agentic-runner 3.4.1__tar.gz → 3.5.0__tar.gz

{agentic_runner-3.4.1 → agentic_runner-3.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.4.1
+Version: 3.5.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.4.1 → agentic_runner-3.5.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.4.1"
+__version__ = "3.5.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.4.1 → agentic_runner-3.5.0}/src/agentic_runner/activities.py

@@ -29,7 +29,7 @@ import shlex
 import shutil
 import tempfile
 import time
-from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
+from collections.abc import AsyncIterator, Awaitable, Callable, Mapping, Sequence
 from dataclasses import asdict, dataclass, field, fields, replace
 from datetime import UTC, datetime
 from pathlib import Path
@@ -128,6 +128,8 @@ from agentic_runner.workers.agent_runtime import (
     AuthMode,
     DirectiveRequest,
     DirectiveResult,
+    ModelUsage,
+    PermissionFallback,
     ResumableAgentRuntime,
 )
 from agentic_runner.workers.contract_device_login import login_file_counts
@@ -588,6 +590,9 @@ class _RuntimeContextState:
     # on the Profile's `command_policy` blob — the sandbox floor already lives there, and
     # a ceiling is exactly a floor rule. None means the Runner's own default applies.
     memory_limit_bytes: int | None = None
+    # PRD decision 12: what a runtime asked per command does when the command policy has
+    # no answer. Carried on the same `command_policy` blob as the ceiling above.
+    permission_fallback: PermissionFallback = PermissionFallback.DENY
     # Pushed on change and applied on receipt (ADR-0011 §11, PRD issue 44): the evaluator
     # is local, so a narrowing lands on the next verb this state is read for.
     grant_snapshot: GrantSnapshot = UNENFORCED_SNAPSHOT
@@ -1296,6 +1301,56 @@ def _profile_memory_limit_bytes(command_policy: Mapping[str, object]) -> int | N
     return None
 
 
+def _model_usage_reports(
+    cli_kind: str, model_usage: Sequence[ModelUsage]
+) -> list[tuple[dict[str, Any], str | None]]:
+    """A harness's per-model usage in the shapes the harness usage route already prices.
+
+    Claude Code: one ``result`` message whose ``modelUsage`` names every model. Codex: one
+    ``turn.completed.usage`` per model, whose ``input_tokens`` includes the cached reads,
+    with the model the harness itself named rather than the Agent's configured one.
+    """
+
+    if cli_kind == "claude_code":
+        return [
+            (
+                {
+                    "type": "result",
+                    "modelUsage": {
+                        row.model: {
+                            "inputTokens": row.input_tokens,
+                            "outputTokens": row.output_tokens,
+                            "cacheReadInputTokens": row.cached_read_tokens,
+                            "cacheCreationInputTokens": row.cached_write_tokens,
+                        }
+                        for row in model_usage
+                    },
+                },
+                None,
+            )
+        ]
+    return [
+        (
+            {
+                "input_tokens": row.input_tokens + row.cached_read_tokens,
+                "cached_input_tokens": row.cached_read_tokens,
+                "output_tokens": row.output_tokens,
+                "reasoning_output_tokens": row.reasoning_output_tokens,
+            },
+            row.model,
+        )
+        for row in model_usage
+    ]
+
+
+def _profile_permission_fallback(command_policy: Mapping[str, object]) -> PermissionFallback:
+    """The Profile's `permission_fallback`; anything but exactly ``hold`` is ``deny``."""
+
+    if command_policy.get("permission_fallback") == PermissionFallback.HOLD.value:
+        return PermissionFallback.HOLD
+    return PermissionFallback.DENY
+
+
 def _contract_workspace_path(
     *,
     workspace_root: Path,
@@ -1992,6 +2047,7 @@ class RunnerRalphActivities:
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
+                    permission_fallback=runtime_state.permission_fallback,
                     prompt=attempt.skills_preamble
                     + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
@@ -3363,6 +3419,7 @@ class RunnerRalphActivities:
             cli_kind=runtime_context.cli_kind,
             model=runtime_context.model,
             memory_limit_bytes=_profile_memory_limit_bytes(runtime_context.command_policy),
+            permission_fallback=_profile_permission_fallback(runtime_context.command_policy),
             grant_snapshot=snapshot,
             grant_snapshot_payload=snapshot_payload,
             persona_slug=runtime_context.persona_slug,
@@ -4636,6 +4693,7 @@ class RunnerRalphActivities:
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
+                    permission_fallback=state.permission_fallback,
                     prompt=attempt.skills_preamble
                     + _learning_prompt(
                         request,
@@ -4896,6 +4954,7 @@ class RunnerRalphActivities:
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
+                    permission_fallback=state.permission_fallback,
                     prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,
@@ -5155,38 +5214,41 @@ class RunnerRalphActivities:
         if auth_mode == AuthMode.API_KEY:
             return
         directive = directive_id(work_record_id=work_record_id, directive_number=directive_number)
-        if runtime_state.cli_kind == "claude_code":
+        reports: list[tuple[dict[str, Any], str | None]]
+        if result.model_usage:
+            reports = _model_usage_reports(runtime_state.cli_kind, result.model_usage)
+        elif runtime_state.cli_kind == "claude_code":
             usage_event = extract_claude_result(result.stdout)
-            model_name = None
+            reports = [(usage_event, None)] if usage_event else []
         else:
             usage_event = extract_codex_turn_usage(result.stdout)
-            model_name = runtime_state.model or None
-        if not usage_event:
-            return
-        if runtime_state.cli_kind != "claude_code" and model_name is None:
-            # The backend 422s a Codex harness report with no model (`report_harness_usage`
-            # requires one to price it), and the `suppress` below swallows that -- an Agent
-            # with no model configured would otherwise lose this Usage Record with no trace.
-            activity.logger.warning(
-                "harness usage unreported: Agent %s has no model configured for a Codex "
-                "harness Directive (work record %s)",
-                runtime_state.agent_id,
-                work_record_id,
-            )
-        with contextlib.suppress(Exception):  # noqa: BLE001 - metering never fails a Directive
-            await self._fastapi_client.report_harness_usage(
-                {
-                    "work_record_id": work_record_id,
-                    "agent_id": runtime_state.agent_id,
-                    "contract_id": runtime_state.contract_id,
-                    "directive_id": directive,
-                    "runner_id": None,
-                    "runtime_kind": runtime_state.cli_kind,
-                    "provider_name": runtime_state.cli_kind,
-                    "model_name": model_name,
-                    "usage_event": usage_event,
-                }
-            )
+            reports = [(usage_event, runtime_state.model or None)] if usage_event else []
+        for usage_event, model_name in reports:
+            if runtime_state.cli_kind != "claude_code" and model_name is None:
+                # The backend 422s a Codex harness report with no model
+                # (`report_harness_usage` requires one to price it), and the `suppress`
+                # below swallows that -- an Agent with no model configured would otherwise
+                # lose this Usage Record with no trace.
+                activity.logger.warning(
+                    "harness usage unreported: Agent %s has no model configured for a Codex "
+                    "harness Directive (work record %s)",
+                    runtime_state.agent_id,
+                    work_record_id,
+                )
+            with contextlib.suppress(Exception):  # noqa: BLE001 - metering never fails a Directive
+                await self._fastapi_client.report_harness_usage(
+                    {
+                        "work_record_id": work_record_id,
+                        "agent_id": runtime_state.agent_id,
+                        "contract_id": runtime_state.contract_id,
+                        "directive_id": directive,
+                        "runner_id": None,
+                        "runtime_kind": runtime_state.cli_kind,
+                        "provider_name": runtime_state.cli_kind,
+                        "model_name": model_name,
+                        "usage_event": usage_event,
+                    }
+                )
 
     async def _harness_hold(
         self,

{agentic_runner-3.4.1 → agentic_runner-3.5.0}/src/agentic_runner/service.py

@@ -99,6 +99,7 @@ from agentic_runner.sealed_box import (
 from agentic_runner.tiny_http import HttpRequest, read_request, write_json
 from agentic_runner.triage_activities import RunnerTriageActivities
 from agentic_runner.user_sources import ProxyTriage, UserSourcePoller
+from agentic_runner.workers.acp_runtime import ACP_BRIDGES, AcpRuntime
 from agentic_runner.workers.agent_runtime import AgentRuntime
 from agentic_runner.workers.claude_runtime import ClaudeRuntime
 from agentic_runner.workers.codex_runtime import CodexRuntime
@@ -388,10 +389,18 @@ def build_agent_runtimes(
     picks from here by the Work Record's `cli_kind` (local-agents 01) -- there is no
     process-wide choice. The same `clis` ride the heartbeat's attestation, so what this
     Runner serves and what routing believes it serves are one list.
+
+    Which runtime serves a kind -- its pinned ACP bridge or the per-CLI one -- is this
+    Runner's setting (`ACP_CLI_KINDS`), never the payload's (local-agents 12 items 6, 7).
     """
 
+    acp_kinds = {kind.strip() for kind in settings.ACP_CLI_KINDS.split(",") if kind.strip()}
     return {
-        cli.cli_kind: _RUNTIMES[cli.cli_kind](settings)
+        cli.cli_kind: (
+            AcpRuntime(cli_kind=cli.cli_kind, settings=settings)
+            if cli.cli_kind in acp_kinds and cli.cli_kind in ACP_BRIDGES
+            else _RUNTIMES[cli.cli_kind](settings)
+        )
         for cli in clis
         if cli.meets_floor and cli.cli_kind in _RUNTIMES
     }

{agentic_runner-3.4.1 → agentic_runner-3.5.0}/src/agentic_runner/testing/control_plane.py

@@ -37,7 +37,7 @@ from dataclasses import dataclass, field
 from datetime import UTC, datetime, timedelta
 from email.utils import formatdate
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any, Literal
+from typing import Any
 from uuid import UUID, uuid4
 
 import httpx
@@ -166,7 +166,7 @@ class FakeControlPlane:
     contracts_floor: str = contracts_version
     contract_id: UUID = DEFAULT_CONTRACT_ID
     agent_id: UUID = DEFAULT_AGENT_ID
-    cli_kind: Literal["codex_cli", "claude_code"] = "codex_cli"
+    cli_kind: str = "codex_cli"
 
     bootstraps: list[BootstrapRequest] = field(default_factory=list)
     runner_ids: list[UUID] = field(default_factory=list)

{agentic_runner-3.4.1 → agentic_runner-3.5.0}/src/agentic_runner/workers/_runtime_support.py

@@ -42,7 +42,10 @@ from agentic_runner.workers.contract_isolation import DirectiveSandbox
 # the funder anyway, or route it round the Profile's egress allow-list. The two Claude Code
 # bearers are here for the last reason too: either would authenticate the harness on a
 # credential the Runner never chose, around the proxy and the mode it decided
-# (local-agents 04; research 01 §4 gap 6).
+# (local-agents 04; research 01 §4 gap 6). The ACP bridges' control variables are here
+# for the same reason (local-agents 12): each swaps the vendor binary, hands approvals
+# back to the harness's own reviewer, authenticates the bridge, or re-enables the MCP
+# filtering that drops a granted server.
 RESERVED_DIRECTIVE_ENV: Final[frozenset[str]] = frozenset(
     {
         "HOME",
@@ -53,6 +56,20 @@ RESERVED_DIRECTIVE_ENV: Final[frozenset[str]] = frozenset(
         "ANTHROPIC_API_KEY",
         "ANTHROPIC_AUTH_TOKEN",
         "CLAUDE_CODE_OAUTH_TOKEN",
+        "CODEX_PATH",
+        "CODEX_CONFIG",
+        "CODEX_API_KEY",
+        "MODEL_PROVIDER",
+        "DEFAULT_AUTH_REQUEST",
+        "INITIAL_AGENT_MODE",
+        "NO_BROWSER",
+        "APP_SERVER_LOGS",
+        "DISABLE_MCP_CONFIG_FILTERING",
+        "CLAUDE_CODE_EXECUTABLE",
+        "CLAUDE_MODEL_CONFIG",
+        "CLAUDE_AGENT_LOGS",
+        "MAX_THINKING_TOKENS",
+        "ANTHROPIC_MODEL",
         CALLBACK_SOCKET_ENV,
         CALLBACK_TOKEN_ENV,
         *PROXY_ENV_NAMES,
@@ -154,10 +171,10 @@ async def run_subprocess_exec(
                     timeout=timeout_seconds,
                 )
             except (TimeoutError, asyncio.CancelledError):
-                await _terminate_process_tree(process)
+                await terminate_process_tree(process)
                 raise
     except PriorAttemptAliveError:
-        await _terminate_process_tree(process)
+        await terminate_process_tree(process)
         raise
 
     return SubprocessResult(
@@ -240,7 +257,7 @@ async def _read_stream_limited(
     return bytes(tail), total_bytes > limit_bytes
 
 
-async def _terminate_process_tree(process: asyncio.subprocess.Process) -> None:
+async def terminate_process_tree(process: asyncio.subprocess.Process) -> None:
     if process.returncode is not None:
         return
     with contextlib.suppress(ProcessLookupError, PermissionError):
@@ -379,7 +396,7 @@ async def run_subprocess_launch_and_detach(
         raise RuntimeError(f"process failed to start: {error.__class__.__name__}") from None
 
     if process.stdout is None:
-        await _terminate_process_tree(process)
+        await terminate_process_tree(process)
         raise RuntimeError("process stdout stream was unavailable")
 
     loop = asyncio.get_running_loop()
@@ -408,7 +425,7 @@ async def run_subprocess_launch_and_detach(
                 _detach(process)
                 return text
     except BaseException:
-        await _terminate_process_tree(process)
+        await terminate_process_tree(process)
         raise