@oneciel-ai/ciel-runtime 0.2.38 → 0.2.40

package/CHANGELOG.md

@@ -5,6 +5,19 @@ capability, followed by the complete commit ledger merged into each release.
 
 ## Unreleased
 
+## 0.2.40 — 2026-09-07
+
+- Authenticate internal router health checks when the web backend uses a
+  specific LAN address. Preserve the external listener and authentication
+  requirements instead of reporting an authenticated running server as down.
+
+## 0.2.39 — 2026-09-07
+
+- Fix native Codex startup failing with `invalid transport` when DuckDuckGo or
+  web_fetch is not registered. Inspect the effective workspace configuration
+  before adding process-only disabling overrides; never modify global or
+  workspace TOML. Concurrent non-native sessions retain their MCP settings.
+
 ## 0.2.38 — 2026-09-07
 
 - Disable inherited DuckDuckGo and web_fetch MCP servers with per-launch

package/ciel_runtime.py

@@ -3024,6 +3024,7 @@ def router_health() -> dict[str, Any] | None:
     try:
         data = http_json(
             f"{ROUTER_BASE}/health",
+            headers=_ROUTER_ACCESS_POLICY.health_headers(ROUTER_BASE, load_config(), router_external_access_token),
             timeout=router_health_timeout_seconds(),
         )
         return data if isinstance(data, dict) else None

package/ciel_runtime_support/managed_tool_injection.py

@@ -1,5 +1,10 @@
 """Launch-mode policy for Ciel-owned tools, never user MCP definitions."""
 from collections.abc import Mapping
+import json
+import logging
+from pathlib import Path
+import subprocess
+from subprocess import run as run_codex_config_probe
 from typing import Any
 
 
@@ -9,14 +14,57 @@ def should_inject_tool(*, native: bool, mode: str = "always") -> bool:
     return mode == "always" or (mode == "native") == native
 
 
-def codex_native_web_tool_overrides(*, native: bool) -> list[str]:
+def codex_native_web_tool_overrides(
+    *, native: bool, passthrough: list[str] | None = None,
+    env: dict[str, str] | None = None, cwd: Path | None = None,
+    codex: str = "codex",
+) -> list[str]:
     """Disable inherited replacement web MCPs for this launch, not on disk."""
     if not native:
         return []
-    return [
-        "-c", "mcp_servers.duckduckgo.enabled=false",
-        "-c", "mcp_servers.web_fetch.enabled=false",
-    ]
+    # An enabled-only table is NOT a valid Codex MCP transport, even when
+    # disabled. Never manufacture such a table on a fresh installation.
+    # Ask the same executable to resolve its effective configuration. Merely
+    # scanning project TOML is unsafe: Codex can ignore untrusted projects,
+    # which would turn our enabled override into another transport-less table.
+    # `mcp list` reads configuration; it does not connect to MCP servers.
+    arguments = passthrough or []
+    configuration_args = []
+    index = 0
+    while index < len(arguments):
+        argument = arguments[index]
+        if argument == "--":
+            break
+        if argument in ("-c", "--config", "-p", "--profile", "-C", "--cd") and index + 1 < len(arguments):
+            configuration_args.extend([argument, arguments[index + 1]])
+            index += 1
+        elif argument.startswith(("--config=", "--profile=", "--cd=")):
+            configuration_args.append(argument)
+        index += 1
+    try:
+        completed = run_codex_config_probe(
+            [codex, *configuration_args, "mcp", "list", "--json"],
+            env=env, cwd=cwd, capture_output=True, text=True, encoding="utf-8",
+            errors="replace", timeout=5, check=False,
+        )
+        if completed.returncode != 0:
+            raise ValueError("configuration probe failed")
+        entries = json.loads(completed.stdout)
+        if not isinstance(entries, list):
+            raise ValueError("unexpected MCP list shape")
+    except (OSError, subprocess.TimeoutExpired, ValueError):
+        # Never print probe output: MCP configuration can contain credentials.
+        logging.getLogger(__name__).warning(
+            "Could not inspect Codex MCP configuration; skipping native web MCP overrides"
+        )
+        return []
+    names = {entry.get("name") for entry in entries if isinstance(entry, dict)
+             and isinstance(entry.get("name"), str)}
+    result = []
+    for name in ("duckduckgo", "web_fetch"):
+        if name in names:
+            result.extend(["-c", f"mcp_servers.{name}.enabled=false"])
+    return result
 
 
 def select_managed_tools(

package/ciel_runtime_support/router_access.py

@@ -7,6 +7,7 @@ import json
 import os
 import secrets
 import time
+import urllib.parse
 from collections.abc import Callable, Mapping, MutableMapping
 from dataclasses import dataclass
 from pathlib import Path
@@ -63,6 +64,18 @@ class RouterAccessPolicy:
     parse_env_bool: Callable[[str | None, bool | None], bool | None]
     load_config: Callable[[], dict[str, Any]]
 
+    def health_headers(
+        self, base: str, config: dict[str, Any], token_provider: Callable[[], str],
+    ) -> dict[str, str]:
+        # Specific LAN binds are also used as the internal client address;
+        # those requests must satisfy external authentication just like peers.
+        if is_loopback_address(urllib.parse.urlparse(base).hostname):
+            return {}
+        if not self.administrative_external_access_enabled(config):
+            return {}
+        token = token_provider()
+        return {"Authorization": f"Bearer {token}"} if token else {}
+
     def remote_bridge_enabled(self, config: Mapping[str, Any]) -> bool:
         override = str(
             self.environ.get("CIEL_RUNTIME_REMOTE_BRIDGE") or ""

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.38"
+VERSION = "0.2.40"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/runtime_launch.py

@@ -927,7 +927,11 @@ def run_codex(
     )
     if workspace_mcp_launch is not None:
         codex_mcp_compat_args.extend(workspace_mcp_launch.codex_args)
-    codex_mcp_compat_args.extend(codex_native_web_tool_overrides(native=native_codex_enabled(provider)))
+    codex_mcp_compat_args.extend(codex_native_web_tool_overrides(
+        native=native_codex_enabled(provider),
+        codex=codex,
+        passthrough=[*codex_passthrough, *codex_mcp_compat_args], env=env, cwd=launch_cwd,
+    ))
     codex_yolo_args = codex_yolo_launch_args(codex_passthrough)
     if not use_native_codex and not use_codex_routed:
         env[CODEX_RUNTIME_API_KEY_ENV] = env.get(CODEX_RUNTIME_API_KEY_ENV) or "ciel-runtime-router-local-key"
@@ -1260,7 +1264,11 @@ def run_codex_app_server(
     try:
         if workspace_mcp_launch is not None:
             codex_mcp_compat_args.extend(workspace_mcp_launch.codex_args)
-        codex_mcp_compat_args.extend(codex_native_web_tool_overrides(native=native_codex_enabled(provider)))
+        codex_mcp_compat_args.extend(codex_native_web_tool_overrides(
+            native=native_codex_enabled(provider),
+            codex=codex,
+            passthrough=[*passthrough, *config_args, *codex_mcp_compat_args], env=env, cwd=launch_cwd,
+        ))
         config_args = [*config_args, *codex_mcp_compat_args]
         listen_url = codex_app_server_default_listen_url()
         app_server_args = codex_app_server_launch_args(

package/docs/journal/2026/09/07/diagnostics/windows/clipboard-paste-markers.okf

@@ -0,0 +1,18 @@
+title: Remote Windows clipboard paste exposes delimiter-like text
+date: 2026-09-07
+status: investigated; remote cause not established
+observation: User screenshot shows [20~ before a pasted URL and [201~ after it.
+interpretation: Consistent with exposed bracketed-paste delimiters; not evidence of mouse reporting.
+reference: https://github.com/microsoft/terminal/issues/12385
+protocol: Bracketed paste wraps text in ESC[200~ and ESC[201~.
+source_checks:
+  parent_input: windows_conpty._read_input_bytes uses ReadConsoleW then UTF-8 encoding.
+  pump: _pump_input observes draft state then writes input bytes without textual marker replacement.
+  transport: write loops until all bytes have been written to ConPTY.
+verification:
+  command: python -m unittest discover -s tests -p test_windows_conpty.py -v
+  result: 33 tests passed in 0.361s on local Windows.
+  coverage: Includes real ConPTY bracketed-paste/large Korean payload byte integrity and submission tests.
+  limitation: Does not reproduce the remote user's clipboard, outer terminal, or Codex TUI input path.
+next_evidence: Remote machine access or exact terminal/runtime versions and relevant transport startup logs.
+changes: No runtime code changes or deployment; do not strip literal marker-like text from user messages.

package/docs/journal/2026/09/07/diagnostics/windows/web-backend-startup.okf

@@ -0,0 +1,12 @@
+title: Router startup timeout after remote Windows web backend configuration
+date: 2026-09-07
+status: conditional configuration bug reproduced; remote root cause unconfirmed
+evidence:
+  traceback: router_process_lifecycle.start_router_if_needed exhausted 30-second router_up polling.
+  remote_initial: http://10.0.0.238:9683/health returned 401 external authentication required.
+  remote_later: Connection timed out after 3015 milliseconds.
+  source: WebBackendSettings.client_host preserves specific LAN addresses; router_health sends no authentication; RouterAccessPolicy permits unauthenticated loopback only.
+  local_policy_reproduction: client_host=10.0.0.238; LAN health without token allowed=False; loopback health allowed=True.
+limitations: No remote router.log or configured bind host available; startup process crash and bind errors remain possible.
+changes: No runtime configuration or code modified.
+required_evidence: Remote router.log or authenticated backend access after service recovery.

package/docs/journal/2026/09/07/fixes/codex/native-web-transport.okf

@@ -0,0 +1,39 @@
+title: Codex native web MCP overrides without cross-session configuration writes
+date: 2026-09-07
+status: source fixed and locally verified; not installed or published
+request:
+  symptom: Codex 0.153.4 fails with invalid transport in mcp_servers.duckduckgo.
+  isolation: Do not change global TOML; isolate workspace/provider sessions.
+evidence:
+  reproduction:
+    environment: Real Windows codex-cli 0.153.4 with temporary empty CODEX_HOME.
+    arguments: -c mcp_servers.duckduckgo.enabled=false mcp list --json
+    exit_code: 1
+    stderr: "Error: failed to load bootstrap configuration; invalid transport in mcp_servers.duckduckgo"
+  cause: The unconditional native override creates an enabled-only server table without command or URL when the server is absent.
+  official_documentation: https://learn.chatgpt.com/docs/extend/mcp?surface=cli
+  documented_constraints: STDIO requires command; HTTP requires url; project configuration applies only to trusted projects.
+implementation:
+  discovery: Run the same Codex executable's mcp list --json with the launch environment, cwd, and configuration arguments.
+  isolation: Apply enabled=false only in this process's arguments, only for servers in the effective list; no TOML writes.
+  workspace: Codex resolves workspace trust/configuration itself; no independent TOML parser or global edits.
+  native: Disable existing duckduckgo and web_fetch entries for CLI and app-server launches.
+  nonnative: No discovery process and no disabling overrides.
+  failure_policy: Five-second bounded probe; if unavailable/invalid, log a credential-free warning and skip overrides.
+  limitation: If discovery fails, replacement MCPs may remain enabled; this must not be described as successful suppression.
+verification:
+  real_cli_command: "$env:CIEL_TEST_CODEX_EXE='C:/Users/djlov/AppData/Local/Programs/OpenAI/Codex/bin/codex.exe'; python -m unittest discover -s tests -p test_codex_native_web_cli.py -v"
+  real_cli_output: "Ran 4 tests in 0.667s; OK"
+  real_cli_cases:
+    empty_home: No overrides; mcp list exits 0 instead of invalid transport.
+    concurrent_shared_home_different_workspaces: native false/false; nonnative true/true for duckduckgo/web_fetch.
+    concurrent_shared_home_same_workspace: native false/false; nonnative true/true for duckduckgo/web_fetch.
+    file_integrity: Shared test config SHA256 unchanged; no workspace config created by override logic.
+    project_configuration: Trusted and untrusted project cases match Codex's effective server list; project TOML bytes unchanged.
+    generated_transport: Native disabled; nonnative enabled; no MCP connection needed.
+  policy_tests: "python -m unittest discover -s tests -p test_managed_tool_injection.py -v: Ran 9 tests; OK"
+  runtime_group: "python scripts/run_test_group.py runtime: Ran 280 tests; OK (skipped=12), real CLI checks enabled"
+  static_checks: py_compile successful; ruff All checks passed; git diff --check clean.
+boundaries:
+  unchanged: Real user global/project TOML, active sessions, installation, npm registry, git remotes.
+  tested: Configuration loading and launch argument policy, not a paid model inference or remote user's TUI.

package/docs/journal/2026/09/07/release/stable/0.2.39.okf

@@ -0,0 +1,10 @@
+title: Publish native Codex transport regression fix as stable 0.2.39
+date: 2026-09-07
+authorization: User requested continuing through main branch deployment.
+version: 0.2.39
+scope: Commit verified fix and version increment, push main, verify CI and npm latest package.
+verification_plan:
+  local: Lint, isolated runtime tests, real Codex config-loader regression checks.
+  remote: Publish workflow runs all test groups before publishing.
+  artifact: Download published package and verify runtime version and fixed helper behavior.
+exclusions: No user configuration edits or active session restart.

package/docs/journal/2026/09/07/release/stable/0.2.40.okf

@@ -0,0 +1,19 @@
+title: Authenticate LAN-bound managed router health checks
+date: 2026-09-07
+version: 0.2.40
+authorization: User explicitly requested fix and new-version main deployment.
+evidence:
+  remote_log: Listener and client base both use 10.0.0.238:9683.
+  observed_http: Earlier external health request returned 401.
+  source: router_health omitted authentication; non-loopback requests require authentication.
+change:
+  health: Read existing administrative token for non-loopback health checks when administrative external access is enabled.
+  preserved: Bind address, port, global/workspace configuration, external authentication rules, active sessions.
+  secrets: No token generation or token logging in the health probe.
+verification:
+  real_http: Isolated HTTP server with production access policy: missing token fails, correct token makes router_up true, wrong token fails.
+  limitations: Test socket is loopback with simulated LAN peer policy; remote user's final restart not yet verified.
+  targeted: 2 tests passed in 0.513s.
+  runtime: 280 tests passed with 16 skips.
+  static: ruff and py_compile passed.
+deployment: main push triggers full-test npm latest publishing; registry and downloaded artifact checked after publishing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.38",
+  "version": "0.2.40",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",