@oneciel-ai/ciel-runtime 0.2.2 → 0.2.3

package/ciel_runtime_support/codex_mcp_integration.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import re
 from collections.abc import Callable, Iterable
 from dataclasses import dataclass
@@ -23,9 +24,15 @@ class CodexMcpArtifactPorts:
     load_json: Callable[[Path], Any]
 
 
+@dataclass(frozen=True, slots=True)
+class CodexMcpProbeCachePorts:
+    ensure: Callable[..., Any]
+    refresh: Callable[..., Any]
+
+
 @dataclass(frozen=True, slots=True)
 class CodexMcpCapabilityPorts:
-    ensure_probe_cache: Callable[..., Any]
+    probe_cache: CodexMcpProbeCachePorts
     read_servers: Callable[[Path, Path], list[dict[str, Any]]]
     cached_probe_servers: Callable[[], list[dict[str, Any]]]
     path_key: Callable[[Path], str]
@@ -99,7 +106,7 @@ class CodexMcpIntegrationService:
     ) -> list[str]:
         if not config_path or not config_path.exists() or not config_path.is_file():
             return []
-        self.capability.ensure_probe_cache(
+        self.capability.probe_cache.ensure(
             cfg, [], extra_config_paths=[config_path]
         )
         candidate_names = [
@@ -110,9 +117,43 @@ class CodexMcpIntegrationService:
             if str(server.get("channel") or "").strip()
         ]
         source_key = self.capability.path_key(config_path)
+        records = self.capability.cached_probe_servers()
+        source_names = {
+            str(record.get("name") or "").strip()
+            for record in records
+            if str(record.get("name") or "").strip()
+            and self.capability.path_key(
+                Path(str(record.get("source_path") or ""))
+            )
+            == source_key
+        }
+        missing_source_names = sorted(set(candidate_names) - source_names)
+        if missing_source_names:
+            # A name-only probe cache can contain a valid result from a stale
+            # source file while the generated Codex projection has different
+            # authentication headers.  Refresh from the generated artifact so
+            # the notification worker is selected from the exact config it
+            # will use, rather than silently falling back to Codex's native
+            # connection (which Ciel cannot inject from).
+            try:
+                self.capability.probe_cache.refresh(
+                    [], extra_config_paths=[config_path]
+                )
+                records = self.capability.cached_probe_servers()
+                self.config.log(
+                    "INFO",
+                    "codex_mcp_channel_probe_refreshed "
+                    f"source={config_path} missing={','.join(missing_source_names)}",
+                )
+            except Exception as exc:
+                self.config.log(
+                    "WARN",
+                    "codex_mcp_channel_probe_refresh_failed "
+                    f"source={config_path} error={type(exc).__name__}: {exc}",
+                )
         capable = {
             str(record.get("name") or "").strip()
-            for record in self.capability.cached_probe_servers()
+            for record in records
             if record.get("capable")
             and str(record.get("name") or "").strip()
             and self.capability.path_key(
@@ -151,6 +192,49 @@ class CodexMcpIntegrationService:
             and self.projection.is_streamable_http(raw_server)
         }
 
+    @staticmethod
+    def _notification_owner_identity(server: dict[str, Any]) -> str:
+        """Identify aliases that would open the same authenticated HTTP stream."""
+        projected = {
+            "url": str(server.get("url") or server.get("endpoint") or "")
+            .strip()
+            .rstrip("/"),
+            "headers": server.get("headers")
+            if isinstance(server.get("headers"), dict)
+            else {},
+            "env_http_headers": server.get("env_http_headers")
+            if isinstance(server.get("env_http_headers"), dict)
+            else {},
+            "bearer_token": str(server.get("bearer_token") or server.get("token") or ""),
+            "bearer_token_env_var": str(
+                server.get("bearer_token_env_var") or server.get("token_env_var") or ""
+            ),
+        }
+        return json.dumps(projected, sort_keys=True, separators=(",", ":"), default=str)
+
+    def channel_owned_aliases(
+        self,
+        servers: dict[str, dict[str, Any]],
+        channel_owned_server_names: Iterable[str] | None,
+    ) -> set[str]:
+        requested = {
+            self.projection.public_name(str(name or "").strip())
+            for name in channel_owned_server_names or []
+            if str(name or "").strip()
+        }
+        owned_identities = {
+            self._notification_owner_identity(server)
+            for name, server in servers.items()
+            if self.projection.public_name(name) in requested
+        }
+        if not owned_identities:
+            return requested
+        return {
+            self.projection.public_name(name)
+            for name, server in servers.items()
+            if self._notification_owner_identity(server) in owned_identities
+        }
+
     def native_http_compat_args(
         self,
         config_path: Path | None,
@@ -167,11 +251,9 @@ class CodexMcpIntegrationService:
             url = self.projection.toml_string(self.policy.builtin_channel_url())
             args.extend(["-c", f"mcp_servers.{key}.url={url}"])
             active.append(key)
-        channel_owned = {
-            self.projection.public_name(str(name or "").strip())
-            for name in channel_owned_server_names or []
-            if str(name or "").strip()
-        }
+        channel_owned = self.channel_owned_aliases(
+            servers, channel_owned_server_names
+        )
         for name in sorted(servers):
             key = self.config_bare_key(name)
             if not key:

package/ciel_runtime_support/codex_model_catalog.py

@@ -6,7 +6,7 @@ import json
 from collections.abc import Callable
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any
+from typing import Any, Mapping
 
 
 @dataclass(frozen=True, slots=True)
@@ -16,6 +16,7 @@ class CodexModelCatalogSpec:
     context_window: int
     effort: str = ""
     auto_compact_token_limit: int | None = None
+    metadata: Mapping[str, Any] | None = None
 
 
 class CodexModelCatalogService:
@@ -106,6 +107,8 @@ class CodexModelCatalogService:
                 ),
             }
         )
+        if spec.metadata:
+            routed.update(json.loads(json.dumps(dict(spec.metadata))))
         if spec.effort:
             routed["default_reasoning_level"] = spec.effort
             supported = routed.get("supported_reasoning_levels")

package/ciel_runtime_support/codex_reasoning_rejects.py

@@ -0,0 +1,225 @@
+"""Remove sealed reasoning that the Codex backend itself refused to verify.
+
+A Codex session can move between providers (routed GitHub Copilot, Alibaba,
+back to an OpenAI account). Each provider seals its reasoning items with its
+own keys, Codex persists them, and on resume it replays them with their item
+IDs stripped — so a replayed reasoning item carries no provenance the router
+could inspect. Only the upstream can tell whose ciphertext it is, and when it
+is not its own the OpenAI backend rejects the whole turn:
+
+    invalid_request_error: The encrypted content oPYR...Lj8= could not be
+    verified. Reason: Encrypted content could not be decrypted or parsed.
+
+This module turns that explicit verdict into the removal rule. The error names
+the ciphertext's head and tail; the matching reasoning item is dropped and the
+request retried, and the verdict is persisted (as a SHA-256 of the ciphertext)
+so later turns strip it before sending. Nothing is guessed: every removal
+traces back to an upstream rejection of that exact ciphertext, sealed
+reasoning the upstream accepts is never touched, and the session file is
+never modified.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from pathlib import Path
+from typing import Any, Callable
+
+_UNVERIFIABLE_CONTENT = re.compile(
+    r"encrypted content ([A-Za-z0-9+/=_-]+)\.\.\.([A-Za-z0-9+/=_-]+) "
+    r"could not be verified"
+)
+
+_MISSING_ITEM = re.compile(r"[Ii]tem with id '([^']+)' not found")
+
+
+def parse_unverifiable_encrypted_content(error_text: str) -> tuple[str, str] | None:
+    """Extract the (head, tail) of the ciphertext an upstream rejected."""
+
+    match = _UNVERIFIABLE_CONTENT.search(str(error_text or ""))
+    return (match.group(1), match.group(2)) if match else None
+
+
+def parse_missing_item_id(error_text: str) -> str | None:
+    """Extract the item ID an upstream says it never stored.
+
+    Switching providers mid-session leaves items whose IDs were minted by the
+    router or by another backend. Replaying one draws a 404: ``Item with id
+    'rs_e50d87c9_0' not found. Items are not persisted when 'store' is set to
+    false. Try again with 'store' set to true, or remove this item from your
+    input.`` The upstream names the offending item, so the removal needs no
+    guesswork.
+    """
+
+    match = _MISSING_ITEM.search(str(error_text or ""))
+    return match.group(1) if match else None
+
+
+def _replayed_without_id(item: dict[str, Any]) -> dict[str, Any] | None:
+    """Rebuild one item so it replays inline, or drop it when it carries nothing.
+
+    A reasoning summary has no signature and no conversation content, so it is
+    dropped outright. Everything else — messages, tool calls, tool outputs — is
+    kept with its ID omitted, which preserves the turn's context and the
+    ``call_id`` pairing while removing the reference the upstream rejected.
+    """
+
+    if item.get("type") == "reasoning" and not str(
+        item.get("encrypted_content") or ""
+    ).strip():
+        return None
+    retained = dict(item)
+    retained.pop("id", None)
+    return retained
+
+
+def repair_unstored_items(body: dict[str, Any]) -> tuple[dict[str, Any], int]:
+    """Replay every identified item inline after the upstream refuses one.
+
+    The rejection is not about one unlucky item. ``Items are not persisted when
+    'store' is set to false`` states that the backend resolves no item ID at
+    all, so a session carrying IDs minted elsewhere has as many unknown items
+    as it has replayed ones. Repairing them one verdict at a time costs one
+    round trip each — thousands of them on a long cross-provider session, with
+    nothing reaching the client meanwhile, which reads as a silent freeze.
+    Strip them in a single pass instead, so the turn recovers in one retry and
+    a second rejection of the same kind can find nothing left to repair.
+    """
+
+    items = body.get("input")
+    if not isinstance(items, list):
+        return body, 0
+    repaired: list[Any] = []
+    changed = 0
+    for item in items:
+        if not isinstance(item, dict) or not item.get("id"):
+            repaired.append(item)
+            continue
+        changed += 1
+        replacement = _replayed_without_id(item)
+        if replacement is not None:
+            repaired.append(replacement)
+    if not changed:
+        return body, 0
+    projected = dict(body)
+    projected["input"] = repaired
+    return projected, changed
+
+
+def encrypted_content_digest(encrypted_content: str) -> str:
+    return hashlib.sha256(encrypted_content.encode("utf-8")).hexdigest()
+
+
+class RejectedReasoningStore:
+    """Durable record of ciphertexts the upstream refused to verify."""
+
+    def __init__(self, path: Path, log: Callable[[str, str], Any]) -> None:
+        self._path = path
+        self._log = log
+        self._digests: set[str] | None = None
+
+    def _load(self) -> set[str]:
+        if self._digests is not None:
+            return self._digests
+        digests: set[str] = set()
+        try:
+            recorded = json.loads(self._path.read_text(encoding="utf-8"))
+            entries = recorded.get("sha256") if isinstance(recorded, dict) else None
+            if isinstance(entries, list):
+                digests = {str(entry) for entry in entries}
+        except FileNotFoundError:
+            pass
+        except Exception as exc:
+            self._log(
+                "WARN",
+                f"rejected_reasoning_store_load_failed error={type(exc).__name__}: {exc}",
+            )
+        self._digests = digests
+        return digests
+
+    def contains(self, encrypted_content: str) -> bool:
+        return encrypted_content_digest(encrypted_content) in self._load()
+
+    def add(self, encrypted_content: str) -> None:
+        digests = self._load()
+        digest = encrypted_content_digest(encrypted_content)
+        if digest in digests:
+            return
+        digests.add(digest)
+        try:
+            self._path.parent.mkdir(parents=True, exist_ok=True)
+            self._path.write_text(
+                json.dumps({"version": 1, "sha256": sorted(digests)}),
+                encoding="utf-8",
+            )
+        except Exception as exc:
+            self._log(
+                "WARN",
+                f"rejected_reasoning_store_write_failed error={type(exc).__name__}: {exc}",
+            )
+
+
+def drop_rejected_reasoning(
+    body: dict[str, Any],
+    is_rejected: Callable[[str], bool],
+) -> tuple[dict[str, Any], int]:
+    """Strip reasoning items whose ciphertext the upstream already rejected."""
+
+    items = body.get("input")
+    if not isinstance(items, list):
+        return body, 0
+    kept: list[Any] = []
+    dropped = 0
+    for item in items:
+        if (
+            isinstance(item, dict)
+            and item.get("type") == "reasoning"
+            and isinstance(item.get("encrypted_content"), str)
+            and is_rejected(item["encrypted_content"])
+        ):
+            dropped += 1
+            continue
+        kept.append(item)
+    if not dropped:
+        return body, 0
+    projected = dict(body)
+    projected["input"] = kept
+    return projected, dropped
+
+
+def drop_reasoning_matching_verdict(
+    body: dict[str, Any],
+    head: str,
+    tail: str,
+) -> tuple[dict[str, Any], str | None]:
+    """Drop the reasoning item whose ciphertext the upstream just named."""
+
+    items = body.get("input")
+    if not isinstance(items, list):
+        return body, None
+    for index, item in enumerate(items):
+        if not isinstance(item, dict) or item.get("type") != "reasoning":
+            continue
+        sealed = item.get("encrypted_content")
+        if (
+            isinstance(sealed, str)
+            and sealed.startswith(head)
+            and sealed.endswith(tail)
+        ):
+            projected = dict(body)
+            projected["input"] = items[:index] + items[index + 1 :]
+            return projected, sealed
+    return body, None
+
+
+__all__ = [
+    "RejectedReasoningStore",
+    "drop_rejected_reasoning",
+    "drop_reasoning_matching_verdict",
+    "encrypted_content_digest",
+    "parse_missing_item_id",
+    "parse_unverifiable_encrypted_content",
+    "repair_unstored_items",
+]

package/ciel_runtime_support/codex_router.py

@@ -10,14 +10,24 @@ from .agent_router import COMMON_RUNTIME_ROUTER_CAPABILITIES, RouterCapability
 
 
 CODEX_CAPACITY_ERROR_CODES = frozenset({"server_is_overloaded", "slow_down"})
+# The upstream reports an oversized turn the same way it reports overload: a
+# 200 response whose first events are control-only, ending in response.failed.
+# Retrying it unchanged cannot succeed, so it is classified apart from capacity.
+CODEX_CONTEXT_ERROR_CODES = frozenset({"context_length_exceeded"})
 CODEX_RESPONSE_PREAMBLE_LIMIT = 256 * 1024
-_CODEX_NON_OUTPUT_EVENT_TYPES = frozenset({"response.created", "response.in_progress"})
+# A bare `error` frame carries no model output and precedes response.failed in
+# every captured refusal, so scanning must continue past it rather than treat it
+# as the start of a reply.
+_CODEX_NON_OUTPUT_EVENT_TYPES = frozenset(
+    {"response.created", "response.in_progress", "error"}
+)
 
 
 @dataclass(frozen=True)
 class CodexResponsePreamble:
     payload: bytes
     capacity_error_code: str | None = None
+    context_error_code: str | None = None
 
 
 @dataclass(frozen=True, slots=True)
@@ -86,19 +96,36 @@ def _codex_sse_event(block: bytes) -> dict[str, Any] | None:
     return value if isinstance(value, dict) else None
 
 
-def _codex_capacity_error_code(event: dict[str, Any]) -> str | None:
-    if event.get("type") != "response.failed":
-        return None
-    response = event.get("response")
-    if not isinstance(response, dict):
+def _codex_failure_code(event: dict[str, Any]) -> str | None:
+    """Read the failure code from either shape the upstream uses.
+
+    A refusal arrives as a bare ``error`` frame and again inside the
+    ``response.failed`` frame that follows it; both carry the same code.
+    """
+
+    event_type = event.get("type")
+    if event_type == "error":
+        error = event.get("error")
+    elif event_type == "response.failed":
+        response = event.get("response")
+        error = response.get("error") if isinstance(response, dict) else None
+    else:
         return None
-    error = response.get("error")
     if not isinstance(error, dict):
         return None
-    code = str(error.get("code") or "").strip()
+    return str(error.get("code") or "").strip() or None
+
+
+def _codex_capacity_error_code(event: dict[str, Any]) -> str | None:
+    code = _codex_failure_code(event)
     return code if code in CODEX_CAPACITY_ERROR_CODES else None
 
 
+def _codex_context_error_code(event: dict[str, Any]) -> str | None:
+    code = _codex_failure_code(event)
+    return code if code in CODEX_CONTEXT_ERROR_CODES else None
+
+
 def read_codex_response_preamble(
     stream: Any,
     *,
@@ -137,6 +164,9 @@ def read_codex_response_preamble(
         capacity_code = _codex_capacity_error_code(event)
         if capacity_code:
             return CodexResponsePreamble(bytes(buffered), capacity_code)
+        context_code = _codex_context_error_code(event)
+        if context_code:
+            return CodexResponsePreamble(bytes(buffered), None, context_code)
         if event.get("type") not in _CODEX_NON_OUTPUT_EVENT_TYPES:
             return CodexResponsePreamble(bytes(buffered))
         if reached_eof:

package/ciel_runtime_support/codex_turn_recovery.py

@@ -0,0 +1,154 @@
+"""Keep routed Codex turns alive when a model only announces its intent.
+
+Claude sessions get two safeguards against a model that says "I'll start now"
+and then ends the turn: a compatibility instruction appended at launch, and
+TaskList synthesis in the Anthropic stream. Neither reaches Codex — the launch
+flag is Claude-only and the recovery lives in the Anthropic protocol path — so
+a routed Codex session simply stops. These helpers give the Responses path the
+same protection without synthesizing a tool call the Codex client never offered.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Any, Callable
+
+
+CODEX_CONTINUATION_NUDGE = (
+    "Continue the work you just described in this same turn. Call the tools you "
+    "need now instead of restating the plan, and report the concrete result. Only "
+    "answer without tools when the task genuinely requires no tool use."
+)
+
+
+def message_text(message: dict[str, Any]) -> str:
+    parts: list[str] = []
+    for block in message.get("content") or []:
+        if isinstance(block, dict) and block.get("type") == "text":
+            text = block.get("text")
+            if isinstance(text, str):
+                parts.append(text)
+    return "\n".join(parts)
+
+
+def message_has_tool_use(message: dict[str, Any]) -> bool:
+    return any(
+        isinstance(block, dict) and block.get("type") == "tool_use"
+        for block in message.get("content") or []
+    )
+
+
+def body_with_continuation_nudge(
+    body: dict[str, Any], message: dict[str, Any], nudge: str = CODEX_CONTINUATION_NUDGE
+) -> dict[str, Any]:
+    """Replay the request with the stalled reply and an explicit continue turn."""
+
+    messages = list(body.get("messages") or [])
+    assistant_text = message_text(message).strip()
+    if assistant_text:
+        messages.append({"role": "assistant", "content": [{"type": "text", "text": assistant_text}]})
+    messages.append({"role": "user", "content": [{"type": "text", "text": nudge}]})
+    retried = dict(body)
+    retried["messages"] = messages
+    return retried
+
+
+def body_with_codex_compat_instructions(
+    body: dict[str, Any],
+    compat_prompt: str,
+    *,
+    is_native_codex: bool,
+    compat_enabled: bool,
+) -> dict[str, Any]:
+    """Append the routed Codex compatibility instruction to a Responses request.
+
+    Codex rejects ``--append-system-prompt`` as a Claude-only flag, so the
+    instruction has to travel in the request body. The native Codex backend is
+    excluded: it serves OpenAI's own models, which do not need the nudge, and
+    rewriting instructions there would only invalidate the cached prefix.
+    """
+
+    if not isinstance(body, dict) or is_native_codex or not compat_enabled:
+        return body
+    existing = str(body.get("instructions") or "")
+    if compat_prompt in existing:
+        return body
+    projected = dict(body)
+    projected["instructions"] = (
+        f"{existing.rstrip()}\n\n{compat_prompt}" if existing.strip() else compat_prompt
+    )
+    return projected
+
+
+@dataclass(frozen=True, slots=True)
+class CodexTurnRecoveryServices:
+    should_retry: Callable[[dict[str, Any], str, list[Any]], bool]
+    collect_message: Callable[..., dict[str, Any]]
+    log: Callable[[str, str], Any]
+
+
+def recover_preamble_only_turn(
+    handler: Any,
+    provider: str,
+    pcfg: dict[str, Any],
+    body: dict[str, Any],
+    message: dict[str, Any],
+    services: CodexTurnRecoveryServices,
+) -> dict[str, Any]:
+    """Retry once when the model announced work but called no tool.
+
+    Bounded to a single extra upstream call. The retry only wins if it produces
+    a tool call; prose answers keep the original reply so a model that legitimately
+    responds without tools is never overridden or duplicated.
+    """
+
+    if not isinstance(message, dict) or message_has_tool_use(message):
+        return message
+    text = message_text(message)
+    if not services.should_retry(body, text, []):
+        return message
+
+    services.log(
+        "WARN",
+        f"codex_preamble_only_turn_retry provider={provider} "
+        f"model={str(body.get('model') or '-')} chars={len(text.strip())}",
+    )
+    try:
+        retried = services.collect_message(
+            handler, provider, pcfg, body_with_continuation_nudge(body, message)
+        )
+    except Exception as exc:  # noqa: BLE001 - recovery must never fail the turn
+        services.log(
+            "WARN",
+            f"codex_preamble_only_turn_retry_failed error={type(exc).__name__}: {exc}",
+        )
+        return message
+    if not isinstance(retried, dict) or not message_has_tool_use(retried):
+        return message
+    return _merged(message, retried)
+
+
+def _merged(original: dict[str, Any], retried: dict[str, Any]) -> dict[str, Any]:
+    """Keep the announcement, then the work it promised."""
+
+    preamble = message_text(original).strip()
+    blocks = list(retried.get("content") or [])
+    if preamble:
+        retried_text = re.sub(r"\s+", " ", message_text(retried)).strip()
+        if re.sub(r"\s+", " ", preamble) not in retried_text:
+            blocks = [{"type": "text", "text": preamble}, *blocks]
+    merged = dict(retried)
+    merged["content"] = blocks
+    return merged
+
+
+__all__ = [
+    "CODEX_CONTINUATION_NUDGE",
+    "CodexTurnRecoveryServices",
+    "body_with_codex_compat_instructions",
+    "body_with_continuation_nudge",
+    "message_has_tool_use",
+    "message_text",
+    "recover_preamble_only_turn",
+]