coderouter-cli 2.11.1__tar.gz → 2.11.2__tar.gz

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/.gitignore

@@ -9,6 +9,11 @@ secrets.env
 ~/.coderouter/
 CLAUDE.md
 
+# *.bak — pre-overwrite backups of the files above (e.g. `vscode-init --force`
+# saves `.envrc.bak` before clobbering `.envrc`; `doctor --apply` saves
+# `providers.yaml.bak`). Same secret-risk as the originals, so same rule.
+*.bak
+
 # ============================================================
 # Python
 # ============================================================

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/CHANGELOG.md

@@ -9,6 +9,95 @@ are kept verbatim where the Japanese text itself is the subject).
 
 ---
 
+## [v2.11.2] — 2026-08-04 (file-write safety and launcher event hygiene)
+
+Two fixes from the same review round as v2.11.1, split out because they
+rewrite `_atomic_write` and the launcher GUI's event plumbing and deserved
+their own rollback unit. **No breaking changes**: no config-schema field
+changed, no CLI flag changed meaning, `--force` still replaces `.envrc`.
+Existing `.vscode/settings.json` merge semantics are unchanged.
+
+### Fixed
+
+- **`vscode-init --force` destroyed `.envrc` with no way back.** The
+  command replaced the file outright — no merge, no backup — so a
+  hand-added `source_env_if_exists .envrc.local`, the very pattern
+  `docs/guides/vscode.md` recommends, vanished silently. direnv then
+  looked healthy while exporting nothing, which is a hard failure to
+  trace back to its cause. The conflict message said only "Re-run with
+  `--force` to overwrite" and never mentioned that the whole file goes.
+  The previous contents are now copied to `.envrc.bak` before the write,
+  the path is reported in the command's output, and the conflict message
+  spells out that this is a whole-file replacement rather than a merge.
+  `--dry-run` makes no backup. Only one generation is kept, so a second
+  `--force` overwrites the first `.bak` (`vscode_init.py`).
+- **The launcher GUI could lose track of a running backend because of
+  that backend's own log output.** `_log_queue` carried control events
+  and raw child stdout in the same channel, with the drain loop
+  dispatching on `line.startswith("_ERR_:")` and friends. A child line
+  beginning `_ERR_:` ran `del self.processes[proc_id]`, so a live
+  llama-server dropped out of the process table — unstoppable from the
+  UI, missed by the shutdown handler, holding its port and VRAM until
+  killed by hand. A line beginning `_SPAWNED_:` with too few colons
+  raised `ValueError` inside the drain loop and discarded that tick's
+  log processing entirely. This is reachable in ordinary use: llama.cpp
+  echoes GGUF metadata such as the chat template verbatim at startup,
+  and `extra_args` wrappers put arbitrary text on the same stream.
+  Events are now `(kind, proc_id, payload)` with `kind` in
+  `log / spawned / ready / error / devices`; raw child output is
+  enqueued unconditionally as `log` and never inspected for markers.
+  `_cr_log_queue` got the same treatment, the `"_DEVICES_"` proc_id
+  sentinel is gone, and a malformed control payload now skips its own
+  event instead of killing the loop. While here, `_SPAWNED_` parsing
+  moved from `split(":", 2)` to `rpartition`, so model names containing
+  a colon no longer mangle the port (`launcher_gui.py`).
+
+### Security
+
+- **`vscode-init` widened the permissions of the files it rewrote.**
+  `_atomic_write` created its temp file under the process umask and
+  `os.replace`d it over the target, so an `.envrc` hardened to `0600` —
+  a file that holds `ANTHROPIC_AUTH_TOKEN` — came back `0644`. The temp
+  path was also fully predictable (`.envrc.tmp`, `settings.json.tmp`),
+  so a pre-planted symlink at that path was followed and its target
+  overwritten (CWE-377), and two concurrent runs in one workspace raced
+  on the same name. Writes now go through `tempfile.mkstemp` with
+  `O_EXCL`, are `fsync`ed, restore the original mode before the rename,
+  and clean up the temp file on failure. A newly created `.envrc` is
+  written `0600`, matching the standard `coderouter doctor --check-env`
+  already enforces for credential-bearing files; an existing file keeps
+  whatever mode the operator set. Mode handling is POSIX-only —
+  `os.chmod` on Windows only toggles the read-only bit and is skipped.
+  `.vscode/settings.json` is backed up before any rewrite too, not just
+  under `--force`, since the merge path also edits it in place
+  (`vscode_init.py`).
+
+### Changed
+
+- `.gitignore` now excludes `*.bak`, so the backups above and
+  `providers.yaml.bak` from `doctor --apply` stay out of commits. They
+  carry the same secrets as the files they shadow.
+- Three GUI test modules documented their `pytest.importorskip("tkinter")`
+  as a CI workaround, stating that the uv-managed Python on CI has no
+  tkinter and that these tests are therefore skipped there. Measured on
+  2026-08-04: `uv python install` ships Tk 8.6 on both 3.12.11 and
+  3.13.7, and all 93 cases in those files run and pass on CI. The
+  docstrings now say so, and record that the guards stay for local
+  system pythons built without Tk — which do exist.
+
+### Tests
+
+- 1 new file, 38 new cases (`test_launcher_gui_events.py`, plus
+  additions to `test_vscode_init.py`). Suite: 2345 passed, 1 skipped,
+  ruff clean.
+- Each fix has a regression test confirmed to fail against the pre-fix
+  tree — 10 for the write path, 7 for the event path. The headline one
+  asserts a live process survives its own `_ERR_:` stdout line; on the
+  old code `app.processes` comes back empty. Another plants a symlink at
+  the predictable temp path and asserts its target is untouched.
+
+---
+
 ## [v2.11.1] — 2026-08-04 (second-round review: correctness & hardening)
 
 Seven fixes from a full-source review of the 36k-line package, plus two

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coderouter-cli
-Version: 2.11.1
+Version: 2.11.2
 Summary: Local-first, free-first, fallback-built-in LLM router. Claude Code / OpenAI compatible.
 Project-URL: Homepage, https://github.com/zephel01/CodeRouter
 Project-URL: Repository, https://github.com/zephel01/CodeRouter

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/coderouter/vscode_init.py

@@ -16,11 +16,21 @@ The design contract:
   without ``--force`` and print a unified diff so the operator decides.
 * ``--dry-run`` is byte-identical to the write path minus the actual
   ``os.replace`` at the end.
-* All writes are atomic (tmp file + ``os.replace``) so a partial write
-  cannot corrupt an existing ``settings.json``. This matters more here
-  than in most CodeRouter modules because the file we're editing is
-  workspace-critical: a broken JSON blob would silently break every
-  VSCode terminal env until a human debugged it.
+* All writes are atomic (``tempfile.mkstemp`` + ``fsync`` +
+  ``os.replace``) so a partial write cannot corrupt an existing
+  ``settings.json``. This matters more here than in most CodeRouter
+  modules because the file we're editing is workspace-critical: a
+  broken JSON blob would silently break every VSCode terminal env
+  until a human debugged it.
+* Nothing an operator wrote is destroyed without a copy: before any
+  existing file is rewritten, its previous bytes (and mode) land in
+  ``<name>.bak``. ``--force`` on ``.envrc`` is a whole-file replace,
+  not a merge, so this is the only thing standing between the user and
+  a lost ``source_env_if_exists .envrc.local`` line.
+* A freshly generated ``.envrc`` is created 0600 — it carries
+  ``ANTHROPIC_AUTH_TOKEN`` and sits next to the operator's real
+  secrets. An existing file's mode is preserved across rewrites
+  instead of being reset to the umask default by ``os.replace``.
 
 Files touched (opt-in per flag):
 
@@ -40,8 +50,12 @@ directly without argparse in the way.
 
 from __future__ import annotations
 
+import contextlib
 import json
 import os
+import shutil
+import stat
+import tempfile
 from dataclasses import dataclass
 from difflib import unified_diff
 from pathlib import Path
@@ -62,6 +76,15 @@ DEFAULT_PORT = 8088
 # then flag the unused directive.)
 DEFAULT_TOKEN = "dummy"
 
+# v2.11 (H-11): a generated .envrc carries ANTHROPIC_AUTH_TOKEN, and
+# users routinely add their real key next to it (or point
+# ``source_env_if_exists .envrc.local`` at one). ``env_security``
+# already WARNs on any ``.env`` whose mode has 0o077 bits set and tells
+# the operator to ``chmod 0600``; a file we generate ourselves should
+# not be born failing that check. Applies to newly created files only —
+# an existing file keeps whatever mode its owner chose.
+_ENVRC_MODE = 0o600
+
 # VSCode reads terminal env from a separate key per host OS. Writing all
 # three means the same ``.vscode/`` folder works whether the developer
 # opens it on macOS, Linux, or WSL/Windows without a second scaffolder
@@ -261,7 +284,9 @@ def _apply_settings_json(
             diff=diff,
             reason=(
                 "existing settings.json has different value(s) for "
-                f"{', '.join(sorted(conflicts))}. Re-run with --force to overwrite."
+                f"{', '.join(sorted(conflicts))}. Re-run with --force to "
+                "overwrite those keys (unrelated keys are preserved; the "
+                f"previous file is saved to {_backup_path(path).name})."
             ),
         )
 
@@ -270,7 +295,24 @@ def _apply_settings_json(
         return FileOutcome(path=path, action="unchanged")
 
     diff = _text_diff(old_text, new_text, path)
+    reason = ""
     if not dry_run:
+        # H-11: same deal as .envrc. The merge preserves unrelated keys
+        # by design, but a bug in _merge_terminal_env would rewrite a
+        # hand-tuned settings.json with no way back — so keep the old
+        # bytes. Unlike .envrc this is not gated on --force: an additive
+        # merge rewrites the file without --force too, and that is
+        # exactly the path a merge bug would take.
+        if old_text:
+            backup = _make_backup(path)
+            reason = (
+                f"previous contents backed up to {backup}"
+                if backup is not None
+                else (
+                    f"could not write {_backup_path(path).name} — "
+                    "previous contents were NOT preserved"
+                )
+            )
         try:
             path.parent.mkdir(parents=True, exist_ok=True)
             _atomic_write(path, new_text)
@@ -281,11 +323,14 @@ def _apply_settings_json(
                 reason=f"write failed: {exc}",
                 diff=diff,
             )
+    elif old_text:
+        reason = f"would back up previous contents to {_backup_path(path)}"
 
     return FileOutcome(
         path=path,
         action="updated" if old_text else "created",
         diff=diff,
+        reason=reason,
     )
 
 
@@ -374,15 +419,32 @@ def _apply_envrc(
             diff=diff,
             reason=(
                 ".envrc already exists and its contents differ. "
-                "Re-run with --force to overwrite. "
+                "Re-run with --force to replace the WHOLE file with the "
+                "generated contents (this is not a merge — custom lines "
+                "such as `source_env_if_exists .envrc.local` are dropped); "
+                f"the previous contents are saved to {_backup_path(path).name}. "
                 "(Tip: keep secrets in a separate .envrc.local and "
                 "``source_env_if_exists`` from .envrc.)"
             ),
         )
 
+    reason = ""
     if not dry_run:
+        # H-11: --force replaces the whole file, so stash the old bytes
+        # (mode included) before they are gone. Inside the dry_run guard
+        # on purpose — --dry-run must not touch the filesystem at all.
+        if old_text:
+            backup = _make_backup(path)
+            reason = (
+                f"previous contents backed up to {backup}"
+                if backup is not None
+                else (
+                    f"could not write {_backup_path(path).name} — "
+                    "previous contents were NOT preserved"
+                )
+            )
         try:
-            _atomic_write(path, new_text)
+            _atomic_write(path, new_text, mode=_ENVRC_MODE)
         except OSError as exc:
             return FileOutcome(
                 path=path,
@@ -390,11 +452,14 @@ def _apply_envrc(
                 reason=f"write failed: {exc}",
                 diff=diff,
             )
+    elif old_text:
+        reason = f"would back up previous contents to {_backup_path(path)}"
 
     return FileOutcome(
         path=path,
         action="updated" if old_text else "created",
         diff=diff,
+        reason=reason,
     )
 
 
@@ -538,21 +603,112 @@ def _dump_json(obj: object) -> str:
     return json.dumps(obj, indent=2, ensure_ascii=False) + "\n"
 
 
-def _atomic_write(path: Path, text: str) -> None:
-    """Write ``text`` to ``path`` atomically (tmp + os.replace).
+def _default_file_mode() -> int:
+    """Return the mode a plain ``open(..., "w")`` would produce.
+
+    ``tempfile.mkstemp`` deliberately creates its file 0600. That is the
+    right default for a secret-bearing ``.envrc``, but it would silently
+    tighten ``settings.json`` (previously umask-derived, typically
+    0644). Reading the umask back keeps the pre-existing behaviour for
+    files that have no explicit mode requirement.
+    """
+    current = os.umask(0)
+    os.umask(current)
+    return 0o666 & ~current
+
+
+def _atomic_write(path: Path, text: str, *, mode: int | None = None) -> None:
+    """Write ``text`` to ``path`` atomically (tmp + ``os.replace``).
 
     A partial write cannot corrupt the target file: the tmp file lives
     on the same filesystem (same parent directory) so ``os.replace`` is
     an atomic inode swap on POSIX. On Windows ``os.replace`` is also
     atomic since Python 3.3.
 
-    The tmp file uses the parent + ``<name>.tmp`` pattern rather than
-    ``Path.with_suffix`` because ``.envrc`` has no stem/suffix in the
-    ``Path`` sense and ``with_suffix`` would silently misbehave.
+    v2.11 hardening (H-11). The tmp file used to be the predictable
+    ``<name>.tmp`` next to the target, written with ``Path.write_text``:
+
+    * a pre-planted symlink at that exact path was *followed*, so the
+      write landed on the link's target (CWE-377);
+    * two concurrent ``vscode-init`` runs on the same workspace
+      clobbered each other's tmp file;
+    * ``os.replace`` swaps inodes, so the target's mode was reset to the
+      umask default — a 0600 ``.envrc`` holding ``ANTHROPIC_AUTH_TOKEN``
+      silently became 0644;
+    * without ``fsync`` a crash right after the rename could leave a
+      zero-length file.
+
+    So: ``tempfile.mkstemp`` (random name, ``O_EXCL``, no symlink
+    following), ``fsync`` before the rename, mode restored from the
+    file being replaced (or from ``mode`` for a fresh file), and the tmp
+    file unlinked in ``finally`` so a failed write leaves no debris.
+
+    Parameters
+    ----------
+    mode:
+        POSIX mode for a *newly created* file. Ignored when ``path``
+        already exists — an existing file's own mode wins, so we never
+        loosen (or tighten) what the operator chose. ``None`` means
+        "whatever the umask would have given us".
+    """
+    existing_mode: int | None = None
+    try:
+        existing_mode = stat.S_IMODE(path.stat().st_mode)
+    except OSError:
+        existing_mode = None
+
+    target_mode = existing_mode if existing_mode is not None else mode
+    if target_mode is None:
+        target_mode = _default_file_mode()
+
+    fd, tmp_name = tempfile.mkstemp(
+        dir=str(path.parent),
+        prefix=f".{path.name}.",
+        suffix=".tmp",
+    )
+    tmp = Path(tmp_name)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            handle.write(text)
+            handle.flush()
+            os.fsync(handle.fileno())
+        # Windows has no POSIX mode bits worth honouring; os.chmod there
+        # only toggles the read-only flag, which would be a surprising
+        # side effect of "preserve the mode".
+        if os.name != "nt":
+            os.chmod(tmp, target_mode)
+        os.replace(tmp, path)
+    finally:
+        # Best effort: a leftover tmp file is noise, not corruption, and
+        # cleaning it up must never mask the original exception.
+        with contextlib.suppress(OSError):
+            tmp.unlink(missing_ok=True)
+
+
+def _backup_path(path: Path) -> Path:
+    """Return the ``.bak`` sibling used to preserve ``path``'s old bytes."""
+    return path.with_name(path.name + ".bak")
+
+
+def _make_backup(path: Path) -> Path | None:
+    """Copy ``path`` to ``<name>.bak``, preserving mode and mtime.
+
+    Returns the backup path, or ``None`` when the copy failed (the
+    caller then proceeds without a backup rather than refusing to write
+    — but the failure is not silent, see the ``reason`` plumbing).
+
+    The destination is unlinked first: ``shutil.copy2`` opens the
+    destination for writing and would happily follow a symlink planted
+    at ``<name>.bak``. ``Path.unlink`` removes the link itself, so the
+    subsequent copy always creates a fresh regular file.
     """
-    tmp = path.parent / (path.name + ".tmp")
-    tmp.write_text(text, encoding="utf-8")
-    os.replace(tmp, path)
+    backup = _backup_path(path)
+    try:
+        backup.unlink(missing_ok=True)
+        shutil.copy2(path, backup)
+    except OSError:
+        return None
+    return backup
 
 
 def _text_diff(old: str, new: str, path: Path) -> str:

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/docs/guides/vscode.md

@@ -64,6 +64,25 @@ coderouter vscode-init [--target PATH]
 - `--dry-run`: `.vscode/settings.json` に何を書くかの unified diff だけ表示
 - `--force`: 既存の `ANTHROPIC_BASE_URL` などが違う値だったとき上書き（既定はコンフリクト報告のみで書かない）
 
+#### `--force` の挙動（v2.11 以降）
+
+`--force` の効き方は 2 つのファイルで異なります。
+
+- `.vscode/settings.json`: **マージ**です。CodeRouter が管理する 3 キー（`ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN` / `CODEROUTER_MODE`）だけを上書きし、`editor.fontSize` などの無関係なキーはそのまま残ります
+- `.envrc`: **ファイル全体の置き換え**です。マージはしません。手で足した行（例: `source_env_if_exists .envrc.local`）は生成内容には含まれないため消えます
+
+そのため、既存ファイルを書き換える前に**必ず退避コピーを作ります**。
+
+| 元のファイル | 退避先 |
+|---|---|
+| `.envrc` | `.envrc.bak` |
+| `.vscode/settings.json` | `.vscode/settings.json.bak` |
+
+- 退避先のパスは実行結果の `→` 行に表示されます
+- `--dry-run` では退避も含めて**一切ファイルを作りません**
+- `.bak` は毎回上書きされます。2 世代前は残らないので、重要な `.envrc` は `--force` の前に自分でも控えを取るか、素直に `.envrc.local` へ分離してください
+- `*.bak` はプロジェクトの `.gitignore` に入れておくことを推奨します
+
 ### 再実行しても壊れない
 
 `vscode-init` は冪等です。同じ引数で再実行すれば `unchanged` を報告して終了。異なる値と衝突した場合は `conflict` を出して**ファイルに触りません**（`--force` 必要）。オンボーディングスクリプトに含めて安全です。
@@ -76,6 +95,13 @@ coderouter vscode-init --with-envrc
 
 これで `.envrc` も生成されます。生成後に **`direnv allow`** を 1 回実行してください。シークレットは `.envrc.local` に分けて `source_env_if_exists .envrc.local` の形が安全です（`.envrc` はプロジェクトに commit することが多いので）。
 
+パーミッションについて（v2.11 以降）:
+
+- **新規生成した `.envrc` は `0600`（所有者のみ読み書き）**で作られます。`ANTHROPIC_AUTH_TOKEN` を含むファイルなので、`coderouter --check-env` が `.env` に課しているのと同じ基準に揃えてあります
+- **既存ファイルを上書きするときは、そのファイルの現在の mode をそのまま維持**します（以前は `os.replace` で umask 既定＝多くの環境で `0644` に戻っていました）
+- Windows では POSIX の mode ビットに意味がないため、mode の設定・維持は行いません
+- なお `--force` で `source_env_if_exists .envrc.local` の行は消えます。消える前の内容は `.envrc.bak` に残るので、必要な行はそこから戻してください
+
 ### 注意点
 
 - `.vscode/` は CodeRouter リポジトリの `.gitignore` に既に入っているため、`.vscode/settings.json` は既定で **git に含まれません**。あなたのプロジェクトの `.gitignore` は個別に確認してください

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/pyproject.toml

@@ -11,7 +11,7 @@
 # in plan.md §11.B; once granted, this name will become an alias and
 # `coderouter` will become the canonical distribution name.
 name = "coderouter-cli"
-version = "2.11.1"
+version = "2.11.2"
 description = "Local-first, free-first, fallback-built-in LLM router. Claude Code / OpenAI compatible."
 readme = "README.md"
 requires-python = ">=3.12"

{coderouter_cli-2.11.1 → coderouter_cli-2.11.2}/tests/test_launcher_gui_devices.py

@@ -5,8 +5,10 @@ bench-sweep pure logic was deliberately factored into Tk-independent
 module-level functions / dataclasses (mirroring the readiness/auto-restart
 split covered by tests/test_launcher_gui_readiness.py) so every case below
 exercises them without ever instantiating ``tk.Tk()`` / ``LauncherApp`` /
-``SweepWindow`` — no display server, matching the desktop CI constraint
-(uv-managed CPython has no tkinter, hence the importorskip below).
+``SweepWindow`` — no display server needed. The importorskip below is not
+for CI: uv-managed CPython does ship tkinter, so these tests really do run
+there. It is for local system pythons built without Tk, which would
+otherwise fail at collection time.
 
 Subprocess spawning is fully mocked: no real llama-server / llmbench ever
 runs. The shared, frozen core logic lives in coderouter.launcher_devices and