agentic-runner 3.16.0__tar.gz → 3.16.2__tar.gz

{agentic_runner-3.16.0 → agentic_runner-3.16.2}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.16.0
+Version: 3.16.2
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.16.0
+Requires-Dist: agentic-runner-contracts==3.16.2
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.16.0 → agentic_runner-3.16.2}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.16.0",
+  "agentic-runner-contracts==3.16.2",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.16.0 → agentic_runner-3.16.2}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.16.0"
+__version__ = "3.16.2"
 
 __all__ = ["__version__"]

{agentic_runner-3.16.0 → agentic_runner-3.16.2}/src/agentic_runner/activities.py

@@ -1490,6 +1490,7 @@ def _persona_instructions_hash(instructions: str) -> str | None:
 def _codex_evidence_payload(
     codex_result: DirectiveResult,
     *,
+    cli_kind: str,
     persona_slug: str | None = None,
     persona_instructions: str = "",
     prompt_notes: list[str] | None = None,
@@ -1517,6 +1518,7 @@ def _codex_evidence_payload(
         ),
         "command_hash": codex_result.command_hash,
         # What ran, which the Agent's configuration alone does not prove (ADR-0021).
+        "cli_kind": cli_kind,
         "model": codex_result.model or None,
         "workspace": asdict(codex_result.evidence),
         "persona_slug": persona_slug,
@@ -2145,6 +2147,7 @@ class RunnerRalphActivities:
                 source="ralph.codex_run",
                 payload=_codex_evidence_payload(
                     codex_result,
+                    cli_kind=runtime_state.cli_kind,
                     persona_slug=runtime_state.persona_slug,
                     persona_instructions=runtime_state.persona_instructions,
                     prompt_notes=prompt_notes,
@@ -5352,6 +5355,7 @@ class RunnerRalphActivities:
                     "agent_id": state.agent_id,
                     **_codex_evidence_payload(
                         codex_result,
+                        cli_kind=state.cli_kind,
                         persona_slug=state.persona_slug,
                         persona_instructions=state.persona_instructions,
                         prompt_notes=prompt_notes,

{agentic_runner-3.16.0 → agentic_runner-3.16.2}/src/agentic_runner/workers/claude_runtime.py

@@ -56,16 +56,18 @@ _SECRET_VALUE_PATTERNS: Final[tuple[re.Pattern[str], ...]] = (
 class ClaudeRuntime(ResumableAgentRuntime):
     """Worker-local Claude Code CLI runtime.
 
-    Authenticates with an API key (``ANTHROPIC_API_KEY``) rather than a device-login session,
-    so an unattended Persona can run without an expiring browser session (ADR-0006). Like the
-    Codex runtime it confines execution to the supplied workspace, refuses fail-closed unless the
-    autonomous-permission guard is configured, and returns bounded, redacted evidence safe for
-    control-plane storage — the API key never appears in returned text.
+    Runs against the attempt's LLM proxy endpoint rather than a device-login session, so an
+    unattended Persona can run without an expiring browser session (ADR-0006), and the
+    subprocess holds only the attempt's bearer, never a provider key (QTS-1520). Like the
+    Codex runtime it confines execution to the supplied workspace, refuses fail-closed unless
+    the autonomous-permission guard is configured or the proxy endpoint is missing, and
+    returns bounded, redacted evidence safe for control-plane storage.
     """
 
-    # Subscription mode for Claude Code is local-agents 07; until then a user-hosted Runner
-    # with no key runs it on the host operator's key, as before.
+    # Subscription mode for Claude Code is local-agents 07; until then a Contract with no
+    # delivered key has nothing this runtime may run on.
     auth_modes = frozenset({AuthMode.API_KEY})
+    host_api_key = False
 
     def __init__(
         self,
@@ -75,7 +77,6 @@ class ClaudeRuntime(ResumableAgentRuntime):
     ) -> None:
         self._settings = settings
         self._runner = runner or run_subprocess_exec
-        self.host_api_key = bool(settings.ANTHROPIC_API_KEY)
 
     def capabilities(self) -> RuntimeCapabilities:
         return RuntimeCapabilities(
@@ -102,6 +103,17 @@ class ClaudeRuntime(ResumableAgentRuntime):
                 work_branch=request.work_branch,
                 evidence_limit_bytes=self._settings.CLAUDE_CLI_OUTPUT_LIMIT_BYTES,
             )
+        if not dict(request.extra_env).get("ANTHROPIC_BASE_URL"):
+            # The proxy pair is the only credential this runtime hands the harness; without
+            # it the harness would fall back to whatever login or key it finds itself.
+            return _refused_result(
+                workspace_id=directive_workspace_id,
+                base_branch=request.base_branch,
+                work_branch=request.work_branch,
+                evidence_limit_bytes=self._settings.CLAUDE_CLI_OUTPUT_LIMIT_BYTES,
+                guard_mode="refused: api_key mode without an LLM proxy endpoint",
+                error="an api_key Claude Code Directive needs the attempt's LLM proxy endpoint",
+            )
 
         model = request.model or self._settings.CLAUDE_MODEL
         argv = _claude_argv(model)
@@ -140,7 +152,7 @@ class ClaudeRuntime(ResumableAgentRuntime):
             )
         # Per-Contract CLAUDE_CONFIG_DIR, never a fleet-wide one (ADR-0015 §4).
         sandbox = request.sandbox
-        env = {"ANTHROPIC_API_KEY": self._settings.ANTHROPIC_API_KEY}
+        env: dict[str, str] = {}
         if sandbox is not None:
             env["CLAUDE_CONFIG_DIR"] = str(sandbox.harness_config_dir)
             env["HOME"] = str(sandbox.home_dir)
@@ -207,7 +219,7 @@ class ClaudeRuntime(ResumableAgentRuntime):
 
 
 def _guard_mode(settings: WorkerSettings) -> str | None:
-    if settings.ANTHROPIC_API_KEY and settings.CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS:
+    if settings.CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS:
         return "auth=api-key; permission=skip-in-sandbox; output=json"
     return None
 
@@ -231,10 +243,9 @@ def _refused_result(
     base_branch: str,
     work_branch: str,
     evidence_limit_bytes: int,
-    guard_mode: str = "refused: missing API key or autonomous permission configuration",
+    guard_mode: str = "refused: missing autonomous permission configuration",
     error: str = (
-        "Claude Code API key and autonomous permission configuration are required "
-        "before worker-local execution"
+        "Claude Code autonomous permission configuration is required before worker-local execution"
     ),
 ) -> DirectiveResult:
     command_hash = hash_command(["claude", "refused"])

{agentic_runner-3.16.0 → agentic_runner-3.16.2}/src/agentic_runner/workers/settings.py

@@ -115,10 +115,6 @@ class WorkerSettings(BaseSettings):
         default=False,
         description="Worker assertion that Codex policy hook or permission profile is configured",
     )
-    ANTHROPIC_API_KEY: str = Field(
-        default="",
-        description="Claude Code runtime API key (api_key auth model; redacted from evidence)",
-    )
     CLAUDE_MODEL: str = Field(
         default="claude-opus-4-8",
         description="Model id the Claude Code runtime runs with",