@oneciel-ai/ciel-runtime 0.1.1 → 0.2.0

package/ciel_runtime_support/codex_mcp_integration.py

@@ -0,0 +1,195 @@
+"""Codex MCP discovery, capability filtering, and proxy configuration."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Callable, Iterable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpConfigPorts:
+    discover: Callable[..., dict[str, dict[str, Any]]]
+    log: Callable[[str, str], None]
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpArtifactPorts:
+    config_path: Callable[[], Path]
+    save_json: Callable[[Path, dict[str, Any], str], None]
+    unlink: Callable[[Path], None]
+    load_json: Callable[[Path], Any]
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpCapabilityPorts:
+    ensure_probe_cache: Callable[..., Any]
+    read_servers: Callable[[Path, Path], list[dict[str, Any]]]
+    cached_probe_servers: Callable[[], list[dict[str, Any]]]
+    path_key: Callable[[Path], str]
+    cwd: Callable[[], Path]
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpProjectionPorts:
+    dedupe_strings: Callable[[Iterable[str]], list[str]]
+    public_name: Callable[[str], str]
+    is_streamable_http: Callable[[dict[str, Any]], bool]
+    split_proxy_url: Callable[[str], str]
+    toml_string: Callable[[str], str]
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpPolicy:
+    native_channel_names: frozenset[str]
+    builtin_channel_url: Callable[[], str]
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpIntegrationService:
+    config: CodexMcpConfigPorts
+    artifact: CodexMcpArtifactPorts
+    capability: CodexMcpCapabilityPorts
+    projection: CodexMcpProjectionPorts
+    policy: CodexMcpPolicy
+
+    def discovered_servers(
+        self,
+        passthrough: list[str] | None = None,
+        env: dict[str, str] | None = None,
+        cwd: Path | None = None,
+    ) -> dict[str, dict[str, Any]]:
+        return self.config.discover(passthrough, env, cwd, log=self.config.log)
+
+    def write_discovery_config(
+        self,
+        passthrough: list[str] | None = None,
+        env: dict[str, str] | None = None,
+        cwd: Path | None = None,
+    ) -> Path | None:
+        servers = self.discovered_servers(passthrough or [], env=env, cwd=cwd)
+        path = self.artifact.config_path()
+        if not servers:
+            try:
+                self.artifact.unlink(path)
+            except FileNotFoundError:
+                pass
+            except Exception as exc:
+                self.config.log(
+                    "WARN",
+                    "codex_mcp_config_remove_failed "
+                    f"error={type(exc).__name__}: {exc}",
+                )
+            return None
+        self.artifact.save_json(path, {"mcpServers": servers}, "codex_mcp_config")
+        self.config.log(
+            "INFO", f"codex_mcp_config_written servers={','.join(sorted(servers))}"
+        )
+        return path
+
+    @staticmethod
+    def config_bare_key(name: str) -> str | None:
+        text = str(name or "").strip()
+        return text if re.fullmatch(r"[A-Za-z0-9_-]+", text) else None
+
+    def channel_capable_server_names(
+        self, cfg: dict[str, Any], config_path: Path | None
+    ) -> list[str]:
+        if not config_path or not config_path.exists() or not config_path.is_file():
+            return []
+        self.capability.ensure_probe_cache(
+            cfg, [], extra_config_paths=[config_path]
+        )
+        candidate_names = [
+            str(server.get("channel") or "").strip()
+            for server in self.capability.read_servers(
+                config_path, self.capability.cwd()
+            )
+            if str(server.get("channel") or "").strip()
+        ]
+        source_key = self.capability.path_key(config_path)
+        capable = {
+            str(record.get("name") or "").strip()
+            for record in self.capability.cached_probe_servers()
+            if record.get("capable")
+            and str(record.get("name") or "").strip()
+            and self.capability.path_key(
+                Path(str(record.get("source_path") or ""))
+            )
+            == source_key
+        }
+        return self.projection.dedupe_strings(
+            name
+            for name in candidate_names
+            if name in capable and name.casefold() not in self.policy.native_channel_names
+        )
+
+    def streamable_http_servers(
+        self, config_path: Path | None
+    ) -> dict[str, dict[str, Any]]:
+        if not config_path or not config_path.exists() or not config_path.is_file():
+            return {}
+        try:
+            data = self.artifact.load_json(config_path)
+        except Exception as exc:
+            self.config.log(
+                "WARN",
+                "codex_mcp_compat_source_read_failed "
+                f"error={type(exc).__name__}: {exc}",
+            )
+            return {}
+        servers = data.get("mcpServers") if isinstance(data, dict) else None
+        if not isinstance(servers, dict):
+            return {}
+        return {
+            name: raw_server
+            for raw_name, raw_server in servers.items()
+            if (name := str(raw_name).strip())
+            and isinstance(raw_server, dict)
+            and self.projection.is_streamable_http(raw_server)
+        }
+
+    def native_http_compat_args(
+        self,
+        config_path: Path | None,
+        *,
+        split_http_proxy: bool = False,
+        channel_owned_server_names: Iterable[str] | None = None,
+        include_builtin_channel: bool = False,
+    ) -> list[str]:
+        servers = self.streamable_http_servers(config_path)
+        args: list[str] = []
+        active: list[str] = []
+        if include_builtin_channel:
+            key = "ciel-runtime-router"
+            url = self.projection.toml_string(self.policy.builtin_channel_url())
+            args.extend(["-c", f"mcp_servers.{key}.url={url}"])
+            active.append(key)
+        channel_owned = {
+            self.projection.public_name(str(name or "").strip())
+            for name in channel_owned_server_names or []
+            if str(name or "").strip()
+        }
+        for name in sorted(servers):
+            key = self.config_bare_key(name)
+            if not key:
+                self.config.log(
+                    "WARN", f"codex_mcp_compat_skipped_unsafe_name server={name}"
+                )
+                continue
+            if split_http_proxy or self.projection.public_name(name) in channel_owned:
+                url = self.projection.toml_string(
+                    self.projection.split_proxy_url(name)
+                )
+                args.extend(["-c", f"mcp_servers.{key}.url={url}"])
+            if name not in active:
+                active.append(name)
+        if active:
+            self.config.log(
+                "INFO",
+                "codex_mcp_native_http_compat servers=%s split_http_proxy=%s"
+                % (",".join(active), str(bool(split_http_proxy)).lower()),
+            )
+        return args

package/ciel_runtime_support/codex_mcp_restore.py

@@ -0,0 +1,304 @@
+"""Conservative restoration of missing native Codex MCP configuration."""
+
+from __future__ import annotations
+
+import json
+import math
+import os
+import time
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from .mcp_inventory import McpInventoryService
+
+
+_SCALAR_KEYS = (
+    "command",
+    "cwd",
+    "url",
+    "bearer_token_env_var",
+    "enabled",
+    "experimental_environment",
+    "oauth_resource",
+    "required",
+    "startup_timeout_ms",
+    "startup_timeout_sec",
+    "tool_timeout_sec",
+)
+_LIST_KEYS = (
+    "args",
+    "env_vars",
+    "enabled_tools",
+    "disabled_tools",
+    "scopes",
+)
+_TABLE_KEYS = ("env", "http_headers", "env_http_headers")
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpRestorePorts:
+    config_paths: Callable[..., list[Path]]
+    discover_managed: Callable[[Path], dict[str, dict[str, Any]]]
+    log: Callable[[str, str], None]
+
+
+@dataclass(frozen=True, slots=True)
+class CodexMcpRestoreService:
+    ports: CodexMcpRestorePorts
+
+    def restore(
+        self,
+        passthrough: list[str] | None = None,
+        env: dict[str, str] | None = None,
+        cwd: Path | None = None,
+    ) -> list[str]:
+        working_directory = (cwd or Path.cwd()).resolve()
+        paths = self.ports.config_paths(
+            passthrough or [], env=env, cwd=working_directory
+        )
+        if not paths:
+            return []
+        config_path = paths[0]
+        reserved: set[str] = set()
+        for path in paths[1:]:
+            if not path.is_file():
+                continue
+            try:
+                reserved.update(
+                    self._existing_names(path.read_text(encoding="utf-8"))
+                )
+            except (OSError, UnicodeError, ValueError, TypeError) as exc:
+                self.ports.log(
+                    "WARN",
+                    "codex_mcp_restore_config_read_failed "
+                    f"path={path} error={type(exc).__name__}: {exc}",
+                )
+                return []
+        managed = self.ports.discover_managed(working_directory)
+        return self._restore_missing(config_path, managed, reserved=reserved)
+
+    def _restore_missing(
+        self,
+        config_path: Path,
+        managed: dict[str, dict[str, Any]],
+        *,
+        reserved: set[str] | None = None,
+    ) -> list[str]:
+        try:
+            before = self._signature(config_path)
+            original = config_path.read_text(encoding="utf-8") if before else ""
+            existing = self._existing_names(original)
+        except (OSError, UnicodeError, ValueError, TypeError, RuntimeError) as exc:
+            self.ports.log(
+                "WARN",
+                "codex_mcp_restore_config_read_failed "
+                f"path={config_path} error={type(exc).__name__}: {exc}",
+            )
+            return []
+
+        projected: dict[str, dict[str, Any]] = {}
+        for raw_name, raw_server in managed.items():
+            name = str(raw_name or "").strip()
+            if not name or not isinstance(raw_server, dict):
+                continue
+            server = self._project_server(raw_server)
+            if server is None:
+                self.ports.log(
+                    "WARN", f"codex_mcp_restore_skipped_unsupported server={name}"
+                )
+                continue
+            projected[name] = server
+        merged = McpInventoryService.merge(
+            {name: {} for name in existing}, projected, reserved=reserved
+        )
+        additions = [(name, projected[name]) for name in merged.added]
+
+        if not additions:
+            return []
+
+        suffix = "" if not original or original.endswith("\n") else "\n"
+        blocks = "\n".join(
+            self._server_toml(name, server) for name, server in additions
+        )
+        restored = original + suffix + ("\n" if original else "") + blocks
+        if not restored.endswith("\n"):
+            restored += "\n"
+
+        try:
+            self._validate(restored)
+            self._atomic_replace(config_path, restored, before)
+        except (OSError, UnicodeError, ValueError, TypeError) as exc:
+            self.ports.log(
+                "WARN",
+                "codex_mcp_restore_write_failed "
+                f"path={config_path} error={type(exc).__name__}: {exc}",
+            )
+            return []
+
+        names = [name for name, _server in additions]
+        self.ports.log(
+            "INFO",
+            "codex_mcp_config_restored "
+            f"path={config_path} servers={','.join(sorted(names))}",
+        )
+        return names
+
+    @staticmethod
+    def _signature(path: Path) -> tuple[int, int, int] | None:
+        try:
+            stat = path.stat()
+        except FileNotFoundError:
+            return None
+        return stat.st_mtime_ns, stat.st_size, getattr(stat, "st_ino", 0)
+
+    @staticmethod
+    def _validate(text: str) -> dict[str, Any]:
+        import tomllib
+
+        data = tomllib.loads(text)
+        if not isinstance(data, dict):
+            raise ValueError("Codex config must be a TOML table")
+        return data
+
+    @classmethod
+    def _existing_names(cls, text: str) -> set[str]:
+        if not text.strip():
+            return set()
+        data = cls._validate(text)
+        servers = data.get("mcp_servers")
+        if not isinstance(servers, dict):
+            return set()
+        return {str(name).strip() for name in servers if str(name).strip()}
+
+    @classmethod
+    def _project_server(cls, server: dict[str, Any]) -> dict[str, Any] | None:
+        projected: dict[str, Any] = {}
+        command = str(server.get("command") or "").strip()
+        url = str(server.get("url") or server.get("endpoint") or "").strip()
+        raw_args = server.get("args")
+        arguments = [str(item) for item in raw_args] if isinstance(raw_args, list) else []
+        if "mcp-proxy" in arguments and "--server-config" in arguments:
+            return None
+        transport = str(server.get("type") or server.get("transport") or "").strip().casefold()
+        if command:
+            projected["command"] = command
+        elif url.startswith(("http://", "https://")) and transport != "sse":
+            projected["url"] = url
+        else:
+            return None
+
+        aliases = {
+            "token_env_var": "bearer_token_env_var",
+            "headers": "http_headers",
+        }
+        normalized = dict(server)
+        for source, target in aliases.items():
+            if target not in normalized and source in normalized:
+                normalized[target] = normalized[source]
+        for key in _SCALAR_KEYS:
+            if key in {"command", "url"} or normalized.get(key) is None:
+                continue
+            value = normalized[key]
+            if isinstance(value, (str, bool, int)) or (
+                isinstance(value, float) and math.isfinite(value)
+            ):
+                projected[key] = value
+        for key in _LIST_KEYS:
+            value = normalized.get(key)
+            if isinstance(value, list) and all(
+                cls._supported_list_item(item) for item in value
+            ):
+                projected[key] = list(value)
+        for key in _TABLE_KEYS:
+            value = normalized.get(key)
+            if isinstance(value, dict):
+                projected[key] = {
+                    str(item_key): str(item_value)
+                    for item_key, item_value in value.items()
+                    if str(item_key).strip()
+                }
+        return projected
+
+    @staticmethod
+    def _supported_list_item(value: Any) -> bool:
+        if isinstance(value, (str, bool, int)):
+            return True
+        if isinstance(value, float):
+            return math.isfinite(value)
+        if isinstance(value, dict):
+            return all(
+                str(key).strip()
+                and CodexMcpRestoreService._supported_list_item(item)
+                and not isinstance(item, (list, dict))
+                for key, item in value.items()
+            )
+        return False
+
+    @staticmethod
+    def _toml_value(value: Any) -> str:
+        if isinstance(value, bool):
+            return "true" if value else "false"
+        if isinstance(value, (int, float)) and not isinstance(value, bool):
+            return repr(value)
+        if isinstance(value, dict):
+            entries = (
+                f"{json.dumps(str(key), ensure_ascii=False)} = {CodexMcpRestoreService._toml_value(item)}"
+                for key, item in value.items()
+            )
+            return "{ " + ", ".join(entries) + " }"
+        if isinstance(value, list):
+            return "[" + ", ".join(CodexMcpRestoreService._toml_value(item) for item in value) + "]"
+        return json.dumps(str(value), ensure_ascii=False)
+
+    @classmethod
+    def _server_toml(cls, name: str, server: dict[str, Any]) -> str:
+        table_name = json.dumps(name, ensure_ascii=False)
+        lines = [
+            "# Restored by Ciel Runtime from managed MCP state; existing Codex entries take precedence.",
+            f"[mcp_servers.{table_name}]",
+        ]
+        for key in _SCALAR_KEYS:
+            if key in server:
+                lines.append(f"{key} = {cls._toml_value(server[key])}")
+        for key in _LIST_KEYS:
+            if key in server:
+                lines.append(f"{key} = {cls._toml_value(server[key])}")
+        for key in _TABLE_KEYS:
+            values = server.get(key)
+            if not isinstance(values, dict) or not values:
+                continue
+            lines.extend(("", f"[mcp_servers.{table_name}.{key}]"))
+            for item_key, item_value in sorted(values.items()):
+                encoded_key = json.dumps(str(item_key), ensure_ascii=False)
+                lines.append(f"{encoded_key} = {cls._toml_value(item_value)}")
+        return "\n".join(lines) + "\n"
+
+    @classmethod
+    def _atomic_replace(
+        cls,
+        path: Path,
+        text: str,
+        expected: tuple[int, int, int] | None,
+    ) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        if cls._signature(path) != expected:
+            raise RuntimeError("Codex config changed while MCP restoration was running")
+        temporary = path.with_name(
+            f"{path.name}.{os.getpid()}.{time.time_ns()}.tmp"
+        )
+        try:
+            temporary.write_text(text, encoding="utf-8")
+            os.chmod(temporary, 0o600)
+            if cls._signature(path) != expected:
+                raise RuntimeError("Codex config changed while MCP restoration was running")
+            temporary.replace(path)
+        finally:
+            try:
+                temporary.unlink()
+            except FileNotFoundError:
+                pass
+
+
+__all__ = ["CodexMcpRestorePorts", "CodexMcpRestoreService"]

package/ciel_runtime_support/codex_model_catalog.py

@@ -0,0 +1,133 @@
+"""Codex bundled-model catalog projection and atomic persistence."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+@dataclass(frozen=True, slots=True)
+class CodexModelCatalogSpec:
+    alias: str
+    provider_label: str
+    context_window: int
+    effort: str = ""
+    auto_compact_token_limit: int | None = None
+
+
+class CodexModelCatalogService:
+    def __init__(
+        self,
+        config_dir: Path,
+        run: Callable[..., Any],
+        log: Callable[[str, str], None],
+    ) -> None:
+        self.config_dir = config_dir
+        self.run = run
+        self.log = log
+
+    def write(
+        self,
+        codex: str,
+        spec: CodexModelCatalogSpec,
+        environment: dict[str, str],
+    ) -> Path | None:
+        try:
+            result = self.run(
+                [codex, "debug", "models", "--bundled"],
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+                timeout=15,
+                check=False,
+                env=environment,
+            )
+            if result.returncode != 0:
+                detail = result.stderr or result.stdout or f"exit {result.returncode}"
+                raise RuntimeError(detail.strip())
+            catalog = json.loads(result.stdout)
+            models = catalog.get("models") if isinstance(catalog, dict) else None
+            if not isinstance(models, list) or not models:
+                raise ValueError("bundled catalog contains no models")
+            template = next(
+                (
+                    item
+                    for item in models
+                    if isinstance(item, dict) and item.get("slug") == "gpt-5.2"
+                ),
+                None,
+            )
+            if template is None:
+                template = next((item for item in models if isinstance(item, dict)), None)
+            if template is None:
+                raise ValueError("bundled catalog contains no model metadata")
+            routed = self._routed_model(template, spec)
+            catalog["models"] = [
+                item
+                for item in models
+                if not (isinstance(item, dict) and item.get("slug") == spec.alias)
+            ] + [routed]
+            return self._save(catalog)
+        except Exception as exc:
+            self.log(
+                "WARN",
+                f"codex_model_catalog_generation_failed "
+                f"error={type(exc).__name__}: {exc}",
+            )
+            return None
+
+    @staticmethod
+    def _routed_model(
+        template: dict[str, Any], spec: CodexModelCatalogSpec
+    ) -> dict[str, Any]:
+        routed = json.loads(json.dumps(template))
+        auto_compact_token_limit = (
+            spec.auto_compact_token_limit
+            if spec.auto_compact_token_limit is not None
+            else max(1, (spec.context_window * 9) // 10)
+        )
+        routed.update(
+            {
+                "slug": spec.alias,
+                "display_name": f"Ciel Runtime {spec.provider_label}",
+                "description": f"{spec.provider_label} routed through Ciel Runtime.",
+                "visibility": "none",
+                "supported_in_api": True,
+                "priority": 99,
+                "context_window": spec.context_window,
+                "max_context_window": spec.context_window,
+                "auto_compact_token_limit": min(
+                    spec.context_window,
+                    max(1, auto_compact_token_limit),
+                ),
+            }
+        )
+        if spec.effort:
+            routed["default_reasoning_level"] = spec.effort
+            supported = routed.get("supported_reasoning_levels")
+            if not isinstance(supported, list):
+                supported = []
+            if not any(
+                isinstance(item, dict) and item.get("effort") == spec.effort
+                for item in supported
+            ):
+                supported.append(
+                    {
+                        "effort": spec.effort,
+                        "description": f"{spec.effort.title()} reasoning effort",
+                    }
+                )
+            routed["supported_reasoning_levels"] = supported
+        return routed
+
+    def _save(self, catalog: dict[str, Any]) -> Path:
+        self.config_dir.mkdir(parents=True, exist_ok=True)
+        path = self.config_dir / "codex-model-catalog.json"
+        temporary = path.with_suffix(".json.tmp")
+        temporary.write_text(json.dumps(catalog, ensure_ascii=False), encoding="utf-8")
+        temporary.replace(path)
+        return path