@oneciel-ai/ciel-runtime 0.2.2 → 0.2.4

package/ciel_runtime_support/config_migrations.py

@@ -34,6 +34,95 @@ def apply_config_migrations(cfg: dict[str, Any], *, policy: ConfigMigrationPolic
         migrations = {}
         cfg["migrations"] = migrations
 
+    marker = "alibaba_provider_catalogs_20260806"
+    if not migrations.get(marker):
+        providers = cfg.get("providers") if isinstance(cfg.get("providers"), dict) else {}
+        catalogs = {
+            "alicode": (
+                "qwen3.7-plus", "qwen3.6-plus", "kimi-k2.5", "glm-5",
+                "MiniMax-M2.5", "qwen3.5-plus", "qwen3-max-2026-01-23",
+                "qwen3-coder-next", "qwen3-coder-plus", "glm-4.7",
+            ),
+            "alicode-intl": (
+                "qwen3.7-plus", "qwen3.6-plus", "kimi-k2.5", "glm-5",
+                "MiniMax-M2.5", "qwen3.5-plus", "qwen3-max-2026-01-23",
+                "qwen3-coder-next", "qwen3-coder-plus", "glm-4.7",
+            ),
+            "alims-intl": (
+                "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus",
+                "qwen3.6-flash", "qwen3.5-plus", "qwen3-coder-plus",
+                "qwen3-coder-flash", "deepseek-v4-pro", "deepseek-v4-flash",
+                "glm-5.2", "kimi-k2.7-code", "MiniMax-M2.5",
+            ),
+        }
+        for provider_name, models in catalogs.items():
+            pcfg = providers.get(provider_name)
+            if not isinstance(pcfg, dict):
+                continue
+            custom = pcfg.get("custom_models")
+            if not isinstance(custom, list):
+                custom = []
+                pcfg["custom_models"] = custom
+            known = {
+                normalize_model_id(provider_name, str(model))
+                for model in custom
+                if str(model).strip()
+            }
+            for model in models:
+                if normalize_model_id(provider_name, model) not in known:
+                    custom.append(model)
+        migrations[marker] = True
+
+    marker = "alibaba_token_plan_singapore_20260806"
+    if not migrations.get(marker):
+        providers = cfg.get("providers") if isinstance(cfg.get("providers"), dict) else {}
+        pcfg = providers.get("alitoken")
+        if isinstance(pcfg, dict):
+            custom = pcfg.get("custom_models")
+            if not isinstance(custom, list):
+                custom = []
+                pcfg["custom_models"] = custom
+            models = (
+                "qwen3.8-max", "qwen3.7-max", "qwen3.7-plus",
+                "qwen3.6-plus", "qwen3.6-flash", "deepseek-v4-pro",
+                "deepseek-v4-flash", "deepseek-v3.2", "kimi-k2.7-code",
+                "kimi-k2.6", "kimi-k2.5", "glm-5.2", "glm-5.1", "glm-5",
+                "MiniMax-M2.5",
+            )
+            known = {
+                normalize_model_id("alitoken", str(model))
+                for model in custom
+                if str(model).strip()
+            }
+            custom.extend(
+                model
+                for model in models
+                if normalize_model_id("alitoken", model) not in known
+            )
+            pcfg["region"] = "ap-southeast-1"
+        migrations[marker] = True
+
+    marker = "alibaba_native_anthropic_routes_20260806"
+    if not migrations.get(marker):
+        providers = cfg.get("providers") if isinstance(cfg.get("providers"), dict) else {}
+        for provider_name in (
+            "alicode", "alicode-intl", "alims-intl", "alitoken",
+            "alitoken-individual",
+        ):
+            pcfg = providers.get(provider_name)
+            if isinstance(pcfg, dict):
+                pcfg["native_compat"] = True
+        migrations[marker] = True
+
+    marker = "alibaba_token_plan_individual_20260806"
+    if not migrations.get(marker):
+        providers = cfg.get("providers") if isinstance(cfg.get("providers"), dict) else {}
+        pcfg = providers.get("alitoken-individual")
+        if isinstance(pcfg, dict):
+            pcfg["region"] = "ap-southeast-1"
+            pcfg["native_compat"] = True
+        migrations[marker] = True
+
     marker = "ollama_cloud_deepseek_v4_flash_0731_20260803"
     if not migrations.get(marker):
         pcfg = cfg.get("providers", {}).get("ollama-cloud", {})
@@ -329,4 +418,18 @@ def apply_config_migrations(cfg: dict[str, Any], *, policy: ConfigMigrationPolic
                 pcfg["model_profile"] = "kimi-k3-1m"
         migrations[marker] = True
 
+    marker = "kimi_k3_official_max_effort_20260806"
+    if not migrations.get(marker):
+        providers = cfg.get("providers") if isinstance(cfg.get("providers"), dict) else {}
+        pcfg = providers.get("kimi")
+        if isinstance(pcfg, dict):
+            current = normalize_model_id("kimi", str(pcfg.get("current_model") or ""))
+            if (
+                current in {KIMI_K3_MODEL, f"{KIMI_K3_MODEL}[1m]"}
+                and pcfg.get("model_profile") == "kimi-k3-1m"
+                and str(pcfg.get("effort_level") or "").lower() == "high"
+            ):
+                pcfg["effort_level"] = "max"
+        migrations[marker] = True
+
 __all__ = ["ConfigMigrationPolicy", "apply_config_migrations"]

package/ciel_runtime_support/config_repository.py

@@ -26,6 +26,36 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
             "port": 0,
             "tailscale_https": False,
         },
+        "speech": {
+            "asr": {
+                "enabled": False,
+                "base_url": "http://ciel-asr:8000",
+                "endpoint": "/v1/audio/transcriptions",
+                "model": "Qwen/Qwen3-ASR-0.6B",
+                "language": "auto",
+                "api_key": "",
+                "timeout_seconds": 300,
+            },
+            "tts": {
+                "enabled": False,
+                "base_url": "http://ciel-tts:8091",
+                "endpoint": "/v1/audio/speech",
+                "voices_endpoint": "/v1/audio/voices",
+                "model": "OpenMOSS-Team/MOSS-TTS-Nano",
+                "voice": "default",
+                "language": "ko",
+                "response_format": "wav",
+                "speed": 1.0,
+                "auto_speak": False,
+                "api_key": "",
+                "timeout_seconds": 300,
+            },
+            "tailscale": {
+                "enabled": True,
+                "asr_hostname": "ciel-asr",
+                "tts_hostname": "ciel-tts",
+            },
+        },
         "claude_code": {
             "compat_prompt_for_non_anthropic": True,
             "channels": [],

package/ciel_runtime_support/configuration_cli.py

@@ -364,6 +364,44 @@ class ConfigurationCliController:
         return aliases.get(normalized, normalized)
 
 
+@dataclass(frozen=True, slots=True)
+class ConfigurationCliCompatibilityApi:
+    controller: Callable[[], ConfigurationCliController]
+
+    def provider(self, args: Any) -> None:
+        self.controller().provider_command(args.name)
+
+    def base_url(self, args: Any) -> None:
+        self.controller().base_url_command(args.provider, args.url)
+
+    def model(self, args: Any) -> None:
+        self.controller().model_command(args.value)
+
+    def advisor_model(self, args: Any) -> None:
+        self.controller().advisor_model_command(args.value)
+
+    def models(self, args: Any) -> None:
+        self.controller().models_command(args.provider)
+
+    def log_level(self, args: Any) -> None:
+        self.controller().log_level_command(getattr(args, "value", None))
+
+    def language(self, args: Any) -> None:
+        self.controller().language_command(args.value)
+
+    def web_search(self, args: Any) -> None:
+        self.controller().web_search_command(args.value)
+
+    def web_fetch(self, args: Any) -> None:
+        self.controller().web_fetch_command(args.value)
+
+    def portable_provider_menu(self) -> int:
+        return self.controller().portable_provider_menu()
+
+    def portable_language_menu(self) -> int:
+        return self.controller().portable_language_menu()
+
+
 __all__ = [
     "ConfigurationCliConfigPorts",
     "ConfigurationCliController",

package/ciel_runtime_support/context_compaction.py

@@ -38,6 +38,7 @@ class ContextCompactionProjection:
     build_fallback_summary: Callable[..., str]
     build_reduce_prompt: Callable[..., str]
     log: Callable[[str, str], None]
+    apply_ollama_optional: Callable[..., dict[str, Any]]
 
 
 @dataclass(frozen=True)
@@ -69,11 +70,15 @@ def request_context_summary(
                 {"role": "user", "content": prompt},
             ],
             "stream": False,
-            "think": False,
-            "options": {"num_predict": max_tokens},
         }
-        if provider_config.get("keep_alive"):
-            request["keep_alive"] = str(provider_config["keep_alive"])
+        request = services.projection.apply_ollama_optional(
+            request,
+            provider,
+            model,
+            provider_config,
+            {},
+            output_limit=max_tokens,
+        )
         operation = "ollama_chat"
     elif wire == "openai":
         request = {

package/ciel_runtime_support/credential_management.py

@@ -33,6 +33,7 @@ class CredentialPersistencePorts:
     clear_requested: Callable[[Any], bool]
     rotation_name: Callable[[str, dict[str, Any]], str]
     error_text: Callable[[Any], bool] = lambda _value: False
+    plausible: Callable[[Any], bool] = lambda value: bool(str(value or "").strip())
 
 
 @dataclass(frozen=True, slots=True)
@@ -125,6 +126,7 @@ class CredentialManagementService:
     def store_one(self, provider: str, key: str) -> list[str]:
         if self.persistence.clear_requested(key):
             return self.clear(provider)
+        self._reject_invalid_keys([key])
         config = self.persistence.load_config()
         provider_config = config["providers"][provider]
         if self.external.enabled(provider):
@@ -174,6 +176,7 @@ class CredentialManagementService:
             return self.clear(provider)
         if not parsed:
             raise SystemExit("No API keys provided; unchanged.")
+        self._reject_invalid_keys(parsed)
         config = self.persistence.load_config()
         provider_config = config["providers"][provider]
         provider_config["api_key"] = parsed[0]
@@ -215,6 +218,15 @@ class CredentialManagementService:
             return self.store_one(provider, keys[0])
         raise SystemExit("No API key provided; unchanged.")
 
+    def _reject_invalid_keys(self, keys: list[str]) -> None:
+        invalid = [key for key in keys if not self.persistence.plausible(key)]
+        if invalid:
+            raise SystemExit(
+                "Refusing to store an API key with an invalid token shape "
+                f"({len(invalid)} item(s)). Control characters and whitespace "
+                "are not valid inside API keys. Unchanged."
+            )
+
     @staticmethod
     def _snapshot_other_provider_keys(
         providers: dict[str, Any], target_provider: str

package/ciel_runtime_support/credentials.py

@@ -58,6 +58,18 @@ def plausible_api_key(value: Any) -> bool:
     if not _KEY_PLAUSIBLE_RE.match(text):
         return False
     return not looks_like_error_text(text)
+
+
+def transportable_api_key(value: Any) -> bool:
+    """Reject control/whitespace corruption without assuming provider key length."""
+
+    text = str(value or "")
+    return bool(
+        text
+        and text == text.strip()
+        and not looks_like_error_text(text)
+        and not any(character.isspace() or ord(character) < 32 or ord(character) == 127 for character in text)
+    )
 SECRET_TEXT_PATTERNS = (
     re.compile(r"ak_key_[A-Za-z0-9_-]+_secret_[A-Za-z0-9_-]+"),
     re.compile(r"(AINET_API_KEY\s*=\s*)(\S+)", re.IGNORECASE),

package/ciel_runtime_support/github_copilot_oauth.py

@@ -20,8 +20,8 @@ GITHUB_USER_URL = "https://api.github.com/user"
 GITHUB_COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token"
 GITHUB_API_VERSION = "2022-11-28"
 COPILOT_API_VERSION = "2025-04-01"
-COPILOT_VSCODE_VERSION = "1.110.0"
-COPILOT_CHAT_VERSION = "0.38.0"
+COPILOT_VSCODE_VERSION = "1.128.0"
+COPILOT_CHAT_VERSION = "0.43.0"
 COPILOT_USER_AGENT = f"GitHubCopilotChat/{COPILOT_CHAT_VERSION}"
 
 

package/ciel_runtime_support/hosted_formula_tools.py

@@ -0,0 +1,216 @@
+"""Append-only orchestration for provider-hosted Formula tools."""
+
+from __future__ import annotations
+
+import copy
+import json
+import threading
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from typing import Any, Callable, Mapping
+
+from .architecture import HostedToolPolicy
+
+
+@dataclass(frozen=True, slots=True)
+class HostedFormulaState:
+    formula_by_function: Mapping[str, str]
+    headers: Mapping[str, str]
+    policy: HostedToolPolicy
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self.formula_by_function)
+
+
+class HostedFormulaToolService:
+    """Load Formula schemas, execute calls, and append results to chat history."""
+
+    def __init__(
+        self,
+        policy_for: Callable[[str, dict[str, Any]], HostedToolPolicy],
+        log: Callable[[str, str], None],
+        *,
+        open_url: Callable[..., Any] = urllib.request.urlopen,
+        max_rounds: int = 8,
+    ) -> None:
+        self._policy_for = policy_for
+        self._log = log
+        self._open_url = open_url
+        self._max_rounds = max(1, max_rounds)
+        self._cache: dict[tuple[str, str], tuple[dict[str, Any], ...]] = {}
+        self._unavailable: set[str] = set()
+        self._lock = threading.Lock()
+
+    @staticmethod
+    def _auth_headers(headers: Mapping[str, str]) -> dict[str, str]:
+        projected = {"content-type": "application/json"}
+        authorization = headers.get("authorization") or headers.get("Authorization")
+        if authorization:
+            projected["authorization"] = str(authorization)
+        return projected
+
+    def _json_request(
+        self,
+        url: str,
+        headers: Mapping[str, str],
+        *,
+        payload: Mapping[str, Any] | None = None,
+        timeout: float,
+    ) -> dict[str, Any]:
+        data = None if payload is None else json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        request = urllib.request.Request(
+            url,
+            data=data,
+            headers=dict(headers),
+            method="GET" if data is None else "POST",
+        )
+        with self._open_url(request, timeout=timeout) as response:
+            decoded = json.loads(response.read().decode("utf-8", errors="replace"))
+        if not isinstance(decoded, dict):
+            raise RuntimeError("hosted Formula API returned non-object JSON")
+        return decoded
+
+    @staticmethod
+    def _formula_path(formula: str) -> str:
+        return urllib.parse.quote(formula, safe="/:")
+
+    def _tools_for_formula(
+        self,
+        policy: HostedToolPolicy,
+        formula: str,
+        headers: Mapping[str, str],
+        timeout: float,
+    ) -> tuple[dict[str, Any], ...]:
+        cache_key = (policy.base_url, formula)
+        with self._lock:
+            cached = self._cache.get(cache_key)
+        if cached is not None:
+            return cached
+        payload = self._json_request(
+            f"{policy.base_url}/formulas/{self._formula_path(formula)}/tools",
+            headers,
+            timeout=timeout,
+        )
+        tools = tuple(copy.deepcopy(tool) for tool in payload.get("tools", ()) if isinstance(tool, dict))
+        with self._lock:
+            self._cache[cache_key] = tools
+        return tools
+
+    def prepare(
+        self,
+        provider: str,
+        config: dict[str, Any],
+        request_body: dict[str, Any],
+        upstream_headers: Mapping[str, str],
+        timeout: float,
+    ) -> tuple[dict[str, Any], HostedFormulaState]:
+        policy = self._policy_for(provider, config)
+        auth_headers = self._auth_headers(upstream_headers)
+        empty = HostedFormulaState({}, auth_headers, policy)
+        if not policy.base_url or not policy.formulas or "authorization" not in auth_headers:
+            return request_body, empty
+        with self._lock:
+            if policy.base_url in self._unavailable:
+                return request_body, empty
+        timeout = min(max(1.0, timeout), 10.0)
+        existing = list(request_body.get("tools") or [])
+        used_names = {
+            str(tool.get("function", {}).get("name") or "")
+            for tool in existing
+            if isinstance(tool, dict) and isinstance(tool.get("function"), dict)
+        }
+        formula_by_function: dict[str, str] = {}
+        try:
+            for formula in policy.formulas:
+                for tool in self._tools_for_formula(policy, formula, auth_headers, timeout):
+                    function = tool.get("function") if isinstance(tool.get("function"), dict) else {}
+                    name = str(function.get("name") or "")
+                    if not name or name in used_names:
+                        continue
+                    used_names.add(name)
+                    formula_by_function[name] = formula
+                    existing.append(tool)
+        except Exception as exc:
+            with self._lock:
+                self._unavailable.add(policy.base_url)
+            self._log("WARN", f"hosted Formula tools unavailable for {provider}: {type(exc).__name__}: {exc}")
+            return request_body, empty
+        if not formula_by_function:
+            return request_body, empty
+        prepared = {**request_body, "tools": existing, "stream": False}
+        return prepared, HostedFormulaState(formula_by_function, auth_headers, policy)
+
+    def _execute(
+        self,
+        state: HostedFormulaState,
+        function: Mapping[str, Any],
+        timeout: float,
+    ) -> str:
+        name = str(function.get("name") or "")
+        formula = state.formula_by_function[name]
+        payload = self._json_request(
+            f"{state.policy.base_url}/formulas/{self._formula_path(formula)}/fibers",
+            state.headers,
+            payload={"function": {"name": name, "arguments": str(function.get("arguments") or "{}")}},
+            timeout=timeout,
+        )
+        context = payload.get("context") if isinstance(payload.get("context"), dict) else {}
+        output = context.get("output")
+        if output is None:
+            output = context.get("encrypted_output")
+        if isinstance(output, str):
+            return output
+        return json.dumps(output if output is not None else payload, ensure_ascii=False)
+
+    def resolve(
+        self,
+        state: HostedFormulaState,
+        request_body: dict[str, Any],
+        response: dict[str, Any],
+        post_chat: Callable[[dict[str, Any]], dict[str, Any]],
+        timeout: float,
+    ) -> dict[str, Any]:
+        if not state.enabled:
+            return response
+        body = copy.deepcopy(request_body)
+        current = response
+        for _round in range(self._max_rounds):
+            choices = current.get("choices") if isinstance(current, dict) else None
+            choice = choices[0] if isinstance(choices, list) and choices and isinstance(choices[0], dict) else {}
+            message = choice.get("message") if isinstance(choice.get("message"), dict) else {}
+            calls = [call for call in message.get("tool_calls", ()) if isinstance(call, dict)]
+            if not calls:
+                return current
+            functions = [call.get("function") if isinstance(call.get("function"), dict) else {} for call in calls]
+            if any(str(function.get("name") or "") not in state.formula_by_function for function in functions):
+                return current
+            body.setdefault("messages", []).append(copy.deepcopy(message))
+            for call, function in zip(calls, functions):
+                body["messages"].append(
+                    {
+                        "role": "tool",
+                        "tool_call_id": str(call.get("id") or "hosted_tool"),
+                        "content": self._execute(state, function, timeout),
+                    }
+                )
+            body["tool_choice"] = "auto"
+            current = post_chat(body)
+        raise RuntimeError(f"hosted Formula tool loop exceeded {self._max_rounds} rounds")
+
+
+__all__ = ["HostedFormulaState", "HostedFormulaToolService"]
+
+
+_SHARED_SERVICE: HostedFormulaToolService | None = None
+
+
+def shared_service(
+    policy_for: Callable[[str, dict[str, Any]], HostedToolPolicy],
+    log: Callable[[str, str], None],
+) -> HostedFormulaToolService:
+    global _SHARED_SERVICE
+    if _SHARED_SERVICE is None:
+        _SHARED_SERVICE = HostedFormulaToolService(policy_for, log)
+    return _SHARED_SERVICE