agentradar-cli 0.1.0 → 0.1.2

package/README.md

@@ -9,7 +9,11 @@ npx -y agentradar-cli setup
 npx -y agentradar-cli skill install
 ```
 
-The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the MCP entry to the project-local section of `~/.claude.json` with mode `0600`. It never prints the bearer or puts it in a URL, command argument, environment variable, or repository file.
+The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the MCP entry to the project-local section of `$CLAUDE_CONFIG_DIR/.claude.json`, or `~/.claude.json` when that variable is unset, with mode `0600`. It prints the path it wrote. It never prints the bearer or puts it in a URL, command argument, environment variable, or repository file.
+
+Claude Code asks you to trust the folder on first launch. `setup` does not pre-accept that for you, and the onboarding lines above deliberately do not: the `hasTrustDialogAccepted` flag trusts everything already in the directory — existing hooks, `.claude/settings.json`, skills — not just the MCP entry setup added. Dismiss the prompt yourself.
+
+There is a `--trust` flag for unattended runners, where a launch prompt would hang the process with nobody there to answer it. It is not part of normal onboarding and is deliberately not given here as a line to paste: read the paragraph above, decide the folder holds nothing you would not run, and then type it.
 
 The skill command installs only the package-bundled `agentradar-vendor` markdown skill at `.claude/skills/agentradar-vendor/SKILL.md` in the current project. It does not fetch or require access to the private AgentRadar repository.
 

package/dist/index.js

@@ -7,11 +7,15 @@ async function main() {
         await setupVendorAgent();
         return;
     }
+    if (args.length === 2 && args[0] === "setup" && args[1] === "--trust") {
+        await setupVendorAgent({ trust: true });
+        return;
+    }
     if (args.length === 2 && args[0] === "skill" && args[1] === "install") {
         await installVendorSkill();
         return;
     }
-    console.error("Usage: agentradar setup | agentradar skill install");
+    console.error("Usage: agentradar setup [--trust] | agentradar skill install");
     process.exitCode = 1;
 }
 main().catch((error) => {

package/dist/setup.js

@@ -1,6 +1,7 @@
 import { lstat, readFile, realpath, rename, chmod, writeFile } from "node:fs/promises";
-import { basename, join } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { homedir } from "node:os";
+import * as tls from "node:tls";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
 async function postJson(fetchImpl, url, body) {
     return fetchImpl(url, {
@@ -14,21 +15,64 @@ async function responseJson(response) {
         throw new Error(`AgentRadar setup request failed (${response.status})`);
     return response.json();
 }
-async function installProjectMcp(home, cwd, installation) {
+/**
+ * D3 — where Claude Code actually reads its config from.
+ *
+ * `CLAUDE_CONFIG_DIR` relocates `.claude.json`, so a vendor running under a scrubbed/managed
+ * config dir (every runner in `docs/vendor-agent-runtime.md`, the exam runner, the whole mini
+ * fleet) had its MCP written to a `~/.claude.json` that the agent never reads — setup reported
+ * success and the agent came up with no AgentRadar MCP at all.
+ *
+ * 🔴 The resolution is ASYMMETRIC and that is the trap. `resolveClaudeConfigDir()` in
+ * `packages/db/scripts/clean-poisoned-claude-sessions.ts:93` answers `~/.claude` when the var is
+ * unset, but the JSON file does NOT live inside that directory by default — it is `~/.claude.json`,
+ * a sibling. Appending `.claude.json` to that resolver would yield `~/.claude/.claude.json`, which
+ * Claude Code never opens, and would break the DEFAULT path while fixing the env one. Hence the
+ * explicit branch rather than reuse; only the env arm joins into the directory
+ * (`$CLAUDE_CONFIG_DIR/.claude.json`, per `docs/vendor-agent-runtime.md:67`).
+ *
+ * Exported for the regression test — the env-SET case is the one that matters.
+ */
+export function claudeConfigPath(home, env = process.env) {
+    const fromEnv = env.CLAUDE_CONFIG_DIR;
+    if (typeof fromEnv === "string" && fromEnv.trim().length > 0) {
+        return join(resolve(fromEnv.trim()), ".claude.json");
+    }
+    return join(home, ".claude.json");
+}
+/**
+ * D4 — `hasTrustDialogAccepted` is OPT-IN, never inferred.
+ *
+ * Claude Code blocks at the trust dialog on first launch, which stalls unattended onboarding, so
+ * the obvious move is to pre-accept it here. We don't, because the flag trusts the whole DIRECTORY
+ * — a pre-existing `.claude/settings.json`, hook or skill executes on launch under it. The consent
+ * a vendor gives `agentradar setup` is "configure AgentRadar here"; the flag grants "execute
+ * whatever this folder says". Those differ most for the vendors least equipped to notice.
+ *
+ * 🔴 The obvious narrowing — "set it only for a folder our CLI created" — is NOT available, and
+ * checked rather than assumed: `index.ts` dispatches only `setup` and `skill install`; setup runs
+ * *in* an existing cwd and creates nothing, and the only `mkdir` in this package is
+ * `skill-install.ts:18`, which creates `.claude/skills/…` INSIDE an already-existing project. So
+ * there is no `mkdirSync(…, {recursive:true})` return value to read as provenance, and creating a
+ * directory purely to manufacture that signal would be inventing the evidence. Every setup run is
+ * the pre-existing case by construction; `--trust` is the only way the flag is ever set.
+ *
+ * Returns the resolved project path so the caller can name it in the trust guidance.
+ */
+async function installProjectMcp(configPath, cwd, installation, trust) {
     const endpoint = new URL(installation.mcpEndpoint);
     if (endpoint.protocol !== "https:" || !/^ar_[A-Za-z0-9_-]+$/.test(installation.bearer)) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const projectPath = await realpath(cwd);
-    const configPath = join(home, ".claude.json");
     let config = {};
     try {
         const info = await lstat(configPath);
         if (info.isSymbolicLink())
-            throw new Error("Refusing to replace a symlinked ~/.claude.json");
+            throw new Error(`Refusing to replace a symlinked ${configPath}`);
         const parsed = JSON.parse(await readFile(configPath, "utf8"));
         if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("~/.claude.json must contain a JSON object");
+            throw new Error(`${configPath} must contain a JSON object`);
         }
         config = parsed;
     }
@@ -52,14 +96,23 @@ async function installProjectMcp(home, cwd, installation) {
         timeout: 1_800_000,
     };
     project.mcpServers = mcpServers;
+    // SET only, never clear. A later plain `setup` must not revoke a decision an earlier `--trust`
+    // run made — that would silently regress a re-onboarding vendor back into the launch prompt, and
+    // this file is the user's, not ours.
+    if (trust)
+        project.hasTrustDialogAccepted = true;
     projects[projectPath] = project;
     config.projects = projects;
     const tempPath = `${configPath}.${process.pid}.tmp`;
     await writeFile(tempPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
     await rename(tempPath, configPath);
     await chmod(configPath, 0o600);
+    return projectPath;
 }
 export async function setupVendorAgent(deps = {}) {
+    if (!deps.fetch && tls.getCACertificates && tls.setDefaultCACertificates) {
+        tls.setDefaultCACertificates([...tls.getCACertificates("default"), ...tls.getCACertificates("system")]);
+    }
     const fetchImpl = deps.fetch ?? fetch;
     const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const log = deps.log ?? console.log;
@@ -88,8 +141,16 @@ export async function setupVendorAgent(deps = {}) {
         const approved = await responseJson(response);
         if (approved.status !== "approved")
             throw new Error("AgentRadar returned an invalid setup state");
-        await installProjectMcp(home, cwd, approved.installation);
-        log("AgentRadar MCP installed for this project. Start Claude Code and use /login with your claude.ai account.");
+        const configPath = claudeConfigPath(home);
+        const trust = deps.trust === true;
+        const projectPath = await installProjectMcp(configPath, cwd, approved.installation, trust);
+        // Print the path, not just "installed". D3 was a silent write to the wrong file under a
+        // relocated CLAUDE_CONFIG_DIR; naming the target turns that class of failure into a glance.
+        log(`AgentRadar MCP installed for this project → ${configPath}`);
+        log(trust
+            ? `--trust: pre-accepted the trust dialog for ${projectPath}. Claude Code will run this folder's existing hooks and settings without asking.`
+            : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
+        log("Start Claude Code and use /login with your claude.ai account.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {