agentic-runner 3.30.0__tar.gz → 3.30.2__tar.gz

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.30.0
+Version: 3.30.2
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.30.0
+Requires-Dist: agentic-runner-contracts==3.30.2
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.30.0",
+  "agentic-runner-contracts==3.30.2",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.30.0"
+__version__ = "3.30.2"
 
 __all__ = ["__version__"]

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/auth_mode.py

@@ -142,7 +142,7 @@ def choose_auth_mode(
         raise AuthModeRefusedError(
             SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE,
             "no API key is present for this Contract and its harness root on this Runner holds "
-            "no login; sign it in on this Runner with `agentic-runner sign-in`",
+            "no login; sign it in on this Runner with `agentic-runner sign-in claude` (or `codex`)",
         )
     if AuthMode.SUBSCRIPTION not in runtime_modes:
         raise AuthModeRefusedError(
@@ -216,7 +216,8 @@ def require_named_access(
             raise AuthModeRefusedError(
                 SUBSCRIPTION_NOT_SIGNED_IN_RULE,
                 f"this Directive was routed to the person's subscription, and its sign-in on "
-                f"this Runner is {subscription.value}; run `agentic-runner sign-in` here",
+                f"this Runner is {subscription.value}; run `agentic-runner sign-in claude` (or "
+                "`codex`) here",
             )
         return AuthMode.SUBSCRIPTION
     if access.kind == LlmAccessKind.LLM_KEY:

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/cli.py

@@ -16,7 +16,7 @@ workstation Runner (PRD issue 47, ``workstation.py``): one login agent per Runne
 by the user who hosts it, with no ``sudo`` anywhere. ``<name>`` is the Runner's, the one the
 console lists it under (QTS-1773); a machine with one Runner needs none (QTS-1774).
 
-``sign-in [claude|codex]`` gives a person's own Runner their LLM access: their subscription,
+``sign-in claude|codex`` gives a person's own Runner their LLM access: their subscription,
 through the vendor's own sign-in in this terminal, or an API key stored in the Runner's
 own store (``sign_in.py``, Spec: Runners rev 3). No ids, and no code or token passes
 through the control plane.
@@ -256,12 +256,15 @@ def main(argv: Sequence[str] | None = None) -> int:
     sign_in = subcommands.add_parser(
         "sign-in",
         help="give your own Runner your subscription or an API key, for Claude Code or Codex",
+        # The runtime is named, never defaulted: a bare `sign-in` read as a Claude sign-in
+        # because Claude Code was asked about first (QTS-2159). Usage lists one form each.
+        usage="%(prog)s claude [--method {oauth_token,claude_ai}] [--name NAME]\n"
+        "       %(prog)s codex [--name NAME]",
     )
     sign_in.add_argument(
         "runtime",
-        nargs="?",
         choices=tuple(AGENT_RUNTIMES),
-        help="one Agent Runtime; omitted asks about each one this Runner serves",
+        help="the Agent Runtime to sign in: claude (Claude Code) or codex (Codex)",
     )
     sign_in.add_argument(
         "--method",

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/service.py

@@ -1284,8 +1284,8 @@ def _temporal_worker(client: Client, **kwargs: Any) -> Worker:
     return Worker(client, **kwargs)
 
 
-async def sign_in(which: str | None, *, store: KeyStore, method: str = OAUTH_TOKEN) -> int:
-    """``agentic-runner sign-in [claude|codex]`` (``sign_in.SignIn``), composed here.
+async def sign_in(which: str, *, store: KeyStore, method: str = OAUTH_TOKEN) -> int:
+    """``agentic-runner sign-in claude|codex`` (``sign_in.SignIn``), composed here.
 
     Runs with the Runner's environment (``kubectl exec``, ``docker exec``, or a
     workstation's own), so a subscription gets the uid and the harness root the Contract's

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/sign_in.py

@@ -1,9 +1,10 @@
-"""``agentic-runner sign-in [claude|codex]``: a person gives their own Runner its LLM access.
+"""``agentic-runner sign-in claude|codex``: a person gives their own Runner its LLM access.
 
 One command for Claude Code and Codex, for a subscription or an API key, on a laptop, in
 ``docker exec -it`` or in ``kubectl exec -it`` (Spec: Runners rev 3). It takes no ids: a
 personal Runner serves one Contract, which the last heartbeat ack named
-(``llm_contracts``). With no argument it asks about each Agent Runtime the Runner serves.
+(``llm_contracts``). It names the one Agent Runtime it signs in: a bare ``sign-in`` read as
+a Claude Code sign-in, so the console script refuses it (QTS-2159).
 
 * **An API key** is read without echo and stored in the Runner's own store under the
   provider's key name (``ANTHROPIC_API_KEY``, ``OPENAI_API_KEY``). The running Runner reads
@@ -66,7 +67,7 @@ class SignIn:
     secret: Callable[[str], str]
     say: Callable[[str], None]
 
-    async def run(self, which: str | None) -> int:
+    async def run(self, which: str) -> int:
         if self.host_party != "user":
             hosted = f"hosted by {self.host_party!r}" if self.host_party else "not registered"
             self.say(
@@ -74,22 +75,14 @@ class SignIn:
                 "Runner their access; a pool Runner uses only its pool's keys"
             )
             return 1
-        kinds = [AGENT_RUNTIMES[which]] if which is not None else sorted(self.served)
-        missing = [kind for kind in kinds if kind not in self.served]
-        if missing:
+        kind = AGENT_RUNTIMES[which]
+        if kind not in self.served:
             self.say(
-                f"refusing to sign in: this Runner does not serve {_LABELS[missing[0]]}; "
+                f"refusing to sign in: this Runner does not serve {_LABELS[kind]}; "
                 "install its CLI on this Runner's PATH and restart it"
             )
             return 1
-        if not kinds:
-            self.say("this Runner serves no Agent Runtime: install `claude` or `codex` first")
-            return 1
-        for kind in kinds:
-            outcome = await self._one(kind)
-            if outcome != 0:
-                return outcome
-        return 0
+        return await self._one(kind)
 
     async def _one(self, cli_kind: str) -> int:
         label = _LABELS[cli_kind]

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/skills/agentic-runner-setup/SKILL.md

@@ -115,7 +115,7 @@ own terminal, the one command for their way of installing. On this machine:
 agentic-runner sign-in claude
 ```
 
-`codex` in place of `claude` for Codex; with no argument it asks about each. Add
+`codex` in place of `claude` for Codex; `sign-in` alone is refused. Add
 `--name <name>` only if this machine runs more than one Runner. On Docker it is
 `docker exec -it <container> agentic-runner sign-in claude`, on Kubernetes
 `kubectl exec -it <pod> -c runner -- agentic-runner sign-in claude`.

{agentic_runner-3.30.0 → agentic_runner-3.30.2}/src/agentic_runner/workstation.py

@@ -81,6 +81,7 @@ from agentic_runner_contracts.runner_registration import (
 __all__ = [
     "CLI_FLOORS",
     "CLI_NAMES",
+    "DRAIN_TIMEOUT_SECONDS",
     "ROOT_ENV",
     "CliMissingError",
     "RunnerPaths",
@@ -111,6 +112,10 @@ __all__ = [
 ROOT_ENV: Final = "AGENTIC_RUNNER_WORKSTATION_ROOT"
 
 _LABEL_PREFIX: Final = "agentic-runner"
+# The drain waits out an in-flight Directive (issue 02), as the chart's
+# terminationGracePeriodSeconds does. Without it the service manager SIGKILLs the drain:
+# systemd after 90 s, launchd after 20 s (QTS-2166).
+DRAIN_TIMEOUT_SECONDS: Final = 2100
 
 Run = Callable[..., subprocess.CompletedProcess[str]]
 
@@ -507,6 +512,7 @@ def _launch_agent(
             "RunAtLoad": True,
             # Restart a crash, not a clean `stop`: SIGTERM drains and exits 0.
             "KeepAlive": {"SuccessfulExit": False},
+            "ExitTimeOut": DRAIN_TIMEOUT_SECONDS,
             "ProcessType": "Background",
             "StandardOutPath": str(paths.log),
             "StandardErrorPath": str(paths.log),
@@ -544,9 +550,7 @@ def _systemd_user_unit(
         f"Environment={_systemd_quote('PATH=' + settings.path)}\n"
         "Restart=on-failure\n"
         "RestartSec=10\n"
-        # The drain waits out an in-flight Directive (issue 02); systemd's default 90 s
-        # would SIGKILL it.
-        "TimeoutStopSec=2100\n"
+        f"TimeoutStopSec={DRAIN_TIMEOUT_SECONDS}\n"
         "KillMode=mixed\n\n"
         "[Install]\n"
         "WantedBy=default.target\n"