coderouter-cli 2.12.0__py3-none-any.whl → 2.13.0__py3-none-any.whl

coderouter/cli.py

@@ -600,28 +600,27 @@ def _run_check_model(args: argparse.Namespace) -> int:
 
 
 def _resolve_config_path(explicit: str | None) -> Path:
-    """Mirror loader._candidate_paths and return the file actually used.
-
-    Used by ``--apply`` to write back to the same path the loader
-    picked up when it parsed providers.yaml. Falls through the same
-    search order so a ``CODEROUTER_CONFIG`` env or default-path lookup
-    matches the live config.
+    """Return the file the loader actually read, for ``--apply`` write-back.
+
+    Delegates the search order to
+    :func:`coderouter.config.loader.resolve_config_path` rather than
+    re-implementing it. Re-implementing it here is exactly how the
+    v2.13.0 CWD opt-in change would introduce a silent bug: if the loader
+    gates ``./providers.yaml`` behind ``CODEROUTER_ALLOW_CWD_CONFIG`` but
+    this copy still searched CWD unconditionally, ``doctor --apply`` would
+    write patches back into a file that ``load_config`` never read. Keeping
+    one source of truth makes that impossible.
+
+    When nothing exists, falls back to ``~/.coderouter/providers.yaml``
+    (the loader's last candidate) — the apply step surfaces a clearer
+    error against that path than this resolver would.
     """
-    import os
-
-    candidates: list[Path] = []
-    if explicit:
-        candidates.append(Path(explicit))
-    if env_path := os.environ.get("CODEROUTER_CONFIG"):
-        candidates.append(Path(env_path))
-    candidates.append(Path.cwd() / "providers.yaml")
-    candidates.append(Path.home() / ".coderouter" / "providers.yaml")
-    for p in candidates:
-        if p.is_file():
-            return p
-    # Fall back to the last candidate even if absent — the apply step
-    # will surface a clearer error than this resolver would.
-    return candidates[-1]
+    from coderouter.config.loader import resolve_config_path
+
+    resolved = resolve_config_path(explicit)
+    if resolved is not None:
+        return resolved
+    return Path.home() / ".coderouter" / "providers.yaml"
 
 
 def _write_verdict_line(*, write: bool, files_written: int) -> None:

coderouter/config/loader.py

@@ -3,21 +3,26 @@
 Search order (first hit wins):
     1. Path passed explicitly (CLI --config flag)
     2. $CODEROUTER_CONFIG env var
-    3. ./providers.yaml (current working dir)
+    3. ./providers.yaml (current working dir) — opt-in since v2.13.0,
+       gated behind ``CODEROUTER_ALLOW_CWD_CONFIG`` (truthy: 1/true/yes/on)
     4. ~/.coderouter/providers.yaml
 
 Secrets are resolved by reading the env var named by `api_key_env`.
 
 .. note::
-    **[Unreleased] deprecation notice (planned v2.12.0):** step 3 above
-    (implicit CWD discovery) is slated to become opt-in, gated behind
-    ``CODEROUTER_ALLOW_CWD_CONFIG``. Landing that change without warning
-    first would silently break anyone currently relying on "run from the
-    directory with providers.yaml in it" with no diagnostic. Until that
-    lands, :func:`load_config` emits a one-time ``cwd-config-loaded``
-    warning whenever step 3 is the one that actually resolved — never
-    when an explicit ``--config`` / ``CODEROUTER_CONFIG`` path was used,
-    even if it happens to point at the same file.
+    **v2.13.0 (security):** step 3 above (implicit CWD discovery) is now
+    opt-in, gated behind ``CODEROUTER_ALLOW_CWD_CONFIG``. It was a code
+    execution vector: a hostile ``providers.yaml`` dropped into a repo
+    could steer ``restart_command`` / ``launcher.backends[*].binary`` /
+    ``launcher.bench.command_template`` — all of which name executables —
+    simply because CodeRouter happened to be started from that directory.
+    When the opt-in is enabled and step 3 resolves the config, a one-time
+    ``cwd-config-loaded`` warning fires (never when an explicit
+    ``--config`` / ``CODEROUTER_CONFIG`` path was used, even if it happens
+    to point at the same file). When the opt-in is NOT set but a
+    ``./providers.yaml`` exists and was not explicitly named, a one-time
+    ``cwd-config-skipped`` warning fires so the operator understands why
+    that file was ignored.
 """
 
 from __future__ import annotations
@@ -32,10 +37,25 @@ from coderouter.logging import get_logger
 
 logger = get_logger(__name__)
 
-# Guards the one-time [Unreleased]/v2.12.0 CWD-config deprecation warning
-# (see module docstring) so a process that calls load_config() repeatedly
-# (tests, hot-reload, multiple create_app() calls) only logs it once.
+# Name of the env var that opts CWD ``providers.yaml`` discovery back in
+# (see module docstring). v2.13.0 gates step 3 of the search behind it.
+CWD_CONFIG_ENV = "CODEROUTER_ALLOW_CWD_CONFIG"
+# Truthy vocabulary shared by every CWD-opt-in / ALLOW_PAID style toggle.
+_TRUTHY = {"1", "true", "yes", "on"}
+
+# Guards the one-time ``cwd-config-loaded`` warning (opt-in enabled and the
+# CWD step actually resolved) so a process that calls load_config()
+# repeatedly (tests, hot-reload, multiple create_app() calls) only logs it
+# once.
 _cwd_config_warning_emitted = False
+# Guards the one-time ``cwd-config-skipped`` warning (opt-in NOT set but a
+# ./providers.yaml exists and was ignored) — same once-per-process rationale.
+_cwd_config_skip_warning_emitted = False
+
+
+def cwd_config_allowed() -> bool:
+    """True iff the CWD ``providers.yaml`` opt-in is enabled (v2.13.0)."""
+    return os.environ.get(CWD_CONFIG_ENV, "").strip().lower() in _TRUTHY
 
 
 def _candidate_paths(explicit: str | os.PathLike[str] | None) -> list[Path]:
@@ -44,27 +64,58 @@ def _candidate_paths(explicit: str | os.PathLike[str] | None) -> list[Path]:
         paths.append(Path(explicit))
     if env_path := os.environ.get("CODEROUTER_CONFIG"):
         paths.append(Path(env_path))
-    paths.append(Path.cwd() / "providers.yaml")
+    # v2.13.0: implicit CWD discovery is opt-in — a hostile providers.yaml
+    # dropped into a repo could otherwise steer restart_command / launcher
+    # binaries simply because CodeRouter was started from that directory.
+    if cwd_config_allowed():
+        paths.append(Path.cwd() / "providers.yaml")
     paths.append(Path.home() / ".coderouter" / "providers.yaml")
     return paths
 
 
+def resolve_config_path(
+    explicit: str | os.PathLike[str] | None = None,
+) -> Path | None:
+    """Return the config file the loader would pick, or None if none exists.
+
+    Single source of truth for the search order so callers (e.g.
+    ``coderouter.cli._resolve_config_path`` driving ``doctor --apply``)
+    never re-implement it. Re-implementing it risks writing back to a
+    different file than the one :func:`load_config` actually read — the
+    exact regression the v2.13.0 CWD opt-in would otherwise introduce.
+    """
+    return next((p for p in _candidate_paths(explicit) if p.is_file()), None)
+
+
+def _explicitly_named(
+    path: Path, explicit: str | os.PathLike[str] | None
+) -> bool:
+    """True iff ``path`` matches the literal --config or CODEROUTER_CONFIG value.
+
+    Used to keep the CWD warnings quiet when ``./providers.yaml`` was
+    chosen on purpose (an explicit choice, however coincidental, is not
+    the implicit-discovery behaviour being gated).
+    """
+    if explicit and Path(explicit) == path:
+        return True
+    env_path = os.environ.get("CODEROUTER_CONFIG")
+    return env_path is not None and Path(env_path) == path
+
+
 def _warn_if_cwd_config(
     chosen: Path, *, explicit: str | os.PathLike[str] | None
 ) -> None:
-    """Emit the one-time [Unreleased]/v2.12.0 CWD-config deprecation warning.
+    """Emit the one-time ``cwd-config-loaded`` warning (opt-in is enabled).
 
     Only fires when ``chosen`` was resolved via the *implicit* CWD-search
-    step. Compares ``chosen`` against the *literal* explicit / env
-    candidate paths (not merely whether those inputs were set) so that:
-
-      * an explicit ``--config`` (or ``CODEROUTER_CONFIG``) path that
-        happens to coincide with ``./providers.yaml`` stays quiet — an
-        explicit choice, however coincidental, is not the thing being
-        deprecated; but
-      * an explicit path/env var that was set but did NOT resolve (file
-        missing, so the search fell through to CWD) still warns, because
-        the CWD step is what actually served the config in that case.
+    step — which, since v2.13.0, only runs when
+    ``CODEROUTER_ALLOW_CWD_CONFIG`` is set. Compares ``chosen`` against the
+    *literal* explicit / env candidate paths (not merely whether those
+    inputs were set) so that an explicit ``--config`` (or
+    ``CODEROUTER_CONFIG``) path that happens to coincide with
+    ``./providers.yaml`` stays quiet, while an explicit path/env var that
+    was set but did NOT resolve (file missing, search fell through to CWD)
+    still warns — the CWD step is what actually served the config there.
     """
     global _cwd_config_warning_emitted
     if _cwd_config_warning_emitted:
@@ -72,9 +123,7 @@ def _warn_if_cwd_config(
     cwd_path = Path.cwd() / "providers.yaml"
     if chosen != cwd_path:
         return
-    if explicit and Path(explicit) == chosen:
-        return
-    if (env_path := os.environ.get("CODEROUTER_CONFIG")) and Path(env_path) == chosen:
+    if _explicitly_named(chosen, explicit):
         return
 
     _cwd_config_warning_emitted = True
@@ -84,26 +133,76 @@ def _warn_if_cwd_config(
             "path": str(chosen),
             "hint": (
                 f"loaded providers.yaml from the current working "
-                f"directory ({chosen}). Starting in v2.12.0, this "
-                "implicit CWD discovery becomes opt-in (gated behind "
-                "CODEROUTER_ALLOW_CWD_CONFIG) — pass --config or set "
-                "CODEROUTER_CONFIG to pin the file explicitly and avoid "
-                "a startup break when that lands."
+                f"directory ({chosen}) because CODEROUTER_ALLOW_CWD_CONFIG "
+                "opt-in is enabled. This file's restart_command / "
+                "launcher.backends[*].binary / "
+                "launcher.bench.command_template decide which executables "
+                "run — only enable the opt-in in directories you trust."
             ),
         },
     )
 
 
+def _warn_if_cwd_config_skipped(
+    explicit: str | os.PathLike[str] | None,
+) -> Path | None:
+    """Warn once when a ./providers.yaml exists but was skipped (no opt-in).
+
+    Returns the skipped CWD path (so :func:`load_config` can name it in a
+    later ``FileNotFoundError``), or None when there is nothing to skip:
+    the opt-in is enabled, no ``./providers.yaml`` exists, or the file was
+    explicitly named (``--config`` / ``CODEROUTER_CONFIG``) — in which case
+    it is not being skipped at all.
+    """
+    global _cwd_config_skip_warning_emitted
+    if cwd_config_allowed():
+        return None
+    cwd_path = Path.cwd() / "providers.yaml"
+    if not cwd_path.is_file():
+        return None
+    if _explicitly_named(cwd_path, explicit):
+        return None
+
+    if not _cwd_config_skip_warning_emitted:
+        _cwd_config_skip_warning_emitted = True
+        logger.warning(
+            "cwd-config-skipped",
+            extra={
+                "path": str(cwd_path),
+                "hint": (
+                    f"found providers.yaml in the current working "
+                    f"directory ({cwd_path}) but did NOT load it: implicit "
+                    "CWD discovery is opt-in since v2.13.0 (a hostile "
+                    "providers.yaml can steer restart_command / launcher "
+                    "binaries). To use it, set CODEROUTER_ALLOW_CWD_CONFIG=1 "
+                    "(only in directories you trust) or pass --config "
+                    f"{cwd_path} to name it explicitly."
+                ),
+            },
+        )
+    return cwd_path
+
+
 def load_config(path: str | os.PathLike[str] | None = None) -> CodeRouterConfig:
     """Load providers.yaml + apply ALLOW_PAID env override."""
+    skipped_cwd = _warn_if_cwd_config_skipped(path)
     candidates = _candidate_paths(path)
     chosen: Path | None = next((p for p in candidates if p.is_file()), None)
     if chosen is None:
         searched = "\n  ".join(str(p) for p in candidates)
-        raise FileNotFoundError(
+        message = (
             f"providers.yaml not found. Searched:\n  {searched}\n"
             f"Hint: copy examples/providers.yaml to ~/.coderouter/providers.yaml"
         )
+        if skipped_cwd is not None:
+            message += (
+                f"\nNote: {skipped_cwd} exists but was NOT read — implicit "
+                "CWD discovery is opt-in since v2.13.0. Three ways to use "
+                f"it: pass --config {skipped_cwd}, set "
+                f"CODEROUTER_CONFIG={skipped_cwd}, or set "
+                "CODEROUTER_ALLOW_CWD_CONFIG=1 (only in directories you trust)."
+            )
+        raise FileNotFoundError(message)
     _warn_if_cwd_config(chosen, explicit=path)
 
     with chosen.open("r", encoding="utf-8") as f:

coderouter/config/schemas.py

@@ -355,15 +355,20 @@ class AgentCliConfig(BaseModel):
         return self
 
 
-# [Unreleased]/planned v2.12.0: patterns used by ProviderConfig's
+# v2.13.0: patterns used by ProviderConfig's
 # ``_warn_restart_command_shell_syntax`` validator to flag
-# ``restart_command`` values that rely on shell syntax not honored by
-# the planned ``shlex.split`` + ``shell=False`` dispatch (see that
-# validator's docstring and the field description below for the full
-# rationale). Compiled once at module scope since every ProviderConfig
-# validation reuses them.
-_RESTART_COMMAND_SHELL_META_RE = re.compile(r"(&&|\|\||\||;|>|<|\$\(|`)")
-_RESTART_COMMAND_ENV_PREFIX_RE = re.compile(r"^\w+=")
+# ``restart_command`` values that rely on shell syntax not honored by the
+# ``shlex.split`` + ``shell=False`` dispatch (see that validator's
+# docstring and the field description below for the full rationale).
+# Public (no leading underscore) because ``coderouter.guards.self_healing``
+# imports ``RESTART_COMMAND_SHELL_META_RE`` to *refuse* to run any
+# restart_command containing shell metacharacters — under shell=False a
+# value like ``touch a; b`` would create a file literally named ``a;`` and
+# exit 0, i.e. report a "successful" restart while only half-executing.
+# Compiled once at module scope since every ProviderConfig validation
+# reuses them.
+RESTART_COMMAND_SHELL_META_RE = re.compile(r"(&&|\|\||\||;|>|<|\$\(|`)")
+RESTART_COMMAND_ENV_PREFIX_RE = re.compile(r"^\w+=")
 
 
 class ProviderConfig(BaseModel):
@@ -520,54 +525,56 @@ class ProviderConfig(BaseModel):
             "transitions to UNHEALTHY. Unset = no automatic restart "
             "(recovery probe still runs, waiting for manual restart). "
             "\n\n"
-            "[Unreleased]/planned v2.12.0: currently run as "
-            "``subprocess.run(command, shell=True)`` (coderouter/guards/"
-            "self_healing.py), so shell syntax works today — pipelines "
-            "(``pkill ollama && ollama serve``), ``~`` expansion, and "
-            "leading env-var assignments (``OLLAMA_HOST=0.0.0.0 ollama "
-            "serve``) are all honored. A future minor switches this to "
-            "``shlex.split(command)`` + ``shell=False`` (argv dispatch, "
-            "no shell in between), which does NOT support any of the "
-            "above — ``&&`` becomes a literal argument to the first "
-            "command instead of a separator, ``~/...`` paths are not "
-            "expanded, and ``FOO=bar cmd`` fails to exec. If your "
-            "command needs shell features, wrap it in a small script "
-            "and point restart_command at that script instead, e.g. "
-            "``restart_command: /path/to/restart-ollama.sh``."
+            "v2.13.0: run as ``subprocess.run(shlex.split(command), "
+            "shell=False)`` (coderouter/guards/self_healing.py) — argv "
+            "dispatch, no shell in between. Pipelines "
+            "(``pkill ollama && ollama serve``), redirects, ``~`` "
+            "expansion, and leading env-var assignments "
+            "(``OLLAMA_HOST=0.0.0.0 ollama serve``) are NOT supported: "
+            "``~/...`` paths are not expanded and ``FOO=bar cmd`` fails to "
+            "exec. A value containing shell metacharacters (``&&``, ``||``, "
+            "``|``, ``;``, ``>``, ``<``, ``$(...)``, ```...```) is refused "
+            "outright (not run) rather than half-executed. If your command "
+            "needs shell features, wrap it in a small script and point "
+            "restart_command at that script (e.g. "
+            "``restart_command: /path/to/restart-ollama.sh``), or write it "
+            "as ``/bin/sh -c '...'`` explicitly."
         ),
     )
 
     @model_validator(mode="after")
     def _warn_restart_command_shell_syntax(self) -> ProviderConfig:
-        """[Unreleased]/planned v2.12.0 breaking-change heads-up (warning only).
-
-        ``coderouter/guards/self_healing.py`` currently runs
-        ``restart_command`` via ``subprocess.run(command, shell=True)``.
-        The planned v2.12.0 change switches that to
-        ``shlex.split(command)`` + ``shell=False`` — a shell-syntax
-        ``restart_command`` that works fine today would then either
-        crash (``FileNotFoundError`` for ``~/...`` paths or an
-        ``ENV=val cmd`` prefix) or, worse, silently misbehave (``&&`` /
-        ``||`` / ``|`` / ``;`` / redirects becoming literal argv tokens
-        instead of shell operators — a provider "restart" that quietly
-        does the wrong thing is worse than one that errors loudly).
+        """v2.13.0: warn that this ``restart_command`` will not run as written.
+
+        ``coderouter/guards/self_healing.py`` runs ``restart_command`` via
+        ``subprocess.run(shlex.split(command), shell=False)`` — argv
+        dispatch, no shell. A shell-syntax ``restart_command`` therefore
+        does NOT do what the shell would do:
+
+          * shell metacharacters (``&&`` / ``||`` / ``|`` / ``;`` /
+            redirects / ``$(...)`` / backticks) → the value is *refused*
+            (not run) by self_healing, because under shell=False they would
+            otherwise become literal argv tokens and half-execute a
+            provider "restart" that quietly does the wrong thing;
+          * a leading ``~/...`` path or an ``ENV=val cmd`` prefix →
+            ``exec`` fails (``FileNotFoundError``) because there is no shell
+            to expand ``~`` or apply the assignment.
 
         Deliberately never raises: this validator does not enforce
-        anything, it only warns ahead of the wire change so operators
-        can migrate ``restart_command`` to a plain argv (or a wrapper
-        script) before v2.12.0 lands, instead of discovering the break
-        the next time a provider actually goes UNHEALTHY.
+        anything, it only warns so an existing providers.yaml still loads
+        (rather than becoming un-startable). Migrate ``restart_command`` to
+        a plain argv, a wrapper script, or an explicit ``/bin/sh -c '...'``.
         """
         cmd = self.restart_command
         if not cmd:
             return self
         stripped = cmd.strip()
         reasons: list[str] = []
-        if _RESTART_COMMAND_SHELL_META_RE.search(cmd):
+        if RESTART_COMMAND_SHELL_META_RE.search(cmd):
             reasons.append("shell metacharacter (&&, ||, |, ;, >, <, $(...), or `...`)")
         if stripped.startswith("~/"):
             reasons.append("leading '~/' path (no shell expansion under shell=False)")
-        if _RESTART_COMMAND_ENV_PREFIX_RE.match(stripped):
+        if RESTART_COMMAND_ENV_PREFIX_RE.match(stripped):
             reasons.append("leading environment-variable assignment (FOO=bar ...)")
         if reasons:
             logger.warning(
@@ -577,13 +584,13 @@ class ProviderConfig(BaseModel):
                     "restart_command": cmd,
                     "reasons": reasons,
                     "hint": (
-                        "restart_command currently runs via "
-                        "subprocess.run(..., shell=True); a planned "
-                        "v2.12.0 change switches to shlex.split(...) + "
-                        "shell=False, which does not support this "
-                        "command's shell syntax. Rewrite it as plain "
-                        "argv, or wrap it in a script and point "
-                        "restart_command at that script."
+                        "restart_command runs via "
+                        "subprocess.run(shlex.split(...), shell=False) as of "
+                        "v2.13.0, which does not support this command's "
+                        "shell syntax: values with shell metacharacters are "
+                        "refused (not run), and '~/' / 'FOO=bar' prefixes "
+                        "fail to exec. Rewrite it as plain argv, wrap it in "
+                        "a script, or use /bin/sh -c '...'."
                     ),
                 },
             )
@@ -1573,6 +1580,28 @@ class LauncherOptionProfile(BaseModel):
     )
 
 
+class LauncherBenchPreset(BaseModel):
+    """launcher.bench.presets[<key>] の1エントリ。H-2: スイープAPIが受け付けるのはキー名だけ。"""
+
+    model_config = ConfigDict(extra="forbid")
+    name: str = Field(..., min_length=1, description="Launcher UI に出す表示名。")
+    command_template: str = Field(
+        ...,
+        min_length=1,
+        description="外部ベンチコマンドのテンプレ。{port} {config} {base_url} {results_dir} {runs} を単純置換で展開。",
+    )
+    runs: int | None = Field(
+        default=None,
+        ge=1,
+        le=1000,
+        description="このプリセット固有の実行回数。None なら launcher.bench.runs。",
+    )
+    results_dir: str | None = Field(
+        default=None,
+        description="このプリセット固有の results ディレクトリ。None なら launcher.bench.results_dir。リクエストからは指定できない。",
+    )
+
+
 class LauncherBenchConfig(BaseModel):
     """The ``launcher.bench:`` block — defaults for the bench sweep feature.
 
@@ -1614,6 +1643,23 @@ class LauncherBenchConfig(BaseModel):
             "大きな GGUF ロードを考慮した既定 5 分。"
         ),
     )
+    presets: dict[str, LauncherBenchPreset] = Field(
+        default_factory=dict,
+        description="名前付きベンチコマンド。キーが POST /api/launcher/sweep/start の bench_preset が取りうる唯一の値。",
+    )
+    default_preset: str | None = Field(
+        default=None,
+        description="bench_preset 未指定時に使うプリセットキー。None なら command_template 由来の暗黙 default。",
+    )
+
+    @model_validator(mode="after")
+    def _check_default_preset(self) -> Self:
+        if self.default_preset is not None and self.default_preset not in self.presets:
+            raise ValueError(
+                f"launcher.bench.default_preset={self.default_preset!r} is not a key of "
+                f"launcher.bench.presets (known: {sorted(self.presets) or 'none'})"
+            )
+        return self
 
 
 class SwapModelSpec(BaseModel):

coderouter/guards/self_healing.py

@@ -50,6 +50,14 @@ Design choices
   are guarded independently.
 - **No new dependency** — subprocess (stdlib) for restart commands,
   asyncio for recovery probe scheduling.
+- **v2.13.0: argv dispatch (shell=False)** — ``restart_command`` is run
+  as ``subprocess.run(shlex.split(command), shell=False)``, never through
+  a shell. A value containing shell metacharacters is refused outright
+  (not run), because under shell=False those tokens would half-execute
+  the command (e.g. ``touch a; b`` would create a file named ``a;`` and
+  exit 0, falsely reporting a successful restart). This closes the H-1
+  code-execution vector where a hostile CWD providers.yaml could drive
+  arbitrary shell through self-healing.
 - **Restart is opt-in** — only providers with ``restart_command``
   set get automatic restart. Others rely solely on recovery probes
   (waiting for manual restart by the operator).
@@ -62,12 +70,14 @@ from __future__ import annotations
 
 import asyncio
 import contextlib
+import os
+import shlex
 import subprocess
 import threading
 import time
 from dataclasses import dataclass
 
-from coderouter.config.schemas import ProviderConfig
+from coderouter.config.schemas import RESTART_COMMAND_SHELL_META_RE, ProviderConfig
 from coderouter.logging import (
     get_logger,
     log_self_healing_exclude,
@@ -268,6 +278,51 @@ class SelfHealingOrchestrator:
 
         provider = provider_config.name
 
+        # v2.13.0: argv dispatch (shell=False). We validate/parse the command
+        # BEFORE taking the per-provider restart lock so a malformed value
+        # short-circuits without ever touching the lock (and a later valid
+        # attempt is unaffected).
+        #
+        # A-5: refuse anything with shell metacharacters. Under shell=False,
+        # ``touch a; b`` would create a file literally named ``a;`` and exit
+        # 0 — reporting a "successful" restart while only half-executing the
+        # intended pipeline. Refusing loudly beats half-running silently.
+        if RESTART_COMMAND_SHELL_META_RE.search(command):
+            log_self_healing_restart(
+                logger,
+                provider=provider,
+                command=command,
+                success=False,
+                error=(
+                    "restart_command contains shell syntax but is no longer "
+                    "run through a shell (v2.13.0). Wrap it in a script and "
+                    "point restart_command at that script, or write it as "
+                    "/bin/sh -c '...'."
+                ),
+            )
+            return False
+
+        try:
+            argv = shlex.split(command, posix=(os.name != "nt"))
+        except ValueError as exc:
+            log_self_healing_restart(
+                logger,
+                provider=provider,
+                command=command,
+                success=False,
+                error=f"unparsable restart_command: {exc}",
+            )
+            return False
+        if not argv:
+            log_self_healing_restart(
+                logger,
+                provider=provider,
+                command=command,
+                success=False,
+                error="restart_command is empty after parsing",
+            )
+            return False
+
         # Get or create a per-provider lock.
         with self._lock:
             if provider not in self._restart_locks:
@@ -281,8 +336,8 @@ class SelfHealingOrchestrator:
 
         try:
             result = subprocess.run(
-                command,
-                shell=True,
+                argv,
+                shell=False,
                 capture_output=True,
                 timeout=timeout_s,
                 text=True,

coderouter/ingress/app.py

@@ -10,7 +10,7 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI, Request
 from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.types import ASGIApp
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
 from coderouter import __version__
 from coderouter.config import load_config
@@ -101,37 +101,78 @@ def _parse_max_body_bytes(raw: str | None) -> int:
     return value if value > 0 else _DEFAULT_MAX_BODY_BYTES
 
 
-class BodySizeLimitMiddleware(BaseHTTPMiddleware):
-    """Reject requests whose declared body exceeds the configured cap.
+class _BodyTooLarge(Exception):
+    pass
 
-    The check is on the incoming ``Content-Length`` header, so it is cheap
-    (no body is read) and fires before the route handler runs. Streaming
-    *responses* (SSE) are unaffected — this only inspects the request side.
-    A body over the limit fails closed with 413.
+
+class BodySizeLimitMiddleware:
+    """Reject requests whose body exceeds the configured cap.
+
+    M-3: this is a **pure ASGI** middleware, not a ``BaseHTTPMiddleware``.
+    The old dispatch only checked the ``Content-Length`` header, so a chunked
+    request (no Content-Length) bypassed the cap entirely. We now also count
+    the bytes actually received and fail closed with 413 the moment the total
+    crosses the limit. It must be pure ASGI because a ``BaseHTTPMiddleware``
+    that consumes ``request.stream()`` to measure the body would hand a
+    drained (empty) body to the downstream route.
+
+    Streaming *responses* (SSE) are unaffected — this only inspects the
+    request side.
     """
 
     def __init__(self, app: ASGIApp, max_bytes: int) -> None:
-        super().__init__(app)
+        self.app = app
         self._max_bytes = max_bytes
 
-    async def dispatch(self, request: Request, call_next):  # type: ignore[no-untyped-def]
-        content_length = request.headers.get("content-length")
-        if content_length is not None:
-            try:
-                declared = int(content_length)
-            except ValueError:
-                declared = -1
-            if declared > self._max_bytes:
-                return JSONResponse(
-                    status_code=413,
-                    content={
-                        "detail": (
-                            f"Request body too large: {declared} bytes exceeds "
-                            f"the {self._max_bytes}-byte limit."
-                        )
-                    },
+    def _too_large(self, observed: int) -> JSONResponse:
+        return JSONResponse(
+            status_code=413,
+            content={
+                "detail": (
+                    f"Request body too large: {observed} bytes exceeds "
+                    f"the {self._max_bytes}-byte limit."
                 )
-        return await call_next(request)
+            },
+        )
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+        for key, value in scope.get("headers", []):
+            if key == b"content-length":
+                try:
+                    declared = int(value)
+                except ValueError:
+                    break
+                if declared > self._max_bytes:
+                    await self._too_large(declared)(scope, receive, send)
+                    return
+                break
+        received = 0
+        response_started = False
+
+        async def limited_receive() -> Message:
+            nonlocal received
+            message = await receive()
+            if message["type"] == "http.request":
+                received += len(message.get("body", b""))
+                if received > self._max_bytes:
+                    raise _BodyTooLarge(received)
+            return message
+
+        async def guarded_send(message: Message) -> None:
+            nonlocal response_started
+            if message["type"] == "http.response.start":
+                response_started = True
+            await send(message)
+
+        try:
+            await self.app(scope, limited_receive, guarded_send)
+        except _BodyTooLarge as exc:
+            if response_started:
+                raise
+            await self._too_large(int(exc.args[0]))(scope, receive, send)
 
 
 class HostValidationMiddleware(BaseHTTPMiddleware):
@@ -409,10 +450,12 @@ def create_app(config_path: str | None = None) -> FastAPI:
     )
     app.add_middleware(HostValidationMiddleware, allowed_hosts=allowed_hosts)
 
-    # M14: request body size limit (DoS protection). Added after the Host
-    # middleware so that — because add_middleware wraps outermost-last — Host
-    # validation runs first and the size guard second. SSE streaming responses
-    # are unaffected: the check only reads the request Content-Length.
+    # M14: request body size limit (DoS protection). ``add_middleware`` wraps
+    # outermost-last, so the middleware added *after* HostValidation ends up
+    # the outermost layer — i.e. the size guard runs FIRST, before Host
+    # validation. That ordering is harmless: an oversized/chunked body is
+    # rejected as early as possible. SSE streaming responses are unaffected;
+    # this only inspects the request side.
     max_body_bytes = _parse_max_body_bytes(
         os.environ.get(_MAX_BODY_BYTES_ENV)
     )

coderouter/ingress/launcher_routes.py

@@ -552,6 +552,47 @@ def _resolve_within_model_dirs(model_path: str, model_dirs: list[str]) -> Path:
     raise ValueError("model_path is not under any configured model_dirs.")
 
 
+_model_dirs_warning_emitted = False
+
+
+def _assert_model_path_allowed(
+    launcher_cfg: Any, model_path: str | None, *, field: str
+) -> None:
+    """model_path が launcher.model_dirs 配下か検査(パスは書き換えない)。
+
+    M-1: ``/api/launcher/start`` と ``/sweep/start`` はこれまで任意の
+    ファイルシステムパスを spawn に渡していた。ここで ``model_dirs`` 配下に
+    限定する。ただし **検証のみ**で resolve 済みパスを spawn に渡さない
+    (macOS の /var→/private/var symlink で argv が変わり既存テストが落ちる)。
+    ``model_dirs`` 未設定なら従来どおり通し、一度だけ警告する。
+    """
+    global _model_dirs_warning_emitted
+    if not model_path:
+        return
+    model_dirs: list[str] = (
+        list(getattr(launcher_cfg, "model_dirs", []) or []) if launcher_cfg else []
+    )
+    if not model_dirs:
+        if not _model_dirs_warning_emitted:
+            logger.warning(
+                "launcher-model-dirs-unconfigured",
+                extra={
+                    "hint": (
+                        "launcher.model_dirs is empty; POST /api/launcher/start and "
+                        "/sweep/start accept any filesystem path. Configure "
+                        "launcher.model_dirs when the launcher is reachable from "
+                        "anything but loopback."
+                    )
+                },
+            )
+            _model_dirs_warning_emitted = True
+        return
+    try:
+        _resolve_within_model_dirs(model_path, model_dirs)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=f"{field}: {exc}") from exc
+
+
 def _option_tokens(options: dict[str, Any]) -> list[str]:
     """Flatten an ``options`` dict into CLI tokens (``{flag: val}`` semantics).
 
@@ -1410,6 +1451,8 @@ async def api_start(req: StartRequest, request: Request) -> dict[str, Any]:
     cfg = request.app.state.config
     launcher_cfg = getattr(cfg, "launcher", None)
     _assert_backend_declared(launcher_cfg, req.backend)
+    _assert_model_path_allowed(launcher_cfg, req.model_path, field="model_path")
+    _assert_model_path_allowed(launcher_cfg, req.draft_model_path, field="draft_model_path")
     # デバイス選択 → CLI 断片(llama.cpp のみ・選択された場合のみ)。未指定なら
     # None を渡し、既存の argv と完全一致(後方互換)。
     device_args: list[str] | None = None
@@ -1665,8 +1708,10 @@ class SweepRequest(BaseModel):
     options: dict[str, Any] = Field(default_factory=dict)
     extra_args: str = ""
     configs: list[SweepConfigItem] = Field(default_factory=list)
-    bench_command: str | None = None  # None なら launcher.bench 既定
-    runs: int | None = None
+    bench_preset: str | None = None  # None なら launcher.bench.default_preset / 暗黙 default
+    runs: int | None = Field(default=None, ge=1, le=1000)
+    # 廃止フィールド。黙って捨てると事故になるので api_sweep_start で 400 にする。
+    bench_command: str | None = None
     results_dir: str | None = None
 
 
@@ -1872,25 +1917,73 @@ class _SweepRunner:
         await self._safe_stop(mp.id)
 
 
-def _bench_defaults(launcher_cfg: Any) -> tuple[str, int, str | None, float]:
-    """launcher.bench(あれば)からベンチ既定を取り出す。無ければハードコード。"""
-    default_template = "llmbench run --model local-openai --runs {runs}"
-    default_runs = 5
-    default_results_dir: str | None = None
-    default_readiness = _DEFAULT_READINESS_TIMEOUT_S
+_HARDCODED_BENCH_TEMPLATE = "llmbench run --model local-openai --runs {runs}"
+_HARDCODED_BENCH_RUNS = 5
+
+
+@dataclass(frozen=True)
+class _ResolvedBench:
+    key: str
+    name: str
+    command_template: str
+    runs: int
+    results_dir: str | None
+    readiness_timeout_s: float
+
+
+def _bench_preset_map(launcher_cfg: Any) -> dict[str, Any]:
     bench_cfg = getattr(launcher_cfg, "bench", None) if launcher_cfg else None
-    if bench_cfg is not None:
-        default_template = bench_cfg.command_template
-        default_runs = bench_cfg.runs
-        default_results_dir = bench_cfg.results_dir
-        default_readiness = bench_cfg.readiness_timeout_s
-    return default_template, default_runs, default_results_dir, default_readiness
+    return dict(getattr(bench_cfg, "presets", {}) or {})
+
+
+def _resolve_bench(launcher_cfg: Any, preset_key: str | None) -> _ResolvedBench:
+    """H-2: リクエストの bench_preset を config 上の実体へ解決。無いキーは ValueError(→400)。"""
+    bench_cfg = getattr(launcher_cfg, "bench", None) if launcher_cfg else None
+    base_template = getattr(bench_cfg, "command_template", None) or _HARDCODED_BENCH_TEMPLATE
+    base_runs = getattr(bench_cfg, "runs", None) or _HARDCODED_BENCH_RUNS
+    base_results = getattr(bench_cfg, "results_dir", None)
+    readiness = getattr(bench_cfg, "readiness_timeout_s", None) or _DEFAULT_READINESS_TIMEOUT_S
+    presets = _bench_preset_map(launcher_cfg)
+    key = preset_key or getattr(bench_cfg, "default_preset", None)
+    if key is None or (key == "default" and "default" not in presets):
+        return _ResolvedBench(
+            key="default",
+            name="default (launcher.bench.command_template)",
+            command_template=base_template,
+            runs=base_runs,
+            results_dir=base_results,
+            readiness_timeout_s=readiness,
+        )
+    preset = presets.get(key)
+    if preset is None:
+        known = sorted(presets) or ["default"]
+        raise ValueError(
+            f"Unknown bench preset {key!r}. Declare it under launcher.bench.presets "
+            f"in providers.yaml (known: {known})."
+        )
+    return _ResolvedBench(
+        key=key,
+        name=preset.name,
+        command_template=preset.command_template,
+        runs=preset.runs if preset.runs is not None else base_runs,
+        results_dir=preset.results_dir if preset.results_dir is not None else base_results,
+        readiness_timeout_s=readiness,
+    )
 
 
 @router.post("/api/launcher/sweep/start")
 async def api_sweep_start(req: SweepRequest, request: Request) -> dict[str, Any]:
     """ベンチスイープを開始する(設計 §4.4 / §4.5)。書き込み系 → token 必須。"""
     _require_launcher_token(request)
+    if req.bench_command is not None or req.results_dir is not None:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                "bench_command / results_dir are no longer accepted from the request. "
+                "Declare the command under launcher.bench.presets in providers.yaml and "
+                "pass its key as 'bench_preset'."
+            ),
+        )
     app = request.app
 
     existing = getattr(app.state, "launcher_sweep", None)
@@ -1901,12 +1994,12 @@ async def api_sweep_start(req: SweepRequest, request: Request) -> dict[str, Any]
 
     cfg = app.state.config
     launcher_cfg = getattr(cfg, "launcher", None)
-    default_template, default_runs, default_results_dir, default_readiness = (
-        _bench_defaults(launcher_cfg)
-    )
-    bench_command = req.bench_command or default_template
-    runs = req.runs if req.runs is not None else default_runs
-    results_dir = req.results_dir if req.results_dir is not None else default_results_dir
+    try:
+        bench = _resolve_bench(launcher_cfg, req.bench_preset)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    runs = req.runs if req.runs is not None else bench.runs
+    _assert_model_path_allowed(launcher_cfg, req.model_path, field="model_path")
 
     # ポート競合: registry の使用中ポート照合 + best-effort な空きチェック。
     reg = _registry_for_app(app)
@@ -1945,17 +2038,60 @@ async def api_sweep_start(req: SweepRequest, request: Request) -> dict[str, Any]
         model_path=req.model_path,
         backend=req.backend,
         port=req.port,
-        bench_cmd_template=bench_command,
-        results_dir=results_dir,
+        bench_cmd_template=bench.command_template,
+        results_dir=bench.results_dir,
         options=req.options,
         extra_args=req.extra_args,
     )
     runner = _SweepRunner(
-        app, launcher_cfg, plan, runs=runs, readiness_timeout_s=default_readiness
+        app, launcher_cfg, plan, runs=runs, readiness_timeout_s=bench.readiness_timeout_s
     )
     app.state.launcher_sweep = runner
     runner.start()
-    return {"sweep_id": runner.sweep_id, "steps": [s.as_dict() for s in steps]}
+    return {
+        "sweep_id": runner.sweep_id,
+        "steps": [s.as_dict() for s in steps],
+        "bench_preset": bench.key,
+    }
+
+
+@router.get("/api/launcher/bench-presets")
+async def api_bench_presets(request: Request) -> dict[str, Any]:
+    """スイープ UI が選べるベンチプリセットのキー一覧。読み取り系 → 認証なし。
+
+    H-2: command_template はローカルパスが混ざりうるので **返さない**。
+    key/name/runs/has_results_dir だけ返す。presets に "default" が無ければ
+    暗黙 default(launcher.bench.command_template 由来)を先頭に挿入する。
+    """
+    cfg = request.app.state.config
+    launcher_cfg = getattr(cfg, "launcher", None)
+    bench_cfg = getattr(launcher_cfg, "bench", None) if launcher_cfg else None
+    presets = _bench_preset_map(launcher_cfg)
+    default_preset = getattr(bench_cfg, "default_preset", None)
+    base_results = getattr(bench_cfg, "results_dir", None)
+    base_runs = getattr(bench_cfg, "runs", None) or _HARDCODED_BENCH_RUNS
+    items: list[dict[str, Any]] = []
+    if "default" not in presets:
+        items.append(
+            {
+                "key": "default",
+                "name": "default (launcher.bench.command_template)",
+                "runs": base_runs,
+                "has_results_dir": base_results is not None,
+            }
+        )
+    for key, preset in presets.items():
+        items.append(
+            {
+                "key": key,
+                "name": preset.name,
+                "runs": preset.runs if preset.runs is not None else base_runs,
+                "has_results_dir": (
+                    preset.results_dir is not None or base_results is not None
+                ),
+            }
+        )
+    return {"presets": items, "default": default_preset}
 
 
 @router.get("/api/launcher/sweep/status")
@@ -2048,6 +2184,7 @@ _LAUNCHER_HTML = r"""<!doctype html>
     <a href="/dashboard" class="text-slate-400 hover:text-slate-200 transition-colors">Dashboard</a>
     <span class="text-slate-100 font-medium border-b border-indigo-400 pb-0.5">Launcher</span>
     <span id="status-msg" class="ml-auto text-xs text-slate-500"></span>
+    <button id="token-badge" onclick="promptToken()" class="btn-sm btn-red hidden">🔑 トークン未設定</button>
   </div>
 </header>
 
@@ -2213,18 +2350,12 @@ _LAUNCHER_HTML = r"""<!doctype html>
           <input id="sweep-port" type="number" value="8090" min="1024" max="65535" />
         </div>
         <div>
-          <label class="block text-xs text-slate-400 mb-1">ベンチコマンド ({port} {config} {base_url} {results_dir} {runs} を置換)</label>
-          <input id="sweep-cmd" type="text" placeholder="llmbench run --model local-openai --runs {runs}" />
+          <label class="block text-xs text-slate-400 mb-1">ベンチプリセット (providers.yaml の launcher.bench.presets)</label>
+          <select id="sweep-preset"></select>
         </div>
-        <div class="grid grid-cols-2 gap-2">
-          <div>
-            <label class="block text-xs text-slate-400 mb-1">runs</label>
-            <input id="sweep-runs" type="number" value="5" min="1" max="1000" />
-          </div>
-          <div>
-            <label class="block text-xs text-slate-400 mb-1">results_dir (任意)</label>
-            <input id="sweep-results" type="text" placeholder="results/" />
-          </div>
+        <div>
+          <label class="block text-xs text-slate-400 mb-1">runs</label>
+          <input id="sweep-runs" type="number" value="5" min="1" max="1000" />
         </div>
       </div>
     </div>
@@ -2269,15 +2400,31 @@ _LAUNCHER_HTML = r"""<!doctype html>
   "use strict";
 
   const POLL_MS = 3000;
-  // H8: launcher shared-secret. The server substitutes __LAUNCHER_TOKEN__
-  // with the configured token (or an empty string when auth is disabled).
-  const LAUNCHER_TOKEN = "__LAUNCHER_TOKEN__";
-  // Build headers for state-changing requests, adding the token only when set.
+  // H-3: the token is NEVER embedded in the HTML. The server only tells us
+  // whether auth is required; the token itself is entered by the operator and
+  // kept in sessionStorage (cleared when the tab closes).
+  const AUTH_REQUIRED = __LAUNCHER_AUTH_REQUIRED__;
+  const TOKEN_KEY = "coderouter-launcher-token";
+  let launcherToken = sessionStorage.getItem(TOKEN_KEY) || "";
   const authHeaders = (base) => {
     const h = Object.assign({}, base || {});
-    if (LAUNCHER_TOKEN) h["X-CodeRouter-Token"] = LAUNCHER_TOKEN;
+    if (launcherToken) h["X-CodeRouter-Token"] = launcherToken;
     return h;
   };
+  const updateTokenBadge = () => {
+    const el = document.getElementById("token-badge");
+    if (!el) return;
+    el.textContent = launcherToken ? "🔑 トークン設定済" : "🔑 トークン未設定";
+    el.className = "btn-sm " + (launcherToken ? "btn-slate" : "btn-red") + (AUTH_REQUIRED ? "" : " hidden");
+  };
+  window.promptToken = () => {
+    const v = window.prompt("CODEROUTER_LAUNCHER_TOKEN を入力してください", "");
+    if (v === null) return;
+    launcherToken = v.trim();
+    if (launcherToken) sessionStorage.setItem(TOKEN_KEY, launcherToken);
+    else sessionStorage.removeItem(TOKEN_KEY);
+    updateTokenBadge();
+  };
   let allProfiles = {};      // backend → [{name, args}]
   const _modelCache = {};    // index → {path, name, dir, size_gb}
   let selectedLogId = null;
@@ -2808,14 +2955,12 @@ _LAUNCHER_HTML = r"""<!doctype html>
                   tensor_split: c.tensor_split, backend: c.backend || null}));
     if (!configs.length) { showSweepErr("構成を 1 つ以上選択してください"); return; }
     const port = parseInt(document.getElementById("sweep-port").value);
-    const cmd = document.getElementById("sweep-cmd").value.trim();
+    const preset = document.getElementById("sweep-preset").value || null;
     const runs = parseInt(document.getElementById("sweep-runs").value);
-    const results = document.getElementById("sweep-results").value.trim();
     const body = {
       backend: "llama.cpp", model_path: model, port, configs,
-      bench_command: cmd || null,
+      bench_preset: preset,
       runs: isNaN(runs) ? null : runs,
-      results_dir: results || null,
     };
     try {
       const r = await fetch("/api/launcher/sweep/start", {
@@ -2970,12 +3115,12 @@ _LAUNCHER_HTML = r"""<!doctype html>
       const modelName = p.model_path.split("/").pop();
       const isActive = p.status === "running" || p.status === "loading" || p.status === "starting";
       const stopBtn = isActive
-        ? `<button onclick="stopProc('${p.id}')" class="btn-sm btn-red">■ 停止</button>`
+        ? `<button data-act="stop" data-id="${esc(p.id)}" class="btn-sm btn-red">■ 停止</button>`
         : "";
       const delBtn = !isActive
-        ? `<button onclick="deleteProc('${p.id}')" class="btn-sm btn-slate ml-1">✕</button>`
+        ? `<button data-act="del" data-id="${esc(p.id)}" class="btn-sm btn-slate ml-1">✕</button>`
         : "";
-      const logBtn = `<button onclick="openLog('${p.id}','${esc(p.name)}')" class="btn-sm btn-indigo ml-1">📋 ログ</button>`;
+      const logBtn = `<button data-act="log" data-id="${esc(p.id)}" data-name="${esc(p.name)}" class="btn-sm btn-indigo ml-1">📋 ログ</button>`;
       // [Unreleased]: swap badge — marks processes SwapManager spawned
       // on demand, distinct from manually-started ones. Title shows the
       // catalog model name when the backend supplied it.
@@ -2994,6 +3139,18 @@ _LAUNCHER_HTML = r"""<!doctype html>
     }).join("");
   };
 
+  // M-2: no inline onclick with interpolated process fields (XSS). The row
+  // buttons carry data-* attributes; a single delegated listener dispatches.
+  document.getElementById("proc-table").addEventListener("click", (ev) => {
+    const btn = ev.target.closest("button[data-act]");
+    if (!btn) return;
+    const id = btn.getAttribute("data-id");
+    const act = btn.getAttribute("data-act");
+    if (act === "stop") stopProc(id);
+    else if (act === "del") deleteProc(id);
+    else if (act === "log") openLog(id, btn.getAttribute("data-name") || "");
+  });
+
   window.stopProc = async (id) => {
     if (!confirm("プロセスを停止しますか?")) return;
     const r = await fetch(`/api/launcher/stop/${id}`, {method:"POST", headers: authHeaders()});
@@ -3051,11 +3208,35 @@ _LAUNCHER_HTML = r"""<!doctype html>
     document.getElementById("log-panel").classList.add("hidden");
   };
 
+  // H-2: fill the sweep preset <select> from config-declared presets. The
+  // command_template is never sent to the browser; the operator only picks a key.
+  const fetchBenchPresets = async () => {
+    try {
+      const r = await fetch("/api/launcher/bench-presets");
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      const d = await r.json();
+      const sel = document.getElementById("sweep-preset");
+      if (!sel) return;
+      const presets = d.presets || [];
+      sel.innerHTML = presets.map((p) => {
+        const runs = (p.runs != null) ? ` — runs ${p.runs}` : "";
+        return `<option value="${esc(p.key)}">${esc(p.name)}${runs}</option>`;
+      }).join("");
+      const chosen = d.default || "default";
+      const keys = presets.map((p) => p.key);
+      sel.value = keys.includes(chosen) ? chosen : (keys[0] || "");
+    } catch (e) {
+      console.error("[Launcher] fetchBenchPresets failed:", e);
+    }
+  };
+
   // ── Init + polling ───────────────────────────────────────────────────────
 
   const init = async () => {
     updateDeviceBlock();
-    await Promise.all([fetchModels(), fetchProfiles(), fetchBackends(), fetchProcesses()]);
+    updateTokenBadge();
+    if (AUTH_REQUIRED && !launcherToken) promptToken();
+    await Promise.all([fetchModels(), fetchProfiles(), fetchBackends(), fetchProcesses(), fetchBenchPresets()]);
     pollSweep();  // 既存スイープがあれば表示 (running なら以後のポーリングを継続)
   };
 
@@ -3078,18 +3259,13 @@ _LAUNCHER_HTML = r"""<!doctype html>
 async def launcher_page() -> HTMLResponse:
     """Serve the launcher single-page UI.
 
-    H8: inject the configured launcher token so the inline JS can attach it
-    to state-changing requests. When the env var is unset the placeholder
-    becomes an empty string and the UI keeps working unauthenticated (the
-    historical local-only default). The token is escaped for a JS string
-    context to avoid breaking out of the double-quoted literal.
+    H-3: the launcher token is NEVER embedded in the served HTML (it used to be
+    substituted into a JS string literal, so anyone who could read the page —
+    including a browser cache or a shoulder-surfer — recovered the shared
+    secret). We now only substitute a boolean ``__LAUNCHER_AUTH_REQUIRED__``
+    telling the client whether auth is on; the operator enters the token in the
+    browser and it lives in ``sessionStorage`` only.
     """
-    token = os.environ.get(_LAUNCHER_TOKEN_ENV, "")
-    safe_token = (
-        token.replace("\\", "\\\\")
-        .replace('"', '\\"')
-        .replace("<", "\\u003c")
-        .replace(">", "\\u003e")
-    )
-    html = _LAUNCHER_HTML.replace("__LAUNCHER_TOKEN__", safe_token)
+    auth_required = "true" if os.environ.get(_LAUNCHER_TOKEN_ENV, "") else "false"
+    html = _LAUNCHER_HTML.replace("__LAUNCHER_AUTH_REQUIRED__", auth_required)
     return HTMLResponse(content=html)

coderouter/launcher_devices.py

@@ -629,6 +629,10 @@ def render_bench_command(
     argv 化。
 
     ``str.format`` は JSON 波括弧等で誤爆するため単純置換を使う。
+
+    H-2: 置換より **先に** ``shlex.split`` でトークン化し、各トークン内でのみ
+    置換する。こうしないと ``{config}`` にスペースを含む値が入ったとき argv が
+    増殖し(引数注入)、想定外のフラグを外部ベンチに渡せてしまう。
     """
     mapping = {
         "port": str(port),
@@ -637,13 +641,16 @@ def render_bench_command(
         "results_dir": results_dir or "",
         "runs": str(runs) if runs is not None else "",
     }
-    rendered = template
-    for k, v in mapping.items():
-        rendered = rendered.replace("{" + k + "}", v)
     # ★ Windows: shlex の POSIX モードはバックスラッシュをエスケープ文字
     #   として食い潰し `C:\tools\llmbench.exe` を壊す。os.name で分岐して
     #   Windows では posix=False(バックスラッシュを素通し)にする。
-    return shlex.split(rendered, posix=(os.name != "nt"))
+    argv: list[str] = []
+    for tok in shlex.split(template, posix=(os.name != "nt")):
+        for k, v in mapping.items():
+            tok = tok.replace("{" + k + "}", v)
+        if tok:
+            argv.append(tok)
+    return argv
 
 
 # ---------------------------------------------------------------------------

{coderouter_cli-2.12.0.dist-info → coderouter_cli-2.13.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coderouter-cli
-Version: 2.12.0
+Version: 2.13.0
 Summary: Local-first, free-first, fallback-built-in LLM router. Claude Code / OpenAI compatible.
 Project-URL: Homepage, https://github.com/zephel01/CodeRouter
 Project-URL: Repository, https://github.com/zephel01/CodeRouter

{coderouter_cli-2.12.0.dist-info → coderouter_cli-2.13.0.dist-info}/RECORD

@@ -1,6 +1,6 @@
 coderouter/__init__.py,sha256=ghdjPrLtnRzY8fyQ4CJZI1UJKADyNTLtA3G7se8H7Ns,696
 coderouter/__main__.py,sha256=-LCgxJnvgUV240HjQKv7ly-mn2NuKHpC4nCpvTHjeSU,130
-coderouter/cli.py,sha256=2g-0HILLM16mNnkFUOR6lWXy5f6Y0LipCjo_YH4--j0,36896
+coderouter/cli.py,sha256=TyI29d8-Zc8SClcKn92Oj8DGyQRxMpBSWTxLiFTH3Qo,37043
 coderouter/cli_stats.py,sha256=CCjzc1G4hTRHZ2gG1XhxhDpUkJnnl3NXbcbp1T18jpg,29894
 coderouter/cost.py,sha256=32h6uzb4nxh2eA5d2Hn3kD9yJbtis6CFDAbeIy5KRkM,7431
 coderouter/doctor.py,sha256=wmPunlvqm2s7x3VGLjexqHPLD2oejwE3Mu04V8y-xn4,89869
@@ -10,7 +10,7 @@ coderouter/errors.py,sha256=Xmq67lheyw8iv3Ox39jh2c4tvNI5RcUR4QkoxVDN6l4,1130
 coderouter/gguf_introspect.py,sha256=Scu0JjUfLHj7T7TL0HQIm1AZcGYrXsjkaMMSN9HkTro,16121
 coderouter/hardware.py,sha256=gn3_9qbVcGRR81yKMn1lJE_8-YDRau0LxIH_M-f7pxE,8356
 coderouter/language_tax.py,sha256=LTbE3tIfoJuV2O3T0NixRKhzq_dEOTUuPEerJv2q9uk,9360
-coderouter/launcher_devices.py,sha256=Jd2hVJMsQZ0x6YFc_2ROvEc2L10b6dh77Y-gvP_Po8M,29039
+coderouter/launcher_devices.py,sha256=DAV34Q1crGptmj1zOAk21YQzlxQNAt5Ud7qcldTD95w,29406
 coderouter/launcher_speculative.py,sha256=h0RTGsD1Y56sJVywDJwybrT75_Ta3GF1Jz_B1d42aPg,12931
 coderouter/launcher_swap.py,sha256=tMW5ZElDdf9T1VQGsUkvfLiSCdj_oXN_UtkV7DE8ySY,24175
 coderouter/logging.py,sha256=5rfi4_R4aoeeUYDc642dgs61wA0aBX7wvubyB-k3Uyo,58074
@@ -26,8 +26,8 @@ coderouter/adapters/registry.py,sha256=XNc1wmFv_oZlqKS0rA693TRDdbq1sZ-OIcofXOVOt
 coderouter/config/__init__.py,sha256=FODEn74fN-qZnt4INPSHswqhOlEgpL6-_onxsitSx8g,274
 coderouter/config/capability_registry.py,sha256=RZgzHF54dXy0CCDocRCz2ee21qXGbbgTSKTkRI9iLL4,16936
 coderouter/config/env_file.py,sha256=CoMK27fuAXm-NtoLzXb8yN2E-wDFjHQuFwiIlmgTBQw,10356
-coderouter/config/loader.py,sha256=jUoHAbEyjK6Y0HDqhjXHO4tfncMPuzsjfWJokrPb2x8,6876
-coderouter/config/schemas.py,sha256=AK2lsPMqBa6NYEXNHwxis8Nd9bcW2q_x4ciO3QuYIpk,134441
+coderouter/config/loader.py,sha256=vk1LFm-OCiyq2GB5G53g7kTnrJgmQjkZPqgr9X13wpc,11294
+coderouter/config/schemas.py,sha256=J05km7-YXgNxy6guKUDcNsuMyJ21SnDIurjx8Rz_hSg,136672
 coderouter/data/__init__.py,sha256=uNyfD9jaCvTWsBAWtaw1Fr25OSxzv3psGMfBjT1z0Cc,328
 coderouter/data/model-capabilities.yaml,sha256=S9jt6SC6-3s2-icZ_n-a14iEMnc2yB1C2R6q-N_tZWQ,19309
 coderouter/guards/__init__.py,sha256=5qliYBqygvVPneej7nx0uSjxDKsz7t8VzvrDgVBJlvU,1170
@@ -39,13 +39,13 @@ coderouter/guards/drift_actions.py,sha256=A6pY5CR480Ct5rCVyjlBvjPFVc93eu_r5qcUpK
 coderouter/guards/drift_detection.py,sha256=lW45EZDGRleDUTstw_CHlfUiwLUrlDHX8g7ncuOYNEw,13962
 coderouter/guards/memory_budget.py,sha256=_bRtusk4AwrU781wVXW32OFU7zD2FXxOwTb7yGqPJqA,8278
 coderouter/guards/memory_pressure.py,sha256=9Xm-b7rv9Td5kPNmAFoL3sNmaOR5zT8NLdn6erWcuyY,8719
-coderouter/guards/self_healing.py,sha256=Qene73S1kqMJn8HYzHO-WT8hhWxKbo2v_JtXtEgpCp8,14434
+coderouter/guards/self_healing.py,sha256=XeUlgFWGqMQ5E9YvvzR2CsHRJOAJEyDChqRN0xmZ0vo,16841
 coderouter/guards/tool_loop.py,sha256=EzeMcmU7BLeTW2jsRVevU81l5rhWcn1oUr7EpzgXjVM,15209
 coderouter/ingress/__init__.py,sha256=WQsCH2CGJCAhy0mS6GSEdeYZRkkQu2OHDsP4CJWTLug,155
 coderouter/ingress/anthropic_routes.py,sha256=1ThXzx8VgxRV7UCi3NF5ey7kbr0ADPKTXyQuYS5gK1w,27063
-coderouter/ingress/app.py,sha256=6e_qNlYZIyjLKhY20t0ZNL-x5Fv8R8oaIH_HCdxa9Ic,20921
+coderouter/ingress/app.py,sha256=ZOx7dSvMxaWS4CzXOOEwgzFuycAVgAeWKCN6lFNF-F0,22433
 coderouter/ingress/dashboard_routes.py,sha256=1SqNNrVTfQiZcx5n2MvjAzWirittX0e61tCt-MKp4Ag,25617
-coderouter/ingress/launcher_routes.py,sha256=ipgY1omiSGQn5RBvsuQMLepCJ03w4eafacg2JDVufe8,133937
+coderouter/ingress/launcher_routes.py,sha256=uP_Otp9JE0fydUt1YP-wYcnS8Kj5RPLNIFf88YpfkPM,141535
 coderouter/ingress/metrics_routes.py,sha256=M22dwOGn24P05Ge4W3c7d7mYytSGWjIR-pPSPOAiHJY,3965
 coderouter/ingress/openai_routes.py,sha256=TrugsQNJfNPgKKLzfT1aXzrs4emWYGE4XebEBuaZoWk,12505
 coderouter/metrics/__init__.py,sha256=7Es351DPS7yLM0yVF_F0eesmiD83n7Zzhie44chht38,1465
@@ -72,8 +72,8 @@ coderouter/translation/anthropic.py,sha256=ZQQGS9itN_3o7IKD68lKr5gR_Kem32Jsd7OcG
 coderouter/translation/convert.py,sha256=VrstDAMsUpcQ1VgMTn_-ETp1OjGX8v0ZGhCkcd4icyU,53037
 coderouter/translation/tool_repair.py,sha256=1p8rmdyyscGX2g0DDOYitMnLv-nKfR1SLuLaRB4z7GM,64244
 coderouter/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-coderouter_cli-2.12.0.dist-info/METADATA,sha256=B1BU4vM2YPNzqR8sMFJy7vfPPUqBliwXqqpiLESl7mE,16897
-coderouter_cli-2.12.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-coderouter_cli-2.12.0.dist-info/entry_points.txt,sha256=-dnLfD1YZ2WjH2zSdNCvlO65wYltM9bsHt9Fhg3yGss,51
-coderouter_cli-2.12.0.dist-info/licenses/LICENSE,sha256=wkEzoR86jFw33jvfOHjULqmkGEfxTFMgMaJnpR8mPRw,1065
-coderouter_cli-2.12.0.dist-info/RECORD,,
+coderouter_cli-2.13.0.dist-info/METADATA,sha256=J6h8klUNsTIhWoMjrax70AR9nCFXYK_rFP2tbpChn8I,16897
+coderouter_cli-2.13.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+coderouter_cli-2.13.0.dist-info/entry_points.txt,sha256=-dnLfD1YZ2WjH2zSdNCvlO65wYltM9bsHt9Fhg3yGss,51
+coderouter_cli-2.13.0.dist-info/licenses/LICENSE,sha256=wkEzoR86jFw33jvfOHjULqmkGEfxTFMgMaJnpR8mPRw,1065
+coderouter_cli-2.13.0.dist-info/RECORD,,