@oneciel-ai/ciel-runtime 0.2.26 → 0.2.27

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 This file records stable Ciel Runtime releases. Changes are grouped by user-visible
 capability, followed by the complete commit ledger merged into each release.
 
+## 0.2.27 — 2026-08-24
+
+- Repair Codex startup only when an invalid TOML file contains equivalent MCP
+  `http_headers` in both a legacy child table and a managed inline table;
+  preserve a timestamped backup before the atomic rewrite.
+- Reject a pasted Z.AI authorization-page URL with explicit callback guidance
+  and keep the prelaunch API-key panel alive when OAuth validation fails.
+
 ## 0.2.26 — 2026-08-24
 
 - Added ZCode as a first-class launch client in the interactive menu,

package/ciel_runtime.py

@@ -121,7 +121,7 @@ from ciel_runtime_support.codex_backend_context import CodexBackendChannelPorts,
 from ciel_runtime_support.codex_reasoning_rejects import RejectedReasoningStore
 from ciel_runtime_support.codex_cli import codex_passthrough_args_for_launch, codex_passthrough_has_command, codex_resume_picker_requested, codex_resume_with_session_id
 from ciel_runtime_support.codex_config import codex_alternate_screen_value_from_config_text  # noqa: F401
-from ciel_runtime_support.codex_config import codex_config_paths_for_launch  # noqa: F401 - compatibility export
+from ciel_runtime_support.codex_config import codex_config_paths_for_launch, repair_codex_mcp_header_collisions  # noqa: F401 - compatibility export
 from ciel_runtime_support.codex_config import codex_config_override_keys as _codex_config_override_keys  # noqa: F401
 from ciel_runtime_support.codex_config import toml_scalar_without_comment as _toml_scalar_without_comment  # noqa: F401
 from ciel_runtime_support.codex_config import toml_string
@@ -4890,7 +4890,7 @@ def runtime_launch_context() -> RuntimeLaunchContext:
 
 _RUNTIME_LAUNCH_API = RuntimeLaunchCompatibilityApi(runtime_launch_context)
 launch_claude = SynchronizedLaunch(_RUNTIME_LAUNCH_API.launch_claude, sync_remote_launch_assets, "claude")
-launch_codex = SynchronizedLaunch(_RUNTIME_LAUNCH_API.launch_codex, sync_remote_launch_assets, "codex")
+launch_codex = SynchronizedLaunch(_RUNTIME_LAUNCH_API.launch_codex, sync_remote_launch_assets, "codex", lambda passthrough=None, **_kwargs: repair_codex_mcp_header_collisions(codex_config_paths_for_launch(list(passthrough or [])), report=lambda message: router_log("WARN", message)))
 launch_codex_app_server = SynchronizedLaunch(_RUNTIME_LAUNCH_API.launch_codex_app_server, sync_remote_launch_assets, "codex-app-server")
 launch_agy = SynchronizedLaunch(_RUNTIME_LAUNCH_API.launch_agy, sync_remote_launch_assets, "agy")
 launch_grok = SynchronizedLaunch(launch_grok, sync_remote_launch_assets, "grok")

package/ciel_runtime_support/codex_config.py

@@ -5,7 +5,16 @@ from __future__ import annotations
 import json
 import os
 import re
+import shutil
+import stat
+import time
 from pathlib import Path
+from typing import Any, Callable, Iterable
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # Python 3.10 remains a supported launcher runtime.
+    tomllib = None  # type: ignore[assignment]
 
 
 def toml_string(value: str) -> str:
@@ -124,3 +133,87 @@ def codex_config_paths_for_launch(
         if path not in paths:
             paths.append(path)
     return paths
+
+
+_MCP_PARENT_TABLE = re.compile(
+    r'^\s*\[mcp_servers\.(?P<name>"(?:[^"\\]|\\.)+"|[A-Za-z0-9_-]+)\]\s*(?:#.*)?$'
+)
+_MCP_HEADER_TABLE = re.compile(
+    r'^\s*\[mcp_servers\.(?P<name>"(?:[^"\\]|\\.)+"|[A-Za-z0-9_-]+)\.http_headers\]\s*(?:#.*)?$'
+)
+
+
+def _toml_table_blocks(lines: list[str], pattern: re.Pattern[str]) -> list[tuple[int, int, str, dict[str, Any]]]:
+    blocks: list[tuple[int, int, str, dict[str, Any]]] = []
+    if tomllib is None:
+        return blocks
+    for start, line in enumerate(lines):
+        if pattern.fullmatch(line.rstrip("\r\n")) is None:
+            continue
+        end = next((index for index in range(start + 1, len(lines)) if lines[index].lstrip().startswith("[")), len(lines))
+        try:
+            parsed = tomllib.loads("".join(lines[start:end]))
+            servers = parsed.get("mcp_servers", {})
+            name, server = next(iter(servers.items()))
+        except (ValueError, TypeError, AttributeError, StopIteration):
+            continue
+        if isinstance(server, dict):
+            blocks.append((start, end, str(name), server))
+    return blocks
+
+
+def repair_codex_mcp_header_collisions(
+    paths: Iterable[Path],
+    *,
+    report: Callable[[str], None] | None = None,
+) -> list[Path]:
+    """Repair only identical legacy-table/managed-inline MCP header collisions."""
+
+    repaired: list[Path] = []
+    if tomllib is None:
+        return repaired
+    for path in paths:
+        if not path.is_file() or path.is_symlink():
+            continue
+        try:
+            text = path.read_text(encoding="utf-8")
+            tomllib.loads(text)
+            continue
+        except (OSError, UnicodeError):
+            continue
+        except tomllib.TOMLDecodeError:
+            pass
+        lines = text.splitlines(keepends=True)
+        parents = {
+            name: server.get("http_headers")
+            for _start, _end, name, server in _toml_table_blocks(lines, _MCP_PARENT_TABLE)
+            if isinstance(server.get("http_headers"), dict)
+        }
+        removals: list[tuple[int, int, str]] = []
+        for start, end, name, server in _toml_table_blocks(lines, _MCP_HEADER_TABLE):
+            old_headers = server.get("http_headers")
+            if isinstance(old_headers, dict) and old_headers == parents.get(name):
+                removals.append((start, end, name))
+        if not removals:
+            continue
+        removed_lines = {index for start, end, _name in removals for index in range(start, end)}
+        candidate = "".join(line for index, line in enumerate(lines) if index not in removed_lines)
+        try:
+            tomllib.loads(candidate)
+        except tomllib.TOMLDecodeError:
+            continue
+        backup = path.with_name(f"{path.name}.ciel-mcp-repair-{time.time_ns()}.bak")
+        temporary = path.with_name(f".{path.name}.ciel-mcp-repair-{os.getpid()}.tmp")
+        try:
+            shutil.copy2(path, backup)
+            temporary.write_text(candidate, encoding="utf-8")
+            os.chmod(temporary, stat.S_IMODE(path.stat().st_mode))
+            os.replace(temporary, path)
+        except OSError:
+            temporary.unlink(missing_ok=True)
+            continue
+        repaired.append(path)
+        if report is not None:
+            names = ", ".join(sorted({name for _start, _end, name in removals}))
+            report(f"Repaired duplicate Codex MCP headers in {path} ({names}); backup: {backup}")
+    return repaired

package/ciel_runtime_support/prelaunch.py

@@ -180,6 +180,13 @@ class PrelaunchServices:
     options: PrelaunchOptions
 
 
+def guarded_zai_oauth_action(action: str, operation: Callable[[str], list[str]]) -> list[str]:
+    try:
+        return operation(action)
+    except RuntimeError as exc:
+        return [f"Z.AI OAuth failed: {exc}"]
+
+
 def run_prelaunch_menu(passthrough: list[str] | None = None,
     *,
     services: PrelaunchServices,
@@ -570,8 +577,8 @@ def run_prelaunch_menu(passthrough: list[str] | None = None,
                         panel_rows, panel_values = api_key_panel_rows(provider, pcfg)
                         panel_idx = 0
                     elif value.startswith("zai-oauth-"):
-                        messages = zai_oauth_action(
-                            value.removeprefix("zai-oauth-")
+                        messages = guarded_zai_oauth_action(
+                            value.removeprefix("zai-oauth-"), zai_oauth_action
                         )
                         refresh_checks()
                         cfg = load_config()
@@ -1082,5 +1089,6 @@ __all__ = [
     "PrelaunchSecrets",
     "PrelaunchServices",
     "PrelaunchTerminal",
+    "guarded_zai_oauth_action",
     "run_prelaunch_menu",
 ]

package/ciel_runtime_support/remote_instructions.py

@@ -206,8 +206,11 @@ class SynchronizedLaunch:
     delegate: Callable[..., Any]
     synchronize: Callable[..., Any]
     runtime: str
+    prepare: Callable[..., Any] | None = None
 
     def __call__(self, *args: Any, **kwargs: Any) -> Any:
+        if self.prepare is not None:
+            self.prepare(*args, **kwargs)
         self.synchronize(self.runtime, reason="launch")
         return self.delegate(*args, **kwargs)
 

package/ciel_runtime_support/runtime_constants.py

@@ -87,7 +87,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.26"
+VERSION = "0.2.27"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/zai_oauth.py

@@ -147,6 +147,15 @@ class ZaiOAuthClient:
             raise ZaiOAuthError("Z.AI returned an invalid OAuth callback URL.") from exc
         path = f"/{parsed.path.strip('/')}"
         if parsed.scheme != "zcode" or parsed.netloc != "zai-auth" or path != "/callback":
+            if (
+                parsed.scheme == "https"
+                and parsed.hostname == "chat.z.ai"
+                and path.endswith("/oauth/authorize")
+            ):
+                raise ZaiOAuthError(
+                    "The pasted URL is the authorization page, not the completed callback. "
+                    "Finish authorization and paste the complete zcode://zai-auth/callback URL."
+                )
             raise ZaiOAuthError("Z.AI returned an unexpected OAuth callback target.")
         query = urllib.parse.parse_qs(parsed.query)
         state = str((query.get("state") or [""])[0])

package/docs/journal/2026/08/24/kevin-codex-config-mia-zai-oauth-recovery.okf

@@ -0,0 +1,69 @@
+okf_version: "1.0"
+knowledge:
+  task:
+    id: kevin-codex-config-mia-zai-oauth-recovery-20260824
+    date: "2026-08-24"
+    objective: >-
+      Restore Kevin's Codex startup and prevent Mia's Z.AI OAuth callback input
+      error from terminating the Ciel prelaunch interface.
+    status: validation-in-progress
+
+  evidence:
+    kevin:
+      observed_error: /home/kevin-codex/.codex/config.toml:63:1 duplicate key
+      conflicting_forms:
+        - table: mcp_servers.ai-net.http_headers
+          lines_before_repair: 36-38
+        - inline_key: mcp_servers.ai-net.http_headers
+          line_before_repair: 63
+      comparison:
+        header_names_equal: true
+        header_values_equal: true
+      repaired_config:
+        toml_valid: true
+        codex_mcp_list_exit: 0
+        ciel_runtime_codex_version_exit: 0
+      backup: /home/kevin-codex/.codex/config.toml.ciel-repair-20260824T0555Z.bak
+      attribution: >-
+        The config and AI-Net managed artifacts were written in the same second,
+        but the writer source was not retained; causal attribution is unconfirmed.
+    mia:
+      supplied_input_kind: https authorization page
+      required_input_kind: zcode callback URL
+      source_behavior: >-
+        ZaiOAuthClient rejected the target with ZaiOAuthError and the prelaunch
+        API-key panel invoked the action without a RuntimeError boundary.
+
+  implementation:
+    codex_preflight:
+      scope: all Codex launch paths
+      mutation_gate:
+        - original TOML must be invalid
+        - legacy child-table and managed inline header maps must be identical
+        - candidate TOML must parse successfully
+      recovery: timestamped backup followed by atomic replacement
+      non_matching_invalid_files: unchanged
+    zai_oauth:
+      authorize_page: rejected with completed-callback guidance
+      prelaunch_error: rendered in panel without unwinding the menu
+
+  verification:
+    completed:
+      - Kevin remote TOML candidate parse
+      - Kevin remote config backup and minimal repair
+      - Kevin codex mcp list exit 0
+      - Kevin Ciel-routed Codex version exit 0
+      - focused Codex repair tests
+      - focused Z.AI OAuth tests
+      - focused synchronized-launch tests
+      - Python compilation
+      - focused Ruff validation
+      - full regression suite: 2744 passed and 136 skipped
+      - documentation metadata: 23 Markdown files passed
+      - full Ruff validation
+      - npm package dry run for version 0.2.27
+      - local install reports ciel-runtime 0.2.27
+      - local Ciel-routed Codex version exit 0
+    pending:
+      - main and nightly publication
+      - Kevin and Mia nightly installation verification

package/docs/journal/2026/08/24/zcode-runtime-oauth-windows-paste.okf

@@ -6,7 +6,7 @@ knowledge:
     objective: >-
       Register ZCode as a supported Ciel runtime, share Z.AI OAuth credentials
       across runtime clients, and repair leaked Windows bracketed-paste markers.
-    status: deployment-in-progress
+    status: complete
 
   evidence:
     source_code:
@@ -64,5 +64,20 @@ knowledge:
       - local install to C:/Users/djlov/.local/share/ciel-runtime
       - local launcher reports ciel-runtime 0.2.26
       - local ZCode launch reports zcode-runtime 0.16.3
-    pending:
-      - nightly publication
+    pending: []
+
+  deployment:
+    implementation_commit: 5e461f468ea78f82ac8b1ce531abec4401ee5a51
+    branches: [main, nightly]
+    local_version: 0.2.26
+    npm_latest: 0.2.26
+    npm_nightly: 0.2.26-nightly.20260824-051932.5e461f4
+    workflow_results:
+      main_ci: success
+      main_publish: success
+      nightly_ci: success
+      nightly_publish_and_tarball_verification: success
+    registry_execution:
+      ciel_runtime: 0.2.26
+      zcode_app_cli: 3.8.1-15
+      zcode_runtime: 0.16.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",