coderouter-cli 2.13.0__py3-none-any.whl → 2.14.0__py3-none-any.whl

coderouter/adapters/anthropic_native.py

@@ -45,7 +45,7 @@ from coderouter.adapters.base import (
     ProviderCallOverrides,
     StreamChunk,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import get_logger, log_output_filter_applied
 from coderouter.output_filters import OutputFilterChain
 from coderouter.translation.anthropic import (
@@ -134,7 +134,9 @@ class AnthropicAdapter(BaseAdapter):
                 self.config.extra_body.get("anthropic_version", _DEFAULT_ANTHROPIC_VERSION)
             ),
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: see openai_compat._headers — same resolver, so an
+        # Anthropic-protocol provider can also ride a CLI session token.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["x-api-key"] = api_key
         # v0.4-D: forward the client's anthropic-beta header verbatim.

coderouter/adapters/openai_compat.py

@@ -29,7 +29,7 @@ from coderouter.adapters.base import (
     ProviderCallOverrides,
     StreamChunk,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import (
     get_logger,
     log_capability_degraded,
@@ -105,7 +105,10 @@ class OpenAICompatAdapter(BaseAdapter):
             "Content-Type": "application/json",
             "User-Agent": "CodeRouter/0.1",
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: resolve_provider_credential covers api_key_env (the
+        # historical path, unchanged) and credential.source=cli_session,
+        # which borrows the token a vendor CLI already wrote to disk.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["Authorization"] = f"Bearer {api_key}"
         return headers

coderouter/cli.py

@@ -149,6 +149,22 @@ def _build_parser() -> argparse.ArgumentParser:
             "See docs/guides/troubleshooting.md §5 for the threat model."
         ),
     )
+    # v2.14.0: --check-secrets is the runtime counterpart to --check-env.
+    # --check-env asks "is the file holding my keys protected?"; this asks
+    # "does the running process know its own secrets, and did any of them
+    # already reach a log file?". The second question is the one that used
+    # to have no answer at all.
+    doctor.add_argument(
+        "--check-secrets",
+        action="store_true",
+        help=(
+            "Audit credential hygiene: prove the log-redaction filter "
+            "actually scrubs, report which declared api_key_env vars are "
+            "set, flag credentials pasted into a base_url, and scan the "
+            "already-written requests.jsonl / audit.jsonl under state_dir "
+            "for live key values. Exit 0 clean / 2 needs attention / 1 leak."
+        ),
+    )
     doctor.add_argument(
         "--config",
         default=None,
@@ -192,6 +208,55 @@ def _build_parser() -> argparse.ArgumentParser:
         ),
     )
 
+    # v2.14.0: `coderouter rollback` — the missing half of --apply.
+    # Both writers (doctor --apply, vscode-init) already dropped a `.bak`
+    # next to every file they rewrote; nothing could put it back. Restore
+    # is a swap, not an overwrite, so running it twice returns you to
+    # where you started rather than destroying the newer version.
+    rollback = sub.add_parser(
+        "rollback",
+        help="Restore files a previous --apply / vscode-init rewrote (v2.14.0).",
+        description=(
+            "Swap each managed file with its .bak sibling: providers.yaml, "
+            "~/.coderouter/model-capabilities.yaml, and (with --workspace) "
+            ".vscode/settings.json and .envrc. The current contents become "
+            "the new .bak, so a second run toggles back. "
+            "Exit codes: 0 restored, 2 nothing to restore, 1 a restore failed."
+        ),
+    )
+    rollback.add_argument(
+        "--config",
+        default=None,
+        help=(
+            "Path to providers.yaml. Defaults to the same file the loader "
+            "would read ($CODEROUTER_CONFIG, then ~/.coderouter/providers.yaml)."
+        ),
+    )
+    rollback.add_argument(
+        "--workspace",
+        metavar="DIR",
+        default=None,
+        help=(
+            "Also restore the vscode-init outputs under DIR: "
+            "DIR/.vscode/settings.json and DIR/.envrc."
+        ),
+    )
+    rollback.add_argument(
+        "--path",
+        action="append",
+        metavar="FILE",
+        default=None,
+        help=(
+            "Restore exactly this file from its .bak sibling. Repeatable. "
+            "When given, the default discovery set is not used."
+        ),
+    )
+    rollback.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Report what would be restored without touching any file.",
+    )
+
     # v1.5-C: `coderouter stats` — live TUI over GET /metrics.json.
     # Lazy-imports ``curses`` inside the runner so the CLI boot stays
     # snappy and environments without curses (rare, but e.g. minimal
@@ -490,6 +555,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.command == "doctor":
         return _run_doctor(args)
 
+    if args.command == "rollback":
+        return _run_rollback(args)
+
     if args.command == "stats":
         # v1.5-C: stats is intentionally a thin wrapper — all logic
         # (fetch, render, curses loop) lives in coderouter.cli_stats so
@@ -526,9 +594,11 @@ def _run_doctor(args: argparse.Namespace) -> int:
     worst-case of the two reports so CI guarding against both leak
     risks AND broken providers can use a single command.
     """
-    if args.check_model is None and args.check_env is None:
+    check_secrets = bool(getattr(args, "check_secrets", False))
+    if args.check_model is None and args.check_env is None and not check_secrets:
         print(
-            "doctor: provide --check-model PROVIDER and/or --check-env [PATH]",
+            "doctor: provide --check-model PROVIDER, --check-env [PATH], "
+            "and/or --check-secrets",
             file=sys.stderr,
         )
         return 1
@@ -541,6 +611,9 @@ def _run_doctor(args: argparse.Namespace) -> int:
     if args.check_env is not None:
         worst_exit = max(worst_exit, _run_check_env(args.check_env))
 
+    if check_secrets:
+        worst_exit = max(worst_exit, _run_check_secrets(args.config))
+
     if args.check_model is not None:
         worst_exit = max(worst_exit, _run_check_model(args))
 
@@ -969,5 +1042,70 @@ def _run_check_env(arg_value: str) -> int:
     return exit_code_for_env_security(report)
 
 
+def _run_rollback(args: argparse.Namespace) -> int:
+    """v2.14.0: put back what ``--apply`` / ``vscode-init`` overwrote.
+
+    Explicit ``--path`` wins over discovery so an operator can restore one
+    file without also reverting an unrelated ``model-capabilities.yaml``
+    edit from last week. Discovery resolves providers.yaml through the
+    loader's own search order rather than a second copy of it.
+    """
+    from coderouter.rollback import (
+        discover_managed_files,
+        exit_code_for_rollback,
+        format_rollback_report,
+        restore_many,
+    )
+
+    explicit = getattr(args, "path", None)
+    if explicit:
+        targets: list[Path] = [Path(p).expanduser() for p in explicit]
+    else:
+        try:
+            config_path: Path | None = _resolve_config_path(args.config)
+        except Exception:
+            # No config anywhere is not fatal here — the workspace files
+            # and the user-layer capabilities file may still have backups.
+            config_path = None
+        targets = discover_managed_files(
+            config_path=config_path,
+            workspace=getattr(args, "workspace", None),
+        )
+
+    outcomes = restore_many(targets, dry_run=bool(args.dry_run))
+    print(format_rollback_report(outcomes, dry_run=bool(args.dry_run)))
+    return exit_code_for_rollback(outcomes)
+
+
+def _run_check_secrets(config_path: str | None) -> int:
+    """v2.14.0: credential-hygiene audit for the running configuration.
+
+    Loads the config through the normal loader — which is also what arms
+    the redaction registry — then runs the suite from
+    :mod:`coderouter.secret_redaction`. A config that fails to load is a
+    blocker (exit 1) rather than a skip: we cannot claim anything about
+    secret hygiene for a file we could not read.
+    """
+    from coderouter.config.loader import load_config
+    from coderouter.secret_redaction import (
+        check_secret_hygiene,
+        exit_code_for_secret_report,
+        format_secret_report,
+    )
+
+    try:
+        config = load_config(config_path)
+    except FileNotFoundError as exc:
+        print(f"doctor: {exc}", file=sys.stderr)
+        return 1
+    except Exception as exc:
+        print(f"doctor: failed to load config: {exc}", file=sys.stderr)
+        return 1
+
+    report = check_secret_hygiene(config)
+    print(format_secret_report(report))
+    return exit_code_for_secret_report(report)
+
+
 if __name__ == "__main__":
     sys.exit(main())

coderouter/config/loader.py

@@ -34,6 +34,7 @@ import yaml
 
 from coderouter.config.schemas import CodeRouterConfig
 from coderouter.logging import get_logger
+from coderouter.secret_redaction import register_config_secrets, register_secret
 
 logger = get_logger(__name__)
 
@@ -253,12 +254,34 @@ def load_config(path: str | os.PathLike[str] | None = None) -> CodeRouterConfig:
     elif env_paid in {"0", "false", "no", "off"}:
         config.allow_paid = False
 
+    # v2.14.0: arm log redaction before anything else runs. Registering here
+    # (rather than lazily on the first resolve_api_key call) means the
+    # startup log lines — which name providers and profiles — are already
+    # scrubbed, and so is any config-validation error raised downstream.
+    # Only labels are logged; the values never leave the registry.
+    registered = register_config_secrets(config)
+    if registered:
+        logger.info(
+            "secret-redaction-armed",
+            extra={"count": len(registered), "labels": sorted(set(registered))},
+        )
+
     return config
 
 
 def resolve_api_key(api_key_env: str | None) -> str | None:
-    """Look up an API key from the named env var. Returns None if unset."""
+    """Look up an API key from the named env var. Returns None if unset.
+
+    v2.14.0: the resolved value is registered with
+    :mod:`coderouter.secret_redaction` before it is handed out. This is the
+    moment a credential enters the process, so it is the one place that can
+    guarantee the log scrubber knows about every key we actually use —
+    including keys for providers added by an adapter plugin, which never
+    pass through ``register_config_secrets``.
+    """
     if not api_key_env:
         return None
     value = os.environ.get(api_key_env, "").strip()
+    if value:
+        register_secret(value, api_key_env)
     return value or None

coderouter/config/schemas.py

@@ -371,6 +371,120 @@ RESTART_COMMAND_SHELL_META_RE = re.compile(r"(&&|\|\||\||;|>|<|\$\(|`)")
 RESTART_COMMAND_ENV_PREFIX_RE = re.compile(r"^\w+=")
 
 
+class CredentialRefresh(BaseModel):
+    """How to make a vendor CLI rotate the token it wrote to disk.
+
+    Deliberately not an OAuth client. Every vendor has its own endpoint,
+    client id, rotation policy and error shape, and all of them change —
+    delegating to the CLI that owns the file is the version that survives
+    contact with a moving vendor.
+
+    ``command`` is an argv **list**, dispatched with ``shell=False``. Same
+    trust decision as v2.13.0's ``restart_command``: a string that goes
+    through a shell turns a config file into arbitrary code execution.
+    There is no string form here to have to refuse.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    command: list[str] = Field(
+        ...,
+        min_length=1,
+        description=(
+            "argv for the vendor CLI, e.g. ['grok', 'models']. Run with "
+            "shell=False; no shell metacharacters are interpreted."
+        ),
+    )
+    early_ratio: float = Field(
+        default=0.5,
+        ge=0.0,
+        le=1.0,
+        description=(
+            "Refresh when the remaining lifetime drops below this fraction "
+            "of itself. Early refresh avoids a token dying mid-request."
+        ),
+    )
+    min_lead_s: float = Field(
+        default=300.0,
+        ge=0.0,
+        description="Always refresh at least this many seconds before expiry.",
+    )
+    timeout_s: float = Field(
+        default=30.0,
+        gt=0.0,
+        le=600.0,
+        description="Hard timeout for the refresh command.",
+    )
+
+
+class ProviderCredential(BaseModel):
+    """Where this provider's credential comes from (v2.14.0).
+
+    ``source: env`` is the historical behaviour, spelled out. ``source:
+    cli_session`` borrows the token a vendor CLI already wrote to disk, so
+    a subscription-authenticated provider can be an ordinary
+    ``openai_compat`` entry instead of a ``kind: agent_cli`` island — and
+    therefore takes part in fallback chains, auto-routing, the budget
+    tracker and every other routing feature.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    source: Literal["env", "cli_session"] = Field(
+        default="env",
+        description="'env' reads an environment variable; 'cli_session' reads a JSON file.",
+    )
+    env: str | None = Field(
+        default=None, description="source=env: the environment variable name."
+    )
+    path: str | None = Field(
+        default=None,
+        description=(
+            "source=cli_session: the JSON file the vendor CLI writes, e.g. "
+            "~/.kimi-code/credentials/kimi-code.json. Must live under $HOME."
+        ),
+    )
+    field: str = Field(
+        default="access_token",
+        description="Dotted path to the token inside that JSON (e.g. 'tokens.access').",
+    )
+    expiry_field: str = Field(
+        default="expires_at",
+        description=(
+            "Dotted path to the expiry. Epoch seconds or milliseconds; both "
+            "are accepted. Absent means 'no expiry info' — the upstream 401 "
+            "becomes the signal instead."
+        ),
+    )
+    refresh: CredentialRefresh | None = Field(
+        default=None,
+        description="Omit to never refresh (a long-lived token, or one you rotate yourself).",
+    )
+
+    @model_validator(mode="after")
+    def _check_source_requirements(self) -> Self:
+        """Each source needs its own field, and only its own field."""
+        if self.source == "env":
+            if not self.env:
+                raise ValueError("credential.source='env' requires credential.env")
+            if self.path:
+                raise ValueError("credential.path is meaningless for source='env'")
+        if self.source == "cli_session":
+            if not self.path:
+                raise ValueError(
+                    "credential.source='cli_session' requires credential.path"
+                )
+            if self.env:
+                raise ValueError("credential.env is meaningless for source='cli_session'")
+            from coderouter.credentials import session_path_is_sane
+
+            if not session_path_is_sane(self.path):
+                raise ValueError(
+                    f"credential.path must live under your home directory: {self.path}"
+                )
+        return self
+
+
 class ProviderConfig(BaseModel):
     """A single provider entry from providers.yaml.
 
@@ -416,6 +530,19 @@ class ProviderConfig(BaseModel):
         default=None,
         description="Env var name holding the API key. None = no auth (e.g. local).",
     )
+    # v2.14.0: the general form of the above. Mutually exclusive with
+    # api_key_env — a resolver that silently fell back between sources would
+    # make "which credential is this request actually using?" unanswerable,
+    # which is the question an operator asks at exactly the wrong moment.
+    credential: ProviderCredential | None = Field(
+        default=None,
+        description=(
+            "Where the credential comes from. Omit to use api_key_env. "
+            "source='cli_session' reads the token a vendor CLI already wrote "
+            "to disk, so a subscription provider can be a plain "
+            "openai_compat entry that takes part in fallback chains."
+        ),
+    )
 
     # Routing-relevant flags
     paid: bool = Field(
@@ -611,6 +738,23 @@ class ProviderConfig(BaseModel):
         validate_output_filters(self.output_filters)
         return self
 
+    @model_validator(mode="after")
+    def _check_credential_exclusive(self) -> Self:
+        """``api_key_env`` and ``credential`` cannot both be set.
+
+        Failing at load time is the whole point: two credential sources on
+        one provider is a question ("which one won?") that should never
+        reach a request, let alone a log line an operator has to reverse
+        engineer at 2am.
+        """
+        if self.credential is not None and self.api_key_env:
+            raise ValueError(
+                f"provider {self.name!r}: set either api_key_env or credential, "
+                "not both (credential.source='env' with credential.env=... is "
+                "the spelled-out form of api_key_env)"
+            )
+        return self
+
     @model_validator(mode="after")
     def _check_kind_requirements(self) -> ProviderConfig:
         """Enforce per-``kind`` field requirements (external-agents design §5.2.2).