coderouter-cli 2.13.0__py3-none-any.whl → 2.15.0__py3-none-any.whl

coderouter/adapters/anthropic_native.py

@@ -44,9 +44,14 @@ from coderouter.adapters.base import (
     ChatResponse,
     ProviderCallOverrides,
     StreamChunk,
+    StreamTruncatedError,
+)
+from coderouter.credentials import resolve_provider_credential
+from coderouter.logging import (
+    get_logger,
+    log_output_filter_applied,
+    log_stream_truncation_detected,
 )
-from coderouter.config.loader import resolve_api_key
-from coderouter.logging import get_logger, log_output_filter_applied
 from coderouter.output_filters import OutputFilterChain
 from coderouter.translation.anthropic import (
     AnthropicRequest,
@@ -74,6 +79,74 @@ _RETRYABLE_STATUSES = {404, 408, 425, 429, 500, 502, 503, 504}
 _DEFAULT_ANTHROPIC_VERSION = "2023-06-01"
 
 
+class _AnthropicTerminatorTracker:
+    """v2.15.0: watch an Anthropic SSE event stream for its terminator.
+
+    The parse loop in :meth:`AnthropicAdapter.stream_anthropic` used to be
+    stateless across events — ``current_event`` was reset on every blank
+    line and nothing remembered whether the stream had ended *properly*.
+    That made "upstream sent 30 deltas and hung up" indistinguishable from
+    "upstream sent the whole message". This tracker is the missing memory.
+
+    What counts as a terminator (deliberately generous, to keep the false
+    positive rate down — see ``stream_truncation_action`` in
+    ``config/schemas.py``):
+
+    * ``message_stop`` — the canonical Anthropic terminator.
+    * ``message_delta`` carrying a non-null ``stop_reason`` — the message is
+      semantically complete even if the provider omits ``message_stop``.
+      Some Anthropic-compatible local servers do exactly that, and their
+      content is *not* truncated, so flagging them would be a false positive.
+    * a top-level ``error`` event — the upstream ended the stream on purpose
+      and the frame is forwarded to the client verbatim (current behavior).
+      Reporting truncation on top would double-report one failure.
+
+    ``open_block_type`` tracks the currently-open content block so a stream
+    cut in the middle of a ``tool_use`` block's ``input_json_delta`` can be
+    reported as such: that is the case where the translation layer's
+    terminator synthesis closes a block whose argument JSON is provably
+    incomplete.
+    """
+
+    __slots__ = ("events", "open_block_type", "saw_start", "saw_terminator")
+
+    def __init__(self) -> None:
+        """Start with nothing observed."""
+        self.saw_terminator: bool = False
+        self.saw_start: bool = False
+        self.events: int = 0
+        self.open_block_type: str | None = None
+
+    def observe(self, event_type: str, data: Any) -> None:
+        """Fold one parsed SSE event into the tracked state.
+
+        ``data`` is whatever ``json.loads`` produced for the block, so it is
+        not guaranteed to be a mapping; non-dict payloads are treated as
+        empty rather than raising inside a streaming hot path.
+        """
+        self.events += 1
+        if not isinstance(data, dict):
+            data = {}
+        if event_type == "message_start":
+            self.saw_start = True
+        elif event_type == "content_block_start":
+            block = data.get("content_block")
+            self.open_block_type = block.get("type") if isinstance(block, dict) else None
+        elif event_type == "content_block_stop":
+            self.open_block_type = None
+        elif event_type == "message_delta":
+            delta = data.get("delta")
+            if isinstance(delta, dict) and delta.get("stop_reason"):
+                self.saw_terminator = True
+        elif event_type in {"message_stop", "error"}:
+            self.saw_terminator = True
+
+    @property
+    def tool_call_in_flight(self) -> bool:
+        """True when a ``tool_use`` block was still open at end-of-stream."""
+        return self.open_block_type == "tool_use"
+
+
 def anthropic_messages_url(base_url: str) -> str:
     """Resolve the ``/v1/messages`` endpoint URL from a ``base_url``.
 
@@ -134,7 +207,9 @@ class AnthropicAdapter(BaseAdapter):
                 self.config.extra_body.get("anthropic_version", _DEFAULT_ANTHROPIC_VERSION)
             ),
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: see openai_compat._headers — same resolver, so an
+        # Anthropic-protocol provider can also ride a CLI session token.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["x-api-key"] = api_key
         # v0.4-D: forward the client's anthropic-beta header verbatim.
@@ -473,6 +548,12 @@ class AnthropicAdapter(BaseAdapter):
         filter_chains: dict[int, OutputFilterChain] = {}
         logged_flag: list[bool] = [False]
 
+        # v2.15.0 (stream-truncation): remember whether the upstream ever
+        # terminated its message. Resolved once per call — the knob is a
+        # profile-level setting threaded in through ProviderCallOverrides.
+        truncation_action = self.effective_stream_truncation_action(overrides)
+        terminator = _AnthropicTerminatorTracker()
+
         try:
             # H3: stream over the shared client (pool / keep-alive / TLS
             # reuse). Only the ``stream(...)`` context is scoped here; the
@@ -512,6 +593,7 @@ class AnthropicAdapter(BaseAdapter):
                                 current_event = None
                                 data_lines = []
                                 continue
+                            terminator.observe(current_event, data_obj)
                             for out_event in self._process_stream_event_for_filters(
                                 AnthropicStreamEvent(type=current_event, data=data_obj),
                                 chains=filter_chains,
@@ -540,12 +622,37 @@ class AnthropicAdapter(BaseAdapter):
                     except json.JSONDecodeError:
                         data_obj = None
                     if data_obj is not None:
+                        terminator.observe(current_event, data_obj)
                         for out_event in self._process_stream_event_for_filters(
                             AnthropicStreamEvent(type=current_event, data=data_obj),
                             chains=filter_chains,
                             logged_flag=logged_flag,
                         ):
                             yield out_event
+
+            # v2.15.0 (stream-truncation): the upstream line iterator is
+            # exhausted. Reaching here with no terminator observed means the
+            # HTTP body ended cleanly while the Anthropic message was still
+            # open — the exact case transport-level error handling below
+            # cannot see (``httpx.RemoteProtocolError`` and timeouts already
+            # raise). Under ``off`` this block is inert, which is what keeps
+            # the default byte-for-byte identical to v2.14.0.
+            if truncation_action != "off" and not terminator.saw_terminator:
+                log_stream_truncation_detected(
+                    logger,
+                    self.name,
+                    action=truncation_action,
+                    wire="anthropic",
+                    events_forwarded=terminator.events,
+                    saw_stream_start=terminator.saw_start,
+                    tool_call_in_flight=terminator.tool_call_in_flight,
+                )
+                if truncation_action == "error":
+                    raise StreamTruncatedError(
+                        "upstream stream truncated (no message_stop terminator)",
+                        provider=self.name,
+                        tool_call_in_flight=terminator.tool_call_in_flight,
+                    )
         except httpx.TimeoutException as exc:
             raise AdapterError(
                 f"timeout streaming from {url}", provider=self.name, retryable=True

coderouter/adapters/base.py

@@ -137,6 +137,49 @@ class AdapterError(CodeRouterError):
         return f"[{self.provider}{sc}] {super().__str__()}"
 
 
+# v2.15.0 (stream-truncation): raised by an adapter when the upstream SSE
+# stream ended *without* its protocol terminator (``message_stop`` on the
+# Anthropic wire, ``data: [DONE]`` / a ``finish_reason`` on the OpenAI wire).
+#
+# HTTP-level breakage (timeout, ``httpx.RemoteProtocolError``) already became a
+# plain ``AdapterError`` in both adapters. This subclass covers the layer
+# mismatch the transport cannot see: the HTTP body ended cleanly, but the *LLM
+# protocol* carried inside it was still mid-message.
+#
+# It subclasses ``AdapterError`` on purpose — every existing engine branch
+# (``except AdapterError``) keeps working untouched, and the L2/L4/L5/L6 guards
+# learn from the failure automatically. The subclass only adds identity, so
+# ``classify_adapter_error`` can label the hop ``stream-truncated`` instead of
+# the generic ``upstream-error``.
+#
+# Raised only when the active profile sets ``stream_truncation_action: error``.
+# Under ``off`` (the default) and ``warn`` the adapter returns normally and the
+# legacy terminator-synthesis path in ``coderouter.translation.convert`` (H6 /
+# M9) runs byte-for-byte as before.
+class StreamTruncatedError(AdapterError):
+    """Upstream SSE stream ended without its protocol terminator event."""
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        provider: str,
+        tool_call_in_flight: bool = False,
+    ) -> None:
+        """Construct a truncation error.
+
+        Args:
+            message: Human-readable reason. Never contains upstream body text.
+            provider: The ``ProviderConfig.name`` whose stream was cut.
+            tool_call_in_flight: True when the stream was cut while a
+                ``tool_use`` / ``tool_calls`` block was still open, i.e. the
+                accumulated argument JSON is certainly incomplete. Carried for
+                observability only — it never changes control flow.
+        """
+        super().__init__(message, provider=provider, status_code=None, retryable=True)
+        self.tool_call_in_flight = tool_call_in_flight
+
+
 # v0.6-B: per-call overrides resolved from the active profile. The engine
 # builds one instance per request (since a profile is invariant across its
 # chain) and threads it through every adapter call on that chain. Adapters
@@ -150,6 +193,13 @@ class AdapterError(CodeRouterError):
 #   - ``append_system_prompt=""`` is a meaningful explicit value: "for
 #     this profile, clear the provider's directive". The adapter must
 #     distinguish ``None`` (no override) from ``""`` (override-to-empty).
+#
+# v2.15.0 (stream-truncation): ``stream_truncation_action`` rides the same
+# channel. It is a *profile*-level knob but has to be read inside the adapter's
+# SSE parse loop, and ``ProviderCallOverrides`` is the only object the engine
+# already threads into every adapter call. Its default of ``"off"`` keeps
+# ``ProviderCallOverrides()`` (and every legacy call site that passes nothing)
+# on the pre-v2.15.0 behavior.
 class ProviderCallOverrides(BaseModel):
     """Per-call provider overrides, resolved from the active profile."""
 
@@ -157,6 +207,7 @@ class ProviderCallOverrides(BaseModel):
 
     timeout_s: float | None = None
     append_system_prompt: str | None = None
+    stream_truncation_action: Literal["off", "warn", "error"] = "off"
 
 
 class BaseAdapter(ABC):
@@ -236,6 +287,20 @@ class BaseAdapter(ABC):
             return overrides.append_system_prompt or None
         return self.config.append_system_prompt
 
+    def effective_stream_truncation_action(
+        self, overrides: ProviderCallOverrides | None
+    ) -> str:
+        """v2.15.0: resolve ``stream_truncation_action`` for this call.
+
+        There is no per-provider counterpart — the knob lives on the profile
+        only — so this is just a null-safe read. ``None`` overrides (legacy
+        call sites, unit tests constructing adapters directly) resolve to
+        ``"off"``, which is the pre-v2.15.0 behavior.
+        """
+        if overrides is None:
+            return "off"
+        return overrides.stream_truncation_action
+
     @abstractmethod
     async def healthcheck(self) -> bool:
         """Lightweight check that the upstream is reachable. Return True if healthy."""

coderouter/adapters/openai_compat.py

@@ -28,12 +28,14 @@ from coderouter.adapters.base import (
     ChatResponse,
     ProviderCallOverrides,
     StreamChunk,
+    StreamTruncatedError,
 )
-from coderouter.config.loader import resolve_api_key
+from coderouter.credentials import resolve_provider_credential
 from coderouter.logging import (
     get_logger,
     log_capability_degraded,
     log_output_filter_applied,
+    log_stream_truncation_detected,
 )
 from coderouter.output_filters import OutputFilterChain
 
@@ -105,7 +107,10 @@ class OpenAICompatAdapter(BaseAdapter):
             "Content-Type": "application/json",
             "User-Agent": "CodeRouter/0.1",
         }
-        api_key = resolve_api_key(self.config.api_key_env)
+        # v2.14.0: resolve_provider_credential covers api_key_env (the
+        # historical path, unchanged) and credential.source=cli_session,
+        # which borrows the token a vendor CLI already wrote to disk.
+        api_key = resolve_provider_credential(self.config)
         if api_key:
             headers["Authorization"] = f"Bearer {api_key}"
         return headers
@@ -344,6 +349,20 @@ class OpenAICompatAdapter(BaseAdapter):
         # Captured for the closing flush chunk (if any): reuse the last
         # seen chunk's id/model so the flush emission looks native.
         last_chunk_template: dict[str, Any] | None = None
+
+        # v2.15.0 (stream-truncation): the loop below used to treat "saw
+        # [DONE]" and "the line iterator ran out" as the same event. These
+        # three flags are the memory that tells them apart.
+        #
+        # A terminator is EITHER ``data: [DONE]`` OR a ``finish_reason`` on
+        # any choice. Accepting ``finish_reason`` matters: a provider that
+        # emits a complete message and then closes without the ``[DONE]``
+        # sentinel is not truncated, and flagging it would be a false
+        # positive. See ``stream_truncation_action`` in ``config/schemas.py``.
+        truncation_action = self.effective_stream_truncation_action(overrides)
+        saw_terminator = False
+        chunks_seen = 0
+        tool_call_in_flight = False
         try:
             # H3: stream over the shared client so the connection pool /
             # keep-alive / TLS session are reused. Only the ``stream(...)``
@@ -373,11 +392,31 @@ class OpenAICompatAdapter(BaseAdapter):
                         continue
                     data_str = line[len("data:") :].strip()
                     if data_str == "[DONE]":
+                        # v2.15.0: the sentinel — this stream ended on purpose.
+                        saw_terminator = True
                         break
                     try:
                         payload_obj = json.loads(data_str)
                     except json.JSONDecodeError:
                         continue  # skip malformed chunks rather than abort
+                    # v2.15.0 (stream-truncation): fold this chunk into the
+                    # terminator state before any filtering / validation, so a
+                    # chunk that is later dropped as malformed still counts as
+                    # "the upstream got this far".
+                    chunks_seen += 1
+                    for _choice in payload_obj.get("choices") or []:
+                        if not isinstance(_choice, dict):
+                            continue
+                        if _choice.get("finish_reason"):
+                            # A finish_reason means the message is complete
+                            # even if the [DONE] sentinel never arrives, and
+                            # it also closes any tool call that was open.
+                            saw_terminator = True
+                            tool_call_in_flight = False
+                        elif isinstance(_choice.get("delta"), dict) and _choice[
+                            "delta"
+                        ].get("tool_calls"):
+                            tool_call_in_flight = True
                     if strip_reasoning:
                         stripped = _strip_reasoning_field(
                             payload_obj.get("choices"), delta_key=True
@@ -443,6 +482,30 @@ class OpenAICompatAdapter(BaseAdapter):
                         streaming=True,
                     )
                     output_filter_logged = True
+
+            # v2.15.0 (stream-truncation): decided AFTER the filter flush on
+            # purpose — the flush is the last chance to hand the caller every
+            # safe byte the filter chain was still holding, and under
+            # ``partial_stitch_action: surface`` those bytes end up in the
+            # partial content the client receives. Under ``off`` this block is
+            # inert, keeping the default byte-for-byte identical to v2.14.0.
+            if truncation_action != "off" and not saw_terminator:
+                log_stream_truncation_detected(
+                    logger,
+                    self.name,
+                    action=truncation_action,
+                    wire="openai",
+                    events_forwarded=chunks_seen,
+                    saw_stream_start=chunks_seen > 0,
+                    tool_call_in_flight=tool_call_in_flight,
+                )
+                if truncation_action == "error":
+                    raise StreamTruncatedError(
+                        "upstream stream truncated "
+                        "(no [DONE] sentinel and no finish_reason)",
+                        provider=self.name,
+                        tool_call_in_flight=tool_call_in_flight,
+                    )
         except httpx.TimeoutException as exc:
             raise AdapterError(
                 f"timeout streaming from {url}", provider=self.name, retryable=True

coderouter/cli.py

@@ -149,6 +149,22 @@ def _build_parser() -> argparse.ArgumentParser:
             "See docs/guides/troubleshooting.md §5 for the threat model."
         ),
     )
+    # v2.14.0: --check-secrets is the runtime counterpart to --check-env.
+    # --check-env asks "is the file holding my keys protected?"; this asks
+    # "does the running process know its own secrets, and did any of them
+    # already reach a log file?". The second question is the one that used
+    # to have no answer at all.
+    doctor.add_argument(
+        "--check-secrets",
+        action="store_true",
+        help=(
+            "Audit credential hygiene: prove the log-redaction filter "
+            "actually scrubs, report which declared api_key_env vars are "
+            "set, flag credentials pasted into a base_url, and scan the "
+            "already-written requests.jsonl / audit.jsonl under state_dir "
+            "for live key values. Exit 0 clean / 2 needs attention / 1 leak."
+        ),
+    )
     doctor.add_argument(
         "--config",
         default=None,
@@ -192,6 +208,55 @@ def _build_parser() -> argparse.ArgumentParser:
         ),
     )
 
+    # v2.14.0: `coderouter rollback` — the missing half of --apply.
+    # Both writers (doctor --apply, vscode-init) already dropped a `.bak`
+    # next to every file they rewrote; nothing could put it back. Restore
+    # is a swap, not an overwrite, so running it twice returns you to
+    # where you started rather than destroying the newer version.
+    rollback = sub.add_parser(
+        "rollback",
+        help="Restore files a previous --apply / vscode-init rewrote (v2.14.0).",
+        description=(
+            "Swap each managed file with its .bak sibling: providers.yaml, "
+            "~/.coderouter/model-capabilities.yaml, and (with --workspace) "
+            ".vscode/settings.json and .envrc. The current contents become "
+            "the new .bak, so a second run toggles back. "
+            "Exit codes: 0 restored, 2 nothing to restore, 1 a restore failed."
+        ),
+    )
+    rollback.add_argument(
+        "--config",
+        default=None,
+        help=(
+            "Path to providers.yaml. Defaults to the same file the loader "
+            "would read ($CODEROUTER_CONFIG, then ~/.coderouter/providers.yaml)."
+        ),
+    )
+    rollback.add_argument(
+        "--workspace",
+        metavar="DIR",
+        default=None,
+        help=(
+            "Also restore the vscode-init outputs under DIR: "
+            "DIR/.vscode/settings.json and DIR/.envrc."
+        ),
+    )
+    rollback.add_argument(
+        "--path",
+        action="append",
+        metavar="FILE",
+        default=None,
+        help=(
+            "Restore exactly this file from its .bak sibling. Repeatable. "
+            "When given, the default discovery set is not used."
+        ),
+    )
+    rollback.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Report what would be restored without touching any file.",
+    )
+
     # v1.5-C: `coderouter stats` — live TUI over GET /metrics.json.
     # Lazy-imports ``curses`` inside the runner so the CLI boot stays
     # snappy and environments without curses (rare, but e.g. minimal
@@ -490,6 +555,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.command == "doctor":
         return _run_doctor(args)
 
+    if args.command == "rollback":
+        return _run_rollback(args)
+
     if args.command == "stats":
         # v1.5-C: stats is intentionally a thin wrapper — all logic
         # (fetch, render, curses loop) lives in coderouter.cli_stats so
@@ -526,9 +594,11 @@ def _run_doctor(args: argparse.Namespace) -> int:
     worst-case of the two reports so CI guarding against both leak
     risks AND broken providers can use a single command.
     """
-    if args.check_model is None and args.check_env is None:
+    check_secrets = bool(getattr(args, "check_secrets", False))
+    if args.check_model is None and args.check_env is None and not check_secrets:
         print(
-            "doctor: provide --check-model PROVIDER and/or --check-env [PATH]",
+            "doctor: provide --check-model PROVIDER, --check-env [PATH], "
+            "and/or --check-secrets",
             file=sys.stderr,
         )
         return 1
@@ -541,6 +611,9 @@ def _run_doctor(args: argparse.Namespace) -> int:
     if args.check_env is not None:
         worst_exit = max(worst_exit, _run_check_env(args.check_env))
 
+    if check_secrets:
+        worst_exit = max(worst_exit, _run_check_secrets(args.config))
+
     if args.check_model is not None:
         worst_exit = max(worst_exit, _run_check_model(args))
 
@@ -969,5 +1042,70 @@ def _run_check_env(arg_value: str) -> int:
     return exit_code_for_env_security(report)
 
 
+def _run_rollback(args: argparse.Namespace) -> int:
+    """v2.14.0: put back what ``--apply`` / ``vscode-init`` overwrote.
+
+    Explicit ``--path`` wins over discovery so an operator can restore one
+    file without also reverting an unrelated ``model-capabilities.yaml``
+    edit from last week. Discovery resolves providers.yaml through the
+    loader's own search order rather than a second copy of it.
+    """
+    from coderouter.rollback import (
+        discover_managed_files,
+        exit_code_for_rollback,
+        format_rollback_report,
+        restore_many,
+    )
+
+    explicit = getattr(args, "path", None)
+    if explicit:
+        targets: list[Path] = [Path(p).expanduser() for p in explicit]
+    else:
+        try:
+            config_path: Path | None = _resolve_config_path(args.config)
+        except Exception:
+            # No config anywhere is not fatal here — the workspace files
+            # and the user-layer capabilities file may still have backups.
+            config_path = None
+        targets = discover_managed_files(
+            config_path=config_path,
+            workspace=getattr(args, "workspace", None),
+        )
+
+    outcomes = restore_many(targets, dry_run=bool(args.dry_run))
+    print(format_rollback_report(outcomes, dry_run=bool(args.dry_run)))
+    return exit_code_for_rollback(outcomes)
+
+
+def _run_check_secrets(config_path: str | None) -> int:
+    """v2.14.0: credential-hygiene audit for the running configuration.
+
+    Loads the config through the normal loader — which is also what arms
+    the redaction registry — then runs the suite from
+    :mod:`coderouter.secret_redaction`. A config that fails to load is a
+    blocker (exit 1) rather than a skip: we cannot claim anything about
+    secret hygiene for a file we could not read.
+    """
+    from coderouter.config.loader import load_config
+    from coderouter.secret_redaction import (
+        check_secret_hygiene,
+        exit_code_for_secret_report,
+        format_secret_report,
+    )
+
+    try:
+        config = load_config(config_path)
+    except FileNotFoundError as exc:
+        print(f"doctor: {exc}", file=sys.stderr)
+        return 1
+    except Exception as exc:
+        print(f"doctor: failed to load config: {exc}", file=sys.stderr)
+        return 1
+
+    report = check_secret_hygiene(config)
+    print(format_secret_report(report))
+    return exit_code_for_secret_report(report)
+
+
 if __name__ == "__main__":
     sys.exit(main())

coderouter/config/loader.py

@@ -34,6 +34,7 @@ import yaml
 
 from coderouter.config.schemas import CodeRouterConfig
 from coderouter.logging import get_logger
+from coderouter.secret_redaction import register_config_secrets, register_secret
 
 logger = get_logger(__name__)
 
@@ -253,12 +254,34 @@ def load_config(path: str | os.PathLike[str] | None = None) -> CodeRouterConfig:
     elif env_paid in {"0", "false", "no", "off"}:
         config.allow_paid = False
 
+    # v2.14.0: arm log redaction before anything else runs. Registering here
+    # (rather than lazily on the first resolve_api_key call) means the
+    # startup log lines — which name providers and profiles — are already
+    # scrubbed, and so is any config-validation error raised downstream.
+    # Only labels are logged; the values never leave the registry.
+    registered = register_config_secrets(config)
+    if registered:
+        logger.info(
+            "secret-redaction-armed",
+            extra={"count": len(registered), "labels": sorted(set(registered))},
+        )
+
     return config
 
 
 def resolve_api_key(api_key_env: str | None) -> str | None:
-    """Look up an API key from the named env var. Returns None if unset."""
+    """Look up an API key from the named env var. Returns None if unset.
+
+    v2.14.0: the resolved value is registered with
+    :mod:`coderouter.secret_redaction` before it is handed out. This is the
+    moment a credential enters the process, so it is the one place that can
+    guarantee the log scrubber knows about every key we actually use —
+    including keys for providers added by an adapter plugin, which never
+    pass through ``register_config_secrets``.
+    """
     if not api_key_env:
         return None
     value = os.environ.get(api_key_env, "").strip()
+    if value:
+        register_secret(value, api_key_env)
     return value or None