agentradar-cli 0.1.6 → 0.1.8

package/README.md

@@ -11,7 +11,7 @@ npx -y agentradar-cli runner start <runner-id>
 npx -y agentradar-cli skill install
 ```
 
-The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the project MCP entry plus the supported runner's private config under `~/.agentradar`, with secret-bearing files mode `0600`. It prints the paths and the exact runner start command. It never prints the bearer or puts it in a URL, command argument, or repository file. The supervisor stages credentials into private runtime files, scrubs its child environment, and gives Claude Code only the strict AgentRadar MCP config.
+The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the project MCP entry plus the supported runner's private config under `~/.agentradar`, with secret-bearing files mode `0600`. It prints the paths and the exact runner start command. It never prints the bearer or puts it in a URL, command argument, or repository file. The supervisor stages only AgentRadar and vendor-tool credentials into private runtime files, scrubs its child environment, and gives Claude Code only the strict AgentRadar MCP config.
 
 Claude Code asks you to trust the folder on first launch. `setup` does not pre-accept that for you, and the onboarding lines above deliberately do not: the `hasTrustDialogAccepted` flag trusts everything already in the directory — existing hooks, `.claude/settings.json`, skills — not just the MCP entry setup added. Dismiss the prompt yourself.
 
@@ -19,4 +19,4 @@ There is a `--trust` flag for unattended runners, where a launch prompt would ha
 
 The skill command installs only the package-bundled `agentradar-vendor` markdown skill at `.claude/skills/agentradar-vendor/SKILL.md` in the current project. It does not fetch or require access to the private AgentRadar repository.
 
-Claude authentication stays separate. Preferred: use interactive `/login` with the vendor's claude.ai account. A `CLAUDE_CODE_OAUTH_TOKEN` may be stored in the private runner env file when non-interactive Claude authentication is required; the supervisor stages it into a mode-`0600` runtime file before launch. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set.
+Claude authentication stays separate. On macOS, the runner uses the vendor's existing Keychain-backed Claude Code login through the normal user config path; it never copies, extracts, or injects Claude credentials. `CLAUDE_CODE_OAUTH_TOKEN` is intentionally unset before launch because the environment-token contract does not authenticate the interactive TUI. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set. Connector isolation remains enforced by `--strict-mcp-config` with the private AgentRadar MCP file.

package/dist/setup.js

@@ -205,7 +205,7 @@ export async function setupVendorAgent(deps = {}) {
             : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
-        log("Claude Code will use your existing /login session. ANTHROPIC_API_KEY is prohibited; a securely stored CLAUDE_CODE_OAUTH_TOKEN is also supported.");
+        log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -9,8 +9,8 @@
 #
 #   1. a tmux session ($TMUX_SESSION) running the agent:
 #        claude --continue $CLAUDE_EXTRA_FLAGS --strict-mcp-config --mcp-config=$MCP_CONFIG
-#      in $AR_BASE, with a SCRUBBED allowlist env + a FRESH $CLAUDE_CONFIG_DIR
-#      (so the agent sees ONLY the AgentRadar MCP — no operator connectors);
+#      in $AR_BASE, with a SCRUBBED allowlist env + the macOS user's normal
+#      Keychain-backed Claude session. Strict MCP flags allow ONLY AgentRadar's config;
 #   2. the feeder ($FEEDER_JS) OUTSIDE that session, holding $AWP_BEARER, long-
 #      polling next_event and tmux-injecting each event into the pane.
 #
@@ -51,14 +51,8 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-# CLAUDE_CODE_OAUTH_TOKEN is OPTIONAL. If SET → claude uses the setup-token (bills "API Usage",
-# subject to the org spend cap). If UNSET → claude falls through to SUBSCRIPTION OAuth (keychain login,
-# a one-time `/login`) → draws on the Max plan's included usage. Either way it's claude.ai auth only —
-# ANTHROPIC_API_KEY is still hard-refused below (never a pay-as-you-go key).
-: "${CLAUDE_CODE_OAUTH_TOKEN:=}"
 : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
-CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR:-${HOME}/.agentradar/config/${AGENT_NAME}}"
 FEEDER_JS="${FEEDER_JS:-$(cd "$(dirname "$0")/.." && pwd)/feeder.mjs}"
 PANE_LIVE_SH="${PANE_LIVE_SH:-$(cd "$(dirname "$0")/.." && pwd)/pane-live.sh}"
 # #133 M4 live terminal — the OPTIONAL feeder bridge (streams the tmux pane to the portals). It's an
@@ -111,6 +105,11 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
   log "loaded ${#TOOL_ENV_ARGS[@]} tool-env var(s) from ${AGENT_TOOL_ENV_FILE}"
 fi
 
+# Interactive Claude must use the user's persisted Keychain-backed login. An isolated config or an
+# environment OAuth token selects a different auth contract and can put the TUI back into onboarding.
+# env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
+unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
+
 # HARD RULE — OAuth only, never a pay-as-you-go API key.
 [ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
 
@@ -119,15 +118,12 @@ command -v "${CLAUDE_BIN}" >/dev/null 2>&1 || die "claude CLI not found (${CLAUD
 [ -f "${FEEDER_JS}" ] || die "feeder not found: ${FEEDER_JS}"
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
-mkdir -p "${CLAUDE_CONFIG_DIR}"
 
 # --- 2b. Credential hygiene (#152): secrets to 0600 files, OUT of argv+env ------
-# The AWP bearer (feeder) and — when used — the OAuth setup-token (claude) must not linger in any
-# long-lived process's ARGV (`ps aux`) or ENVIRONMENT (`ps eww`), where a co-resident process on the
-# box could read them. We stage them into per-agent 0600 files and hand each consumer the FILE PATH
-# (not a secret): the feeder reads AWP_BEARER_FILE; the scrubbed claude wrapper reads AR_OAUTH_TOKEN_FILE.
-# Then we UNSET the raw vars from this supervisor's env so neither the supervisor nor the feeder it
-# spawns inherits them. (The agent's own outbound bearer already lives only in awp-only.json @0600.)
+# The AWP bearer must not linger in any long-lived process's ARGV (`ps aux`) or ENVIRONMENT
+# (`ps eww`), where a co-resident process on the box could read it. Stage it into a per-agent 0600
+# file and hand the feeder only the FILE PATH. Claude authenticates directly through the user's normal
+# macOS Keychain-backed session; no Claude credential is copied, extracted, or injected.
 _SECRETS_DIR="${HOME}/.agentradar/run/${AGENT_NAME}"
 ( umask 077; mkdir -p "${_SECRETS_DIR}" )
 chmod 700 "${_SECRETS_DIR}" 2>/dev/null || true
@@ -135,24 +131,12 @@ _BEARER_FILE="${_SECRETS_DIR}/awp_bearer"
 ( umask 077; printf '%s' "${AWP_BEARER}" > "${_BEARER_FILE}" )
 AWP_BEARER_FILE="${_BEARER_FILE}"
 unset AWP_BEARER   # drop from the supervisor's exported env → feeder no longer inherits it; ps eww clean
-# OAuth setup-token: same treatment. `set -a; . ENV_FILE` EXPORTS CLAUDE_CODE_OAUTH_TOKEN into the
-# supervisor env, from which the feeder (spawned WITHOUT env -i) would inherit it → ps eww leak. So when
-# it's set, stage it to a 0600 file and UNSET the raw var here (mirror of the bearer). ensure_agent then
-# passes ONLY AR_OAUTH_TOKEN_FILE (the path) on the scrubbed env -i line, and the sh wrapper reads it into
-# claude's env just before exec. When UNSET (subscription-login mode) _OAUTH_TOKEN_FILE stays empty → the
-# claude launch is a pure no-op and falls through to subscription OAuth (no API-billing regression).
-_OAUTH_TOKEN_FILE=""
-if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
-  _OAUTH_TOKEN_FILE="${_SECRETS_DIR}/oauth_token"
-  ( umask 077; printf '%s' "${CLAUDE_CODE_OAUTH_TOKEN}" > "${_OAUTH_TOKEN_FILE}" )
-fi
-unset CLAUDE_CODE_OAUTH_TOKEN   # out of the supervisor+feeder env (ps eww); staged to the 0600 file above
 # Vendor MCP-tool creds (#166): the agent's OWN tool API keys (WEBFLOW_TOKEN, PERPLEXITY_API_KEY, …) were
 # being passed INLINE as KEY=VALUE on the env -i line → stored PLAINTEXT in tmux's pane_start_command
 # (`tmux list-panes` = any co-resident proc) and in claude's env (ps eww). Same inline-secret class as the
 # bearer/token. Stage the already-validated entries to a 0600 file and pass ONLY AR_TOOL_ENV_FILE (a PATH);
 # the wrapper reads+exports them just before exec, so the VALUES never appear on the pane command / argv
-# (still in claude's env by necessity, exactly like the OAuth token — acceptable, same-user only).
+# (tool credentials remain in Claude's environment because their MCP subprocesses require them).
 _TOOL_ENV_FILE=""
 if [ "${#TOOL_ENV_ARGS[@]}" -gt 0 ]; then
   _TOOL_ENV_FILE="${_SECRETS_DIR}/tool_env"
@@ -221,31 +205,22 @@ ensure_agent() {
   fi
   # SCRUBBED launch: env -i with a strict allowlist so the agent inherits nothing from this daemon
   # (AWP_BEARER, AWP_MCP_URL, etc. never reach the pane). CONNECTOR ISOLATION is enforced by
-  # --strict-mcp-config (the agent loads ONLY $MCP_CONFIG's servers) — NOT by the config dir, which is
-  # deliberately the agent's EXISTING CLAUDE_CONFIG_DIR (often the shared ~/.claude) so `claude
-  # --continue` resumes the real conversation. The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are
-  # NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
+  # --strict-mcp-config (the agent loads ONLY $MCP_CONFIG's servers). Claude's config override stays unset,
+  # so the normal HOME/USER Keychain-backed interactive session and conversation history remain available.
+  # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
   log "starting agent in tmux '${TMUX_SESSION}' (flags: ${CLAUDE_EXTRA_FLAGS:-none}; tool-env file: ${_TOOL_ENV_FILE:-none})"
   # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
-  # _tool_env / _oauth_env use the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
+  # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
-  # conversation (a fresh engagement folder / brand-new CLAUDE_CONFIG_DIR) → the pane dies → the supervisor
+  # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
   # crash-loops. So try `--continue`, and FALL BACK to a fresh `claude` (which stays up AND creates the
   # session) when there's nothing to resume. Self-healing: once a conversation exists, --continue resumes it;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
   # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
   # shellcheck disable=SC2086
   _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
-  # OAuth setup-token (#152): the token was already staged to a 0600 file + UNSET from this env in section
-  # 2b (so it's off both the supervisor+feeder env / ps eww). Here we only pass AR_OAUTH_TOKEN_FILE (a PATH,
-  # not the secret) on the env -i line — so the token is NOT in the `env`/claude argv (`ps aux`) either. The
-  # wrapper below reads the file into CLAUDE_CODE_OAUTH_TOKEN just before exec'ing claude. When it was UNSET
-  # (subscription-login mode) _OAUTH_TOKEN_FILE is empty → we pass NOTHING token-related and the wrapper's
-  # read is a no-op → claude falls through to subscription OAuth exactly as before. bash 3.2-safe array form.
-  _oauth_env=()
-  [ -n "${_OAUTH_TOKEN_FILE}" ] && _oauth_env=( AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" )
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
@@ -277,8 +252,8 @@ ensure_agent() {
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
       DISABLE_AUTOUPDATER=1 \
-      ${_tool_env[@]+"${_tool_env[@]}"} ${_oauth_env[@]+"${_oauth_env[@]}"} CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; if [ -n "${AR_OAUTH_TOKEN_FILE:-}" ]; then CLAUDE_CODE_OAUTH_TOKEN="$(cat "$AR_OAUTH_TOKEN_FILE")"; export CLAUDE_CODE_OAUTH_TOKEN; unset AR_OAUTH_TOKEN_FILE; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
+      ${_tool_env[@]+"${_tool_env[@]}"} \
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -293,7 +268,7 @@ FEEDER_PID=""
 cleanup() {
   [ -n "${FEEDER_PID}" ] && kill "${FEEDER_PID}" 2>/dev/null || true
   [ -n "${BRIDGE_PID:-}" ] && kill "${BRIDGE_PID}" 2>/dev/null || true   # #133 terminal bridge
-  # #152: remove the staged 0600 secret files (bearer + optional oauth token) on exit.
+  # #152: remove the staged 0600 secret files on exit.
   [ -n "${_SECRETS_DIR:-}" ] && rm -rf "${_SECRETS_DIR}" 2>/dev/null || true
 }
 trap cleanup EXIT INT TERM
@@ -307,8 +282,7 @@ log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
 # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
 # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
 AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
-  AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" node "${FEEDER_JS}" &
+  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" node "${FEEDER_JS}" &
 FEEDER_PID=$!
 log "feeder pid ${FEEDER_PID}"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {