brindle 0.2.1__tar.gz → 0.3.0__tar.gz

{brindle-0.2.1 → brindle-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.2.1
+Version: 0.3.0
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -89,7 +89,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.2.1`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.0`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -350,6 +350,7 @@ your own status line prints, so what you see doesn't change.
 | `brindle transfer [REPO] [--from SESSION] [-b BRANCH]` | move a scratch session's work into a real repo |
 | `brindle ls [--all]` | workspaces and agents |
 | `brindle repo add PATH [--name ALIAS] / rm ALIAS / ls` | attach other local repos to the current session so workers can go there (brindle Pro; see "Several repos in one session") |
+| `brindle keys set/unset/list [NAME]` | store model API keys (e.g. `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`) once in the OS keychain (or a 0600 file); every agent pane gets the ones its provider reads, unless you already export it. `set` reads the value from a hidden prompt or stdin, `list` shows names and the last 4 characters. `CLAUDE_CODE_OAUTH_TOKEN` (a Claude subscription token) is never stored |
 | `brindle history [--limit N] [--kind K] [--all]` | durable log of worker results, reviews, merges and milestone checks |
 | `brindle cost [--days N] [--all]` | dollar spend at list prices over the last 30 days, by model |
 | `brindle cost report [--days N] [--all]` | Pro: spend by day, profile and goal, cost per merged branch, review pass rate per worker profile |
@@ -361,7 +362,7 @@ your own status line prints, so what you see doesn't change.
 | `brindle cost estimate [--tasks N] [--weight W] [--profile P] [--reviewer R]` | what the current goal (or N tasks) is likely to cost, as a range from this repo's history (median to p80 of past worker and review runs), plus a cheaper alternative with a different reviewer; says "low confidence" when there's too little history. Also added to `set_goal` and `assign` replies (brindle Pro) |
 | `brindle learning` | whether brindle Pro's hosted learning is on for this repo, and if not, why (nothing is learned on your machine) |
 | `brindle learning seed` | Pro: sends this repo's finished routing history to the hosted learner once, so it starts with what this machine has seen. Only the usual coarse record fields leave (kind/size one-hots, counters, HMAC keys), never task text or paths. A second run sends nothing new; decisions already sent live are skipped |
-| `brindle account [login\|logout\|status\|upgrade\|portal\|org]` | paid features: bare `brindle account` shows what your plan has and how to get the rest (see "brindle Pro and Team" below) |
+| `brindle account [login\|logout\|status\|upgrade\|portal\|seats\|org]` | paid features: bare `brindle account` shows what your plan has and how to get the rest (see "brindle Pro and Team" below) |
 | `brindle audit verify\|export\|pubkey\|ship\|prune` | the local tamper-evident audit log, and shipping it to your SIEM (brindle Enterprise; see "Audit log" below) |
 | `brindle watch [--all] [--once]` | the dashboard on its own (the same view as the sidebar): enter attaches, `p` peeks, `x` closes |
 | `brindle sidebar` | bring this session's sidebar into the tmux session you're in (also `Ctrl-b S` in a window without one); restarts it if it was closed |
@@ -526,6 +527,7 @@ Autopilot, merge gates and cleanup:
 | `max_agents` | `4` | workers running at once per session (`0`: no cap) |
 | `check_timeout` | `900` | seconds each check may take |
 | `check_concurrency` | `2` | check runs at once on this machine, across branches; the rest wait their turn (`0`: no cap). A run far past its last duration is reported to the supervisor |
+| `fable_escalation` | on, unless the worker runs on a cloud account (Bedrock, Vertex or Foundry) | retry a failed heavy task once on `developer-heavy` (Fable) before handing it to you; `true` turns it on for a cloud account, `false` off |
 | `usage_limit` | `90` | autopilot stops pushing on at this % of your Claude usage limit |
 | `limit_cooldown_minutes` | `300` for Antigravity | how long a provider that hit its limit counts as unavailable |
 | `graphify` | if the graph is there | point agents at the repo's [graphify](https://github.com/safishamsi/graphify) code map (`false` turns it off) |
@@ -589,9 +591,9 @@ keep theirs):
 ```json
 {
   "routing": {
-    "light":  ["developer", "developer-codex", "developer-local"],
+    "light":  ["developer-light", "developer", "developer-codex", "developer-local"],
     "medium": ["developer", "developer-codex", "developer-heavy"],
-    "heavy":  ["developer-heavy", "developer", "developer-codex"]
+    "heavy":  ["developer", "developer-heavy", "developer-codex"]
   }
 }
 ```
@@ -599,7 +601,9 @@ keep theirs):
 No tier prefers another provider for its own sake: all-Claude or all-Codex may
 be what works best for you, and that's for the learner to find out.
 
-`developer-codex` runs on Codex; `developer-heavy` on Claude Fable at high effort.
+`developer-light` runs on Claude Haiku at low effort; `developer` on your Claude
+Code default model; `developer-codex` on Codex; `developer-heavy` on Claude Fable
+at high effort.
 A profile is skipped when its CLI isn't installed (`claude`, `codex`, `agy`), the
 local model server isn't answering, or its provider is at your `usage_limit`. If
 hosted learning is on it chooses among the profiles left; otherwise the first
@@ -762,7 +766,9 @@ brindle account login      # opens your browser to sign in (--device: enter a co
 brindle account status     # your plan, features, hosted learning on or off, when the entitlement expires
 brindle account savings    # what hosted learning's picks gained in this repo, this month and last: estimates, from this machine's records only
 brindle account upgrade    # opens the checkout for brindle Pro (and prints its URL)
-brindle account portal     # opens the billing portal (invoices, seats, cancellation); --org ORG for a team org
+brindle account upgrade --enterprise [--trial] --seats N --org ORG   # brindle Enterprise for a team org; --trial: free trial, at most 10 seats
+brindle account portal     # opens the billing portal (invoices, payment method, cancellation); --org ORG for a team org
+brindle account seats N    # set a Team or Enterprise org's seat count (billing admin); --org ORG; Stripe prorates the change
 brindle account org list   # the orgs you belong to; `org use <id>` switches, `org policy` shows the current one
 brindle account org policy # the org's policy, its per-role overrides, and the policy that applies to you
 brindle account org profiles                                  # the org's shared profiles and rule packs, and which are pinned
@@ -825,6 +831,16 @@ entitlement.
 * `deny_personal_keys`: the personal model keys (`ANTHROPIC_API_KEY`,
   `OPENAI_API_KEY`, ...) are taken out of every agent pane, and a profile that
   sets one is refused.
+* An org-owned key: with `provider` `anthropic` (or `openai-compatible`), set
+  `key_env` to the name of a variable that holds the org's key (not a personal
+  one like `ANTHROPIC_API_KEY`), or `key_helper` to a command, as a list of
+  arguments, that prints the key (for example `["vault", "kv", "get",
+  "-field=key", "secret/anthropic"]`). brindle runs the helper on the person's
+  machine, without a shell and with a timeout, each time a worker starts, and
+  gives the key to that worker as `ANTHROPIC_API_KEY` (`OPENAI_API_KEY` for
+  Codex). It passes `deny_personal_keys`; a personal key doesn't. The key never
+  goes through brindle's servers. When the variable is missing or the helper
+  fails, the worker doesn't start.
 
 Two things to know when you turn on `deny_personal_keys`:
 
@@ -985,17 +1001,31 @@ workflows call these commands:
   commits the workflows on a `brindle/ci-setup` branch, then puts you back on
   the branch you started on and deletes the local setup branch, so `git pull`
   after merging the setup pull request is clean (commit or stash your changes
-  first: it refuses to start with uncommitted work).
+  first: it refuses to start with uncommitted work). With your own cloud
+  (`--credential bedrock|vertex|foundry`, keyless GitHub OIDC) it can read the
+  IDs from the deployment template's outputs instead of asking:
+  `--from-stack NAME [--region R]` (AWS CloudFormation), `--from-terraform DIR`
+  (Google) or `--from-deployment NAME -g RG` (Azure). They are defaults for
+  `--cloud-var`, which still overrides them, and every ID is format-checked. A
+  missing `aws`, `terraform` or `az` CLI or output is an error that names the
+  `--cloud-var` to pass instead. Vertex AI and Microsoft Foundry are in
+  **preview** (not yet verified end to end): `init` refuses them unless you pass
+  `--preview` or set `BRINDLE_CI_PREVIEW_CLOUDS=1`, and `doctor` marks them
+  `(preview)`. Bedrock is generally available.
 - `brindle ci doctor`: which provider CLIs and credential names a runner has, and
-  which providers CI may use on this repository.
+  which providers CI may use on this repository. `--models` also makes one tiny
+  call per pinned model and says why any is refused (a quota, a form not filled in).
 - `brindle ci start`: start a run for an issue, a goal text or a dispatched run,
   or a validation of a pull request.
 - `brindle ci run`: run what was started: the supervisor and the result upload,
   or the pull request's checks and reviews and the evidence upload.
 - `brindle ci report`: tell the service how the workflow's jobs ended.
 
-Credential names are reported, never values. On a repository owned by a GitHub
-organization, a provider signed in only with a personal subscription is not used.
+Credential names are reported, never values. CI uses API keys, cloud sign-ins
+(Bedrock, Vertex, Foundry) or identity federation only: a provider signed in
+only with a subscription (`CLAUDE_CODE_OAUTH_TOKEN`, a Codex ChatGPT login) is
+not used, on personal and organization repositories alike. Add an API key
+secret instead.
 
 Fix builds only fix the default branch's *required* status checks, and a new
 repository has none. When the default branch requires none, `brindle ci init`
@@ -1240,6 +1270,16 @@ needs no browser step. Put the key in your environment, or in a profile's
 `brindle doctor` names the variable each CLI gets, from your shell or from
 which profiles.
 
+A profile chooses between the two with `auth`:
+
+| `auth:` | What the worker signs in with |
+|---|---|
+| `auto` (default) | A key from your environment or `brindle keys` if there is one, else the CLI's own login. |
+| `subscription` | Always the CLI's own login: brindle strips that provider's API keys from the pane. |
+| `api_key` | Only a key: the worker refuses to start without one. |
+
+Your org's `deny_personal_keys` (Enterprise) still applies on top of `auth`.
+
 ### Cheap workers
 
 By default a Claude Code worker loads everything your own `claude` does: your

{brindle-0.2.1 → brindle-0.3.0}/README.md

@@ -59,7 +59,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.2.1`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.0`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -320,6 +320,7 @@ your own status line prints, so what you see doesn't change.
 | `brindle transfer [REPO] [--from SESSION] [-b BRANCH]` | move a scratch session's work into a real repo |
 | `brindle ls [--all]` | workspaces and agents |
 | `brindle repo add PATH [--name ALIAS] / rm ALIAS / ls` | attach other local repos to the current session so workers can go there (brindle Pro; see "Several repos in one session") |
+| `brindle keys set/unset/list [NAME]` | store model API keys (e.g. `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`) once in the OS keychain (or a 0600 file); every agent pane gets the ones its provider reads, unless you already export it. `set` reads the value from a hidden prompt or stdin, `list` shows names and the last 4 characters. `CLAUDE_CODE_OAUTH_TOKEN` (a Claude subscription token) is never stored |
 | `brindle history [--limit N] [--kind K] [--all]` | durable log of worker results, reviews, merges and milestone checks |
 | `brindle cost [--days N] [--all]` | dollar spend at list prices over the last 30 days, by model |
 | `brindle cost report [--days N] [--all]` | Pro: spend by day, profile and goal, cost per merged branch, review pass rate per worker profile |
@@ -331,7 +332,7 @@ your own status line prints, so what you see doesn't change.
 | `brindle cost estimate [--tasks N] [--weight W] [--profile P] [--reviewer R]` | what the current goal (or N tasks) is likely to cost, as a range from this repo's history (median to p80 of past worker and review runs), plus a cheaper alternative with a different reviewer; says "low confidence" when there's too little history. Also added to `set_goal` and `assign` replies (brindle Pro) |
 | `brindle learning` | whether brindle Pro's hosted learning is on for this repo, and if not, why (nothing is learned on your machine) |
 | `brindle learning seed` | Pro: sends this repo's finished routing history to the hosted learner once, so it starts with what this machine has seen. Only the usual coarse record fields leave (kind/size one-hots, counters, HMAC keys), never task text or paths. A second run sends nothing new; decisions already sent live are skipped |
-| `brindle account [login\|logout\|status\|upgrade\|portal\|org]` | paid features: bare `brindle account` shows what your plan has and how to get the rest (see "brindle Pro and Team" below) |
+| `brindle account [login\|logout\|status\|upgrade\|portal\|seats\|org]` | paid features: bare `brindle account` shows what your plan has and how to get the rest (see "brindle Pro and Team" below) |
 | `brindle audit verify\|export\|pubkey\|ship\|prune` | the local tamper-evident audit log, and shipping it to your SIEM (brindle Enterprise; see "Audit log" below) |
 | `brindle watch [--all] [--once]` | the dashboard on its own (the same view as the sidebar): enter attaches, `p` peeks, `x` closes |
 | `brindle sidebar` | bring this session's sidebar into the tmux session you're in (also `Ctrl-b S` in a window without one); restarts it if it was closed |
@@ -496,6 +497,7 @@ Autopilot, merge gates and cleanup:
 | `max_agents` | `4` | workers running at once per session (`0`: no cap) |
 | `check_timeout` | `900` | seconds each check may take |
 | `check_concurrency` | `2` | check runs at once on this machine, across branches; the rest wait their turn (`0`: no cap). A run far past its last duration is reported to the supervisor |
+| `fable_escalation` | on, unless the worker runs on a cloud account (Bedrock, Vertex or Foundry) | retry a failed heavy task once on `developer-heavy` (Fable) before handing it to you; `true` turns it on for a cloud account, `false` off |
 | `usage_limit` | `90` | autopilot stops pushing on at this % of your Claude usage limit |
 | `limit_cooldown_minutes` | `300` for Antigravity | how long a provider that hit its limit counts as unavailable |
 | `graphify` | if the graph is there | point agents at the repo's [graphify](https://github.com/safishamsi/graphify) code map (`false` turns it off) |
@@ -559,9 +561,9 @@ keep theirs):
 ```json
 {
   "routing": {
-    "light":  ["developer", "developer-codex", "developer-local"],
+    "light":  ["developer-light", "developer", "developer-codex", "developer-local"],
     "medium": ["developer", "developer-codex", "developer-heavy"],
-    "heavy":  ["developer-heavy", "developer", "developer-codex"]
+    "heavy":  ["developer", "developer-heavy", "developer-codex"]
   }
 }
 ```
@@ -569,7 +571,9 @@ keep theirs):
 No tier prefers another provider for its own sake: all-Claude or all-Codex may
 be what works best for you, and that's for the learner to find out.
 
-`developer-codex` runs on Codex; `developer-heavy` on Claude Fable at high effort.
+`developer-light` runs on Claude Haiku at low effort; `developer` on your Claude
+Code default model; `developer-codex` on Codex; `developer-heavy` on Claude Fable
+at high effort.
 A profile is skipped when its CLI isn't installed (`claude`, `codex`, `agy`), the
 local model server isn't answering, or its provider is at your `usage_limit`. If
 hosted learning is on it chooses among the profiles left; otherwise the first
@@ -732,7 +736,9 @@ brindle account login      # opens your browser to sign in (--device: enter a co
 brindle account status     # your plan, features, hosted learning on or off, when the entitlement expires
 brindle account savings    # what hosted learning's picks gained in this repo, this month and last: estimates, from this machine's records only
 brindle account upgrade    # opens the checkout for brindle Pro (and prints its URL)
-brindle account portal     # opens the billing portal (invoices, seats, cancellation); --org ORG for a team org
+brindle account upgrade --enterprise [--trial] --seats N --org ORG   # brindle Enterprise for a team org; --trial: free trial, at most 10 seats
+brindle account portal     # opens the billing portal (invoices, payment method, cancellation); --org ORG for a team org
+brindle account seats N    # set a Team or Enterprise org's seat count (billing admin); --org ORG; Stripe prorates the change
 brindle account org list   # the orgs you belong to; `org use <id>` switches, `org policy` shows the current one
 brindle account org policy # the org's policy, its per-role overrides, and the policy that applies to you
 brindle account org profiles                                  # the org's shared profiles and rule packs, and which are pinned
@@ -795,6 +801,16 @@ entitlement.
 * `deny_personal_keys`: the personal model keys (`ANTHROPIC_API_KEY`,
   `OPENAI_API_KEY`, ...) are taken out of every agent pane, and a profile that
   sets one is refused.
+* An org-owned key: with `provider` `anthropic` (or `openai-compatible`), set
+  `key_env` to the name of a variable that holds the org's key (not a personal
+  one like `ANTHROPIC_API_KEY`), or `key_helper` to a command, as a list of
+  arguments, that prints the key (for example `["vault", "kv", "get",
+  "-field=key", "secret/anthropic"]`). brindle runs the helper on the person's
+  machine, without a shell and with a timeout, each time a worker starts, and
+  gives the key to that worker as `ANTHROPIC_API_KEY` (`OPENAI_API_KEY` for
+  Codex). It passes `deny_personal_keys`; a personal key doesn't. The key never
+  goes through brindle's servers. When the variable is missing or the helper
+  fails, the worker doesn't start.
 
 Two things to know when you turn on `deny_personal_keys`:
 
@@ -955,17 +971,31 @@ workflows call these commands:
   commits the workflows on a `brindle/ci-setup` branch, then puts you back on
   the branch you started on and deletes the local setup branch, so `git pull`
   after merging the setup pull request is clean (commit or stash your changes
-  first: it refuses to start with uncommitted work).
+  first: it refuses to start with uncommitted work). With your own cloud
+  (`--credential bedrock|vertex|foundry`, keyless GitHub OIDC) it can read the
+  IDs from the deployment template's outputs instead of asking:
+  `--from-stack NAME [--region R]` (AWS CloudFormation), `--from-terraform DIR`
+  (Google) or `--from-deployment NAME -g RG` (Azure). They are defaults for
+  `--cloud-var`, which still overrides them, and every ID is format-checked. A
+  missing `aws`, `terraform` or `az` CLI or output is an error that names the
+  `--cloud-var` to pass instead. Vertex AI and Microsoft Foundry are in
+  **preview** (not yet verified end to end): `init` refuses them unless you pass
+  `--preview` or set `BRINDLE_CI_PREVIEW_CLOUDS=1`, and `doctor` marks them
+  `(preview)`. Bedrock is generally available.
 - `brindle ci doctor`: which provider CLIs and credential names a runner has, and
-  which providers CI may use on this repository.
+  which providers CI may use on this repository. `--models` also makes one tiny
+  call per pinned model and says why any is refused (a quota, a form not filled in).
 - `brindle ci start`: start a run for an issue, a goal text or a dispatched run,
   or a validation of a pull request.
 - `brindle ci run`: run what was started: the supervisor and the result upload,
   or the pull request's checks and reviews and the evidence upload.
 - `brindle ci report`: tell the service how the workflow's jobs ended.
 
-Credential names are reported, never values. On a repository owned by a GitHub
-organization, a provider signed in only with a personal subscription is not used.
+Credential names are reported, never values. CI uses API keys, cloud sign-ins
+(Bedrock, Vertex, Foundry) or identity federation only: a provider signed in
+only with a subscription (`CLAUDE_CODE_OAUTH_TOKEN`, a Codex ChatGPT login) is
+not used, on personal and organization repositories alike. Add an API key
+secret instead.
 
 Fix builds only fix the default branch's *required* status checks, and a new
 repository has none. When the default branch requires none, `brindle ci init`
@@ -1210,6 +1240,16 @@ needs no browser step. Put the key in your environment, or in a profile's
 `brindle doctor` names the variable each CLI gets, from your shell or from
 which profiles.
 
+A profile chooses between the two with `auth`:
+
+| `auth:` | What the worker signs in with |
+|---|---|
+| `auto` (default) | A key from your environment or `brindle keys` if there is one, else the CLI's own login. |
+| `subscription` | Always the CLI's own login: brindle strips that provider's API keys from the pane. |
+| `api_key` | Only a key: the worker refuses to start without one. |
+
+Your org's `deny_personal_keys` (Enterprise) still applies on top of `auth`.
+
 ### Cheap workers
 
 By default a Claude Code worker loads everything your own `claude` does: your

{brindle-0.2.1 → brindle-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.2.1"
+version = "0.3.0"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -52,6 +52,8 @@ audit_export = "brindle.pro.audit_export:make"
 dev = [
     "pytest>=8",
     "pytest-xdist>=3.8.0",
+    "python-hcl2>=8.1.4",
+    "pyyaml>=6.0.3",
 ]
 
 [build-system]

{brindle-0.2.1 → brindle-0.3.0}/src/brindle/agents.py

@@ -20,7 +20,7 @@ import sys
 import time
 import uuid
 
-from brindle import git, secrets, tmux, workspaces
+from brindle import git, keystore, pane_auth, providers, secrets, tmux, workspaces
 from brindle.config import RepoConfig
 from brindle.db import DB, Agent, Workspace
 from brindle.profiles import load_profile, missing_add_dirs
@@ -180,7 +180,10 @@ def agent_env(ws: Workspace, agent_id: str, agent: Agent | None = None,
             profile_env = {}
         if m is _UNREAD:
             m = managed(ws.repo_root)
-        env = {**profile_env, **managed_models.agent_env(m, agent.provider), **env}
+        # Claude Code's own managed settings (apiKeyHelper, a managed env) pick
+        # the credential and backend: brindle adds no provider_config env there.
+        org = agent.provider == "claude" and providers.claude_org_managed()
+        env = {**profile_env, **({} if org else managed_models.agent_env(m, agent.provider)), **env}
     if agent is not None and preload_tools(agent, ws):
         # Claude Code defers MCP tools and loads them on demand, which costs a
         # worker an extra round trip at the moment it's told to report (and
@@ -419,11 +422,33 @@ def _open_window(db: DB, agent: Agent, ws: Workspace, name: str, argv: list[str]
     # reach the pane, kept or not.
     if m is _UNREAD:
         m = managed(ws.repo_root)
-    target = tmux.new_window(ws.tmux_session, name, ws.path, argv, agent_env(ws, agent.id, agent, m),
-                             tag=(AGENT_TAG, agent.id),
-                             keep=secrets.agent_credentials(agent.provider, agent.profile, ws.repo_root),
-                             **({"allow": allow} if allow is not None else {}),
-                             **({"deny": m.denied_keys} if m is not None and m.denied_keys else {}))
+    env = agent_env(ws, agent.id, agent, m)
+    credentials = secrets.agent_credentials(agent.provider, agent.profile, ws.repo_root)
+    # Keys stored with `brindle keys` reach this window's env only (never the
+    # tmux server's), unless the environment already has the name or an org's
+    # deny_personal_keys keeps it out. deny/allow strip it as they do an exported key.
+    # The profile's `auth` (subscription strips the provider's keys) and Claude
+    # Code's managed settings (a personal key mustn't bypass them) add to the
+    # org's denied keys; the org's own key (key_env / key_helper) is set last and
+    # passes the deny (secrets.org_key), a personal key under its name doesn't.
+    from brindle.pro import managed_models
+
+    org_managed = agent.provider == "claude" and bool(providers.claude_org_managed())
+    deny = pane_auth.deny_names(agent.provider, guarded.auth if guarded is not None else "auto",
+                                m, org_managed)
+    try:
+        org_env = managed_models.org_key_env(m, agent.provider)
+    except managed_models.ManagedUnavailable as e:
+        raise AgentError(f"managed models: {e}") from None
+    # Claude Code's managed settings supply the credential: no stored Claude key.
+    no_stored = set(deny) | (set(providers._ENV_AUTH["claude"]) if org_managed else set())
+    env = {**keystore.pane_keys(credentials - no_stored, {**env, **org_env}), **env, **org_env}
+    with secrets.org_key(org_env):
+        target = tmux.new_window(ws.tmux_session, name, ws.path, argv, env,
+                                 tag=(AGENT_TAG, agent.id),
+                                 keep=credentials,
+                                 **({"allow": allow} if allow is not None else {}),
+                                 **({"deny": deny} if deny else {}))
     # The pane id only means anything on the server that issued it (a
     # resumed agent may come back on a different one), so record both.
     server = tmux.current_server()
@@ -591,9 +616,16 @@ def _launch(db: DB, agent: Agent, ws: Workspace, *, prompt: str | None,
     # no personal keys (blank, so the launcher's own copy doesn't count).
     from brindle.pro import managed_models
 
-    why = signed_out(provider.name, {**profile.env, **managed_models.agent_env(m, provider.name),
-                                     **{k: "" for k in secrets.pane_deny(m.denied_keys if m else (),
-                                                                         {**profile.env, **managed_models.agent_env(m, provider.name)})}})
+    launch_env = {**profile.env, **managed_models.agent_env(m, provider.name)}
+    deny = pane_auth.deny_names(provider.name, profile.auth, m,
+                                provider.name == "claude" and bool(providers.claude_org_managed()))
+    org_key = managed_models.has_org_key(m, provider.name)
+    why = pane_auth.key_problem(profile, provider.name, deny, org_key)
+    if why:
+        raise AgentError(why)
+    # The org's own key signs the agent in: there is no login to check.
+    why = None if org_key else signed_out(
+        provider.name, {**launch_env, **{k: "" for k in secrets.pane_deny(deny, launch_env)}})
     if why:
         raise AgentError(why)
     # Here rather than in spawn, so a resume checks too: a directory can be
@@ -2319,6 +2351,22 @@ def agent_for_session(db: DB, session_id: object) -> str | None:
     return matches[-1].id if matches else None
 
 
+def command_running(db: DB, agent: Agent) -> bool:
+    """Whether a command the agent started (possibly in the background) is
+    still running under it. Never raises: when unsure, it says no."""
+    if agent.provider != "claude":
+        return False
+    try:
+        from brindle import procs
+
+        window = agent.tmux_window if same_server(agent) and owns_pane(db, agent) else ""
+        pane_pids = tmux.window_pids(window) if window else []
+        return bool(procs.running_commands(agent.id, pane_pids))
+    except Exception:  # noqa: BLE001
+        log.exception("brindle: couldn't look for %s's running commands", agent.id)
+        return False
+
+
 def tell_parent_unreported(db: DB, agent: Agent) -> None:
     """A worker stopped again after being reminded to report, still without a
     result. It won't be reminded again on its own, and its supervisor has
@@ -2336,6 +2384,11 @@ def tell_parent_unreported(db: DB, agent: Agent) -> None:
             return  # its verdict for the current commit is already recorded
     if agent.unreported_noted:
         return  # the supervisor was told once; no repeats
+    if command_running(db, agent):
+        # Its turn ended while a long or background command (a test run) is
+        # still going: it isn't stopped, and the command finishing wakes it.
+        # Not marked noted, so a real stop later still gets its one alert.
+        return
     db.update_agent(agent.id, unreported_noted=1)
     where = f" (branch `{ws.branch}`, workspace {ws.id})" if ws else ""
     tool = "submit_review" if agent.mode == "review" else "report_result"

{brindle-0.2.1 → brindle-0.3.0}/src/brindle/autopilot.py

@@ -451,6 +451,11 @@ def _unavailable(name: str, cfg: RepoConfig, repo_root: str, gate=None,
     over = gate.why_not(name, weight) if gate is not None and gate.active else None
     if over:
         return f"over budget, skipped {name} ({over})"
+    from brindle import model_access
+
+    denied = model_access.refused(name, repo_root)
+    if denied:
+        return f"model refused for this account ({denied.cause}; {denied.fix}), skipped {name}"
     cli = CLI_FOR_PROVIDER.get(p.provider)
     if cli and unusable(p.provider, p.env):
         return (f"{cli} isn't signed in, skipped {name}" if signed_out(p.provider, p.env)

{brindle-0.2.1 → brindle-0.3.0}/src/brindle/builtin_agents/developer-light.md

@@ -1,7 +1,7 @@
 ---
 name: developer-light
-description: Implements a small, well-specified task on its own branch, on Sonnet with low effort (the baseline of the light tier of weight routing)
+description: Implements a small, well-specified task on its own branch, on Haiku with low effort (the baseline of the light tier of weight routing)
 extends: developer
-model: sonnet
+model: haiku
 effort: low
 ---

{brindle-0.2.1 → brindle-0.3.0}/src/brindle/ci_adapters.py

@@ -19,11 +19,12 @@ An adapter answers four questions and does three things:
   its raw reply.
 * ``usage``: token usage of a session, by model.
 
-The credential rule (:func:`usable`): on a repository owned by a GitHub
-organization, a provider whose only credential is a personal subscription is
-unavailable for CI. Personal repositories may use it. Whether the owner is
-an organization comes from the workflow's event payload or the GitHub API
-(:func:`repo_is_org`); when neither says, the stricter answer is used.
+The credential rule (:func:`usable`): CI uses API keys, cloud sign-ins or
+identity federation only. A provider whose only credential is a personal
+subscription (``CLAUDE_CODE_OAUTH_TOKEN``, a Codex ChatGPT login) is
+unavailable for CI on every repository, personal or organization-owned.
+The repository owner (:func:`repo_is_org`) is still reported but no longer
+changes the rule.
 
 Nothing here decides anything about the run itself: no verdicts, no stall
 detection, no rendering. The server does that.
@@ -44,7 +45,7 @@ from pathlib import Path
 from typing import Mapping, MutableMapping
 
 
-from brindle import providers
+from brindle import model_access, providers
 from brindle.secrets import is_job_secret
 
 log = logging.getLogger(__name__)
@@ -57,7 +58,8 @@ RATE_LIMIT = "rate_limit"
 AUTH = "auth"
 
 CLAUDE_API_KEYS = ("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")
-CLAUDE_CLOUD = ("CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY")
+CLAUDE_CLOUD = ("CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
+                "CLAUDE_CODE_USE_MANTLE")
 CLAUDE_SUBSCRIPTION = ("CLAUDE_CODE_OAUTH_TOKEN",)
 CODEX_API_KEYS = ("OPENAI_API_KEY", "CODEX_API_KEY")
 CODEX_LOGIN = "codex login (auth.json)"     # the name shown for a ChatGPT sign-in
@@ -181,6 +183,11 @@ class Adapter:
         person answers), or None. Default: never."""
         return None
 
+    def notices(self, db, root) -> list[str]:
+        """Warnings the CLI printed that a run's notes should carry (Claude
+        Code's alias fallback to an older model). Default: none."""
+        return []
+
     def review(self, instructions: str, cwd: str, env: Mapping[str, str], *,
                timeout: float = REVIEW_TIMEOUT, profile: str | None = None) -> Review:
         raise AdapterError(f"{self.name} can't review")
@@ -340,12 +347,30 @@ class ClaudeAdapter(Adapter):
                 since = now
             self._api_errors[agent.id] = (error, since)
             line = api_error_line(error)
+            cause = model_access.classify(error)
+            if cause is not None:
+                # The account can't call the model: no retry will help.
+                # under the repo's fingerprint, which session_event reads the notes with
+                ws = db.get_workspace(agent.workspace_id)
+                model_access.refuse(agent.profile, cause, repo_root=ws.repo_root if ws else None)
+                return f"{who} can't call its model: {cause.line()} ({line})"
             if providers.ClaudeCode.FATAL_API_ERROR.match(error):
                 return f"{who} stopped on an error it won't retry: {line}"
             if now - since >= TRANSIENT_API_ERROR_S:
                 return f"{who} has been stopped on an API error for {int(now - since)}s: {line}"
         return None
 
+    def notices(self, db, root) -> list[str]:
+        from brindle import agents
+
+        found = []
+        for agent in [root, *(a for a in (agents.tree(db, root.id) if root else [])
+                              if a.id != root.id and a.provider == self.name)]:
+            warning = model_access.alias_fallback(self._screen(agent) or "")
+            if warning and warning not in found:
+                found.append(warning)
+        return found
+
     @staticmethod
     def _screen(root) -> str | None:
         from brindle import agents, tmux
@@ -610,10 +635,10 @@ def usable(adapter: Adapter, env: Mapping[str, str], org: bool | None) -> tuple[
     ok, why = adapter.available(env)
     if not ok:
         return False, why
-    if adapter.credential(env).kind == SUBSCRIPTION and org is not False:
-        who = "an organization" if org else "unknown (treated as an organization)"
-        return False, (f"its only credential is a personal subscription and the repository owner is "
-                       f"{who}: use an API key or a cloud sign-in")
+    if adapter.credential(env).kind == SUBSCRIPTION:
+        return False, ("its only credential is a personal subscription, which CI may not use "
+                       "(Anthropic's terms bar third parties from routing subscription credentials): "
+                       "use an API key or a cloud sign-in")
     return True, ""
 
 
@@ -642,6 +667,53 @@ def doctor(adapters: Mapping[str, Adapter], env: Mapping[str, str], org: bool |
     return rows
 
 
+def pinned_models(cwd: str) -> list[tuple[str, str]]:
+    """(profile, model) for each distinct model a Claude profile in the routing
+    tiers pins, in routing order."""
+    from brindle.config import DEFAULT_ROUTING, load_repo_config
+    from brindle.profiles import load_profile
+
+    try:
+        routing = load_repo_config(cwd).routing
+    except ValueError:
+        routing = DEFAULT_ROUTING
+    seen: dict[str, str] = {}
+    for tier in routing.values():
+        for name in tier:
+            try:
+                p = load_profile(name, cwd)
+            except KeyError:
+                continue
+            if p.provider == "claude" and p.model and p.model not in seen:
+                seen[p.model] = name
+    return [(profile, model) for model, profile in seen.items()]
+
+
+def check_models(adapters: Mapping[str, Adapter], env: Mapping[str, str], cwd: str,
+                 org: bool | None, *, run=subprocess.run) -> list[str]:
+    """One tiny call per pinned model through the claude CLI: a line each,
+    with the cause and fix of a model-access refusal. A refused profile is
+    remembered, so routing moves its tasks to the next profile of the tier."""
+    claude = adapters.get("claude")
+    if claude is None or not usable(claude, env, org)[0]:
+        return ["models: skipped (claude isn't usable here)"]
+    pinned = pinned_models(cwd)
+    if not pinned:
+        return ["models: none pinned"]
+    binary = claude.cli_path(env) or "claude"
+    lines = []
+    for profile, model in pinned:
+        ok, cause, text = model_access.probe(binary, model, cwd, claude_env(env), run=run)
+        if ok:
+            lines.append(f"model {model} ({profile}): ok")
+        elif cause is not None:
+            model_access.refuse(profile, cause, repo_root=cwd)
+            lines.append(f"model {model} ({profile}): refused: {cause.line()}")
+        else:
+            lines.append(f"model {model} ({profile}): failed: {api_error_line(text)}")
+    return lines
+
+
 def format_doctor(rows: list[dict], repo: str | None, org: bool | None) -> str:
     owner = {True: "an organization", False: "a personal account"}.get(org, "unknown; treated as an organization")
     lines = [f"repository: {repo or '(unknown)'}, owner is {owner}"]