-    リスト** を返す。デバイスを列挙できない環境で機能を殺さないための
-    best-effort 原則 (``hardware.py`` の 5-deps 不変則と同じ姿勢)。
+    判定は **id の完全一致ではなくバックエンド接頭辞** (:func:`backend_of` —
+    ``"CUDA0"`` → ``"CUDA"``) で行う。理由は 2 つある:
+
+    1. 検出したいのは「ビルド違い」= 名前空間そのものの不一致であって、
+       同一ビルド内の番号ズレではない。UI はチェックボックスから id を渡す
+       ので番号ズレは実際には起きない。
+    2. 完全一致にすると ``--list-devices`` の出力形式が将来変わって
+       :func:`parse_list_devices` が一部の行だけ取りこぼした場合に、**正しい
+       id を誤って拒否してしまう**。接頭辞単位なら 1 行でも同じ接頭辞が
+       拾えていれば通る。
+
+    ``probe.ok`` が False (``--list-devices`` 自体が失敗) のときと、デバイス
+    を 1 つも拾えなかったときは **常に空リスト** を返す。列挙できない環境で
+    機能を殺さないための best-effort 原則 (``hardware.py`` の 5-deps 不変則と
+    同じ姿勢)。
     """
-    if not probe.ok:
+    if not probe.ok or not probe.devices:
         return []
-    known = {d.id for d in probe.devices}
-    return [d for d in device_ids if d not in known]
+    known_prefixes = {backend_of(d.id) for d in probe.devices}
+    return [d for d in device_ids if backend_of(d) not in known_prefixes]
 
 
 # ---------------------------------------------------------------------------

coderouter/routing/fallback.py

@@ -2911,7 +2911,15 @@ class FallbackEngine:
                     chat_req = to_chat_request(effective_request)
                     chat_req.stream = False
                     chat_resp = await adapter.generate(chat_req, overrides=overrides)
-                    resp = to_anthropic_response(chat_resp, allowed_tool_names=tool_names)
+                    # H-4: the translation hop runs the tool-call repair
+                    # scanners over the whole assistant message. That is CPU
+                    # work, not I/O, so it is pushed onto a worker thread —
+                    # a pathological message must not stall the event loop
+                    # for every other in-flight request. `to_anthropic_response`
+                    # itself stays synchronous (many callers depend on it).
+                    resp = await asyncio.to_thread(
+                        to_anthropic_response, chat_resp, allowed_tool_names=tool_names
+                    )
             except AdapterError as exc:
                 # v1.9-C: record the failure with its observed latency.
                 # Auth-flavored failures (401 / 403) carry no useful
@@ -3223,7 +3231,11 @@ class FallbackEngine:
                     chat_req = to_chat_request(effective_request)
                     chat_req.stream = False
                     chat_resp = await adapter.generate(chat_req, overrides=overrides)
-                    anth_resp = to_anthropic_response(chat_resp, allowed_tool_names=tool_names)
+                    # H-4: same as the non-streaming branch — keep the
+                    # CPU-bound repair scan off the event loop.
+                    anth_resp = await asyncio.to_thread(
+                        to_anthropic_response, chat_resp, allowed_tool_names=tool_names
+                    )
                     event_iter = synthesize_anthropic_stream_from_response(anth_resp)
                     first = await anext(event_iter)
                 else:

coderouter/translation/anthropic.py

@@ -321,7 +321,20 @@ class AnthropicResponse(BaseModel):
     role: Literal["assistant"] = "assistant"
     model: str
     content: list[dict[str, Any]]
-    stop_reason: Literal["end_turn", "max_tokens", "stop_sequence", "tool_use"] | None = None
+    # H-6: intentionally `str | None`, NOT a closed `Literal[...]`. Anthropic
+    # adds new stop_reason values over time (observed additions: pause_turn
+    # for long-running server-side-tool turns, refusal for safety-classifier
+    # stops, model_context_window_exceeded); a closed Literal rejects any
+    # response using a value minted after this code was written, which
+    # pydantic surfaces as a ValidationError that the adapter turns into a
+    # retryable AdapterError — silently discarding an already-billed,
+    # perfectly valid response and falling back to another provider. Known
+    # values as of writing: end_turn, max_tokens, stop_sequence, tool_use,
+    # pause_turn, refusal, model_context_window_exceeded. Other models in
+    # this module already use `extra="allow"` for the same forward-
+    # compatibility reason; this keeps that policy consistent for a
+    # declared field, which `extra="allow"` alone does not cover.
+    stop_reason: str | None = None
     stop_sequence: str | None = None
     usage: AnthropicUsage = Field(default_factory=AnthropicUsage)
 

coderouter/translation/convert.py

@@ -846,6 +846,13 @@ _REVERSE_FINISH_REASON_MAP = {
     "max_tokens": "length",
     "tool_use": "tool_calls",
     "stop_sequence": "stop",
+    # H-6: forward-compat stop_reason values (see translation/anthropic.py).
+    # The `.get(..., "stop")` fallback at each call site already keeps these
+    # from raising; mapping them explicitly just makes the OpenAI-shaped
+    # finish_reason semantically accurate instead of a generic "stop".
+    "pause_turn": "stop",
+    "refusal": "content_filter",
+    "model_context_window_exceeded": "length",
 }