agentic-runner 3.7.0__tar.gz → 3.9.0__tar.gz

{agentic_runner-3.7.0 → agentic_runner-3.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.7.0
+Version: 3.9.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.7.0 → agentic_runner-3.9.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.7.0"
+__version__ = "3.9.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.7.0 → agentic_runner-3.9.0}/src/agentic_runner/activities.py

@@ -124,6 +124,7 @@ from agentic_runner.workers._runtime_support import (
     bound_text,
     bound_text_tail,
 )
+from agentic_runner.workers.acp_runtime import ACP_BRIDGES, AcpRuntime
 from agentic_runner.workers.agent_runtime import (
     AgentRuntime,
     AuthMode,
@@ -595,6 +596,8 @@ class _RuntimeContextState:
     # PRD decision 12: what a runtime asked per command does when the command policy has
     # no answer. Carried on the same `command_policy` blob as the ceiling above.
     permission_fallback: PermissionFallback = PermissionFallback.DENY
+    # Local-agents 18: the Profile-named ACP command, for a kind with no pinned bridge.
+    acp_command: tuple[str, ...] = ()
     # Pushed on change and applied on receipt (ADR-0011 §11, PRD issue 44): the evaluator
     # is local, so a narrowing lands on the next verb this state is read for.
     grant_snapshot: GrantSnapshot = UNENFORCED_SNAPSHOT
@@ -2053,6 +2056,7 @@ class RunnerRalphActivities:
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
                     permission_fallback=runtime_state.permission_fallback,
+                    acp_command=runtime_state.acp_command,
                     prompt=attempt.skills_preamble
                     + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
@@ -3008,10 +3012,55 @@ class RunnerRalphActivities:
         Fails closed (local-agents 01): a kind this process does not serve fails the
         Directive non-retryably, with Evidence naming the kind and the Runner, and never
         falls back to another runtime -- routing should not have sent it here, and a
-        retry on this Runner would find the same registry.
+        retry on this Runner would find the same registry. So does a Profile-named ACP
+        command for a kind whose bridge the Runner pins (local-agents 18): the platform
+        never sends one, and the pinned bridge is the only thing that runs for that kind --
+        and, for any other kind, a command whose ``argv[0]`` is not the executable the host
+        pinned for it.
         """
 
+        if state.acp_command and state.cli_kind in ACP_BRIDGES:
+            await _raise_recorded(
+                ApplicationError(
+                    f"the Runner pins the ACP bridge for {state.cli_kind!r}; a Profile-named "
+                    "ACP command is refused for it",
+                    non_retryable=True,
+                ),
+                self._fastapi_client,
+                work_record_id,
+                source=AGENT_RUNTIME_EVIDENCE_SOURCE,
+                actor=self._actor(),
+                payload={
+                    "event": "directive.acp_command_refused",
+                    "cli_kind": state.cli_kind,
+                    # The executable's name only: its arguments may carry a secret.
+                    "executable": redact_secret_like_text(Path(state.acp_command[0]).name),
+                },
+            )
         runtime = self._agent_runtimes.get(state.cli_kind)
+        command_refusal = (
+            runtime.acp_command_refusal(state.acp_command)
+            if isinstance(runtime, AcpRuntime)
+            else None
+        )
+        if command_refusal is not None:
+            await _raise_recorded(
+                ApplicationError(command_refusal, non_retryable=True),
+                self._fastapi_client,
+                work_record_id,
+                source=AGENT_RUNTIME_EVIDENCE_SOURCE,
+                actor=self._actor(),
+                payload={
+                    "event": "directive.acp_command_refused",
+                    "cli_kind": state.cli_kind,
+                    "executable": (
+                        redact_secret_like_text(Path(state.acp_command[0]).name)
+                        if state.acp_command
+                        else None
+                    ),
+                    "reason": command_refusal,
+                },
+            )
         if runtime is not None:
             return runtime
         served = sorted(self._agent_runtimes)
@@ -3425,6 +3474,7 @@ class RunnerRalphActivities:
             model=runtime_context.model,
             memory_limit_bytes=_profile_memory_limit_bytes(runtime_context.command_policy),
             permission_fallback=_profile_permission_fallback(runtime_context.command_policy),
+            acp_command=tuple(runtime_context.acp_command or ()),
             grant_snapshot=snapshot,
             grant_snapshot_payload=snapshot_payload,
             persona_slug=runtime_context.persona_slug,
@@ -4699,6 +4749,7 @@ class RunnerRalphActivities:
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
                     permission_fallback=state.permission_fallback,
+                    acp_command=state.acp_command,
                     prompt=attempt.skills_preamble
                     + _learning_prompt(
                         request,
@@ -4960,6 +5011,7 @@ class RunnerRalphActivities:
                     egress_allow_list=attempt.egress_allow_list,
                     auth_mode=attempt.auth_mode,
                     permission_fallback=state.permission_fallback,
+                    acp_command=state.acp_command,
                     prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,

agentic_runner-3.9.0/src/agentic_runner/integrations/oauth/__init__.py

@@ -0,0 +1,68 @@
+"""The OAuth provider port: one form POST to a token or revocation endpoint (issue 30).
+
+RFC 6749 §4.1.3 / §6 and RFC 7009 are each a form POST answered with JSON, so the port is
+exactly that and the protocol lives in :mod:`agentic_runner.oauth_connectors`, where a
+fake provider exercises all of it. ``HttpOAuthProvider`` is the Runner's own outbound HTTPS
+-- the exchange never touches the control plane.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from typing import Final, Protocol
+
+import httpx
+
+__all__ = [
+    "HttpOAuthProvider",
+    "OAuthProvider",
+    "OAuthProviderError",
+    "ProviderResponse",
+]
+
+# One beat's budget: the exchange and a refresh run on the heartbeat, so a provider that
+# hangs must cost a failed step and not a stale link.
+_TIMEOUT: Final[float] = 10.0
+
+
+class OAuthProviderError(RuntimeError):
+    """The provider could not be reached or did not answer HTTP. Never carries a body."""
+
+
+@dataclass(frozen=True, slots=True)
+class ProviderResponse:
+    status: int
+    # repr=False: a token response is the one body that must never reach a log line.
+    body: Mapping[str, object] = field(default_factory=dict, repr=False)
+
+
+class OAuthProvider(Protocol):
+    async def post_form(self, url: str, form: Mapping[str, str]) -> ProviderResponse: ...
+
+
+class HttpOAuthProvider:
+    """The real provider: HTTPS only, no redirects, JSON asked for.
+
+    Redirects are not followed because a 30x on a token endpoint would re-send the code
+    and the verifier to wherever it points. ``Accept: application/json`` because GitHub,
+    among others, answers form-encoded unless asked.
+    """
+
+    async def post_form(self, url: str, form: Mapping[str, str]) -> ProviderResponse:
+        try:
+            async with httpx.AsyncClient(timeout=_TIMEOUT, follow_redirects=False) as client:
+                response = await client.post(
+                    url, data=dict(form), headers={"Accept": "application/json"}
+                )
+        except httpx.HTTPError as error:
+            # The type only: an httpx error's text can carry the request URL, and a
+            # refresh's form is in no URL, but nothing here needs more than the class.
+            raise OAuthProviderError(type(error).__name__) from None
+        try:
+            body = response.json()
+        except ValueError:
+            body = {}
+        return ProviderResponse(
+            status=response.status_code, body=body if isinstance(body, dict) else {}
+        )

agentic_runner-3.9.0/src/agentic_runner/integrations/oauth/fake_provider.py

@@ -0,0 +1,134 @@
+"""A fake OAuth provider that enforces what a real one does (issue 30's Runner tests).
+
+Strict on purpose: a code is single-use and bound to its client, redirect and S256
+challenge; a refresh token rotates and the old one stops working; revocation ends both.
+A Runner that sent the wrong verifier, replayed a code or kept an old refresh token fails
+here the way it would fail against a provider.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import secrets
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from urllib.parse import parse_qs, urlsplit
+
+from agentic_runner.integrations.oauth import ProviderResponse
+
+__all__ = ["FakeOAuthProvider"]
+
+AUTHORIZE = "https://provider.test/authorize"
+TOKEN = "https://provider.test/token"
+REVOKE = "https://provider.test/revoke"
+
+
+@dataclass
+class _Grant:
+    client_id: str
+    redirect_uri: str
+    challenge: str
+    scope: str
+
+
+@dataclass
+class FakeOAuthProvider:
+    client_id: str = "client-123"
+    client_secret: str | None = None
+    expires_in: int | None = 3600
+    authorize_endpoint: str = AUTHORIZE
+    token_endpoint: str = TOKEN
+    revocation_endpoint: str = REVOKE
+    requests: list[tuple[str, dict[str, str]]] = field(default_factory=list)
+    issued: list[str] = field(default_factory=list)
+    revoked: set[str] = field(default_factory=set)
+    _codes: dict[str, _Grant] = field(default_factory=dict)
+    # token -> the grant it belongs to; a refresh token also keeps the grant's scope.
+    _access: dict[str, str] = field(default_factory=dict)
+    _refresh: dict[str, tuple[str, str]] = field(default_factory=dict)
+
+    def consent(self, authorize_url: str) -> tuple[str, str]:
+        """The person approves: the ``(code, state)`` the callback URL would carry."""
+
+        query = {key: values[0] for key, values in parse_qs(urlsplit(authorize_url).query).items()}
+        assert query["response_type"] == "code"
+        assert query["code_challenge_method"] == "S256"
+        code = f"code-{secrets.token_hex(8)}"
+        self._codes[code] = _Grant(
+            client_id=query["client_id"],
+            redirect_uri=query["redirect_uri"],
+            challenge=query["code_challenge"],
+            scope=query.get("scope", ""),
+        )
+        return code, query["state"]
+
+    def access_valid(self, token: str) -> bool:
+        return token in self._access and token not in self.revoked
+
+    async def post_form(self, url: str, form: Mapping[str, str]) -> ProviderResponse:
+        self.requests.append((url, dict(form)))
+        if url == self.revocation_endpoint:
+            return self._revoke(form)
+        if url != self.token_endpoint:
+            return ProviderResponse(404)
+        if not self._client_ok(form):
+            return _error(401, "invalid_client")
+        if form.get("grant_type") == "authorization_code":
+            return self._exchange(form)
+        if form.get("grant_type") == "refresh_token":
+            return self._rotate(form)
+        return _error(400, "unsupported_grant_type")
+
+    def _client_ok(self, form: Mapping[str, str]) -> bool:
+        if form.get("client_id") != self.client_id:
+            return False
+        return self.client_secret is None or form.get("client_secret") == self.client_secret
+
+    def _exchange(self, form: Mapping[str, str]) -> ProviderResponse:
+        grant = self._codes.pop(form.get("code", ""), None)
+        if grant is None or grant.redirect_uri != form.get("redirect_uri"):
+            return _error(400, "invalid_grant")
+        verifier = form.get("code_verifier", "")
+        digest = hashlib.sha256(verifier.encode("ascii")).digest()
+        if base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii") != grant.challenge:
+            return _error(400, "invalid_grant")
+        return self._tokens(f"grant-{secrets.token_hex(8)}", grant.scope)
+
+    def _rotate(self, form: Mapping[str, str]) -> ProviderResponse:
+        held = self._refresh.pop(form.get("refresh_token", ""), None)
+        if held is None:
+            return _error(400, "invalid_grant")
+        return self._tokens(*held)
+
+    def _tokens(self, grant_id: str, scope: str) -> ProviderResponse:
+        access = f"at-{secrets.token_hex(16)}"
+        refresh = f"rt-{secrets.token_hex(16)}"
+        self._access[access] = grant_id
+        self._refresh[refresh] = (grant_id, scope)
+        self.issued += [access, refresh]
+        body: dict[str, object] = {
+            "access_token": access,
+            "refresh_token": refresh,
+            "token_type": "Bearer",
+            "scope": scope,
+        }
+        if self.expires_in is not None:
+            body["expires_in"] = self.expires_in
+        return ProviderResponse(200, body)
+
+    def _revoke(self, form: Mapping[str, str]) -> ProviderResponse:
+        if not self._client_ok(form):
+            return _error(401, "invalid_client")
+        token = form.get("token", "")
+        self.revoked.add(token)
+        # RFC 7009 §2.1: revoking a refresh token may revoke the grant's access tokens;
+        # this provider does, so the test can see the access token stop working.
+        held = self._refresh.pop(token, None)
+        if held is not None:
+            self.revoked.update(t for t, grant_id in self._access.items() if grant_id == held[0])
+        return ProviderResponse(200)
+
+
+def _error(status: int, code: str) -> ProviderResponse:
+    return ProviderResponse(status, {"error": code, "error_description": "fake provider"})