@oneciel-ai/ciel-runtime 0.2.41 → 0.2.43

package/CHANGELOG.md

@@ -5,6 +5,19 @@ capability, followed by the complete commit ledger merged into each release.
 
 ## Unreleased
 
+## 0.2.43 — 2026-09-08
+
+- Isolate child ConPTY Win32-input and mouse-reporting modes from the parent
+  Windows terminal. Preserve display controls, bracketed paste and Unicode.
+- Explicitly reset Win32-input mode on startup/shutdown and restore the parent
+  console even if closing the pseudo-console fails.
+
+## 0.2.42 — 2026-09-08
+
+- Preserve fragmented OSC palette responses and other VT control strings as
+  complete frames in the Windows input bridge. Prevent RGB palette replies
+  from appearing in the Codex draft; retain literal text and bounded buffering.
+
 ## 0.2.41 — 2026-09-07
 
 - Automatically authenticate Codex model and Ciel MCP requests to LAN-bound

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.41"
+VERSION = "0.2.43"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/terminal_input_frames.py

@@ -6,7 +6,7 @@ from collections.abc import Callable
 
 
 class TerminalInputFrames:
-    """Do not expose a partial CSI to a child's keyboard-event parser.
+    """Do not expose a partial VT sequence to a child's keyboard parser.
 
     A bounded idle timer preserves a standalone Escape key. Nothing is
     stripped or rewritten, including literal text resembling paste markers.
@@ -32,13 +32,24 @@ class TerminalInputFrames:
                         ready.append(byte)
                     continue
                 self.pending.append(byte)
-                # CSI/SS3 sequences end with a final byte; other ESC keys
-                # (including Alt+key) are complete after the next byte.
-                complete = (
-                    len(self.pending) == 2 and byte not in (ord('['), ord('O'))
-                ) or (
-                    len(self.pending) >= 3 and 0x40 <= byte <= 0x7e
-                ) or len(self.pending) >= 64
+                introducer = self.pending[1]
+                # OSC (including palette replies) and other control strings
+                # end at ST, not at their first printable byte. OSC also
+                # accepts BEL. An ESC ending one read may start ST in the next.
+                if introducer in b']PX^_':
+                    complete = (
+                        self.pending.endswith(b'\x1b\\')
+                        or (introducer == ord(']') and byte == 0x07)
+                        or byte in (0x18, 0x1a)  # CAN/SUB cancel the sequence.
+                        or len(self.pending) >= 4096
+                    )
+                else:
+                    # CSI/SS3 final byte, or a two-byte ESC/Alt key.
+                    complete = (
+                        len(self.pending) == 2 and introducer not in b'[O'
+                    ) or (
+                        len(self.pending) >= 3 and 0x40 <= byte <= 0x7e
+                    ) or len(self.pending) >= 64
                 if complete:
                     ready.extend(self.pending)
                     self.pending.clear()

package/ciel_runtime_support/windows_conpty.py

@@ -12,7 +12,10 @@ import time
 from collections.abc import Mapping
 from typing import Any, Callable
 
-from .terminal_platform_io import TERMINAL_INPUT_MODE_RESET
+from .windows_terminal_modes import (
+    WINDOWS_TERMINAL_INPUT_MODE_RESET,
+    WindowsTerminalModeFilter,
+)
 from .terminal_input_frames import TerminalInputFrames
 from .windows_command_line import command_line_for_create_process
 
@@ -435,19 +438,18 @@ class WindowsConPtySession:
             self._input_handle = None
         # Keep the output reader alive while ClosePseudoConsole asks its host
         # to flush and exit. Closing the output pipe first can deadlock conhost.
-        if self._hpc and self._kernel32:
-            self._kernel32.ClosePseudoConsole(self._hpc)
-            self._hpc = None
-        if self._output_thread is not None:
-            self._output_thread.join(timeout=1.0)
-        self._stop.set()
-        # Interactive TUIs enable DEC mouse/focus reporting in the terminal
-        # emulator.  A normal CLI shutdown disables those modes itself, but a
-        # crash leaves Windows Terminal sending sequences such as
-        # ``ESC[<35;29;23M`` into the parent shell on every mouse move.  The
-        # Win32 console-mode restore below cannot clear emulator-owned DEC
-        # state, so reset it explicitly while VT output is still enabled.
-        self._reset_and_restore_parent_console()
+        try:
+            if self._hpc and self._kernel32:
+                self._kernel32.ClosePseudoConsole(self._hpc)
+                self._hpc = None
+            if self._output_thread is not None:
+                self._output_thread.join(timeout=1.0)
+        finally:
+            self._stop.set()
+            # Win32 SetConsoleMode cannot clear emulator-owned DEC state.
+            # Reset even when closing conhost fails, then prevent late output
+            # from re-enabling modes after the parent console is restored.
+            self._reset_and_restore_parent_console()
         if self._output_handle and self._kernel32:
             try:
                 self._kernel32.CloseHandle(self._output_handle)
@@ -459,12 +461,12 @@ class WindowsConPtySession:
             self._process_handle = None
 
     def _reset_parent_terminal_modes(self) -> None:
-        self._write_parent_terminal_modes(TERMINAL_INPUT_MODE_RESET)
+        self._write_parent_terminal_modes(WINDOWS_TERMINAL_INPUT_MODE_RESET)
 
     def _reset_and_restore_parent_console(self) -> None:
         with self._parent_output_lock():
             self._write_parent_terminal_modes_unlocked(
-                TERMINAL_INPUT_MODE_RESET
+                WINDOWS_TERMINAL_INPUT_MODE_RESET
             )
             self._mirror_output = False
             self._restore_parent_console()
@@ -848,6 +850,10 @@ class WindowsConPtySession:
         with self._parent_output_lock():
             if not self._mirror_output:
                 return
+            mode_filter = getattr(self, "_parent_mode_filter", None)
+            if mode_filter is None:
+                mode_filter = self._parent_mode_filter = WindowsTerminalModeFilter()
+            data = mode_filter.feed(data, final=final)
             if self._stdout_console_handle is not None and self._output_decoder is not None:
                 text = self._output_decoder.decode(data, final=final)
                 if text:

package/ciel_runtime_support/windows_terminal_modes.py

@@ -0,0 +1,67 @@
+"""Keep child ConPTY input protocols from taking over the parent terminal."""
+
+from .terminal_platform_io import TERMINAL_INPUT_MODE_RESET
+
+
+WINDOWS_TERMINAL_INPUT_MODE_RESET = TERMINAL_INPUT_MODE_RESET + "\x1b[?9001l"
+
+
+class WindowsTerminalModeFilter:
+    """Filter DECSET at the output boundary, not user text at the input boundary.
+
+    Our parent reader consumes ordinary VT input, not Win32-input-mode records.
+    Mouse reporting is also intentionally disabled on Windows. Display modes,
+    focus events and bracketed paste are preserved. State spans pipe reads;
+    control strings are streamed without buffering their potentially large bodies.
+    """
+
+    _blocked = {9, 1000, 1001, 1002, 1003, 1005, 1006, 1015, 1016, 9001}
+
+    def __init__(self) -> None:
+        self._pending = bytearray()
+        self._string = 0
+        self._string_escape = False
+
+    def feed(self, data: bytes, *, final: bool = False) -> bytes:
+        output = bytearray()
+        for value in data:
+            if self._string:
+                output.append(value)
+                if (self._string_escape and value == 92) or value in (24, 26) or (
+                    self._string == 93 and value == 7
+                ):
+                    self._string = 0
+                self._string_escape = value == 27
+                continue
+            if value == 27:
+                output.extend(self._pending)
+                self._pending[:] = b"\x1b"
+                continue
+            if not self._pending:
+                output.append(value)
+                continue
+            self._pending.append(value)
+            if len(self._pending) == 2:
+                if value in b"]PX^_":
+                    self._string = value
+                    self._string_escape = False
+                if value == 91:
+                    continue
+            elif not (64 <= value <= 126) and value not in (24, 26):
+                if len(self._pending) < 256:
+                    continue
+            output.extend(self._filter_csi(bytes(self._pending)))
+            self._pending.clear()
+        if final:
+            output.extend(self._pending)
+            self._pending.clear()
+        return bytes(output)
+
+    def _filter_csi(self, sequence: bytes) -> bytes:
+        if not sequence.startswith(b"\x1b[?") or not sequence.endswith(b"h"):
+            return sequence
+        parameters = sequence[3:-1].split(b";")
+        if not all(part.isdigit() for part in parameters):
+            return sequence
+        kept = [part for part in parameters if int(part) not in self._blocked]
+        return b"\x1b[?" + b";".join(kept) + b"h" if kept else b""

package/docs/journal/2026/09/08/release/stable/0.2.42.okf

@@ -0,0 +1,18 @@
+title: Windows OSC palette response framing regression
+date: 2026-09-08
+version: 0.2.42
+request: Continue handling user-reported OSC 4 palette strings exposed in console input.
+cause:
+  source: TerminalInputFrames treated ESC ] as a complete two-byte key, forwarding the subsequent OSC body separately.
+  actual_cli_before: Codex rendered 4;0;rgb:0c0c/0c0c/0c0c followed by the test paste.
+change:
+  protocol: Keep OSC, DCS, SOS, PM and APC strings until ST; OSC also accepts BEL; CAN/SUB cancel.
+  safety: Never remove literal text; 4096-byte bound and existing 100ms idle flush retained.
+verification:
+  actual_cli_after: Both palette and paste tests passed; palette text absent and 1660377 still visible. No model prompt submitted.
+  frames: Six tests passed including every control-string split, BEL/ST, plain literal RGB text, bounded malformed strings, standalone Esc and paste.
+  static: Ruff passed.
+reference: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
+limitations: Remote user's terminal not directly manipulated; local real Codex reproduction uses simulated split parent-console reads.
+deployment: Continue main stable release workflow; validate npm artifact after publishing.
+excluded: No Kevin AI Net authentication changes or session restart.

package/docs/journal/2026/09/08/windows/terminal/input-mode-leak.okf

@@ -0,0 +1,33 @@
+# Windows parent-terminal input protocol isolation
+
+## Evidence
+- User screenshot: after Codex exits, cmd receives ESC[9;15;9;0;32;1_ and similar records.
+- Microsoft protocol/issues: https://github.com/microsoft/terminal/issues/19576
+- Double encoded mouse reproduction: https://github.com/microsoft/terminal/issues/17851
+- Prior windows_conpty._mirror_bytes forwarded child DECSET without filtering.
+- Prior TERMINAL_INPUT_MODE_RESET omitted DEC private mode 9001.
+- These establish an output-boundary/cleanup defect, not the remote process crash cause.
+
+## Changes
+- New streaming WindowsTerminalModeFilter blocks child enabling Win32 input mode9001
+  and mouse reporting on the parent terminal; keeps display, paste, focus and Unicode.
+- Parses across read boundaries; streams control strings without accumulating bodies.
+- Parent startup/shutdown reset now includes 9001l; close failure still restores console.
+- User input is not pattern stripped, rewritten, or redirected to router transport.
+
+## Executed verification
+- test_windows_terminal_modes.py: 5/5 passed on native Windows.
+- Real ConPTY child exited7, raw output contained9001h; parent mirror did not;
+  final parent output ended with9001l. Parent output captured, not a real clicked UI.
+- test_windows_conpty.py: 33/33 passed including native transport and resize tests.
+- test_codex_paste_frames.py: 2/2 passed using locally installed actual Codex executable.
+  Split paste and OSC palette replies did not enter the Codex prompt as marker text.
+- test_terminal_input_frames.py: 6/6 passed. Architecture budget: 2/2 passed.
+- Replacing the filter with prior passthrough behavior: same native child test
+  failed exactly once, confirming the regression test detects the original leak.
+- Runtime group: 287 tests, OK (19 skipped); ruff repository check passed.
+
+## Limits
+- Remote Windows Terminal mouse clicks and the reported process crash have not been
+  reproduced directly. Do not report the remote crash as resolved by these tests.
+- This journal contains no authentication tokens or unrelated session content.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",