agentic-runner 3.4.2__tar.gz → 3.6.0__tar.gz

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.4.2
+Version: 3.6.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.4.2"
+__version__ = "3.6.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/activities.py

@@ -29,7 +29,7 @@ import shlex
 import shutil
 import tempfile
 import time
-from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
+from collections.abc import AsyncIterator, Awaitable, Callable, Mapping, Sequence
 from dataclasses import asdict, dataclass, field, fields, replace
 from datetime import UTC, datetime
 from pathlib import Path
@@ -128,6 +128,8 @@ from agentic_runner.workers.agent_runtime import (
     AuthMode,
     DirectiveRequest,
     DirectiveResult,
+    ModelUsage,
+    PermissionFallback,
     ResumableAgentRuntime,
 )
 from agentic_runner.workers.contract_device_login import login_file_counts
@@ -588,6 +590,9 @@ class _RuntimeContextState:
     # on the Profile's `command_policy` blob — the sandbox floor already lives there, and
     # a ceiling is exactly a floor rule. None means the Runner's own default applies.
     memory_limit_bytes: int | None = None
+    # PRD decision 12: what a runtime asked per command does when the command policy has
+    # no answer. Carried on the same `command_policy` blob as the ceiling above.
+    permission_fallback: PermissionFallback = PermissionFallback.DENY
     # Pushed on change and applied on receipt (ADR-0011 §11, PRD issue 44): the evaluator
     # is local, so a narrowing lands on the next verb this state is read for.
     grant_snapshot: GrantSnapshot = UNENFORCED_SNAPSHOT
@@ -1296,6 +1301,56 @@ def _profile_memory_limit_bytes(command_policy: Mapping[str, object]) -> int | N
     return None
 
 
+def _model_usage_reports(
+    cli_kind: str, model_usage: Sequence[ModelUsage]
+) -> list[tuple[dict[str, Any], str | None]]:
+    """A harness's per-model usage in the shapes the harness usage route already prices.
+
+    Claude Code: one ``result`` message whose ``modelUsage`` names every model. Codex: one
+    ``turn.completed.usage`` per model, whose ``input_tokens`` includes the cached reads,
+    with the model the harness itself named rather than the Agent's configured one.
+    """
+
+    if cli_kind == "claude_code":
+        return [
+            (
+                {
+                    "type": "result",
+                    "modelUsage": {
+                        row.model: {
+                            "inputTokens": row.input_tokens,
+                            "outputTokens": row.output_tokens,
+                            "cacheReadInputTokens": row.cached_read_tokens,
+                            "cacheCreationInputTokens": row.cached_write_tokens,
+                        }
+                        for row in model_usage
+                    },
+                },
+                None,
+            )
+        ]
+    return [
+        (
+            {
+                "input_tokens": row.input_tokens + row.cached_read_tokens,
+                "cached_input_tokens": row.cached_read_tokens,
+                "output_tokens": row.output_tokens,
+                "reasoning_output_tokens": row.reasoning_output_tokens,
+            },
+            row.model,
+        )
+        for row in model_usage
+    ]
+
+
+def _profile_permission_fallback(command_policy: Mapping[str, object]) -> PermissionFallback:
+    """The Profile's `permission_fallback`; anything but exactly ``hold`` is ``deny``."""
+
+    if command_policy.get("permission_fallback") == PermissionFallback.HOLD.value:
+        return PermissionFallback.HOLD
+    return PermissionFallback.DENY
+
+
 def _contract_workspace_path(
     *,
     workspace_root: Path,
@@ -1992,6 +2047,7 @@ class RunnerRalphActivities:
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
+                    permission_fallback=runtime_state.permission_fallback,
                     prompt=attempt.skills_preamble
                     + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
@@ -3363,6 +3419,7 @@ class RunnerRalphActivities:
             cli_kind=runtime_context.cli_kind,
             model=runtime_context.model,
             memory_limit_bytes=_profile_memory_limit_bytes(runtime_context.command_policy),
+            permission_fallback=_profile_permission_fallback(runtime_context.command_policy),
             grant_snapshot=snapshot,
             grant_snapshot_payload=snapshot_payload,
             persona_slug=runtime_context.persona_slug,
@@ -4636,6 +4693,7 @@ class RunnerRalphActivities:
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
+                    permission_fallback=state.permission_fallback,
                     prompt=attempt.skills_preamble
                     + _learning_prompt(
                         request,
@@ -4896,6 +4954,7 @@ class RunnerRalphActivities:
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
+                    permission_fallback=state.permission_fallback,
                     prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,
@@ -5155,38 +5214,41 @@ class RunnerRalphActivities:
         if auth_mode == AuthMode.API_KEY:
             return
         directive = directive_id(work_record_id=work_record_id, directive_number=directive_number)
-        if runtime_state.cli_kind == "claude_code":
+        reports: list[tuple[dict[str, Any], str | None]]
+        if result.model_usage:
+            reports = _model_usage_reports(runtime_state.cli_kind, result.model_usage)
+        elif runtime_state.cli_kind == "claude_code":
             usage_event = extract_claude_result(result.stdout)
-            model_name = None
+            reports = [(usage_event, None)] if usage_event else []
         else:
             usage_event = extract_codex_turn_usage(result.stdout)
-            model_name = runtime_state.model or None
-        if not usage_event:
-            return
-        if runtime_state.cli_kind != "claude_code" and model_name is None:
-            # The backend 422s a Codex harness report with no model (`report_harness_usage`
-            # requires one to price it), and the `suppress` below swallows that -- an Agent
-            # with no model configured would otherwise lose this Usage Record with no trace.
-            activity.logger.warning(
-                "harness usage unreported: Agent %s has no model configured for a Codex "
-                "harness Directive (work record %s)",
-                runtime_state.agent_id,
-                work_record_id,
-            )
-        with contextlib.suppress(Exception):  # noqa: BLE001 - metering never fails a Directive
-            await self._fastapi_client.report_harness_usage(
-                {
-                    "work_record_id": work_record_id,
-                    "agent_id": runtime_state.agent_id,
-                    "contract_id": runtime_state.contract_id,
-                    "directive_id": directive,
-                    "runner_id": None,
-                    "runtime_kind": runtime_state.cli_kind,
-                    "provider_name": runtime_state.cli_kind,
-                    "model_name": model_name,
-                    "usage_event": usage_event,
-                }
-            )
+            reports = [(usage_event, runtime_state.model or None)] if usage_event else []
+        for usage_event, model_name in reports:
+            if runtime_state.cli_kind != "claude_code" and model_name is None:
+                # The backend 422s a Codex harness report with no model
+                # (`report_harness_usage` requires one to price it), and the `suppress`
+                # below swallows that -- an Agent with no model configured would otherwise
+                # lose this Usage Record with no trace.
+                activity.logger.warning(
+                    "harness usage unreported: Agent %s has no model configured for a Codex "
+                    "harness Directive (work record %s)",
+                    runtime_state.agent_id,
+                    work_record_id,
+                )
+            with contextlib.suppress(Exception):  # noqa: BLE001 - metering never fails a Directive
+                await self._fastapi_client.report_harness_usage(
+                    {
+                        "work_record_id": work_record_id,
+                        "agent_id": runtime_state.agent_id,
+                        "contract_id": runtime_state.contract_id,
+                        "directive_id": directive,
+                        "runner_id": None,
+                        "runtime_kind": runtime_state.cli_kind,
+                        "provider_name": runtime_state.cli_kind,
+                        "model_name": model_name,
+                        "usage_event": usage_event,
+                    }
+                )
 
     async def _harness_hold(
         self,

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/device_login_activities.py

@@ -13,7 +13,8 @@ from datetime import UTC, datetime
 from temporalio import activity
 from temporalio.exceptions import ApplicationError
 
-from agentic_runner.auth_mode import SHARED_RUNNER_SIGN_IN_RULE
+from agentic_runner.auth_mode import SHARED_RUNNER_SIGN_IN_RULE, is_shared_runner
+from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import ContractIsolation
 from agentic_runner_contracts.activity_io import (
@@ -36,10 +37,10 @@ class ContractDeviceLoginActivities:
         host_party: str | None = None,
     ) -> None:
         self._contract_isolation = contract_isolation
-        # The party this process was registered as hosted by. A shared Runner never runs a
-        # subscription, so it never starts or reads one either (local-agents 04).
+        # The party this process was registered as hosted by. A shared Runner signs in only
+        # a Claude Code long-lived token (local-agents 04, amended by 21).
         self._host_party = host_party
-        # Injectable for tests; None falls through to the real `codex` subprocess.
+        # Injectable for tests; None falls through to the real vendor CLIs.
         self._device_login = device_login or ContractDeviceLogin(contract_isolation)
 
     def activity_callables(self) -> list[Callable[..., object]]:
@@ -52,9 +53,12 @@ class ContractDeviceLoginActivities:
     async def sign_in_contract_device_login(
         self, request: ContractDeviceLoginInput
     ) -> ContractDeviceLoginResult:
-        self._refuse_on_shared_runner()
+        long_lived = request.runtime_kind == "claude_code" and (request.method or OAUTH_TOKEN) == (
+            OAUTH_TOKEN
+        )
+        self._refuse_on_shared_runner(allow=long_lived)
         prompt = await self._device_login.sign_in(
-            request.contract_id, runtime_kind=request.runtime_kind
+            request.contract_id, runtime_kind=request.runtime_kind, method=request.method
         )
         return ContractDeviceLoginResult(
             contract_id=prompt.contract_id,
@@ -62,12 +66,24 @@ class ContractDeviceLoginActivities:
             verification_uri=prompt.verification_uri,
             user_code=prompt.user_code,
             expires_at=prompt.expires_at.isoformat(),
+            sign_in_id=prompt.sign_in_id,
         )
 
     @activity.defn(name="check_contract_device_login_status")
     async def check_contract_device_login_status(
         self, request: ContractDeviceLoginStatusInput
     ) -> ContractDeviceLoginStatusResult:
+        if request.runtime_kind == "claude_code":
+            self._refuse_on_shared_runner(allow=True)
+            status = await self._device_login.claude.status(request.contract_id)
+            return ContractDeviceLoginStatusResult(
+                contract_id=request.contract_id,
+                runtime_kind=request.runtime_kind,
+                token_present=status.logged_in,
+                delivered_at=None,
+                auth_method=status.auth_method,
+                subscription_type=status.subscription_type,
+            )
         self._refuse_on_shared_runner()
         present = self._device_login.token_present(
             request.contract_id, runtime_kind=request.runtime_kind
@@ -86,18 +102,20 @@ class ContractDeviceLoginActivities:
             delivered_at=delivered_at,
         )
 
-    def _refuse_on_shared_runner(self) -> None:
+    def _refuse_on_shared_runner(self, *, allow: bool = False) -> None:
         """Non-retryable, and typed by the rule: there is no Work Record to write Evidence
         on here, so the failure the platform's sign-in workflow receives names it.
 
-        Only a Runner known to be the person's own signs in: one whose state names no host
-        party (registered before issue 42) is refused too, as `choose_auth_mode` never runs
-        a subscription on it either."""
+        Only a Runner known to be the person's own signs in, except that a shared Runner
+        may make (``allow``) a Claude Code long-lived token (local-agents 21). One whose
+        state names no host party (registered before issue 42) is refused either way, as
+        `choose_auth_mode` never runs a subscription on it."""
 
-        if self._host_party != "user":
+        if self._host_party != "user" and not (allow and is_shared_runner(self._host_party)):
             raise ApplicationError(
                 f"this Runner is hosted by {self._host_party!r}; only a person's own Runner "
-                "signs in, a shared Runner runs API keys only",
+                "signs in, a shared Runner runs API keys and Claude Code long-lived tokens "
+                "only",
                 type=SHARED_RUNNER_SIGN_IN_RULE,
                 non_retryable=True,
             )

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/sealed_box.py

@@ -61,6 +61,7 @@ from agentic_runner_contracts.sealed_credential import (
     SEAL_DOMAIN,
     OpenedCredential,
     SealedCredential,
+    SealedSignInCode,
     delivery_binding,
     key_fingerprint,
 )
@@ -516,15 +517,25 @@ class SealedCredentialStream:
         if not self._awaiting:
             self._keys.retire_previous()
 
+    def open_sign_in_code(self, sealed: SealedSignInCode) -> str | None:
+        """A relayed sign-in code, or None when it does not open (local-agents 05).
+
+        Opened with the same Recipient Key as a slot, but never held: the caller types it
+        into the waiting CLI and drops it.
+        """
+
+        return self._open_with(sealed.recipient_key_id, sealed.binding(), sealed.ciphertext)
+
     def _open(self, sealed: SealedCredential) -> str | None:
+        return self._open_with(sealed.recipient_key_id, sealed.binding(), sealed.ciphertext)
+
+    def _open_with(self, recipient_key_id: str, binding: bytes, ciphertext: str) -> str | None:
         for pair in (self._keys.current(), self._keys.previous()):
-            if pair is None or pair.key_id != sealed.recipient_key_id:
+            if pair is None or pair.key_id != recipient_key_id:
                 continue
             try:
                 return open_sealed(
-                    private_key=pair.private_key,
-                    binding=sealed.binding(),
-                    ciphertext=sealed.ciphertext,
+                    private_key=pair.private_key, binding=binding, ciphertext=ciphertext
                 )
             except SealedCredentialError:
                 return None

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/service.py

@@ -99,9 +99,12 @@ from agentic_runner.sealed_box import (
 from agentic_runner.tiny_http import HttpRequest, read_request, write_json
 from agentic_runner.triage_activities import RunnerTriageActivities
 from agentic_runner.user_sources import ProxyTriage, UserSourcePoller
+from agentic_runner.workers.acp_runtime import ACP_BRIDGES, AcpRuntime
 from agentic_runner.workers.agent_runtime import AgentRuntime
 from agentic_runner.workers.claude_runtime import ClaudeRuntime
+from agentic_runner.workers.claude_sign_in import ClaudeSignIns
 from agentic_runner.workers.codex_runtime import CodexRuntime
+from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import UID_MAP_FILENAME, ContractIsolation
 from agentic_runner.workers.fastapi_client import DirectiveTokenSource, RunnerFastApiClient
 from agentic_runner.workers.settings import WorkerSettings, get_worker_settings
@@ -123,7 +126,11 @@ from agentic_runner_contracts.runner_registration import (
     ResourcePressure,
 )
 from agentic_runner_contracts.runtime_context import WorkerRuntimeContextResolver
-from agentic_runner_contracts.sealed_credential import key_fingerprint
+from agentic_runner_contracts.sealed_credential import (
+    SignInCodeOutcome,
+    SignInCodeRelay,
+    key_fingerprint,
+)
 
 __all__ = [
     "AGENT_TOKEN_ENV",
@@ -388,10 +395,18 @@ def build_agent_runtimes(
     picks from here by the Work Record's `cli_kind` (local-agents 01) -- there is no
     process-wide choice. The same `clis` ride the heartbeat's attestation, so what this
     Runner serves and what routing believes it serves are one list.
+
+    Which runtime serves a kind -- its pinned ACP bridge or the per-CLI one -- is this
+    Runner's setting (`ACP_CLI_KINDS`), never the payload's (local-agents 12 items 6, 7).
     """
 
+    acp_kinds = {kind.strip() for kind in settings.ACP_CLI_KINDS.split(",") if kind.strip()}
     return {
-        cli.cli_kind: _RUNTIMES[cli.cli_kind](settings)
+        cli.cli_kind: (
+            AcpRuntime(cli_kind=cli.cli_kind, settings=settings)
+            if cli.cli_kind in acp_kinds and cli.cli_kind in ACP_BRIDGES
+            else _RUNTIMES[cli.cli_kind](settings)
+        )
         for cli in clis
         if cli.meets_floor and cli.cli_kind in _RUNTIMES
     }
@@ -568,6 +583,11 @@ class ControlPlaneStream:
     self_tests: HarnessSelfTests | None = None
     # Local-agents 04b: which delivered references fill the LLM proxy's slot, and where.
     llm_slots: Mapping[str, LlmProvider] = field(default_factory=lambda: dict(LLM_SLOT_REFERENCES))
+    # Local-agents 05: the Claude Code sign-ins a relayed code is typed into.
+    sign_ins: ClaudeSignIns | None = None
+    # Reported once, on the beat after the relay: a lost beat loses the outcome, and the
+    # console's own wait on the sign-in is what tells the person.
+    _sign_in_outcomes: list[SignInCodeRelay] = field(default_factory=list)
     _delivered: set[tuple[str, str]] = field(default_factory=set)
     _offered_to_proxy: dict[tuple[str, str], str] = field(default_factory=dict)
     _last_seen: tuple[float, datetime] | None = None
@@ -670,11 +690,14 @@ class ControlPlaneStream:
             clock_skew_seconds=self._clock_skew(now),
             source_status=self.sources.statuses() if self.sources is not None else [],
             tool_servers=self.tool_servers.latest() if self.tool_servers is not None else [],
+            sign_in_codes=self._sign_in_outcomes,
         )
+        self._sign_in_outcomes = []
         ack = await self.client.heartbeat(self.state, envelope)
         if self.sources is not None:
             self.sources.assign(ack.user_sources)
         await self._deliver_transcripts(ack)
+        await self._relay_sign_in_codes(ack)
         if self.lifecycle is not None:
             self.lifecycle.acknowledge(lifecycle)
         if self.heartbeat_stamp is not None:
@@ -721,6 +744,28 @@ class ControlPlaneStream:
                     "transcript %s could not be delivered: %s", request.request_id, error
                 )
 
+    async def _relay_sign_in_codes(self, ack: HeartbeatAck) -> None:
+        """Type each relayed code into the sign-in it names (local-agents 05).
+
+        The code is opened, written to that sign-in's PTY and dropped here; nothing logs
+        it and only its outcome travels back.
+        """
+
+        for sealed in ack.sign_in_codes:
+            code = self.sealed.open_sign_in_code(sealed)
+            if code is None:
+                outcome = SignInCodeOutcome.UNOPENABLE
+            elif self.sign_ins is None:
+                outcome = SignInCodeOutcome.UNKNOWN
+            else:
+                outcome = await self.sign_ins.relay(
+                    str(sealed.contract_id), sealed.sign_in_id, code
+                )
+            del code
+            self._sign_in_outcomes.append(
+                SignInCodeRelay(sign_in_id=sealed.sign_in_id, outcome=outcome)
+            )
+
     def _sync_delivered(self) -> None:
         """The resolver holds exactly what the last ack let this installation open."""
 
@@ -1010,6 +1055,8 @@ async def _serve_registered(
     )
     messages = MessageStore(state_dir / MESSAGES_DIR)
     stream.messages = messages
+    sign_ins = ClaudeSignIns(build_contract_isolation(settings, can_separate_uids=can_change_uid))
+    stream.sign_ins = sign_ins
     tool_servers = ToolServerHealthLog()
     stream.tool_servers = tool_servers
     link = HeartbeatLink(stream, ceilings=proxy.ceilings)
@@ -1056,6 +1103,7 @@ async def _serve_registered(
                 token_source=stream,
                 messages=messages,
                 tool_servers=tool_servers,
+                sign_ins=sign_ins,
                 # The wake signal rides the connection this process polls with: one
                 # namespace, the Organisation's own (PRD issue 52, map ticket 15 §2).
                 signaller=TemporalWorkflowSignaller(client),
@@ -1083,6 +1131,7 @@ async def _serve_registered(
                 task.cancel()
                 with contextlib.suppress(asyncio.CancelledError):
                     await task
+            await sign_ins.close()
             await run_runner_lifecycle_hook(hooks, HookName.RUNNER_SHUTDOWN)
             await _report_stop(link, lifecycle)
     return 1 if revoked.is_set() else 0
@@ -1195,6 +1244,7 @@ def _activities(
     messages: MessageStore | None = None,
     signaller: TemporalWorkflowSignaller | None = None,
     tool_servers: ToolServerHealthLog | None = None,
+    sign_ins: ClaudeSignIns | None = None,
 ) -> list[Callable[..., Any]]:
     github_client = GitHubAppClient(
         app_id=os.getenv("GITHUB_APP_ID"),
@@ -1246,7 +1296,9 @@ def _activities(
     return [
         *ralph.activity_callables(),
         *ContractDeviceLoginActivities(
-            contract_isolation=isolation, host_party=state.host_party or None
+            contract_isolation=isolation,
+            device_login=ContractDeviceLogin(isolation, claude=sign_ins),
+            host_party=state.host_party or None,
         ).activity_callables(),
         *RunnerTriageActivities(
             proxy=proxy,

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/testing/control_plane.py

@@ -37,7 +37,7 @@ from dataclasses import dataclass, field
 from datetime import UTC, datetime, timedelta
 from email.utils import formatdate
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any, Literal
+from typing import Any
 from uuid import UUID, uuid4
 
 import httpx
@@ -166,7 +166,7 @@ class FakeControlPlane:
     contracts_floor: str = contracts_version
     contract_id: UUID = DEFAULT_CONTRACT_ID
     agent_id: UUID = DEFAULT_AGENT_ID
-    cli_kind: Literal["codex_cli", "claude_code"] = "codex_cli"
+    cli_kind: str = "codex_cli"
 
     bootstraps: list[BootstrapRequest] = field(default_factory=list)
     runner_ids: list[UUID] = field(default_factory=list)

{agentic_runner-3.4.2 → agentic_runner-3.6.0}/src/agentic_runner/workers/_runtime_support.py

@@ -42,7 +42,10 @@ from agentic_runner.workers.contract_isolation import DirectiveSandbox
 # the funder anyway, or route it round the Profile's egress allow-list. The two Claude Code
 # bearers are here for the last reason too: either would authenticate the harness on a
 # credential the Runner never chose, around the proxy and the mode it decided
-# (local-agents 04; research 01 §4 gap 6).
+# (local-agents 04; research 01 §4 gap 6). The ACP bridges' control variables are here
+# for the same reason (local-agents 12): each swaps the vendor binary, hands approvals
+# back to the harness's own reviewer, authenticates the bridge, or re-enables the MCP
+# filtering that drops a granted server.
 RESERVED_DIRECTIVE_ENV: Final[frozenset[str]] = frozenset(
     {
         "HOME",
@@ -53,6 +56,20 @@ RESERVED_DIRECTIVE_ENV: Final[frozenset[str]] = frozenset(
         "ANTHROPIC_API_KEY",
         "ANTHROPIC_AUTH_TOKEN",
         "CLAUDE_CODE_OAUTH_TOKEN",
+        "CODEX_PATH",
+        "CODEX_CONFIG",
+        "CODEX_API_KEY",
+        "MODEL_PROVIDER",
+        "DEFAULT_AUTH_REQUEST",
+        "INITIAL_AGENT_MODE",
+        "NO_BROWSER",
+        "APP_SERVER_LOGS",
+        "DISABLE_MCP_CONFIG_FILTERING",
+        "CLAUDE_CODE_EXECUTABLE",
+        "CLAUDE_MODEL_CONFIG",
+        "CLAUDE_AGENT_LOGS",
+        "MAX_THINKING_TOKENS",
+        "ANTHROPIC_MODEL",
         CALLBACK_SOCKET_ENV,
         CALLBACK_TOKEN_ENV,
         *PROXY_ENV_NAMES,
@@ -154,10 +171,10 @@ async def run_subprocess_exec(
                     timeout=timeout_seconds,
                 )
             except (TimeoutError, asyncio.CancelledError):
-                await _terminate_process_tree(process)
+                await terminate_process_tree(process)
                 raise
     except PriorAttemptAliveError:
-        await _terminate_process_tree(process)
+        await terminate_process_tree(process)
         raise
 
     return SubprocessResult(
@@ -240,7 +257,7 @@ async def _read_stream_limited(
     return bytes(tail), total_bytes > limit_bytes
 
 
-async def _terminate_process_tree(process: asyncio.subprocess.Process) -> None:
+async def terminate_process_tree(process: asyncio.subprocess.Process) -> None:
     if process.returncode is not None:
         return
     with contextlib.suppress(ProcessLookupError, PermissionError):
@@ -379,7 +396,7 @@ async def run_subprocess_launch_and_detach(
         raise RuntimeError(f"process failed to start: {error.__class__.__name__}") from None
 
     if process.stdout is None:
-        await _terminate_process_tree(process)
+        await terminate_process_tree(process)
         raise RuntimeError("process stdout stream was unavailable")
 
     loop = asyncio.get_running_loop()
@@ -408,7 +425,7 @@ async def run_subprocess_launch_and_detach(
                 _detach(process)
                 return text
     except BaseException:
-        await _terminate_process_tree(process)
+        await terminate_process_tree(process)
         raise