agentic-runner 3.29.0__tar.gz → 3.30.1__tar.gz

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.29.0
+Version: 3.30.1
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.29.0
+Requires-Dist: agentic-runner-contracts==3.30.1
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.29.0",
+  "agentic-runner-contracts==3.30.1",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.29.0"
+__version__ = "3.30.1"
 
 __all__ = ["__version__"]

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/auth_mode.py

@@ -142,7 +142,7 @@ def choose_auth_mode(
         raise AuthModeRefusedError(
             SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE,
             "no API key is present for this Contract and its harness root on this Runner holds "
-            "no login; sign it in on this Runner with `agentic-runner sign-in`",
+            "no login; sign it in on this Runner with `agentic-runner sign-in claude` (or `codex`)",
         )
     if AuthMode.SUBSCRIPTION not in runtime_modes:
         raise AuthModeRefusedError(
@@ -216,7 +216,8 @@ def require_named_access(
             raise AuthModeRefusedError(
                 SUBSCRIPTION_NOT_SIGNED_IN_RULE,
                 f"this Directive was routed to the person's subscription, and its sign-in on "
-                f"this Runner is {subscription.value}; run `agentic-runner sign-in` here",
+                f"this Runner is {subscription.value}; run `agentic-runner sign-in claude` (or "
+                "`codex`) here",
             )
         return AuthMode.SUBSCRIPTION
     if access.kind == LlmAccessKind.LLM_KEY:

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/cli.py

@@ -11,12 +11,12 @@ namespace and queue this process was assigned. It is idempotent by state file --
 restart re-reads what is already there rather than registering a second Runner against
 the Organisation's cap.
 
-``install | start | stop | status <name>``, ``credential set`` and ``list`` are the
+``install | start | stop | restart | status <name>``, ``credential set`` and ``list`` are the
 workstation Runner (PRD issue 47, ``workstation.py``): one login agent per Runner, managed
 by the user who hosts it, with no ``sudo`` anywhere. ``<name>`` is the Runner's, the one the
 console lists it under (QTS-1773); a machine with one Runner needs none (QTS-1774).
 
-``sign-in [claude|codex]`` gives a person's own Runner their LLM access: their subscription,
+``sign-in claude|codex`` gives a person's own Runner their LLM access: their subscription,
 through the vendor's own sign-in in this terminal, or an API key stored in the Runner's
 own store (``sign_in.py``, Spec: Runners rev 3). No ids, and no code or token passes
 through the control plane.
@@ -215,6 +215,17 @@ def main(argv: Sequence[str] | None = None) -> int:
         driven.add_argument("name", nargs="?", help=_INSTALLED_NAME_HELP)
         driven.add_argument("--root", default=None, type=Path)
 
+    restart = subcommands.add_parser(
+        "restart",
+        help="restart running workstation Runners on the agentic-runner installed now, as "
+        "after `uv tool upgrade`",
+    )
+    restart.add_argument("name", nargs="?", help=_INSTALLED_NAME_HELP)
+    which = restart.add_mutually_exclusive_group()
+    which.add_argument("--name", dest="name_flag", default=None, help=_INSTALLED_NAME_HELP)
+    which.add_argument("--all", action="store_true", help="every Runner running on this machine")
+    restart.add_argument("--root", default=None, type=Path)
+
     listed = subcommands.add_parser(
         "list", help="the workstation Runners installed on this machine, and which are running"
     )
@@ -245,12 +256,15 @@ def main(argv: Sequence[str] | None = None) -> int:
     sign_in = subcommands.add_parser(
         "sign-in",
         help="give your own Runner your subscription or an API key, for Claude Code or Codex",
+        # The runtime is named, never defaulted: a bare `sign-in` read as a Claude sign-in
+        # because Claude Code was asked about first (QTS-2159). Usage lists one form each.
+        usage="%(prog)s claude [--method {oauth_token,claude_ai}] [--name NAME]\n"
+        "       %(prog)s codex [--name NAME]",
     )
     sign_in.add_argument(
         "runtime",
-        nargs="?",
         choices=tuple(AGENT_RUNTIMES),
-        help="one Agent Runtime; omitted asks about each one this Runner serves",
+        help="the Agent Runtime to sign in: claude (Claude Code) or codex (Codex)",
     )
     sign_in.add_argument(
         "--method",
@@ -368,6 +382,8 @@ def main(argv: Sequence[str] | None = None) -> int:
         return asyncio.run(service.run(attestation=_image_attestation(), install=_run_install()))
     if arguments.command in {"install", "start", "stop", "credential"}:
         return _workstation(arguments)
+    if arguments.command == "restart":
+        return _restart(arguments)
     if arguments.command == "list":
         for line in workstation.list_lines(arguments.root or workstation.default_root()):
             print(line)
@@ -462,6 +478,49 @@ def _workstation(arguments: argparse.Namespace) -> int:
         return 1
 
 
+def _restart(arguments: argparse.Namespace) -> int:
+    """``restart <name> | --name <name> | --all``: exit 2 names the Runners installed here.
+
+    A stopped Runner is not started: it was stopped on purpose, and ``systemctl restart``
+    would start it where ``launchctl kickstart`` refuses to, so the two OSes would differ.
+    """
+
+    root = arguments.root or workstation.default_root()
+    name = arguments.name or arguments.name_flag
+    if arguments.all and name:
+        print("restart takes a name or --all, not both", file=sys.stderr)
+        return 2
+    try:
+        if arguments.all:
+            targets = [
+                workstation.RunnerPaths(root=root, name=installed)
+                for installed in workstation.installed_names(root)
+            ]
+            if not targets:
+                raise ValueError(f"no workstation Runner is installed under {root}")
+        elif name:
+            targets = [workstation.installed_runner(root, name)]
+        else:
+            targets = [workstation.only_runner(root, how="name one, or restart --all")]
+    except ValueError as error:
+        print(error, file=sys.stderr)
+        return 2
+    failed = False
+    for paths in targets:
+        if workstation.process_id(paths) is None:
+            print(f"{paths.name} is stopped; `agentic-runner start {paths.name}` starts it")
+            failed = failed or not arguments.all
+            continue
+        try:
+            pid, version = workstation.restart(paths)
+        except (FileNotFoundError, RuntimeError) as error:
+            print(f"{paths.name}: restart failed: {error}", file=sys.stderr)
+            failed = True
+            continue
+        print(f"restarted {paths.name}: pid {pid}, agentic-runner {version}")
+    return 1 if failed else 0
+
+
 def _image_attestation() -> HostAttestation:
     """What a container Runner says about itself, where issue 47 gave the workstation its
     own: the CLIs it found are what the registry serves and routing matches on."""

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/service.py

@@ -1284,8 +1284,8 @@ def _temporal_worker(client: Client, **kwargs: Any) -> Worker:
     return Worker(client, **kwargs)
 
 
-async def sign_in(which: str | None, *, store: KeyStore, method: str = OAUTH_TOKEN) -> int:
-    """``agentic-runner sign-in [claude|codex]`` (``sign_in.SignIn``), composed here.
+async def sign_in(which: str, *, store: KeyStore, method: str = OAUTH_TOKEN) -> int:
+    """``agentic-runner sign-in claude|codex`` (``sign_in.SignIn``), composed here.
 
     Runs with the Runner's environment (``kubectl exec``, ``docker exec``, or a
     workstation's own), so a subscription gets the uid and the harness root the Contract's
@@ -1301,14 +1301,17 @@ async def sign_in(which: str | None, *, store: KeyStore, method: str = OAUTH_TOK
         can = can_separate_uids()
         try:
             require_isolation_supported(mode, can_separate_uids=can)
+            # `run` gives the settings this default; a sign-in must build the same ones, or a
+            # workstation, whose environment sets only the control plane, is refused (QTS-2157).
+            _default_callback_url(os.environ.get(CONTROL_PLANE_ENV, "").strip())
             settings = get_worker_settings()
         except RunnerRegistrationError as error:
             print(f"refusing to sign in ({error.reason}): {error}", file=sys.stderr)
             return 1
-        except ValidationError:
+        except ValidationError as error:
             print(
-                "refusing to sign in: run this with the Runner's environment (`docker exec`, "
-                "`kubectl exec`, or on the workstation that runs it)",
+                f"refusing to sign in: {_invalid_settings(error)}; run this with the Runner's "
+                "environment (`docker exec`, `kubectl exec`, or on the workstation that runs it)",
                 file=sys.stderr,
             )
             return 2
@@ -1336,6 +1339,22 @@ async def sign_in(which: str | None, *, store: KeyStore, method: str = OAUTH_TOK
 _SIGN_IN_CLIS: Final[Mapping[str, str]] = {"claude_code": "claude", "codex_cli": "codex"}
 
 
+def _default_callback_url(control_plane: str) -> None:
+    # The control plane the activities call back is the one this process registered
+    # with, unless the operator points them at an internal address explicitly.
+    if control_plane:
+        os.environ.setdefault("INTERNAL_FASTAPI_BASE_URL", control_plane)
+
+
+def _invalid_settings(error: ValidationError) -> str:
+    """``INTERNAL_FASTAPI_BASE_URL (Field required)``, one per field, never the value."""
+
+    return ", ".join(
+        f"{'.'.join(str(part) for part in detail['loc'])} ({detail['msg']})"
+        for detail in error.errors(include_input=False, include_url=False)
+    )
+
+
 async def run(
     *,
     http_client: httpx.AsyncClient | None = None,
@@ -1416,9 +1435,7 @@ async def _run(
     except (RunnerRegistrationError, UnsafeStateError) as error:
         print(f"refusing to start ({error.reason}): {error}", flush=True)
         return 1
-    # The control plane the activities call back is the one this process registered
-    # with, unless the operator points them at an internal address explicitly.
-    os.environ.setdefault("INTERNAL_FASTAPI_BASE_URL", control_plane)
+    _default_callback_url(control_plane)
     settings = get_worker_settings()
     try:
         attestation = with_profile_acp_cli_kinds(with_acp_bridges(attestation, settings), settings)

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/sign_in.py

@@ -1,9 +1,10 @@
-"""``agentic-runner sign-in [claude|codex]``: a person gives their own Runner its LLM access.
+"""``agentic-runner sign-in claude|codex``: a person gives their own Runner its LLM access.
 
 One command for Claude Code and Codex, for a subscription or an API key, on a laptop, in
 ``docker exec -it`` or in ``kubectl exec -it`` (Spec: Runners rev 3). It takes no ids: a
 personal Runner serves one Contract, which the last heartbeat ack named
-(``llm_contracts``). With no argument it asks about each Agent Runtime the Runner serves.
+(``llm_contracts``). It names the one Agent Runtime it signs in: a bare ``sign-in`` read as
+a Claude Code sign-in, so the console script refuses it (QTS-2159).
 
 * **An API key** is read without echo and stored in the Runner's own store under the
   provider's key name (``ANTHROPIC_API_KEY``, ``OPENAI_API_KEY``). The running Runner reads
@@ -66,7 +67,7 @@ class SignIn:
     secret: Callable[[str], str]
     say: Callable[[str], None]
 
-    async def run(self, which: str | None) -> int:
+    async def run(self, which: str) -> int:
         if self.host_party != "user":
             hosted = f"hosted by {self.host_party!r}" if self.host_party else "not registered"
             self.say(
@@ -74,22 +75,14 @@ class SignIn:
                 "Runner their access; a pool Runner uses only its pool's keys"
             )
             return 1
-        kinds = [AGENT_RUNTIMES[which]] if which is not None else sorted(self.served)
-        missing = [kind for kind in kinds if kind not in self.served]
-        if missing:
+        kind = AGENT_RUNTIMES[which]
+        if kind not in self.served:
             self.say(
-                f"refusing to sign in: this Runner does not serve {_LABELS[missing[0]]}; "
+                f"refusing to sign in: this Runner does not serve {_LABELS[kind]}; "
                 "install its CLI on this Runner's PATH and restart it"
             )
             return 1
-        if not kinds:
-            self.say("this Runner serves no Agent Runtime: install `claude` or `codex` first")
-            return 1
-        for kind in kinds:
-            outcome = await self._one(kind)
-            if outcome != 0:
-                return outcome
-        return 0
+        return await self._one(kind)
 
     async def _one(self, cli_kind: str) -> int:
         label = _LABELS[cli_kind]

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/skills/agentic-runner-setup/SKILL.md

@@ -115,7 +115,7 @@ own terminal, the one command for their way of installing. On this machine:
 agentic-runner sign-in claude
 ```
 
-`codex` in place of `claude` for Codex; with no argument it asks about each. Add
+`codex` in place of `claude` for Codex; `sign-in` alone is refused. Add
 `--name <name>` only if this machine runs more than one Runner. On Docker it is
 `docker exec -it <container> agentic-runner sign-in claude`, on Kubernetes
 `kubectl exec -it <pod> -c runner -- agentic-runner sign-in claude`.

{agentic_runner-3.29.0 → agentic_runner-3.30.1}/src/agentic_runner/workstation.py

@@ -1,7 +1,7 @@
 """The workstation Runner: one login agent per Runner (PRD issue 47, map ticket 23).
 
-``agentic-runner install | start | stop | status <name>`` and ``list``. Everything a CI-runner
-precedent does on a developer machine and nothing a daemon would need:
+``agentic-runner install | start | stop | restart | status <name>`` and ``list``. Everything
+a CI-runner precedent does on a developer machine and nothing a daemon would need:
 
 * **One process per Runner** (23 item 3), each with its own state directory, identity,
   namespace, Runner Token, hooks, credential store and Workspaces under ``<root>/<name>/``.
@@ -37,11 +37,12 @@ import shutil
 import subprocess
 import sys
 import tempfile
+import time
 from collections.abc import Callable, Mapping, Sequence
 from dataclasses import dataclass
 from datetime import UTC, datetime
 from pathlib import Path
-from typing import Any, Final
+from typing import Any, Final, Literal
 from xml.sax.saxutils import escape
 
 import httpx
@@ -91,11 +92,13 @@ __all__ = [
     "install",
     "install_channel",
     "installed_names",
+    "installed_runner",
     "list_lines",
     "locate_clis",
     "only_runner",
     "parse_acp_cli_kinds",
     "require_any_cli",
+    "restart",
     "run_environment",
     "run_process",
     "service_definition",
@@ -158,6 +161,16 @@ def installed_names(root: Path) -> list[str]:
     )
 
 
+def installed_runner(root: Path, name: str) -> RunnerPaths:
+    """``<name>``, refused with the names installed here when it is not one of them."""
+
+    names = installed_names(root)
+    if name in names:
+        return RunnerPaths(root=root, name=name)
+    installed = ", ".join(names) if names else "none"
+    raise ValueError(f"no Runner named {name!r} is installed under {root}; installed: {installed}")
+
+
 def only_runner(root: Path, *, how: str = "name one") -> RunnerPaths:
     """The one Runner installed here, so a command needs no name (QTS-1774)."""
 
@@ -444,6 +457,7 @@ class ServiceDefinition:
     install: list[list[str]]
     start: list[list[str]]
     stop: list[list[str]]
+    restart: list[list[str]]
 
 
 def runner_command(name: str, root: Path) -> list[str]:
@@ -504,6 +518,9 @@ def _launch_agent(
         install=[],
         start=[["launchctl", "bootstrap", domain, str(plist)]],
         stop=[["launchctl", "bootout", f"{domain}/{name}"]],
+        # One call, not bootout then bootstrap: launchd refuses a bootstrap of a label it
+        # still holds, and it holds it until the old process has drained.
+        restart=[["launchctl", "kickstart", "-k", f"{domain}/{name}"]],
     )
 
 
@@ -546,6 +563,7 @@ def _systemd_user_unit(
         ],
         start=[[*systemctl, "enable", "--now", unit_name]],
         stop=[[*systemctl, "disable", "--now", unit_name]],
+        restart=[[*systemctl, "restart", unit_name]],
     )
 
 
@@ -599,6 +617,10 @@ def _logon_task(
             ["schtasks", "/End", "/TN", task_name],
             ["schtasks", "/Change", "/TN", task_name, "/DISABLE"],
         ],
+        restart=[
+            ["schtasks", "/End", "/TN", task_name],
+            ["schtasks", "/Run", "/TN", task_name],
+        ],
     )
 
 
@@ -837,9 +859,36 @@ def stop(paths: RunnerPaths, **driver: Any) -> None:
     _drive_service(paths, "stop", **driver)
 
 
+def restart(
+    paths: RunnerPaths,
+    *,
+    timeout: float = 60.0,
+    sleep: Callable[[float], None] = time.sleep,
+    clock: Callable[[], float] = time.monotonic,
+    **driver: Any,
+) -> tuple[int, str]:
+    """Restart a running Runner and wait for its new process: ``(pid, version)``.
+
+    ``uv tool upgrade`` replaces the console script, not the process, so a login agent keeps
+    running the old version until this (QTS-2158). The process writes its version before
+    its pidfile, so a new pid means the version beside it is the new process's.
+    """
+
+    previous = process_id(paths)
+    _drive_service(paths, "restart", **driver)
+    deadline = clock() + timeout
+    while (pid := process_id(paths)) is None or pid == previous:
+        if clock() >= deadline:
+            raise RuntimeError(
+                f"no new process wrote {paths.pidfile} within {timeout:.0f}s; see {paths.log}"
+            )
+        sleep(0.5)
+    return pid, paths.started_version.read_text(encoding="utf-8").strip()
+
+
 def _drive_service(
     paths: RunnerPaths,
-    verb: str,
+    verb: Literal["start", "stop", "restart"],
     *,
     platform: str = sys.platform,
     home: Path | None = None,
@@ -847,7 +896,7 @@ def _drive_service(
 ) -> None:
     settings = WorkstationSettings.load(paths)
     definition = service_definition(paths, settings, platform=platform, home=home)
-    drive(definition.start if verb == "start" else definition.stop, run=run)
+    drive(getattr(definition, verb), run=run)
 
 
 def run_process(paths: RunnerPaths, *, login_agent: bool) -> int: