agentradar-cli 0.1.7 → 0.1.8

package/README.md

@@ -11,7 +11,7 @@ npx -y agentradar-cli runner start <runner-id>
 npx -y agentradar-cli skill install
 ```
 
-The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the project MCP entry plus the supported runner's private config under `~/.agentradar`, with secret-bearing files mode `0600`. It prints the paths and the exact runner start command. It never prints the bearer or puts it in a URL, command argument, or repository file. The supervisor stages credentials into private runtime files, scrubs its child environment, and gives Claude Code only the strict AgentRadar MCP config.
+The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the project MCP entry plus the supported runner's private config under `~/.agentradar`, with secret-bearing files mode `0600`. It prints the paths and the exact runner start command. It never prints the bearer or puts it in a URL, command argument, or repository file. The supervisor stages only AgentRadar and vendor-tool credentials into private runtime files, scrubs its child environment, and gives Claude Code only the strict AgentRadar MCP config.
 
 Claude Code asks you to trust the folder on first launch. `setup` does not pre-accept that for you, and the onboarding lines above deliberately do not: the `hasTrustDialogAccepted` flag trusts everything already in the directory — existing hooks, `.claude/settings.json`, skills — not just the MCP entry setup added. Dismiss the prompt yourself.
 
@@ -19,4 +19,4 @@ There is a `--trust` flag for unattended runners, where a launch prompt would ha
 
 The skill command installs only the package-bundled `agentradar-vendor` markdown skill at `.claude/skills/agentradar-vendor/SKILL.md` in the current project. It does not fetch or require access to the private AgentRadar repository.
 
-Claude authentication stays separate. On macOS, the runner reuses the vendor's existing Claude Code OAuth login by extracting only `claudeAiOauth.accessToken` from the `Claude Code-credentials` Keychain item into a mode-`0600` runtime file; it never copies the credential profile into the isolated config. An explicit `CLAUDE_CODE_OAUTH_TOKEN` in the private runner env remains supported and takes precedence. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set.
+Claude authentication stays separate. On macOS, the runner uses the vendor's existing Keychain-backed Claude Code login through the normal user config path; it never copies, extracts, or injects Claude credentials. `CLAUDE_CODE_OAUTH_TOKEN` is intentionally unset before launch because the environment-token contract does not authenticate the interactive TUI. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set. Connector isolation remains enforced by `--strict-mcp-config` with the private AgentRadar MCP file.

package/dist/setup.js

@@ -205,7 +205,7 @@ export async function setupVendorAgent(deps = {}) {
             : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
-        log("On macOS the runner uses your existing Claude Code Keychain OAuth credential; an explicit CLAUDE_CODE_OAUTH_TOKEN is also supported. ANTHROPIC_API_KEY is prohibited.");
+        log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -9,8 +9,8 @@
 #
 #   1. a tmux session ($TMUX_SESSION) running the agent:
 #        claude --continue $CLAUDE_EXTRA_FLAGS --strict-mcp-config --mcp-config=$MCP_CONFIG
-#      in $AR_BASE, with a SCRUBBED allowlist env + a FRESH $CLAUDE_CONFIG_DIR
-#      (so the agent sees ONLY the AgentRadar MCP — no operator connectors);
+#      in $AR_BASE, with a SCRUBBED allowlist env + the macOS user's normal
+#      Keychain-backed Claude session. Strict MCP flags allow ONLY AgentRadar's config;
 #   2. the feeder ($FEEDER_JS) OUTSIDE that session, holding $AWP_BEARER, long-
 #      polling next_event and tmux-injecting each event into the pane.
 #
@@ -51,14 +51,8 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-# CLAUDE_CODE_OAUTH_TOKEN is an OPTIONAL explicit override. When unset on macOS, section 2b extracts
-# claudeAiOauth.accessToken from Claude Code's existing Keychain credential into the same private-file
-# handoff. With neither source, Claude uses its normal interactive auth path. ANTHROPIC_API_KEY remains
-# hard-refused below.
-: "${CLAUDE_CODE_OAUTH_TOKEN:=}"
 : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
-CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR:-${HOME}/.agentradar/config/${AGENT_NAME}}"
 FEEDER_JS="${FEEDER_JS:-$(cd "$(dirname "$0")/.." && pwd)/feeder.mjs}"
 PANE_LIVE_SH="${PANE_LIVE_SH:-$(cd "$(dirname "$0")/.." && pwd)/pane-live.sh}"
 # #133 M4 live terminal — the OPTIONAL feeder bridge (streams the tmux pane to the portals). It's an
@@ -111,6 +105,11 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
   log "loaded ${#TOOL_ENV_ARGS[@]} tool-env var(s) from ${AGENT_TOOL_ENV_FILE}"
 fi
 
+# Interactive Claude must use the user's persisted Keychain-backed login. An isolated config or an
+# environment OAuth token selects a different auth contract and can put the TUI back into onboarding.
+# env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
+unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
+
 # HARD RULE — OAuth only, never a pay-as-you-go API key.
 [ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
 
@@ -119,15 +118,12 @@ command -v "${CLAUDE_BIN}" >/dev/null 2>&1 || die "claude CLI not found (${CLAUD
 [ -f "${FEEDER_JS}" ] || die "feeder not found: ${FEEDER_JS}"
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
-mkdir -p "${CLAUDE_CONFIG_DIR}"
 
 # --- 2b. Credential hygiene (#152): secrets to 0600 files, OUT of argv+env ------
-# The AWP bearer (feeder) and — when used — the OAuth setup-token (claude) must not linger in any
-# long-lived process's ARGV (`ps aux`) or ENVIRONMENT (`ps eww`), where a co-resident process on the
-# box could read them. We stage them into per-agent 0600 files and hand each consumer the FILE PATH
-# (not a secret): the feeder reads AWP_BEARER_FILE; the scrubbed claude wrapper reads AR_OAUTH_TOKEN_FILE.
-# Then we UNSET the raw vars from this supervisor's env so neither the supervisor nor the feeder it
-# spawns inherits them. (The agent's own outbound bearer already lives only in awp-only.json @0600.)
+# The AWP bearer must not linger in any long-lived process's ARGV (`ps aux`) or ENVIRONMENT
+# (`ps eww`), where a co-resident process on the box could read it. Stage it into a per-agent 0600
+# file and hand the feeder only the FILE PATH. Claude authenticates directly through the user's normal
+# macOS Keychain-backed session; no Claude credential is copied, extracted, or injected.
 _SECRETS_DIR="${HOME}/.agentradar/run/${AGENT_NAME}"
 ( umask 077; mkdir -p "${_SECRETS_DIR}" )
 chmod 700 "${_SECRETS_DIR}" 2>/dev/null || true
@@ -135,34 +131,12 @@ _BEARER_FILE="${_SECRETS_DIR}/awp_bearer"
 ( umask 077; printf '%s' "${AWP_BEARER}" > "${_BEARER_FILE}" )
 AWP_BEARER_FILE="${_BEARER_FILE}"
 unset AWP_BEARER   # drop from the supervisor's exported env → feeder no longer inherits it; ps eww clean
-# OAuth token: same treatment. An explicit CLAUDE_CODE_OAUTH_TOKEN still wins. Otherwise, on macOS,
-# Claude Code stores a JSON credential in the "Claude Code-credentials" Keychain item; the env contract
-# needs only its claudeAiOauth.accessToken scalar, not that whole JSON copied into .credentials.json.
-# Pipe Keychain → plutil → a 0600 file so the token never appears in logs, argv, or this supervisor's env.
-_OAUTH_TOKEN_FILE="${_SECRETS_DIR}/oauth_token"
-if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
-  ( umask 077; printf '%s' "${CLAUDE_CODE_OAUTH_TOKEN}" > "${_OAUTH_TOKEN_FILE}" )
-elif [ "$(uname -s)" = "Darwin" ] && [ -x /usr/bin/security ] && [ -x /usr/bin/plutil ]; then
-  _OAUTH_TOKEN_TMP="${_OAUTH_TOKEN_FILE}.$$"
-  if ( umask 077; /usr/bin/security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null \
-      | /usr/bin/plutil -extract claudeAiOauth.accessToken raw -o "${_OAUTH_TOKEN_TMP}" - 2>/dev/null ) \
-      && [ -s "${_OAUTH_TOKEN_TMP}" ]; then
-    mv "${_OAUTH_TOKEN_TMP}" "${_OAUTH_TOKEN_FILE}"
-    log "loaded Claude Code OAuth credential from macOS Keychain"
-  else
-    rm -f "${_OAUTH_TOKEN_TMP}"
-    _OAUTH_TOKEN_FILE=""
-  fi
-else
-  _OAUTH_TOKEN_FILE=""
-fi
-unset CLAUDE_CODE_OAUTH_TOKEN   # out of the supervisor+feeder env (ps eww); staged to the 0600 file above
 # Vendor MCP-tool creds (#166): the agent's OWN tool API keys (WEBFLOW_TOKEN, PERPLEXITY_API_KEY, …) were
 # being passed INLINE as KEY=VALUE on the env -i line → stored PLAINTEXT in tmux's pane_start_command
 # (`tmux list-panes` = any co-resident proc) and in claude's env (ps eww). Same inline-secret class as the
 # bearer/token. Stage the already-validated entries to a 0600 file and pass ONLY AR_TOOL_ENV_FILE (a PATH);
 # the wrapper reads+exports them just before exec, so the VALUES never appear on the pane command / argv
-# (still in claude's env by necessity, exactly like the OAuth token — acceptable, same-user only).
+# (tool credentials remain in Claude's environment because their MCP subprocesses require them).
 _TOOL_ENV_FILE=""
 if [ "${#TOOL_ENV_ARGS[@]}" -gt 0 ]; then
   _TOOL_ENV_FILE="${_SECRETS_DIR}/tool_env"
@@ -231,29 +205,22 @@ ensure_agent() {
   fi
   # SCRUBBED launch: env -i with a strict allowlist so the agent inherits nothing from this daemon
   # (AWP_BEARER, AWP_MCP_URL, etc. never reach the pane). CONNECTOR ISOLATION is enforced by
-  # --strict-mcp-config (the agent loads ONLY $MCP_CONFIG's servers) — NOT by the config dir, which is
-  # deliberately the agent's EXISTING CLAUDE_CONFIG_DIR (often the shared ~/.claude) so `claude
-  # --continue` resumes the real conversation. The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are
-  # NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
+  # --strict-mcp-config (the agent loads ONLY $MCP_CONFIG's servers). Claude's config override stays unset,
+  # so the normal HOME/USER Keychain-backed interactive session and conversation history remain available.
+  # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
   log "starting agent in tmux '${TMUX_SESSION}' (flags: ${CLAUDE_EXTRA_FLAGS:-none}; tool-env file: ${_TOOL_ENV_FILE:-none})"
   # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
-  # _tool_env / _oauth_env use the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
+  # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
-  # conversation (a fresh engagement folder / brand-new CLAUDE_CONFIG_DIR) → the pane dies → the supervisor
+  # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
   # crash-loops. So try `--continue`, and FALL BACK to a fresh `claude` (which stays up AND creates the
   # session) when there's nothing to resume. Self-healing: once a conversation exists, --continue resumes it;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
   # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
   # shellcheck disable=SC2086
   _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
-  # OAuth (#152): section 2b staged either the explicit token or the macOS Keychain accessToken into a
-  # 0600 file and kept the value out of the supervisor+feeder env. Here we pass only that file PATH through
-  # env -i; the wrapper reads CLAUDE_CODE_OAUTH_TOKEN immediately before exec'ing Claude. If neither source
-  # exists, _OAUTH_TOKEN_FILE is empty and Claude falls back to its normal interactive auth path.
-  _oauth_env=()
-  [ -n "${_OAUTH_TOKEN_FILE}" ] && _oauth_env=( AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" )
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
@@ -285,8 +252,8 @@ ensure_agent() {
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
       DISABLE_AUTOUPDATER=1 \
-      ${_tool_env[@]+"${_tool_env[@]}"} ${_oauth_env[@]+"${_oauth_env[@]}"} CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; if [ -n "${AR_OAUTH_TOKEN_FILE:-}" ]; then CLAUDE_CODE_OAUTH_TOKEN="$(cat "$AR_OAUTH_TOKEN_FILE")"; export CLAUDE_CODE_OAUTH_TOKEN; unset AR_OAUTH_TOKEN_FILE; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
+      ${_tool_env[@]+"${_tool_env[@]}"} \
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -301,7 +268,7 @@ FEEDER_PID=""
 cleanup() {
   [ -n "${FEEDER_PID}" ] && kill "${FEEDER_PID}" 2>/dev/null || true
   [ -n "${BRIDGE_PID:-}" ] && kill "${BRIDGE_PID}" 2>/dev/null || true   # #133 terminal bridge
-  # #152: remove the staged 0600 secret files (bearer + optional oauth token) on exit.
+  # #152: remove the staged 0600 secret files on exit.
   [ -n "${_SECRETS_DIR:-}" ] && rm -rf "${_SECRETS_DIR}" 2>/dev/null || true
 }
 trap cleanup EXIT INT TERM
@@ -315,8 +282,7 @@ log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
 # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
 # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
 AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
-  AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" node "${FEEDER_JS}" &
+  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" node "${FEEDER_JS}" &
 FEEDER_PID=$!
 log "feeder pid ${FEEDER_PID}"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {