coderouter-cli 2.6.1__py3-none-any.whl → 2.7.0__py3-none-any.whl

coderouter/guards/continuous_probe.py

@@ -98,6 +98,11 @@ async def probe_one(
     """
     import os
 
+    # Local import: keeps the module-level import graph free of the
+    # convert ↔ anthropic_native circular dependency (adapters pull in
+    # translation.convert, which pulls back in this adapter).
+    from coderouter.adapters.anthropic_native import anthropic_messages_url
+
     start = time.monotonic()
     provider_name = provider.name
     base_url = str(provider.base_url).rstrip("/")
@@ -116,7 +121,10 @@ async def probe_one(
     try:
         async with httpx.AsyncClient(timeout=timeout_s) as client:
             if provider.kind == "anthropic":
-                url = f"{base_url}/v1/messages"
+                # Use the shared normalizer so the probe hits the exact
+                # same endpoint the adapter does — base_url ending in
+                # `/v1` must not produce `/v1/v1/messages` (bug H4).
+                url = anthropic_messages_url(base_url)
                 body: dict[str, Any] = {
                     "model": provider.model,
                     "max_tokens": 1,

coderouter/guards/memory_pressure.py

@@ -53,6 +53,7 @@ the body of its read/write.
 
 from __future__ import annotations
 
+import re
 import threading
 import time
 
@@ -76,9 +77,18 @@ _MEMORY_PRESSURE_PHRASES: tuple[str, ...] = (
     "failed to allocate",
     "failed to load model",
     "ggml_cuda_host_malloc",  # llama.cpp specific
-    "oom",
 )
 
+# M10: "oom" needs word-boundary matching, not a bare substring test.
+# A plain ``"oom" in text`` false-fires on "room" / "zoom" / "bloom" and
+# would wrongly cool down a healthy provider whose error body merely
+# contains one of those words. ``\boom\b`` matches the standalone token
+# "oom" (and "OOM" once lowercased) while rejecting the embedded cases.
+# Note the digit/underscore edges are word chars, so "oom_killer" is NOT
+# matched by this pattern alone — real oom-killer bodies still trip the
+# match via the separate "out of memory" phrase or a standalone "oom".
+_OOM_TOKEN_RE = re.compile(r"\boom\b")
+
 
 def is_memory_pressure_error(exc: AdapterError) -> bool:
     """Return True iff ``exc`` looks like a backend OOM signal.
@@ -96,7 +106,11 @@ def is_memory_pressure_error(exc: AdapterError) -> bool:
     focused on the actual signal.
     """
     text = str(exc).lower()
-    return any(phrase in text for phrase in _MEMORY_PRESSURE_PHRASES)
+    if any(phrase in text for phrase in _MEMORY_PRESSURE_PHRASES):
+        return True
+    # M10: standalone "oom" token only (word-boundary), so "room" /
+    # "zoom" / "bloom" in an unrelated error body don't false-fire.
+    return _OOM_TOKEN_RE.search(text) is not None
 
 
 # ---------------------------------------------------------------------------

coderouter/guards/self_healing.py

@@ -181,6 +181,20 @@ class SelfHealingOrchestrator:
         with self._lock:
             return set(self._excluded.keys())
 
+    def excluded_profiles(self) -> dict[str, str]:
+        """Return a snapshot mapping excluded provider -> owning profile.
+
+        Used by the engine to re-arm recovery probes after a restart:
+        each excluded provider must be probed under the profile whose
+        ``backend_health_threshold`` / ``recovery_probe_*`` settings
+        drove its exclusion. See :meth:`excluded_providers` for the
+        name-only variant.
+        """
+        with self._lock:
+            return {
+                name: entry.profile for name, entry in self._excluded.items()
+            }
+
     def reset(self) -> None:
         """Drop all state. Mainly for tests."""
         with self._lock:

coderouter/ingress/anthropic_routes.py

@@ -21,6 +21,8 @@ SDKs send values like "2023-06-01"; we log it for diagnostics only.
 
 from __future__ import annotations
 
+import asyncio
+import contextlib
 import json
 from collections.abc import AsyncIterator
 from typing import Any
@@ -51,6 +53,109 @@ _ANTHROPIC_BETA_HEADER = "anthropic-beta"
 _CTX_BUDGET_HEADER = "X-CodeRouter-Context-Budget"
 _DRIFT_HEADER = "X-CodeRouter-Drift"
 
+# M14: overall SSE stream ceiling. A single streamed request can legitimately
+# run much longer than one provider call (long generations, tool turns), so we
+# derive the ceiling from the profile's per-call ``timeout_s`` scaled up, and
+# fall back to a large default when no profile timeout is configured. This is a
+# safety net against a wedged upstream holding a client (and the upstream
+# socket) open forever — NOT a tight per-token deadline.
+_STREAM_TIMEOUT_MULTIPLIER = 20.0
+_STREAM_TIMEOUT_DEFAULT_S = 900.0
+_STREAM_TIMEOUT_MIN_S = 60.0
+
+
+def _resolve_stream_timeout_s(engine: FallbackEngine, profile: str | None) -> float:
+    """M14: derive the overall stream ceiling (seconds) for a profile.
+
+    Uses the profile's per-call ``timeout_s`` (or the first provider's, or
+    the default) scaled by ``_STREAM_TIMEOUT_MULTIPLIER`` so a whole stream
+    gets a generous but bounded budget. Never returns below
+    ``_STREAM_TIMEOUT_MIN_S``. Any resolution failure (stub config in tests,
+    missing profile) falls back to ``_STREAM_TIMEOUT_DEFAULT_S`` — the guard
+    stays active rather than disabling itself. Does NOT change the config
+    schema.
+    """
+    per_call: float | None = None
+    try:
+        config = engine.config
+        chosen = profile or config.default_profile
+        chain_cfg = config.profile_by_name(chosen)
+        per_call = getattr(chain_cfg, "timeout_s", None)
+        if per_call is None:
+            # Fall back to the first provider's timeout.
+            for pname in getattr(chain_cfg, "providers", []) or []:
+                pconf = next(
+                    (p for p in config.providers if p.name == pname), None
+                )
+                if pconf is not None:
+                    per_call = getattr(pconf, "timeout_s", None)
+                    break
+    except (AttributeError, KeyError, ValueError):
+        per_call = None
+
+    if per_call is None:
+        return _STREAM_TIMEOUT_DEFAULT_S
+    return max(_STREAM_TIMEOUT_MIN_S, float(per_call) * _STREAM_TIMEOUT_MULTIPLIER)
+
+
+async def _guard_stream(
+    source: AsyncIterator[str],
+    *,
+    timeout_s: float,
+    label: str,
+) -> AsyncIterator[str]:
+    """M14: enforce an overall timeout + clean cancellation on an SSE stream.
+
+    Wraps ``source`` (an iterator of already-formatted SSE frames) so that:
+
+    * The total wall-clock time is bounded by ``timeout_s`` via
+      ``asyncio.timeout`` — a wedged upstream can no longer hold the client
+      (and the upstream socket) open indefinitely.
+    * On client disconnect (the ASGI server throws ``CancelledError`` into
+      the generator) or on timeout, the underlying ``source`` generator is
+      explicitly closed via ``aclose()``. Closing the engine generator runs
+      its ``finally`` blocks, which lets the adapter's ``httpx`` streaming
+      context manager exit and release the upstream connection instead of
+      leaking it until GC.
+
+    Errors raised by ``source`` itself (in-stream ``event: error`` framing)
+    are produced by the caller's iterator before it reaches here, so this
+    wrapper only has to deal with timeout / cancellation / normal completion.
+    """
+    try:
+        async with asyncio.timeout(timeout_s):
+            async for frame in source:
+                yield frame
+    except TimeoutError:
+        # Overall ceiling hit. Emit a terminal error frame so a
+        # spec-compliant client sees a clean stream end rather than a
+        # silently truncated body, then stop.
+        logger.warning("sse-stream-timeout", extra={"label": label, "timeout_s": timeout_s})
+        err_event = AnthropicStreamEvent(
+            type="error",
+            data={
+                "type": "error",
+                "error": {
+                    "type": "timeout_error",
+                    "message": f"stream exceeded {timeout_s:.0f}s ceiling",
+                },
+            },
+        )
+        yield _format_anthropic_sse(err_event)
+    except asyncio.CancelledError:
+        # Client disconnected. Re-raise after ensuring the source is closed
+        # in the finally block so the upstream connection is released.
+        logger.info("sse-client-disconnect", extra={"label": label})
+        raise
+    finally:
+        # Guarantee the upstream generator is finalized on every exit path
+        # (normal completion, timeout, or cancellation).
+        aclose = getattr(source, "aclose", None)
+        if aclose is not None:
+            # Best-effort cleanup; never mask the original exit reason.
+            with contextlib.suppress(asyncio.CancelledError, Exception):
+                await aclose()
+
 
 @router.post("/messages", response_model=None)
 async def messages(
@@ -151,8 +256,17 @@ async def messages(
         drift_severity = engine.last_drift_severity
         if drift_severity:
             stream_headers[_DRIFT_HEADER] = drift_severity
-        return StreamingResponse(
+        # M14: wrap the SSE iterator with an overall timeout + client
+        # disconnect cleanup so a wedged upstream cannot pin the client
+        # (or the upstream socket) open forever.
+        timeout_s = _resolve_stream_timeout_s(engine, anth_req.profile)
+        guarded = _guard_stream(
             _anthropic_sse_iterator(engine, anth_req),
+            timeout_s=timeout_s,
+            label="anthropic",
+        )
+        return StreamingResponse(
+            guarded,
             media_type="text/event-stream",
             headers=stream_headers,
         )

coderouter/ingress/app.py

@@ -7,7 +7,10 @@ import os
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.types import ASGIApp
 
 from coderouter import __version__
 from coderouter.config import load_config
@@ -25,6 +28,137 @@ from coderouter.routing.capability import check_claude_code_chain_suitability
 logger = get_logger(__name__)
 
 
+# ---------------------------------------------------------------------------
+# H8: DNS-rebinding protection via Host-header validation
+# ---------------------------------------------------------------------------
+
+# Loopback hosts that are always allowed. ``testserver`` is the default Host
+# that Starlette's TestClient sends, so it is whitelisted to keep the existing
+# suite (and any local integration tests) working without extra configuration.
+_DEFAULT_ALLOWED_HOSTS: frozenset[str] = frozenset(
+    {"localhost", "127.0.0.1", "[::1]", "::1", "testserver"}
+)
+
+
+def _parse_allowed_hosts(raw: str | None) -> frozenset[str]:
+    """Merge the built-in loopback set with ``CODEROUTER_ALLOWED_HOSTS``.
+
+    The env var is a comma-separated list of extra hostnames (no port) that
+    should be accepted — the escape hatch for deliberate external exposure.
+    """
+    extra = {
+        part.strip().lower()
+        for part in (raw or "").split(",")
+        if part.strip()
+    }
+    return _DEFAULT_ALLOWED_HOSTS | frozenset(extra)
+
+
+def _host_without_port(host_header: str) -> str:
+    """Strip the optional ``:port`` suffix from a Host header value.
+
+    Handles bracketed IPv6 literals (``[::1]:8080`` → ``[::1]``) as well as
+    the common ``host:port`` form. A bare ``[::1]`` or ``host`` is returned
+    unchanged.
+    """
+    value = host_header.strip().lower()
+    if value.startswith("["):
+        # IPv6 literal: keep everything up to and including the closing bracket.
+        end = value.find("]")
+        if end != -1:
+            return value[: end + 1]
+        return value
+    # IPv4 / hostname: split off a trailing :port if present.
+    if ":" in value:
+        return value.rsplit(":", 1)[0]
+    return value
+
+
+# ---------------------------------------------------------------------------
+# M14: request body size limit (DoS protection)
+# ---------------------------------------------------------------------------
+
+# Default cap for incoming request bodies. Anthropic/OpenAI chat payloads are
+# comfortably below this even with large system prompts; the ceiling exists to
+# stop a client from streaming an unbounded body and exhausting memory.
+_DEFAULT_MAX_BODY_BYTES = 64 * 1024 * 1024  # 64 MB
+_MAX_BODY_BYTES_ENV = "CODEROUTER_MAX_BODY_BYTES"
+
+
+def _parse_max_body_bytes(raw: str | None) -> int:
+    """Resolve the body-size cap from ``CODEROUTER_MAX_BODY_BYTES``.
+
+    Falls back to :data:`_DEFAULT_MAX_BODY_BYTES` when the env var is unset,
+    empty, non-numeric, or non-positive — a misconfigured value must never
+    silently disable the guard.
+    """
+    if raw is None or not raw.strip():
+        return _DEFAULT_MAX_BODY_BYTES
+    try:
+        value = int(raw.strip())
+    except ValueError:
+        return _DEFAULT_MAX_BODY_BYTES
+    return value if value > 0 else _DEFAULT_MAX_BODY_BYTES
+
+
+class BodySizeLimitMiddleware(BaseHTTPMiddleware):
+    """Reject requests whose declared body exceeds the configured cap.
+
+    The check is on the incoming ``Content-Length`` header, so it is cheap
+    (no body is read) and fires before the route handler runs. Streaming
+    *responses* (SSE) are unaffected — this only inspects the request side.
+    A body over the limit fails closed with 413.
+    """
+
+    def __init__(self, app: ASGIApp, max_bytes: int) -> None:
+        super().__init__(app)
+        self._max_bytes = max_bytes
+
+    async def dispatch(self, request: Request, call_next):  # type: ignore[no-untyped-def]
+        content_length = request.headers.get("content-length")
+        if content_length is not None:
+            try:
+                declared = int(content_length)
+            except ValueError:
+                declared = -1
+            if declared > self._max_bytes:
+                return JSONResponse(
+                    status_code=413,
+                    content={
+                        "detail": (
+                            f"Request body too large: {declared} bytes exceeds "
+                            f"the {self._max_bytes}-byte limit."
+                        )
+                    },
+                )
+        return await call_next(request)
+
+
+class HostValidationMiddleware(BaseHTTPMiddleware):
+    """Reject requests whose Host header is not an allow-listed hostname.
+
+    This blocks DNS-rebinding attacks: even when CodeRouter is bound to
+    ``127.0.0.1``, a malicious page can point a hostname it controls at the
+    loopback address and drive the local API from the victim's browser. By
+    pinning the accepted Host values we make such cross-origin requests fail
+    closed with 403.
+    """
+
+    def __init__(self, app: ASGIApp, allowed_hosts: frozenset[str]) -> None:
+        super().__init__(app)
+        self._allowed = allowed_hosts
+
+    async def dispatch(self, request: Request, call_next):  # type: ignore[no-untyped-def]
+        host_header = request.headers.get("host", "")
+        host = _host_without_port(host_header)
+        if host not in self._allowed:
+            return JSONResponse(
+                status_code=403,
+                content={"detail": f"Host {host_header!r} is not allowed."},
+            )
+        return await call_next(request)
+
+
 def create_app(config_path: str | None = None) -> FastAPI:
     """Build a FastAPI app with routes, engine, and lifespan installed.
 
@@ -189,6 +323,15 @@ def create_app(config_path: str | None = None) -> FastAPI:
         with contextlib.suppress(Exception):
             await engine.shutdown_recovery_probes()
 
+        # H3: close each adapter's shared httpx.AsyncClient so pooled
+        # connections / keep-alive sockets are released cleanly instead of
+        # being left to garbage collection. Adapters are cached on the
+        # engine (one per provider); ``aclose`` is idempotent and a no-op
+        # when the adapter never issued a request.
+        for _adapter in engine._adapters.values():
+            with contextlib.suppress(Exception):
+                await _adapter.aclose()
+
         # v2.0-K: persist state and close audit log on shutdown.
         if state_store is not None:
             with contextlib.suppress(Exception):
@@ -228,6 +371,24 @@ def create_app(config_path: str | None = None) -> FastAPI:
     app.state.engine = engine
     app.state.config = config
 
+    # H8: DNS-rebinding protection. Applied to every route so a hostname an
+    # attacker controls cannot be pointed at loopback and used to drive the
+    # local API from a victim's browser. Extra hostnames for deliberate
+    # external exposure come from CODEROUTER_ALLOWED_HOSTS (comma-separated).
+    allowed_hosts = _parse_allowed_hosts(
+        os.environ.get("CODEROUTER_ALLOWED_HOSTS")
+    )
+    app.add_middleware(HostValidationMiddleware, allowed_hosts=allowed_hosts)
+
+    # M14: request body size limit (DoS protection). Added after the Host
+    # middleware so that — because add_middleware wraps outermost-last — Host
+    # validation runs first and the size guard second. SSE streaming responses
+    # are unaffected: the check only reads the request Content-Length.
+    max_body_bytes = _parse_max_body_bytes(
+        os.environ.get(_MAX_BODY_BYTES_ENV)
+    )
+    app.add_middleware(BodySizeLimitMiddleware, max_bytes=max_body_bytes)
+
     @app.get("/healthz")
     async def healthz() -> dict[str, object]:
         """Lightweight liveness / config snapshot endpoint.