coderouter-cli 2.12.0__tar.gz → 2.14.0__tar.gz

{coderouter_cli-2.12.0 → coderouter_cli-2.14.0}/CHANGELOG.md

@@ -9,6 +9,221 @@ are kept verbatim where the Japanese text itself is the subject).
 
 ---
 
+## [v2.14.0] — 2026-08-09 (credential hygiene + undo)
+
+Five changes that came out of reading `duolahypercho/codex-router` and
+comparing it with what CodeRouter actually does. Four of them close holes
+this project had; one imports a capability it was missing. Everything is
+opt-in except the `.envrc` behaviour change called out under **Changed
+(BREAKING)**.
+
+### Added
+
+- **`credential.source: cli_session` — borrow the token a vendor CLI
+  already wrote.** A subscription-authenticated provider (Kimi Code CLI,
+  Grok CLI, …) can now be an ordinary `openai_compat` / `anthropic`
+  entry: CodeRouter reads the OAuth token out of the JSON file the
+  vendor's CLI maintains and makes the HTTP call itself. Until now the
+  only answer to those was `kind: agent_cli`, which spawns the CLI once
+  per request and therefore has no streaming, no tool-call repair, no
+  context-budget guard, and does not sit in a fallback chain — the
+  subscription ended up an island. It is now a chain link:
+  `providers: [kimi-sub, free-cloud, local-llama]` just works.
+  Refresh delegates to the vendor's own CLI (`refresh.command`, an argv
+  list run with `shell=False`) rather than reimplementing OAuth, because
+  endpoints, client ids and rotation policies all change and a bespoke
+  implementation rots. Refresh is single-flighted in-process and
+  serialised across processes with an advisory `flock`. `credential` and
+  `api_key_env` are mutually exclusive at load time, `credential.path`
+  must live under `$HOME`, and a missing or malformed session file
+  resolves to `None` (unauthenticated request → upstream 401 → the chain
+  moves on) instead of raising. See `examples/providers.cli-session.yaml`.
+- **`coderouter rollback`** — restores `providers.yaml`,
+  `~/.coderouter/model-capabilities.yaml` and (with `--workspace`)
+  `.vscode/settings.json` / `.envrc` from their `.bak` siblings.
+  `doctor --apply` and `vscode-init` have always written a backup and
+  never offered a way back. Restore is a **swap**: the current contents
+  become the new `.bak`, so a second run returns you to where you
+  started. Exit 0 restored / 2 nothing to restore / 1 a restore failed.
+- **`coderouter doctor --check-secrets`** — proves the log-redaction
+  filter scrubs by pushing a canary through it, reports which declared
+  `api_key_env` vars are actually set, flags credentials pasted into a
+  `base_url`, and scans the already-written `requests.jsonl` /
+  `audit.jsonl` (plus rotated `.1`) for live key values. Same 0/2/1 exit
+  contract as `--check-env`. The log scan is the part that produces
+  evidence rather than reassurance.
+- **`CODEROUTER_METRICS_TOKEN`** — opt-in token auth for `/dashboard`,
+  `/metrics.json` and `/metrics`, mirroring `CODEROUTER_LAUNCHER_TOKEN`.
+
+### Changed (BREAKING)
+
+- **`vscode-init --with-envrc --force` no longer replaces `.envrc`.** The
+  block CodeRouter owns is now fenced between
+  `# BEGIN coderouter-managed` / `# END coderouter-managed`, and only
+  that block is rewritten. Consequences:
+  - A re-run against a fenced file needs **no `--force`** — rewriting our
+    own fence is not destructive, so a port change is an ordinary update
+    instead of a conflict to override.
+  - `--force` now means "adopt a file I did not write": the block is
+    appended and every existing line survives. Previously it deleted
+    them, which is how the H-11 `.envrc` incident happened — including
+    the `source_env_if_exists .envrc.local` line the docs tell users to
+    add.
+  - A managed variable exported *outside* the fence is refused, because
+    direnv applies exports in order and a silent duplicate leaves nobody
+    able to say which value is live. Commented-out lines are not
+    conflicts.
+  - A file byte-identical to a pre-v2.14.0 generation is adopted into the
+    fence silently, so upgrading does not demand `--force` for our own
+    previous output.
+  `settings.json` handling is unchanged (it already refused to overwrite
+  a user-owned value without `--force`).
+- **A failed `doctor --apply` is now a no-op instead of a partial one.**
+  The write loop had no error handling: an apply spanning `providers.yaml`
+  and `model-capabilities.yaml` left the first file rewritten when the
+  second failed. It now restores what it already wrote (and deletes what
+  it created) before raising.
+
+### Fixed (security)
+
+- **Credentials are scrubbed from every log sink.** CodeRouter had no
+  notion of "this string is a secret": keys were read by
+  `resolve_api_key`, dropped into `x-api-key` / `Authorization`, and
+  nothing masked them because nothing knew which strings needed masking.
+  No call site logged a header dict, so this was not a live leak — the
+  problem was that the safety of every future log line depended on
+  whoever wrote it remembering what was in their hand. There is now a
+  process-global registry keyed on the exact credential value, armed by
+  `resolve_api_key` (the choke point every key passes through, plugins
+  included) and pre-armed by `load_config`, plus a
+  `SecretRedactingFilter` on the stderr handler, `RequestLogHandler` and
+  `AuditLogHandler`. It scrubs the message, printf args, `exc_text` and
+  every `extra={...}` field, recursing into nested dicts and lists.
+  Exact-match registry first (zero false positives); a small set of
+  anchored backstop patterns (`sk-*`, `gh*_`, `AIza*`, `Bearer`,
+  `?api_key=`, URL userinfo) covers credentials that never passed through
+  the resolver. Values under 8 characters are refused — redacting those
+  would corrupt ordinary log text.
+- **`/dashboard`, `/metrics.json` and `/metrics` were unauthenticated
+  with no way to close them.** They change nothing, so they were never
+  part of the H-8 work, but `/metrics.json` returns every provider's
+  name, kind, paid flag and `base_url` plus the profile graph — the full
+  topology of which models an operator runs and which vendors they pay.
+  With `CODEROUTER_METRICS_TOKEN` unset they stay open exactly as before
+  (no running scrape breaks on upgrade) and log a one-time
+  `metrics-auth-disabled` warning. The check runs **before** the payload
+  is assembled, so a 401 leaks nothing, and the page receives only a
+  boolean — never the token. `base_url` now also goes through the
+  scrubber on its way into the JSON, since it is the one config field an
+  operator can paste a credential into and this endpoint hands it to a
+  browser.
+
+### Tests
+
+- 2572 passed / 1 skipped (was 2464 on `main`), ruff clean, and 51 mypy
+  errors against 53 on `main` (net −2; strict mypy is not CI-enforced).
+- New: `tests/test_secret_redaction.py` (36),
+  `tests/test_credentials.py` (25), `tests/test_rollback.py` (17),
+  `tests/test_ui_auth.py` (17), plus 9 in `tests/test_vscode_init.py` and
+  1 in `tests/test_doctor_apply.py`.
+- `test_existing_envrc_force_overwrites` asserted the old destructive
+  `--force` contract and is rewritten as
+  `test_existing_envrc_force_adopts_without_destroying`, pinning the
+  opposite.
+
+---
+
+## [v2.13.0] — 2026-08-07 (remaining-high security hardening)
+
+### Changed (BREAKING)
+
+- **Implicit `./providers.yaml` discovery is now opt-in, gated behind
+  `CODEROUTER_ALLOW_CWD_CONFIG`.** Previously, starting CodeRouter (or the
+  GUI launcher) from a directory containing a `providers.yaml` loaded that
+  file automatically. That was a code-execution vector: a hostile config
+  dropped into a repo could steer `restart_command`,
+  `launcher.backends[*].binary`, and `launcher.bench.command_template` —
+  all of which name executables — simply because of the working directory.
+  The current-working-directory step now runs only when
+  `CODEROUTER_ALLOW_CWD_CONFIG` is truthy (`1`/`true`/`yes`/`on`). When the
+  opt-in is off but a `./providers.yaml` exists and was not explicitly
+  named, a one-time `cwd-config-skipped` warning explains why it was
+  ignored and how to enable it (`--config`, `CODEROUTER_CONFIG`, or the
+  opt-in). To keep the old behaviour, set `CODEROUTER_ALLOW_CWD_CONFIG=1`
+  in directories you trust. (The v2.12.0 heads-up mis-stated the landing
+  release as "v2.12.0"; it actually lands here in v2.13.0.)
+- **`restart_command` is now run as `subprocess.run(shlex.split(command),
+  shell=False)` — argv dispatch, no shell.** Self-healing previously ran
+  it through `shell=True`, so a `providers.yaml` from an untrusted source
+  meant arbitrary shell execution (directly, and unconditionally at
+  startup when excluded providers were restored from `state_dir`).
+  Pipelines, redirects, `~` expansion, and `FOO=bar cmd` env prefixes are
+  no longer supported. A value containing shell metacharacters (`&&`,
+  `||`, `|`, `;`, `>`, `<`, `$(...)`, `` ` ``) is now **refused (not run)**
+  rather than half-executed — under `shell=False`, `touch a; b` would
+  otherwise create a file literally named `a;` and report a "successful"
+  restart. Wrap shell-dependent commands in a script, or write them as
+  `/bin/sh -c '...'` explicitly.
+- **`doctor --apply` now writes back to exactly the file the loader read.**
+  The apply path's config resolution was a hand-maintained copy of the
+  loader's search order; it now delegates to the loader's single
+  `resolve_config_path`, so the v2.13.0 CWD change can never make `--apply`
+  rewrite a file that `load_config` did not actually load.
+- **The GUI launcher (`launcher_gui.py`) applies the same
+  `CODEROUTER_ALLOW_CWD_CONFIG` gate** to its own `providers.yaml`
+  discovery.
+- **The launcher sweep API no longer accepts a `bench_command` (or
+  `results_dir`) from the request body.** `POST /api/launcher/sweep/start`
+  previously took an arbitrary command string, `shlex.split` it, and ran
+  it — so anyone who could reach the (loopback, token-optional) launcher
+  port could run any program under the CodeRouter process. The request now
+  carries only a `bench_preset` key that must name an entry under
+  `launcher.bench.presets` in `providers.yaml`; the executable template
+  lives solely in the operator-owned config, matching the trust boundary
+  already used for `launcher.backends[*].binary`. `bench_command` /
+  `results_dir` in a request are rejected with `400`. To keep a custom
+  sweep command, declare it under `launcher.bench.presets`; a single
+  `launcher.bench.command_template` still works unchanged as the implicit
+  `default` preset. Placeholder substitution in bench templates now splits
+  the template into argv *before* substituting, so a config label can no
+  longer inject extra arguments.
+
+### Fixed (security)
+
+- **The launcher HTML no longer embeds `CODEROUTER_LAUNCHER_TOKEN`.**
+  `GET /launcher` used to substitute the shared secret straight into the
+  page, so `curl /launcher | grep` recovered it and defeated
+  `_require_launcher_token`. The page now receives only a boolean telling
+  the UI whether auth is enabled; the operator enters the token once and it
+  is held in `sessionStorage` (per-tab). Token-free deployments are
+  unaffected.
+- **`POST /api/launcher/start` and `/sweep/start` now validate
+  `model_path` / `draft_model_path` against `launcher.model_dirs`** (the
+  same check previously applied only to `/suggest`). When `model_dirs` is
+  unset the endpoints stay open as before, with a one-time warning;
+  configure `model_dirs` when the launcher is reachable beyond loopback.
+- **Stored XSS in the launcher process table is fixed.** Process-row
+  buttons no longer build `onclick` attributes from the process name
+  (which an HTML parser decoded back into executable JS); they use
+  `data-*` attributes with a single delegated listener, so a name like
+  `x');alert(1);//` renders as inert text.
+- **The request body-size limit is now enforced for
+  `Transfer-Encoding: chunked` requests.** The middleware previously only
+  read `Content-Length`, so a chunked body bypassed the cap entirely (and
+  a malformed length header fell through as unlimited). It now also counts
+  bytes as they are received and aborts with `413` the moment the running
+  total exceeds the cap, without buffering the body.
+- **The GUI bench-sweep window no longer orphans `llama-server`
+  processes.** Closing the sweep window (the `×` button) did not signal the
+  worker, and sweep child processes were never registered for the app's
+  bulk shutdown, so backends kept running and leaked VRAM and ports. The
+  window now stops the worker and its children on close (non-blocking, via
+  an `after()` poll with a grace period then `SIGKILL`), sweep children are
+  drained when the app closes, and the app confirms before quitting while a
+  sweep is running.
+
+---
+
 ## [v2.12.0] — 2026-08-04 (the context-budget guard actually fires now)
 
 **This release changes behaviour you can observe.** The token estimator

{coderouter_cli-2.12.0 → coderouter_cli-2.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coderouter-cli
-Version: 2.12.0
+Version: 2.14.0
 Summary: Local-first, free-first, fallback-built-in LLM router. Claude Code / OpenAI compatible.
 Project-URL: Homepage, https://github.com/zephel01/CodeRouter
 Project-URL: Repository, https://github.com/zephel01/CodeRouter

{coderouter_cli-2.12.0 → coderouter_cli-2.14.0}/coderouter/adapters/anthropic_native.py

@@ -45,7 +45,7 @@ from coderouter.adapters.base import (
     ProviderCallOverrides,
     StreamChunk,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import get_logger, log_output_filter_applied
 from coderouter.output_filters import OutputFilterChain
 from coderouter.translation.anthropic import (
@@ -134,7 +134,9 @@ class AnthropicAdapter(BaseAdapter):
                 self.config.extra_body.get("anthropic_version", _DEFAULT_ANTHROPIC_VERSION)
             ),
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: see openai_compat._headers — same resolver, so an
+        # Anthropic-protocol provider can also ride a CLI session token.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["x-api-key"] = api_key
         # v0.4-D: forward the client's anthropic-beta header verbatim.

{coderouter_cli-2.12.0 → coderouter_cli-2.14.0}/coderouter/adapters/openai_compat.py

@@ -29,7 +29,7 @@ from coderouter.adapters.base import (
     ProviderCallOverrides,
     StreamChunk,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import (
     get_logger,
     log_capability_degraded,
@@ -105,7 +105,10 @@ class OpenAICompatAdapter(BaseAdapter):
             "Content-Type": "application/json",
             "User-Agent": "CodeRouter/0.1",
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: resolve_provider_credential covers api_key_env (the
+        # historical path, unchanged) and credential.source=cli_session,
+        # which borrows the token a vendor CLI already wrote to disk.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["Authorization"] = f"Bearer {api_key}"
         return headers

{coderouter_cli-2.12.0 → coderouter_cli-2.14.0}/coderouter/cli.py

@@ -149,6 +149,22 @@ def _build_parser() -> argparse.ArgumentParser:
             "See docs/guides/troubleshooting.md §5 for the threat model."
         ),
     )
+    # v2.14.0: --check-secrets is the runtime counterpart to --check-env.
+    # --check-env asks "is the file holding my keys protected?"; this asks
+    # "does the running process know its own secrets, and did any of them
+    # already reach a log file?". The second question is the one that used
+    # to have no answer at all.
+    doctor.add_argument(
+        "--check-secrets",
+        action="store_true",
+        help=(
+            "Audit credential hygiene: prove the log-redaction filter "
+            "actually scrubs, report which declared api_key_env vars are "
+            "set, flag credentials pasted into a base_url, and scan the "
+            "already-written requests.jsonl / audit.jsonl under state_dir "
+            "for live key values. Exit 0 clean / 2 needs attention / 1 leak."
+        ),
+    )
     doctor.add_argument(
         "--config",
         default=None,
@@ -192,6 +208,55 @@ def _build_parser() -> argparse.ArgumentParser:
         ),
     )
 
+    # v2.14.0: `coderouter rollback` — the missing half of --apply.
+    # Both writers (doctor --apply, vscode-init) already dropped a `.bak`
+    # next to every file they rewrote; nothing could put it back. Restore
+    # is a swap, not an overwrite, so running it twice returns you to
+    # where you started rather than destroying the newer version.
+    rollback = sub.add_parser(
+        "rollback",
+        help="Restore files a previous --apply / vscode-init rewrote (v2.14.0).",
+        description=(
+            "Swap each managed file with its .bak sibling: providers.yaml, "
+            "~/.coderouter/model-capabilities.yaml, and (with --workspace) "
+            ".vscode/settings.json and .envrc. The current contents become "
+            "the new .bak, so a second run toggles back. "
+            "Exit codes: 0 restored, 2 nothing to restore, 1 a restore failed."
+        ),
+    )
+    rollback.add_argument(
+        "--config",
+        default=None,
+        help=(
+            "Path to providers.yaml. Defaults to the same file the loader "
+            "would read ($CODEROUTER_CONFIG, then ~/.coderouter/providers.yaml)."
+        ),
+    )
+    rollback.add_argument(
+        "--workspace",
+        metavar="DIR",
+        default=None,
+        help=(
+            "Also restore the vscode-init outputs under DIR: "
+            "DIR/.vscode/settings.json and DIR/.envrc."
+        ),
+    )
+    rollback.add_argument(
+        "--path",
+        action="append",
+        metavar="FILE",
+        default=None,
+        help=(
+            "Restore exactly this file from its .bak sibling. Repeatable. "
+            "When given, the default discovery set is not used."
+        ),
+    )
+    rollback.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Report what would be restored without touching any file.",
+    )
+
     # v1.5-C: `coderouter stats` — live TUI over GET /metrics.json.
     # Lazy-imports ``curses`` inside the runner so the CLI boot stays
     # snappy and environments without curses (rare, but e.g. minimal
@@ -490,6 +555,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.command == "doctor":
         return _run_doctor(args)
 
+    if args.command == "rollback":
+        return _run_rollback(args)
+
     if args.command == "stats":
         # v1.5-C: stats is intentionally a thin wrapper — all logic
         # (fetch, render, curses loop) lives in coderouter.cli_stats so
@@ -526,9 +594,11 @@ def _run_doctor(args: argparse.Namespace) -> int:
     worst-case of the two reports so CI guarding against both leak
     risks AND broken providers can use a single command.
     """
-    if args.check_model is None and args.check_env is None:
+    check_secrets = bool(getattr(args, "check_secrets", False))
+    if args.check_model is None and args.check_env is None and not check_secrets:
         print(
-            "doctor: provide --check-model PROVIDER and/or --check-env [PATH]",
+            "doctor: provide --check-model PROVIDER, --check-env [PATH], "
+            "and/or --check-secrets",
             file=sys.stderr,
         )
         return 1
@@ -541,6 +611,9 @@ def _run_doctor(args: argparse.Namespace) -> int:
     if args.check_env is not None:
         worst_exit = max(worst_exit, _run_check_env(args.check_env))
 
+    if check_secrets:
+        worst_exit = max(worst_exit, _run_check_secrets(args.config))
+
     if args.check_model is not None:
         worst_exit = max(worst_exit, _run_check_model(args))
 
@@ -600,28 +673,27 @@ def _run_check_model(args: argparse.Namespace) -> int:
 
 
 def _resolve_config_path(explicit: str | None) -> Path:
-    """Mirror loader._candidate_paths and return the file actually used.
-
-    Used by ``--apply`` to write back to the same path the loader
-    picked up when it parsed providers.yaml. Falls through the same
-    search order so a ``CODEROUTER_CONFIG`` env or default-path lookup
-    matches the live config.
+    """Return the file the loader actually read, for ``--apply`` write-back.
+
+    Delegates the search order to
+    :func:`coderouter.config.loader.resolve_config_path` rather than
+    re-implementing it. Re-implementing it here is exactly how the
+    v2.13.0 CWD opt-in change would introduce a silent bug: if the loader
+    gates ``./providers.yaml`` behind ``CODEROUTER_ALLOW_CWD_CONFIG`` but
+    this copy still searched CWD unconditionally, ``doctor --apply`` would
+    write patches back into a file that ``load_config`` never read. Keeping
+    one source of truth makes that impossible.
+
+    When nothing exists, falls back to ``~/.coderouter/providers.yaml``
+    (the loader's last candidate) — the apply step surfaces a clearer
+    error against that path than this resolver would.
     """
-    import os
+    from coderouter.config.loader import resolve_config_path
 
-    candidates: list[Path] = []
-    if explicit:
-        candidates.append(Path(explicit))
-    if env_path := os.environ.get("CODEROUTER_CONFIG"):
-        candidates.append(Path(env_path))
-    candidates.append(Path.cwd() / "providers.yaml")
-    candidates.append(Path.home() / ".coderouter" / "providers.yaml")
-    for p in candidates:
-        if p.is_file():
-            return p
-    # Fall back to the last candidate even if absent — the apply step
-    # will surface a clearer error than this resolver would.
-    return candidates[-1]
+    resolved = resolve_config_path(explicit)
+    if resolved is not None:
+        return resolved
+    return Path.home() / ".coderouter" / "providers.yaml"
 
 
 def _write_verdict_line(*, write: bool, files_written: int) -> None:
@@ -970,5 +1042,70 @@ def _run_check_env(arg_value: str) -> int:
     return exit_code_for_env_security(report)
 
 
+def _run_rollback(args: argparse.Namespace) -> int:
+    """v2.14.0: put back what ``--apply`` / ``vscode-init`` overwrote.
+
+    Explicit ``--path`` wins over discovery so an operator can restore one
+    file without also reverting an unrelated ``model-capabilities.yaml``
+    edit from last week. Discovery resolves providers.yaml through the
+    loader's own search order rather than a second copy of it.
+    """
+    from coderouter.rollback import (
+        discover_managed_files,
+        exit_code_for_rollback,
+        format_rollback_report,
+        restore_many,
+    )
+
+    explicit = getattr(args, "path", None)
+    if explicit:
+        targets: list[Path] = [Path(p).expanduser() for p in explicit]
+    else:
+        try:
+            config_path: Path | None = _resolve_config_path(args.config)
+        except Exception:
+            # No config anywhere is not fatal here — the workspace files
+            # and the user-layer capabilities file may still have backups.
+            config_path = None
+        targets = discover_managed_files(
+            config_path=config_path,
+            workspace=getattr(args, "workspace", None),
+        )
+
+    outcomes = restore_many(targets, dry_run=bool(args.dry_run))
+    print(format_rollback_report(outcomes, dry_run=bool(args.dry_run)))
+    return exit_code_for_rollback(outcomes)
+
+
+def _run_check_secrets(config_path: str | None) -> int:
+    """v2.14.0: credential-hygiene audit for the running configuration.
+
+    Loads the config through the normal loader — which is also what arms
+    the redaction registry — then runs the suite from
+    :mod:`coderouter.secret_redaction`. A config that fails to load is a
+    blocker (exit 1) rather than a skip: we cannot claim anything about
+    secret hygiene for a file we could not read.
+    """
+    from coderouter.config.loader import load_config
+    from coderouter.secret_redaction import (
+        check_secret_hygiene,
+        exit_code_for_secret_report,
+        format_secret_report,
+    )
+
+    try:
+        config = load_config(config_path)
+    except FileNotFoundError as exc:
+        print(f"doctor: {exc}", file=sys.stderr)
+        return 1
+    except Exception as exc:
+        print(f"doctor: failed to load config: {exc}", file=sys.stderr)
+        return 1
+
+    report = check_secret_hygiene(config)
+    print(format_secret_report(report))
+    return exit_code_for_secret_report(report)
+
+
 if __name__ == "__main__":
     sys.exit(main())