agentradar-cli 0.1.8 → 0.2.0

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -7,10 +7,11 @@
 # all env params). It idempotently ensures BOTH halves of an always-on agent are
 # up, then blocks so KeepAlive/Restart revives the whole thing on any death:
 #
-#   1. a tmux session ($TMUX_SESSION) running the agent:
+#   1. a tmux session ($TMUX_SESSION) running the agent CLI named by $AR_AGENT_HARNESS:
 #        claude --continue $CLAUDE_EXTRA_FLAGS --strict-mcp-config --mcp-config=$MCP_CONFIG
-#      in $AR_BASE, with a SCRUBBED allowlist env + the macOS user's normal
-#      Keychain-backed Claude session. Strict MCP flags allow ONLY AgentRadar's config;
+#        codex resume --last $CODEX_EXTRA_FLAGS --cd $AR_BASE   (MCP confined by $CODEX_HOME)
+#      in $AR_BASE, with a SCRUBBED allowlist env + the CLI's own persisted login.
+#      Strict MCP flags (Claude) / a per-agent CODEX_HOME (Codex) allow ONLY AgentRadar's config;
 #   2. the feeder ($FEEDER_JS) OUTSIDE that session, holding $AWP_BEARER, long-
 #      polling next_event and tmux-injecting each event into the pane.
 #
@@ -20,7 +21,8 @@
 # starts it on boot → same. Composes with the stateless AWP MCP (#111/#112:
 # reconnect, no -32001) + `claude --continue` (context resumes) = hands-free revive.
 #
-# HARD RULE: claude.ai OAuth ONLY. Refuses to start if ANTHROPIC_API_KEY is set.
+# HARD RULE (claude harness): claude.ai OAuth ONLY. Refuses to start if
+# ANTHROPIC_API_KEY is set. Codex authenticates only through $CODEX_HOME/auth.json.
 # =============================================================================
 set -euo pipefail
 
@@ -51,7 +53,6 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-: "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
 FEEDER_JS="${FEEDER_JS:-$(cd "$(dirname "$0")/.." && pwd)/feeder.mjs}"
 PANE_LIVE_SH="${PANE_LIVE_SH:-$(cd "$(dirname "$0")/.." && pwd)/pane-live.sh}"
@@ -68,11 +69,56 @@ BROWSER_APP="${BROWSER_APP:-Google Chrome}"          # #150: app to ensure-up fo
 BROWSER_READY_MAX_SEC="${BROWSER_READY_MAX_SEC:-20}" # #150: bounded wait for the browser proc on cold boot
 BROWSER_READY_SETTLE_SEC="${BROWSER_READY_SETTLE_SEC:-3}" # #150: settle for extension/native-host after cold launch
 HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
-# Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
-# differs by directory), NOT the basename: on a multi-agent box every agent's config is named
-# `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
-# death (silent death — the exact failure #145 kills). Override per agent for extra scoping if needed.
-AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-mcp-config.*${MCP_CONFIG}}"
+
+# --- 2a. R004 HARNESS SELECTION — one documented variable picks the CLI ---------
+# The Bible names two agent harnesses: Claude Code and Codex. `claude` is the default, so every existing
+# agent env file keeps launching exactly what it launched before. Anything that is neither is REFUSED by
+# name: a supervisor that quietly fell back to Claude for an unrecognized value would come up healthy,
+# keep a pane alive, and answer nothing the vendor expected.
+AR_AGENT_HARNESS="${AR_AGENT_HARNESS:-claude}"
+case "${AR_AGENT_HARNESS}" in
+  claude|codex) : ;;
+  *) die "AR_AGENT_HARNESS must be 'claude' or 'codex' (got '${AR_AGENT_HARNESS}')" ;;
+esac
+
+# What actually differs between the two CLIs, measured against `claude` and codex-cli 0.149.1:
+#   the binary, the resume argument, how connectors are confined, and the argv the pane can be found by.
+# Everything else below — the env -i allowlist, the 0600 bearer file, the feeder, the bridge, the recovery
+# loop — is shared, because nothing about it is harness-specific.
+if [ "${AR_AGENT_HARNESS}" = "codex" ]; then
+  AGENT_BIN="${CODEX_BIN:-codex}"
+  # `codex resume --last` continues the most recent recorded session and exits non-zero when there is none,
+  # so the launch falls back to a fresh `codex` exactly as the Claude path falls back from `--continue`.
+  AR_RESUME_FLAGS="resume --last"
+  # 🔴 CODEX HAS NO `--strict-mcp-config`. Its MCP servers are read from $CODEX_HOME/config.toml, so
+  # CODEX_HOME *is* the connector-isolation boundary rather than a convenience, and it is REQUIRED. Point it
+  # at a per-agent home whose config.toml declares the AgentRadar MCP and nothing else. Failing closed here
+  # is the point: letting it default to the vendor's own ~/.codex would hand the client's agent every MCP
+  # server that vendor has ever configured — exactly the exposure `--strict-mcp-config` closes on the Claude
+  # path, and it would present as a working agent.
+  [ -n "${CODEX_HOME:-}" ] || die "AR_AGENT_HARNESS=codex requires CODEX_HOME — a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server"
+  [ -d "${CODEX_HOME}" ] || die "CODEX_HOME not found: ${CODEX_HOME}"
+  CODEX_EXTRA_FLAGS="${CODEX_EXTRA_FLAGS:-}"
+  # shellcheck disable=SC2086  # CODEX_EXTRA_FLAGS is intentionally unquoted so it word-splits into flags.
+  _launch_flags=( ${CODEX_EXTRA_FLAGS} --cd "${AR_BASE}" )
+  # Pane-alive predicate — MUST be unique per agent. `--cd <AR_BASE>` is the per-agent argv token on this
+  # harness (CODEX_HOME is an env var, invisible to `ps -o command=`), so it plays the role the full
+  # mcp-config path plays for Claude: a pattern that cannot match another agent's live process.
+  _agent_pid_pattern_default="${AGENT_BIN}.*--cd ${AR_BASE}"
+else
+  AGENT_BIN="${CLAUDE_BIN}"
+  AR_RESUME_FLAGS="--continue"
+  : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
+  # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
+  # shellcheck disable=SC2086
+  _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
+  # differs by directory), NOT the basename: on a multi-agent box every agent's config is named
+  # `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
+  # death (silent death — the exact failure #145 kills). Override per agent for extra scoping if needed.
+  _agent_pid_pattern_default="mcp-config.*${MCP_CONFIG}"
+fi
+AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-${_agent_pid_pattern_default}}"
 
 # Optional per-agent TOOL credentials — a vendor brain's OWN MCP-tool API keys (e.g. an SEO agent's
 # WEBFLOW_TOKEN / PERPLEXITY_API_KEY). These are ADDED to the scrubbed launch env so the agent's own
@@ -97,7 +143,7 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
     # identity). Reject at parse time (visible warning) AND — belt-and-suspenders — the launch lists
     # the reserved allowlist AFTER TOOL_ENV_ARGS so `env` last-wins keeps reserved vars authoritative.
     case "${_tline%%=*}" in
-      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
+      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
         log "WARN ignoring reserved key '${_tline%%=*}' in ${AGENT_TOOL_ENV_FILE} (cannot override supervisor/agent env)"; continue ;;
     esac
     TOOL_ENV_ARGS+=("${_tline}")
@@ -110,11 +156,18 @@ fi
 # env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
 unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
 
-# HARD RULE — OAuth only, never a pay-as-you-go API key.
-[ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
+# HARD RULE — OAuth only, never a pay-as-you-go API key. Scoped to the Claude harness because that is where
+# the variable decides anything: `claude` prefers ANTHROPIC_API_KEY over the subscription session, so its
+# mere presence changes who pays. `codex` (>= 0.122) ignores OPENAI_API_KEY entirely and reads credentials
+# only from $CODEX_HOME/auth.json, so there is no equivalent env var to refuse — a Codex vendor chooses
+# subscription or API-key billing by how that home was logged in, and a refusal here would guard nothing
+# while blocking boxes that carry the variable for unrelated work.
+if [ "${AR_AGENT_HARNESS}" = "claude" ]; then
+  [ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
+fi
 
 command -v "${TMUX_BIN}" >/dev/null 2>&1 || die "tmux not found (${TMUX_BIN})"
-command -v "${CLAUDE_BIN}" >/dev/null 2>&1 || die "claude CLI not found (${CLAUDE_BIN})"
+command -v "${AGENT_BIN}" >/dev/null 2>&1 || die "${AR_AGENT_HARNESS} CLI not found (${AGENT_BIN})"
 [ -f "${FEEDER_JS}" ] || die "feeder not found: ${FEEDER_JS}"
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
@@ -210,17 +263,18 @@ ensure_agent() {
   # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
-  log "starting agent in tmux '${TMUX_SESSION}' (flags: ${CLAUDE_EXTRA_FLAGS:-none}; tool-env file: ${_TOOL_ENV_FILE:-none})"
-  # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
+  log "starting agent (${AR_AGENT_HARNESS}) in tmux '${TMUX_SESSION}' (tool-env file: ${_TOOL_ENV_FILE:-none})"
   # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
   # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
-  # crash-loops. So try `--continue`, and FALL BACK to a fresh `claude` (which stays up AND creates the
-  # session) when there's nothing to resume. Self-healing: once a conversation exists, --continue resumes it;
+  # crash-loops. So try the resume form, and FALL BACK to a fresh session (which stays up AND creates the
+  # session) when there's nothing to resume. Self-healing: once a conversation exists, resume picks it up;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
-  # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
-  # shellcheck disable=SC2086
-  _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # verified — so the `||` fallback is reliable, and `codex resume --last` behaves the same way.)
+  # R004: the resume argument is the ONE harness-specific token inside the wrapper, so it arrives as
+  # AR_RESUME_FLAGS ("--continue" or "resume --last") and is word-split there — the same idiom this launch
+  # already uses for the extra flags. The wrapper copies it to a local and unsets it before exec so it does
+  # not linger in the agent's environment.
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
@@ -239,6 +293,10 @@ ensure_agent() {
   # visible once there is colour to look at. LC_ALL stays empty on purpose: an empty LC_ALL does not
   # override, so LC_CTYPE governs and a vendor can still set LANG per agent.
   #
+  # Channels: CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 keeps the tengu_harbor flag readable from the
+  # disk cache even if telemetry is off, and it and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC are reserved so a
+  # tool file cannot turn channels off. See docs/claude-code-channels-gates.md.
+  #
   # 🔴 This comment block lives ABOVE the command, not inside it. A `#` comment between two
   # `\`-continued lines TERMINATES the command at its unescaped newline: tmux would receive only the
   # args up to SHELL=…, the pane would start with no `claude` at all, and the `TERM=… claude` tail
@@ -251,9 +309,10 @@ ensure_agent() {
       TERM="${AR_AGENT_TERM:-tmux-256color}" COLORTERM="${AR_AGENT_COLORTERM:-truecolor}" \
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
-      DISABLE_AUTOUPDATER=1 \
+      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${AR_RESUME_FLAGS}" \
+      DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
       ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; unset AR_RESUME_FLAGS; CB="$1"; shift; "$CB" $RF "$@" || exec "$CB" "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -282,7 +341,8 @@ log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
 # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
 # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
 AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" node "${FEEDER_JS}" &
+  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
+  node "${FEEDER_JS}" &
 FEEDER_PID=$!
 log "feeder pid ${FEEDER_PID}"
 
@@ -316,7 +376,7 @@ while true; do
     exit 1
   fi
   if ! pane_alive; then
-    log "agent claude pane died — recovering it in place"
+    log "agent pane died — recovering it in place"
     if ensure_agent; then
       if [ -n "${BRIDGE_PID}" ]; then
         kill "${BRIDGE_PID}" 2>/dev/null || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {
@@ -10,7 +10,10 @@
     "dist/index.js",
     "dist/setup.js",
     "dist/runner.js",
+    "dist/channel.js",
     "dist/skill-install.js",
+    "dist/tool-run.js",
+    "dist/sync.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",
     "README.md"