agentic-runner 3.13.0__tar.gz → 3.14.0__tar.gz

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.13.0
+Version: 3.14.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.13.0"
+__version__ = "3.14.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/cli.py

@@ -15,6 +15,10 @@ the Organisation's cap.
 Runner (PRD issue 47, ``workstation.py``): one login agent per Organisation, managed by
 the user who hosts it, with no ``sudo`` anywhere.
 
+``sign-in --contract <id>`` signs one Contract's Claude Code in with Anthropic's own flow,
+in this terminal, as that Contract's uid in its harness root (QTS-1448). No code or token
+passes through the control plane.
+
 ``skill install | print`` hands the setup skill to the person's own Claude Code or Codex
 (``skill.py``, console-v2 issue 21).
 
@@ -36,6 +40,7 @@ import os
 import sys
 from collections.abc import Sequence
 from pathlib import Path
+from uuid import UUID
 
 from agentic_runner import __version__ as runner_version
 from agentic_runner import service, skill, workstation
@@ -59,6 +64,7 @@ from agentic_runner.service import (
     TAGS_ENV,
     parse_tags,
 )
+from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN, SIGN_IN_METHODS
 from agentic_runner_contracts import __version__ as contracts_version
 from agentic_runner_contracts.runner_registration import (
     HostAttestation,
@@ -198,6 +204,21 @@ def main(argv: Sequence[str] | None = None) -> int:
     status.add_argument("org", nargs="?", help="a workstation Organisation (issue 47)")
     status.add_argument("--root", default=None, type=Path)
 
+    sign_in = subcommands.add_parser(
+        "sign-in",
+        help="sign a Contract's Claude Code in with Anthropic's own flow, in this terminal",
+    )
+    sign_in.add_argument("--contract", required=True, help="the Contract's id")
+    sign_in.add_argument(
+        "--method",
+        default=OAUTH_TOKEN,
+        choices=SIGN_IN_METHODS,
+        help="oauth_token: a long-lived token (claude setup-token); claude_ai: a Claude.ai "
+        "login (claude auth login --claudeai)",
+    )
+    sign_in.add_argument("--org", default=None, help="a workstation Organisation (issue 47)")
+    sign_in.add_argument("--root", default=None, type=Path, help=argparse.SUPPRESS)
+
     annotate = subcommands.add_parser("annotate", help="attach an annotation to this Work Record")
     annotate.add_argument("--context", default="default")
     annotate.add_argument(
@@ -303,6 +324,8 @@ def main(argv: Sequence[str] | None = None) -> int:
         for line in lines:
             print(line)
         return 0
+    if arguments.command == "sign-in":
+        return _sign_in(arguments)
     if arguments.command == "skill":
         if arguments.action == "print":
             sys.stdout.write(skill.text())
@@ -366,6 +389,26 @@ def _image_attestation() -> HostAttestation:
     )
 
 
+def _sign_in(arguments: argparse.Namespace) -> int:
+    try:
+        contract_id = str(UUID(arguments.contract))
+    except ValueError:
+        print(f"--contract expects a Contract id, got {arguments.contract!r}", file=sys.stderr)
+        return 2
+    if not (os.isatty(0) and os.isatty(1)):
+        print(
+            "sign-in is interactive: run it in a terminal (`kubectl exec -it`, `docker exec -it`)",
+            file=sys.stderr,
+        )
+        return 2
+    if arguments.org:
+        paths = _org_paths(arguments)
+        os.environ.update(
+            workstation.run_environment(paths, workstation.WorkstationSettings.load(paths))
+        )
+    return asyncio.run(service.sign_in_claude(contract_id, method=arguments.method))
+
+
 def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
     if not arguments.control_plane:
         print(f"--control-plane (or {CONTROL_PLANE_ENV}) is required", file=sys.stderr)

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/device_login_activities.py

@@ -14,7 +14,6 @@ from temporalio import activity
 from temporalio.exceptions import ApplicationError
 
 from agentic_runner.auth_mode import SHARED_RUNNER_SIGN_IN_RULE, is_shared_runner
-from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import ContractIsolation
 from agentic_runner_contracts.activity_io import (
@@ -37,8 +36,9 @@ class ContractDeviceLoginActivities:
         host_party: str | None = None,
     ) -> None:
         self._contract_isolation = contract_isolation
-        # The party this process was registered as hosted by. A shared Runner signs in only
-        # a Claude Code long-lived token (local-agents 04, amended by 21).
+        # The party this process was registered as hosted by. A shared Runner starts no
+        # device login and reports only Claude Code's sign-in (local-agents 04, amended by
+        # 21); a person signs Claude Code in on the Runner itself (QTS-1448).
         self._host_party = host_party
         # Injectable for tests; None falls through to the real vendor CLIs.
         self._device_login = device_login or ContractDeviceLogin(contract_isolation)
@@ -53,12 +53,9 @@ class ContractDeviceLoginActivities:
     async def sign_in_contract_device_login(
         self, request: ContractDeviceLoginInput
     ) -> ContractDeviceLoginResult:
-        long_lived = request.runtime_kind == "claude_code" and (request.method or OAUTH_TOKEN) == (
-            OAUTH_TOKEN
-        )
-        self._refuse_on_shared_runner(allow=long_lived)
+        self._refuse_on_shared_runner()
         prompt = await self._device_login.sign_in(
-            request.contract_id, runtime_kind=request.runtime_kind, method=request.method
+            request.contract_id, runtime_kind=request.runtime_kind
         )
         return ContractDeviceLoginResult(
             contract_id=prompt.contract_id,
@@ -66,7 +63,6 @@ class ContractDeviceLoginActivities:
             verification_uri=prompt.verification_uri,
             user_code=prompt.user_code,
             expires_at=prompt.expires_at.isoformat(),
-            sign_in_id=prompt.sign_in_id,
         )
 
     @activity.defn(name="check_contract_device_login_status")
@@ -107,7 +103,7 @@ class ContractDeviceLoginActivities:
         on here, so the failure the platform's sign-in workflow receives names it.
 
         Only a Runner known to be the person's own signs in, except that a shared Runner
-        may make (``allow``) a Claude Code long-lived token (local-agents 21). One whose
+        may report (``allow``) a Claude Code long-lived token (local-agents 21). One whose
         state names no host party (registered before issue 42) is refused either way, as
         `choose_auth_mode` never runs a subscription on it."""
 

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/sealed_box.py

@@ -63,7 +63,6 @@ from agentic_runner_contracts.sealed_credential import (
     SEAL_DOMAIN,
     OpenedCredential,
     SealedCredential,
-    SealedSignInCode,
     delivery_binding,
     key_fingerprint,
 )
@@ -554,20 +553,10 @@ class SealedCredentialStream:
         if not self._awaiting:
             self._keys.retire_previous()
 
-    def open_sign_in_code(self, sealed: SealedSignInCode) -> str | None:
-        """A relayed sign-in code, or None when it does not open (local-agents 05).
-
-        Opened with the same Recipient Key as a slot, but never held: the caller types it
-        into the waiting CLI and drops it.
-        """
-
-        return self._open_with(sealed.recipient_key_id, sealed.binding(), sealed.ciphertext)
-
     def open_oauth_code(self, sealed: SealedOAuthCode) -> str | None:
         """A relayed OAuth code, or None when it does not open (console-v2 issue 30).
 
-        Never held, like a sign-in code: the caller spends it on the token endpoint and
-        drops it.
+        Never held: the caller spends it on the token endpoint and drops it.
         """
 
         return self._open_with(sealed.recipient_key_id, sealed.binding(), sealed.ciphertext)

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/service.py

@@ -24,6 +24,7 @@ import logging
 import os
 import shutil
 import signal
+import sys
 import tempfile
 import time
 from collections.abc import Awaitable, Callable, Mapping, Sequence
@@ -34,6 +35,7 @@ from typing import Any, Protocol
 from uuid import UUID
 
 import httpx
+from pydantic import ValidationError
 from temporalio import activity
 from temporalio.client import Client
 from temporalio.worker import (
@@ -110,7 +112,7 @@ from agentic_runner.user_sources import ProxyTriage, UserSourcePoller
 from agentic_runner.workers.acp_runtime import ACP_BRIDGES, AcpRuntime, profile_acp_executables
 from agentic_runner.workers.agent_runtime import AgentRuntime
 from agentic_runner.workers.claude_runtime import ClaudeRuntime
-from agentic_runner.workers.claude_sign_in import ClaudeSignIns
+from agentic_runner.workers.claude_sign_in import ClaudeSignInError, ClaudeSignIns
 from agentic_runner.workers.codex_runtime import CodexRuntime
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import UID_MAP_FILENAME, ContractIsolation
@@ -135,11 +137,7 @@ from agentic_runner_contracts.runner_registration import (
     ResourcePressure,
 )
 from agentic_runner_contracts.runtime_context import WorkerRuntimeContextResolver
-from agentic_runner_contracts.sealed_credential import (
-    SignInCodeOutcome,
-    SignInCodeRelay,
-    key_fingerprint,
-)
+from agentic_runner_contracts.sealed_credential import key_fingerprint
 
 __all__ = [
     "AGENT_TOKEN_ENV",
@@ -166,6 +164,7 @@ __all__ = [
     "run",
     "run_runner_lifecycle_hook",
     "run_worker_until_terminated",
+    "sign_in_claude",
     "with_profile_acp_cli_kinds",
 ]
 
@@ -657,13 +656,8 @@ class ControlPlaneStream:
     usage_windows: UsageWindows | None = None
     # Local-agents 04b: which delivered references fill the LLM proxy's slot, and where.
     llm_slots: Mapping[str, LlmProvider] = field(default_factory=lambda: dict(LLM_SLOT_REFERENCES))
-    # Local-agents 05: the Claude Code sign-ins a relayed code is typed into.
-    sign_ins: ClaudeSignIns | None = None
     # Console-v2 issue 30: the OAuth Connectors whose code, tokens and verifier stay here.
     oauth: OAuthConnectors | None = None
-    # Reported once, on the beat after the relay: a lost beat loses the outcome, and the
-    # console's own wait on the sign-in is what tells the person.
-    _sign_in_outcomes: list[SignInCodeRelay] = field(default_factory=list)
     _delivered: set[tuple[str, str]] = field(default_factory=set)
     _offered_to_proxy: dict[tuple[str, str], str] = field(default_factory=dict)
     _last_seen: tuple[float, datetime] | None = None
@@ -773,17 +767,14 @@ class ControlPlaneStream:
             clock_skew_seconds=self._clock_skew(now),
             source_status=self.sources.statuses() if self.sources is not None else [],
             tool_servers=self.tool_servers.latest() if self.tool_servers is not None else [],
-            sign_in_codes=self._sign_in_outcomes,
             oauth_authorizations=self.oauth.take_authorizations() if self.oauth else [],
             oauth_tokens=self.oauth.uploads() if self.oauth else [],
             oauth_outcomes=self.oauth.take_outcomes() if self.oauth else [],
         )
-        self._sign_in_outcomes = []
         ack = await self.client.heartbeat(self.state, envelope)
         if self.sources is not None:
             self.sources.assign(ack.user_sources)
         await self._deliver_transcripts(ack)
-        await self._relay_sign_in_codes(ack)
         if self.oauth is not None:
             # Before the sealed values are applied: a Disconnect revokes with the tokens
             # this Runner holds, and the same ack may already have withdrawn their ciphertext.
@@ -836,28 +827,6 @@ class ControlPlaneStream:
                     "transcript %s could not be delivered: %s", request.request_id, error
                 )
 
-    async def _relay_sign_in_codes(self, ack: HeartbeatAck) -> None:
-        """Type each relayed code into the sign-in it names (local-agents 05).
-
-        The code is opened, written to that sign-in's PTY and dropped here; nothing logs
-        it and only its outcome travels back.
-        """
-
-        for sealed in ack.sign_in_codes:
-            code = self.sealed.open_sign_in_code(sealed)
-            if code is None:
-                outcome = SignInCodeOutcome.UNOPENABLE
-            elif self.sign_ins is None:
-                outcome = SignInCodeOutcome.UNKNOWN
-            else:
-                outcome = await self.sign_ins.relay(
-                    str(sealed.contract_id), sealed.sign_in_id, code
-                )
-            del code
-            self._sign_in_outcomes.append(
-                SignInCodeRelay(sign_in_id=sealed.sign_in_id, outcome=outcome)
-            )
-
     def _sync_delivered(self) -> None:
         """The resolver holds exactly what the last ack let this installation open."""
 
@@ -1021,6 +990,42 @@ async def run(
         await readiness.close()
 
 
+async def sign_in_claude(contract_id: str, *, method: str) -> int:
+    """``agentic-runner sign-in``: Claude Code's own flow for one Contract, in this terminal.
+
+    Runs with the Runner's environment (``kubectl exec``, or ``--org`` on a workstation),
+    so the Contract gets the uid and the harness root its Directives already run under.
+    Nothing reaches the control plane: the console only reads the outcome back through
+    ``claude auth status`` (QTS-1448).
+    """
+
+    mode = isolation_mode()
+    can = can_separate_uids()
+    try:
+        require_isolation_supported(mode, can_separate_uids=can)
+    except RunnerRegistrationError as error:
+        print(f"refusing to sign in ({error.reason}): {error}", file=sys.stderr)
+        return 1
+    control_plane = os.environ.get(CONTROL_PLANE_ENV, "").strip()
+    if control_plane:
+        os.environ.setdefault("INTERNAL_FASTAPI_BASE_URL", control_plane)
+    try:
+        settings = get_worker_settings()
+    except ValidationError:
+        print(
+            "refusing to sign in: run this with the Runner's environment "
+            "(`--org <org>` on a workstation, `kubectl exec` into the Runner's pod)",
+            file=sys.stderr,
+        )
+        return 2
+    sign_ins = ClaudeSignIns(build_contract_isolation(settings, can_separate_uids=can))
+    try:
+        return await sign_ins.sign_in(contract_id, method=method)
+    except ClaudeSignInError as error:
+        print(f"sign-in failed: {error}", file=sys.stderr)
+        return 1
+
+
 async def _serve(
     *,
     config: RunnerConfig,
@@ -1157,7 +1162,6 @@ async def _serve_registered(
     messages = MessageStore(state_dir / MESSAGES_DIR)
     stream.messages = messages
     sign_ins = ClaudeSignIns(build_contract_isolation(settings, can_separate_uids=can_change_uid))
-    stream.sign_ins = sign_ins
     stream.oauth = OAuthConnectors(
         sealed=stream.sealed, provider=HttpOAuthProvider(), credentials=credentials
     )
@@ -1243,7 +1247,6 @@ async def _serve_registered(
                 task.cancel()
                 with contextlib.suppress(asyncio.CancelledError):
                     await task
-            await sign_ins.close()
             await run_runner_lifecycle_hook(hooks, HookName.RUNNER_SHUTDOWN)
             await _report_stop(link, lifecycle)
     return 1 if revoked.is_set() else 0

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/skills/agentic-runner-setup/SKILL.md

@@ -120,11 +120,14 @@ whose LLM key or subscription the Agents spend. Ask which of the two the Contrac
   For Docker and Kubernetes the value is delivered from the console, sealed to the Runner:
   https://github.com/qtsone/agentic-runner/blob/main/docs/helm.md#the-recipient-key.
 - **A Codex or Claude Code subscription.** This works only on a Runner the person hosts
-  themselves. Send them to the Contract's page in the console and its **Connect** button:
-  the console opens the vendor's sign-in in their browser and the Runner finishes it. See
+  themselves. For Codex, send them to the Contract's page in the console and its
+  **Connect** button. For Claude Code, ask the person to run, in their own terminal, the
+  sign-in line for their way of installing: `agentic-runner sign-in --org <org> --contract
+  <contract-id>` on this machine, or the `docker exec -it` / `kubectl exec -it` line in
+  docker.md or helm.md. See
   https://github.com/qtsone/agentic-runner/blob/main/docs/workstation.md#sign-in-to-codex-and-claude-code.
-  You have no sign-in of your own to run, and you do not run `codex login` or
-  `claude auth login`.
+  The sign-in is the person's own, with their own Anthropic account: you never run it, and
+  you do not run `codex login` or `claude auth login`.
 
 ### 5. Wait for the Runner to come online
 

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/workers/claude_sign_in.py

@@ -1,4 +1,9 @@
-"""Claude Code's in-place sign-in for one Contract (local-agents 05, PRD decision 13).
+"""Claude Code's sign-in for one Contract, run by the person on the Runner (QTS-1448).
+
+``agentic-runner sign-in`` runs Anthropic's own CLI flow, unmodified, as the Contract's
+uid in its harness root and attached to the caller's terminal. No sign-in code, token or
+session passes through the control plane: the QTS-1349 decision (controls 1 and 5)
+retired the sealed sign-in-code relay local-agents 05 built here.
 
 Two methods, both made in the Contract's own harness root and neither ever delivered:
 
@@ -9,14 +14,9 @@ Two methods, both made in the Contract's own harness root and neither ever deliv
 * ``claude_ai``: ``claude auth login --claudeai``, a refreshing login the CLI keeps itself
   -- ``.credentials.json`` on Linux, a Keychain item on macOS.
 
-Both are interactive paste-code flows with no device code (claude 2.1.295: S256 PKCE, the
-CLI waits at "Paste code here if prompted >"), so the CLI runs on a pseudo-terminal and
-the code the browser shows the person comes back sealed on the heartbeat ack
-(:meth:`ClaudeSignIns.relay`). The PKCE verifier never leaves the CLI's process, so the
-code alone signs nobody in.
-
-A waiting sign-in is the one thing here held in the Runner's process: the PTY is the only
-way to reach the CLI. A restart closes it and the CLI exits; the person starts again.
+The CLI runs on a pseudo-terminal this process relays to the caller's own, byte for byte:
+``setup-token`` prints the token to its terminal and nowhere else, so the relay is the
+only way to read it. The person sees and types exactly what the CLI shows and reads.
 
 macOS (the 2026-10-08 spike): Claude saves a ``claude_ai`` login with the ``security`` CLI
 into the default keychain of the ``HOME`` it is given, and a Contract's sandbox ``HOME``
@@ -31,7 +31,6 @@ import asyncio
 import contextlib
 import fcntl
 import json
-import logging
 import os
 import pty
 import re
@@ -40,15 +39,14 @@ import signal
 import struct
 import sys
 import termios
-from collections.abc import Callable, Sequence
-from dataclasses import dataclass, field
-from datetime import UTC, datetime, timedelta
+import tty
+from collections.abc import Iterator, Sequence
+from dataclasses import dataclass
 from pathlib import Path
 from typing import Final
 
 from agentic_runner.workers._runtime_support import run_subprocess_exec
 from agentic_runner.workers.contract_isolation import ContractIsolation, DirectiveSandbox
-from agentic_runner_contracts.sealed_credential import SignInCodeOutcome
 
 __all__ = [
     "CLAUDE_AI",
@@ -57,9 +55,9 @@ __all__ = [
     "KEYCHAIN_PASSWORD_FILE",
     "OAUTH_TOKEN",
     "OAUTH_TOKEN_FILE",
+    "SIGN_IN_METHODS",
     "ClaudeAuthStatus",
     "ClaudeSignInError",
-    "ClaudeSignInPrompt",
     "ClaudeSignIns",
     "UnknownSignInMethodError",
     "launcher_argv",
@@ -73,6 +71,7 @@ CLAUDE_SIGN_IN_ARGV: Final[dict[str, tuple[str, ...]]] = {
     OAUTH_TOKEN: ("claude", "setup-token"),
     CLAUDE_AI: ("claude", "auth", "login", "--claudeai"),
 }
+SIGN_IN_METHODS: Final[tuple[str, ...]] = tuple(CLAUDE_SIGN_IN_ARGV)
 _STATUS_ARGV: Final[tuple[str, ...]] = ("claude", "auth", "status", "--json")
 
 OAUTH_TOKEN_FILE: Final[str] = "oauth-token"
@@ -99,24 +98,16 @@ export CLAUDE_CODE_SUBPROCESS_ENV_SCRUB
 exec "$@"
 """
 
-# A relayed code expires after this, or when the waiting CLI exits, whichever is first;
-# the CLI's process group is killed at the same moment.
-SIGN_IN_WINDOW: Final[timedelta] = timedelta(minutes=10)
-# Paperclip's setup-token-runner.ts:44-60: Ink reads a paste and its Enter as one chunk
-# and drops the Enter, so the newline goes in a separate write a beat later.
-_ENTER_DELAY_SECONDS: Final[float] = 0.15
-# Ink wraps the authorize URL and the token at the terminal width; one line each keeps
-# them whole.
+# Ink wraps the authorize URL and the token at the width it is told; one line each keeps
+# the token whole for `_printed_token`. The caller's terminal soft-wraps what it shows,
+# which also leaves the URL copyable in one piece.
 _PTY_COLUMNS: Final[int] = 1000
 _PTY_ROWS: Final[int] = 50
-_DEFAULT_PROMPT_TIMEOUT_SECONDS: Final[float] = 30.0
 _STATUS_TIMEOUT_SECONDS: Final[int] = 30
 _OUTPUT_LIMIT_BYTES: Final[int] = 65_536
 
-_logger = logging.getLogger(__name__)
-
 # Runs as the Contract's uid, never the Runner's: the Contract owns every directory down to
-# its harness root and can swap one for a symlink while a sign-in waits. The Runner, with
+# its harness root and can swap one for a symlink while a sign-in runs. The Runner, with
 # CAP_CHOWN and CAP_DAC_OVERRIDE, would follow it into another Contract's root; as the
 # Contract's uid the write or unlink reaches only what that Contract already could.
 # ``value`` None removes the file.
@@ -146,31 +137,18 @@ except BaseException:
     raise
 """
 
-# The URL arrives as an OSC 8 hyperlink whose target is whole even when its visible text
-# is split; the plain form is the fallback for a CLI that prints it bare.
-_OSC8_URL: Final[re.Pattern[str]] = re.compile(r"\x1b\]8;[^;\x07]*;(https://[^\x07\x1b]+)")
-_PLAIN_URL: Final[re.Pattern[str]] = re.compile(r"https://\S+/oauth/authorize\?[^\s\x07\x1b]+")
 _ANSI: Final[re.Pattern[str]] = re.compile(r"\x1b(?:\][^\x07]*\x07|\[[0-9;?>]*[A-Za-z]|[78])")
 _TOKEN: Final[re.Pattern[str]] = re.compile(r"sk-ant-oat\d\d-[A-Za-z0-9_-]{20,}")
-# What a browser shows the person to paste back: base64url, with `#` joining the state.
-_CODE_SHAPE: Final[re.Pattern[str]] = re.compile(r"^[A-Za-z0-9_\-#.~]{8,512}$")
 
 
 class ClaudeSignInError(RuntimeError):
-    """The CLI never printed a usable sign-in prompt, or its status could not be read."""
+    """The CLI did not start, its status could not be read, or it printed no token."""
 
 
 class UnknownSignInMethodError(ValueError):
     """A ``method`` this Runner has no Claude Code sign-in command for."""
 
 
-@dataclass(frozen=True, slots=True)
-class ClaudeSignInPrompt:
-    sign_in_id: str
-    verification_uri: str
-    expires_at: datetime
-
-
 @dataclass(frozen=True, slots=True)
 class ClaudeAuthStatus:
     """``claude auth status --json``'s three fields, and nothing else it reports."""
@@ -180,22 +158,6 @@ class ClaudeAuthStatus:
     subscription_type: str | None
 
 
-@dataclass(eq=False)
-class _WaitingSignIn:
-    sign_in_id: str
-    contract_id: str
-    method: str
-    harness_root: Path
-    uid: int | None
-    process: asyncio.subprocess.Process
-    master_fd: int
-    deadline: float
-    output: bytearray = field(default_factory=bytearray)
-    changed: asyncio.Event = field(default_factory=asyncio.Event)
-    exited: asyncio.Event = field(default_factory=asyncio.Event)
-    ended: bool = False
-
-
 def launcher_argv(harness_root: Path, argv: Sequence[str]) -> list[str]:
     """``argv`` behind the launcher that hands it this harness root's login."""
 
@@ -203,7 +165,7 @@ def launcher_argv(harness_root: Path, argv: Sequence[str]) -> list[str]:
 
 
 class ClaudeSignIns:
-    """Every Claude Code sign-in this Runner has started and is still waiting on."""
+    """Claude Code's sign-in and sign-in status for each Contract's harness root."""
 
     def __init__(
         self,
@@ -211,80 +173,48 @@ class ClaudeSignIns:
         *,
         argv_by_method: dict[str, tuple[str, ...]] | None = None,
         status_argv: Sequence[str] = _STATUS_ARGV,
-        prompt_timeout_seconds: float = _DEFAULT_PROMPT_TIMEOUT_SECONDS,
-        window: timedelta = SIGN_IN_WINDOW,
         platform: str = sys.platform,
-        clock: Callable[[], float] | None = None,
     ) -> None:
         self._isolation = isolation
         self._argv_by_method = argv_by_method or CLAUDE_SIGN_IN_ARGV
         self._status_argv = list(status_argv)
-        self._prompt_timeout_seconds = prompt_timeout_seconds
-        self._window = window
         self._platform = platform
-        self._clock = clock
-        self._waiting: dict[str, _WaitingSignIn] = {}
-        self._watchers: set[asyncio.Task[None]] = set()
-
-    def _now(self) -> float:
-        return self._clock() if self._clock is not None else asyncio.get_running_loop().time()
 
-    @property
-    def waiting(self) -> int:
-        return len(self._waiting)
+    async def sign_in(
+        self, contract_id: str, *, method: str = OAUTH_TOKEN, stdin_fd: int = 0, stdout_fd: int = 1
+    ) -> int:
+        """Run the method's CLI as this Contract's uid, attached to the caller's terminal
+        (``stdin_fd``/``stdout_fd``); keep what it signed in. Returns the CLI's exit code."""
 
-    async def start(self, contract_id: str, *, method: str | None) -> ClaudeSignInPrompt:
-        """Spawn the method's CLI as this Contract's uid; return once it prints its URL."""
-
-        method = method or OAUTH_TOKEN
         argv = self._argv_by_method.get(method)
         if argv is None:
             raise UnknownSignInMethodError(f"no Claude Code sign-in method {method!r}")
         sandbox = self._isolation.sandbox(contract_id, runtime_kind=RUNTIME_KIND)
-        # One sign-in per Contract: a second start supersedes the first, whose code the
-        # person can no longer use anyway.
-        for waiting in [w for w in self._waiting.values() if w.contract_id == contract_id]:
-            await self._end(waiting)
         if method == CLAUDE_AI and self._platform == "darwin":
             await self._ensure_keychain(sandbox)
-        session = await self._spawn(contract_id, method, argv, sandbox)
+        output = bytearray()
         try:
-            url = await self._await_prompt(session)
-        except BaseException:
-            await self._end(session)
-            raise
-        # The relay rests on PKCE: without a verifier held by the CLI, a relayed code
-        # would be a usable credential in transit (local-agents 05, item 1).
-        if "code_challenge_method=S256" not in url:
-            await self._end(session)
-            raise ClaudeSignInError("the sign-in URL carries no S256 code challenge")
-        self._waiting[session.sign_in_id] = session
-        watcher = asyncio.ensure_future(self._watch(session))
-        self._watchers.add(watcher)
-        watcher.add_done_callback(self._watchers.discard)
-        return ClaudeSignInPrompt(
-            sign_in_id=session.sign_in_id,
-            verification_uri=url,
-            expires_at=datetime.now(UTC) + self._window,
-        )
-
-    async def relay(self, contract_id: str, sign_in_id: str, code: str) -> SignInCodeOutcome:
-        """Type one relayed code into the sign-in it names, or say why not. Never retried."""
-
-        session = self._waiting.get(sign_in_id)
-        if session is None or session.contract_id != contract_id:
-            return SignInCodeOutcome.UNKNOWN
-        if session.exited.is_set() or self._now() >= session.deadline:
-            return SignInCodeOutcome.EXPIRED
-        if not _CODE_SHAPE.fullmatch(code):
-            # A newline or a control character would be keystrokes, not a code.
-            return SignInCodeOutcome.UNOPENABLE
-        os.write(session.master_fd, code.encode("ascii"))
-        await asyncio.sleep(_ENTER_DELAY_SECONDS)
-        if session.exited.is_set():
-            return SignInCodeOutcome.EXPIRED
-        os.write(session.master_fd, b"\r")
-        return SignInCodeOutcome.WRITTEN
+            returncode = await _run_attached(
+                launcher_argv(sandbox.harness_config_dir, argv),
+                sandbox,
+                output=output,
+                stdin_fd=stdin_fd,
+                stdout_fd=stdout_fd,
+            )
+            token_file = sandbox.harness_config_dir / OAUTH_TOKEN_FILE
+            if method == OAUTH_TOKEN:
+                token = _printed_token(output.decode("utf-8", errors="replace"))
+                if token is not None:
+                    await _write_private(token_file, token, sandbox.uid)
+                elif returncode == 0:
+                    raise ClaudeSignInError("claude setup-token exited 0 but printed no token")
+            elif returncode == 0:
+                # A finished `claude_ai` sign-in replaces a long-lived token, which the
+                # launcher would otherwise go on preferring.
+                await _write_private(token_file, None, sandbox.uid)
+        finally:
+            output.clear()
+        return returncode
 
     async def status(self, contract_id: str) -> ClaudeAuthStatus:
         """Ask the CLI, as the Contract's uid, whether it is signed in.
@@ -322,134 +252,6 @@ class ClaudeSignIns:
             subscription_type=plan if isinstance(plan, str) else None,
         )
 
-    async def close(self) -> None:
-        for session in list(self._waiting.values()):
-            await self._end(session)
-
-    async def _spawn(
-        self,
-        contract_id: str,
-        method: str,
-        argv: tuple[str, ...],
-        sandbox: DirectiveSandbox,
-    ) -> _WaitingSignIn:
-        master_fd, slave_fd = pty.openpty()
-        try:
-            fcntl.ioctl(
-                slave_fd, termios.TIOCSWINSZ, struct.pack("HHHH", _PTY_ROWS, _PTY_COLUMNS, 0, 0)
-            )
-            os.set_blocking(master_fd, False)
-            try:
-                process = await asyncio.create_subprocess_exec(
-                    *launcher_argv(sandbox.harness_config_dir, argv),
-                    cwd=sandbox.home_dir,
-                    env=_harness_env(sandbox) | {"TERM": "xterm-256color"},
-                    stdin=slave_fd,
-                    stdout=slave_fd,
-                    stderr=slave_fd,
-                    start_new_session=True,
-                    **sandbox.spawn_kwargs(),
-                )
-            except OSError as error:
-                raise ClaudeSignInError(
-                    f"claude failed to start: {error.__class__.__name__}"
-                ) from None
-        except BaseException:
-            os.close(master_fd)
-            raise
-        finally:
-            os.close(slave_fd)
-        session = _WaitingSignIn(
-            sign_in_id=f"si_{secrets.token_hex(16)}",
-            contract_id=contract_id,
-            method=method,
-            harness_root=sandbox.harness_config_dir,
-            uid=sandbox.uid,
-            process=process,
-            master_fd=master_fd,
-            deadline=self._now() + self._window.total_seconds(),
-        )
-        asyncio.get_running_loop().add_reader(master_fd, self._read, session)
-        return session
-
-    def _read(self, session: _WaitingSignIn) -> None:
-        try:
-            chunk = os.read(session.master_fd, 4096)
-        except BlockingIOError:
-            return
-        except OSError:
-            # EIO: every holder of the slave side is gone, i.e. the CLI exited.
-            chunk = b""
-        if not chunk:
-            asyncio.get_running_loop().remove_reader(session.master_fd)
-            session.exited.set()
-            session.changed.set()
-            return
-        _keep_tail(session.output, chunk)
-        session.changed.set()
-
-    async def _await_prompt(self, session: _WaitingSignIn) -> str:
-        async with asyncio.timeout(self._prompt_timeout_seconds):
-            while True:
-                url = _authorize_url(session.output.decode("utf-8", errors="replace"))
-                if url is not None:
-                    return url
-                if session.exited.is_set():
-                    code = await session.process.wait()
-                    raise ClaudeSignInError(
-                        f"claude exited before printing its sign-in URL (code {code})"
-                    )
-                session.changed.clear()
-                await session.changed.wait()
-
-    async def _watch(self, session: _WaitingSignIn) -> None:
-        remaining = max(0.0, session.deadline - self._now())
-        with contextlib.suppress(TimeoutError):
-            await asyncio.wait_for(session.exited.wait(), timeout=remaining)
-        await self._end(session)
-
-    async def _end(self, session: _WaitingSignIn) -> None:
-        """Kill the group if it is still waiting, keep what it signed in, forget the rest."""
-
-        if session.ended:
-            return
-        session.ended = True
-        loop = asyncio.get_running_loop()
-        if not session.exited.is_set():
-            loop.remove_reader(session.master_fd)
-            with contextlib.suppress(ProcessLookupError, PermissionError):
-                os.killpg(session.process.pid, signal.SIGKILL)
-            session.exited.set()
-        with contextlib.suppress(TimeoutError):
-            await asyncio.wait_for(session.process.wait(), timeout=2)
-        with contextlib.suppress(OSError):
-            # The CLI's last words can still be in the master's buffer after EOF.
-            while chunk := os.read(session.master_fd, 4096):
-                _keep_tail(session.output, chunk)
-        with contextlib.suppress(OSError):
-            os.close(session.master_fd)
-        session.master_fd = -1
-        token_file = session.harness_root / OAUTH_TOKEN_FILE
-        try:
-            if session.method == OAUTH_TOKEN:
-                token = _printed_token(session.output.decode("utf-8", errors="replace"))
-                if token is not None:
-                    await _write_private(token_file, token, session.uid)
-                elif session.process.returncode == 0:
-                    raise ClaudeSignInError("claude setup-token exited 0 but printed no token")
-            elif session.process.returncode == 0:
-                # A finished `claude_ai` sign-in replaces a long-lived token, which the
-                # launcher would otherwise go on preferring.
-                await _write_private(token_file, None, session.uid)
-        except ClaudeSignInError as error:
-            # Nobody awaits a sign-in's end; the person sees it as still signed out.
-            _logger.error("Claude Code sign-in %s did not complete: %s", session.sign_in_id, error)
-        finally:
-            session.output.clear()
-            # Last, so `waiting` falls to zero only once the token is on disk.
-            if self._waiting.get(session.sign_in_id) is session:
-                del self._waiting[session.sign_in_id]
-
     async def _ensure_keychain(self, sandbox: DirectiveSandbox) -> None:
         """A per-Contract keychain, the default of the sandbox ``HOME`` (macOS only)."""
 
@@ -483,6 +285,104 @@ class ClaudeSignIns:
                 raise ClaudeSignInError(f"security {argv[1]} failed (exit {result.exit_code})")
 
 
+async def _run_attached(
+    argv: Sequence[str],
+    sandbox: DirectiveSandbox,
+    *,
+    output: bytearray,
+    stdin_fd: int,
+    stdout_fd: int,
+) -> int:
+    """Run ``argv`` on a pseudo-terminal relayed to the caller's; its output's tail lands
+    in ``output``. Returns once the CLI has exited and its last output is relayed."""
+
+    master_fd, slave_fd = pty.openpty()
+    try:
+        rows = os.get_terminal_size(stdout_fd).lines if os.isatty(stdout_fd) else _PTY_ROWS
+        fcntl.ioctl(slave_fd, termios.TIOCSWINSZ, struct.pack("HHHH", rows, _PTY_COLUMNS, 0, 0))
+        os.set_blocking(master_fd, False)
+        try:
+            process = await asyncio.create_subprocess_exec(
+                *argv,
+                cwd=sandbox.home_dir,
+                env=_harness_env(sandbox) | {"TERM": os.environ.get("TERM") or "xterm-256color"},
+                stdin=slave_fd,
+                stdout=slave_fd,
+                stderr=slave_fd,
+                start_new_session=True,
+                **sandbox.spawn_kwargs(),
+            )
+        except OSError as error:
+            raise ClaudeSignInError(f"claude failed to start: {error.__class__.__name__}") from None
+    except BaseException:
+        os.close(master_fd)
+        raise
+    finally:
+        os.close(slave_fd)
+
+    loop = asyncio.get_running_loop()
+    exited = asyncio.Event()
+
+    def from_cli() -> None:
+        try:
+            chunk = os.read(master_fd, 4096)
+        except BlockingIOError:
+            return
+        except OSError:
+            # EIO: every holder of the slave side is gone, i.e. the CLI exited.
+            chunk = b""
+        if not chunk:
+            loop.remove_reader(master_fd)
+            exited.set()
+            return
+        _write_all(stdout_fd, chunk)
+        _keep_tail(output, chunk)
+
+    def from_person() -> None:
+        typed = os.read(stdin_fd, 1024)
+        if not typed:
+            loop.remove_reader(stdin_fd)
+            return
+        os.write(master_fd, typed)
+
+    loop.add_reader(master_fd, from_cli)
+    loop.add_reader(stdin_fd, from_person)
+    try:
+        with _raw(stdin_fd):
+            await exited.wait()
+            return await process.wait()
+    except BaseException:
+        with contextlib.suppress(ProcessLookupError, PermissionError):
+            os.killpg(process.pid, signal.SIGKILL)
+        raise
+    finally:
+        loop.remove_reader(master_fd)
+        loop.remove_reader(stdin_fd)
+        os.close(master_fd)
+
+
+@contextlib.contextmanager
+def _raw(fd: int) -> Iterator[None]:
+    """The caller's terminal in raw mode, so each key reaches the CLI as the CLI's own
+    terminal would deliver it (Ink reads keys, not lines), and restored after."""
+
+    if not os.isatty(fd):
+        yield
+        return
+    saved = termios.tcgetattr(fd)
+    tty.setraw(fd)
+    try:
+        yield
+    finally:
+        termios.tcsetattr(fd, termios.TCSADRAIN, saved)
+
+
+def _write_all(fd: int, data: bytes) -> None:
+    view = memoryview(data)
+    while view:
+        view = view[os.write(fd, view) :]
+
+
 def _harness_env(sandbox: DirectiveSandbox) -> dict[str, str]:
     return {
         "HOME": str(sandbox.home_dir),
@@ -492,13 +392,6 @@ def _harness_env(sandbox: DirectiveSandbox) -> dict[str, str]:
     }
 
 
-def _authorize_url(text: str) -> str | None:
-    if hyperlink := _OSC8_URL.search(text):
-        return hyperlink.group(1)
-    plain = _PLAIN_URL.search(_ANSI.sub("", text))
-    return plain.group(0) if plain else None
-
-
 def _printed_token(text: str) -> str | None:
     match = _TOKEN.search(_ANSI.sub("", text))
     return match.group(0) if match else None

{agentic_runner-3.13.0 → agentic_runner-3.14.0}/src/agentic_runner/workers/contract_device_login.py

@@ -54,8 +54,8 @@ _TOKEN_FILES_BY_RUNTIME: Final[dict[str, tuple[str, ...]]] = {
 }
 
 # Codex's non-interactive device-code flow (research/29 §1.5, "Headless login is
-# first-class"). Claude Code's is an interactive paste-code flow on a pseudo-terminal
-# instead: ``claude_sign_in.CLAUDE_SIGN_IN_ARGV`` (local-agents 05).
+# first-class"). Claude Code has none here: the person runs its own flow on the Runner,
+# ``agentic-runner sign-in`` (``claude_sign_in``, QTS-1448), and no console starts it.
 DEVICE_LOGIN_ARGV: Final[dict[str, tuple[str, ...]]] = {
     "codex_cli": ("codex", "login", "--device-auth"),
 }
@@ -97,8 +97,6 @@ class DeviceLoginPrompt:
     verification_uri: str
     user_code: str
     expires_at: datetime
-    # Claude Code's: what a relayed code names (local-agents 05).
-    sign_in_id: str = ""
 
 
 class ContractDeviceLogin:
@@ -119,9 +117,7 @@ class ContractDeviceLogin:
         self._prompt_timeout_seconds = prompt_timeout_seconds
         self._output_limit_bytes = output_limit_bytes
 
-    async def sign_in(
-        self, contract_id: str, *, runtime_kind: str, method: str | None = None
-    ) -> DeviceLoginPrompt:
+    async def sign_in(self, contract_id: str, *, runtime_kind: str) -> DeviceLoginPrompt:
         """Spawn the harness CLI as this Contract's own uid; return once it has printed
         its verification prompt, and leave it running to finish the funder's approval.
 
@@ -130,16 +126,6 @@ class ContractDeviceLogin:
         harness config root no other Contract's uid can read.
         """
 
-        if runtime_kind == "claude_code":
-            claude = await self.claude.start(contract_id, method=method)
-            return DeviceLoginPrompt(
-                contract_id=contract_id,
-                runtime_kind=runtime_kind,
-                verification_uri=claude.verification_uri,
-                user_code="",
-                expires_at=claude.expires_at,
-                sign_in_id=claude.sign_in_id,
-            )
         argv = self._argv_by_runtime.get(runtime_kind)
         if argv is None:
             raise UnknownHarnessError(f"no device-login command for runtime {runtime_kind!r}")