agentradar-cli 0.1.7 → 0.1.9

package/README.md

@@ -11,7 +11,7 @@ npx -y agentradar-cli runner start <runner-id>
 npx -y agentradar-cli skill install
 ```
 
-The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the project MCP entry plus the supported runner's private config under `~/.agentradar`, with secret-bearing files mode `0600`. It prints the paths and the exact runner start command. It never prints the bearer or puts it in a URL, command argument, or repository file. The supervisor stages credentials into private runtime files, scrubs its child environment, and gives Claude Code only the strict AgentRadar MCP config.
+The setup command prints a short approval code. Approve that code in the AgentRadar vendor portal; the CLI then receives the AgentRadar bearer in the polling response body and writes the project MCP entry plus the supported runner's private config under `~/.agentradar`, with secret-bearing files mode `0600`. It prints the paths and the exact runner start command. It never prints the bearer or puts it in a URL, command argument, or repository file. The supervisor stages only AgentRadar and vendor-tool credentials into private runtime files, scrubs its child environment, and gives Claude Code only the strict AgentRadar MCP config.
 
 Claude Code asks you to trust the folder on first launch. `setup` does not pre-accept that for you, and the onboarding lines above deliberately do not: the `hasTrustDialogAccepted` flag trusts everything already in the directory — existing hooks, `.claude/settings.json`, skills — not just the MCP entry setup added. Dismiss the prompt yourself.
 
@@ -19,4 +19,4 @@ There is a `--trust` flag for unattended runners, where a launch prompt would ha
 
 The skill command installs only the package-bundled `agentradar-vendor` markdown skill at `.claude/skills/agentradar-vendor/SKILL.md` in the current project. It does not fetch or require access to the private AgentRadar repository.
 
-Claude authentication stays separate. On macOS, the runner reuses the vendor's existing Claude Code OAuth login by extracting only `claudeAiOauth.accessToken` from the `Claude Code-credentials` Keychain item into a mode-`0600` runtime file; it never copies the credential profile into the isolated config. An explicit `CLAUDE_CODE_OAUTH_TOKEN` in the private runner env remains supported and takes precedence. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set.
+Claude authentication stays separate. On macOS, the runner uses the vendor's existing Keychain-backed Claude Code login through the normal user config path; it never copies, extracts, or injects Claude credentials. `CLAUDE_CODE_OAUTH_TOKEN` is intentionally unset before launch because the environment-token contract does not authenticate the interactive TUI. `ANTHROPIC_API_KEY` is prohibited and the supervisor refuses to start when it is set. Connector isolation remains enforced by `--strict-mcp-config` with the private AgentRadar MCP file.

package/dist/index.js

@@ -2,8 +2,13 @@
 import { installVendorSkill } from "./skill-install.js";
 import { startVendorRunner } from "./runner.js";
 import { setupVendorAgent } from "./setup.js";
+import { installSyncTimer, syncAgentDir } from "./sync.js";
 async function main() {
     const args = process.argv.slice(2);
+    if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+        console.log("Usage: agentradar setup [--trust] | agentradar runner start <runner-id> | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        return;
+    }
     if (args.length === 1 && args[0] === "setup") {
         await setupVendorAgent();
         return;
@@ -25,8 +30,27 @@ async function main() {
         await installVendorSkill();
         return;
     }
-    console.error("Usage: agentradar setup [--trust] | agentradar runner start <runner-id> | agentradar skill install");
-    process.exitCode = 1;
+    if (args[0] === "sync" && args[1] === "install") {
+        const rest = args.slice(2);
+        const iIdx = rest.indexOf("--interval");
+        const interval = iIdx >= 0 ? Number(rest[iIdx + 1]) : 600;
+        if (!Number.isFinite(interval) || interval < 60) {
+            console.error("--interval must be a number of seconds >= 60");
+            process.exitCode = 1;
+            return;
+        }
+        const dir = rest.filter((_, i) => i !== iIdx && i !== iIdx + 1)[0];
+        process.exitCode = await installSyncTimer(dir, interval);
+        return;
+    }
+    if (args[0] === "sync" && args.length <= 2) {
+        process.exitCode = await syncAgentDir(args[1]);
+        return;
+    }
+    const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
+    (help ? console.log : console.error)("Usage: agentradar setup [--trust] | agentradar runner start <runner-id> | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+    if (!help)
+        process.exitCode = 1;
 }
 main().catch((error) => {
     console.error(error instanceof Error ? error.message : "AgentRadar command failed");

package/dist/setup.js

@@ -59,9 +59,17 @@ export function claudeConfigPath(home, env = process.env) {
  *
  * Returns the resolved project path so the caller can name it in the trust guidance.
  */
+function trustedMcpEndpoint(value) {
+    const endpoint = new URL(value);
+    const loopbackHttp = endpoint.protocol === "http:" && (endpoint.hostname === "localhost" ||
+        endpoint.hostname === "127.0.0.1" ||
+        endpoint.hostname === "[::1]" ||
+        endpoint.hostname.endsWith(".localhost"));
+    return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
+}
 async function installProjectMcp(configPath, cwd, installation, trust) {
-    const endpoint = new URL(installation.mcpEndpoint);
-    if (endpoint.protocol !== "https:" || !/^ar_[A-Za-z0-9_-]+$/.test(installation.bearer)) {
+    const endpoint = trustedMcpEndpoint(installation.mcpEndpoint);
+    if (!endpoint || !/^ar_[A-Za-z0-9_-]+$/.test(installation.bearer)) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const projectPath = await realpath(cwd);
@@ -130,8 +138,8 @@ async function installRunner(home, projectPath, approved) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(approved.runnerId)) {
         throw new Error("AgentRadar returned an invalid runner ID");
     }
-    const endpoint = new URL(approved.installation.mcpEndpoint);
-    if (endpoint.protocol !== "https:" || !/^ar_[A-Za-z0-9_-]+$/.test(approved.installation.bearer)) {
+    const endpoint = trustedMcpEndpoint(approved.installation.mcpEndpoint);
+    if (!endpoint || !/^ar_[A-Za-z0-9_-]+$/.test(approved.installation.bearer)) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const agentDir = join(home, ".agentradar", "agents");
@@ -205,7 +213,7 @@ export async function setupVendorAgent(deps = {}) {
             : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
-        log("On macOS the runner uses your existing Claude Code Keychain OAuth credential; an explicit CLAUDE_CODE_OAUTH_TOKEN is also supported. ANTHROPIC_API_KEY is prohibited.");
+        log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");

package/dist/sync.js

@@ -0,0 +1,89 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { homedir, platform } from "node:os";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+const run = promisify(execFile);
+/**
+ * `agentradar sync [dir]` — fast-forward a git-scoped agent project dir to its remote branch.
+ *
+ * Safe by construction:
+ *  - refuses when tracked files are locally MODIFIED (vendor edits are never clobbered);
+ *  - `checkout -f -B <branch> <remote>/<branch>` rewrites tracked paths only, so untracked runtime
+ *    state (sessions, .env, caches) survives;
+ *  - uses the vendor's own git credentials — the CLI never carries any.
+ *
+ * Config (optional, via `git config`): `agentradar.syncRemote` (default `origin`),
+ * `agentradar.syncBranch` (default `main`).
+ */
+export async function syncAgentDir(dir = process.cwd()) {
+    const git = (...args) => run("git", ["-C", dir, ...args]);
+    try {
+        await git("rev-parse", "--git-dir");
+    }
+    catch {
+        console.error(`Not a git repository: ${dir}`);
+        return 1;
+    }
+    const remote = (await git("config", "--get", "agentradar.syncRemote").catch(() => ({ stdout: "origin" }))).stdout.trim() || "origin";
+    const branch = (await git("config", "--get", "agentradar.syncBranch").catch(() => ({ stdout: "main" }))).stdout.trim() || "main";
+    const dirty = (await git("status", "--porcelain")).stdout
+        .split("\n")
+        .filter((l) => l && !l.startsWith("??"));
+    if (dirty.length > 0) {
+        console.error(`Refusing to sync: ${dirty.length} tracked file(s) locally modified in ${dir}. Commit, stash, or revert them first.`);
+        return 1;
+    }
+    await git("fetch", remote, branch);
+    const target = (await git("rev-parse", `${remote}/${branch}`)).stdout.trim();
+    const head = (await git("rev-parse", "HEAD").catch(() => ({ stdout: "" }))).stdout.trim();
+    if (head === target) {
+        console.log(`Up to date at ${target.slice(0, 8)}.`);
+        return 0;
+    }
+    await git("checkout", "-f", "-B", branch, `${remote}/${branch}`);
+    console.log(`Synced ${dir} to ${remote}/${branch} @ ${target.slice(0, 8)}.`);
+    return 0;
+}
+/**
+ * `agentradar sync install [dir] [--interval <seconds>]` — install a background timer that runs
+ * `agentradar sync <dir>` periodically. launchd LaunchAgent on macOS, systemd user timer on Linux.
+ */
+export async function installSyncTimer(dir = process.cwd(), intervalSeconds = 600) {
+    const abs = dir;
+    const cli = process.argv[1] ?? "agentradar";
+    const node = process.execPath;
+    if (platform() === "darwin") {
+        const label = `com.agentradar.sync.${abs.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(-40)}`;
+        const plistDir = join(homedir(), "Library", "LaunchAgents");
+        await mkdir(plistDir, { recursive: true });
+        const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>${label}</string>
+  <key>ProgramArguments</key><array><string>${node}</string><string>${cli}</string><string>sync</string><string>${abs}</string></array>
+  <key>StartInterval</key><integer>${intervalSeconds}</integer>
+  <key>RunAtLoad</key><true/>
+  <key>StandardOutPath</key><string>${join(homedir(), "Library", "Logs", `${label}.log`)}</string>
+  <key>StandardErrorPath</key><string>${join(homedir(), "Library", "Logs", `${label}.log`)}</string>
+</dict></plist>
+`;
+        const plistPath = join(plistDir, `${label}.plist`);
+        await writeFile(plistPath, plist);
+        await run("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label}`]).catch(() => undefined);
+        await run("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, plistPath]);
+        console.log(`Installed launchd timer ${label} (every ${intervalSeconds}s) for ${abs}.`);
+        return 0;
+    }
+    // Linux: systemd user service + timer.
+    const unit = `agentradar-sync-${abs.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(-40)}`;
+    const unitDir = join(homedir(), ".config", "systemd", "user");
+    await mkdir(unitDir, { recursive: true });
+    await writeFile(join(unitDir, `${unit}.service`), `[Unit]\nDescription=AgentRadar sync ${abs}\n\n[Service]\nType=oneshot\nExecStart=${node} ${cli} sync ${abs}\n`);
+    await writeFile(join(unitDir, `${unit}.timer`), `[Unit]\nDescription=AgentRadar sync timer ${abs}\n\n[Timer]\nOnBootSec=60\nOnUnitActiveSec=${intervalSeconds}\n\n[Install]\nWantedBy=timers.target\n`);
+    await run("systemctl", ["--user", "daemon-reload"]);
+    await run("systemctl", ["--user", "enable", "--now", `${unit}.timer`]);
+    console.log(`Installed systemd user timer ${unit} (every ${intervalSeconds}s) for ${abs}.`);
+    return 0;
+}
+//# sourceMappingURL=sync.js.map

package/dist/vendor-runner/feeder.mjs

@@ -421,6 +421,10 @@ export function stripVolatilePaneLines(text) {
     .join("\n");
 }
 
+export function paneInputReady(text) {
+  return /bypass permissions on\b|^\s*❯/im.test(String(text ?? "").split("\n").slice(-12).join("\n"));
+}
+
 function capturePane() {
   const r = spawnSync("tmux", ["capture-pane", "-p", "-t", TMUX_SESSION], { encoding: "utf8" });
   if (r.status !== 0 || typeof r.stdout !== "string") {
@@ -439,9 +443,10 @@ function capturePane() {
   // claude's TUI shows a working line ("… esc to interrupt") while mid-turn. This is only a HINT that
   // triggers a probe on stagnation — it never decides liveness, so a missed/extra hint is harmless.
   const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
-  // This runner always starts Claude with --dangerously-skip-permissions. Its input footer is therefore a
-  // positive signal that startup/trust/auth screens are gone and the interactive TUI can accept a work turn.
-  const inputReady = /bypass permissions on\b/i.test(text.split("\n").slice(-12).join("\n"));
+  // Claude's idle input prompt is the durable readiness signal. The optional bypass-permissions footer
+  // disappeared from a live Claude build after several turns, which falsely demoted a healthy pane to
+  // `starting` and stopped next_event from draining until its heartbeat aged stale.
+  const inputReady = paneInputReady(text);
   return { hash, inProgress, inputReady };
 }
 /**

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -9,8 +9,8 @@
 #
 #   1. a tmux session ($TMUX_SESSION) running the agent:
 #        claude --continue $CLAUDE_EXTRA_FLAGS --strict-mcp-config --mcp-config=$MCP_CONFIG
-#      in $AR_BASE, with a SCRUBBED allowlist env + a FRESH $CLAUDE_CONFIG_DIR
-#      (so the agent sees ONLY the AgentRadar MCP — no operator connectors);
+#      in $AR_BASE, with a SCRUBBED allowlist env + the macOS user's normal
+#      Keychain-backed Claude session. Strict MCP flags allow ONLY AgentRadar's config;
 #   2. the feeder ($FEEDER_JS) OUTSIDE that session, holding $AWP_BEARER, long-
 #      polling next_event and tmux-injecting each event into the pane.
 #
@@ -51,14 +51,8 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-# CLAUDE_CODE_OAUTH_TOKEN is an OPTIONAL explicit override. When unset on macOS, section 2b extracts
-# claudeAiOauth.accessToken from Claude Code's existing Keychain credential into the same private-file
-# handoff. With neither source, Claude uses its normal interactive auth path. ANTHROPIC_API_KEY remains
-# hard-refused below.
-: "${CLAUDE_CODE_OAUTH_TOKEN:=}"
 : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
-CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR:-${HOME}/.agentradar/config/${AGENT_NAME}}"
 FEEDER_JS="${FEEDER_JS:-$(cd "$(dirname "$0")/.." && pwd)/feeder.mjs}"
 PANE_LIVE_SH="${PANE_LIVE_SH:-$(cd "$(dirname "$0")/.." && pwd)/pane-live.sh}"
 # #133 M4 live terminal — the OPTIONAL feeder bridge (streams the tmux pane to the portals). It's an
@@ -111,6 +105,11 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
   log "loaded ${#TOOL_ENV_ARGS[@]} tool-env var(s) from ${AGENT_TOOL_ENV_FILE}"
 fi
 
+# Interactive Claude must use the user's persisted Keychain-backed login. An isolated config or an
+# environment OAuth token selects a different auth contract and can put the TUI back into onboarding.
+# env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
+unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
+
 # HARD RULE — OAuth only, never a pay-as-you-go API key.
 [ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
 
@@ -119,15 +118,12 @@ command -v "${CLAUDE_BIN}" >/dev/null 2>&1 || die "claude CLI not found (${CLAUD
 [ -f "${FEEDER_JS}" ] || die "feeder not found: ${FEEDER_JS}"
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
-mkdir -p "${CLAUDE_CONFIG_DIR}"
 
 # --- 2b. Credential hygiene (#152): secrets to 0600 files, OUT of argv+env ------
-# The AWP bearer (feeder) and — when used — the OAuth setup-token (claude) must not linger in any
-# long-lived process's ARGV (`ps aux`) or ENVIRONMENT (`ps eww`), where a co-resident process on the
-# box could read them. We stage them into per-agent 0600 files and hand each consumer the FILE PATH
-# (not a secret): the feeder reads AWP_BEARER_FILE; the scrubbed claude wrapper reads AR_OAUTH_TOKEN_FILE.
-# Then we UNSET the raw vars from this supervisor's env so neither the supervisor nor the feeder it
-# spawns inherits them. (The agent's own outbound bearer already lives only in awp-only.json @0600.)
+# The AWP bearer must not linger in any long-lived process's ARGV (`ps aux`) or ENVIRONMENT
+# (`ps eww`), where a co-resident process on the box could read it. Stage it into a per-agent 0600
+# file and hand the feeder only the FILE PATH. Claude authenticates directly through the user's normal
+# macOS Keychain-backed session; no Claude credential is copied, extracted, or injected.
 _SECRETS_DIR="${HOME}/.agentradar/run/${AGENT_NAME}"
 ( umask 077; mkdir -p "${_SECRETS_DIR}" )
 chmod 700 "${_SECRETS_DIR}" 2>/dev/null || true
@@ -135,34 +131,12 @@ _BEARER_FILE="${_SECRETS_DIR}/awp_bearer"
 ( umask 077; printf '%s' "${AWP_BEARER}" > "${_BEARER_FILE}" )
 AWP_BEARER_FILE="${_BEARER_FILE}"
 unset AWP_BEARER   # drop from the supervisor's exported env → feeder no longer inherits it; ps eww clean
-# OAuth token: same treatment. An explicit CLAUDE_CODE_OAUTH_TOKEN still wins. Otherwise, on macOS,
-# Claude Code stores a JSON credential in the "Claude Code-credentials" Keychain item; the env contract
-# needs only its claudeAiOauth.accessToken scalar, not that whole JSON copied into .credentials.json.
-# Pipe Keychain → plutil → a 0600 file so the token never appears in logs, argv, or this supervisor's env.
-_OAUTH_TOKEN_FILE="${_SECRETS_DIR}/oauth_token"
-if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
-  ( umask 077; printf '%s' "${CLAUDE_CODE_OAUTH_TOKEN}" > "${_OAUTH_TOKEN_FILE}" )
-elif [ "$(uname -s)" = "Darwin" ] && [ -x /usr/bin/security ] && [ -x /usr/bin/plutil ]; then
-  _OAUTH_TOKEN_TMP="${_OAUTH_TOKEN_FILE}.$$"
-  if ( umask 077; /usr/bin/security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null \
-      | /usr/bin/plutil -extract claudeAiOauth.accessToken raw -o "${_OAUTH_TOKEN_TMP}" - 2>/dev/null ) \
-      && [ -s "${_OAUTH_TOKEN_TMP}" ]; then
-    mv "${_OAUTH_TOKEN_TMP}" "${_OAUTH_TOKEN_FILE}"
-    log "loaded Claude Code OAuth credential from macOS Keychain"
-  else
-    rm -f "${_OAUTH_TOKEN_TMP}"
-    _OAUTH_TOKEN_FILE=""
-  fi
-else
-  _OAUTH_TOKEN_FILE=""
-fi
-unset CLAUDE_CODE_OAUTH_TOKEN   # out of the supervisor+feeder env (ps eww); staged to the 0600 file above
 # Vendor MCP-tool creds (#166): the agent's OWN tool API keys (WEBFLOW_TOKEN, PERPLEXITY_API_KEY, …) were
 # being passed INLINE as KEY=VALUE on the env -i line → stored PLAINTEXT in tmux's pane_start_command
 # (`tmux list-panes` = any co-resident proc) and in claude's env (ps eww). Same inline-secret class as the
 # bearer/token. Stage the already-validated entries to a 0600 file and pass ONLY AR_TOOL_ENV_FILE (a PATH);
 # the wrapper reads+exports them just before exec, so the VALUES never appear on the pane command / argv
-# (still in claude's env by necessity, exactly like the OAuth token — acceptable, same-user only).
+# (tool credentials remain in Claude's environment because their MCP subprocesses require them).
 _TOOL_ENV_FILE=""
 if [ "${#TOOL_ENV_ARGS[@]}" -gt 0 ]; then
   _TOOL_ENV_FILE="${_SECRETS_DIR}/tool_env"
@@ -231,29 +205,22 @@ ensure_agent() {
   fi
   # SCRUBBED launch: env -i with a strict allowlist so the agent inherits nothing from this daemon
   # (AWP_BEARER, AWP_MCP_URL, etc. never reach the pane). CONNECTOR ISOLATION is enforced by
-  # --strict-mcp-config (the agent loads ONLY $MCP_CONFIG's servers) — NOT by the config dir, which is
-  # deliberately the agent's EXISTING CLAUDE_CONFIG_DIR (often the shared ~/.claude) so `claude
-  # --continue` resumes the real conversation. The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are
-  # NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
+  # --strict-mcp-config (the agent loads ONLY $MCP_CONFIG's servers). Claude's config override stays unset,
+  # so the normal HOME/USER Keychain-backed interactive session and conversation history remain available.
+  # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
   log "starting agent in tmux '${TMUX_SESSION}' (flags: ${CLAUDE_EXTRA_FLAGS:-none}; tool-env file: ${_TOOL_ENV_FILE:-none})"
   # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
-  # _tool_env / _oauth_env use the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
+  # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
-  # conversation (a fresh engagement folder / brand-new CLAUDE_CONFIG_DIR) → the pane dies → the supervisor
+  # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
   # crash-loops. So try `--continue`, and FALL BACK to a fresh `claude` (which stays up AND creates the
   # session) when there's nothing to resume. Self-healing: once a conversation exists, --continue resumes it;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
   # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
   # shellcheck disable=SC2086
   _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
-  # OAuth (#152): section 2b staged either the explicit token or the macOS Keychain accessToken into a
-  # 0600 file and kept the value out of the supervisor+feeder env. Here we pass only that file PATH through
-  # env -i; the wrapper reads CLAUDE_CODE_OAUTH_TOKEN immediately before exec'ing Claude. If neither source
-  # exists, _OAUTH_TOKEN_FILE is empty and Claude falls back to its normal interactive auth path.
-  _oauth_env=()
-  [ -n "${_OAUTH_TOKEN_FILE}" ] && _oauth_env=( AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" )
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
@@ -285,8 +252,8 @@ ensure_agent() {
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
       DISABLE_AUTOUPDATER=1 \
-      ${_tool_env[@]+"${_tool_env[@]}"} ${_oauth_env[@]+"${_oauth_env[@]}"} CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; if [ -n "${AR_OAUTH_TOKEN_FILE:-}" ]; then CLAUDE_CODE_OAUTH_TOKEN="$(cat "$AR_OAUTH_TOKEN_FILE")"; export CLAUDE_CODE_OAUTH_TOKEN; unset AR_OAUTH_TOKEN_FILE; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
+      ${_tool_env[@]+"${_tool_env[@]}"} \
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -301,7 +268,7 @@ FEEDER_PID=""
 cleanup() {
   [ -n "${FEEDER_PID}" ] && kill "${FEEDER_PID}" 2>/dev/null || true
   [ -n "${BRIDGE_PID:-}" ] && kill "${BRIDGE_PID}" 2>/dev/null || true   # #133 terminal bridge
-  # #152: remove the staged 0600 secret files (bearer + optional oauth token) on exit.
+  # #152: remove the staged 0600 secret files on exit.
   [ -n "${_SECRETS_DIR:-}" ] && rm -rf "${_SECRETS_DIR}" 2>/dev/null || true
 }
 trap cleanup EXIT INT TERM
@@ -315,8 +282,7 @@ log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
 # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
 # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
 AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" \
-  AR_OAUTH_TOKEN_FILE="${_OAUTH_TOKEN_FILE}" node "${FEEDER_JS}" &
+  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" node "${FEEDER_JS}" &
 FEEDER_PID=$!
 log "feeder pid ${FEEDER_PID}"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "dist/setup.js",
     "dist/runner.js",
     "dist/skill-install.js",
+    "dist/sync.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",
     "README.md"