@openagents-org/agent-launcher 0.2.177 → 0.2.178

package/icons/codebuddy.svg

@@ -1,3 +1,38 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" viewBox="0 0 1024 1024" role="img" style="flex:none;line-height:1">
+<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" viewBox="0 0 40 40" fill="none" role="img" style="flex:none;line-height:1">
 <title>CodeBuddy Code</title>
-<rect x="88" y="88" width="848" height="848" rx="182" fill="#0052d9"/><path d="M400 372 262 512l138 140m224-280 138 140-138 140M566 316 458 708" stroke="#fff" stroke-width="62" stroke-linecap="round" stroke-linejoin="round" fill="none"/></svg>
+<g clip-path="url(#cb-clip)">
+<rect width="40" height="40" rx="20" fill="url(#cb-bg)"/>
+<g filter="url(#cb-glow-a)">
+<circle cx="12.6071" cy="34.9794" r="14.081" fill="#32E6B9" fill-opacity="0.4"/>
+</g>
+<g filter="url(#cb-glow-b)">
+<circle cx="33.3404" cy="43.6185" r="12.8704" fill="#32E6B9"/>
+</g>
+<path d="M27.6897 3.3426C28.057 3.01322 28.0795 2.99983 28.3485 2.98366C28.7851 2.95177 29.1858 3.16107 29.8664 3.78072C31.4566 5.22574 33.6703 8.19724 35.047 10.7343L35.5796 11.7191L36.3309 12.0927C37.0562 12.4593 38.2459 13.2111 38.7428 13.614C38.9673 13.7997 38.9992 13.8032 39.2326 13.7124C40.2872 13.3017 41.7982 13.846 43.1307 15.1244C44.3302 16.274 45.479 18.2384 45.9191 19.8778C45.9833 20.1417 46.0683 20.709 46.0994 21.1314C46.1997 22.6144 45.7243 23.7986 44.8085 24.3349C44.6213 24.443 44.6085 24.4725 44.6137 24.939C44.6559 27.1604 44.0571 29.3777 42.8543 31.54C41.4965 33.9678 39.0794 36.4798 35.8073 38.846C34.0502 40.1247 29.8918 42.5469 28.0122 43.3973C23.5096 45.4244 19.8999 46.2022 16.7645 45.8181C14.8943 45.5915 12.7771 44.8611 11.5246 44.0137C11.1951 43.786 11.1428 43.7719 10.8909 43.8439C9.55017 44.2289 7.79442 43.4374 6.30272 41.7817C5.70771 41.1197 4.74709 39.4939 4.43575 38.6241C3.71569 36.5887 3.85859 34.752 4.81783 33.6551C5.0657 33.3725 5.07387 33.3607 5.01972 32.8856C4.93033 32.1079 4.88982 30.9566 4.93066 30.2138L4.96343 29.5205L3.92091 27.6777C2.3078 24.8074 1.28326 22.3968 0.887982 20.5554C0.679402 19.546 0.692781 19.0981 0.949061 18.7667C1.10529 18.5666 1.61622 18.3594 2.23252 18.2455C3.78518 17.9729 7.17203 18.2198 10.9394 18.885L11.3303 18.9525L12.1903 18.1921C13.6179 16.9275 14.5665 16.2176 16.315 15.1274C18.1373 13.9872 20.1943 13.0498 22.5103 12.3071L23.2533 12.0687L23.6615 10.9964C25.1239 7.13587 26.6218 4.28969 27.6897 3.3426ZM15.4393 23.1261C13.7864 24.0804 12.9602 24.5582 12.3529 25.093C9.89364 27.2585 8.9738 30.6888 10.0208 33.7938C10.2794 34.5606 10.7568 35.387 11.7111 37.0398C12.6653 38.6926 13.1424 39.5194 13.6771 40.1267C15.8426 42.5859 19.2732 43.5045 22.3783 42.4574C23.145 42.1989 23.972 41.7223 25.6248 40.768L35.1333 35.2783C36.7862 34.324 37.6124 33.8462 38.2196 33.3114C40.6789 31.1459 41.5988 27.7156 40.5518 24.6105C40.2932 23.8438 39.8157 23.0174 38.8615 21.3646C37.9072 19.7117 37.4302 18.885 36.8955 18.2777C34.7299 15.8185 31.2993 14.8999 28.1943 15.947C27.4275 16.2055 26.6006 16.6821 24.9478 17.6364L15.4393 23.1261Z" fill="url(#cb-cat)"/>
+<rect x="15.8816" y="30.0273" width="4.00904" height="8.32646" rx="2.00452" transform="rotate(-30 15.8816 30.0273)" fill="white"/>
+<rect x="26.6978" y="23.7812" width="4.00904" height="8.32646" rx="2.00452" transform="rotate(-30 26.6978 23.7812)" fill="white"/>
+</g>
+<defs>
+<filter id="cb-glow-a" x="-14.9163" y="7.45599" width="55.0468" height="55.047" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
+<feGaussianBlur stdDeviation="6.72123" result="cb-blur"/>
+</filter>
+<filter id="cb-glow-b" x="9.46959" y="19.7477" width="47.7417" height="47.741" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
+<feGaussianBlur stdDeviation="5.50019" result="cb-blur"/>
+</filter>
+<linearGradient id="cb-bg" x1="20" y1="0" x2="20" y2="40" gradientUnits="userSpaceOnUse">
+<stop stop-color="#6C4DFF"/>
+<stop offset="1" stop-color="#583ED3"/>
+</linearGradient>
+<linearGradient id="cb-cat" x1="14.639" y1="10.7917" x2="32.1712" y2="41.1585" gradientUnits="userSpaceOnUse">
+<stop stop-color="white" stop-opacity="0.8"/>
+<stop offset="0.437689" stop-color="white"/>
+</linearGradient>
+<clipPath id="cb-clip">
+<rect width="40" height="40" rx="20" fill="white"/>
+</clipPath>
+</defs>
+</svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagents-org/agent-launcher",
-  "version": "0.2.177",
+  "version": "0.2.178",
   "description": "OpenAgents Launcher — install, configure, and run AI coding agents from your terminal",
   "main": "src/index.js",
   "bin": {

package/registry.json

@@ -1680,7 +1680,7 @@
       "saved_env_key": "CODEBUDDY_API_KEY",
       "login_command": "codebuddy",
       "unverifiable": true,
-      "not_ready_message": "Sign-in not confirmed. Set CODEBUDDY_API_KEY (press e), or run `codebuddy` and sign in with /login — there is no non-interactive login command. Auth is confirmed when you run a task.",
+      "not_ready_message": "Not signed in for this site. Sign in with the Login button — it opens the CLI on the site CODEBUDDY_REGION selects, where you run /login — or set CODEBUDDY_API_KEY / CODEBUDDY_AUTH_TOKEN (press e). A session for the other site does not carry over: the CLI keeps only one, and codebuddy.ai and codebuddy.cn are separate accounts.",
       "auth_detected_labels": {
         "cli_login": "CodeBuddy sign-in detected",
         "api_key": "API key detected"

package/src/adapters/base.js

@@ -1079,11 +1079,23 @@ class BaseAdapter {
     }
   }
 
+  /**
+   * Post the agent's answer for a turn — the last thing said before control
+   * returns to the user.
+   *
+   * `status_kind: 'completed'` marks it as exactly that. The backend's push
+   * fan-out (workspace/backend/app/services/push.py) reads the field and
+   * notifies under the user's "task completions" switch instead of the
+   * "all messages" firehose, which is off by default. It has to be a
+   * structured field: an earlier attempt matched the word "completed" in the
+   * message text and fired on every bash for-loop that ended in `done`.
+   */
   async sendResponse(channel, content) {
     try {
       await this.client.sendMessage(this.workspaceId, channel, this.token, content, {
         senderType: 'agent',
         senderName: this.agentName,
+        metadata: { status_kind: 'completed' },
         sessionId: this._sessionId,
       });
     } catch (e) {
@@ -1154,11 +1166,18 @@ class BaseAdapter {
     }
   }
 
+  /**
+   * Post a turn that ended badly. Carries `status_kind: 'error'` so the push
+   * fan-out routes it to the user's "agent errors" switch rather than the
+   * general message firehose — same structured-field contract as
+   * sendResponse's 'completed'.
+   */
   async sendError(channel, error) {
     try {
       await this.client.sendMessage(this.workspaceId, channel, this.token, error, {
         senderType: 'agent',
         senderName: this.agentName,
+        metadata: { status_kind: 'error' },
         sessionId: this._sessionId,
       });
     } catch (e) {

package/src/adapters/claude.js

@@ -17,7 +17,7 @@ const path = require('path');
 const { execSync, spawn } = require('child_process');
 
 const BaseAdapter = require('./base');
-const { formatAttachmentsForPrompt, SESSION_DEFAULT_RE, generateSessionTitle } = require('./utils');
+const { formatAttachmentsForPrompt, SESSION_DEFAULT_RE, generateSessionTitle, redactSecrets } = require('./utils');
 const { buildClaudeSystemPrompt, buildClaudeSkillMd, workspaceSkillName } = require('./workspace-prompt');
 const { pinnedFingerprint, sampleRecap } = require('./decision-log');
 const { defaultAgentWorkdir, whichBinary, whereBinary } = require('../paths');
@@ -737,9 +737,17 @@ class ClaudeAdapter extends BaseAdapter {
       }
 
       if (consecutiveTimeouts >= this._WATCHDOG_MAX_TIMEOUTS) {
+        const tail = this._stderrTail(pp);
         this._log(`Watchdog: process unresponsive for ${consecutiveTimeouts * 15}s on ${pp.msgChannel} — killing`);
+        if (tail) this._log(`stderr: ${tail}`);
         this._stopWatchdog(pp);
-        try { await this.sendError(pp.msgChannel, 'Agent process became unresponsive and was restarted.'); } catch {}
+        try {
+          await this.sendError(
+            pp.msgChannel,
+            'Agent process became unresponsive and was restarted.' +
+              (tail ? `\n\n\`\`\`\n${tail}\n\`\`\`` : ''),
+          );
+        } catch {}
         if (pp.messageResolve) {
           const resolve = pp.messageResolve;
           pp.messageResolve = null;
@@ -926,6 +934,8 @@ class ClaudeAdapter extends BaseAdapter {
 
     proc.on('exit', (code) => {
       this._log(`Persistent process exited: channel=${channel} code=${code}`);
+      const tail = this._stderrTail(pp);
+      if (tail) this._log(`stderr: ${tail}`);
       pp.alive = false;
       if (pp.idleTimer) clearTimeout(pp.idleTimer);
       this._stopWatchdog(pp);
@@ -992,6 +1002,22 @@ class ClaudeAdapter extends BaseAdapter {
     });
   }
 
+  /**
+   * What the CLI wrote to stderr this turn, trimmed and redacted, or ''.
+   *
+   * `stderrBuf` was collected and then read by nothing at all: when the process
+   * died before emitting a single JSON event, or hung without emitting one, the
+   * only account of why sat in a string no code path ever looked at. The channel
+   * got "No response generated" and the daemon log got an exit code, so a run
+   * that had the reason in hand reported none. codex, gemini and opencode all
+   * log their stderr on exit; this is that, plus the two paths — watchdog kill
+   * and silent exit — where it is the ONLY thing there is to report.
+   */
+  _stderrTail(pp) {
+    const tail = String((pp && pp.stderrBuf) || '').trim();
+    return tail ? redactSecrets(tail).slice(-800) : '';
+  }
+
   /**
    * Turn a raw Claude `result` error into a user-facing message. Auth failures
    * (401 / invalid token) are the most common real-world cause and are otherwise
@@ -1291,10 +1317,15 @@ class ClaudeAdapter extends BaseAdapter {
             continue;
           }
           if (!pp.everPostedAnything) {
-            if (pp.lastErrorText) {
-              try { await this.sendError(msgChannel, this._formatClaudeError(pp.lastErrorText)); } catch {}
+            // stderr is the fallback, not nothing: a CLI that dies before its
+            // first JSON event leaves no `result` to read, and "No response
+            // generated. Please try again." is what turned those into an
+            // unreportable failure.
+            const detail = pp.lastErrorText || this._stderrTail(pp);
+            if (detail) {
+              try { await this.sendError(msgChannel, this._formatClaudeError(detail)); } catch {}
             } else {
-              try { await this.sendResponse(msgChannel, 'No response generated. Please try again.'); } catch {}
+              try { await this.sendResponse(msgChannel, `No response generated (exit code ${result.code === undefined ? 'unknown' : result.code}). Please try again.`); } catch {}
             }
           }
           break;

package/src/adapters/codex.js

@@ -21,6 +21,7 @@ const https = require('https');
 
 const { whereBinary } = require('../paths');
 const BaseAdapter = require('./base');
+const { redactSecrets } = require('./utils');
 const { buildOpenclawSystemPrompt } = require('./workspace-prompt');
 
 const IS_WINDOWS = process.platform === 'win32';
@@ -535,18 +536,7 @@ class CodexAdapter extends BaseAdapter {
 
   /** Redact secrets (keys, tokens, bearer/authorization, query secrets) from diagnostics. */
   static _redact(s) {
-    let out = String(s == null ? '' : s);
-    out = out
-      .replace(/\bsk-[A-Za-z0-9_-]{6,}/g, 'sk-[REDACTED]')
-      .replace(/\b(?:github_pat|gh[pousr])_[A-Za-z0-9_]{10,}/g, '[REDACTED_TOKEN]')
-      .replace(/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, '[REDACTED_TOKEN]')
-      .replace(/\bAKIA[0-9A-Z]{12,}/g, '[REDACTED_KEY]')
-      .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g, '[REDACTED_JWT]')
-      .replace(/(authorization|api[_-]?key|x-api-key|token|bearer|secret|password|passwd)(["'\s:=]+)([^\s"',}]+)/gi,
-        (m, k, sep) => `${k}${sep}[REDACTED]`)
-      .replace(/([?&](?:api[_-]?key|key|token|access_token)=)[^&\s"']+/gi, '$1[REDACTED]')
-      .replace(/\b[A-Za-z0-9_-]{40,}\b/g, '[REDACTED]');
-    return out;
+    return redactSecrets(s);
   }
 
   // ------------------------------------------------------------------

package/src/adapters/opencode.js

@@ -17,7 +17,7 @@ const crypto = require('crypto');
 const { execSync, spawn } = require('child_process');
 
 const BaseAdapter = require('./base');
-const { formatAttachmentsForPrompt } = require('./utils');
+const { formatAttachmentsForPrompt, redactSecrets } = require('./utils');
 const { buildOpenCodeSkillMd, buildOpenCodeSystemPrompt, workspaceSkillName } = require('./workspace-prompt');
 const { whichBinary, whereBinary, getEnhancedEnv } = require('../paths');
 
@@ -1224,18 +1224,7 @@ class OpenCodeAdapter extends BaseAdapter {
 
   /** Redact secrets (keys, tokens, bearer/authorization, query secrets) from diagnostics. */
   static _redact(s) {
-    let out = String(s == null ? '' : s);
-    out = out
-      .replace(/\bsk-[A-Za-z0-9_-]{6,}/g, 'sk-[REDACTED]')
-      .replace(/\b(?:github_pat|gh[pousr])_[A-Za-z0-9_]{10,}/g, '[REDACTED_TOKEN]')
-      .replace(/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, '[REDACTED_TOKEN]')
-      .replace(/\bAKIA[0-9A-Z]{12,}/g, '[REDACTED_KEY]')
-      .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g, '[REDACTED_JWT]')
-      .replace(/(authorization|api[_-]?key|x-api-key|token|bearer|secret|password|passwd)(["'\s:=]+)([^\s"',}]+)/gi,
-        (m, k, sep) => `${k}${sep}[REDACTED]`)
-      .replace(/([?&](?:api[_-]?key|key|token|access_token)=)[^&\s"']+/gi, '$1[REDACTED]')
-      .replace(/\b[A-Za-z0-9_-]{40,}\b/g, '[REDACTED]');
-    return out;
+    return redactSecrets(s);
   }
 }
 

package/src/adapters/utils.js

@@ -120,8 +120,35 @@ function formatAttachmentsForPrompt(
   return lines.join('\n');
 }
 
+/**
+ * Strip secrets out of anything on its way to a log line or a channel message.
+ *
+ * Adapter diagnostics quote raw CLI output, and a CLI that fails on auth tends
+ * to echo the credential it was handed. The shapes here are the ones that
+ * actually turn up in that output; the closing catch-all takes any long opaque
+ * token the named patterns missed.
+ *
+ * Lived as a private static on two adapters before claude needed it as well —
+ * a third identical copy is one copy too many for a security-relevant rule.
+ */
+function redactSecrets(s) {
+  let out = String(s == null ? '' : s);
+  out = out
+    .replace(/\bsk-[A-Za-z0-9_-]{6,}/g, 'sk-[REDACTED]')
+    .replace(/\b(?:github_pat|gh[pousr])_[A-Za-z0-9_]{10,}/g, '[REDACTED_TOKEN]')
+    .replace(/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, '[REDACTED_TOKEN]')
+    .replace(/\bAKIA[0-9A-Z]{12,}/g, '[REDACTED_KEY]')
+    .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g, '[REDACTED_JWT]')
+    .replace(/(authorization|api[_-]?key|x-api-key|token|bearer|secret|password|passwd)(["'\s:=]+)([^\s"',}]+)/gi,
+      (m, k, sep) => `${k}${sep}[REDACTED]`)
+    .replace(/([?&](?:api[_-]?key|key|token|access_token)=)[^&\s"']+/gi, '$1[REDACTED]')
+    .replace(/\b[A-Za-z0-9_-]{40,}\b/g, '[REDACTED]');
+  return out;
+}
+
 module.exports = {
   SESSION_DEFAULT_RE,
   generateSessionTitle,
   formatAttachmentsForPrompt,
+  redactSecrets,
 };

package/src/installer.js

@@ -1805,6 +1805,22 @@ class Installer {
         } catch {}
       }
     }
+    // Where a user-level installer puts things, on every platform. uv's own
+    // `curl … | sh` (and its Windows script) install into ~/.local/bin and add
+    // it to PATH through a shell profile that a GUI-launched process never
+    // reads — so an install command that IS `uv tool install …` died with
+    // "uv: command not found" on a machine that had uv. install-preflight's
+    // probeUv already searches these two, so leaving them out here meant the
+    // pre-flight passed and the spawn it was guarding then failed.
+    // unshift, not push: the loop below PREPENDS each entry, so the first one
+    // here ends up LAST on PATH. These are a fallback for a binary nothing else
+    // provides — they must never shadow the user's own PATH or the runtime
+    // directories above.
+    extraDirs.unshift(
+      path.join(os.homedir(), '.local', 'bin'),
+      path.join(os.homedir(), '.cargo', 'bin'),
+    );
+
     // On Windows the spread above yields a "Path" key, not "PATH". Writing
     // `env.PATH` would create a duplicate key holding only extraDirs and drop
     // everything else; libuv then resolves spawned binaries against the wrong,

package/src/probe.js

@@ -30,7 +30,6 @@ const { spawn } = require('child_process');
 const { getEnhancedEnv } = require('./paths');
 const { shouldUseShellForBinary } = require('./adapters/health-status');
 const { formatAuthGuidance } = require('./auth-guidance');
-const { testLLMConnection } = require('./utils');
 
 const PROBE_PROMPT = 'hi';
 const DEFAULT_TIMEOUT_MS = 90_000;
@@ -90,7 +89,10 @@ function authFlavor(entry, agentEnv) {
  */
 /** Classify an error by its OUTPUT TEXT alone; null when nothing matches. */
 function classifyOutputText(text) {
-  if (/credit balance|insufficient[_ ]?(quota|credits|funds)|payment required|\b402\b|billing/.test(text)) return CODE.OUT_OF_CREDIT;
+  // Relays word this their own way and answer 403 rather than 402, so the
+  // English-and-402 pattern alone read "out of credit" as "bad credentials"
+  // — the one misreading that sends a user to re-authenticate a working key.
+  if (/credit balance|insufficient[_ ]?(quota|credits|funds)|payment required|\b402\b|billing|quota[_ ]?exceeded|exceeded your current quota|额度|余额|欠费|余额不足/.test(text)) return CODE.OUT_OF_CREDIT;
   if (/rate[- ]?limit|too many requests|\b429\b|overloaded|\b529\b/.test(text)) return CODE.RATE_LIMITED;
   if (/enotfound|econnrefused|econnreset|etimedout|eai_again|fetch failed|socket hang up|network error|self[- ]signed certificate|unable to get local issuer/.test(text)) return CODE.NETWORK;
   if (/api key.{0,24}(not set|not found|missing)|no api key|missing api key|environment variable.{0,40}(is )?(not set|required)/.test(text)) return CODE.MISSING_API_KEY;
@@ -171,6 +173,37 @@ function buildGuidance(code, entry, agentEnv, extra = {}) {
   return lines;
 }
 
+/**
+ * Ask the model endpoint directly why an agent is not answering.
+ *
+ * Only ever used to REPLACE a verdict that explains nothing, and only when it
+ * can do better: a successful call means the endpoint is healthy and whatever
+ * ails the CLI is the CLI's own, which the caller's vaguer answer already says
+ * more honestly than "everything is fine" would. Likewise an unclassifiable
+ * error — swapping one shrug for another helps nobody.
+ */
+async function directApiVerdict(agentEnv, entry) {
+  // Required here rather than at the top so a test can stand in for it, and
+  // so a probe that never reaches this path never loads the HTTP client.
+  const { testLLMConnection } = require('./utils');
+  let res;
+  try {
+    res = await testLLMConnection(agentEnv);
+  } catch (e) {
+    res = { success: false, error: e.message };
+  }
+  if (!res || res.success) return null;
+  const code = classifyFailure(res.error, {});
+  if (code === CODE.CLI_ERROR) return null;
+  return {
+    ok: false,
+    method: 'llm_api',
+    code,
+    message: tail(res.error, OUTPUT_CAP),
+    guidance: buildGuidance(code, entry, agentEnv),
+  };
+}
+
 /** Run a CLI to completion with a hard timeout. Never rejects. */
 function runCommand(cmd, args, { env, timeoutMs, shell = false }) {
   return new Promise((resolve) => {
@@ -266,6 +299,10 @@ async function probeAgentType(connector, type, opts = {}) {
     || (entry.probe && entry.probe.timeout_s ? entry.probe.timeout_s * 1000 : DEFAULT_TIMEOUT_MS);
   const env = { ...getEnhancedEnv(), ...agentEnv };
 
+  // Hoisted above the CLI tier: a failing CLI probe consults it too (below).
+  const hasApiKey = !!(agentEnv.LLM_API_KEY || agentEnv.OPENAI_API_KEY || agentEnv.ANTHROPIC_API_KEY
+    || agentEnv.ANTHROPIC_AUTH_TOKEN || agentEnv.KIMI_API_KEY || agentEnv.MOONSHOT_API_KEY);
+
   // ── Live tier 1: the agent's own CLI, when the registry declares how ──
   const probeArgs = entry.probe && Array.isArray(entry.probe.args) ? entry.probe.args : null;
   const altCheck = entry.check_ready && entry.check_ready.alt_check;
@@ -298,6 +335,19 @@ async function probeAgentType(connector, type, opts = {}) {
         guidance: buildGuidance(code, entry, agentEnv),
       });
     }
+    // A CLI verdict is not always the true one. A relay answering 403 "out of
+    // credit" makes Claude Code retry in silence until the probe's clock runs
+    // out, and all that reaches here is a timeout with an unrelated warning on
+    // stderr — which the guidance then reads as "it may be waiting for a login
+    // prompt", sending the user to a terminal to fix something that is not
+    // broken. Where the agent carries an endpoint and a key, ask the API the
+    // same question directly: one round trip, and it says why.
+    const unexplained = code === CODE.TIMEOUT || code === CODE.CLI_ERROR || code === CODE.EMPTY_RESPONSE;
+    if (unexplained && hasApiKey) {
+      const direct = await directApiVerdict(agentEnv, entry);
+      if (direct) return done(direct);
+    }
+
     return done({
       ok: false, method: 'cli', code,
       message: tail(res.stderr || res.stdout, OUTPUT_CAP) || (res.timedOut ? 'Timed out' : `Exited with code ${res.code}`),
@@ -306,9 +356,8 @@ async function probeAgentType(connector, type, opts = {}) {
   }
 
   // ── Live tier 2: direct LLM API call for API-key agents (e.g. OpenClaw) ──
-  const hasApiKey = !!(agentEnv.LLM_API_KEY || agentEnv.OPENAI_API_KEY || agentEnv.ANTHROPIC_API_KEY
-    || agentEnv.KIMI_API_KEY || agentEnv.MOONSHOT_API_KEY);
   if (hasApiKey || (entry.install && entry.install.api_only)) {
+    const { testLLMConnection } = require('./utils');
     let res;
     try { res = await testLLMConnection(agentEnv); } catch (e) { res = { success: false, error: e.message }; }
     if (res && res.success) {

package/src/utils.js

@@ -13,12 +13,20 @@ function testLLMConnection(env) {
   const http = require('http');
 
   const hasKimiConfig = !!(env.KIMI_API_KEY || env.MOONSHOT_API_KEY || env.KIMI_BASE_URL || env.KIMI_MODEL);
-  const apiKey = env.KIMI_API_KEY || env.MOONSHOT_API_KEY || env.LLM_API_KEY || env.OPENAI_API_KEY || env.ANTHROPIC_API_KEY || '';
+  const apiKey = env.KIMI_API_KEY || env.MOONSHOT_API_KEY || env.LLM_API_KEY || env.OPENAI_API_KEY
+    || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || '';
   if (!apiKey) return Promise.resolve({ success: false, error: 'No API key provided' });
 
   let baseUrl = (env.KIMI_BASE_URL || env.LLM_BASE_URL || env.OPENAI_BASE_URL || (hasKimiConfig ? 'https://api.moonshot.ai/v1' : 'https://api.openai.com/v1')).replace(/\/$/, '');
   const model = env.KIMI_MODEL || env.LLM_MODEL || env.OPENCLAW_MODEL || '';
-  const isAnthropic = baseUrl.includes('anthropic');
+  // An agent configured the Anthropic way is Anthropic-shaped wherever it
+  // points. Reading only the URL missed every relay whose host says nothing
+  // about the protocol it speaks — the common case for Claude Code, which is
+  // configured entirely through ANTHROPIC_* — and sent the test to OpenAI's
+  // default endpoint with an Anthropic key.
+  const hasAnthropicConfig = !hasKimiConfig && !env.LLM_API_KEY && !env.OPENAI_API_KEY
+    && !!(env.ANTHROPIC_BASE_URL || env.ANTHROPIC_MODEL || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY);
+  const isAnthropic = hasAnthropicConfig || baseUrl.includes('anthropic');
 
   if (!isAnthropic && !baseUrl.endsWith('/v1')) {
     baseUrl += '/v1';
@@ -28,14 +36,25 @@ function testLLMConnection(env) {
     let url, headers, body;
 
     if (isAnthropic) {
-      url = 'https://api.anthropic.com/v1/messages';
+      // The configured endpoint, not the official one: a relay IS the API as
+      // far as this agent is concerned, and testing api.anthropic.com would
+      // report on a service the agent never talks to.
+      const base = (env.ANTHROPIC_BASE_URL || 'https://api.anthropic.com').replace(/\/+$/, '');
+      url = /\/v1$/.test(base) ? `${base}/messages` : `${base}/v1/messages`;
+      const token = env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || apiKey;
       headers = {
-        'x-api-key': apiKey,
+        'x-api-key': token,
         'anthropic-version': '2023-06-01',
         'content-type': 'application/json',
       };
+      // Relays are split on which header they read, and Claude Code itself
+      // sends the bearer when pointed at one. Only off the official host: the
+      // real API has no use for it.
+      if (!/api\.anthropic\.com$/.test(new URL(url).hostname)) {
+        headers['authorization'] = `Bearer ${token}`;
+      }
       body = JSON.stringify({
-        model: model || 'claude-sonnet-4-20250514',
+        model: env.ANTHROPIC_MODEL || model || 'claude-sonnet-4-20250514',
         max_tokens: 32,
         messages: [{ role: 'user', content: 'Say hi in 5 words.' }],
       });