agentradar-cli 0.1.0

package/README.md

@@ -0,0 +1,16 @@
+# AgentRadar CLI
+
+Secure vendor-agent onboarding for vendor-owned compute.
+
+From the agent's project folder:
+
+```sh
+npx -y agentradar-cli setup
+npx -y agentradar-cli skill install
+```
+
+The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the MCP entry to the project-local section of `~/.claude.json` with mode `0600`. It never prints the bearer or puts it in a URL, command argument, environment variable, or repository file.
+
+The skill command installs only the package-bundled `agentradar-vendor` markdown skill at `.claude/skills/agentradar-vendor/SKILL.md` in the current project. It does not fetch or require access to the private AgentRadar repository.
+
+Claude authentication stays separate: start Claude Code and use interactive `/login` with the vendor's claude.ai account. Do not set `ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN`.

package/dist/agentradar-vendor/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: agentradar-vendor
+description: >
+  Run an AgentRadar vendor agent on vendor-owned compute through the single
+  AgentRadar MCP. Use when receiving client work, replying, reporting usage,
+  or checking context for an AgentRadar engagement.
+---
+
+# AgentRadar vendor agent
+
+You work on the vendor's computer and connect to AgentRadar through the `agentradar` MCP only. AgentRadar holds every client channel credential; never ask for or store a client's Slack, email, Telegram, or AgentRadar token.
+
+## Authentication
+
+- Authenticate Claude Code interactively with `/login` and the vendor's claude.ai subscription.
+- Never use `ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN`.
+- Never print, inspect, copy, or move the AgentRadar MCP authorization header. The setup CLI stores it in the project-local entry of `~/.claude.json`, outside the project repository.
+
+## Work loop
+
+1. Use the AgentRadar MCP to receive the next event or assigned work.
+2. Read the supplied engagement context before acting.
+3. Do the work in this project folder on the vendor's compute.
+4. Reply through the MCP so AgentRadar can enforce the client boundary and audit the action.
+5. Report actual usage through the MCP when the work incurs billable time or metered extras.
+
+Do not connect directly to a client's workspace or bypass the MCP with direct channel/API calls.

package/dist/index.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { installVendorSkill } from "./skill-install.js";
+import { setupVendorAgent } from "./setup.js";
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 1 && args[0] === "setup") {
+        await setupVendorAgent();
+        return;
+    }
+    if (args.length === 2 && args[0] === "skill" && args[1] === "install") {
+        await installVendorSkill();
+        return;
+    }
+    console.error("Usage: agentradar setup | agentradar skill install");
+    process.exitCode = 1;
+}
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : "AgentRadar command failed");
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/setup.js

@@ -0,0 +1,97 @@
+import { lstat, readFile, realpath, rename, chmod, writeFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { homedir } from "node:os";
+const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
+async function postJson(fetchImpl, url, body) {
+    return fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json", "cache-control": "no-store" },
+        body: JSON.stringify(body),
+    });
+}
+async function responseJson(response) {
+    if (!response.ok)
+        throw new Error(`AgentRadar setup request failed (${response.status})`);
+    return response.json();
+}
+async function installProjectMcp(home, cwd, installation) {
+    const endpoint = new URL(installation.mcpEndpoint);
+    if (endpoint.protocol !== "https:" || !/^ar_[A-Za-z0-9_-]+$/.test(installation.bearer)) {
+        throw new Error("AgentRadar returned an invalid setup payload");
+    }
+    const projectPath = await realpath(cwd);
+    const configPath = join(home, ".claude.json");
+    let config = {};
+    try {
+        const info = await lstat(configPath);
+        if (info.isSymbolicLink())
+            throw new Error("Refusing to replace a symlinked ~/.claude.json");
+        const parsed = JSON.parse(await readFile(configPath, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("~/.claude.json must contain a JSON object");
+        }
+        config = parsed;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const projects = config.projects && typeof config.projects === "object" && !Array.isArray(config.projects)
+        ? config.projects
+        : {};
+    const project = projects[projectPath] && typeof projects[projectPath] === "object" && !Array.isArray(projects[projectPath])
+        ? projects[projectPath]
+        : {};
+    const mcpServers = project.mcpServers && typeof project.mcpServers === "object" && !Array.isArray(project.mcpServers)
+        ? project.mcpServers
+        : {};
+    mcpServers.agentradar = {
+        type: "http",
+        url: endpoint.toString(),
+        headers: { Authorization: `Bearer ${installation.bearer}` },
+        timeout: 1_800_000,
+    };
+    project.mcpServers = mcpServers;
+    projects[projectPath] = project;
+    config.projects = projects;
+    const tempPath = `${configPath}.${process.pid}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    await rename(tempPath, configPath);
+    await chmod(configPath, 0o600);
+}
+export async function setupVendorAgent(deps = {}) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const log = deps.log ?? console.log;
+    const cwd = deps.cwd ?? process.cwd();
+    const home = deps.home ?? homedir();
+    const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
+    if (!agentName)
+        throw new Error("Run setup from the agent project folder");
+    const apiBase = deps.apiUrl ?? process.env.AGENTRADAR_API_URL ?? DEFAULT_API_URL;
+    const setupUrl = new URL("vendor/agent-setups", `${apiBase.replace(/\/+$/, "")}/`);
+    const started = await responseJson(await postJson(fetchImpl, setupUrl, { name: agentName }));
+    if (!/^ars_[A-Za-z0-9_-]+$/.test(started.deviceCode) || !/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(started.userCode)) {
+        throw new Error("AgentRadar returned an invalid setup challenge");
+    }
+    log(`Approve code ${started.userCode} at ${started.verificationUri}`);
+    log("Waiting for approval…");
+    const tokenUrl = new URL("vendor/agent-setups/token", `${apiBase.replace(/\/+$/, "")}/`);
+    const expiresAt = Date.now() + started.expiresIn * 1000;
+    while (Date.now() < expiresAt) {
+        await sleep(Math.max(1, started.interval) * 1000);
+        const response = await postJson(fetchImpl, tokenUrl, { deviceCode: started.deviceCode });
+        if (response.status === 202)
+            continue;
+        if (response.status === 410)
+            throw new Error("AgentRadar setup code expired; run setup again");
+        const approved = await responseJson(response);
+        if (approved.status !== "approved")
+            throw new Error("AgentRadar returned an invalid setup state");
+        await installProjectMcp(home, cwd, approved.installation);
+        log("AgentRadar MCP installed for this project. Start Claude Code and use /login with your claude.ai account.");
+        return;
+    }
+    throw new Error("AgentRadar setup code expired; run setup again");
+}
+//# sourceMappingURL=setup.js.map

package/dist/skill-install.js

@@ -0,0 +1,42 @@
+import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+async function ensureDirectory(path) {
+    try {
+        const info = await lstat(path);
+        if (info.isSymbolicLink())
+            throw new Error(`Refusing to install through symlinked ${path}`);
+        if (!info.isDirectory())
+            throw new Error(`Expected a directory at ${path}`);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await mkdir(path);
+    }
+}
+export async function installVendorSkill(deps = {}) {
+    const projectPath = await realpath(deps.cwd ?? process.cwd());
+    const claudeDir = join(projectPath, ".claude");
+    const skillsDir = join(claudeDir, "skills");
+    const skillDir = join(skillsDir, "agentradar-vendor");
+    await ensureDirectory(claudeDir);
+    await ensureDirectory(skillsDir);
+    await ensureDirectory(skillDir);
+    const markdown = await readFile(deps.source ?? new URL("./agentradar-vendor/SKILL.md", import.meta.url), "utf8");
+    const destination = join(skillDir, "SKILL.md");
+    const temporary = join(skillDir, `.SKILL.md.${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, markdown, { flag: "wx", mode: 0o644 });
+        await rename(temporary, destination);
+        await chmod(destination, 0o644);
+    }
+    finally {
+        await unlink(temporary).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+    }
+    (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
+}
+//# sourceMappingURL=skill-install.js.map

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "agentradar-cli",
+  "version": "0.1.0",
+  "description": "Secure AgentRadar vendor setup and skill installer",
+  "type": "module",
+  "bin": {
+    "agentradar": "./dist/index.js"
+  },
+  "files": [
+    "dist/index.js",
+    "dist/setup.js",
+    "dist/skill-install.js",
+    "dist/agentradar-vendor/SKILL.md",
+    "README.md"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc && mkdir -p dist/agentradar-vendor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && chmod +x dist/index.js",
+    "clean": "rm -rf dist",
+    "prepack": "pnpm run build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@types/node": "^22.19.21",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.8"
+  }
+}