@oneciel-ai/ciel-runtime 0.2.39 → 0.2.40

package/CHANGELOG.md

@@ -5,6 +5,12 @@ capability, followed by the complete commit ledger merged into each release.
 
 ## Unreleased
 
+## 0.2.40 — 2026-09-07
+
+- Authenticate internal router health checks when the web backend uses a
+  specific LAN address. Preserve the external listener and authentication
+  requirements instead of reporting an authenticated running server as down.
+
 ## 0.2.39 — 2026-09-07
 
 - Fix native Codex startup failing with `invalid transport` when DuckDuckGo or

package/ciel_runtime.py

@@ -3024,6 +3024,7 @@ def router_health() -> dict[str, Any] | None:
     try:
         data = http_json(
             f"{ROUTER_BASE}/health",
+            headers=_ROUTER_ACCESS_POLICY.health_headers(ROUTER_BASE, load_config(), router_external_access_token),
             timeout=router_health_timeout_seconds(),
         )
         return data if isinstance(data, dict) else None

package/ciel_runtime_support/router_access.py

@@ -7,6 +7,7 @@ import json
 import os
 import secrets
 import time
+import urllib.parse
 from collections.abc import Callable, Mapping, MutableMapping
 from dataclasses import dataclass
 from pathlib import Path
@@ -63,6 +64,18 @@ class RouterAccessPolicy:
     parse_env_bool: Callable[[str | None, bool | None], bool | None]
     load_config: Callable[[], dict[str, Any]]
 
+    def health_headers(
+        self, base: str, config: dict[str, Any], token_provider: Callable[[], str],
+    ) -> dict[str, str]:
+        # Specific LAN binds are also used as the internal client address;
+        # those requests must satisfy external authentication just like peers.
+        if is_loopback_address(urllib.parse.urlparse(base).hostname):
+            return {}
+        if not self.administrative_external_access_enabled(config):
+            return {}
+        token = token_provider()
+        return {"Authorization": f"Bearer {token}"} if token else {}
+
     def remote_bridge_enabled(self, config: Mapping[str, Any]) -> bool:
         override = str(
             self.environ.get("CIEL_RUNTIME_REMOTE_BRIDGE") or ""

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.39"
+VERSION = "0.2.40"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/docs/journal/2026/09/07/diagnostics/windows/clipboard-paste-markers.okf

@@ -0,0 +1,18 @@
+title: Remote Windows clipboard paste exposes delimiter-like text
+date: 2026-09-07
+status: investigated; remote cause not established
+observation: User screenshot shows [20~ before a pasted URL and [201~ after it.
+interpretation: Consistent with exposed bracketed-paste delimiters; not evidence of mouse reporting.
+reference: https://github.com/microsoft/terminal/issues/12385
+protocol: Bracketed paste wraps text in ESC[200~ and ESC[201~.
+source_checks:
+  parent_input: windows_conpty._read_input_bytes uses ReadConsoleW then UTF-8 encoding.
+  pump: _pump_input observes draft state then writes input bytes without textual marker replacement.
+  transport: write loops until all bytes have been written to ConPTY.
+verification:
+  command: python -m unittest discover -s tests -p test_windows_conpty.py -v
+  result: 33 tests passed in 0.361s on local Windows.
+  coverage: Includes real ConPTY bracketed-paste/large Korean payload byte integrity and submission tests.
+  limitation: Does not reproduce the remote user's clipboard, outer terminal, or Codex TUI input path.
+next_evidence: Remote machine access or exact terminal/runtime versions and relevant transport startup logs.
+changes: No runtime code changes or deployment; do not strip literal marker-like text from user messages.

package/docs/journal/2026/09/07/diagnostics/windows/web-backend-startup.okf

@@ -0,0 +1,12 @@
+title: Router startup timeout after remote Windows web backend configuration
+date: 2026-09-07
+status: conditional configuration bug reproduced; remote root cause unconfirmed
+evidence:
+  traceback: router_process_lifecycle.start_router_if_needed exhausted 30-second router_up polling.
+  remote_initial: http://10.0.0.238:9683/health returned 401 external authentication required.
+  remote_later: Connection timed out after 3015 milliseconds.
+  source: WebBackendSettings.client_host preserves specific LAN addresses; router_health sends no authentication; RouterAccessPolicy permits unauthenticated loopback only.
+  local_policy_reproduction: client_host=10.0.0.238; LAN health without token allowed=False; loopback health allowed=True.
+limitations: No remote router.log or configured bind host available; startup process crash and bind errors remain possible.
+changes: No runtime configuration or code modified.
+required_evidence: Remote router.log or authenticated backend access after service recovery.

package/docs/journal/2026/09/07/release/stable/0.2.40.okf

@@ -0,0 +1,19 @@
+title: Authenticate LAN-bound managed router health checks
+date: 2026-09-07
+version: 0.2.40
+authorization: User explicitly requested fix and new-version main deployment.
+evidence:
+  remote_log: Listener and client base both use 10.0.0.238:9683.
+  observed_http: Earlier external health request returned 401.
+  source: router_health omitted authentication; non-loopback requests require authentication.
+change:
+  health: Read existing administrative token for non-loopback health checks when administrative external access is enabled.
+  preserved: Bind address, port, global/workspace configuration, external authentication rules, active sessions.
+  secrets: No token generation or token logging in the health probe.
+verification:
+  real_http: Isolated HTTP server with production access policy: missing token fails, correct token makes router_up true, wrong token fails.
+  limitations: Test socket is loopback with simulated LAN peer policy; remote user's final restart not yet verified.
+  targeted: 2 tests passed in 0.513s.
+  runtime: 280 tests passed with 16 skips.
+  static: ruff and py_compile passed.
+deployment: main push triggers full-test npm latest publishing; registry and downloaded artifact checked after publishing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",