coderouter-cli 2.12.0__py3-none-any.whl → 2.14.0__py3-none-any.whl

coderouter/ingress/dashboard_routes.py

@@ -34,9 +34,11 @@ Why inline JS / CSS
 
 from __future__ import annotations
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Request
 from fastapi.responses import HTMLResponse
 
+from coderouter.ingress.ui_auth import auth_required, require_ui_token
+
 router = APIRouter()
 
 
@@ -219,6 +221,17 @@ _DASHBOARD_HTML = r"""<!doctype html>
   // Poll interval — 2s matches plan.md §12.3.5. Short enough to feel
   // live on a local dev machine, long enough that HTTP overhead is noise.
   const POLL_MS = 2000;
+  // v2.14.0: the token is entered by the operator and kept in
+  // sessionStorage (cleared when the tab closes). The page is told only
+  // whether auth is on, never what the token is.
+  const AUTH_REQUIRED = __METRICS_AUTH_REQUIRED__;
+  const TOKEN_KEY = "coderouter-metrics-token";
+  let metricsToken = sessionStorage.getItem(TOKEN_KEY) || "";
+  if (AUTH_REQUIRED && !metricsToken) {
+    const v = window.prompt("CODEROUTER_METRICS_TOKEN を入力してください", "");
+    if (v) { metricsToken = v.trim(); sessionStorage.setItem(TOKEN_KEY, metricsToken); }
+  }
+  const authHeaders = () => metricsToken ? {"X-CodeRouter-Token": metricsToken} : {};
   // Sparkline ring — 60 samples at 2s/sample → 2 minutes of history.
   const SPARK_POINTS = 60;
   const sparkBuffer = [];
@@ -524,7 +537,7 @@ _DASHBOARD_HTML = r"""<!doctype html>
 
   const poll = async () => {
     try {
-      const resp = await fetch("/metrics.json", {cache: "no-store"});
+      const resp = await fetch("/metrics.json", {cache: "no-store", headers: authHeaders()});
       if (!resp.ok) {
         renderError("HTTP " + resp.status);
         return;
@@ -547,7 +560,7 @@ _DASHBOARD_HTML = r"""<!doctype html>
 
 
 @router.get("/dashboard", response_class=HTMLResponse)
-async def dashboard() -> HTMLResponse:
+async def dashboard(request: Request) -> HTMLResponse:
     """Serve the single-page dashboard HTML.
 
     The page is entirely static — all data comes from polling
@@ -556,4 +569,11 @@ async def dashboard() -> HTMLResponse:
     the template lives in this module as a string, keeping the shipping
     unit a single Python file with no template dir to configure.
     """
-    return HTMLResponse(content=_DASHBOARD_HTML)
+    require_ui_token(request)
+    # Only the boolean reaches the page — never the token. Same split the
+    # v2.13.0 launcher fix introduced after ``curl /launcher | grep``
+    # recovered the shared secret straight out of the HTML.
+    html = _DASHBOARD_HTML.replace(
+        "__METRICS_AUTH_REQUIRED__", "true" if auth_required() else "false"
+    )
+    return HTMLResponse(content=html)

coderouter/ingress/launcher_routes.py

@@ -552,6 +552,47 @@ def _resolve_within_model_dirs(model_path: str, model_dirs: list[str]) -> Path:
     raise ValueError("model_path is not under any configured model_dirs.")
 
 
+_model_dirs_warning_emitted = False
+
+
+def _assert_model_path_allowed(
+    launcher_cfg: Any, model_path: str | None, *, field: str
+) -> None:
+    """model_path が launcher.model_dirs 配下か検査(パスは書き換えない)。
+
+    M-1: ``/api/launcher/start`` と ``/sweep/start`` はこれまで任意の
+    ファイルシステムパスを spawn に渡していた。ここで ``model_dirs`` 配下に
+    限定する。ただし **検証のみ**で resolve 済みパスを spawn に渡さない
+    (macOS の /var→/private/var symlink で argv が変わり既存テストが落ちる)。
+    ``model_dirs`` 未設定なら従来どおり通し、一度だけ警告する。
+    """
+    global _model_dirs_warning_emitted
+    if not model_path:
+        return
+    model_dirs: list[str] = (
+        list(getattr(launcher_cfg, "model_dirs", []) or []) if launcher_cfg else []
+    )
+    if not model_dirs:
+        if not _model_dirs_warning_emitted:
+            logger.warning(
+                "launcher-model-dirs-unconfigured",
+                extra={
+                    "hint": (
+                        "launcher.model_dirs is empty; POST /api/launcher/start and "
+                        "/sweep/start accept any filesystem path. Configure "
+                        "launcher.model_dirs when the launcher is reachable from "
+                        "anything but loopback."
+                    )
+                },
+            )
+            _model_dirs_warning_emitted = True
+        return
+    try:
+        _resolve_within_model_dirs(model_path, model_dirs)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=f"{field}: {exc}") from exc
+
+
 def _option_tokens(options: dict[str, Any]) -> list[str]:
     """Flatten an ``options`` dict into CLI tokens (``{flag: val}`` semantics).
 
@@ -1410,6 +1451,8 @@ async def api_start(req: StartRequest, request: Request) -> dict[str, Any]:
     cfg = request.app.state.config
     launcher_cfg = getattr(cfg, "launcher", None)
     _assert_backend_declared(launcher_cfg, req.backend)
+    _assert_model_path_allowed(launcher_cfg, req.model_path, field="model_path")
+    _assert_model_path_allowed(launcher_cfg, req.draft_model_path, field="draft_model_path")
     # デバイス選択 → CLI 断片(llama.cpp のみ・選択された場合のみ)。未指定なら
     # None を渡し、既存の argv と完全一致(後方互換)。
     device_args: list[str] | None = None
@@ -1665,8 +1708,10 @@ class SweepRequest(BaseModel):
     options: dict[str, Any] = Field(default_factory=dict)
     extra_args: str = ""
     configs: list[SweepConfigItem] = Field(default_factory=list)
-    bench_command: str | None = None  # None なら launcher.bench 既定
-    runs: int | None = None
+    bench_preset: str | None = None  # None なら launcher.bench.default_preset / 暗黙 default
+    runs: int | None = Field(default=None, ge=1, le=1000)
+    # 廃止フィールド。黙って捨てると事故になるので api_sweep_start で 400 にする。
+    bench_command: str | None = None
     results_dir: str | None = None
 
 
@@ -1872,25 +1917,73 @@ class _SweepRunner:
         await self._safe_stop(mp.id)
 
 
-def _bench_defaults(launcher_cfg: Any) -> tuple[str, int, str | None, float]:
-    """launcher.bench(あれば)からベンチ既定を取り出す。無ければハードコード。"""
-    default_template = "llmbench run --model local-openai --runs {runs}"
-    default_runs = 5
-    default_results_dir: str | None = None
-    default_readiness = _DEFAULT_READINESS_TIMEOUT_S
+_HARDCODED_BENCH_TEMPLATE = "llmbench run --model local-openai --runs {runs}"
+_HARDCODED_BENCH_RUNS = 5
+
+
+@dataclass(frozen=True)
+class _ResolvedBench:
+    key: str
+    name: str
+    command_template: str
+    runs: int
+    results_dir: str | None
+    readiness_timeout_s: float
+
+
+def _bench_preset_map(launcher_cfg: Any) -> dict[str, Any]:
     bench_cfg = getattr(launcher_cfg, "bench", None) if launcher_cfg else None
-    if bench_cfg is not None:
-        default_template = bench_cfg.command_template
-        default_runs = bench_cfg.runs
-        default_results_dir = bench_cfg.results_dir
-        default_readiness = bench_cfg.readiness_timeout_s
-    return default_template, default_runs, default_results_dir, default_readiness
+    return dict(getattr(bench_cfg, "presets", {}) or {})
+
+
+def _resolve_bench(launcher_cfg: Any, preset_key: str | None) -> _ResolvedBench:
+    """H-2: リクエストの bench_preset を config 上の実体へ解決。無いキーは ValueError(→400)。"""
+    bench_cfg = getattr(launcher_cfg, "bench", None) if launcher_cfg else None
+    base_template = getattr(bench_cfg, "command_template", None) or _HARDCODED_BENCH_TEMPLATE
+    base_runs = getattr(bench_cfg, "runs", None) or _HARDCODED_BENCH_RUNS
+    base_results = getattr(bench_cfg, "results_dir", None)
+    readiness = getattr(bench_cfg, "readiness_timeout_s", None) or _DEFAULT_READINESS_TIMEOUT_S
+    presets = _bench_preset_map(launcher_cfg)
+    key = preset_key or getattr(bench_cfg, "default_preset", None)
+    if key is None or (key == "default" and "default" not in presets):
+        return _ResolvedBench(
+            key="default",
+            name="default (launcher.bench.command_template)",
+            command_template=base_template,
+            runs=base_runs,
+            results_dir=base_results,
+            readiness_timeout_s=readiness,
+        )
+    preset = presets.get(key)
+    if preset is None:
+        known = sorted(presets) or ["default"]
+        raise ValueError(
+            f"Unknown bench preset {key!r}. Declare it under launcher.bench.presets "
+            f"in providers.yaml (known: {known})."
+        )
+    return _ResolvedBench(
+        key=key,
+        name=preset.name,
+        command_template=preset.command_template,
+        runs=preset.runs if preset.runs is not None else base_runs,
+        results_dir=preset.results_dir if preset.results_dir is not None else base_results,
+        readiness_timeout_s=readiness,
+    )
 
 
 @router.post("/api/launcher/sweep/start")
 async def api_sweep_start(req: SweepRequest, request: Request) -> dict[str, Any]:
     """ベンチスイープを開始する(設計 §4.4 / §4.5)。書き込み系 → token 必須。"""
     _require_launcher_token(request)
+    if req.bench_command is not None or req.results_dir is not None:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                "bench_command / results_dir are no longer accepted from the request. "
+                "Declare the command under launcher.bench.presets in providers.yaml and "
+                "pass its key as 'bench_preset'."
+            ),
+        )
     app = request.app
 
     existing = getattr(app.state, "launcher_sweep", None)
@@ -1901,12 +1994,12 @@ async def api_sweep_start(req: SweepRequest, request: Request) -> dict[str, Any]
 
     cfg = app.state.config
     launcher_cfg = getattr(cfg, "launcher", None)
-    default_template, default_runs, default_results_dir, default_readiness = (
-        _bench_defaults(launcher_cfg)
-    )
-    bench_command = req.bench_command or default_template
-    runs = req.runs if req.runs is not None else default_runs
-    results_dir = req.results_dir if req.results_dir is not None else default_results_dir
+    try:
+        bench = _resolve_bench(launcher_cfg, req.bench_preset)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    runs = req.runs if req.runs is not None else bench.runs
+    _assert_model_path_allowed(launcher_cfg, req.model_path, field="model_path")
 
     # ポート競合: registry の使用中ポート照合 + best-effort な空きチェック。
     reg = _registry_for_app(app)
@@ -1945,17 +2038,60 @@ async def api_sweep_start(req: SweepRequest, request: Request) -> dict[str, Any]
         model_path=req.model_path,
         backend=req.backend,
         port=req.port,
-        bench_cmd_template=bench_command,
-        results_dir=results_dir,
+        bench_cmd_template=bench.command_template,
+        results_dir=bench.results_dir,
         options=req.options,
         extra_args=req.extra_args,
     )
     runner = _SweepRunner(
-        app, launcher_cfg, plan, runs=runs, readiness_timeout_s=default_readiness
+        app, launcher_cfg, plan, runs=runs, readiness_timeout_s=bench.readiness_timeout_s
     )
     app.state.launcher_sweep = runner
     runner.start()
-    return {"sweep_id": runner.sweep_id, "steps": [s.as_dict() for s in steps]}
+    return {
+        "sweep_id": runner.sweep_id,
+        "steps": [s.as_dict() for s in steps],
+        "bench_preset": bench.key,
+    }
+
+
+@router.get("/api/launcher/bench-presets")
+async def api_bench_presets(request: Request) -> dict[str, Any]:
+    """スイープ UI が選べるベンチプリセットのキー一覧。読み取り系 → 認証なし。
+
+    H-2: command_template はローカルパスが混ざりうるので **返さない**。
+    key/name/runs/has_results_dir だけ返す。presets に "default" が無ければ
+    暗黙 default(launcher.bench.command_template 由来)を先頭に挿入する。
+    """
+    cfg = request.app.state.config
+    launcher_cfg = getattr(cfg, "launcher", None)
+    bench_cfg = getattr(launcher_cfg, "bench", None) if launcher_cfg else None
+    presets = _bench_preset_map(launcher_cfg)
+    default_preset = getattr(bench_cfg, "default_preset", None)
+    base_results = getattr(bench_cfg, "results_dir", None)
+    base_runs = getattr(bench_cfg, "runs", None) or _HARDCODED_BENCH_RUNS
+    items: list[dict[str, Any]] = []
+    if "default" not in presets:
+        items.append(
+            {
+                "key": "default",
+                "name": "default (launcher.bench.command_template)",
+                "runs": base_runs,
+                "has_results_dir": base_results is not None,
+            }
+        )
+    for key, preset in presets.items():
+        items.append(
+            {
+                "key": key,
+                "name": preset.name,
+                "runs": preset.runs if preset.runs is not None else base_runs,
+                "has_results_dir": (
+                    preset.results_dir is not None or base_results is not None
+                ),
+            }
+        )
+    return {"presets": items, "default": default_preset}
 
 
 @router.get("/api/launcher/sweep/status")
@@ -2048,6 +2184,7 @@ _LAUNCHER_HTML = r"""<!doctype html>
     <a href="/dashboard" class="text-slate-400 hover:text-slate-200 transition-colors">Dashboard</a>
     <span class="text-slate-100 font-medium border-b border-indigo-400 pb-0.5">Launcher</span>
     <span id="status-msg" class="ml-auto text-xs text-slate-500"></span>
+    <button id="token-badge" onclick="promptToken()" class="btn-sm btn-red hidden">🔑 トークン未設定</button>
   </div>
 </header>
 
@@ -2213,18 +2350,12 @@ _LAUNCHER_HTML = r"""<!doctype html>
           <input id="sweep-port" type="number" value="8090" min="1024" max="65535" />
         </div>
         <div>
-          <label class="block text-xs text-slate-400 mb-1">ベンチコマンド ({port} {config} {base_url} {results_dir} {runs} を置換)</label>
-          <input id="sweep-cmd" type="text" placeholder="llmbench run --model local-openai --runs {runs}" />
+          <label class="block text-xs text-slate-400 mb-1">ベンチプリセット (providers.yaml の launcher.bench.presets)</label>
+          <select id="sweep-preset"></select>
         </div>
-        <div class="grid grid-cols-2 gap-2">
-          <div>
-            <label class="block text-xs text-slate-400 mb-1">runs</label>
-            <input id="sweep-runs" type="number" value="5" min="1" max="1000" />
-          </div>
-          <div>
-            <label class="block text-xs text-slate-400 mb-1">results_dir (任意)</label>
-            <input id="sweep-results" type="text" placeholder="results/" />
-          </div>
+        <div>
+          <label class="block text-xs text-slate-400 mb-1">runs</label>
+          <input id="sweep-runs" type="number" value="5" min="1" max="1000" />
         </div>
       </div>
     </div>
@@ -2269,15 +2400,31 @@ _LAUNCHER_HTML = r"""<!doctype html>
   "use strict";
 
   const POLL_MS = 3000;
-  // H8: launcher shared-secret. The server substitutes __LAUNCHER_TOKEN__
-  // with the configured token (or an empty string when auth is disabled).
-  const LAUNCHER_TOKEN = "__LAUNCHER_TOKEN__";
-  // Build headers for state-changing requests, adding the token only when set.
+  // H-3: the token is NEVER embedded in the HTML. The server only tells us
+  // whether auth is required; the token itself is entered by the operator and
+  // kept in sessionStorage (cleared when the tab closes).
+  const AUTH_REQUIRED = __LAUNCHER_AUTH_REQUIRED__;
+  const TOKEN_KEY = "coderouter-launcher-token";
+  let launcherToken = sessionStorage.getItem(TOKEN_KEY) || "";
   const authHeaders = (base) => {
     const h = Object.assign({}, base || {});
-    if (LAUNCHER_TOKEN) h["X-CodeRouter-Token"] = LAUNCHER_TOKEN;
+    if (launcherToken) h["X-CodeRouter-Token"] = launcherToken;
     return h;
   };
+  const updateTokenBadge = () => {
+    const el = document.getElementById("token-badge");
+    if (!el) return;
+    el.textContent = launcherToken ? "🔑 トークン設定済" : "🔑 トークン未設定";
+    el.className = "btn-sm " + (launcherToken ? "btn-slate" : "btn-red") + (AUTH_REQUIRED ? "" : " hidden");
+  };
+  window.promptToken = () => {
+    const v = window.prompt("CODEROUTER_LAUNCHER_TOKEN を入力してください", "");
+    if (v === null) return;
+    launcherToken = v.trim();
+    if (launcherToken) sessionStorage.setItem(TOKEN_KEY, launcherToken);
+    else sessionStorage.removeItem(TOKEN_KEY);
+    updateTokenBadge();
+  };
   let allProfiles = {};      // backend → [{name, args}]
   const _modelCache = {};    // index → {path, name, dir, size_gb}
   let selectedLogId = null;
@@ -2808,14 +2955,12 @@ _LAUNCHER_HTML = r"""<!doctype html>
                   tensor_split: c.tensor_split, backend: c.backend || null}));
     if (!configs.length) { showSweepErr("構成を 1 つ以上選択してください"); return; }
     const port = parseInt(document.getElementById("sweep-port").value);
-    const cmd = document.getElementById("sweep-cmd").value.trim();
+    const preset = document.getElementById("sweep-preset").value || null;
     const runs = parseInt(document.getElementById("sweep-runs").value);
-    const results = document.getElementById("sweep-results").value.trim();
     const body = {
       backend: "llama.cpp", model_path: model, port, configs,
-      bench_command: cmd || null,
+      bench_preset: preset,
       runs: isNaN(runs) ? null : runs,
-      results_dir: results || null,
     };
     try {
       const r = await fetch("/api/launcher/sweep/start", {
@@ -2970,12 +3115,12 @@ _LAUNCHER_HTML = r"""<!doctype html>
       const modelName = p.model_path.split("/").pop();
       const isActive = p.status === "running" || p.status === "loading" || p.status === "starting";
       const stopBtn = isActive
-        ? `<button onclick="stopProc('${p.id}')" class="btn-sm btn-red">■ 停止</button>`
+        ? `<button data-act="stop" data-id="${esc(p.id)}" class="btn-sm btn-red">■ 停止</button>`
         : "";
       const delBtn = !isActive
-        ? `<button onclick="deleteProc('${p.id}')" class="btn-sm btn-slate ml-1">✕</button>`
+        ? `<button data-act="del" data-id="${esc(p.id)}" class="btn-sm btn-slate ml-1">✕</button>`
         : "";
-      const logBtn = `<button onclick="openLog('${p.id}','${esc(p.name)}')" class="btn-sm btn-indigo ml-1">📋 ログ</button>`;
+      const logBtn = `<button data-act="log" data-id="${esc(p.id)}" data-name="${esc(p.name)}" class="btn-sm btn-indigo ml-1">📋 ログ</button>`;
       // [Unreleased]: swap badge — marks processes SwapManager spawned
       // on demand, distinct from manually-started ones. Title shows the
       // catalog model name when the backend supplied it.
@@ -2994,6 +3139,18 @@ _LAUNCHER_HTML = r"""<!doctype html>
     }).join("");
   };
 
+  // M-2: no inline onclick with interpolated process fields (XSS). The row
+  // buttons carry data-* attributes; a single delegated listener dispatches.
+  document.getElementById("proc-table").addEventListener("click", (ev) => {
+    const btn = ev.target.closest("button[data-act]");
+    if (!btn) return;
+    const id = btn.getAttribute("data-id");
+    const act = btn.getAttribute("data-act");
+    if (act === "stop") stopProc(id);
+    else if (act === "del") deleteProc(id);
+    else if (act === "log") openLog(id, btn.getAttribute("data-name") || "");
+  });
+
   window.stopProc = async (id) => {
     if (!confirm("プロセスを停止しますか?")) return;
     const r = await fetch(`/api/launcher/stop/${id}`, {method:"POST", headers: authHeaders()});
@@ -3051,11 +3208,35 @@ _LAUNCHER_HTML = r"""<!doctype html>
     document.getElementById("log-panel").classList.add("hidden");
   };
 
+  // H-2: fill the sweep preset <select> from config-declared presets. The
+  // command_template is never sent to the browser; the operator only picks a key.
+  const fetchBenchPresets = async () => {
+    try {
+      const r = await fetch("/api/launcher/bench-presets");
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      const d = await r.json();
+      const sel = document.getElementById("sweep-preset");
+      if (!sel) return;
+      const presets = d.presets || [];
+      sel.innerHTML = presets.map((p) => {
+        const runs = (p.runs != null) ? ` — runs ${p.runs}` : "";
+        return `<option value="${esc(p.key)}">${esc(p.name)}${runs}</option>`;
+      }).join("");
+      const chosen = d.default || "default";
+      const keys = presets.map((p) => p.key);
+      sel.value = keys.includes(chosen) ? chosen : (keys[0] || "");
+    } catch (e) {
+      console.error("[Launcher] fetchBenchPresets failed:", e);
+    }
+  };
+
   // ── Init + polling ───────────────────────────────────────────────────────
 
   const init = async () => {
     updateDeviceBlock();
-    await Promise.all([fetchModels(), fetchProfiles(), fetchBackends(), fetchProcesses()]);
+    updateTokenBadge();
+    if (AUTH_REQUIRED && !launcherToken) promptToken();
+    await Promise.all([fetchModels(), fetchProfiles(), fetchBackends(), fetchProcesses(), fetchBenchPresets()]);
     pollSweep();  // 既存スイープがあれば表示 (running なら以後のポーリングを継続)
   };
 
@@ -3078,18 +3259,13 @@ _LAUNCHER_HTML = r"""<!doctype html>
 async def launcher_page() -> HTMLResponse:
     """Serve the launcher single-page UI.
 
-    H8: inject the configured launcher token so the inline JS can attach it
-    to state-changing requests. When the env var is unset the placeholder
-    becomes an empty string and the UI keeps working unauthenticated (the
-    historical local-only default). The token is escaped for a JS string
-    context to avoid breaking out of the double-quoted literal.
+    H-3: the launcher token is NEVER embedded in the served HTML (it used to be
+    substituted into a JS string literal, so anyone who could read the page —
+    including a browser cache or a shoulder-surfer — recovered the shared
+    secret). We now only substitute a boolean ``__LAUNCHER_AUTH_REQUIRED__``
+    telling the client whether auth is on; the operator enters the token in the
+    browser and it lives in ``sessionStorage`` only.
     """
-    token = os.environ.get(_LAUNCHER_TOKEN_ENV, "")
-    safe_token = (
-        token.replace("\\", "\\\\")
-        .replace('"', '\\"')
-        .replace("<", "\\u003c")
-        .replace(">", "\\u003e")
-    )
-    html = _LAUNCHER_HTML.replace("__LAUNCHER_TOKEN__", safe_token)
+    auth_required = "true" if os.environ.get(_LAUNCHER_TOKEN_ENV, "") else "false"
+    html = _LAUNCHER_HTML.replace("__LAUNCHER_AUTH_REQUIRED__", auth_required)
     return HTMLResponse(content=html)

coderouter/ingress/metrics_routes.py

@@ -28,7 +28,9 @@ from typing import Any
 from fastapi import APIRouter, Request
 from fastapi.responses import PlainTextResponse
 
+from coderouter.ingress.ui_auth import require_ui_token
 from coderouter.metrics import format_prometheus, get_collector
+from coderouter.secret_redaction import redact
 
 router = APIRouter()
 
@@ -48,6 +50,11 @@ async def metrics_json(request: Request) -> dict[str, Any]:
     dashboard uses it to classify providers into local / free / paid
     for the usage-mix bar without a second endpoint round-trip.
     """
+    # v2.14.0: opt-in token first, before anything is computed. The
+    # ordering is the point — codex-router's /health answers before its
+    # own auth check and leaks the live session name to any local caller.
+    require_ui_token(request)
+
     snapshot = get_collector().snapshot()
 
     config = getattr(request.app.state, "config", None)
@@ -66,7 +73,10 @@ async def metrics_json(request: Request) -> dict[str, Any]:
                     "paid": p.paid,
                     # ``HttpUrl`` is not JSON-serializable directly in Pydantic v2;
                     # the cast also makes the shape stable if Pydantic switches types.
-                    "base_url": str(p.base_url),
+                    # v2.14.0: run it through the scrubber. A base_url is the
+                    # one config field an operator can paste a credential into
+                    # (``?api_key=…``), and this endpoint hands it to a browser.
+                    "base_url": redact(str(p.base_url)),
                 }
                 for p in config.providers
             ],
@@ -79,7 +89,7 @@ async def metrics_json(request: Request) -> dict[str, Any]:
 
 
 @router.get("/metrics", response_class=PlainTextResponse)
-async def metrics_prometheus() -> PlainTextResponse:
+async def metrics_prometheus(request: Request) -> PlainTextResponse:
     """Prometheus text exposition format (v1.5-B).
 
     Convention-compliant endpoint path for Prometheus scrapers. Returns
@@ -88,5 +98,6 @@ async def metrics_prometheus() -> PlainTextResponse:
     Sits alongside :func:`metrics_json` (not a replacement) — JSON is
     for internal UI, Prometheus is for external time-series DBs.
     """
+    require_ui_token(request)
     body = format_prometheus(get_collector().snapshot())
     return PlainTextResponse(content=body, media_type=_PROM_CONTENT_TYPE)

coderouter/ingress/ui_auth.py

@@ -0,0 +1,94 @@
+"""Opt-in token auth for the read-only UI surfaces (v2.14.0).
+
+``/dashboard``, ``/metrics.json`` and ``/metrics`` were the last endpoints
+with no authentication story at all. They change nothing, so they were
+never part of the H-8 state-changing-endpoint work — but "read-only" is
+not "harmless". ``/metrics.json`` returns every provider's name, kind,
+paid flag and ``base_url``, plus the profile graph: the full topology of
+which models an operator runs and which vendors they pay. On a laptop
+that is fine. On a box where the port is reachable by anything else, it
+is a free reconnaissance endpoint.
+
+The failure we are deliberately not repeating is codex-router's: its
+``/health`` answers *before* the caller-key check and includes the live
+session name, so any local process can read what the operator is working
+on. Cheap to avoid, easy to ship by accident — the check just has to come
+first.
+
+Contract
+--------
+Identical in shape to :func:`coderouter.ingress.launcher_routes._require_launcher_token`,
+so an operator learns it once:
+
+* ``CODEROUTER_METRICS_TOKEN`` unset → the endpoints stay open exactly as
+  they were, and a one-time warning is logged. Backwards compatible by
+  construction; nobody's Prometheus scrape breaks on upgrade.
+* Set → every request must carry a matching ``X-CodeRouter-Token`` header,
+  compared with :func:`secrets.compare_digest`.
+
+The token is deliberately **not** accepted as a query parameter. A token
+in a URL lands in access logs, in ``Referer`` headers, and in the browser
+history — and this codebase now has a log scrubber precisely because
+credentials end up in places nobody predicted.
+"""
+
+from __future__ import annotations
+
+import os
+import secrets
+
+from fastapi import HTTPException, Request
+
+from coderouter.logging import get_logger
+
+__all__ = ["METRICS_TOKEN_ENV", "METRICS_TOKEN_HEADER", "require_ui_token"]
+
+logger = get_logger(__name__)
+
+METRICS_TOKEN_ENV = "CODEROUTER_METRICS_TOKEN"
+METRICS_TOKEN_HEADER = "X-CodeRouter-Token"
+
+# One warning per process, not per request — a 2-second dashboard poll
+# would otherwise bury every other log line.
+_warning_emitted = False
+
+
+def require_ui_token(request: Request) -> None:
+    """Enforce the metrics/dashboard token when one is configured.
+
+    Raises ``401`` on mismatch. Returns silently when the env var is
+    unset, after logging a single ``metrics-auth-disabled`` line.
+    """
+    global _warning_emitted
+    expected = os.environ.get(METRICS_TOKEN_ENV, "")
+    if not expected:
+        if not _warning_emitted:
+            logger.warning(
+                "metrics-auth-disabled",
+                extra={
+                    "hint": (
+                        f"{METRICS_TOKEN_ENV} is not set; /dashboard, "
+                        "/metrics.json and /metrics are unauthenticated and "
+                        "expose provider names, base_urls and the profile "
+                        "graph. Set it when binding to anything but loopback."
+                    ),
+                },
+            )
+            _warning_emitted = True
+        return
+    provided = request.headers.get(METRICS_TOKEN_HEADER, "")
+    if not secrets.compare_digest(provided, expected):
+        raise HTTPException(
+            status_code=401, detail="Invalid or missing metrics token."
+        )
+
+
+def auth_required() -> bool:
+    """Whether a token is configured — safe to embed in the page.
+
+    The dashboard needs to know *that* auth is on so it can prompt; it
+    must never receive the token itself. Same split as the v2.13.0 fix
+    that stopped ``GET /launcher`` embedding ``CODEROUTER_LAUNCHER_TOKEN``
+    straight into the HTML, where ``curl | grep`` recovered it.
+    """
+    return bool(os.environ.get(METRICS_TOKEN_ENV, ""))

coderouter/launcher_devices.py

@@ -629,6 +629,10 @@ def render_bench_command(
     argv 化。
 
     ``str.format`` は JSON 波括弧等で誤爆するため単純置換を使う。
+
+    H-2: 置換より **先に** ``shlex.split`` でトークン化し、各トークン内でのみ
+    置換する。こうしないと ``{config}`` にスペースを含む値が入ったとき argv が
+    増殖し(引数注入)、想定外のフラグを外部ベンチに渡せてしまう。
     """
     mapping = {
         "port": str(port),
@@ -637,13 +641,16 @@ def render_bench_command(
         "results_dir": results_dir or "",
         "runs": str(runs) if runs is not None else "",
     }
-    rendered = template
-    for k, v in mapping.items():
-        rendered = rendered.replace("{" + k + "}", v)
     # ★ Windows: shlex の POSIX モードはバックスラッシュをエスケープ文字
     #   として食い潰し `C:\tools\llmbench.exe` を壊す。os.name で分岐して
     #   Windows では posix=False(バックスラッシュを素通し)にする。
-    return shlex.split(rendered, posix=(os.name != "nt"))
+    argv: list[str] = []
+    for tok in shlex.split(template, posix=(os.name != "nt")):
+        for k, v in mapping.items():
+            tok = tok.replace("{" + k + "}", v)
+        if tok:
+            argv.append(tok)
+    return argv
 
 
 # ---------------------------------------------------------------------------