agentradar-cli 0.1.8 → 0.2.0

package/dist/tool-run.js

@@ -0,0 +1,300 @@
+import { readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+/**
+ * One `KEY='value'` line as `setup.ts` wrote it, single-quoted with `'` escaped as `'\''`.
+ * Nothing here is printed: the file holds the runner's bearer.
+ */
+export function envValue(contents, key) {
+    const line = contents.split("\n").find((row) => row.startsWith(`${key}=`));
+    if (!line)
+        return null;
+    const raw = line.slice(key.length + 1).trim();
+    const quoted = raw.startsWith("'") && raw.endsWith("'") && raw.length >= 2;
+    return (quoted ? raw.slice(1, -1).replaceAll("'\\''", "'") : raw) || null;
+}
+export async function runServiceToolOverCli(runnerId, toolKey, argumentsJson, deps = {}) {
+    const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    return await callAwpTool(runnerId, "run_service_tool", { toolKey, arguments: parameters, entryPoint: "cli" }, deps);
+}
+/** `agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>']`: any AWP tool from a shell, so a just-joined agent works before its harness reloads MCP tools. */
+export async function callToolOverCli(runnerId, tool, argumentsJson, deps = {}, flags = []) {
+    const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    if (flags.length) {
+        const typed = await flagArguments(runnerId, tool, flags, deps);
+        if (!typed)
+            return 1;
+        Object.assign(parameters, typed);
+    }
+    if (tool !== "next_event" || !RUNNER_ID.test(runnerId))
+        return await callAwpTool(runnerId, tool, parameters, deps);
+    // A bare poll acknowledges the batch the previous poll printed, so the command stays byte-identical and
+    // an operator can allow it once. Asking for the next event means the last one was read; a lost or
+    // failed poll leaves the file as it was, so delivery stays at-least-once.
+    const delivered = join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.delivered.json`);
+    if (parameters.ackEventIds === undefined) {
+        const ids = await readFile(delivered, "utf8").then((text) => JSON.parse(text), () => []);
+        if (Array.isArray(ids) && ids.length)
+            parameters.ackEventIds = ids;
+    }
+    let said = "";
+    const code = await callAwpTool(runnerId, tool, parameters, { ...deps, log: (text) => { said = text; (deps.log ?? console.log)(text); } });
+    if (code !== 0)
+        return code;
+    let events = [];
+    try {
+        events = JSON.parse(said).events;
+    }
+    catch { /* not a batch: nothing to acknowledge */ }
+    const ids = Array.isArray(events) ? events.map((event) => event?.eventId).filter((id) => typeof id === "string") : [];
+    await writeFile(delivered, JSON.stringify(ids), { mode: 0o600 }).catch(() => undefined);
+    return 0;
+}
+/**
+ * `agentradar run <runner-id> listen`: bare `next_event` polls (each held by the server, each acking the
+ * batch before it) until work, a liveness probe or the welcome arrives, or until the next hold could run
+ * past `budgetMs`. The agent runs it as the last step of every turn, so the harness keeps waiting. Nine
+ * minutes stays under Claude Code's 10-minute Bash cap; Codex waits on it in 5-minute chunks.
+ */
+export async function listenOverCli(runnerId, deps = {}, budgetMs = 540_000) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const start = now();
+    let longest = 0;
+    for (;;) {
+        const began = now();
+        let said = "";
+        const code = await callToolOverCli(runnerId, "next_event", undefined, { ...deps, log: (text) => { said = text; } });
+        if (code !== 0)
+            return code;
+        let batch = null;
+        try {
+            batch = JSON.parse(said);
+        }
+        catch { /* not a batch: keep waiting */ }
+        // Wake on work, a liveness probe or the welcome; anything else (events: null, an unknown key) waits.
+        if ((Array.isArray(batch?.events) && batch.events.length) || batch?.livenessProbe || batch?.welcome) {
+            (deps.log ?? console.log)(said);
+            return 0;
+        }
+        // A caller the server does not hold (not yet hired, a run JWT) answers at once; do not spin on it.
+        if (now() - began < 10_000)
+            await sleep(10_000 - (now() - began));
+        longest = Math.max(longest, now() - began);
+        if (now() - start + longest > budgetMs) {
+            (deps.log ?? console.log)(`No client message in ${Math.round((now() - start) / 60_000)} minutes. Run agentradar run ${runnerId} listen again.`);
+            return 0;
+        }
+    }
+}
+/** Split `<runner-id> <tool> [--args '<json>'] [--<argument> <value> ...]`; null when it is not that shape. */
+export function parseCallArgs(rest) {
+    const positional = [];
+    const flags = [];
+    let json;
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (!arg.startsWith("--")) {
+            positional.push(arg);
+            continue;
+        }
+        const value = rest[++i];
+        if (value === undefined)
+            return null;
+        if (arg === "--args")
+            json = value;
+        else
+            flags.push([arg.slice(2), value]);
+    }
+    return positional.length === 2 ? { runnerId: positional[0], tool: positional[1], json, flags } : null;
+}
+/**
+ * `--text "hi" --conversation-id X` as the tool's own arguments, typed by the inputSchema the server
+ * advertises, so an agent never types JSON (braces and quotes) into a shell command.
+ */
+async function flagArguments(runnerId, tool, flags, deps) {
+    const logError = deps.logError ?? console.error;
+    const listed = await awpRequest(runnerId, "tools/list", {}, deps);
+    if (!listed)
+        return null;
+    const schema = listed.result?.tools?.find((entry) => entry.name === tool)?.inputSchema?.properties ?? {};
+    const out = {};
+    const camel = (flag) => flag.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+    for (let [flag, value] of flags) {
+        // --body-file page.md: the argument read from a file, so a multi-line page never sits in a quoted
+        // shell argument (Claude Code prompts on a newline followed by # inside one).
+        if (flag.endsWith("-file") && !(flag in schema) && !(camel(flag) in schema)) {
+            const text = await readArgumentFile(value, deps.cwd ?? process.cwd(), deps.home ?? homedir()).catch((error) => error);
+            if (text instanceof Error) {
+                logError(`--${flag}: ${text.message}`);
+                return null;
+            }
+            [flag, value] = [flag.slice(0, -"-file".length), text];
+        }
+        // --text is what agents reach for on append_task_log, whose argument is --entry.
+        const key = flag in schema ? flag : flag === "text" && "entry" in schema ? "entry" : camel(flag);
+        if (!(key in schema)) {
+            logError(`${tool} has no argument --${flag}. Its arguments: ${Object.keys(schema).map((name) => `--${name}`).join(" ") || "none"}`);
+            return null;
+        }
+        const type = [schema[key].type].flat()[0];
+        const typed = coerce(type === "array" ? [schema[key].items?.type].flat()[0] : type, value);
+        if (typed === undefined) {
+            logError(`--${flag} must be ${type === "array" ? "a list of " + schema[key].items?.type : "a " + type}`);
+            return null;
+        }
+        // A repeated flag builds a list: --message-ids a --message-ids b.
+        out[key] = type === "array" ? [...(out[key] ?? []), typed] : typed;
+    }
+    return out;
+}
+/**
+ * `agentradar run` is always-allowed, so a file flag must not read and upload any file the agent names:
+ * only a regular file inside the working folder (after symlinks), and at most 256 KB — and never one in
+ * ~/.agentradar, which holds the runner's own key even when the working folder is $HOME.
+ * ponytail: a hard link to the key is not caught (same inode, different path); making one is the agent's own act.
+ */
+async function readArgumentFile(path, cwd, home) {
+    const real = await realpath(resolve(cwd, path)).catch(() => { throw new Error(`cannot read ${path}`); });
+    const within = (dir) => { const inside = relative(dir, real); return inside !== ".." && !inside.startsWith(`..${sep}`) && !isAbsolute(inside); };
+    const own = await realpath(join(home, ".agentradar")).catch(() => null);
+    if (own && within(own))
+        throw new Error(`${path} is refused: a file flag never reads AgentRadar's own folder (~/.agentradar), which holds this agent's key`);
+    const info = await stat(real);
+    if (!info.isFile() || !within(await realpath(cwd)) || info.size > 256 * 1024) {
+        throw new Error(`${path} is refused: a file flag reads only a regular file inside the current folder, up to 256 KB`);
+    }
+    return await readFile(real, "utf8");
+}
+function coerce(type, value) {
+    if (type === "string")
+        return value;
+    if (type === "number" || type === "integer") {
+        const number = value.trim() === "" ? NaN : Number(value);
+        return Number.isFinite(number) && (type === "number" || Number.isInteger(number)) ? number : undefined;
+    }
+    if (type === "boolean")
+        return value === "true" ? true : value === "false" ? false : undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return type === undefined ? value : undefined;
+    }
+}
+/**
+ * Ruling 49 — `agentradar task create|repeat <runner-id> --args '<json>'`: the agent's own `create_task`
+ * or `create_recurring_task`, on the same AWP endpoint with the same key, so who it may assign to is the
+ * server's decision exactly as it is over MCP.
+ */
+export async function createTaskOverCli(runnerId, recurring, argumentsJson, deps = {}) {
+    const parameters = parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    return await callAwpTool(runnerId, recurring ? "create_recurring_task" : "create_task", parameters, deps);
+}
+function parseArgumentsObject(argumentsJson, logError) {
+    let parsed;
+    try {
+        parsed = JSON.parse(argumentsJson);
+    }
+    catch {
+        logError("--args must be a JSON object, e.g. --args '{\"title\":\"a real issue\"}'");
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        logError("--args must be a JSON object");
+        return null;
+    }
+    return parsed;
+}
+/**
+ * R251 — `agentradar tool list <runner-id>`: the server's own `list_service_tools`, printed as it
+ * answered. The listing is the policy's preview for this agent, so the CLI computes nothing — a second
+ * copy of the decision here could only drift from the one the MCP tool and every real call make.
+ */
+export async function listServiceToolsOverCli(runnerId, deps = {}) {
+    return await callAwpTool(runnerId, "list_service_tools", {}, deps);
+}
+/** One `tools/call` on the runner's AWP MCP endpoint with the runner's own key; the answer is printed verbatim. */
+export async function callAwpTool(runnerId, name, toolArguments, deps) {
+    const log = deps.log ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const body = await awpRequest(runnerId, "tools/call", { name, arguments: toolArguments }, deps);
+    if (!body)
+        return 1;
+    const text = body.result?.content?.[0]?.text;
+    const said = typeof text === "string" ? text : JSON.stringify(body.result ?? {});
+    // A refusal is the server's sentence and belongs on stderr with a non-zero exit, or a script that
+    // pipes stdout reads "the tool ran" from a body that says it was refused.
+    if (body.result?.isError) {
+        logError(said);
+        return 1;
+    }
+    log(said);
+    return 0;
+}
+const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
+async function awpRequest(runnerId, method, params, deps) {
+    const logError = deps.logError ?? console.error;
+    if (!RUNNER_ID.test(runnerId)) {
+        logError("Invalid runner ID");
+        return null;
+    }
+    const envPath = join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.env`);
+    let url;
+    let bearer;
+    const contents = await readFile(envPath, "utf8").catch(() => null);
+    if (contents !== null) {
+        url = envValue(contents, "AWP_MCP_URL");
+        bearer = envValue(contents, "AWP_BEARER");
+        if (!url || !bearer) {
+            logError(`${envPath} is missing AWP_MCP_URL or AWP_BEARER. Run agentradar setup again.`);
+            return null;
+        }
+    }
+    else {
+        // Ruling 41 — a hosted agent has no runner file. Its run already carries the server's origin and its
+        // per-run JWT (`PAPERCLIP_API_URL`/`PAPERCLIP_API_KEY`), which the AWP MCP admits for a vendorless
+        // hosted agent (`server/src/awp/resolve.ts`). The runner file, when present, still wins.
+        const env = deps.env ?? process.env;
+        const origin = env.PAPERCLIP_API_URL?.trim().replace(/\/+$/, "");
+        bearer = env.PAPERCLIP_API_KEY?.trim() || null;
+        if (!origin || !bearer) {
+            logError(`No runner named ${runnerId}: ${envPath} does not exist. Run agentradar setup first.`);
+            return null;
+        }
+        url = `${origin}/api/mcp`;
+    }
+    const response = await (deps.fetch ?? fetch)(url, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${bearer}`,
+            "content-type": "application/json",
+            // Both, because the endpoint answers JSON only when the client says it takes JSON.
+            accept: "application/json, text/event-stream",
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method,
+            params,
+        }),
+    });
+    if (!response.ok) {
+        logError(`AgentRadar refused the tool call (${response.status}).`);
+        return null;
+    }
+    const body = await response.json();
+    if (body.error) {
+        logError(typeof body.error.message === "string" ? body.error.message : "AgentRadar returned an error");
+        return null;
+    }
+    return body;
+}
+//# sourceMappingURL=tool-run.js.map

package/dist/vendor-runner/feeder.mjs

@@ -4,7 +4,10 @@
 //
 // Unlike runner.mjs (which spawns a fresh `claude` per event, out-of-context), the
 // feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
-// `claude` running in a tmux pane (real in-session continuity — I1). It:
+// agent CLI running in a tmux pane (real in-session continuity — I1). R004: that CLI is
+// Claude Code or Codex, selected by AR_AGENT_HARNESS; injection, acking and the
+// in-progress hint are identical on both, and only the login probe, the idle-composer
+// marker and the pane's argv pattern branch. It:
 //   1. phones home to the single AgentRadar AWP MCP and long-polls `next_event`;
 //   2. injects each event into the live pane via `tmux send-keys` (I2), pinning the
 //      EXPLICIT conversationId so the agent's `reply` never guesses the target;
@@ -18,11 +21,11 @@
 // ===========================================================================
 
 import { spawn, spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, sendKeysCommands } from "./session-frame.mjs";
 
@@ -45,9 +48,22 @@ const AWP_BEARER = (() => {
   return process.env.AWP_BEARER ?? "";
 })();
 const TMUX_SESSION = process.env.TMUX_SESSION ?? "agent";
-// The claude pid marker (same predicate entrypoint.sh uses) — proves the pane is live.
-const AGENT_PID_PATTERN = process.env.AGENT_PID_PATTERN ?? "mcp-config.*awp-only";
-const CLAUDE_BIN = process.env.CLAUDE_BIN ?? "claude";
+/**
+ * R004 — which CLI is in the pane. `claude` is the default, so a feeder started by an older supervisor (or
+ * by hand) behaves exactly as before. Only what genuinely differs reads this: how the CLI reports its login
+ * state, what its idle composer looks like, and the argv the pane can be found by. The in-progress hint and
+ * the volatile-line strip are NOT harness-specific — measured on codex-cli 0.149.1, Codex renders the same
+ * `esc to interrupt` working line Claude does (`• Working (1s • esc to interrupt)`), so the existing
+ * matchers already cover it and a speculative Codex spinner pattern would be invention, not coverage.
+ */
+export const AR_AGENT_HARNESS = process.env.AR_AGENT_HARNESS === "codex" ? "codex" : "claude";
+// The agent pid marker (same predicate entrypoint.sh uses) — proves the pane is live. Claude is found by its
+// mcp-config argument; Codex takes its MCP servers from CODEX_HOME (an env var, invisible to `ps`), so its
+// per-agent argv token is `--cd <working dir>`. The supervisor passes an exact pattern; this default only
+// matters for a hand-started feeder.
+const AGENT_PID_PATTERN =
+  process.env.AGENT_PID_PATTERN ?? (AR_AGENT_HARNESS === "codex" ? "codex.*--cd " : "mcp-config.*awp-only");
+const AGENT_BIN = process.env.AGENT_BIN ?? process.env.CLAUDE_BIN ?? (AR_AGENT_HARNESS === "codex" ? "codex" : "claude");
 const AR_OAUTH_TOKEN_FILE = process.env.AR_OAUTH_TOKEN_FILE ?? "";
 
 const MCP_CALL_TIMEOUT_MS = Number(process.env.AWP_MCP_CALL_TIMEOUT_MS ?? "30000");
@@ -75,6 +91,18 @@ const REPORT_PANE_INTERVAL_MS = Number(process.env.REPORT_PANE_INTERVAL_MS ?? "4
 // any single failure well under the 45s interval.
 const PANE_MCP_TIMEOUT_MS = Number(process.env.PANE_MCP_TIMEOUT_MS ?? "10000");
 
+// R650 — the agent's AgentRadar skills (bundled + linked) are written into its CLI's skills directory on this
+// cadence. Only directories this feeder created (they carry MANAGED_MARK) are ever replaced or removed; a
+// skill the vendor put there by hand is left alone. 0 disables.
+/** Claude reads `$AR_BASE/.claude/skills`; Codex reads `$CODEX_HOME/skills`, the per-agent home the supervisor requires. */
+export function skillsDirFor(harness, env) {
+  if (harness === "codex") return env.CODEX_HOME ? join(env.CODEX_HOME, "skills") : null;
+  return env.AR_BASE ? join(env.AR_BASE, ".claude", "skills") : null;
+}
+const SKILLS_DIR = skillsDirFor(AR_AGENT_HARNESS, process.env);
+const SKILLS_SYNC_INTERVAL_MS = Number(process.env.SKILLS_SYNC_INTERVAL_MS ?? "600000");
+const MANAGED_MARK = ".agentradar-managed";
+
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
@@ -195,8 +223,10 @@ function toolJson(result) {
   const text = result?.content?.find((c) => c.type === "text")?.text;
   return text ? JSON.parse(text) : {};
 }
+const runnerSessionId = randomUUID();
 async function nextEvent(ackEventIds, runnerState) {
   const args = {
+    sessionId: runnerSessionId,
     ...(ackEventIds && ackEventIds.length ? { ackEventIds } : {}),
     ...(runnerState ? { runnerState } : {}),
   };
@@ -208,11 +238,16 @@ async function nextEvent(ackEventIds, runnerState) {
 // Work readiness — process liveness is not enough. A live Claude process can
 // be blocked on subscription OAuth, where injected work is consumed as the OAuth code.
 // --------------------------------------------------------------------------
-export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
+function authProbeEnv(extraNames = []) {
   const env = {};
-  for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", "CLAUDE_CONFIG_DIR"]) {
+  for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", ...extraNames]) {
     if (typeof process.env[name] === "string") env[name] = process.env[name];
   }
+  return env;
+}
+
+export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
+  const env = authProbeEnv(["CLAUDE_CONFIG_DIR"]);
   if (AR_OAUTH_TOKEN_FILE) {
     try {
       env.CLAUDE_CODE_OAUTH_TOKEN = readFile(AR_OAUTH_TOKEN_FILE, "utf8").trim();
@@ -220,7 +255,7 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
       return "unknown";
     }
   }
-  const r = run(CLAUDE_BIN, ["auth", "status", "--json"], { encoding: "utf8", env, timeout: 10000 });
+  const r = run(AGENT_BIN, ["auth", "status", "--json"], { encoding: "utf8", env, timeout: 10000 });
   if (typeof r.stdout !== "string") return "unknown";
   try {
     return JSON.parse(r.stdout).loggedIn === true ? "authenticated" : "unauthenticated";
@@ -229,7 +264,31 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
   }
 }
 
-export function runnerState(auth = claudeAuthState, sample = capturePane) {
+/**
+ * Codex has no `auth status --json`. Its login probe is `codex login status`, which EXITS 0 when logged in
+ * and 1 when not, and prints "Logged in using ChatGPT" / "Not logged in" (measured, codex-cli 0.149.1).
+ *
+ * The exit code is the signal and the text is only a cross-check, not the other way round: a future build
+ * that reworded the line would still exit correctly, whereas reading the words alone would silently start
+ * returning "unknown" and park the runner in `starting` forever. A code we do not recognise stays "unknown"
+ * rather than becoming "unauthenticated", because `auth_required` is a claim the vendor is asked to act on.
+ *
+ * CODEX_HOME crosses into the probe because it IS the agent's credential home — probing the default
+ * ~/.codex would answer about a different login than the one the pane runs on.
+ */
+export function codexAuthState(run = spawnSync) {
+  const r = run(AGENT_BIN, ["login", "status"], { encoding: "utf8", env: authProbeEnv(["CODEX_HOME"]), timeout: 10000 });
+  if (r.status === 0) return "authenticated";
+  if (r.status === 1) return "unauthenticated";
+  return "unknown";
+}
+
+/** The login probe for whichever CLI this runner drives. */
+export function agentAuthState() {
+  return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
+}
+
+export function runnerState(auth = agentAuthState, sample = capturePane) {
   const authState = auth();
   if (authState === "unauthenticated") return "auth_required";
   if (authState !== "authenticated") return "starting";
@@ -392,7 +451,11 @@ export function stripVolatilePaneLines(text) {
   return String(text ?? "")
     .split("\n")
     .filter((line) => {
-      // the mid-turn interrupt hint (often carries the ticking counter)
+      // The mid-turn interrupt hint (often carries the ticking counter). This first matcher is also what
+      // covers CODEX: its whole working line is "• Working (1s • esc to interrupt)" (measured, codex-cli
+      // 0.149.1), counter included, so it is stripped entire and the Claude-specific spinner matchers below
+      // are simply inert on a Codex pane. No speculative Codex pattern is added here — an unmeasured
+      // matcher would look like coverage while stabilising nothing.
       if (/\besc to (?:interrupt|cancel)\b/i.test(line)) return false;
       // claude's spinner line, TWO observed forms — a leading animated glyph + a SINGLE gerund word +
       // the elapsed counter. Tightly anchored (one word before the counter) so real transcript prose
@@ -421,6 +484,40 @@ export function stripVolatilePaneLines(text) {
     .join("\n");
 }
 
+/**
+ * The durable "this pane can take a turn" marker, which is the one pane signal that genuinely differs
+ * between the two CLIs. Claude Code shows its bypass-permissions footer or the `❯` prompt; Codex shows its
+ * idle composer placeholder `Ask Codex to do anything` (measured, codex-cli 0.149.1).
+ *
+ * ponytail: both markers vanish while a modal owns the screen — Claude's login prompt, Codex's trust or
+ * rate-limit dialog — which is the behaviour we want, since a pane blocked on a dialog cannot take work.
+ * Both also vanish once a human has typed into the composer without submitting; on an unattended runner
+ * nothing types there except `send-keys`, which submits immediately. Narrow the marker only if a real pane
+ * is observed to defeat it.
+ */
+export function paneInputReady(text, harness = AR_AGENT_HARNESS) {
+  const tail = String(text ?? "").split("\n").slice(-12).join("\n");
+  return harness === "codex"
+    ? /Ask Codex to do anything/i.test(tail)
+    : /bypass permissions on\b|^\s*❯/im.test(tail);
+}
+
+/**
+ * Why a Claude Code session refused to register its channels, read off the banner it prints — or null.
+ * Keyed by the CLI's own skip `kind`. The `auth` banner comes from builds before 2.1.281, which has no auth
+ * gate. See docs/claude-code-channels-gates.md.
+ */
+const CHANNEL_BANNERS = [
+  [/Channels are not currently available/, "disabled", "tengu_harbor is off: unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, set CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1, seed or fetch the flag cache, restart the session"],
+  [/Channels require claude\.ai authentication/, "auth", "no claude.ai login: run /login in the session, then restart it"],
+  [/Channels are not enabled for your org/, "policy", "org managed settings block channels: an admin must set channelsEnabled: true"],
+  [/Channels are not available on (?:Bedrock|third-party)/, "provider", "a Bedrock/Vertex/Foundry provider is selected: channels need the first-party API"],
+];
+export function classifyChannelBanner(text) {
+  const hit = CHANNEL_BANNERS.find(([re]) => re.test(String(text ?? "")));
+  return hit ? { kind: hit[1], action: hit[2] } : null;
+}
+
 function capturePane() {
   const r = spawnSync("tmux", ["capture-pane", "-p", "-t", TMUX_SESSION], { encoding: "utf8" });
   if (r.status !== 0 || typeof r.stdout !== "string") {
@@ -436,13 +533,17 @@ function capturePane() {
   // Fingerprint the TRANSCRIPT BODY only — strip the client-side-ticking spinner/counter so a mid-turn
   // API hang (LLM dead, counter still ticking) yields a STABLE hash → stagnation is detectable (§4).
   const hash = createHash("sha256").update(stripVolatilePaneLines(text)).digest("hex").slice(0, 32);
-  // claude's TUI shows a working line ("… esc to interrupt") while mid-turn. This is only a HINT that
-  // triggers a probe on stagnation — it never decides liveness, so a missed/extra hint is harmless.
+  // Both TUIs show a working line ("… esc to interrupt") while mid-turn — Codex's reads
+  // "• Working (1s • esc to interrupt)", measured on codex-cli 0.149.1, so this matcher needs no harness
+  // branch. This is only a HINT that triggers a probe on stagnation — it never decides liveness, so a
+  // missed/extra hint is harmless.
   const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
-  // This runner always starts Claude with --dangerously-skip-permissions. Its input footer is therefore a
-  // positive signal that startup/trust/auth screens are gone and the interactive TUI can accept a work turn.
-  const inputReady = /bypass permissions on\b/i.test(text.split("\n").slice(-12).join("\n"));
-  return { hash, inProgress, inputReady };
+  // The CLI's idle input prompt is the durable readiness signal, and it is the one pane signal that differs
+  // per harness (see paneInputReady). The optional bypass-permissions footer disappeared from a live Claude
+  // build after several turns, which falsely demoted a healthy pane to `starting` and stopped next_event
+  // from draining until its heartbeat aged stale.
+  const inputReady = paneInputReady(text);
+  return { hash, inProgress, inputReady, channelGate: classifyChannelBanner(text) };
 }
 /**
  * #173b (disc obs) — format-drift detector. If the STRIPPED fingerprint keeps CHANGING while the pane
@@ -456,6 +557,7 @@ export function looksLikeStripMiss(prev, cur) {
   return Boolean(prev && cur && prev.inProgress && cur.inProgress && prev.hash !== cur.hash);
 }
 let _lastPaneSample = null;
+let _lastChannelGate = null;
 let _paneReportCount = 0;
 async function reportPane() {
   // #156 diagnostics: log EVERY outcome (skip / ok+latency / error) under DEBUG_PANE with a monotonic
@@ -478,6 +580,10 @@ async function reportPane() {
       );
     }
     _lastPaneSample = p;
+    // ponytail: a hint, not a detector — the banner shows for ~12 s and this samples every 45 s, so most
+    // refusals pass unseen. The durable record is `--debug-file`'s "Channel notifications skipped:" line.
+    if (p.channelGate && p.channelGate.kind !== _lastChannelGate) console.warn(`[feeder] channels not registered (${p.channelGate.kind}): ${p.channelGate.action}`);
+    _lastChannelGate = p.channelGate?.kind ?? null;
     // #156: isolated connection (NOT the shared long-poll socket) so pane sampling never stalls behind
     // the receive long-poll's ALB-killed socket.
     await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress } });
@@ -492,6 +598,71 @@ async function reportPane() {
   }
 }
 
+// --------------------------------------------------------------------------
+// R650 skill sync. The server's answer is untrusted input to this box's filesystem: names and paths are
+// checked before anything is written, and every write lands inside a fresh directory under skillsDir.
+// --------------------------------------------------------------------------
+const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
+const isManaged = (dir) => {
+  const st = fs.lstatSync(dir, { throwIfNoEntry: false });
+  return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
+};
+
+export function writeManagedSkills(skillsDir, skills) {
+  fs.mkdirSync(skillsDir, { recursive: true });
+  const written = new Set();
+  for (const skill of skills) {
+    const name = String(skill?.name ?? "");
+    const target = join(skillsDir, name);
+    if (!SKILL_NAME.test(name)) { console.warn(`[feeder] skill sync: bad name ${JSON.stringify(name)} skipped`); continue; }
+    if (fs.lstatSync(target, { throwIfNoEntry: false }) && !isManaged(target)) {
+      console.warn(`[feeder] skill sync: ${name} is not ours, left alone`);
+      continue;
+    }
+    const files = Array.isArray(skill.files) ? skill.files : [];
+    const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+      || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
+    if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+    try {
+      fs.rmSync(staging, { recursive: true, force: true });
+      for (const f of files) {
+        fs.mkdirSync(dirname(join(staging, f.path)), { recursive: true });
+        fs.writeFileSync(join(staging, f.path), f.content);
+      }
+      fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+      fs.rmSync(target, { recursive: true, force: true });
+      fs.renameSync(staging, target);
+      written.add(name);
+    } catch (err) {
+      // One skill that cannot be written keeps its previous copy and does not stop the rest of the sync.
+      fs.rmSync(staging, { recursive: true, force: true });
+      if (isManaged(target)) written.add(name);
+      console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  // An unlinked skill leaves: every directory we wrote earlier and the server no longer lists.
+  for (const entry of fs.readdirSync(skillsDir)) {
+    if (!written.has(entry) && isManaged(join(skillsDir, entry))) fs.rmSync(join(skillsDir, entry), { recursive: true, force: true });
+  }
+  return [...written];
+}
+
+async function syncSkills() {
+  try {
+    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: {} }));
+    // A refusal or an older server keeps whatever this box already has.
+    if (!answer.ok || !Array.isArray(answer.skills)) {
+      console.warn(`[feeder] skill sync: server answered ${answer.error ?? "without skills"}; keeping current copies`);
+      return;
+    }
+    const written = writeManagedSkills(SKILLS_DIR, answer.skills);
+    console.log(`[feeder] skill sync: ${written.length} skill(s) in ${SKILLS_DIR}`);
+  } catch (err) {
+    console.warn(`[feeder] skill sync failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 // --------------------------------------------------------------------------
 // The loop: initialize → poll next_event → inject each into the live pane → ack the
 // delivered ones on the NEXT poll → self-heal on transient MCP errors (runner shape).
@@ -561,6 +732,10 @@ async function loop() {
     _paneTimer = setInterval(() => { void reportPane(); }, REPORT_PANE_INTERVAL_MS);
     _paneTimer.unref?.();
   }
+  if (SKILLS_DIR && SKILLS_SYNC_INTERVAL_MS > 0) {
+    void syncSkills();
+    setInterval(() => { void syncSkills(); }, SKILLS_SYNC_INTERVAL_MS).unref?.();
+  }
   while (!_stopping) {
     try {
       await pollOnce();