coderouter-cli 2.6.1__py3-none-any.whl → 2.7.1__py3-none-any.whl

coderouter/guards/context_budget.py

@@ -339,33 +339,128 @@ def _compute_preserve_set(
     return preserved
 
 
+def _group_removable_units(
+    messages: list[Any],
+    removable: list[int],
+) -> list[list[int]]:
+    """Group removable message indices into atomic tool-pair units.
+
+    ``removable`` is the sorted list of indices eligible for removal
+    (i.e. not in the preserve set). A tool_use assistant message and the
+    user message carrying its matching tool_result must be removed
+    together so we never leave an orphaned tool_use or tool_result in the
+    trimmed history (Anthropic rejects both with a 400). Because the
+    preserve-set computation already keeps pairs atomic, both halves of a
+    pair are always either both preserved or both removable — here we just
+    coalesce the removable halves into a single unit so the incremental
+    loop drops them in one step.
+
+    Returns a list of units (each a sorted list of indices), ordered by
+    the position of the unit's earliest message so the caller can peel
+    them off the front oldest-first.
+    """
+    removable_set = set(removable)
+
+    # Map every tool_use_id to the indices of the message(s) that emit the
+    # tool_use and the message that carries the matching tool_result.
+    partner: dict[int, set[int]] = {idx: set() for idx in removable}
+    use_index: dict[str, int] = {}
+    result_index: dict[str, int] = {}
+    for idx in removable:
+        for tid in _extract_tool_use_ids(messages[idx]):
+            use_index[tid] = idx
+        for tid in _extract_tool_result_ids(messages[idx]):
+            result_index[tid] = idx
+    for tid, use_idx in use_index.items():
+        res_idx = result_index.get(tid)
+        if res_idx is not None and res_idx in removable_set:
+            partner[use_idx].add(res_idx)
+            partner[res_idx].add(use_idx)
+
+    # Union-find style grouping over the partner graph.
+    seen: set[int] = set()
+    units: list[list[int]] = []
+    for idx in removable:
+        if idx in seen:
+            continue
+        stack = [idx]
+        group: set[int] = set()
+        while stack:
+            cur = stack.pop()
+            if cur in group:
+                continue
+            group.add(cur)
+            seen.add(cur)
+            stack.extend(p for p in partner[cur] if p not in group)
+        units.append(sorted(group))
+
+    units.sort(key=lambda unit: unit[0])
+    return units
+
+
+def _normalize_head(messages: list[Any]) -> list[Any]:
+    """Drop leading messages until the first is a clean ``user`` message.
+
+    Anthropic requires the first message to be a ``user`` message, and a
+    leading user message must not open with a dangling ``tool_result``
+    (its ``tool_use`` was trimmed away). We therefore drop from the front
+    any assistant message and any user message that contains a
+    tool_result, stopping at the first ``user`` message with no
+    tool_result block.
+    """
+    start = 0
+    n = len(messages)
+    while start < n:
+        msg = messages[start]
+        role = msg.role if hasattr(msg, "role") else (
+            msg.get("role") if isinstance(msg, dict) else None
+        )
+        if role == "user" and not _has_tool_result(msg):
+            break
+        start += 1
+    return messages[start:]
+
+
 def _do_trim(
     messages: list[Any],
     system: Any,
     target_tokens: int,
     preserve_last_n: int,
 ) -> list[Any]:
-    """Core trim loop. Reduces preserve_last_n if needed (floor: 2)."""
-    current_preserve = preserve_last_n
-
-    while current_preserve >= 2:
-        preserved_indices = _compute_preserve_set(messages, current_preserve)
-        # Keep only preserved messages (maintain order)
-        trimmed = [messages[i] for i in sorted(preserved_indices)]
-
-        estimated = estimate_tokens_from_anthropic_request(
-            system=system,
-            messages=trimmed,
-        )
+    """Incrementally drop oldest messages until under ``target_tokens``.
+
+    Unlike the previous implementation (which deleted every non-preserved
+    message in one shot the moment the threshold was crossed), this peels
+    messages off the front one atomic unit at a time and re-estimates
+    after each removal, stopping as soon as the estimate is at or below
+    the target. The preserve set (last N messages + their tool pairs) is a
+    hard floor that is never removed. After trimming, the head is
+    normalized so the first surviving message is a ``user`` message
+    without a leading ``tool_result`` (avoids upstream 400s). Bug H5.
+    """
+    if not messages:
+        return messages
+
+    already = estimate_tokens_from_anthropic_request(system=system, messages=messages)
+    if already <= target_tokens:
+        # Nothing to do — return the input unchanged.
+        return messages
+
+    preserved_indices = _compute_preserve_set(messages, preserve_last_n)
+    removable = [i for i in range(len(messages)) if i not in preserved_indices]
+    units = _group_removable_units(messages, removable)
+
+    # Indices we have decided to drop; peel atomic units from the front.
+    dropped: set[int] = set()
+    for unit in units:
+        kept = [messages[i] for i in range(len(messages)) if i not in dropped]
+        estimated = estimate_tokens_from_anthropic_request(system=system, messages=kept)
         if estimated <= target_tokens:
-            return trimmed
-
-        # Still over target — reduce preserve count and retry
-        current_preserve -= 1
+            break
+        dropped.update(unit)
 
-    # Floor reached — return with minimum preservation (last 2)
-    preserved_indices = _compute_preserve_set(messages, 2)
-    return [messages[i] for i in sorted(preserved_indices)]
+    trimmed = [messages[i] for i in range(len(messages)) if i not in dropped]
+    return _normalize_head(trimmed)
 
 
 __all__ = [

coderouter/guards/continuous_probe.py

@@ -98,6 +98,11 @@ async def probe_one(
     """
     import os
 
+    # Local import: keeps the module-level import graph free of the
+    # convert ↔ anthropic_native circular dependency (adapters pull in
+    # translation.convert, which pulls back in this adapter).
+    from coderouter.adapters.anthropic_native import anthropic_messages_url
+
     start = time.monotonic()
     provider_name = provider.name
     base_url = str(provider.base_url).rstrip("/")
@@ -116,7 +121,10 @@ async def probe_one(
     try:
         async with httpx.AsyncClient(timeout=timeout_s) as client:
             if provider.kind == "anthropic":
-                url = f"{base_url}/v1/messages"
+                # Use the shared normalizer so the probe hits the exact
+                # same endpoint the adapter does — base_url ending in
+                # `/v1` must not produce `/v1/v1/messages` (bug H4).
+                url = anthropic_messages_url(base_url)
                 body: dict[str, Any] = {
                     "model": provider.model,
                     "max_tokens": 1,

coderouter/guards/memory_pressure.py

@@ -53,6 +53,7 @@ the body of its read/write.
 
 from __future__ import annotations
 
+import re
 import threading
 import time
 
@@ -76,9 +77,18 @@ _MEMORY_PRESSURE_PHRASES: tuple[str, ...] = (
     "failed to allocate",
     "failed to load model",
     "ggml_cuda_host_malloc",  # llama.cpp specific
-    "oom",
 )
 
+# M10: "oom" needs word-boundary matching, not a bare substring test.
+# A plain ``"oom" in text`` false-fires on "room" / "zoom" / "bloom" and
+# would wrongly cool down a healthy provider whose error body merely
+# contains one of those words. ``\boom\b`` matches the standalone token
+# "oom" (and "OOM" once lowercased) while rejecting the embedded cases.
+# Note the digit/underscore edges are word chars, so "oom_killer" is NOT
+# matched by this pattern alone — real oom-killer bodies still trip the
+# match via the separate "out of memory" phrase or a standalone "oom".
+_OOM_TOKEN_RE = re.compile(r"\boom\b")
+
 
 def is_memory_pressure_error(exc: AdapterError) -> bool:
     """Return True iff ``exc`` looks like a backend OOM signal.
@@ -96,7 +106,11 @@ def is_memory_pressure_error(exc: AdapterError) -> bool:
     focused on the actual signal.
     """
     text = str(exc).lower()
-    return any(phrase in text for phrase in _MEMORY_PRESSURE_PHRASES)
+    if any(phrase in text for phrase in _MEMORY_PRESSURE_PHRASES):
+        return True
+    # M10: standalone "oom" token only (word-boundary), so "room" /
+    # "zoom" / "bloom" in an unrelated error body don't false-fire.
+    return _OOM_TOKEN_RE.search(text) is not None
 
 
 # ---------------------------------------------------------------------------

coderouter/guards/self_healing.py

@@ -181,6 +181,20 @@ class SelfHealingOrchestrator:
         with self._lock:
             return set(self._excluded.keys())
 
+    def excluded_profiles(self) -> dict[str, str]:
+        """Return a snapshot mapping excluded provider -> owning profile.
+
+        Used by the engine to re-arm recovery probes after a restart:
+        each excluded provider must be probed under the profile whose
+        ``backend_health_threshold`` / ``recovery_probe_*`` settings
+        drove its exclusion. See :meth:`excluded_providers` for the
+        name-only variant.
+        """
+        with self._lock:
+            return {
+                name: entry.profile for name, entry in self._excluded.items()
+            }
+
     def reset(self) -> None:
         """Drop all state. Mainly for tests."""
         with self._lock:

coderouter/ingress/anthropic_routes.py

@@ -21,6 +21,8 @@ SDKs send values like "2023-06-01"; we log it for diagnostics only.
 
 from __future__ import annotations
 
+import asyncio
+import contextlib
 import json
 from collections.abc import AsyncIterator
 from typing import Any
@@ -36,6 +38,8 @@ from coderouter.routing import (
     NoProvidersAvailableError,
 )
 from coderouter.routing.auto_router import RESERVED_PROFILE_NAME, classify
+from coderouter.token_estimation import extract_text_from_anthropic_request
+from coderouter.token_estimation_accurate import count_tokens, is_accuracy_available
 from coderouter.translation import (
     AnthropicRequest,
     AnthropicStreamEvent,
@@ -51,6 +55,109 @@ _ANTHROPIC_BETA_HEADER = "anthropic-beta"
 _CTX_BUDGET_HEADER = "X-CodeRouter-Context-Budget"
 _DRIFT_HEADER = "X-CodeRouter-Drift"
 
+# M14: overall SSE stream ceiling. A single streamed request can legitimately
+# run much longer than one provider call (long generations, tool turns), so we
+# derive the ceiling from the profile's per-call ``timeout_s`` scaled up, and
+# fall back to a large default when no profile timeout is configured. This is a
+# safety net against a wedged upstream holding a client (and the upstream
+# socket) open forever — NOT a tight per-token deadline.
+_STREAM_TIMEOUT_MULTIPLIER = 20.0
+_STREAM_TIMEOUT_DEFAULT_S = 900.0
+_STREAM_TIMEOUT_MIN_S = 60.0
+
+
+def _resolve_stream_timeout_s(engine: FallbackEngine, profile: str | None) -> float:
+    """M14: derive the overall stream ceiling (seconds) for a profile.
+
+    Uses the profile's per-call ``timeout_s`` (or the first provider's, or
+    the default) scaled by ``_STREAM_TIMEOUT_MULTIPLIER`` so a whole stream
+    gets a generous but bounded budget. Never returns below
+    ``_STREAM_TIMEOUT_MIN_S``. Any resolution failure (stub config in tests,
+    missing profile) falls back to ``_STREAM_TIMEOUT_DEFAULT_S`` — the guard
+    stays active rather than disabling itself. Does NOT change the config
+    schema.
+    """
+    per_call: float | None = None
+    try:
+        config = engine.config
+        chosen = profile or config.default_profile
+        chain_cfg = config.profile_by_name(chosen)
+        per_call = getattr(chain_cfg, "timeout_s", None)
+        if per_call is None:
+            # Fall back to the first provider's timeout.
+            for pname in getattr(chain_cfg, "providers", []) or []:
+                pconf = next(
+                    (p for p in config.providers if p.name == pname), None
+                )
+                if pconf is not None:
+                    per_call = getattr(pconf, "timeout_s", None)
+                    break
+    except (AttributeError, KeyError, ValueError):
+        per_call = None
+
+    if per_call is None:
+        return _STREAM_TIMEOUT_DEFAULT_S
+    return max(_STREAM_TIMEOUT_MIN_S, float(per_call) * _STREAM_TIMEOUT_MULTIPLIER)
+
+
+async def _guard_stream(
+    source: AsyncIterator[str],
+    *,
+    timeout_s: float,
+    label: str,
+) -> AsyncIterator[str]:
+    """M14: enforce an overall timeout + clean cancellation on an SSE stream.
+
+    Wraps ``source`` (an iterator of already-formatted SSE frames) so that:
+
+    * The total wall-clock time is bounded by ``timeout_s`` via
+      ``asyncio.timeout`` — a wedged upstream can no longer hold the client
+      (and the upstream socket) open indefinitely.
+    * On client disconnect (the ASGI server throws ``CancelledError`` into
+      the generator) or on timeout, the underlying ``source`` generator is
+      explicitly closed via ``aclose()``. Closing the engine generator runs
+      its ``finally`` blocks, which lets the adapter's ``httpx`` streaming
+      context manager exit and release the upstream connection instead of
+      leaking it until GC.
+
+    Errors raised by ``source`` itself (in-stream ``event: error`` framing)
+    are produced by the caller's iterator before it reaches here, so this
+    wrapper only has to deal with timeout / cancellation / normal completion.
+    """
+    try:
+        async with asyncio.timeout(timeout_s):
+            async for frame in source:
+                yield frame
+    except TimeoutError:
+        # Overall ceiling hit. Emit a terminal error frame so a
+        # spec-compliant client sees a clean stream end rather than a
+        # silently truncated body, then stop.
+        logger.warning("sse-stream-timeout", extra={"label": label, "timeout_s": timeout_s})
+        err_event = AnthropicStreamEvent(
+            type="error",
+            data={
+                "type": "error",
+                "error": {
+                    "type": "timeout_error",
+                    "message": f"stream exceeded {timeout_s:.0f}s ceiling",
+                },
+            },
+        )
+        yield _format_anthropic_sse(err_event)
+    except asyncio.CancelledError:
+        # Client disconnected. Re-raise after ensuring the source is closed
+        # in the finally block so the upstream connection is released.
+        logger.info("sse-client-disconnect", extra={"label": label})
+        raise
+    finally:
+        # Guarantee the upstream generator is finalized on every exit path
+        # (normal completion, timeout, or cancellation).
+        aclose = getattr(source, "aclose", None)
+        if aclose is not None:
+            # Best-effort cleanup; never mask the original exit reason.
+            with contextlib.suppress(asyncio.CancelledError, Exception):
+                await aclose()
+
 
 @router.post("/messages", response_model=None)
 async def messages(
@@ -151,8 +258,17 @@ async def messages(
         drift_severity = engine.last_drift_severity
         if drift_severity:
             stream_headers[_DRIFT_HEADER] = drift_severity
-        return StreamingResponse(
+        # M14: wrap the SSE iterator with an overall timeout + client
+        # disconnect cleanup so a wedged upstream cannot pin the client
+        # (or the upstream socket) open forever.
+        timeout_s = _resolve_stream_timeout_s(engine, anth_req.profile)
+        guarded = _guard_stream(
             _anthropic_sse_iterator(engine, anth_req),
+            timeout_s=timeout_s,
+            label="anthropic",
+        )
+        return StreamingResponse(
+            guarded,
             media_type="text/event-stream",
             headers=stream_headers,
         )
@@ -202,6 +318,112 @@ async def messages(
     return anth_resp.model_dump(exclude_none=True)
 
 
+def _resolve_count_tokens_tokenizer_path(
+    config: Any, profile: str | None
+) -> str | None:
+    """S1 (shim): best-effort resolve a local tokenizer.json for counting.
+
+    Routing for ``count_tokens`` is not a full chain resolution — we only
+    need *a* representative tokenizer for the profile the request would use.
+    We take the first provider of the resolved profile (or the default
+    profile) and return its ``tokenizer_path`` when declared. Any resolution
+    hiccup (unknown profile, empty chain, stub config in tests) returns
+    ``None``, which makes :func:`count_tokens` fall back to the char/4
+    heuristic — a graceful degrade rather than an error.
+    """
+    try:
+        chosen = profile or config.default_profile
+        chain_cfg = config.profile_by_name(chosen)
+        for pname in getattr(chain_cfg, "providers", []) or []:
+            pconf = next((p for p in config.providers if p.name == pname), None)
+            if pconf is not None:
+                tok = getattr(pconf, "tokenizer_path", None)
+                if tok:
+                    return tok
+                # First provider resolved but declares no tokenizer — stop
+                # here (don't scan the whole chain for an unrelated one).
+                return None
+    except (AttributeError, KeyError, ValueError, TypeError):
+        return None
+    return None
+
+
+@router.post("/messages/count_tokens", response_model=None)
+async def count_tokens_route(
+    payload: dict[str, Any],
+    request: Request,
+    x_coderouter_profile: str | None = Header(default=None, alias=_PROFILE_HEADER),
+    x_coderouter_mode: str | None = Header(default=None, alias=_MODE_HEADER),
+) -> dict[str, Any]:
+    """Anthropic ``POST /v1/messages/count_tokens`` — local token estimate.
+
+    Mirrors Anthropic's count_tokens endpoint: the request body has the
+    same shape as ``/v1/messages`` (minus the ``max_tokens`` requirement)
+    and the response is ``{"input_tokens": N}``. CodeRouter answers this
+    entirely locally — there is no upstream round-trip — using the same
+    text-extraction the language-tax / context-budget guards use, feeding
+    an accurate local tokenizer when the routed provider declares one and
+    the ``accuracy`` extra is installed, otherwise the char/4 heuristic.
+
+    Validation is deliberately looser than :class:`AnthropicRequest` (no
+    ``max_tokens`` needed): ``model`` and a non-empty ``messages`` list are
+    required, everything else optional. Profile selection follows the same
+    body > profile-header > mode-header precedence as ``/messages`` so the
+    tokenizer resolves against the provider the real request would hit.
+    """
+    config = request.app.state.config
+
+    if not isinstance(payload, dict):
+        raise HTTPException(status_code=400, detail="request body must be a JSON object")
+
+    messages = payload.get("messages")
+    if not isinstance(messages, list) or not messages:
+        raise HTTPException(
+            status_code=400,
+            detail="'messages' is required and must be a non-empty list",
+        )
+    if "model" not in payload:
+        raise HTTPException(status_code=400, detail="'model' is required")
+
+    # Profile selection — body field wins over header, mode header last
+    # (same policy as /messages). Kept minimal: we only need the profile to
+    # pick a representative tokenizer, so an unknown mode/profile degrades
+    # to the default rather than 400'ing the count.
+    profile = payload.get("profile") or x_coderouter_profile
+    if profile is None and x_coderouter_mode:
+        try:
+            profile = config.resolve_mode(x_coderouter_mode)
+        except (KeyError, AttributeError):
+            profile = None
+
+    # Combine system + messages (+ tool JSON length) into one text blob and
+    # count. tools contribute their JSON length as a coarse proxy for the
+    # schema tokens Anthropic would bill.
+    text = extract_text_from_anthropic_request(
+        system=payload.get("system"),
+        messages=messages,
+    )
+    tools = payload.get("tools")
+    if isinstance(tools, list) and tools:
+        with contextlib.suppress(TypeError, ValueError):
+            text = f"{text}\n{json.dumps(tools, ensure_ascii=False)}"
+
+    tokenizer_path = _resolve_count_tokens_tokenizer_path(config, profile)
+    input_tokens = count_tokens(text, tokenizer_path=tokenizer_path)
+    # Report the method count_tokens *actually* used: the accurate backend
+    # only engages when a path is declared AND the optional ``tokenizers``
+    # dependency is importable (see token_estimation_accurate). Otherwise
+    # count_tokens transparently falls back to char/4 — so we must too, or
+    # the log would misreport a heuristic count as tokenizer-accurate.
+    method = "tokenizer" if (tokenizer_path and is_accuracy_available()) else "heuristic"
+
+    logger.info(
+        "count-tokens-served",
+        extra={"method": method, "input_tokens": input_tokens},
+    )
+    return {"input_tokens": input_tokens}
+
+
 async def _anthropic_sse_iterator(
     engine: FallbackEngine, anth_req: AnthropicRequest
 ) -> AsyncIterator[str]:

coderouter/ingress/app.py

@@ -7,7 +7,10 @@ import os
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.types import ASGIApp
 
 from coderouter import __version__
 from coderouter.config import load_config
@@ -25,6 +28,137 @@ from coderouter.routing.capability import check_claude_code_chain_suitability
 logger = get_logger(__name__)
 
 
+# ---------------------------------------------------------------------------
+# H8: DNS-rebinding protection via Host-header validation
+# ---------------------------------------------------------------------------
+
+# Loopback hosts that are always allowed. ``testserver`` is the default Host
+# that Starlette's TestClient sends, so it is whitelisted to keep the existing
+# suite (and any local integration tests) working without extra configuration.
+_DEFAULT_ALLOWED_HOSTS: frozenset[str] = frozenset(
+    {"localhost", "127.0.0.1", "[::1]", "::1", "testserver"}
+)
+
+
+def _parse_allowed_hosts(raw: str | None) -> frozenset[str]:
+    """Merge the built-in loopback set with ``CODEROUTER_ALLOWED_HOSTS``.
+
+    The env var is a comma-separated list of extra hostnames (no port) that
+    should be accepted — the escape hatch for deliberate external exposure.
+    """
+    extra = {
+        part.strip().lower()
+        for part in (raw or "").split(",")
+        if part.strip()
+    }
+    return _DEFAULT_ALLOWED_HOSTS | frozenset(extra)
+
+
+def _host_without_port(host_header: str) -> str:
+    """Strip the optional ``:port`` suffix from a Host header value.
+
+    Handles bracketed IPv6 literals (``[::1]:8080`` → ``[::1]``) as well as
+    the common ``host:port`` form. A bare ``[::1]`` or ``host`` is returned
+    unchanged.
+    """
+    value = host_header.strip().lower()
+    if value.startswith("["):
+        # IPv6 literal: keep everything up to and including the closing bracket.
+        end = value.find("]")
+        if end != -1:
+            return value[: end + 1]
+        return value
+    # IPv4 / hostname: split off a trailing :port if present.
+    if ":" in value:
+        return value.rsplit(":", 1)[0]
+    return value
+
+
+# ---------------------------------------------------------------------------
+# M14: request body size limit (DoS protection)
+# ---------------------------------------------------------------------------
+
+# Default cap for incoming request bodies. Anthropic/OpenAI chat payloads are
+# comfortably below this even with large system prompts; the ceiling exists to
+# stop a client from streaming an unbounded body and exhausting memory.
+_DEFAULT_MAX_BODY_BYTES = 64 * 1024 * 1024  # 64 MB
+_MAX_BODY_BYTES_ENV = "CODEROUTER_MAX_BODY_BYTES"
+
+
+def _parse_max_body_bytes(raw: str | None) -> int:
+    """Resolve the body-size cap from ``CODEROUTER_MAX_BODY_BYTES``.
+
+    Falls back to :data:`_DEFAULT_MAX_BODY_BYTES` when the env var is unset,
+    empty, non-numeric, or non-positive — a misconfigured value must never
+    silently disable the guard.
+    """
+    if raw is None or not raw.strip():
+        return _DEFAULT_MAX_BODY_BYTES
+    try:
+        value = int(raw.strip())
+    except ValueError:
+        return _DEFAULT_MAX_BODY_BYTES
+    return value if value > 0 else _DEFAULT_MAX_BODY_BYTES
+
+
+class BodySizeLimitMiddleware(BaseHTTPMiddleware):
+    """Reject requests whose declared body exceeds the configured cap.
+
+    The check is on the incoming ``Content-Length`` header, so it is cheap
+    (no body is read) and fires before the route handler runs. Streaming
+    *responses* (SSE) are unaffected — this only inspects the request side.
+    A body over the limit fails closed with 413.
+    """
+
+    def __init__(self, app: ASGIApp, max_bytes: int) -> None:
+        super().__init__(app)
+        self._max_bytes = max_bytes
+
+    async def dispatch(self, request: Request, call_next):  # type: ignore[no-untyped-def]
+        content_length = request.headers.get("content-length")
+        if content_length is not None:
+            try:
+                declared = int(content_length)
+            except ValueError:
+                declared = -1
+            if declared > self._max_bytes:
+                return JSONResponse(
+                    status_code=413,
+                    content={
+                        "detail": (
+                            f"Request body too large: {declared} bytes exceeds "
+                            f"the {self._max_bytes}-byte limit."
+                        )
+                    },
+                )
+        return await call_next(request)
+
+
+class HostValidationMiddleware(BaseHTTPMiddleware):
+    """Reject requests whose Host header is not an allow-listed hostname.
+
+    This blocks DNS-rebinding attacks: even when CodeRouter is bound to
+    ``127.0.0.1``, a malicious page can point a hostname it controls at the
+    loopback address and drive the local API from the victim's browser. By
+    pinning the accepted Host values we make such cross-origin requests fail
+    closed with 403.
+    """
+
+    def __init__(self, app: ASGIApp, allowed_hosts: frozenset[str]) -> None:
+        super().__init__(app)
+        self._allowed = allowed_hosts
+
+    async def dispatch(self, request: Request, call_next):  # type: ignore[no-untyped-def]
+        host_header = request.headers.get("host", "")
+        host = _host_without_port(host_header)
+        if host not in self._allowed:
+            return JSONResponse(
+                status_code=403,
+                content={"detail": f"Host {host_header!r} is not allowed."},
+            )
+        return await call_next(request)
+
+
 def create_app(config_path: str | None = None) -> FastAPI:
     """Build a FastAPI app with routes, engine, and lifespan installed.
 
@@ -189,6 +323,15 @@ def create_app(config_path: str | None = None) -> FastAPI:
         with contextlib.suppress(Exception):
             await engine.shutdown_recovery_probes()
 
+        # H3: close each adapter's shared httpx.AsyncClient so pooled
+        # connections / keep-alive sockets are released cleanly instead of
+        # being left to garbage collection. Adapters are cached on the
+        # engine (one per provider); ``aclose`` is idempotent and a no-op
+        # when the adapter never issued a request.
+        for _adapter in engine._adapters.values():
+            with contextlib.suppress(Exception):
+                await _adapter.aclose()
+
         # v2.0-K: persist state and close audit log on shutdown.
         if state_store is not None:
             with contextlib.suppress(Exception):
@@ -228,6 +371,24 @@ def create_app(config_path: str | None = None) -> FastAPI:
     app.state.engine = engine
     app.state.config = config
 
+    # H8: DNS-rebinding protection. Applied to every route so a hostname an
+    # attacker controls cannot be pointed at loopback and used to drive the
+    # local API from a victim's browser. Extra hostnames for deliberate
+    # external exposure come from CODEROUTER_ALLOWED_HOSTS (comma-separated).
+    allowed_hosts = _parse_allowed_hosts(
+        os.environ.get("CODEROUTER_ALLOWED_HOSTS")
+    )
+    app.add_middleware(HostValidationMiddleware, allowed_hosts=allowed_hosts)
+
+    # M14: request body size limit (DoS protection). Added after the Host
+    # middleware so that — because add_middleware wraps outermost-last — Host
+    # validation runs first and the size guard second. SSE streaming responses
+    # are unaffected: the check only reads the request Content-Length.
+    max_body_bytes = _parse_max_body_bytes(
+        os.environ.get(_MAX_BODY_BYTES_ENV)
+    )
+    app.add_middleware(BodySizeLimitMiddleware, max_bytes=max_body_bytes)
+
     @app.get("/healthz")
     async def healthz() -> dict[str, object]:
         """Lightweight liveness / config snapshot endpoint.