@oneciel-ai/ciel-runtime 0.2.46 → 0.2.47

package/CHANGELOG.md

@@ -5,6 +5,16 @@ capability, followed by the complete commit ledger merged into each release.
 
 ## Unreleased
 
+## 0.2.47 — 2026-09-12
+
+- Report non-native upstream authentication failures on Responses routes as
+  HTTP 424 dependency failures, preserving the provider, upstream HTTP 401,
+  error type and message. Prevent Codex from hiding these failures behind an
+  unrelated ChatGPT token refresh. Native OpenAI and router access authentication
+  retain their original HTTP semantics.
+
+## Earlier unreleased changes
+
 - Allow complete transcript records larger than the batch target (separate
   max_record_bytes memory bound, default 16 MiB, configurable up to 64 MiB).
 - Forward structured runtime errors to the shared event stream and display

package/ciel_runtime_support/openai_responses_router.py

@@ -261,6 +261,7 @@ def handle_openai_responses_request(
             stream=stream,
             status=exc.code,
             error_type=_responses_error_type(exc.code),
+            **({"upstream_provider": provider} if exc.code == 401 else {}),
         )
     except UpstreamFailure as exc:
         # The upstream status, type and message were all read before this was
@@ -273,6 +274,7 @@ def handle_openai_responses_request(
             stream=stream,
             status=exc.status_code,
             error_type=exc.anthropic_error_type,
+            **({"upstream_provider": provider} if exc.status_code == 401 else {}),
         )
     except UpstreamStreamReadError as exc:
         core.event_bus.publish(
@@ -467,6 +469,7 @@ def _handle_provider_responses_route(
             stream=bool(body.get("stream", True)),
             status=exc.code,
             error_type=_responses_error_type(exc.code),
+            **({"upstream_provider": provider} if exc.code == 401 else {}),
         )
     except UpstreamFailure as exc:
         delivery.mark_failed(
@@ -478,6 +481,7 @@ def _handle_provider_responses_route(
             stream=bool(body.get("stream", True)),
             status=exc.status_code,
             error_type=exc.anthropic_error_type,
+            **({"upstream_provider": provider} if exc.status_code == 401 else {}),
             response_started=exc.output_started,
             response_id=exc.response_id,
         )

package/ciel_runtime_support/openai_responses_stream.py

@@ -51,26 +51,37 @@ def write_openai_responses_error(
     error_type: str = "api_error",
     response_started: bool = False,
     response_id: str | None = None,
+    upstream_provider: str | None = None,
     services: OpenAIResponsesStreamServices,
 ) -> None:
+    error = {"type": error_type, "message": message}
+    if upstream_provider is not None and status == 401:
+        # The client authenticated to this router; a different credential at
+        # the upstream dependency failed. HTTP 401 here makes Codex refresh
+        # its unrelated OpenAI login, hiding the actual provider failure.
+        error.update(
+            code="upstream_authentication_error",
+            upstream_status=status,
+            upstream_provider=upstream_provider,
+            message=f"Upstream provider {upstream_provider} rejected authentication (HTTP {status}): {message}",
+        )
+        status = 424
+        if not response_started:
+            stream = False
     if response_started:
         failed = {
             "type": "response.failed",
             "response": {
                 "id": str(response_id or "resp_ciel_upstream_failure"),
                 "status": "failed",
-                "error": {
-                    "type": error_type,
-                    "code": error_type,
-                    "message": message,
-                },
+                "error": {"code": error_type, **error},
             },
         }
         handler.wfile.write(b"\n\n")
         _emit(handler, "response.failed", failed)
         handler.wfile.flush()
         return
-    payload = {"type": "error", "error": {"type": error_type, "message": message}}
+    payload = {"type": "error", "error": error}
     if not stream:
         services.write_json(handler, payload, status)
         return

package/ciel_runtime_support/response_stream_context.py

@@ -423,6 +423,7 @@ class ResponseStreamContext:
         error_type: str = "api_error",
         response_started: bool = False,
         response_id: str | None = None,
+        upstream_provider: str | None = None,
     ) -> None:
         self.algorithms.write_openai_error(
             handler,
@@ -432,6 +433,7 @@ class ResponseStreamContext:
             error_type=error_type,
             response_started=response_started,
             response_id=response_id,
+            **({"upstream_provider": upstream_provider} if upstream_provider is not None else {}),
             services=self.openai_responses_stream_services(),
         )
 

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.46"
+VERSION = "0.2.47"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/docs/journal/2026/09/12/releases/auth-boundary/verification.okf

@@ -0,0 +1,16 @@
+title: Responses upstream authentication isolation, 0.2.47
+scope: Non-native upstream HTTP 401 only; native OpenAI and router access policy unchanged.
+implementation:
+  transport: Upstream failure projected to HTTP 424 with JSON even for requested streaming when headers are not sent. Already-started streams emit response.failed without new headers.
+  metadata: error.upstream_status=401, upstream_provider, code=upstream_authentication_error, original error type and original message retained within prefixed message.
+  routes: Translated Responses and provider-native Responses, HTTPError and structured UpstreamFailure. Native Codex route deliberately excluded.
+verification:
+  unit: python -m unittest discover -s tests -p test_openai_responses_stream.py; 9 tests passed.
+  boundary: python -m unittest discover -s tests -p test_responses_provider_auth_boundary.py; native/non-native and raw/structured matrix passed.
+  runtime_binary: codex-cli 0.154.0
+  runtime_harness: Isolated CODEX_HOME, synthetic provider and ChatGPT credentials, loopback server and refresh endpoint; actual production write_openai_responses_error used by server.
+  before: Two /v1/responses attempts followed by /oauth/token; user-visible refresh token revoked error.
+  after: One /v1/responses request with correct synthetic provider key, no /oauth/token; turn.failed displays unexpected status 424 Failed Dependency: Upstream provider diagnostic-provider rejected authentication (HTTP 401): invalid credentials.
+  assertions: Original message present, unrelated refresh message absent, no retry, no OAuth request; PASS.
+  static: Modified-source Ruff checks and documentation metadata checks passed.
+limitations: Does not make an invalid upstream API key valid. Remote Ollama account identity check rejected currently stored key with HTTP 401 invalid credentials. No remote credentials or processes changed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.46",
+  "version": "0.2.47",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",