coderouter-cli 2.6.1__py3-none-any.whl → 2.7.1__py3-none-any.whl

coderouter/ingress/launcher_routes.py

@@ -26,6 +26,7 @@ import asyncio
 import contextlib
 import os
 import platform
+import secrets
 import shlex
 import shutil
 import subprocess
@@ -39,11 +40,57 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import HTMLResponse
 from pydantic import BaseModel
 
+from coderouter.logging import get_logger
+
+logger = get_logger(__name__)
+
 router = APIRouter()
 
 # 背景タスクへの強参照を保持する (create_task の戻り値が GC されるのを防ぐ)
 _background_tasks: set[asyncio.Task[Any]] = set()
 
+# ---------------------------------------------------------------------------
+# H8: token auth for state-changing endpoints (start / stop / delete)
+# ---------------------------------------------------------------------------
+
+# Env var holding the shared secret. When unset, auth is disabled and the
+# launcher behaves exactly as before (local-only assumption). When set, every
+# state-changing request must carry a matching X-CodeRouter-Token header.
+_LAUNCHER_TOKEN_ENV = "CODEROUTER_LAUNCHER_TOKEN"
+_LAUNCHER_TOKEN_HEADER = "X-CodeRouter-Token"
+
+# Guard so the "no token configured" warning is only logged once per process.
+_token_warning_emitted = False
+
+
+def _require_launcher_token(request: Request) -> None:
+    """Enforce the launcher shared-secret on state-changing endpoints.
+
+    If ``CODEROUTER_LAUNCHER_TOKEN`` is unset the launcher stays open (its
+    historical local-only behaviour) and a one-time warning is logged. When
+    the env var is set, the ``X-CodeRouter-Token`` header must match it using
+    a constant-time comparison, otherwise a 401 is raised.
+    """
+    global _token_warning_emitted
+    expected = os.environ.get(_LAUNCHER_TOKEN_ENV, "")
+    if not expected:
+        if not _token_warning_emitted:
+            logger.warning(
+                "launcher-auth-disabled",
+                extra={
+                    "hint": (
+                        f"{_LAUNCHER_TOKEN_ENV} is not set; launcher "
+                        "start/stop/delete endpoints are unauthenticated. "
+                        "Set it when binding to anything other than loopback."
+                    ),
+                },
+            )
+            _token_warning_emitted = True
+        return
+    provided = request.headers.get(_LAUNCHER_TOKEN_HEADER, "")
+    if not secrets.compare_digest(provided, expected):
+        raise HTTPException(status_code=401, detail="Invalid or missing launcher token.")
+
 # ---------------------------------------------------------------------------
 # Model file extensions to scan
 # ---------------------------------------------------------------------------
@@ -153,6 +200,38 @@ _BACKEND_DEFAULTS: dict[str, str] = {
     "mlx": "python",          # mlx_lm.server (Apple Silicon 向け)
 }
 
+# H8: flags that re-specify the model path. Allowing these through
+# ``options`` / ``extra_args`` would let a caller override the vetted
+# ``model_path`` and load an arbitrary file (or, for vllm/mlx, swap the
+# ``-m`` module target). We reject them per backend so the model is only
+# ever set by the ``model_path`` field.
+#   - llama.cpp: ``-m`` / ``--model`` select the GGUF file.
+#   - vllm / mlx: ``--model`` selects the model; ``-m`` selects the python
+#     module that ``_build_cmd`` pins, so it must not be re-specified either.
+_MODEL_FLAGS: dict[str, frozenset[str]] = {
+    "llama.cpp": frozenset({"-m", "--model"}),
+    "vllm": frozenset({"-m", "--model"}),
+    "mlx": frozenset({"-m", "--model"}),
+}
+
+
+def _assert_no_model_override(backend: str, tokens: list[str]) -> None:
+    """Raise ValueError if ``tokens`` contain a model-selecting flag.
+
+    ``tokens`` is the flat list of argument tokens sourced from ``options``
+    keys or ``shlex.split(extra_args)``. Matching is exact on the flag name;
+    ``--model=foo`` style is caught by comparing the part before ``=``.
+    """
+    banned = _MODEL_FLAGS.get(backend, frozenset())
+    for token in tokens:
+        name = token.split("=", 1)[0]
+        if name in banned:
+            raise ValueError(
+                f"Flag {name!r} is not allowed: the model is set by "
+                "'model_path' and cannot be re-specified via options or "
+                "extra_args."
+            )
+
 
 def _resolve_binary(backend: str, configured: str | None) -> str:
     """Return the executable to use, expanding ~ and env vars."""
@@ -307,6 +386,27 @@ def _model_size_gb(path: str) -> float:
         return 0.0
 
 
+def _resolve_within_model_dirs(model_path: str, model_dirs: list[str]) -> Path:
+    """Resolve ``model_path`` and assert it lives under a configured model dir.
+
+    M14: ``/api/launcher/suggest`` accepts an arbitrary ``model_path`` query
+    param that was previously fed straight into ``expanduser().stat()``. That
+    let a caller probe the existence and size of any file on disk (a path
+    traversal / information-disclosure primitive). We now resolve the path
+    (following ``~`` and ``..``) and require it to be contained in one of the
+    resolved ``model_dirs``. Anything outside — or a request when no
+    ``model_dirs`` are configured — raises ``ValueError`` (mapped to 400).
+    """
+    if not model_dirs:
+        raise ValueError("No model_dirs configured; model_path cannot be validated.")
+    candidate = Path(model_path).expanduser().resolve()
+    for raw in model_dirs:
+        base = Path(raw).expanduser().resolve()
+        if candidate == base or base in candidate.parents:
+            return candidate
+    raise ValueError("model_path is not under any configured model_dirs.")
+
+
 def _build_cmd(
     backend: str,
     model_path: str,
@@ -343,6 +443,9 @@ def _build_cmd(
             "Expected 'llama.cpp', 'vllm' or 'mlx'."
         )
 
+    # H8: reject model-path re-specification via options keys.
+    _assert_no_model_override(backend, list(options.keys()))
+
     for flag, val in options.items():
         if isinstance(val, bool):
             if val:
@@ -351,7 +454,10 @@ def _build_cmd(
             cmd.extend([flag, str(val)])
 
     if extra_args.strip():
-        cmd.extend(shlex.split(extra_args))
+        extra_tokens = shlex.split(extra_args)
+        # H8: reject model-path re-specification via free-form extra_args.
+        _assert_no_model_override(backend, extra_tokens)
+        cmd.extend(extra_tokens)
 
     return cmd
 
@@ -361,6 +467,14 @@ def _build_cmd(
 # ---------------------------------------------------------------------------
 
 
+# M14: cap the StreamReader buffer for launched processes. A backend that
+# emits a huge amount of output without a newline (e.g. a progress bar that
+# only writes ``\r``) would otherwise make ``readline()`` buffer without
+# bound. asyncio raises ``LimitOverrunError`` once the limit is exceeded; we
+# recover by reading the buffered chunk and continuing so log tailing survives.
+_LOG_STREAM_LIMIT = 256 * 1024  # 256 KB
+
+
 async def _tail_logs(proc: ManagedProcess) -> None:
     """Read stdout+stderr into proc.log_tail until the process exits."""
     p = proc._proc
@@ -371,7 +485,22 @@ async def _tail_logs(proc: ManagedProcess) -> None:
         if stream is None:
             return
         while True:
-            line = await stream.readline()
+            try:
+                line = await stream.readline()
+            except (asyncio.LimitOverrunError, ValueError):
+                # M14: a single line exceeded the buffer limit (no newline in
+                # sight). Drain the currently buffered bytes so the reader can
+                # make progress instead of raising forever, then continue.
+                try:
+                    chunk = await stream.read(_LOG_STREAM_LIMIT)
+                except (asyncio.LimitOverrunError, ValueError):
+                    chunk = b""
+                if not chunk:
+                    if stream.at_eof():
+                        break
+                    continue
+                proc.log_tail.append(chunk.decode(errors="replace").rstrip())
+                continue
             if not line:
                 break
             proc.log_tail.append(line.decode(errors="replace").rstrip())
@@ -529,6 +658,7 @@ async def api_backends(request: Request) -> dict[str, Any]:
 @router.post("/api/launcher/start")
 async def api_start(req: StartRequest, request: Request) -> dict[str, Any]:
     """Start a new backend process."""
+    _require_launcher_token(request)
     # Resolve binary path from providers.yaml launcher.backends
     cfg = request.app.state.config
     launcher_cfg = getattr(cfg, "launcher", None)
@@ -565,6 +695,9 @@ async def api_start(req: StartRequest, request: Request) -> dict[str, Any]:
             *cmd,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
+            # M14: bound the per-stream StreamReader buffer so a newline-less
+            # flood from the child cannot grow it without limit.
+            limit=_LOG_STREAM_LIMIT,
         )
     except FileNotFoundError:
         raise HTTPException(
@@ -590,6 +723,7 @@ async def api_start(req: StartRequest, request: Request) -> dict[str, Any]:
 @router.post("/api/launcher/stop/{proc_id}")
 async def api_stop(proc_id: str, request: Request) -> dict[str, Any]:
     """Terminate a running process (SIGTERM, then SIGKILL after 5s)."""
+    _require_launcher_token(request)
     try:
         proc = _registry(request).get(proc_id)
     except KeyError:
@@ -597,12 +731,18 @@ async def api_stop(proc_id: str, request: Request) -> dict[str, Any]:
             status_code=404, detail=f"Process {proc_id!r} not found.") from None
 
     if proc._proc and proc.status == "running":
-        proc._proc.terminate()
+        # M14: the child may already be gone (crashed / reaped) between the
+        # status check and the signal. terminate()/kill() then raise
+        # ProcessLookupError, which previously escaped as a 500. Suppress it
+        # (mirroring shutdown_launcher) so stop is idempotent.
+        with contextlib.suppress(ProcessLookupError):
+            proc._proc.terminate()
         proc.log_tail.append("[launcher] SIGTERM sent")
         try:
             await asyncio.wait_for(proc._proc.wait(), timeout=5.0)
         except TimeoutError:
-            proc._proc.kill()
+            with contextlib.suppress(ProcessLookupError):
+                proc._proc.kill()
             proc.log_tail.append("[launcher] SIGKILL sent (timeout)")
         proc.status = "stopped"
         proc.pid = None
@@ -613,6 +753,7 @@ async def api_stop(proc_id: str, request: Request) -> dict[str, Any]:
 @router.delete("/api/launcher/processes/{proc_id}")
 async def api_delete(proc_id: str, request: Request) -> dict[str, Any]:
     """Remove a stopped process from the registry."""
+    _require_launcher_token(request)
     reg = _registry(request)
     try:
         proc = reg.get(proc_id)
@@ -638,17 +779,28 @@ async def api_logs(proc_id: str, request: Request, n: int = 100) -> dict[str, An
 
 
 @router.get("/api/launcher/suggest")
-async def api_suggest(model_path: str = "",
+async def api_suggest(request: Request, model_path: str = "",
                       backend: str = "llama.cpp") -> dict[str, Any]:
     """Suggest launch flags for the given model based on detected hardware.
 
     クライアントの「推奨値」ボタンから呼ばれる。値はあくまで目安。
     バックエンドごとにフラグ体系が違うため backend も受け取る。
+
+    M14: ``model_path`` is validated against the configured ``model_dirs``
+    before it is ``stat``-ed, so this endpoint can no longer be used to probe
+    the existence/size of arbitrary filesystem paths.
     """
     hw = await asyncio.to_thread(_detect_hardware)
     size_gb = 0.0
     if model_path:
-        size_gb = await asyncio.to_thread(_model_size_gb, model_path)
+        cfg = request.app.state.config
+        launcher_cfg = getattr(cfg, "launcher", None)
+        model_dirs: list[str] = launcher_cfg.model_dirs if launcher_cfg else []
+        try:
+            resolved = _resolve_within_model_dirs(model_path, model_dirs)
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+        size_gb = await asyncio.to_thread(_model_size_gb, str(resolved))
     return {
         "extra_args": _suggest_launch_flags(backend, size_gb, hw),
         "backend": backend,
@@ -828,6 +980,15 @@ _LAUNCHER_HTML = r"""<!doctype html>
   "use strict";
 
   const POLL_MS = 3000;
+  // H8: launcher shared-secret. The server substitutes __LAUNCHER_TOKEN__
+  // with the configured token (or an empty string when auth is disabled).
+  const LAUNCHER_TOKEN = "__LAUNCHER_TOKEN__";
+  // Build headers for state-changing requests, adding the token only when set.
+  const authHeaders = (base) => {
+    const h = Object.assign({}, base || {});
+    if (LAUNCHER_TOKEN) h["X-CodeRouter-Token"] = LAUNCHER_TOKEN;
+    return h;
+  };
   let allProfiles = {};      // backend → [{name, args}]
   const _modelCache = {};    // index → {path, name, dir, size_gb}
   let selectedLogId = null;
@@ -1093,7 +1254,7 @@ _LAUNCHER_HTML = r"""<!doctype html>
     try {
       const res = await fetch("/api/launcher/start", {
         method: "POST",
-        headers: {"Content-Type": "application/json"},
+        headers: authHeaders({"Content-Type": "application/json"}),
         body: JSON.stringify({name, backend, model_path: model, port,
                               options: selectedProfileArgs(), extra_args: extra}),
       });
@@ -1150,7 +1311,7 @@ _LAUNCHER_HTML = r"""<!doctype html>
 
   window.stopProc = async (id) => {
     if (!confirm("プロセスを停止しますか?")) return;
-    const r = await fetch(`/api/launcher/stop/${id}`, {method:"POST"});
+    const r = await fetch(`/api/launcher/stop/${id}`, {method:"POST", headers: authHeaders()});
     const d = await r.json();
     statusMsg(`停止: ${d.status}`);
     await fetchProcesses();
@@ -1159,7 +1320,7 @@ _LAUNCHER_HTML = r"""<!doctype html>
 
   window.deleteProc = async (id) => {
     if (!confirm("レジストリから削除しますか?")) return;
-    await fetch(`/api/launcher/processes/${id}`, {method:"DELETE"});
+    await fetch(`/api/launcher/processes/${id}`, {method:"DELETE", headers: authHeaders()});
     if (selectedLogId === id) closeLog();
     await fetchProcesses();
   };
@@ -1214,5 +1375,20 @@ _LAUNCHER_HTML = r"""<!doctype html>
 
 @router.get("/launcher", response_class=HTMLResponse)
 async def launcher_page() -> HTMLResponse:
-    """Serve the launcher single-page UI."""
-    return HTMLResponse(content=_LAUNCHER_HTML)
+    """Serve the launcher single-page UI.
+
+    H8: inject the configured launcher token so the inline JS can attach it
+    to state-changing requests. When the env var is unset the placeholder
+    becomes an empty string and the UI keeps working unauthenticated (the
+    historical local-only default). The token is escaped for a JS string
+    context to avoid breaking out of the double-quoted literal.
+    """
+    token = os.environ.get(_LAUNCHER_TOKEN_ENV, "")
+    safe_token = (
+        token.replace("\\", "\\\\")
+        .replace('"', '\\"')
+        .replace("<", "\\u003c")
+        .replace(">", "\\u003e")
+    )
+    html = _LAUNCHER_HTML.replace("__LAUNCHER_TOKEN__", safe_token)
+    return HTMLResponse(content=html)

coderouter/ingress/openai_routes.py

@@ -21,6 +21,8 @@ through to the engine, which applies ``config.default_profile``.
 
 from __future__ import annotations
 
+import asyncio
+import contextlib
 import json
 import time
 from collections.abc import AsyncIterator
@@ -40,6 +42,41 @@ logger = get_logger(__name__)
 _PROFILE_HEADER = "x-coderouter-profile"
 _MODE_HEADER = "x-coderouter-mode"
 
+# M14: overall SSE stream ceiling — see anthropic_routes for rationale.
+_STREAM_TIMEOUT_MULTIPLIER = 20.0
+_STREAM_TIMEOUT_DEFAULT_S = 900.0
+_STREAM_TIMEOUT_MIN_S = 60.0
+
+
+def _resolve_stream_timeout_s(engine: FallbackEngine, profile: str | None) -> float:
+    """M14: derive the overall stream ceiling (seconds) for a profile.
+
+    Mirrors the Anthropic route. Uses the profile's per-call ``timeout_s``
+    (or the first provider's, or the default) scaled up. Never below
+    ``_STREAM_TIMEOUT_MIN_S``; any resolution failure falls back to
+    ``_STREAM_TIMEOUT_DEFAULT_S``. Does not change the config schema.
+    """
+    per_call: float | None = None
+    try:
+        config = engine.config
+        chosen = profile or config.default_profile
+        chain_cfg = config.profile_by_name(chosen)
+        per_call = getattr(chain_cfg, "timeout_s", None)
+        if per_call is None:
+            for pname in getattr(chain_cfg, "providers", []) or []:
+                pconf = next(
+                    (p for p in config.providers if p.name == pname), None
+                )
+                if pconf is not None:
+                    per_call = getattr(pconf, "timeout_s", None)
+                    break
+    except (AttributeError, KeyError, ValueError):
+        per_call = None
+
+    if per_call is None:
+        return _STREAM_TIMEOUT_DEFAULT_S
+    return max(_STREAM_TIMEOUT_MIN_S, float(per_call) * _STREAM_TIMEOUT_MULTIPLIER)
+
 
 @router.get("/models")
 async def list_models(request: Request) -> dict[str, object]:
@@ -125,8 +162,10 @@ async def chat_completions(
             ) from exc
 
     if chat_req.stream:
+        # M14: overall stream timeout + client-disconnect cleanup.
+        timeout_s = _resolve_stream_timeout_s(engine, chat_req.profile)
         return StreamingResponse(
-            _sse_iterator(engine, chat_req),
+            _sse_iterator(engine, chat_req, timeout_s=timeout_s),
             media_type="text/event-stream",
             headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
         )
@@ -139,15 +178,46 @@ async def chat_completions(
     return response.model_dump(exclude_none=True)
 
 
-async def _sse_iterator(engine: FallbackEngine, chat_req: ChatRequest) -> AsyncIterator[str]:
-    """Wrap the engine's stream into SSE wire format."""
+async def _sse_iterator(
+    engine: FallbackEngine,
+    chat_req: ChatRequest,
+    *,
+    timeout_s: float = _STREAM_TIMEOUT_DEFAULT_S,
+) -> AsyncIterator[str]:
+    """Wrap the engine's stream into SSE wire format.
+
+    M14: bounded by an overall ``timeout_s`` ceiling and guarantees the
+    upstream engine generator is finalized on client disconnect
+    (``CancelledError``) or timeout, so the upstream connection is
+    released instead of leaking.
+    """
+    source = engine.stream(chat_req)
     try:
-        async for chunk in engine.stream(chat_req):
-            data = chunk.model_dump(exclude_none=True)
-            yield f"data: {json.dumps(data, ensure_ascii=False)}\n\n"
-        yield "data: [DONE]\n\n"
+        async with asyncio.timeout(timeout_s):
+            async for chunk in source:
+                data = chunk.model_dump(exclude_none=True)
+                yield f"data: {json.dumps(data, ensure_ascii=False)}\n\n"
+            yield "data: [DONE]\n\n"
     except NoProvidersAvailableError as exc:
         # Encode the error inside the SSE channel — OpenAI clients handle this
         err = {"error": {"message": str(exc), "type": "no_providers_available"}}
         yield f"data: {json.dumps(err, ensure_ascii=False)}\n\n"
         yield "data: [DONE]\n\n"
+    except TimeoutError:
+        # M14: overall ceiling hit — surface a terminal error frame.
+        logger.warning("sse-stream-timeout", extra={"timeout_s": timeout_s})
+        err = {"error": {"message": f"stream exceeded {timeout_s:.0f}s ceiling", "type": "timeout"}}
+        yield f"data: {json.dumps(err, ensure_ascii=False)}\n\n"
+        yield "data: [DONE]\n\n"
+    except asyncio.CancelledError:
+        # M14: client disconnected — re-raise after finalizing the source.
+        logger.info("sse-client-disconnect")
+        raise
+    finally:
+        # M14: ensure the engine generator's finally blocks run so the
+        # adapter's httpx streaming context releases the upstream socket.
+        aclose = getattr(source, "aclose", None)
+        if aclose is not None:
+            # Best-effort cleanup; never mask the original exit reason.
+            with contextlib.suppress(asyncio.CancelledError, Exception):
+                await aclose()

coderouter/logging.py

@@ -76,15 +76,36 @@ class JsonLineFormatter(logging.Formatter):
         return json.dumps(payload, ensure_ascii=False)
 
 
+# Marker attribute stamped on the handler this module installs. Used by
+# configure_logging to remove ONLY its own prior handler on reconfigure,
+# rather than nuking every handler on the root logger. Removing all
+# handlers was a M4 bug: a second create_app() in the same process would
+# also detach the MetricsCollector / audit / request-log handlers that
+# other subsystems had attached, silently killing metrics and the JSONL
+# journals from the second app onward.
+_CODEROUTER_LOG_HANDLER_MARKER: str = "_coderouter_json_line_handler"
+
+
 def configure_logging(level: str = "INFO") -> None:
-    """Install JSON-line logging on the root logger. Idempotent."""
+    """Install JSON-line logging on the root logger. Idempotent.
+
+    Only the handler this function previously installed (identified by the
+    :data:`_CODEROUTER_LOG_HANDLER_MARKER` attribute) is removed on
+    reconfigure. Handlers attached by other subsystems — the
+    :class:`~coderouter.metrics.collector.MetricsCollector`, the audit /
+    request-log JSONL handlers — are left in place so a second
+    ``create_app()`` in the same process does not silently detach them.
+    """
     root = logging.getLogger()
     root.setLevel(level.upper())
-    # Avoid duplicate handlers on reload
+    # Avoid duplicate handlers on reload — but only remove OUR own prior
+    # handler, never handlers other subsystems attached (M4).
     for h in list(root.handlers):
-        root.removeHandler(h)
+        if getattr(h, _CODEROUTER_LOG_HANDLER_MARKER, False):
+            root.removeHandler(h)
     handler = logging.StreamHandler(sys.stderr)
     handler.setFormatter(JsonLineFormatter())
+    setattr(handler, _CODEROUTER_LOG_HANDLER_MARKER, True)
     root.addHandler(handler)
 
 
@@ -108,6 +129,7 @@ CapabilityDegradedReason = Literal[
     "provider-does-not-support",
     "translation-lossy",
     "non-standard-field",
+    "unsupported-backend",
 ]
 """Why a capability was degraded.
 
@@ -121,6 +143,10 @@ CapabilityDegradedReason = Literal[
 - ``non-standard-field``: upstream emits a field that is not in the spec
   the ingress speaks, so we strip it on the response-side boundary.
   v0.5-C reasoning field.
+- ``unsupported-backend``: the request asks for a semantic the target
+  backend does not honor (S2 forced ``tool_choice``); with action
+  ``warn`` the request is sent unchanged, with ``emulate`` a separate
+  ``tool-choice-emulated`` line records the substituted directive.
 """