coderouter-cli 2.12.0__py3-none-any.whl → 2.14.0__py3-none-any.whl

coderouter/adapters/anthropic_native.py

@@ -45,7 +45,7 @@ from coderouter.adapters.base import (
     ProviderCallOverrides,
     StreamChunk,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import get_logger, log_output_filter_applied
 from coderouter.output_filters import OutputFilterChain
 from coderouter.translation.anthropic import (
@@ -134,7 +134,9 @@ class AnthropicAdapter(BaseAdapter):
                 self.config.extra_body.get("anthropic_version", _DEFAULT_ANTHROPIC_VERSION)
             ),
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: see openai_compat._headers — same resolver, so an
+        # Anthropic-protocol provider can also ride a CLI session token.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["x-api-key"] = api_key
         # v0.4-D: forward the client's anthropic-beta header verbatim.

coderouter/adapters/openai_compat.py

@@ -29,7 +29,7 @@ from coderouter.adapters.base import (
     ProviderCallOverrides,
     StreamChunk,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import (
     get_logger,
     log_capability_degraded,
@@ -105,7 +105,10 @@ class OpenAICompatAdapter(BaseAdapter):
             "Content-Type": "application/json",
             "User-Agent": "CodeRouter/0.1",
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: resolve_provider_credential covers api_key_env (the
+        # historical path, unchanged) and credential.source=cli_session,
+        # which borrows the token a vendor CLI already wrote to disk.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["Authorization"] = f"Bearer {api_key}"
         return headers

coderouter/cli.py

@@ -149,6 +149,22 @@ def _build_parser() -> argparse.ArgumentParser:
             "See docs/guides/troubleshooting.md §5 for the threat model."
         ),
     )
+    # v2.14.0: --check-secrets is the runtime counterpart to --check-env.
+    # --check-env asks "is the file holding my keys protected?"; this asks
+    # "does the running process know its own secrets, and did any of them
+    # already reach a log file?". The second question is the one that used
+    # to have no answer at all.
+    doctor.add_argument(
+        "--check-secrets",
+        action="store_true",
+        help=(
+            "Audit credential hygiene: prove the log-redaction filter "
+            "actually scrubs, report which declared api_key_env vars are "
+            "set, flag credentials pasted into a base_url, and scan the "
+            "already-written requests.jsonl / audit.jsonl under state_dir "
+            "for live key values. Exit 0 clean / 2 needs attention / 1 leak."
+        ),
+    )
     doctor.add_argument(
         "--config",
         default=None,
@@ -192,6 +208,55 @@ def _build_parser() -> argparse.ArgumentParser:
         ),
     )
 
+    # v2.14.0: `coderouter rollback` — the missing half of --apply.
+    # Both writers (doctor --apply, vscode-init) already dropped a `.bak`
+    # next to every file they rewrote; nothing could put it back. Restore
+    # is a swap, not an overwrite, so running it twice returns you to
+    # where you started rather than destroying the newer version.
+    rollback = sub.add_parser(
+        "rollback",
+        help="Restore files a previous --apply / vscode-init rewrote (v2.14.0).",
+        description=(
+            "Swap each managed file with its .bak sibling: providers.yaml, "
+            "~/.coderouter/model-capabilities.yaml, and (with --workspace) "
+            ".vscode/settings.json and .envrc. The current contents become "
+            "the new .bak, so a second run toggles back. "
+            "Exit codes: 0 restored, 2 nothing to restore, 1 a restore failed."
+        ),
+    )
+    rollback.add_argument(
+        "--config",
+        default=None,
+        help=(
+            "Path to providers.yaml. Defaults to the same file the loader "
+            "would read ($CODEROUTER_CONFIG, then ~/.coderouter/providers.yaml)."
+        ),
+    )
+    rollback.add_argument(
+        "--workspace",
+        metavar="DIR",
+        default=None,
+        help=(
+            "Also restore the vscode-init outputs under DIR: "
+            "DIR/.vscode/settings.json and DIR/.envrc."
+        ),
+    )
+    rollback.add_argument(
+        "--path",
+        action="append",
+        metavar="FILE",
+        default=None,
+        help=(
+            "Restore exactly this file from its .bak sibling. Repeatable. "
+            "When given, the default discovery set is not used."
+        ),
+    )
+    rollback.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Report what would be restored without touching any file.",
+    )
+
     # v1.5-C: `coderouter stats` — live TUI over GET /metrics.json.
     # Lazy-imports ``curses`` inside the runner so the CLI boot stays
     # snappy and environments without curses (rare, but e.g. minimal
@@ -490,6 +555,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.command == "doctor":
         return _run_doctor(args)
 
+    if args.command == "rollback":
+        return _run_rollback(args)
+
     if args.command == "stats":
         # v1.5-C: stats is intentionally a thin wrapper — all logic
         # (fetch, render, curses loop) lives in coderouter.cli_stats so
@@ -526,9 +594,11 @@ def _run_doctor(args: argparse.Namespace) -> int:
     worst-case of the two reports so CI guarding against both leak
     risks AND broken providers can use a single command.
     """
-    if args.check_model is None and args.check_env is None:
+    check_secrets = bool(getattr(args, "check_secrets", False))
+    if args.check_model is None and args.check_env is None and not check_secrets:
         print(
-            "doctor: provide --check-model PROVIDER and/or --check-env [PATH]",
+            "doctor: provide --check-model PROVIDER, --check-env [PATH], "
+            "and/or --check-secrets",
             file=sys.stderr,
         )
         return 1
@@ -541,6 +611,9 @@ def _run_doctor(args: argparse.Namespace) -> int:
     if args.check_env is not None:
         worst_exit = max(worst_exit, _run_check_env(args.check_env))
 
+    if check_secrets:
+        worst_exit = max(worst_exit, _run_check_secrets(args.config))
+
     if args.check_model is not None:
         worst_exit = max(worst_exit, _run_check_model(args))
 
@@ -600,28 +673,27 @@ def _run_check_model(args: argparse.Namespace) -> int:
 
 
 def _resolve_config_path(explicit: str | None) -> Path:
-    """Mirror loader._candidate_paths and return the file actually used.
-
-    Used by ``--apply`` to write back to the same path the loader
-    picked up when it parsed providers.yaml. Falls through the same
-    search order so a ``CODEROUTER_CONFIG`` env or default-path lookup
-    matches the live config.
+    """Return the file the loader actually read, for ``--apply`` write-back.
+
+    Delegates the search order to
+    :func:`coderouter.config.loader.resolve_config_path` rather than
+    re-implementing it. Re-implementing it here is exactly how the
+    v2.13.0 CWD opt-in change would introduce a silent bug: if the loader
+    gates ``./providers.yaml`` behind ``CODEROUTER_ALLOW_CWD_CONFIG`` but
+    this copy still searched CWD unconditionally, ``doctor --apply`` would
+    write patches back into a file that ``load_config`` never read. Keeping
+    one source of truth makes that impossible.
+
+    When nothing exists, falls back to ``~/.coderouter/providers.yaml``
+    (the loader's last candidate) — the apply step surfaces a clearer
+    error against that path than this resolver would.
     """
-    import os
+    from coderouter.config.loader import resolve_config_path
 
-    candidates: list[Path] = []
-    if explicit:
-        candidates.append(Path(explicit))
-    if env_path := os.environ.get("CODEROUTER_CONFIG"):
-        candidates.append(Path(env_path))
-    candidates.append(Path.cwd() / "providers.yaml")
-    candidates.append(Path.home() / ".coderouter" / "providers.yaml")
-    for p in candidates:
-        if p.is_file():
-            return p
-    # Fall back to the last candidate even if absent — the apply step
-    # will surface a clearer error than this resolver would.
-    return candidates[-1]
+    resolved = resolve_config_path(explicit)
+    if resolved is not None:
+        return resolved
+    return Path.home() / ".coderouter" / "providers.yaml"
 
 
 def _write_verdict_line(*, write: bool, files_written: int) -> None:
@@ -970,5 +1042,70 @@ def _run_check_env(arg_value: str) -> int:
     return exit_code_for_env_security(report)
 
 
+def _run_rollback(args: argparse.Namespace) -> int:
+    """v2.14.0: put back what ``--apply`` / ``vscode-init`` overwrote.
+
+    Explicit ``--path`` wins over discovery so an operator can restore one
+    file without also reverting an unrelated ``model-capabilities.yaml``
+    edit from last week. Discovery resolves providers.yaml through the
+    loader's own search order rather than a second copy of it.
+    """
+    from coderouter.rollback import (
+        discover_managed_files,
+        exit_code_for_rollback,
+        format_rollback_report,
+        restore_many,
+    )
+
+    explicit = getattr(args, "path", None)
+    if explicit:
+        targets: list[Path] = [Path(p).expanduser() for p in explicit]
+    else:
+        try:
+            config_path: Path | None = _resolve_config_path(args.config)
+        except Exception:
+            # No config anywhere is not fatal here — the workspace files
+            # and the user-layer capabilities file may still have backups.
+            config_path = None
+        targets = discover_managed_files(
+            config_path=config_path,
+            workspace=getattr(args, "workspace", None),
+        )
+
+    outcomes = restore_many(targets, dry_run=bool(args.dry_run))
+    print(format_rollback_report(outcomes, dry_run=bool(args.dry_run)))
+    return exit_code_for_rollback(outcomes)
+
+
+def _run_check_secrets(config_path: str | None) -> int:
+    """v2.14.0: credential-hygiene audit for the running configuration.
+
+    Loads the config through the normal loader — which is also what arms
+    the redaction registry — then runs the suite from
+    :mod:`coderouter.secret_redaction`. A config that fails to load is a
+    blocker (exit 1) rather than a skip: we cannot claim anything about
+    secret hygiene for a file we could not read.
+    """
+    from coderouter.config.loader import load_config
+    from coderouter.secret_redaction import (
+        check_secret_hygiene,
+        exit_code_for_secret_report,
+        format_secret_report,
+    )
+
+    try:
+        config = load_config(config_path)
+    except FileNotFoundError as exc:
+        print(f"doctor: {exc}", file=sys.stderr)
+        return 1
+    except Exception as exc:
+        print(f"doctor: failed to load config: {exc}", file=sys.stderr)
+        return 1
+
+    report = check_secret_hygiene(config)
+    print(format_secret_report(report))
+    return exit_code_for_secret_report(report)
+
+
 if __name__ == "__main__":
     sys.exit(main())

coderouter/config/loader.py

@@ -3,21 +3,26 @@
 Search order (first hit wins):
     1. Path passed explicitly (CLI --config flag)
     2. $CODEROUTER_CONFIG env var
-    3. ./providers.yaml (current working dir)
+    3. ./providers.yaml (current working dir) — opt-in since v2.13.0,
+       gated behind ``CODEROUTER_ALLOW_CWD_CONFIG`` (truthy: 1/true/yes/on)
     4. ~/.coderouter/providers.yaml
 
 Secrets are resolved by reading the env var named by `api_key_env`.
 
 .. note::
-    **[Unreleased] deprecation notice (planned v2.12.0):** step 3 above
-    (implicit CWD discovery) is slated to become opt-in, gated behind
-    ``CODEROUTER_ALLOW_CWD_CONFIG``. Landing that change without warning
-    first would silently break anyone currently relying on "run from the
-    directory with providers.yaml in it" with no diagnostic. Until that
-    lands, :func:`load_config` emits a one-time ``cwd-config-loaded``
-    warning whenever step 3 is the one that actually resolved — never
-    when an explicit ``--config`` / ``CODEROUTER_CONFIG`` path was used,
-    even if it happens to point at the same file.
+    **v2.13.0 (security):** step 3 above (implicit CWD discovery) is now
+    opt-in, gated behind ``CODEROUTER_ALLOW_CWD_CONFIG``. It was a code
+    execution vector: a hostile ``providers.yaml`` dropped into a repo
+    could steer ``restart_command`` / ``launcher.backends[*].binary`` /
+    ``launcher.bench.command_template`` — all of which name executables —
+    simply because CodeRouter happened to be started from that directory.
+    When the opt-in is enabled and step 3 resolves the config, a one-time
+    ``cwd-config-loaded`` warning fires (never when an explicit
+    ``--config`` / ``CODEROUTER_CONFIG`` path was used, even if it happens
+    to point at the same file). When the opt-in is NOT set but a
+    ``./providers.yaml`` exists and was not explicitly named, a one-time
+    ``cwd-config-skipped`` warning fires so the operator understands why
+    that file was ignored.
 """
 
 from __future__ import annotations
@@ -29,13 +34,29 @@ import yaml
 
 from coderouter.config.schemas import CodeRouterConfig
 from coderouter.logging import get_logger
+from coderouter.secret_redaction import register_config_secrets, register_secret
 
 logger = get_logger(__name__)
 
-# Guards the one-time [Unreleased]/v2.12.0 CWD-config deprecation warning
-# (see module docstring) so a process that calls load_config() repeatedly
-# (tests, hot-reload, multiple create_app() calls) only logs it once.
+# Name of the env var that opts CWD ``providers.yaml`` discovery back in
+# (see module docstring). v2.13.0 gates step 3 of the search behind it.
+CWD_CONFIG_ENV = "CODEROUTER_ALLOW_CWD_CONFIG"
+# Truthy vocabulary shared by every CWD-opt-in / ALLOW_PAID style toggle.
+_TRUTHY = {"1", "true", "yes", "on"}
+
+# Guards the one-time ``cwd-config-loaded`` warning (opt-in enabled and the
+# CWD step actually resolved) so a process that calls load_config()
+# repeatedly (tests, hot-reload, multiple create_app() calls) only logs it
+# once.
 _cwd_config_warning_emitted = False
+# Guards the one-time ``cwd-config-skipped`` warning (opt-in NOT set but a
+# ./providers.yaml exists and was ignored) — same once-per-process rationale.
+_cwd_config_skip_warning_emitted = False
+
+
+def cwd_config_allowed() -> bool:
+    """True iff the CWD ``providers.yaml`` opt-in is enabled (v2.13.0)."""
+    return os.environ.get(CWD_CONFIG_ENV, "").strip().lower() in _TRUTHY
 
 
 def _candidate_paths(explicit: str | os.PathLike[str] | None) -> list[Path]:
@@ -44,27 +65,58 @@ def _candidate_paths(explicit: str | os.PathLike[str] | None) -> list[Path]:
         paths.append(Path(explicit))
     if env_path := os.environ.get("CODEROUTER_CONFIG"):
         paths.append(Path(env_path))
-    paths.append(Path.cwd() / "providers.yaml")
+    # v2.13.0: implicit CWD discovery is opt-in — a hostile providers.yaml
+    # dropped into a repo could otherwise steer restart_command / launcher
+    # binaries simply because CodeRouter was started from that directory.
+    if cwd_config_allowed():
+        paths.append(Path.cwd() / "providers.yaml")
     paths.append(Path.home() / ".coderouter" / "providers.yaml")
     return paths
 
 
+def resolve_config_path(
+    explicit: str | os.PathLike[str] | None = None,
+) -> Path | None:
+    """Return the config file the loader would pick, or None if none exists.
+
+    Single source of truth for the search order so callers (e.g.
+    ``coderouter.cli._resolve_config_path`` driving ``doctor --apply``)
+    never re-implement it. Re-implementing it risks writing back to a
+    different file than the one :func:`load_config` actually read — the
+    exact regression the v2.13.0 CWD opt-in would otherwise introduce.
+    """
+    return next((p for p in _candidate_paths(explicit) if p.is_file()), None)
+
+
+def _explicitly_named(
+    path: Path, explicit: str | os.PathLike[str] | None
+) -> bool:
+    """True iff ``path`` matches the literal --config or CODEROUTER_CONFIG value.
+
+    Used to keep the CWD warnings quiet when ``./providers.yaml`` was
+    chosen on purpose (an explicit choice, however coincidental, is not
+    the implicit-discovery behaviour being gated).
+    """
+    if explicit and Path(explicit) == path:
+        return True
+    env_path = os.environ.get("CODEROUTER_CONFIG")
+    return env_path is not None and Path(env_path) == path
+
+
 def _warn_if_cwd_config(
     chosen: Path, *, explicit: str | os.PathLike[str] | None
 ) -> None:
-    """Emit the one-time [Unreleased]/v2.12.0 CWD-config deprecation warning.
+    """Emit the one-time ``cwd-config-loaded`` warning (opt-in is enabled).
 
     Only fires when ``chosen`` was resolved via the *implicit* CWD-search
-    step. Compares ``chosen`` against the *literal* explicit / env
-    candidate paths (not merely whether those inputs were set) so that:
-
-      * an explicit ``--config`` (or ``CODEROUTER_CONFIG``) path that
-        happens to coincide with ``./providers.yaml`` stays quiet — an
-        explicit choice, however coincidental, is not the thing being
-        deprecated; but
-      * an explicit path/env var that was set but did NOT resolve (file
-        missing, so the search fell through to CWD) still warns, because
-        the CWD step is what actually served the config in that case.
+    step — which, since v2.13.0, only runs when
+    ``CODEROUTER_ALLOW_CWD_CONFIG`` is set. Compares ``chosen`` against the
+    *literal* explicit / env candidate paths (not merely whether those
+    inputs were set) so that an explicit ``--config`` (or
+    ``CODEROUTER_CONFIG``) path that happens to coincide with
+    ``./providers.yaml`` stays quiet, while an explicit path/env var that
+    was set but did NOT resolve (file missing, search fell through to CWD)
+    still warns — the CWD step is what actually served the config there.
     """
     global _cwd_config_warning_emitted
     if _cwd_config_warning_emitted:
@@ -72,9 +124,7 @@ def _warn_if_cwd_config(
     cwd_path = Path.cwd() / "providers.yaml"
     if chosen != cwd_path:
         return
-    if explicit and Path(explicit) == chosen:
-        return
-    if (env_path := os.environ.get("CODEROUTER_CONFIG")) and Path(env_path) == chosen:
+    if _explicitly_named(chosen, explicit):
         return
 
     _cwd_config_warning_emitted = True
@@ -84,26 +134,76 @@ def _warn_if_cwd_config(
             "path": str(chosen),
             "hint": (
                 f"loaded providers.yaml from the current working "
-                f"directory ({chosen}). Starting in v2.12.0, this "
-                "implicit CWD discovery becomes opt-in (gated behind "
-                "CODEROUTER_ALLOW_CWD_CONFIG) — pass --config or set "
-                "CODEROUTER_CONFIG to pin the file explicitly and avoid "
-                "a startup break when that lands."
+                f"directory ({chosen}) because CODEROUTER_ALLOW_CWD_CONFIG "
+                "opt-in is enabled. This file's restart_command / "
+                "launcher.backends[*].binary / "
+                "launcher.bench.command_template decide which executables "
+                "run — only enable the opt-in in directories you trust."
             ),
         },
     )
 
 
+def _warn_if_cwd_config_skipped(
+    explicit: str | os.PathLike[str] | None,
+) -> Path | None:
+    """Warn once when a ./providers.yaml exists but was skipped (no opt-in).
+
+    Returns the skipped CWD path (so :func:`load_config` can name it in a
+    later ``FileNotFoundError``), or None when there is nothing to skip:
+    the opt-in is enabled, no ``./providers.yaml`` exists, or the file was
+    explicitly named (``--config`` / ``CODEROUTER_CONFIG``) — in which case
+    it is not being skipped at all.
+    """
+    global _cwd_config_skip_warning_emitted
+    if cwd_config_allowed():
+        return None
+    cwd_path = Path.cwd() / "providers.yaml"
+    if not cwd_path.is_file():
+        return None
+    if _explicitly_named(cwd_path, explicit):
+        return None
+
+    if not _cwd_config_skip_warning_emitted:
+        _cwd_config_skip_warning_emitted = True
+        logger.warning(
+            "cwd-config-skipped",
+            extra={
+                "path": str(cwd_path),
+                "hint": (
+                    f"found providers.yaml in the current working "
+                    f"directory ({cwd_path}) but did NOT load it: implicit "
+                    "CWD discovery is opt-in since v2.13.0 (a hostile "
+                    "providers.yaml can steer restart_command / launcher "
+                    "binaries). To use it, set CODEROUTER_ALLOW_CWD_CONFIG=1 "
+                    "(only in directories you trust) or pass --config "
+                    f"{cwd_path} to name it explicitly."
+                ),
+            },
+        )
+    return cwd_path
+
+
 def load_config(path: str | os.PathLike[str] | None = None) -> CodeRouterConfig:
     """Load providers.yaml + apply ALLOW_PAID env override."""
+    skipped_cwd = _warn_if_cwd_config_skipped(path)
     candidates = _candidate_paths(path)
     chosen: Path | None = next((p for p in candidates if p.is_file()), None)
     if chosen is None:
         searched = "\n  ".join(str(p) for p in candidates)
-        raise FileNotFoundError(
+        message = (
             f"providers.yaml not found. Searched:\n  {searched}\n"
             f"Hint: copy examples/providers.yaml to ~/.coderouter/providers.yaml"
         )
+        if skipped_cwd is not None:
+            message += (
+                f"\nNote: {skipped_cwd} exists but was NOT read — implicit "
+                "CWD discovery is opt-in since v2.13.0. Three ways to use "
+                f"it: pass --config {skipped_cwd}, set "
+                f"CODEROUTER_CONFIG={skipped_cwd}, or set "
+                "CODEROUTER_ALLOW_CWD_CONFIG=1 (only in directories you trust)."
+            )
+        raise FileNotFoundError(message)
     _warn_if_cwd_config(chosen, explicit=path)
 
     with chosen.open("r", encoding="utf-8") as f:
@@ -154,12 +254,34 @@ def load_config(path: str | os.PathLike[str] | None = None) -> CodeRouterConfig:
     elif env_paid in {"0", "false", "no", "off"}:
         config.allow_paid = False
 
+    # v2.14.0: arm log redaction before anything else runs. Registering here
+    # (rather than lazily on the first resolve_api_key call) means the
+    # startup log lines — which name providers and profiles — are already
+    # scrubbed, and so is any config-validation error raised downstream.
+    # Only labels are logged; the values never leave the registry.
+    registered = register_config_secrets(config)
+    if registered:
+        logger.info(
+            "secret-redaction-armed",
+            extra={"count": len(registered), "labels": sorted(set(registered))},
+        )
+
     return config
 
 
 def resolve_api_key(api_key_env: str | None) -> str | None:
-    """Look up an API key from the named env var. Returns None if unset."""
+    """Look up an API key from the named env var. Returns None if unset.
+
+    v2.14.0: the resolved value is registered with
+    :mod:`coderouter.secret_redaction` before it is handed out. This is the
+    moment a credential enters the process, so it is the one place that can
+    guarantee the log scrubber knows about every key we actually use —
+    including keys for providers added by an adapter plugin, which never
+    pass through ``register_config_secrets``.
+    """
     if not api_key_env:
         return None
     value = os.environ.get(api_key_env, "").strip()
+    if value:
+        register_secret(value, api_key_env)
     return value or None