coderouter-cli 2.13.0__py3-none-any.whl → 2.14.0__py3-none-any.whl

coderouter/credentials.py

@@ -0,0 +1,332 @@
+"""Credential resolution, including CLI-session borrowing (v2.14.0).
+
+Until now a provider's credential could only be an env var. That is fine
+for API keys and useless for the thing an increasing number of vendors
+actually sell: a subscription, authenticated by an OAuth token that their
+own CLI already fetched and wrote to disk.
+
+CodeRouter's existing answer to those was ``kind: agent_cli`` — spawn the
+vendor's CLI once per request and read its stdout. It works, and it
+throws away almost everything CodeRouter is for. A one-shot ``exec`` has
+no streaming, no tool-call repair, no context-budget guard, and it does
+not sit in a fallback chain the way an HTTP provider does. The vendor's
+subscription ends up as an island.
+
+The alternative, which is what codex-router does for Kimi and Grok, is to
+skip the process entirely: **read the token the CLI already wrote, and
+make the HTTP call ourselves.** The provider then becomes an ordinary
+``openai_compat`` entry, and every routing feature applies to it —
+"use the subscription until it 429s, then fall through to a free cloud
+model, then to local llama.cpp" becomes an ordinary chain.
+
+    - name: kimi-sub
+      kind: openai_compat
+      base_url: https://api.moonshot.cn/v1
+      credential:
+        source: cli_session
+        path: ~/.kimi-code/credentials/kimi-code.json
+        field: access_token
+        expiry_field: expires_at
+        refresh:
+          command: ["kimi", "auth", "status"]
+
+Refresh: delegate, don't reimplement
+------------------------------------
+Refreshing is the part that rots. Every vendor has its own endpoint,
+client id, rotation policy and error shape, and all of them change. So
+this module does not implement OAuth. It runs the vendor's own CLI and
+re-reads the file — codex-router's approach for Grok, and the reason that
+path has survived contact with a moving vendor while its bespoke Kimi
+refresh has not.
+
+The command is an argv **list**, dispatched with ``shell=False``. That is
+the same trust decision v2.13.0 made for ``restart_command``: a string
+that goes through a shell turns a config file into arbitrary code
+execution, and half-executing one (``touch a; b`` under ``shell=False``
+creates a file literally named ``a;`` and reports success) is worse than
+refusing. Here there is no string form to refuse — the schema only
+accepts a list.
+
+Concurrency
+-----------
+Two workers hitting an expired token would otherwise both shell out.
+Refresh is single-flighted in-process by a per-path lock, and serialised
+across processes by an advisory ``flock`` on a sidecar file where the
+platform has one. After acquiring either lock the file is re-read before
+deciding to refresh, because the holder of the lock may already have done
+the work.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import threading
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from coderouter.logging import get_logger
+from coderouter.secret_redaction import register_secret
+
+__all__ = [
+    "CredentialError",
+    "resolve_provider_credential",
+]
+
+logger = get_logger(__name__)
+
+# One lock per session file, created on demand. Keyed by the resolved
+# absolute path so two providers pointing at the same file share it.
+_locks: dict[str, threading.Lock] = {}
+_locks_guard = threading.Lock()
+
+
+class CredentialError(RuntimeError):
+    """A credential was configured but could not be produced."""
+
+
+@dataclass(frozen=True)
+class _SessionRead:
+    token: str | None
+    expires_at: float | None
+
+
+def _lock_for(path: str) -> threading.Lock:
+    with _locks_guard:
+        return _locks.setdefault(path, threading.Lock())
+
+
+def _dotted_get(payload: Any, dotted: str) -> Any:
+    """Fetch ``a.b.c`` out of nested mappings.
+
+    Vendors nest differently (``access_token`` at the root for Kimi, under
+    ``tokens`` for others), so the field is a path rather than a key. A
+    missing segment returns ``None`` rather than raising — an absent token
+    is a normal state (the operator has not logged in yet) and the caller
+    turns it into a clear message.
+    """
+    current = payload
+    for segment in dotted.split("."):
+        if not isinstance(current, dict) or segment not in current:
+            return None
+        current = current[segment]
+    return current
+
+
+def _as_epoch_seconds(value: Any) -> float | None:
+    """Normalise an expiry field to epoch seconds.
+
+    Accepts seconds and milliseconds, because both are common and telling
+    them apart is unambiguous: any plausible expiry in seconds is under
+    1e11, and any in milliseconds is over it. A value we cannot read at
+    all yields ``None``, which is treated as "no expiry information" —
+    the token is used and the upstream 401 becomes the signal instead.
+    """
+    if isinstance(value, bool) or value is None:
+        return None
+    if isinstance(value, (int, float)):
+        seconds = float(value)
+        return seconds / 1000.0 if seconds > 1e11 else seconds
+    if isinstance(value, str):
+        try:
+            return _as_epoch_seconds(float(value))
+        except ValueError:
+            return None
+    return None
+
+
+def _read_session(path: Path, *, field: str, expiry_field: str) -> _SessionRead:
+    """Read the token (and its expiry, if present) out of a session file."""
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        raise CredentialError(f"cannot read session file {path}: {exc}") from exc
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise CredentialError(f"session file {path} is not valid JSON: {exc}") from exc
+
+    token = _dotted_get(payload, field)
+    if token is not None and not isinstance(token, str):
+        raise CredentialError(
+            f"session file {path}: field {field!r} is "
+            f"{type(token).__name__}, expected a string"
+        )
+    expires_at = _as_epoch_seconds(_dotted_get(payload, expiry_field))
+    return _SessionRead(token=token or None, expires_at=expires_at)
+
+
+def _needs_refresh(read: _SessionRead, *, early_ratio: float, min_lead_s: float) -> bool:
+    """Whether to refresh now.
+
+    Refresh early rather than on expiry: a token that dies mid-request
+    costs a retry and a confusing upstream error. ``early_ratio`` is a
+    fraction of the *remaining* lifetime as seen right now, floored by
+    ``min_lead_s`` — so a long-lived token still refreshes several minutes
+    before it lapses rather than at the last second.
+    """
+    if read.token is None:
+        return True
+    if read.expires_at is None:
+        return False
+    remaining = read.expires_at - time.time()
+    return remaining <= max(min_lead_s, remaining * early_ratio)
+
+
+def _run_refresh(command: list[str], *, timeout_s: float, path: Path) -> None:
+    """Run the vendor CLI so it rotates the token, then let the caller re-read.
+
+    ``shell=False`` with an argv list: the config file names a program, it
+    does not get to compose a shell command. Failures are logged and
+    swallowed — a stale-but-present token is still worth trying, and the
+    upstream 401 is a better error for the operator than a refresh
+    traceback that hides it.
+    """
+    try:
+        completed = subprocess.run(
+            command,
+            shell=False,
+            capture_output=True,
+            timeout=timeout_s,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError) as exc:
+        logger.warning(
+            "credential-refresh-failed",
+            extra={"path": str(path), "command": command[0], "error": str(exc)},
+        )
+        return
+    if completed.returncode != 0:
+        # stderr is deliberately NOT logged: a failing auth CLI is exactly
+        # the thing most likely to print a token or a device code.
+        logger.warning(
+            "credential-refresh-nonzero",
+            extra={
+                "path": str(path),
+                "command": command[0],
+                "returncode": completed.returncode,
+            },
+        )
+
+
+def _flock(handle: Any, *, exclusive: bool = True) -> Any:
+    """Best-effort advisory lock; a no-op where the platform has none."""
+    try:
+        import fcntl
+    except ImportError:  # pragma: no cover - Windows
+        return None
+    fcntl.flock(handle, fcntl.LOCK_EX if exclusive else fcntl.LOCK_SH)
+    return fcntl
+
+
+def _resolve_cli_session(spec: Any, provider_name: str) -> str | None:
+    """Read (and if needed refresh) a token a vendor CLI wrote to disk."""
+    path = Path(str(spec.path)).expanduser()
+    field = spec.field
+    expiry_field = spec.expiry_field
+
+    read = _read_session(path, field=field, expiry_field=expiry_field)
+    refresh = spec.refresh
+    if refresh is None or not _needs_refresh(
+        read, early_ratio=refresh.early_ratio, min_lead_s=refresh.min_lead_s
+    ):
+        return _register(read.token, provider_name)
+
+    with _lock_for(str(path)):
+        # Re-read under the in-process lock: another worker may have
+        # refreshed while we waited.
+        read = _read_session(path, field=field, expiry_field=expiry_field)
+        if not _needs_refresh(
+            read, early_ratio=refresh.early_ratio, min_lead_s=refresh.min_lead_s
+        ):
+            return _register(read.token, provider_name)
+
+        lock_path = path.with_name(path.name + ".coderouter-lock")
+        try:
+            lock_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(lock_path, "a+") as handle:
+                _flock(handle)
+                # And once more across processes, same reason.
+                read = _read_session(path, field=field, expiry_field=expiry_field)
+                if _needs_refresh(
+                    read,
+                    early_ratio=refresh.early_ratio,
+                    min_lead_s=refresh.min_lead_s,
+                ):
+                    logger.info(
+                        "credential-refresh-started",
+                        extra={"provider": provider_name, "command": refresh.command[0]},
+                    )
+                    _run_refresh(
+                        list(refresh.command), timeout_s=refresh.timeout_s, path=path
+                    )
+                    read = _read_session(path, field=field, expiry_field=expiry_field)
+        except OSError as exc:
+            logger.warning(
+                "credential-lock-failed",
+                extra={"path": str(lock_path), "error": str(exc)},
+            )
+
+    return _register(read.token, provider_name)
+
+
+def _register(token: str | None, provider_name: str) -> str | None:
+    """Arm the log scrubber before the token goes anywhere near a header."""
+    if token:
+        register_secret(token, f"{provider_name}-session")
+    return token
+
+
+def resolve_provider_credential(config: Any) -> str | None:
+    """Return the credential for ``config``, or ``None`` when there is none.
+
+    Order of precedence is deliberately not "try everything":
+    ``credential`` and ``api_key_env`` are mutually exclusive at the
+    schema level, so exactly one path can apply. A resolver that silently
+    fell back between sources would make "which credential is this request
+    actually using?" unanswerable, which is the question an operator asks
+    at exactly the wrong moment.
+    """
+    from coderouter.config.loader import resolve_api_key
+
+    spec = getattr(config, "credential", None)
+    if spec is None:
+        return resolve_api_key(getattr(config, "api_key_env", None))
+
+    name = str(getattr(config, "name", "?"))
+    if spec.source == "env":
+        return resolve_api_key(spec.env)
+    if spec.source == "cli_session":
+        try:
+            return _resolve_cli_session(spec, name)
+        except CredentialError as exc:
+            # A missing or malformed session file is an operator problem
+            # (not logged in yet, vendor changed its layout), not a crash.
+            # Returning None sends the request unauthenticated, the upstream
+            # 401 fires, and the fallback chain moves on.
+            logger.warning(
+                "credential-unavailable",
+                extra={"provider": name, "source": spec.source, "error": str(exc)},
+            )
+            return None
+    raise CredentialError(f"provider {name}: unknown credential source {spec.source!r}")
+
+
+def session_path_is_sane(path: str) -> bool:
+    """Reject a session path that reaches outside the user's home.
+
+    ``providers.yaml`` is operator-owned config, at the same trust level as
+    ``launcher.backends[*].binary`` — but v2.13.0 exists because that
+    assumption broke once already when a file could be picked up from the
+    working directory. A vendor CLI writes under ``$HOME``; nothing
+    legitimate needs ``/etc/shadow``.
+    """
+    try:
+        resolved = Path(path).expanduser().resolve()
+        home = Path.home().resolve()
+    except (OSError, RuntimeError):
+        return False
+    return resolved == home or home in resolved.parents or os.name == "nt"

coderouter/doctor_apply.py

@@ -520,6 +520,34 @@ def _resolve_target_path(
     return None
 
 
+def _undo_partial_apply(
+    backups: dict[str, str], created_paths: list[Path]
+) -> int:
+    """Put back every file this invocation already rewrote.
+
+    Best-effort by design: a rollback that raises would mask the original
+    write failure, which is the thing the operator actually needs to see.
+    Files we created from nothing are removed; files we overwrote are
+    restored from the ``.bak`` copy taken moments earlier in the same loop.
+
+    Returns the number of files successfully reverted, for the error text.
+    """
+    reverted = 0
+    for target_str, backup_str in backups.items():
+        try:
+            shutil.copy2(backup_str, target_str)
+            reverted += 1
+        except OSError:
+            continue
+    for created in created_paths:
+        try:
+            created.unlink(missing_ok=True)
+            reverted += 1
+        except OSError:
+            continue
+    return reverted
+
+
 def apply_doctor_patches(
     *,
     report: Any,  # DoctorReport — typed Any to avoid an import cycle
@@ -637,6 +665,9 @@ def apply_doctor_patches(
     written = False
     written_paths: list[str] = []
     backups: dict[str, str] = {}
+    # Files this invocation created from nothing. They have no backup to
+    # restore from, so undoing them means deleting them again.
+    created_paths: list[Path] = []
     for target_path in target_order:
         doc, before_text = docs_by_path[target_path]
         after_text = _dump_yaml_with_comments(doc)
@@ -656,15 +687,29 @@ def apply_doctor_patches(
                 reformat_only[str(target_path)] = diff_text
         if write and target_changed:
             # Backup first (only when we have a pre-existing file).
-            if target_path.is_file():
-                backup_path = target_path.with_suffix(
-                    target_path.suffix + PROVIDERS_BACKUP_SUFFIX
-                )
-                shutil.copy2(target_path, backup_path)
-                backups[str(target_path)] = str(backup_path)
-            else:
-                target_path.parent.mkdir(parents=True, exist_ok=True)
-            target_path.write_text(after_text, encoding="utf-8")
+            try:
+                if target_path.is_file():
+                    backup_path = target_path.with_suffix(
+                        target_path.suffix + PROVIDERS_BACKUP_SUFFIX
+                    )
+                    shutil.copy2(target_path, backup_path)
+                    backups[str(target_path)] = str(backup_path)
+                else:
+                    target_path.parent.mkdir(parents=True, exist_ok=True)
+                    created_paths.append(target_path)
+                target_path.write_text(after_text, encoding="utf-8")
+            except OSError as exc:
+                # v2.14.0: an apply that spans two files used to leave the
+                # first one rewritten when the second failed — a half-applied
+                # config the operator had no way to name, let alone undo. Roll
+                # the completed writes back before surfacing the error, so a
+                # failed apply is always a no-op rather than a partial one.
+                undone = _undo_partial_apply(backups, created_paths)
+                raise DoctorApplyError(
+                    f"failed to write {target_path}: {exc}. "
+                    f"Rolled back {undone} already-written file(s); "
+                    "no partial apply was left on disk."
+                ) from exc
             written = True
             written_paths.append(str(target_path))
 

coderouter/ingress/dashboard_routes.py

@@ -34,9 +34,11 @@ Why inline JS / CSS
 
 from __future__ import annotations
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Request
 from fastapi.responses import HTMLResponse
 
+from coderouter.ingress.ui_auth import auth_required, require_ui_token
+
 router = APIRouter()
 
 
@@ -219,6 +221,17 @@ _DASHBOARD_HTML = r"""<!doctype html>
   // Poll interval — 2s matches plan.md §12.3.5. Short enough to feel
   // live on a local dev machine, long enough that HTTP overhead is noise.
   const POLL_MS = 2000;
+  // v2.14.0: the token is entered by the operator and kept in
+  // sessionStorage (cleared when the tab closes). The page is told only
+  // whether auth is on, never what the token is.
+  const AUTH_REQUIRED = __METRICS_AUTH_REQUIRED__;
+  const TOKEN_KEY = "coderouter-metrics-token";
+  let metricsToken = sessionStorage.getItem(TOKEN_KEY) || "";
+  if (AUTH_REQUIRED && !metricsToken) {
+    const v = window.prompt("CODEROUTER_METRICS_TOKEN を入力してください", "");
+    if (v) { metricsToken = v.trim(); sessionStorage.setItem(TOKEN_KEY, metricsToken); }
+  }
+  const authHeaders = () => metricsToken ? {"X-CodeRouter-Token": metricsToken} : {};
   // Sparkline ring — 60 samples at 2s/sample → 2 minutes of history.
   const SPARK_POINTS = 60;
   const sparkBuffer = [];
@@ -524,7 +537,7 @@ _DASHBOARD_HTML = r"""<!doctype html>
 
   const poll = async () => {
     try {
-      const resp = await fetch("/metrics.json", {cache: "no-store"});
+      const resp = await fetch("/metrics.json", {cache: "no-store", headers: authHeaders()});
       if (!resp.ok) {
         renderError("HTTP " + resp.status);
         return;
@@ -547,7 +560,7 @@ _DASHBOARD_HTML = r"""<!doctype html>
 
 
 @router.get("/dashboard", response_class=HTMLResponse)
-async def dashboard() -> HTMLResponse:
+async def dashboard(request: Request) -> HTMLResponse:
     """Serve the single-page dashboard HTML.
 
     The page is entirely static — all data comes from polling
@@ -556,4 +569,11 @@ async def dashboard() -> HTMLResponse:
     the template lives in this module as a string, keeping the shipping
     unit a single Python file with no template dir to configure.
     """
-    return HTMLResponse(content=_DASHBOARD_HTML)
+    require_ui_token(request)
+    # Only the boolean reaches the page — never the token. Same split the
+    # v2.13.0 launcher fix introduced after ``curl /launcher | grep``
+    # recovered the shared secret straight out of the HTML.
+    html = _DASHBOARD_HTML.replace(
+        "__METRICS_AUTH_REQUIRED__", "true" if auth_required() else "false"
+    )
+    return HTMLResponse(content=html)

coderouter/ingress/metrics_routes.py

@@ -28,7 +28,9 @@ from typing import Any
 from fastapi import APIRouter, Request
 from fastapi.responses import PlainTextResponse
 
+from coderouter.ingress.ui_auth import require_ui_token
 from coderouter.metrics import format_prometheus, get_collector
+from coderouter.secret_redaction import redact
 
 router = APIRouter()
 
@@ -48,6 +50,11 @@ async def metrics_json(request: Request) -> dict[str, Any]:
     dashboard uses it to classify providers into local / free / paid
     for the usage-mix bar without a second endpoint round-trip.
     """
+    # v2.14.0: opt-in token first, before anything is computed. The
+    # ordering is the point — codex-router's /health answers before its
+    # own auth check and leaks the live session name to any local caller.
+    require_ui_token(request)
+
     snapshot = get_collector().snapshot()
 
     config = getattr(request.app.state, "config", None)
@@ -66,7 +73,10 @@ async def metrics_json(request: Request) -> dict[str, Any]:
                     "paid": p.paid,
                     # ``HttpUrl`` is not JSON-serializable directly in Pydantic v2;
                     # the cast also makes the shape stable if Pydantic switches types.
-                    "base_url": str(p.base_url),
+                    # v2.14.0: run it through the scrubber. A base_url is the
+                    # one config field an operator can paste a credential into
+                    # (``?api_key=…``), and this endpoint hands it to a browser.
+                    "base_url": redact(str(p.base_url)),
                 }
                 for p in config.providers
             ],
@@ -79,7 +89,7 @@ async def metrics_json(request: Request) -> dict[str, Any]:
 
 
 @router.get("/metrics", response_class=PlainTextResponse)
-async def metrics_prometheus() -> PlainTextResponse:
+async def metrics_prometheus(request: Request) -> PlainTextResponse:
     """Prometheus text exposition format (v1.5-B).
 
     Convention-compliant endpoint path for Prometheus scrapers. Returns
@@ -88,5 +98,6 @@ async def metrics_prometheus() -> PlainTextResponse:
     Sits alongside :func:`metrics_json` (not a replacement) — JSON is
     for internal UI, Prometheus is for external time-series DBs.
     """
+    require_ui_token(request)
     body = format_prometheus(get_collector().snapshot())
     return PlainTextResponse(content=body, media_type=_PROM_CONTENT_TYPE)

coderouter/ingress/ui_auth.py

@@ -0,0 +1,94 @@
+"""Opt-in token auth for the read-only UI surfaces (v2.14.0).
+
+``/dashboard``, ``/metrics.json`` and ``/metrics`` were the last endpoints
+with no authentication story at all. They change nothing, so they were
+never part of the H-8 state-changing-endpoint work — but "read-only" is
+not "harmless". ``/metrics.json`` returns every provider's name, kind,
+paid flag and ``base_url``, plus the profile graph: the full topology of
+which models an operator runs and which vendors they pay. On a laptop
+that is fine. On a box where the port is reachable by anything else, it
+is a free reconnaissance endpoint.
+
+The failure we are deliberately not repeating is codex-router's: its
+``/health`` answers *before* the caller-key check and includes the live
+session name, so any local process can read what the operator is working
+on. Cheap to avoid, easy to ship by accident — the check just has to come
+first.
+
+Contract
+--------
+Identical in shape to :func:`coderouter.ingress.launcher_routes._require_launcher_token`,
+so an operator learns it once:
+
+* ``CODEROUTER_METRICS_TOKEN`` unset → the endpoints stay open exactly as
+  they were, and a one-time warning is logged. Backwards compatible by
+  construction; nobody's Prometheus scrape breaks on upgrade.
+* Set → every request must carry a matching ``X-CodeRouter-Token`` header,
+  compared with :func:`secrets.compare_digest`.
+
+The token is deliberately **not** accepted as a query parameter. A token
+in a URL lands in access logs, in ``Referer`` headers, and in the browser
+history — and this codebase now has a log scrubber precisely because
+credentials end up in places nobody predicted.
+"""
+
+from __future__ import annotations
+
+import os
+import secrets
+
+from fastapi import HTTPException, Request
+
+from coderouter.logging import get_logger
+
+__all__ = ["METRICS_TOKEN_ENV", "METRICS_TOKEN_HEADER", "require_ui_token"]
+
+logger = get_logger(__name__)
+
+METRICS_TOKEN_ENV = "CODEROUTER_METRICS_TOKEN"
+METRICS_TOKEN_HEADER = "X-CodeRouter-Token"
+
+# One warning per process, not per request — a 2-second dashboard poll
+# would otherwise bury every other log line.
+_warning_emitted = False
+
+
+def require_ui_token(request: Request) -> None:
+    """Enforce the metrics/dashboard token when one is configured.
+
+    Raises ``401`` on mismatch. Returns silently when the env var is
+    unset, after logging a single ``metrics-auth-disabled`` line.
+    """
+    global _warning_emitted
+    expected = os.environ.get(METRICS_TOKEN_ENV, "")
+    if not expected:
+        if not _warning_emitted:
+            logger.warning(
+                "metrics-auth-disabled",
+                extra={
+                    "hint": (
+                        f"{METRICS_TOKEN_ENV} is not set; /dashboard, "
+                        "/metrics.json and /metrics are unauthenticated and "
+                        "expose provider names, base_urls and the profile "
+                        "graph. Set it when binding to anything but loopback."
+                    ),
+                },
+            )
+            _warning_emitted = True
+        return
+    provided = request.headers.get(METRICS_TOKEN_HEADER, "")
+    if not secrets.compare_digest(provided, expected):
+        raise HTTPException(
+            status_code=401, detail="Invalid or missing metrics token."
+        )
+
+
+def auth_required() -> bool:
+    """Whether a token is configured — safe to embed in the page.
+
+    The dashboard needs to know *that* auth is on so it can prompt; it
+    must never receive the token itself. Same split as the v2.13.0 fix
+    that stopped ``GET /launcher`` embedding ``CODEROUTER_LAUNCHER_TOKEN``
+    straight into the HTML, where ``curl | grep`` recovered it.
+    """
+    return bool(os.environ.get(METRICS_TOKEN_ENV, ""))

coderouter/logging.py

@@ -23,6 +23,8 @@ import logging
 import sys
 from typing import Any, Literal, TypedDict
 
+from coderouter.secret_redaction import install_secret_filter
+
 
 class JsonLineFormatter(logging.Formatter):
     """Emit each record as a single JSON line."""
@@ -105,6 +107,11 @@ def configure_logging(level: str = "INFO") -> None:
             root.removeHandler(h)
     handler = logging.StreamHandler(sys.stderr)
     handler.setFormatter(JsonLineFormatter())
+    # v2.14.0: scrub registered credentials before the formatter runs. The
+    # filter is attached per-handler (not to the root logger) because logger
+    # filters do not apply to records propagated up from child loggers —
+    # every emitting module in this codebase uses its own module logger.
+    install_secret_filter(handler)
     setattr(handler, _CODEROUTER_LOG_HANDLER_MARKER, True)
     root.addHandler(handler)