agentic-runner 3.2.0__tar.gz → 3.4.0__tar.gz

{agentic_runner-3.2.0 → agentic_runner-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.2.0
+Version: 3.4.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.2.0 → agentic_runner-3.4.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.2.0"
+__version__ = "3.4.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.2.0 → agentic_runner-3.4.0}/src/agentic_runner/activities.py

@@ -31,6 +31,7 @@ import tempfile
 import time
 from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
 from dataclasses import asdict, dataclass, field, fields, replace
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, NoReturn, Protocol
 from uuid import UUID
@@ -44,6 +45,11 @@ from agentic_runner.attempts import (
     fence_work_record,
     refuse_if_prior_attempt_alive,
 )
+from agentic_runner.auth_mode import (
+    AuthModeRefusedError,
+    choose_auth_mode,
+    is_shared_runner,
+)
 from agentic_runner.callback import (
     CALLBACK_TOKEN_ENV,
     AnnotateRequest,
@@ -70,6 +76,7 @@ from agentic_runner.credentials import (
     UnresolvableCredentialReferenceError,
 )
 from agentic_runner.egress import EGRESS_REFUSED_SOURCE, EgressProxy, Resolver, host_of
+from agentic_runner.harness_self_test import DirectivesInFlight
 from agentic_runner.heartbeat_link import HeartbeatLink, SeamUnavailableError
 from agentic_runner.hooks import (
     HOOK_EVIDENCE_SOURCE,
@@ -118,11 +125,12 @@ from agentic_runner.workers._runtime_support import (
 )
 from agentic_runner.workers.agent_runtime import (
     AgentRuntime,
-    AuthModel,
+    AuthMode,
     DirectiveRequest,
     DirectiveResult,
     ResumableAgentRuntime,
 )
+from agentic_runner.workers.contract_device_login import login_file_counts
 from agentic_runner.workers.contract_isolation import (
     NO_CONTRACT,
     ContractIsolation,
@@ -134,6 +142,7 @@ from agentic_runner.workers.fastapi_client import (
     WorkerFastApiClientError,
     directive_token,
 )
+from agentic_runner.workers.harness_outcome import classify_harness_outcome
 from agentic_runner.workers.harness_usage import extract_claude_result, extract_codex_turn_usage
 from agentic_runner.workers.mcp_config import McpServerEntry
 from agentic_runner.workers.skills import (
@@ -162,6 +171,7 @@ from agentic_runner_contracts.activity_io import (
     FixDirectiveOutput,
     GitHubCallError,
     GitHubCallFailure,
+    HarnessHold,
     LearningDirectiveInput,
     LearningDirectiveOutput,
     MemberDirectiveInput,
@@ -638,6 +648,9 @@ class _DirectiveAttempt:
     # Console-v2 issue 28: the attached Skills, for a runtime with no skills directory to
     # write them into. Prefixed to the Directive prompt; empty when there is none.
     skills_preamble: str = ""
+    # Chosen before anything is spawned (local-agents 04); the runtime runs in it and
+    # the harness-usage report follows it.
+    auth_mode: AuthMode = AuthMode.API_KEY
 
     async def run_environment_hook(self) -> None:
         self.extra_env.update(await self.hooks.environment())
@@ -1432,6 +1445,8 @@ HARNESS_SESSION_EVIDENCE_SOURCE = "runner.harness_session"
 DIRECTIVE_TOKEN_EVIDENCE_SOURCE = "runner.directive_token"
 AGENT_RUNTIME_EVIDENCE_SOURCE = "runner.agent_runtime"
 SKILLS_EVIDENCE_SOURCE = "runner.skills"
+HARNESS_LOGIN_RESIDUE_SOURCE = "runner.harness_login_residue"
+HARNESS_HOLD_SOURCE = "runner.harness_hold"
 
 
 class _EvidenceWriter(Protocol):
@@ -1545,8 +1560,11 @@ class RunnerRalphActivities:
         egress_resolver: Resolver | None = None,
         tool_server_health: ToolServerHealthLog | None = None,
         attempt_records: AttemptRecords | None = None,
+        directives_in_flight: DirectivesInFlight | None = None,
     ) -> None:
         self._fastapi_client = fastapi_client
+        # Read by the harness self-test, which never runs beside a Contract's Directive.
+        self._directives_in_flight = directives_in_flight or DirectivesInFlight()
         # Wall-clock source for per-Directive runtime, accrued against the Budget's
         # wall-clock dimension (ADR-0007). Activities run outside the Temporal sandbox,
         # so a real monotonic clock is allowed here (it must never be used in the
@@ -1578,6 +1596,10 @@ class RunnerRalphActivities:
         # no proxy here keeps calling the backend one, which is exactly the transition
         # the issue describes.
         self._llm_proxy = llm_proxy
+        # Contracts whose harness roots this process has already checked for a login
+        # left behind (local-agents 04). Only de-duplicates an Evidence line -- no later
+        # activity reads it -- so a restart reporting the residue again is the intent.
+        self._residue_checked: set[str | None] = set()
         # Credential References (PRD issue 48, 22 A1). None means this Runner resolves
         # none: a Contract that declares a manifest then fails its Directives closed,
         # which is the right answer -- a Runner with no host store cannot host that
@@ -1969,6 +1991,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
+                    auth_mode=attempt.auth_mode,
                     prompt=attempt.skills_preamble
                     + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
@@ -2000,8 +2023,34 @@ class RunnerRalphActivities:
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
                 result=codex_result,
+                auth_mode=attempt.auth_mode,
             )
             plan = _take_plan(checkout_workspace)
+            harness_hold = await self._harness_hold(
+                runtime_state=runtime_state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=codex_result,
+                auth_mode=attempt.auth_mode,
+            )
+            if harness_hold is not None:
+                return BranchPullRequestOutput(
+                    repository=request.repository,
+                    branch_name=request.branch_name,
+                    base_ref=request.base_ref,
+                    pr_number=0,
+                    pr_url="",
+                    branch_created=branch.created,
+                    pr_created=False,
+                    duration_seconds=self._monotonic() - directive_started,
+                    usage=await self._directive_usage(
+                        work_record_id=request.work_record_id,
+                        directive_number=request.directive_number,
+                    ),
+                    workspace_path=str(workspace_path),
+                    grant_snapshot=dict(request.grant_snapshot),
+                    harness_hold=harness_hold,
+                )
             if codex_result.exit_code != 0:
                 if _is_guard_mode_refusal(codex_result):
                     # The runtime refused this Directive (guard-mode). Return a flagged
@@ -2419,6 +2468,8 @@ class RunnerRalphActivities:
         the bearer defensible under ADR-0011 §9.
         """
 
+        auth_mode = await self._directive_auth_mode(work_record_id, state)
+        await self._report_login_residue(work_record_id, state)
         facts = AttemptFacts(
             work_record_id=work_record_id,
             directive_id=directive_id(
@@ -2457,6 +2508,7 @@ class RunnerRalphActivities:
         scratch_root = sandbox.tmp_dir if sandbox is not None else Path(tempfile.gettempdir())
         attempt_dir = prepare_attempt_dir(scratch_root / f"attempt-{key}", uid)
         async with contextlib.AsyncExitStack() as stack:
+            stack.enter_context(self._directives_in_flight.running(facts.contract_id))
             stack.callback(shutil.rmtree, attempt_dir, ignore_errors=True)
             callback_env: dict[str, str] = {}
             if self._socket_dir is not None:
@@ -2476,8 +2528,8 @@ class RunnerRalphActivities:
                     )
                 )
                 callback_env = server.env()
-            if self._llm_proxy is not None and self._meters_through_the_proxy(state):
-                # API-key mode only (issue 43): a device-login Contract never has a slot
+            if self._llm_proxy is not None and auth_mode == AuthMode.API_KEY:
+                # API-key mode only (issue 43): a subscription Directive never has a slot
                 # to resolve, and issue 31 meters it from the harness's own output. One
                 # bearer serves the callback socket and the proxy alike.
                 proxy_attempt = await stack.enter_async_context(
@@ -2528,6 +2580,7 @@ class RunnerRalphActivities:
                 mcp_servers=mcp_servers,
                 egress_allow_list=egress_allow_list,
                 skills_preamble=delivered_preamble,
+                auth_mode=auth_mode,
             )
 
     async def _refuse_skill_digest_mismatch(
@@ -2805,26 +2858,86 @@ class RunnerRalphActivities:
             )
             raise
 
-    def _meters_through_the_proxy(self, state: _RuntimeContextState) -> bool:
-        """Whether this Directive's runtime is metered at the proxy (issue 43).
-
-        The mirror of :meth:`_report_harness_usage`'s test: an ``api_key`` Directive
-        routes through the proxy and is metered there; a device-login one bypasses it
-        entirely and is metered from the harness's own output by PRD issue 31. Read off
-        the runtime the Work Record's `cli_kind` names, never a process-wide one.
+    async def _directive_auth_mode(
+        self, work_record_id: str, state: _RuntimeContextState
+    ) -> AuthMode:
+        """This Directive's auth mode, or a non-retryable refusal with Evidence naming the
+        rule (local-agents 04).
+
+        Decided from the host party this process was registered with and from whether a
+        key is present for the Contract -- never from the payload. A runtime that declares
+        no modes (a test double built before the port grew the field) reads as
+        ``api_key``-only, and a kind this Runner does not serve reads the same way; that
+        Directive fails closed in :meth:`_agent_runtime_for` regardless.
         """
 
-        return self._auth_model(state) == AuthModel.API_KEY
-
-    def _auth_model(self, state: _RuntimeContextState) -> AuthModel:
-        # `getattr` with a default, not `.auth_model` outright: a runtime that carries
-        # none (a test double built before this port grew the field) is the same case as
-        # `api_key` -- nothing to report from the harness -- never a crash on an
-        # unrelated Directive. A kind this Runner does not serve reads the same way; the
-        # Directive itself has already failed closed in :meth:`_agent_runtime_for`.
         runtime = self._agent_runtimes.get(state.cli_kind)
-        model = getattr(runtime, "auth_model", AuthModel.API_KEY)
-        return model if isinstance(model, AuthModel) else AuthModel.API_KEY
+        host_party = self._routing_identity.host_party if self._routing_identity else None
+        try:
+            return choose_auth_mode(
+                host_party=host_party,
+                key_present=self._api_key_present(state, runtime),
+                runtime_modes=getattr(runtime, "auth_modes", frozenset({AuthMode.API_KEY})),
+            )
+        except AuthModeRefusedError as refusal:
+            await _raise_recorded(
+                ApplicationError(str(refusal), type=refusal.rule, non_retryable=True),
+                self._fastapi_client,
+                work_record_id,
+                source=AGENT_RUNTIME_EVIDENCE_SOURCE,
+                actor=self._actor(),
+                payload={
+                    "event": "directive.auth_mode_refused",
+                    "rule": refusal.rule,
+                    "cli_kind": state.cli_kind,
+                    "host_party": host_party,
+                    "contract_id": state.contract_id,
+                },
+            )
+
+    def _api_key_present(self, state: _RuntimeContextState, runtime: AgentRuntime | None) -> bool:
+        """A delivered slot for the Contract (or its funder), or the host operator's key."""
+
+        if bool(getattr(runtime, "host_api_key", False)):
+            return True
+        contract_id = _optional_uuid(state.contract_id)
+        return (
+            self._llm_proxy is not None
+            and contract_id is not None
+            and self._llm_proxy.slots.holds(contract_id)
+        )
+
+    async def _report_login_residue(self, work_record_id: str, state: _RuntimeContextState) -> None:
+        """On a shared Runner, say once that a Contract's harness root holds a login.
+
+        A count per harness, never a path or a byte of the file: the Runner does not open
+        it, a shared Runner never runs on it, and ``wipe_contract_residue`` removes it with
+        the Contract. Saying so is what turns a sign-in made before local-agents 03 (or by
+        hand) into something the Organisation can see and act on.
+        """
+
+        host_party = self._routing_identity.host_party if self._routing_identity else None
+        if (
+            self._contract_isolation is None
+            or not is_shared_runner(host_party)
+            or state.contract_id in self._residue_checked
+        ):
+            return
+        self._residue_checked.add(state.contract_id)
+        counts = login_file_counts(self._contract_isolation, state.contract_id)
+        if not counts:
+            return
+        await self._fastapi_client.append_evidence(
+            work_record_id,
+            source=HARNESS_LOGIN_RESIDUE_SOURCE,
+            actor=self._actor(),
+            payload={
+                "event": "harness.login_residue",
+                "contract_id": state.contract_id,
+                "host_party": host_party,
+                "login_files": counts,
+            },
+        )
 
     async def _agent_runtime_for(
         self, work_record_id: str, state: _RuntimeContextState
@@ -4405,7 +4518,13 @@ class RunnerRalphActivities:
                 guard_mode_refused=True,
                 workspace_path=request.workspace_path,
             )
-        if consumed and self._message_store is not None and not ran.guard_mode_refused:
+        if (
+            consumed
+            and self._message_store is not None
+            and not ran.guard_mode_refused
+            # A held turn never read its Messages; the wake after the hold must see them.
+            and ran.harness_hold is None
+        ):
             self._message_store.mark_consumed(
                 contract_id=contract[0],
                 work_record_id=request.work_record_id,
@@ -4516,6 +4635,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
+                    auth_mode=attempt.auth_mode,
                     prompt=attempt.skills_preamble
                     + _learning_prompt(
                         request,
@@ -4534,6 +4654,14 @@ class RunnerRalphActivities:
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
                 result=result,
+                auth_mode=attempt.auth_mode,
+            )
+            harness_hold = await self._harness_hold(
+                runtime_state=state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=result,
+                auth_mode=attempt.auth_mode,
             )
             usage = await self._directive_usage(
                 work_record_id=request.work_record_id,
@@ -4571,6 +4699,7 @@ class RunnerRalphActivities:
                 usage=usage,
                 outcome=LEARNING_FAILED,
                 summary=f"the Learner's runtime exited {result.exit_code}",
+                harness_hold=harness_hold,
             )
         return self._learning_output(
             request,
@@ -4587,6 +4716,7 @@ class RunnerRalphActivities:
         usage: DirectiveUsage | None = None,
         outcome: str = LEARNING_PROPOSED,
         summary: str = "",
+        harness_hold: HarnessHold | None = None,
     ) -> LearningDirectiveOutput:
         return LearningDirectiveOutput(
             work_record_id=request.work_record_id,
@@ -4595,6 +4725,7 @@ class RunnerRalphActivities:
             usage=usage or DirectiveUsage(),
             outcome=outcome,
             summary=summary,
+            harness_hold=harness_hold,
         )
 
     def _learner_transcript(self, state: _RuntimeContextState, work_record_id: str) -> str:
@@ -4764,6 +4895,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
+                    auth_mode=attempt.auth_mode,
                     prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,
@@ -4789,9 +4921,34 @@ class RunnerRalphActivities:
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
                 result=codex_result,
+                auth_mode=attempt.auth_mode,
             )
             # Taken before the commit below so it never lands on the branch (PRD 59).
             plan = _take_plan(state.workspace_path)
+            harness_hold = await self._harness_hold(
+                runtime_state=state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=codex_result,
+                auth_mode=attempt.auth_mode,
+            )
+            if harness_hold is not None:
+                return FixDirectiveOutput(
+                    work_record_id=request.work_record_id,
+                    repository=request.repository,
+                    pr_number=request.pr_number,
+                    directive_number=request.directive_number,
+                    branch_head_sha="",
+                    summary=f"held: the harness reported {harness_hold.kind.value}",
+                    duration_seconds=self._monotonic() - directive_started,
+                    usage=await self._directive_usage(
+                        work_record_id=request.work_record_id,
+                        directive_number=request.directive_number,
+                    ),
+                    workspace_path=str(state.workspace_path),
+                    grant_snapshot=state.grant_snapshot_payload,
+                    harness_hold=harness_hold,
+                )
             if codex_result.exit_code != 0:
                 if _is_guard_mode_refusal(codex_result):
                     return FixDirectiveOutput(
@@ -4987,14 +5144,15 @@ class RunnerRalphActivities:
         work_record_id: str,
         directive_number: int,
         result: DirectiveResult,
+        auth_mode: AuthMode,
     ) -> None:
-        """A device-login/setup-token Directive bypasses the LLM proxy, so this is the
-        only metering the Runner can produce for it (PRD issue 31, 17 A9). A no-op for an
-        ``api_key`` runtime -- the proxy already metered that call at request time -- and
-        never the reason a Directive fails (same posture as :meth:`_directive_usage`).
+        """A subscription Directive bypasses the LLM proxy, so this is the only metering
+        the Runner can produce for it (PRD issue 31, 17 A9). A no-op for an ``api_key``
+        Directive -- the proxy already metered that call at request time -- and never the
+        reason a Directive fails (same posture as :meth:`_directive_usage`).
         """
 
-        if self._auth_model(runtime_state) == AuthModel.API_KEY:
+        if auth_mode == AuthMode.API_KEY:
             return
         directive = directive_id(work_record_id=work_record_id, directive_number=directive_number)
         if runtime_state.cli_kind == "claude_code":
@@ -5030,6 +5188,46 @@ class RunnerRalphActivities:
                 }
             )
 
+    async def _harness_hold(
+        self,
+        *,
+        runtime_state: _RuntimeContextState,
+        work_record_id: str,
+        directive_number: int,
+        result: DirectiveResult,
+        auth_mode: AuthMode,
+    ) -> HarnessHold | None:
+        """A subscription harness that stopped on its usage limit or sign-in, recorded
+        once (local-agents 08). An ``api_key`` Directive's limits are the proxy's, so it is
+        never classified. The Evidence names the kind and the reset, never the output."""
+
+        if auth_mode != AuthMode.SUBSCRIPTION:
+            return None
+        hold = classify_harness_outcome(
+            runtime_state.cli_kind,
+            exit_code=result.exit_code,
+            stdout=result.stdout,
+            stderr=result.stderr,
+            error=result.error,
+            now=datetime.now(UTC),
+        )
+        if hold is None:
+            return None
+        await self._fastapi_client.append_evidence(
+            work_record_id,
+            source=HARNESS_HOLD_SOURCE,
+            payload={
+                "event": "directive.harness_hold",
+                "kind": hold.kind.value,
+                "cli_kind": runtime_state.cli_kind,
+                "retry_not_before": hold.retry_not_before,
+                "directive_number": directive_number,
+                "agent_id": runtime_state.agent_id,
+                "contract_id": runtime_state.contract_id,
+            },
+        )
+        return hold
+
     @activity.defn(name="wipe_contract_residue")
     async def wipe_contract_residue(self, request: ContractResidueInput) -> ContractResidueOutput:
         """Delete everything one Contract left on this Runner and retire its uid (17 A6).

agentic_runner-3.4.0/src/agentic_runner/auth_mode.py

@@ -0,0 +1,86 @@
+"""Which auth mode one Directive runs in, decided on the Runner before spawn (local-agents 04).
+
+Subscriptions follow the person, not the host (owner, 2026-09-26): a harness runs on a
+subscription login only on the Contract person's own Runner -- host party ``user``, which
+routing has already tied to the Contract's person (``assert_routed`` here, the platform's
+``_subscription_bound`` there) -- whatever channel the Runner was installed by. A shared
+Runner (``organisation`` or ``account``) runs every Directive through the LLM proxy on an
+API key and refuses sign-in. The platform refuses an ineligible sign-in at the door
+(local-agents 03); this module is the backstop, so it decides from what the Runner itself
+knows and never from the payload.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Collection
+from typing import Final
+
+from agentic_runner.workers.agent_runtime import AuthMode
+
+__all__ = [
+    "SETUP_TOKEN_REFUSED_RULE",
+    "SHARED_HOST_PARTIES",
+    "SHARED_RUNNER_SIGN_IN_RULE",
+    "SHARED_RUNNER_SUBSCRIPTION_RULE",
+    "AuthModeRefusedError",
+    "choose_auth_mode",
+    "is_setup_token",
+    "is_shared_runner",
+]
+
+SHARED_HOST_PARTIES: Final[frozenset[str]] = frozenset({"organisation", "account"})
+
+# The rule names a refusal's Evidence carries, so a support read can say which line held.
+SHARED_RUNNER_SUBSCRIPTION_RULE: Final[str] = "shared_runner_api_key_only"
+SHARED_RUNNER_SIGN_IN_RULE: Final[str] = "shared_runner_sign_in_refused"
+SETUP_TOKEN_REFUSED_RULE: Final[str] = "setup_token_refused"
+
+# `claude setup-token` mints an OAuth bearer under this prefix; an Anthropic API key is
+# `sk-ant-api…`. The sealed wire carries no mode, so the value's own shape is what the
+# Runner can refuse on.
+_SETUP_TOKEN_PREFIX: Final[str] = "sk-ant-oat"
+
+
+class AuthModeRefusedError(RuntimeError):
+    """A Directive or sign-in this Runner will not run; ``rule`` is the stable code."""
+
+    def __init__(self, rule: str, message: str) -> None:
+        super().__init__(message)
+        self.rule = rule
+
+
+def is_shared_runner(host_party: str | None) -> bool:
+    return host_party in SHARED_HOST_PARTIES
+
+
+def choose_auth_mode(
+    *,
+    host_party: str | None,
+    key_present: bool,
+    runtime_modes: Collection[AuthMode],
+) -> AuthMode:
+    """``api_key`` whenever a key is present; otherwise ``subscription`` on a user-hosted
+    Runner whose runtime can run one, and a refusal on a shared Runner.
+
+    The refusal is the shared Runner's "subscription case": with no key there is nothing
+    for the proxy to spend, and the only thing left that could authenticate the harness is
+    a login, which a shared Runner never uses. An unregistered process (``host_party``
+    ``None``) is not user-hosted either, so it never runs a subscription; it runs on a key
+    or fails at the proxy for want of one, as it would today.
+    """
+
+    if key_present:
+        return AuthMode.API_KEY
+    if is_shared_runner(host_party):
+        raise AuthModeRefusedError(
+            SHARED_RUNNER_SUBSCRIPTION_RULE,
+            f"this Runner is hosted by {host_party!r}, so it runs API keys only, and no API "
+            "key is present for this Contract",
+        )
+    if host_party == "user" and AuthMode.SUBSCRIPTION in runtime_modes:
+        return AuthMode.SUBSCRIPTION
+    return AuthMode.API_KEY
+
+
+def is_setup_token(value: str) -> bool:
+    return value.strip().startswith(_SETUP_TOKEN_PREFIX)

agentic_runner-3.4.0/src/agentic_runner/cli_floor.py

@@ -0,0 +1,33 @@
+"""Which executable each Agent Runtime CLI is, and the version floor it must clear."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from typing import Final
+
+__all__ = ["CLI_FLOORS", "CLI_NAMES", "meets_floor", "parse_cli_version"]
+
+# What the Profile's `cli_kind` runs, by executable name on PATH.
+CLI_NAMES: Final[Mapping[str, str]] = {"codex_cli": "codex", "claude_code": "claude"}
+# The versions the Runner image is built and tested against (Dockerfile.runner's
+# CODEX_CLI_VERSION / CLAUDE_CODE_VERSION; a test holds the two together). Below the
+# floor is *reported*, not refused: the user's own CLI is the user's to upgrade.
+CLI_FLOORS: Final[Mapping[str, str]] = {"codex": "0.141.0", "claude": "2.1.280"}
+
+_VERSION = re.compile(r"(\d+\.\d+\.\d+[0-9A-Za-z.+-]{0,40})")
+
+
+def parse_cli_version(output: str) -> str | None:
+    match = _VERSION.search(output)
+    return None if match is None else match.group(1)
+
+
+def meets_floor(name: str, version: str) -> bool:
+    """Whether ``version`` of the executable ``name`` clears the Runner's floor for it."""
+
+    return _version_tuple(version) >= _version_tuple(CLI_FLOORS[name])
+
+
+def _version_tuple(version: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in re.findall(r"\d+", version)[:3])

{agentic_runner-3.2.0 → agentic_runner-3.4.0}/src/agentic_runner/config.py

@@ -51,6 +51,11 @@ class RunnerConfig(BaseModel):
     # fails its Directives with Evidence naming the reference (22 A1), instead of running
     # without the credential it was told to use.
     credential_store: Path | None = None
+    # Where a delivered OpenAI / Anthropic key is spent (local-agents 04b), when not at
+    # the vendor itself: a gateway the host runs in front of it. The host already holds
+    # the opened value, so pointing it elsewhere grants the host nothing it lacked.
+    openai_base_url: str | None = None
+    anthropic_base_url: str | None = None
     log_level: str = "info"
 
 

{agentic_runner-3.2.0 → agentic_runner-3.4.0}/src/agentic_runner/device_login_activities.py

@@ -11,7 +11,9 @@ from collections.abc import Callable
 from datetime import UTC, datetime
 
 from temporalio import activity
+from temporalio.exceptions import ApplicationError
 
+from agentic_runner.auth_mode import SHARED_RUNNER_SIGN_IN_RULE
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import ContractIsolation
 from agentic_runner_contracts.activity_io import (
@@ -31,8 +33,12 @@ class ContractDeviceLoginActivities:
         *,
         contract_isolation: ContractIsolation,
         device_login: ContractDeviceLogin | None = None,
+        host_party: str | None = None,
     ) -> None:
         self._contract_isolation = contract_isolation
+        # The party this process was registered as hosted by. A shared Runner never runs a
+        # subscription, so it never starts or reads one either (local-agents 04).
+        self._host_party = host_party
         # Injectable for tests; None falls through to the real `codex` subprocess.
         self._device_login = device_login or ContractDeviceLogin(contract_isolation)
 
@@ -46,6 +52,7 @@ class ContractDeviceLoginActivities:
     async def sign_in_contract_device_login(
         self, request: ContractDeviceLoginInput
     ) -> ContractDeviceLoginResult:
+        self._refuse_on_shared_runner()
         prompt = await self._device_login.sign_in(
             request.contract_id, runtime_kind=request.runtime_kind
         )
@@ -61,6 +68,7 @@ class ContractDeviceLoginActivities:
     async def check_contract_device_login_status(
         self, request: ContractDeviceLoginStatusInput
     ) -> ContractDeviceLoginStatusResult:
+        self._refuse_on_shared_runner()
         present = self._device_login.token_present(
             request.contract_id, runtime_kind=request.runtime_kind
         )
@@ -77,3 +85,19 @@ class ContractDeviceLoginActivities:
             token_present=present,
             delivered_at=delivered_at,
         )
+
+    def _refuse_on_shared_runner(self) -> None:
+        """Non-retryable, and typed by the rule: there is no Work Record to write Evidence
+        on here, so the failure the platform's sign-in workflow receives names it.
+
+        Only a Runner known to be the person's own signs in: one whose state names no host
+        party (registered before issue 42) is refused too, as `choose_auth_mode` never runs
+        a subscription on it either."""
+
+        if self._host_party != "user":
+            raise ApplicationError(
+                f"this Runner is hosted by {self._host_party!r}; only a person's own Runner "
+                "signs in, a shared Runner runs API keys only",
+                type=SHARED_RUNNER_SIGN_IN_RULE,
+                non_retryable=True,
+            )