@oneciel-ai/ciel-runtime 0.2.39 → 0.2.41

package/CHANGELOG.md

@@ -5,6 +5,21 @@ capability, followed by the complete commit ledger merged into each release.
 
 ## Unreleased
 
+## 0.2.41 — 2026-09-07
+
+- Automatically authenticate Codex model and Ciel MCP requests to LAN-bound
+  routers using a separate process-local header. Preserve native OpenAI
+  authorization and strip Ciel credentials before forwarding upstream.
+- Reassemble fragmented Windows console VT input sequences before forwarding
+  them to ConPTY, preventing split paste boundaries from entering the Codex
+  draft as text. Preserve literal text and standalone Escape (100ms idle bound).
+
+## 0.2.40 — 2026-09-07
+
+- Authenticate internal router health checks when the web backend uses a
+  specific LAN address. Preserve the external listener and authentication
+  requirements instead of reporting an authenticated running server as down.
+
 ## 0.2.39 — 2026-09-07
 
 - Fix native Codex startup failing with `invalid transport` when DuckDuckGo or

package/ciel_runtime.py

@@ -3024,6 +3024,7 @@ def router_health() -> dict[str, Any] | None:
     try:
         data = http_json(
             f"{ROUTER_BASE}/health",
+            headers=_ROUTER_ACCESS_POLICY.health_headers(ROUTER_BASE, load_config(), router_external_access_token),
             timeout=router_health_timeout_seconds(),
         )
         return data if isinstance(data, dict) else None

package/ciel_runtime_support/codex_router_auth.py

@@ -0,0 +1,88 @@
+"""Attach router authentication without replacing native OpenAI credentials."""
+import json
+from pathlib import Path
+import re
+from urllib.parse import urlparse
+
+from .router_access import is_loopback_address
+
+CLIENT_TOKEN_ENV = "CIEL_RUNTIME_ROUTER_CLIENT_TOKEN"
+
+
+def authenticated_codex_command(cmd: list[str], env: dict[str, str], router_base: str) -> list[str]:
+    router = urlparse(router_base)
+    targets = []
+    builtin_base = None
+    overrides = {}
+    index = 1
+    while index < len(cmd):
+        argument = cmd[index]
+        index += 1
+        if argument == '--':
+            break
+        if argument in ('-c', '--config') and index < len(cmd):
+            setting = cmd[index]
+            index += 1
+        elif argument.startswith('--config='):
+            setting = argument.split('=', 1)[1]
+        else:
+            continue
+        key, separator, raw = setting.partition('=')
+        if separator:
+            key = key.strip()
+            # Do not attach credentials based on an overridden earlier URL.
+            overrides = {old: value for old, value in overrides.items()
+                         if not old.startswith(key + '.')}
+            overrides[key] = raw
+    for key, raw in overrides.items():
+        if not raw:
+            continue
+        match = re.fullmatch(r"model_providers\.([\w-]+)\.base_url", key)
+        if match:
+            prefix = f"model_providers.{match.group(1)}"
+        elif key == "openai_base_url":
+            prefix = "model_providers.ciel-runtime-native-auth"
+        elif key == "mcp_servers.ciel-runtime-router.url":
+            prefix = "mcp_servers.ciel-runtime-router"
+        else:
+            continue
+        try:
+            url = urlparse(json.loads(raw))
+        except (ValueError, TypeError):
+            continue
+        # These are Ciel's generated local-router routes, not arbitrary
+        # upstream provider URLs. Only authorize this launch's exact origin.
+        if (not is_loopback_address(url.hostname) and url.scheme == router.scheme
+                and url.netloc == router.netloc
+                and url.path.rstrip('/') in ('/v1', '/backend-api/codex', '/ca/mcp')):
+            targets.append(prefix)
+            if key == 'openai_base_url':
+                builtin_base = raw
+    if not targets:
+        return cmd
+    token = str(env.get("CIEL_RUNTIME_ROUTER_EXTERNAL_TOKEN") or "").strip()
+    if not token:
+        state = env.get("CIEL_RUNTIME_STATE_DIR")
+        if state:
+            try:
+                token = (Path(state) / "router-external-token").read_text(encoding="utf-8").strip()
+            except OSError:
+                pass
+    if not token:
+        return cmd
+    env[CLIENT_TOKEN_ENV] = token
+    options = []
+    if builtin_base is not None:
+        # Modern Codex forbids overriding the built-in `openai` table.
+        # Use a per-launch provider retaining native OpenAI authentication.
+        provider = 'ciel-runtime-native-auth'
+        cmd = [f'model_provider="{provider}"' if item == 'model_provider="openai"' else item for item in cmd]
+        for setting in (f'model_provider="{provider}"',
+                        f'model_providers.{provider}.name="Ciel Runtime Codex"',
+                        f'model_providers.{provider}.base_url={builtin_base}',
+                        f'model_providers.{provider}.wire_api="responses"',
+                        f'model_providers.{provider}.requires_openai_auth=true'):
+            options.extend(['-c', setting])
+    for prefix in dict.fromkeys(targets):
+        options.extend(['-c', f'{prefix}.env_http_headers.x-ciel-runtime-token="{CLIENT_TOKEN_ENV}"'])
+    return [cmd[0], *options, *cmd[1:]]

package/ciel_runtime_support/router_access.py

@@ -7,6 +7,7 @@ import json
 import os
 import secrets
 import time
+import urllib.parse
 from collections.abc import Callable, Mapping, MutableMapping
 from dataclasses import dataclass
 from pathlib import Path
@@ -63,6 +64,18 @@ class RouterAccessPolicy:
     parse_env_bool: Callable[[str | None, bool | None], bool | None]
     load_config: Callable[[], dict[str, Any]]
 
+    def health_headers(
+        self, base: str, config: dict[str, Any], token_provider: Callable[[], str],
+    ) -> dict[str, str]:
+        # Specific LAN binds are also used as the internal client address;
+        # those requests must satisfy external authentication just like peers.
+        if is_loopback_address(urllib.parse.urlparse(base).hostname):
+            return {}
+        if not self.administrative_external_access_enabled(config):
+            return {}
+        token = token_provider()
+        return {"Authorization": f"Bearer {token}"} if token else {}
+
     def remote_bridge_enabled(self, config: Mapping[str, Any]) -> bool:
         override = str(
             self.environ.get("CIEL_RUNTIME_REMOTE_BRIDGE") or ""
@@ -188,9 +201,11 @@ class RouterAccessPolicy:
                 and hmac.compare_digest(expected, bridge_expected)
             ):
                 return False
-            return bool(
-                expected and supplied and hmac.compare_digest(expected, supplied)
-            )
+            local_token = str(handler.headers.get("x-ciel-runtime-token") or "").strip()
+            return bool(expected and (
+                (supplied and hmac.compare_digest(expected, supplied))
+                or (local_token and hmac.compare_digest(expected, local_token))
+            ))
         return False
 
 

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.39"
+VERSION = "0.2.41"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/runtime_launch.py

@@ -9,6 +9,7 @@ from dataclasses import dataclass
 
 from ciel_runtime_support.claude_environment import CLAUDE_PROJECTED_ENV_KEYS
 from ciel_runtime_support.managed_tool_injection import should_inject_tool, codex_native_web_tool_overrides
+from ciel_runtime_support.codex_router_auth import authenticated_codex_command
 from ciel_runtime_support.runtime_constants import (
     CLAUDE_SERVER_SIDE_WEB_TOOLS,
     CODEX_RUNTIME_API_KEY_ENV,
@@ -973,6 +974,7 @@ def run_codex(
         if workspace_mcp is not None and workspace_mcp_launch is not None:
             workspace_mcp.finish(workspace_mcp_launch)
         raise
+    cmd = authenticated_codex_command(cmd, env, ROUTER_BASE)
     _log_codex_command_for_diagnostics(cmd, env)
     record_launch_state_for_cwd(
         current_launch_cwd_key(),
@@ -1287,6 +1289,7 @@ def run_codex_app_server(
             print(f"Codex App Server listen: {cmd[cmd.index('--listen') + 1]}", flush=True)
         except Exception:
             pass
+    cmd = authenticated_codex_command(cmd, env, ROUTER_BASE)
     _log_codex_app_server_command_for_diagnostics(cmd, env)
     record_launch_state_for_cwd(
         current_launch_cwd_key(),

package/ciel_runtime_support/terminal_input_frames.py

@@ -0,0 +1,78 @@
+"""Reassemble short VT input sequences across parent-console reads."""
+from __future__ import annotations
+
+import threading
+from collections.abc import Callable
+
+
+class TerminalInputFrames:
+    """Do not expose a partial CSI to a child's keyboard-event parser.
+
+    A bounded idle timer preserves a standalone Escape key. Nothing is
+    stripped or rewritten, including literal text resembling paste markers.
+    """
+
+    def __init__(self, write: Callable[[bytes], None], *, idle_seconds: float = 0.1):
+        self.write = write
+        self.idle_seconds = idle_seconds
+        self.pending = bytearray()
+        self.lock = threading.Lock()
+        self.timer: threading.Timer | None = None
+        self.generation = 0
+
+    def feed(self, data: bytes) -> None:
+        with self.lock:
+            self._cancel()
+            ready = bytearray()
+            for byte in data:
+                if not self.pending:
+                    if byte == 0x1b:
+                        self.pending.append(byte)
+                    else:
+                        ready.append(byte)
+                    continue
+                self.pending.append(byte)
+                # CSI/SS3 sequences end with a final byte; other ESC keys
+                # (including Alt+key) are complete after the next byte.
+                complete = (
+                    len(self.pending) == 2 and byte not in (ord('['), ord('O'))
+                ) or (
+                    len(self.pending) >= 3 and 0x40 <= byte <= 0x7e
+                ) or len(self.pending) >= 64
+                if complete:
+                    ready.extend(self.pending)
+                    self.pending.clear()
+            if ready:
+                self.write(bytes(ready))
+            if self.pending:
+                generation = self.generation
+                self.timer = threading.Timer(self.idle_seconds, self._expire, args=(generation,))
+                self.timer.daemon = True
+                self.timer.start()
+
+    def _cancel(self) -> None:
+        self.generation += 1
+        if self.timer is not None:
+            self.timer.cancel()
+            self.timer = None
+
+    def _expire(self, generation: int) -> None:
+        with self.lock:
+            if generation != self.generation:
+                return
+            self.timer = None
+            self._flush()
+
+    def _flush(self) -> None:
+        if self.pending:
+            data = bytes(self.pending)
+            self.pending.clear()
+            try:
+                self.write(data)
+            except OSError:
+                pass  # Child may have exited while Escape was pending.
+
+    def close(self) -> None:
+        with self.lock:
+            self._cancel()
+            self._flush()

package/ciel_runtime_support/windows_conpty.py

@@ -13,6 +13,7 @@ from collections.abc import Mapping
 from typing import Any, Callable
 
 from .terminal_platform_io import TERMINAL_INPUT_MODE_RESET
+from .terminal_input_frames import TerminalInputFrames
 from .windows_command_line import command_line_for_create_process
 
 
@@ -980,15 +981,19 @@ class WindowsConPtySession:
             self._parent_input_draft = draft
 
     def _pump_input(self) -> None:
-        while not self._stop.is_set():
-            try:
-                data = self._read_input_bytes()
-                if not data:
+        frames = TerminalInputFrames(self.write)
+        try:
+            while not self._stop.is_set():
+                try:
+                    data = self._read_input_bytes()
+                    if not data:
+                        return
+                    self._observe_parent_input(data)
+                    frames.feed(data)
+                except OSError:
                     return
-                self._observe_parent_input(data)
-                self.write(data)
-            except OSError:
-                return
+        finally:
+            frames.close()
 
 
 __all__ = ["WindowsConPtySession", "conpty_enabled"]

package/docs/journal/2026/09/07/diagnostics/windows/clipboard-paste-markers.okf

@@ -0,0 +1,18 @@
+title: Remote Windows clipboard paste exposes delimiter-like text
+date: 2026-09-07
+status: investigated; remote cause not established
+observation: User screenshot shows [20~ before a pasted URL and [201~ after it.
+interpretation: Consistent with exposed bracketed-paste delimiters; not evidence of mouse reporting.
+reference: https://github.com/microsoft/terminal/issues/12385
+protocol: Bracketed paste wraps text in ESC[200~ and ESC[201~.
+source_checks:
+  parent_input: windows_conpty._read_input_bytes uses ReadConsoleW then UTF-8 encoding.
+  pump: _pump_input observes draft state then writes input bytes without textual marker replacement.
+  transport: write loops until all bytes have been written to ConPTY.
+verification:
+  command: python -m unittest discover -s tests -p test_windows_conpty.py -v
+  result: 33 tests passed in 0.361s on local Windows.
+  coverage: Includes real ConPTY bracketed-paste/large Korean payload byte integrity and submission tests.
+  limitation: Does not reproduce the remote user's clipboard, outer terminal, or Codex TUI input path.
+next_evidence: Remote machine access or exact terminal/runtime versions and relevant transport startup logs.
+changes: No runtime code changes or deployment; do not strip literal marker-like text from user messages.

package/docs/journal/2026/09/07/diagnostics/windows/remote-backend-log-access.okf

@@ -0,0 +1,14 @@
+title: Attempt remote web backend log capture for Windows paste-marker issue
+date: 2026-09-07
+target: http://10.0.0.238:9683
+authorization: User requested backend log capture and console/mouse diagnostics.
+request: GET /health without credentials
+response:
+  timestamp: Mon, 07 Sep 2026 18:02:22 GMT
+  status: HTTP/1.0 401 Unauthorized
+  challenge: Bearer realm="ciel-runtime"
+  message: ciel-runtime router external authentication is required.
+conclusion: Backend reachable; administrative authentication required before logs or TUI diagnostics can be retrieved.
+limitation: Remote runtime version, logs, and console state not retrieved; no assertion that paste issue is diagnosed.
+next_requirement: User-provided administrative external access token for this remote backend.
+changes: No remote writes, input injection, configuration changes, or authentication bypass attempted.

package/docs/journal/2026/09/07/diagnostics/windows/remote-console-capture.okf

@@ -0,0 +1,36 @@
+title: Authenticated remote backend console investigation
+date: 2026-09-07
+target: http://10.0.0.238:9683
+credentials: Omitted; user-provided token used only for authenticated requests.
+captures:
+  health:
+    ok: true
+    version: 0.2.40
+    source_fingerprint: 3bc950932f5d1691
+    pid: 21824
+    workspace: c:\users\1347817
+    router_port: 9683
+    instance_id: 9683-a2f58d1342e0
+    active_client_count: 1
+    active_client_pids: [29116]
+    provider: codex
+  chat_health:
+    ok: true
+    base: http://10.0.0.238:9683
+  tui_status:
+    ok: true
+    enabled: true
+    active_count: 0
+    latest_event_id: 0
+    capture_scope: routed runtime traffic
+    excluded: hidden thinking, tool arguments, native traffic that bypasses this router, terminal pixels
+  tui_recent: '{"ok":true,"events":[],"last_id":0,"active":[]}'
+  events_recent: '{"ok":true,"events":[]}'
+source_audit:
+  router_http: Authenticated GET dispatches TUI/events/config/web/chat/runtime APIs; no raw router.log download handler found.
+  tui: Observation API explicitly excludes terminal pixels and native bypass traffic.
+conclusion:
+  confirmed: Remote 0.2.40 is running and reachable on LAN with authentication; one active client recorded.
+  not_confirmed: Clipboard delimiter corruption location, actual ConPTY/fallback selection, mouse state, live terminal input bytes.
+blocker: Existing backend does not expose the raw log and console input/output evidence required for this native-terminal issue.
+remote_changes: None; no input injection, model request, log-level change, or session restart.

package/docs/journal/2026/09/07/diagnostics/windows/web-backend-startup.okf

@@ -0,0 +1,12 @@
+title: Router startup timeout after remote Windows web backend configuration
+date: 2026-09-07
+status: conditional configuration bug reproduced; remote root cause unconfirmed
+evidence:
+  traceback: router_process_lifecycle.start_router_if_needed exhausted 30-second router_up polling.
+  remote_initial: http://10.0.0.238:9683/health returned 401 external authentication required.
+  remote_later: Connection timed out after 3015 milliseconds.
+  source: WebBackendSettings.client_host preserves specific LAN addresses; router_health sends no authentication; RouterAccessPolicy permits unauthenticated loopback only.
+  local_policy_reproduction: client_host=10.0.0.238; LAN health without token allowed=False; loopback health allowed=True.
+limitations: No remote router.log or configured bind host available; startup process crash and bind errors remain possible.
+changes: No runtime configuration or code modified.
+required_evidence: Remote router.log or authenticated backend access after service recovery.

package/docs/journal/2026/09/07/release/stable/0.2.40.okf

@@ -0,0 +1,19 @@
+title: Authenticate LAN-bound managed router health checks
+date: 2026-09-07
+version: 0.2.40
+authorization: User explicitly requested fix and new-version main deployment.
+evidence:
+  remote_log: Listener and client base both use 10.0.0.238:9683.
+  observed_http: Earlier external health request returned 401.
+  source: router_health omitted authentication; non-loopback requests require authentication.
+change:
+  health: Read existing administrative token for non-loopback health checks when administrative external access is enabled.
+  preserved: Bind address, port, global/workspace configuration, external authentication rules, active sessions.
+  secrets: No token generation or token logging in the health probe.
+verification:
+  real_http: Isolated HTTP server with production access policy: missing token fails, correct token makes router_up true, wrong token fails.
+  limitations: Test socket is loopback with simulated LAN peer policy; remote user's final restart not yet verified.
+  targeted: 2 tests passed in 0.513s.
+  runtime: 280 tests passed with 16 skips.
+  static: ruff and py_compile passed.
+deployment: main push triggers full-test npm latest publishing; registry and downloaded artifact checked after publishing.

package/docs/journal/2026/09/07/release/stable/0.2.41.okf

@@ -0,0 +1,26 @@
+title: Codex LAN client authentication and Windows paste framing
+date: 2026-09-07
+version: 0.2.41
+authorization: User requested handling paste corruption and internal Codex router authentication failure; continuing requested main release workflow.
+causes:
+  auth: Previous patch authenticated health only; native model Authorization cannot double as Ciel administrative token.
+  paste_reproduction: Real Windows Codex 0.153.4 rendered [200~1660377[201~ when ESC and remaining delimiter bytes were written 20ms apart.
+changes:
+  auth: Model and builtin Ciel MCP receive x-ciel-runtime-token from process environment, loaded from this instance token repository; no user TOML edits.
+  scope: Exact router origin only; later URL overrides excluded; native OpenAI Authorization retained.
+  upstream: Existing x-ciel-runtime header exclusion verified; router credential not forwarded to OpenAI.
+  builtin: Reserved openai provider uses a per-launch custom provider retaining requires_openai_auth, verified with actual Codex config loader.
+  paste: Frame CSI/SS3 boundaries across parent reads without stripping or rewriting payload; single Escape flushed after 100ms idle.
+verification:
+  actual_codex_paste: Replayed split input through corrected pump; 1660377 visible, neither delimiter visible; no prompt submitted.
+  actual_codex_http: Local test server received Ciel token on MCP and model requests; native Authorization also present on model requests. Server intentionally returns 400 without inference or forwarding.
+  auth_tests: 5 passed, including real CLI and overridden destination protection.
+  conpty: 33 passed.
+  framing: 3 passed, covering every split, Korean, literal marker text, standalone Escape, arrows and F9.
+  runtime_group: 285 passed with 12 skips before additional URL-override test.
+  router_debug: 25 passed.
+  static: Ruff and architecture budget passed.
+limitations:
+  remote: Original mouse gesture on remote machine not directly replayed; reproduced matching corruption with fragmented native Codex input locally.
+  idle: Incomplete sequences exceeding 100ms idle are flushed unchanged to preserve standalone Escape.
+  deployment: Main workflow and published package verification follow commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.39",
+  "version": "0.2.41",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",