@oneciel-ai/ciel-runtime 0.2.37 → 0.2.39

package/ciel_runtime_support/prompt_compaction.py

@@ -228,12 +228,42 @@ def responses_tail_is_safe(items: list[dict[str, Any]], start: int) -> bool:
     )
 
 
+def responses_stable_checkpoint_start(
+    items: list[dict[str, Any]], start: int, checkpoint_items: int
+) -> int:
+    """Move an omitted-prefix boundary onto a stable, pair-safe checkpoint.
+
+    A Responses cache reuses an exact prefix.  Advancing the ordinary sliding
+    boundary by a few items on every turn regenerates the summary at item zero
+    and invalidates that prefix.  Rounding the boundary forward means appended
+    turns reuse the same summary until they cross the next checkpoint.
+
+    Moving forward is conservative for the wire budget: it summarizes more old
+    input and retains less verbatim history.  The final item is always retained,
+    and a checkpoint never leaves a tool output without its matching call.
+    """
+
+    try:
+        width = max(0, int(checkpoint_items or 0))
+    except (TypeError, ValueError):
+        width = 0
+    if width <= 1 or start <= 0 or start >= len(items):
+        return start
+    checkpoint = ((start + width - 1) // width) * width
+    if checkpoint >= len(items):
+        return start
+    while checkpoint < len(items) and not responses_tail_is_safe(items, checkpoint):
+        checkpoint += 1
+    return checkpoint if checkpoint < len(items) else start
+
+
 def compact_responses_input_for_budget(
     body: dict[str, Any],
     budget_tokens: int,
     *,
     provider: str = "",
     model: str = "",
+    stable_prefix_checkpoint_items: int = 0,
     services: PromptCompactionServices,
 ) -> dict[str, Any]:
     """Fit a Responses ``input`` array inside the target model's budget.
@@ -278,6 +308,9 @@ def compact_responses_input_for_budget(
         tail_start = len(typed) - 1
         while tail_start > 0 and not responses_tail_is_safe(typed, tail_start):
             tail_start -= 1
+    tail_start = responses_stable_checkpoint_start(
+        typed, tail_start, stable_prefix_checkpoint_items
+    )
 
     def projected(omitted: list[dict[str, Any]]) -> dict[str, Any]:
         summary = text.build_summary(
@@ -299,6 +332,12 @@ def compact_responses_input_for_budget(
         if not tail:
             tail = [typed[-1]]
             break
+        next_start = responses_stable_checkpoint_start(
+            typed,
+            len(typed) - len(tail),
+            stable_prefix_checkpoint_items,
+        )
+        tail = typed[next_start:]
         out["input"] = [projected(typed[: len(typed) - len(tail)]), *tail]
     final_tokens = runtime.estimate_tokens(out)
     runtime.log(

package/ciel_runtime_support/provider_files_proxy.py

@@ -0,0 +1,248 @@
+"""Streaming passthrough for provider-native OpenAI Files endpoints."""
+
+from __future__ import annotations
+
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from typing import Any, Callable
+
+
+PROVIDER_FILES_PATH = "/v1/files"
+META_FILE_UPLOAD_MAX_BYTES = 1_073_741_824
+# Multipart boundaries and form fields are transport overhead rather than file
+# bytes.  Leave one MiB for that envelope while Meta enforces the exact 1 GiB
+# file limit upstream.
+META_FILE_UPLOAD_WIRE_MAX_BYTES = META_FILE_UPLOAD_MAX_BYTES + 1_048_576
+FILES_API_PROVIDERS = frozenset({"meta"})
+
+
+def is_provider_files_path(path: str) -> bool:
+    normalized = urllib.parse.urlparse(str(path or "")).path
+    return normalized == PROVIDER_FILES_PATH or normalized.startswith(
+        PROVIDER_FILES_PATH + "/"
+    )
+
+
+class _LengthLimitedReader:
+    """Expose exactly one HTTP request body without waiting for socket EOF."""
+
+    def __init__(self, stream: Any, length: int) -> None:
+        self._stream = stream
+        self._remaining = length
+
+    def read(self, size: int = -1) -> bytes:
+        if self._remaining <= 0:
+            return b""
+        requested = self._remaining if size is None or size < 0 else min(size, self._remaining)
+        data = self._stream.read(requested)
+        if not data and self._remaining:
+            raise EOFError(
+                f"multipart request ended with {self._remaining} bytes unread"
+            )
+        self._remaining -= len(data)
+        return data
+
+
+@dataclass(frozen=True, slots=True)
+class ProviderFilesProxyPorts:
+    current_provider: Callable[[dict[str, Any]], tuple[str, dict[str, Any]]]
+    bridge_enabled: Callable[[dict[str, Any]], bool]
+    bridge_is_request: Callable[[Any, dict[str, Any]], bool]
+    bridge_resolve: Callable[..., Any]
+    upstream_base: Callable[[str, dict[str, Any]], str]
+    join_url: Callable[[str, str], str]
+    headers: Callable[..., dict[str, str]]
+    urlopen: Callable[..., Any]
+    timeout_seconds: Callable[[dict[str, Any]], float]
+    copy_response_headers: Callable[[Any, Any], None]
+    write_json: Callable[..., Any]
+    log: Callable[[str, str], Any] = lambda _level, _message: None
+
+
+class ProviderFilesProxy:
+    """Proxy Meta's Files API without buffering uploads in router memory."""
+
+    def __init__(self, ports: ProviderFilesProxyPorts) -> None:
+        self._ports = ports
+
+    def _route(
+        self, handler: Any, config: dict[str, Any], path: str
+    ) -> tuple[str, dict[str, Any]]:
+        if self._ports.bridge_enabled(config) and self._ports.bridge_is_request(
+            handler, config
+        ):
+            route = self._ports.bridge_resolve(config, handler.headers, {}, path)
+            return route.provider, route.provider_config
+        return self._ports.current_provider(config)
+
+    def _reject(
+        self, handler: Any, status: int, error_type: str, message: str
+    ) -> bool:
+        handler.close_connection = True
+        self._ports.write_json(
+            handler,
+            {
+                "error": {
+                    "message": message,
+                    "type": error_type,
+                    "param": None,
+                    "code": error_type,
+                }
+            },
+            status,
+        )
+        return True
+
+    def _target(
+        self, handler: Any, config: dict[str, Any], path: str
+    ) -> tuple[str, dict[str, Any], str] | None:
+        if not is_provider_files_path(path):
+            return None
+        try:
+            provider, provider_config = self._route(handler, config, path)
+        except ValueError as exc:
+            self._reject(handler, 400, "invalid_request_error", str(exc))
+            return None
+        if provider not in FILES_API_PROVIDERS:
+            self._reject(
+                handler,
+                404,
+                "not_found_error",
+                f"Provider does not expose a native Files API through Ciel Runtime: {provider}",
+            )
+            return None
+        parsed = urllib.parse.urlparse(handler.path)
+        url = self._ports.join_url(
+            self._ports.upstream_base(provider, provider_config), parsed.path
+        )
+        if parsed.query:
+            url += "?" + parsed.query
+        return provider, provider_config, url
+
+    def _relay(
+        self,
+        handler: Any,
+        provider: str,
+        provider_config: dict[str, Any],
+        request: urllib.request.Request,
+    ) -> bool:
+        try:
+            response = self._ports.urlopen(
+                request,
+                timeout=self._ports.timeout_seconds(provider_config),
+                provider=provider,
+                pcfg=provider_config,
+            )
+        except urllib.error.HTTPError as exc:
+            response = exc
+        with response:
+            status = getattr(response, "status", None) or getattr(
+                response, "code", 200
+            )
+            handler.send_response(status)
+            self._ports.copy_response_headers(handler, response.headers)
+            handler.end_headers()
+            while chunk := response.read(65_536):
+                handler.wfile.write(chunk)
+                handler.wfile.flush()
+        return True
+
+    def get(self, handler: Any, path: str, config: dict[str, Any]) -> bool:
+        target = self._target(handler, config, path)
+        if target is None:
+            return is_provider_files_path(path)
+        provider, provider_config, url = target
+        request = urllib.request.Request(
+            url,
+            headers=self._ports.headers(
+                provider, provider_config, handler.headers, "openai_responses"
+            ),
+            method="GET",
+        )
+        return self._relay(handler, provider, provider_config, request)
+
+    def post(
+        self,
+        handler: Any,
+        path: str,
+        content_length: int,
+        content_type: str,
+        config: dict[str, Any],
+    ) -> bool:
+        if not is_provider_files_path(path):
+            return False
+        if path != PROVIDER_FILES_PATH:
+            return self._reject(
+                handler, 404, "not_found_error", f"Unsupported Files API path: {path}"
+            )
+        if "multipart/form-data" not in content_type.casefold():
+            return self._reject(
+                handler,
+                415,
+                "invalid_request_error",
+                "POST /v1/files requires multipart/form-data",
+            )
+        if content_length <= 0 or content_length > META_FILE_UPLOAD_WIRE_MAX_BYTES:
+            return self._reject(
+                handler,
+                413,
+                "request_too_large",
+                "Meta Files API multipart upload exceeds the 1 GiB file limit",
+            )
+        target = self._target(handler, config, path)
+        if target is None:
+            return True
+        provider, provider_config, url = target
+        headers = self._ports.headers(
+            provider, provider_config, handler.headers, "openai_responses"
+        )
+        headers["content-length"] = str(content_length)
+        request = urllib.request.Request(
+            url,
+            data=_LengthLimitedReader(handler.rfile, content_length),
+            headers=headers,
+            method="POST",
+        )
+        # An upstream can reject before consuming the whole body.  Closing the
+        # client connection prevents unread multipart bytes from becoming a
+        # second HTTP request on this socket.
+        handler.close_connection = True
+        self._ports.log(
+            "INFO",
+            f"provider_files_upload provider={provider} bytes={content_length}",
+        )
+        return self._relay(handler, provider, provider_config, request)
+
+    def delete(self, handler: Any, path: str, config: dict[str, Any]) -> bool:
+        target = self._target(handler, config, path)
+        if target is None:
+            return is_provider_files_path(path)
+        if path == PROVIDER_FILES_PATH:
+            return self._reject(
+                handler,
+                405,
+                "invalid_request_error",
+                "DELETE /v1/files requires a file id",
+            )
+        provider, provider_config, url = target
+        request = urllib.request.Request(
+            url,
+            headers=self._ports.headers(
+                provider, provider_config, handler.headers, "openai_responses"
+            ),
+            method="DELETE",
+        )
+        return self._relay(handler, provider, provider_config, request)
+
+
+__all__ = [
+    "FILES_API_PROVIDERS",
+    "META_FILE_UPLOAD_MAX_BYTES",
+    "META_FILE_UPLOAD_WIRE_MAX_BYTES",
+    "PROVIDER_FILES_PATH",
+    "ProviderFilesProxy",
+    "ProviderFilesProxyPorts",
+    "is_provider_files_path",
+]

package/ciel_runtime_support/provider_model_identity.py

@@ -64,9 +64,17 @@ class ProviderModelIdentityService:
         return self.adapters.create(provider).upstream_api_model_id(str(model_id or ""))
 
     def alias_for(self, provider: str, model_id: str) -> str:
-        if self.adapters.create(provider).preserves_claude_model_alias(model_id):
+        adapter = self.adapters.create(provider)
+        if adapter.preserves_claude_model_alias(model_id):
             return model_id
-        return f"ciel-runtime-{provider}-{self.slug(model_id)}"
+        one_million = adapter.preserves_claude_context_suffix_in_alias() and bool(
+            re.search(r"\[1m\]\s*$", str(model_id or ""), re.IGNORECASE)
+        )
+        base_model_id = (
+            self.strip_claude_context_suffix(model_id) if one_million else model_id
+        )
+        alias = f"ciel-runtime-{provider}-{self.slug(base_model_id)}"
+        return f"{alias}[1m]" if one_million else alias
 
     def unslug_alias(
         self,

package/ciel_runtime_support/provider_option_cli.py

@@ -94,7 +94,7 @@ DEFAULT_PROVIDER_NOTES: Mapping[str, Sequence[str]] = {
 }
 DEFAULT_UNSUPPORTED_MESSAGE = (
     "Provider options are available for anthropic, ollama, ollama-cloud, "
-    "deepseek, opencode, opencode-go, kimi, z.ai, fireworks, vllm, "
+    "deepseek, opencode, opencode-go, kimi, meta, z.ai, fireworks, vllm, "
     "lm-studio, nvidia-hosted, self-hosted-nim, and openrouter."
 )
 

package/ciel_runtime_support/provider_request_access.py

@@ -7,7 +7,11 @@ from dataclasses import dataclass
 from typing import Any
 
 from ciel_runtime_support.architecture import MessageProtocol, ProviderRequestPolicy
-from ciel_runtime_support.header_forwarding import project_end_to_end_request_headers
+from ciel_runtime_support.header_forwarding import (
+    CONFIGURED_PROVIDER_CREDENTIAL_HEADERS,
+    HOP_BY_HOP_REQUEST_HEADERS,
+    project_end_to_end_request_headers,
+)
 from ciel_runtime_support.remote_bridge import (
     REMOTE_BRIDGE_CONFIG_MARKER,
     REQUEST_API_KEY_MARKER,
@@ -17,6 +21,9 @@ from ciel_runtime_support.remote_bridge import (
 _HOST_CREDENTIAL_SCOPE_HEADERS = frozenset(
     {"openai-organization", "openai-project"}
 )
+_CONFIGURED_PROTOCOL_HEADER_EXCLUSIONS = (
+    CONFIGURED_PROVIDER_CREDENTIAL_HEADERS | HOP_BY_HOP_REQUEST_HEADERS
+)
 
 
 @dataclass(frozen=True, slots=True)
@@ -46,6 +53,39 @@ class ProviderRequestAccessService:
     ports: ProviderRequestAccessPorts
     effects: ProviderRequestAccessEffects
 
+    @staticmethod
+    def _configured_protocol_headers(
+        config: dict[str, Any], protocol: MessageProtocol | None
+    ) -> dict[str, str]:
+        """Project safe, protocol-specific provider headers from configuration.
+
+        Credentials and connection-owned headers stay under the existing
+        adapter/transport policies.  This hook is for provider protocol
+        switches such as Alibaba's Responses session cache header.
+        """
+
+        if protocol is None:
+            return {}
+        configured = config.get("protocol_headers")
+        if not isinstance(configured, Mapping):
+            return {}
+        selected = configured.get(protocol)
+        if not isinstance(selected, Mapping):
+            return {}
+        projected: dict[str, str] = {}
+        for raw_name, raw_value in selected.items():
+            name = str(raw_name).strip()
+            folded = name.casefold()
+            if (
+                not name
+                or raw_value is None
+                or folded in _CONFIGURED_PROTOCOL_HEADER_EXCLUSIONS
+                or folded.startswith("x-ciel-runtime-")
+            ):
+                continue
+            projected[name] = str(raw_value)
+        return projected
+
     def upstream_model(
         self, provider: str, config: dict[str, Any], model: str
     ) -> str:
@@ -137,6 +177,19 @@ class ProviderRequestAccessService:
                     provider, config, meaningful
                 )
             )
+        configured_protocol_headers = self._configured_protocol_headers(
+            config, protocol
+        )
+        if configured_protocol_headers:
+            configured_names = {
+                name.casefold() for name in configured_protocol_headers
+            }
+            headers = {
+                name: value
+                for name, value in headers.items()
+                if name.casefold() not in configured_names
+            }
+            headers.update(configured_protocol_headers)
         if protocol == "anthropic_messages":
             normalized_names = {
                 str(name).casefold() for name in headers