agentic-runner 3.12.0__tar.gz → 3.12.2__tar.gz

{agentic_runner-3.12.0 → agentic_runner-3.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.12.0
+Version: 3.12.2
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.12.0 → agentic_runner-3.12.2}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.12.0"
+__version__ = "3.12.2"
 
 __all__ = ["__version__"]

{agentic_runner-3.12.0 → agentic_runner-3.12.2}/src/agentic_runner/cli.py

@@ -158,6 +158,12 @@ def main(argv: Sequence[str] | None = None) -> int:
         action="store_true",
         help="no TLS to Temporal -- a local development server only",
     )
+    install.add_argument(
+        "--acp-cli-kinds",
+        default=None,
+        help="comma-separated cli_kinds served through the pinned ACP bridge (codex_cli, "
+        "claude_code); omitted keeps the previous install's, '' turns ACP off",
+    )
     install.add_argument("--no-start", action="store_true", help="write the agent, do not start")
     install.add_argument("--root", default=None, type=Path, help="state root (default per OS)")
     for service_verb in ("start", "stop"):
@@ -342,6 +348,11 @@ def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
     if not arguments.control_plane:
         print(f"--control-plane (or {CONTROL_PLANE_ENV}) is required", file=sys.stderr)
         return 2
+    try:
+        acp_cli_kinds = _acp_cli_kinds(arguments.acp_cli_kinds, paths)
+    except ValueError as error:
+        print(str(error), file=sys.stderr)
+        return 2
     # Pasted, never a flag: a flag is in the process table for every uid on the box.
     token = os.environ.get(AGENT_TOKEN_ENV, "").strip() or getpass.getpass(
         "Agent Token (yours from /me/runners, or the Organisation Admin's for an "
@@ -354,6 +365,7 @@ def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
         temporal_tls=not arguments.temporal_plaintext,
         path=os.environ.get("PATH", ""),
         install_channel=workstation.install_channel(),
+        acp_cli_kinds=acp_cli_kinds,
     )
     try:
         lines = asyncio.run(
@@ -369,6 +381,15 @@ def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
     return 0
 
 
+def _acp_cli_kinds(flag: str | None, paths: workstation.OrgPaths) -> str:
+    # A reinstall to pick up a new PATH or retry a token must not turn ACP off (QTS-1355).
+    if flag is not None:
+        return workstation.parse_acp_cli_kinds(flag)
+    if not paths.settings_file.is_file():
+        return ""
+    return workstation.WorkstationSettings.load(paths).acp_cli_kinds
+
+
 def _callback(arguments: argparse.Namespace) -> int:
     socket_path = os.environ.get(CALLBACK_SOCKET_ENV, "")
     token = os.environ.get(CALLBACK_TOKEN_ENV, "")

{agentic_runner-3.12.0 → agentic_runner-3.12.2}/src/agentic_runner/workers/acp_runtime.py

@@ -34,7 +34,19 @@ Facts this module stands on (the LA-02 spike, re-read against the pinned bridge
   is refused, and a harness-root ``config.toml`` may hold only ``_CODEX_HARNESS_ROOT_KEYS``
   (LA-19): nothing may load that the Runner did not choose.
 - claude-agent-acp loads the Workspace's settings, hooks, ``.mcp.json`` and ``CLAUDE.md``
-  unless ``session/new`` carries the three options in ``_CLAUDE_SESSION_OPTIONS``.
+  unless ``session/new`` carries the three options in ``_CLAUDE_SESSION_OPTIONS``. The
+  harness root is the Contract's uid's to write, and its ``user`` source is more than
+  ``settings.json``: a skill's or command's ``allowed-tools`` is an allow rule, and an
+  agent, a hook or ``CLAUDE.md`` would steer every later Directive of that Contract. So no
+  setting source loads at all, the ``user`` one included: measured on claude 2.1.280, the
+  harness root's skills, commands, agents, ``CLAUDE.md`` and settings stay out while its
+  ``.credentials.json`` login still signs the requests (LA-12d item 2). The bridge itself
+  still reads the harness root's ``settings.json`` for the initial mode, bypass and model
+  list, so that file may hold only ``_CLAUDE_HARNESS_ROOT_KEYS``.
+- A Claude permission request for an MCP tool names no command. It carries the serving
+  server in ``_meta.claudeCode.mcpServer``, and ``source: "dynamic"`` is a server from the
+  CLI's ``--mcp-config``: the ones ``session/new`` sent, the only ones ``strictMcpConfig``
+  loads. A granted server's tool is allowed (LA-12d item 1).
 
 A ``cli_kind`` with no pinned bridge (local-agents 18) runs the command its Agent Runtime
 Profile names, and only on a Runner whose host pinned that kind's executable in
@@ -187,9 +199,21 @@ _CODEX_HARNESS_ROOT_KEYS: Final[frozenset[str]] = frozenset(
     {"model", "model_reasoning_effort", "model_reasoning_summary", "model_verbosity", "notice"}
 )
 
+# What a harness-root `settings.json` may set: the choices Claude Code writes there itself.
+# The CLI no longer loads it, but the bridge does; `permissions`, `hooks`, `env`,
+# `apiKeyHelper`, `enabledPlugins` and the rest would be the Contract's own file steering it.
+_CLAUDE_HARNESS_ROOT_KEYS: Final[frozenset[str]] = frozenset(
+    {"$schema", "model", "effortLevel", "alwaysThinkingEnabled"}
+)
+# The `mcpServer.source` of a server the CLI got from `--mcp-config`, which is where the
+# bridge puts `session/new`'s servers. A name alone is the config key as authored, so a
+# server from any other source could reuse a granted slug.
+_CLAUDE_SENT_MCP_SOURCE: Final[str] = "dynamic"
+
 _CLAUDE_SESSION_OPTIONS: Final[Mapping[str, object]] = {
-    # The harness root's own settings only: no Workspace settings, hooks or CLAUDE.md.
-    "settingSources": ["user"],
+    # No settings file, hook, skill, command, agent or CLAUDE.md from anywhere, the
+    # Contract's harness root included; the login is not a setting source and still loads.
+    "settingSources": [],
     # Only the servers sent over ACP; never the Workspace's `.mcp.json`.
     "strictMcpConfig": True,
     # Bypass is never offered as a mode, whatever a settings file asks for.
@@ -267,6 +291,7 @@ class _Turn:
     output: list[str] = field(default_factory=list)
     notes: list[str] = field(default_factory=list)
     held: bool = False
+    session_id: str = ""
     usage_windows: tuple[UsageWindow, ...] = ()
 
 
@@ -389,6 +414,10 @@ class AcpRuntime:
             )
             if config_refusal:
                 return refuse("refused: Codex config file", config_refusal)
+        if self._is_claude and harness_root is not None:
+            settings_refusal = _claude_settings_refusal(harness_root)
+            if settings_refusal:
+                return refuse("refused: Claude settings file", settings_refusal)
 
         # The activity refuses this first, with Evidence; checked again where it runs.
         command_refusal = self.acp_command_refusal(request.acp_command)
@@ -539,7 +568,7 @@ class AcpRuntime:
             with recorded_group(process.pid):
                 try:
                     stop_reason, model_usage, error = await asyncio.wait_for(
-                        self._turn(connection, request, workspace_path, extra_env),
+                        self._turn(connection, request, workspace_path, extra_env, turn),
                         timeout=self._timeout_seconds,
                     )
                 finally:
@@ -551,6 +580,17 @@ class AcpRuntime:
             await terminate_process_tree(process)
             raise
         stderr = await stderr_task
+        if self._is_codex and turn.session_id:
+            # After the bridge exited, so Codex has flushed the rollout, and before the
+            # api_key attempt root holding it is removed.
+            codex_home = Path(env[ACP_BRIDGES["codex_cli"].config_root_env])
+            total = await asyncio.to_thread(
+                _codex_rollout_usage, codex_home, turn.session_id, model_usage
+            )
+            if total is None:
+                turn.notes.append("usage: the bridge's last model call only; no rollout total")
+            else:
+                model_usage = total
         return stop_reason, model_usage, stderr, error
 
     async def _turn(
@@ -559,6 +599,7 @@ class AcpRuntime:
         request: DirectiveRequest,
         workspace_path: Path,
         extra_env: Mapping[str, str],
+        turn: _Turn,
     ) -> tuple[str, tuple[ModelUsage, ...], str]:
         try:
             await connection.request(
@@ -584,7 +625,7 @@ class AcpRuntime:
                     }
                 }
             session = await connection.request("session/new", session_params)
-            session_id = str(session.get("sessionId") or "")
+            session_id = turn.session_id = str(session.get("sessionId") or "")
             if self._is_claude and _offers_mode(session, _CLAUDE_MODE):
                 await connection.request(
                     "session/set_mode", {"sessionId": session_id, "modeId": _CLAUDE_MODE}
@@ -625,19 +666,22 @@ class AcpRuntime:
         turn: _Turn,
     ) -> Mapping[str, Any]:
         tool_call = params.get("toolCall") or {}
-        raw_input = tool_call.get("rawInput") if isinstance(tool_call, Mapping) else None
-        argv, cwd = _requested_command(raw_input, workspace_path)
-        described = (
-            shlex.join(argv)
-            if argv
-            else str(tool_call.get("title") or "an action")
-            if isinstance(tool_call, Mapping)
-            else "an action"
+        title = str(tool_call.get("title") or "") if isinstance(tool_call, Mapping) else ""
+        mcp_server = (
+            _granted_mcp_server(tool_call, request.mcp_servers or ()) if self._is_claude else None
         )
-        described = _redact(described)
-        # The Directive's own Workspace, not WORKSPACE_ROOT: without a Contract uid nothing
-        # else keeps an allowlisted command out of another Work Record's Workspace.
-        verdict, reason = _verdict(argv, cwd, request, workspace_path)
+        if mcp_server is not None:
+            # Checked first: an MCP tool's arguments are not a command, even one named so.
+            described = _redact(f"{title} (MCP server {mcp_server})")
+            verdict, reason = _Verdict.ALLOW, "a granted MCP server's tool"
+        else:
+            raw_input = tool_call.get("rawInput") if isinstance(tool_call, Mapping) else None
+            argv, cwd = _requested_command(raw_input, workspace_path)
+            described = _redact(shlex.join(argv) if argv else title or "an action")
+            # The Directive's own Workspace, not WORKSPACE_ROOT: without a Contract uid
+            # nothing else keeps an allowlisted command out of another Work Record's
+            # Workspace.
+            verdict, reason = _verdict(argv, cwd, request, workspace_path)
         options = params.get("options") or []
         if verdict == _Verdict.ALLOW:
             turn.notes.append(f"permission allowed: {described}")
@@ -879,6 +923,44 @@ def _codex_config_refusal(workspace_path: Path, harness_root: Path | None) -> st
     return None
 
 
+def _claude_settings_refusal(harness_root: Path) -> str | None:
+    """Why the harness root's ``settings.json`` refuses a Claude Directive, or None.
+
+    As ``_codex_config_refusal``: the key names, never the path, reach the control plane.
+    """
+
+    try:
+        text = (harness_root / "settings.json").read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return None
+    except OSError:
+        return "the harness root's settings.json cannot be read"
+    try:
+        settings = json.loads(text)
+    except ValueError:
+        return "the harness root's settings.json does not parse"
+    if not isinstance(settings, dict):
+        return "the harness root's settings.json is not an object"
+    unexpected = sorted(set(settings) - _CLAUDE_HARNESS_ROOT_KEYS)
+    if unexpected:
+        return f"the harness root's settings.json sets {', '.join(unexpected)}; remove them"
+    return None
+
+
+def _granted_mcp_server(tool_call: object, granted: Sequence[McpServerEntry]) -> str | None:
+    """The granted server a Claude permission request's MCP tool is served by, or None."""
+
+    if not isinstance(tool_call, Mapping):
+        return None
+    meta = tool_call.get("_meta")
+    claude = meta.get("claudeCode") if isinstance(meta, Mapping) else None
+    server = claude.get("mcpServer") if isinstance(claude, Mapping) else None
+    if not isinstance(server, Mapping) or server.get("source") != _CLAUDE_SENT_MCP_SOURCE:
+        return None
+    name = server.get("name")
+    return name if isinstance(name, str) and name in {e.slug for e in granted} else None
+
+
 @contextlib.contextmanager
 def _attempt_codex_home(
     proxy_url: str, harness_root: Path, sandbox: DirectiveSandbox | None
@@ -1034,6 +1116,62 @@ def _model_usage(response: Mapping[str, Any]) -> tuple[ModelUsage, ...]:
     return tuple(usage)
 
 
+def _codex_rollout_usage(
+    codex_home: Path, session_id: str, reported: tuple[ModelUsage, ...]
+) -> tuple[ModelUsage, ...] | None:
+    """The whole turn's usage from the Codex thread's rollout, or None if it has none.
+
+    codex-acp 2.1.1 reports ``tokenUsage.last`` -- the turn's last model call -- as the
+    prompt response's ``model_usage`` (LA-12d item 4). One Directive is one session with
+    one turn, so the thread's ``total_token_usage`` is that turn's. The ACP session id is
+    the Codex thread id, which names the rollout file.
+    """
+
+    # The id goes into a glob, and a subscription harness root keeps other Directives'
+    # rollouts: anything but a thread id could match, and meter, one of theirs.
+    try:
+        uuid.UUID(session_id)
+    except ValueError:
+        return None
+    total: Mapping[str, Any] | None = None
+    model = reported[0].model if reported else None
+    try:
+        for path in (codex_home / "sessions").rglob(f"rollout-*-{session_id}.jsonl"):
+            with path.open(encoding="utf-8") as rollout:
+                for line in rollout:
+                    try:
+                        entry = json.loads(line)
+                    except ValueError:
+                        continue
+                    payload = entry.get("payload") if isinstance(entry, dict) else None
+                    if not isinstance(payload, dict):
+                        continue
+                    if entry.get("type") == "turn_context" and isinstance(
+                        payload.get("model"), str
+                    ):
+                        model = model or payload["model"]
+                    info = payload.get("info") if payload.get("type") == "token_count" else None
+                    usage = info.get("total_token_usage") if isinstance(info, dict) else None
+                    if isinstance(usage, dict):
+                        total = usage
+    except OSError:
+        return None
+    if total is None or model is None:
+        return None
+    cached = _count(total, "cached_input_tokens")
+    return (
+        ModelUsage(
+            model=model,
+            # Net of the cached part, as the bridge's own count is.
+            input_tokens=max(_count(total, "input_tokens") - cached, 0),
+            output_tokens=_count(total, "output_tokens"),
+            cached_read_tokens=cached,
+            cached_write_tokens=_count(total, "cache_write_input_tokens"),
+            reasoning_output_tokens=_count(total, "reasoning_output_tokens"),
+        ),
+    )
+
+
 def _count(values: Mapping[str, Any], key: str) -> int:
     value = values.get(key)
     return int(value) if isinstance(value, int | float) and not isinstance(value, bool) else 0

{agentic_runner-3.12.0 → agentic_runner-3.12.2}/src/agentic_runner/workers/settings.py

@@ -137,7 +137,9 @@ class WorkerSettings(BaseSettings):
         default="",
         description=(
             "Comma-separated cli_kinds (`codex_cli`, `claude_code`) this Runner serves through "
-            "the pinned ACP bridge instead of the per-CLI runtime (local-agents 12)."
+            "the pinned ACP bridge instead of the per-CLI runtime (local-agents 12). Never "
+            "`codex_cli` on a Runner pod: its bwrap sandbox cannot start under the default "
+            "seccomp profile (LA-12d item 3)."
         ),
     )
     ACP_PROFILE_CLI_KINDS: str = Field(

{agentic_runner-3.12.0 → agentic_runner-3.12.2}/src/agentic_runner/workstation.py

@@ -50,6 +50,7 @@ from agentic_runner.host_store import open_workstation_store
 from agentic_runner.lifecycle import LifecycleOutbox
 from agentic_runner.registration import load_state
 from agentic_runner.service import HEARTBEAT_STAMP_NAME, PIDFILE_NAME
+from agentic_runner.workers.acp_runtime import ACP_BRIDGES
 from agentic_runner_contracts.runner_registration import (
     CliVersion,
     EgressPosture,
@@ -75,6 +76,7 @@ __all__ = [
     "install",
     "install_channel",
     "locate_clis",
+    "parse_acp_cli_kinds",
     "require_any_cli",
     "run_environment",
     "run_process",
@@ -204,6 +206,9 @@ class WorkstationSettings(BaseModel):
     # would not find a Homebrew or `~/.local/bin` CLI without it.
     path: str
     install_channel: InstallChannel
+    # The Runner's `ACP_CLI_KINDS`, kept here rather than hand-added to the login agent,
+    # which every `install` rewrites (QTS-1355).
+    acp_cli_kinds: str = ""
 
     def save(self, paths: OrgPaths) -> None:
         paths.settings_file.write_text(self.model_dump_json(indent=2), encoding="utf-8")
@@ -218,6 +223,23 @@ class WorkstationSettings(BaseModel):
         return cls.model_validate_json(paths.settings_file.read_text(encoding="utf-8"))
 
 
+def parse_acp_cli_kinds(value: str) -> str:
+    """``--acp-cli-kinds``, refused if it names a kind with no pinned bridge.
+
+    The Runner itself drops such a kind without a word, so a typo here would turn ACP off
+    as quietly as the rewritten login agent did (QTS-1355).
+    """
+
+    kinds = [kind.strip() for kind in value.split(",") if kind.strip()]
+    unknown = sorted(set(kinds) - ACP_BRIDGES.keys())
+    if unknown:
+        raise ValueError(
+            f"--acp-cli-kinds names {', '.join(unknown)}; a pinned ACP bridge exists only for "
+            f"{', '.join(sorted(ACP_BRIDGES))}"
+        )
+    return ",".join(dict.fromkeys(kinds))
+
+
 def install_channel(
     platform: str = sys.platform, *, executable: str = sys.executable
 ) -> InstallChannel:
@@ -235,7 +257,7 @@ def run_environment(paths: OrgPaths, settings: WorkstationSettings) -> dict[str,
     a unit, a task -- stays a one-liner, and the three OSes cannot drift apart.
     """
 
-    return {
+    environment = {
         "PATH": settings.path,
         "AGENTIC_RUNNER_STATE_DIR": str(paths.state_dir),
         "AGENTIC_RUNNER_WORKSPACE_ROOT": str(paths.workspaces),
@@ -254,6 +276,11 @@ def run_environment(paths: OrgPaths, settings: WorkstationSettings) -> dict[str,
         # port inherited from a pod-style environment would collide on the second one.
         service.READINESS_PORT_ENV: "0",
     }
+    # Only when set: a login agent hand-edited with `ACP_CLI_KINDS` before QTS-1355 keeps
+    # ACP on across an upgrade until its next `install`.
+    if settings.acp_cli_kinds:
+        environment["ACP_CLI_KINDS"] = settings.acp_cli_kinds
+    return environment
 
 
 # ------------------------------------------------------------------ the CLIs