agentradar-cli 0.1.9 → 0.2.0

package/dist/setup.js

@@ -1,8 +1,25 @@
+import { createHash } from "node:crypto";
 import { chmod, lstat, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
-import { basename, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import * as tls from "node:tls";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
+/** `ar_` is a vendor runner bearer; `pcp_` is the key an organisation's own agent claims through `join`. */
+const BEARER_SHAPE = /^(?:ar|pcp)_[A-Za-z0-9_-]+$/;
+/**
+ * R004 — the server's harness id, in the words `supervise-agent.sh` accepts.
+ *
+ * Two vocabularies, deliberately: the server stores `claude_code` (its internal id, the key of
+ * `HARNESS_PROFILES`, and what lands in `adapterConfig.harness`), while the supervisor's
+ * `AR_AGENT_HARNESS` takes `claude`. Translating here rather than widening either side keeps the
+ * refusal in one place — the supervisor dies by name on an unrecognised value, and so does this.
+ */
+const SUPERVISOR_HARNESS = {
+    claude: "claude",
+    claude_code: "claude",
+    codex: "codex",
+};
 async function postJson(fetchImpl, url, body) {
     return fetchImpl(url, {
         method: "POST",
@@ -10,9 +27,35 @@ async function postJson(fetchImpl, url, body) {
         body: JSON.stringify(body),
     });
 }
+/**
+ * The server's own words for a refusal, when it sent any.
+ *
+ * 🔴 THE BODY WAS BEING THROWN AWAY ON THE FAILURE PATH, one function above the `console.error` that
+ * would have printed it. `POST /vendor/agent-setups` answers a configuration problem with
+ * `{ error: "vendor_setup_not_configured", message: "Vendor setup is unavailable until the public
+ * MCP and vendor portal URLs are configured." }` (`server/src/routes/vendor.ts`), and the vendor read
+ * `AgentRadar setup request failed (503)` — on the FIRST door they touch in the product.
+ *
+ * Reads `message` before `error` because this door sends both and only `message` is a sentence;
+ * elsewhere the servers' convention is a bare `{ error: <sentence> }`, so both are tried. A non-JSON
+ * body (an HTML error page from a proxy, an empty 502) throws in `json()` and falls back to the
+ * status line — which is why the parse is inside the try and not beside it.
+ */
+async function failureMessage(response) {
+    const line = `AgentRadar setup request failed (${response.status})`;
+    try {
+        const body = await response.json();
+        const said = [body?.message, body?.error]
+            .find((value) => typeof value === "string" && value.trim().length > 0);
+        return said ? `${line}: ${said.trim()}` : line;
+    }
+    catch {
+        return line;
+    }
+}
 async function responseJson(response) {
     if (!response.ok)
-        throw new Error(`AgentRadar setup request failed (${response.status})`);
+        throw new Error(await failureMessage(response));
     return response.json();
 }
 /**
@@ -59,7 +102,7 @@ export function claudeConfigPath(home, env = process.env) {
  *
  * Returns the resolved project path so the caller can name it in the trust guidance.
  */
-function trustedMcpEndpoint(value) {
+export function trustedMcpEndpoint(value) {
     const endpoint = new URL(value);
     const loopbackHttp = endpoint.protocol === "http:" && (endpoint.hostname === "localhost" ||
         endpoint.hostname === "127.0.0.1" ||
@@ -67,9 +110,9 @@ function trustedMcpEndpoint(value) {
         endpoint.hostname.endsWith(".localhost"));
     return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
 }
-async function installProjectMcp(configPath, cwd, installation, trust) {
+async function installProjectMcp(configPath, cwd, installation, trust, channelRunnerId) {
     const endpoint = trustedMcpEndpoint(installation.mcpEndpoint);
-    if (!endpoint || !/^ar_[A-Za-z0-9_-]+$/.test(installation.bearer)) {
+    if (!endpoint || !BEARER_SHAPE.test(installation.bearer)) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const projectPath = await realpath(cwd);
@@ -97,7 +140,11 @@ async function installProjectMcp(configPath, cwd, installation, trust) {
     const mcpServers = project.mcpServers && typeof project.mcpServers === "object" && !Array.isArray(project.mcpServers)
         ? project.mcpServers
         : {};
-    mcpServers.agentradar = {
+    mcpServers.agentradar = channelRunnerId ? {
+        type: "stdio",
+        command: process.execPath,
+        args: [join(dirname(fileURLToPath(import.meta.url)), "index.js"), "channel", channelRunnerId],
+    } : {
         type: "http",
         url: endpoint.toString(),
         headers: { Authorization: `Bearer ${installation.bearer}` },
@@ -117,10 +164,10 @@ async function installProjectMcp(configPath, cwd, installation, trust) {
     await chmod(configPath, 0o600);
     return projectPath;
 }
-function shellValue(value) {
+export function shellValue(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
-async function writePrivateFile(path, contents) {
+export async function writePrivateFile(path, contents) {
     try {
         if ((await lstat(path)).isSymbolicLink())
             throw new Error(`Refusing to replace a symlinked ${path}`);
@@ -139,7 +186,7 @@ async function installRunner(home, projectPath, approved) {
         throw new Error("AgentRadar returned an invalid runner ID");
     }
     const endpoint = trustedMcpEndpoint(approved.installation.mcpEndpoint);
-    if (!endpoint || !/^ar_[A-Za-z0-9_-]+$/.test(approved.installation.bearer)) {
+    if (!endpoint || !BEARER_SHAPE.test(approved.installation.bearer)) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const agentDir = join(home, ".agentradar", "agents");
@@ -148,6 +195,10 @@ async function installRunner(home, projectPath, approved) {
     await mkdir(configDir, { recursive: true, mode: 0o700 });
     await chmod(agentDir, 0o700);
     await chmod(configDir, 0o700);
+    const declared = (approved.harness ?? "").trim().toLowerCase();
+    const harness = declared ? SUPERVISOR_HARNESS[declared] : undefined;
+    if (declared && !harness)
+        throw new Error(`AgentRadar returned a runtime this runner cannot start: ${JSON.stringify(declared)}`);
     const mcpConfig = join(configDir, "awp-only.json");
     const envPath = join(agentDir, `${approved.runnerId}.env`);
     await writePrivateFile(mcpConfig, `${JSON.stringify({
@@ -165,6 +216,10 @@ async function installRunner(home, projectPath, approved) {
         `AWP_MCP_URL=${shellValue(endpoint.toString())}`,
         `AWP_BEARER=${shellValue(approved.installation.bearer)}`,
         `MCP_CONFIG=${shellValue(mcpConfig)}`,
+        // Written only when the vendor declared a runtime. An absent variable is the supervisor's own
+        // default, so writing `AR_AGENT_HARNESS=claude` unconditionally would change nothing except to make
+        // every existing env file look as though a choice had been made.
+        ...(harness ? [`AR_AGENT_HARNESS=${shellValue(harness)}`] : []),
         "",
     ].join("\n"));
     return envPath;
@@ -183,7 +238,13 @@ export async function setupVendorAgent(deps = {}) {
         throw new Error("Run setup from the agent project folder");
     const apiBase = deps.apiUrl ?? process.env.AGENTRADAR_API_URL ?? DEFAULT_API_URL;
     const setupUrl = new URL("vendor/agent-setups", `${apiBase.replace(/\/+$/, "")}/`);
-    const started = await responseJson(await postJson(fetchImpl, setupUrl, { name: agentName }));
+    const requestedHarness = (deps.harness ?? process.env.AGENTRADAR_AGENT_HARNESS ?? "").trim();
+    const started = await responseJson(await postJson(fetchImpl, setupUrl, {
+        name: agentName,
+        // Sent only when asked for. The server refuses a value it cannot run — by name, in its own words —
+        // so an unrecognised `--harness` fails at the first door rather than at `runner start`, hours later.
+        ...(requestedHarness ? { harness: requestedHarness } : {}),
+    }));
     if (!/^ars_[A-Za-z0-9_-]+$/.test(started.deviceCode) || !/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(started.userCode)) {
         throw new Error("AgentRadar returned an invalid setup challenge");
     }
@@ -191,9 +252,31 @@ export async function setupVendorAgent(deps = {}) {
     log("Waiting for approval…");
     const tokenUrl = new URL("vendor/agent-setups/token", `${apiBase.replace(/\/+$/, "")}/`);
     const expiresAt = Date.now() + started.expiresIn * 1000;
+    // 🔴 A DROPPED CONNECTION MUST NOT DISCARD AN APPROVAL A HUMAN ALREADY GAVE. This poll used to be a
+    // bare `await` in the loop, so one blip — a laptop sleeping, wifi switching, a proxy hiccup — threw
+    // straight out of setup and the vendor had to re-run it and approve a SECOND code while the first sat
+    // pending server-side. Only a definitive answer from the server ends this loop now: approved, denied,
+    // or expired. A transport failure is retried, on a backoff that grows with consecutive failures.
+    //
+    // It cannot spin forever, and the bound is not new: `Date.now() < expiresAt` is the code's own
+    // ten-minute TTL, which the server sent as `expiresIn`. If that TTL ever grows enough that a retry
+    // loop could outlive the code's validity, this needs its own deadline as well.
+    let consecutiveFailures = 0;
     while (Date.now() < expiresAt) {
-        await sleep(Math.max(1, started.interval) * 1000);
-        const response = await postJson(fetchImpl, tokenUrl, { deviceCode: started.deviceCode });
+        await sleep(Math.max(1, started.interval) * 1000 * Math.min(consecutiveFailures + 1, 5));
+        let response;
+        try {
+            response = await postJson(fetchImpl, tokenUrl, { deviceCode: started.deviceCode });
+        }
+        catch {
+            consecutiveFailures += 1;
+            // Said out loud, and naming the HOST rather than the error: a silent retry is indistinguishable
+            // from a hang to the person watching, and `fetch` rejects with the two words "fetch failed",
+            // which name nothing. The host is the fact worth printing and we already hold it.
+            log(`Could not reach ${tokenUrl.host} — the code is still valid, retrying…`);
+            continue;
+        }
+        consecutiveFailures = 0;
         if (response.status === 202)
             continue;
         if (response.status === 410)
@@ -212,10 +295,151 @@ export async function setupVendorAgent(deps = {}) {
             ? `--trust: pre-accepted the trust dialog for ${projectPath}. Claude Code will run this folder's existing hooks and settings without asking.`
             : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
+        if ((approved.harness ?? "").trim().toLowerCase() === "codex") {
+            // Said BEFORE the vendor runs the runner, because the supervisor's refusal comes after they
+            // think setup succeeded. Codex reads its MCP servers from $CODEX_HOME/config.toml — there is no
+            // `--strict-mcp-config` to point at the file this setup just wrote — so the isolation boundary is
+            // a per-agent home the vendor supplies, and the supervisor fails closed without it.
+            log(`This agent runs on Codex. Set CODEX_HOME in ${runnerEnv} to a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server; the runner refuses to start without it.`);
+        }
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
         log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");
 }
+/**
+ * Mode A — the organisation's own agent, on its own compute, joining through an enrolment link.
+ *
+ * accept → wait for a human to approve → claim the key once → install the same MCP config and runner
+ * `setup` installs. The one-time claim secret is kept in a 0600 state file per link, so a re-run
+ * resumes the wait (or, once claimed, just starts the runner) instead of filing a second request.
+ * The key itself is written only into the two 0600 config files and is never printed.
+ */
+export async function joinOrganisation(enrolmentUrl, deps = {}) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const log = deps.log ?? console.log;
+    const cwd = deps.cwd ?? process.cwd();
+    const home = deps.home ?? homedir();
+    // Claude Code sets CLAUDECODE in its shell; a machine with both tools installed may export CODEX_HOME too.
+    const harness = deps.harness ?? (process.env.CLAUDECODE || !process.env.CODEX_HOME ? "claude" : "codex");
+    const startJoined = async (runnerId, firstPoll = false) => {
+        if (!firstPoll) {
+            log(`Connected. Runner: ${runnerId}. Now, in this same session, poll for your welcome and work: agentradar run ${runnerId} next_event`);
+            return 0;
+        }
+        // The first poll is the same call the agent makes next, so the welcome arrives without a second harness
+        // prompt and the agent's next bare poll acknowledges it. The key is already saved: a failed poll only says so.
+        log("Connected. Your welcome and first instructions:");
+        const { callToolOverCli } = await import("./tool-run.js");
+        await callToolOverCli(runnerId, "next_event", undefined, { home, fetch: fetchImpl, log })
+            .catch(() => log("Could not fetch them yet."));
+        log(`Runner: ${runnerId}. Do what the instructions above say. Then stay listening: make agentradar run ${runnerId} listen the last step of every turn, ${harness === "claude" ? "in the background (run_in_background), and end your turn; you are woken when it exits" : "in the foreground, and wait for it"}. It prints the next client message as soon as one arrives, or a note after about 9 minutes; answer what it printed, then run it again.`);
+        return 0;
+    };
+    let link;
+    try {
+        link = new URL(enrolmentUrl);
+    }
+    catch {
+        throw new Error("Pass the enrolment link your organisation gave you, e.g. https://…/invite/<token>");
+    }
+    const token = /^\/(?:api\/invites|invite)\/([^/]+?)(?:\.md)?(?:\/|$)/.exec(link.pathname)?.[1];
+    if (!token || !trustedMcpEndpoint(link.origin)) {
+        throw new Error("That is not an AgentRadar enrolment link (expected https://…/invite/<token>)");
+    }
+    const api = (path) => new URL(`/api/${path}`, link.origin);
+    const mcpEndpoint = process.env.AWP_MCP_URL || api("mcp").toString();
+    const joinsDir = join(home, ".agentradar", "joins");
+    await mkdir(joinsDir, { recursive: true, mode: 0o700 });
+    const statePath = join(joinsDir, `${createHash("sha256").update(token).digest("hex")}.json`);
+    let state = null;
+    try {
+        state = JSON.parse(await readFile(statePath, "utf8"));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (state?.agentId) {
+        log("This enrolment link is already joined on this machine.");
+        const runnerId = `join-${state.requestId}`;
+        const env = await readFile(join(home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
+        const { envValue } = await import("./tool-run.js");
+        await installProjectMcp(claudeConfigPath(home), cwd, {
+            mcpEndpoint: envValue(env, "AWP_MCP_URL") ?? "", bearer: envValue(env, "AWP_BEARER") ?? "",
+        }, deps.trust === true, harness === "claude" ? runnerId : undefined);
+        return startJoined(runnerId);
+    }
+    if (!state) {
+        const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
+        if (!agentName)
+            throw new Error("Run join from the agent project folder");
+        // Codex has no env var for its model; its config's top-level `model` is the default a session starts on.
+        // A codex agent reporting "claude" is guessing (a gateway combo answers as Claude), so the config wins there too.
+        const codexModel = async () => !process.env.CODEX_HOME ? undefined : /^model\s*=\s*"([^"\n]+)"/m.exec((await readFile(join(process.env.CODEX_HOME, "config.toml"), "utf8").catch(() => "")).split(/^\[/m)[0])?.[1];
+        const model = (!deps.model || deps.model === "unknown" || /claude/i.test(deps.model)) && harness === "codex" ? (await codexModel()) ?? deps.model : deps.model;
+        const response = await postJson(fetchImpl, api(`invites/${encodeURIComponent(token)}/accept`), {
+            requestType: "agent", agentName, adapterType: "awp_remote",
+            agentDefaultsPayload: { harness, ...(model ? { model } : {}) },
+        });
+        if (!response.ok) {
+            throw new Error(response.status === 404
+                ? "This join link has expired, was already used, or was withdrawn. Ask your organisation for a new link."
+                : `This join link cannot be used. ${await failureMessage(response)}`);
+        }
+        const accepted = await response.json();
+        if (typeof accepted.id !== "string" || typeof accepted.claimSecret !== "string") {
+            throw new Error("AgentRadar returned an invalid join response");
+        }
+        state = { requestId: accepted.id, claimSecret: accepted.claimSecret, ...(typeof accepted.approvalUrl === "string" ? { approvalUrl: accepted.approvalUrl } : {}) };
+        await writePrivateFile(statePath, JSON.stringify(state));
+    }
+    log("Join request sent. Waiting for your organisation to approve it…");
+    if (state.approvalUrl)
+        log(`Approval link: ${state.approvalUrl}\nSend it to your own human once; they approve after signing in. Never send anything else from this folder.`);
+    const claimUrl = api(`join-requests/${encodeURIComponent(state.requestId)}/claim-api-key`);
+    // Named off the join request, which exists before the key does, so the server can record it at claim.
+    const runnerId = `join-${state.requestId}`;
+    for (let poll = 1;; poll++) {
+        if (poll > (deps.polls ?? 9)) {
+            log(`Still waiting for approval. Run this same command again: agentradar run ${enrolmentUrl}`);
+            return 0;
+        }
+        let response;
+        try {
+            response = await postJson(fetchImpl, claimUrl, { claimSecret: state.claimSecret, runnerId });
+        }
+        catch {
+            log(`Could not reach ${claimUrl.host}; retrying…`);
+            await sleep(10_000);
+            continue;
+        }
+        if (response.status === 201) {
+            const claimed = await response.json();
+            if (typeof claimed.token !== "string" || typeof claimed.agentId !== "string") {
+                throw new Error("AgentRadar returned an invalid key claim");
+            }
+            const installation = { mcpEndpoint, bearer: claimed.token };
+            const projectPath = await installProjectMcp(claudeConfigPath(home), cwd, installation, deps.trust === true, harness === "claude" ? runnerId : undefined);
+            const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId: claimed.agentId, runnerId, installation, harness });
+            await writePrivateFile(statePath, JSON.stringify({ ...state, agentId: claimed.agentId }));
+            log(`Approved. AgentRadar MCP installed for this project, runner installed → ${runnerEnv}`);
+            return startJoined(runnerId, true);
+        }
+        const said = await failureMessage(response);
+        if (response.status === 409 && said.includes("must be approved")) {
+            await sleep(10_000);
+            continue;
+        }
+        if (response.status === 409 && said.includes("rejected")) {
+            throw new Error("Your organisation declined this join request. Ask it for a new enrolment link.");
+        }
+        if (response.status === 409 && /already (?:used|claimed)/.test(said)) {
+            throw new Error("This enrolment link's key was already claimed. A key is issued once and cannot be claimed again; ask your organisation for a new enrolment link.");
+        }
+        throw new Error(said);
+    }
+}
 //# sourceMappingURL=setup.js.map

package/dist/skill-install.js

@@ -37,6 +37,8 @@ export async function installVendorSkill(deps = {}) {
                 throw error;
         });
     }
+    // The runner keeps this skill current from AgentRadar; the marker says the folder is AgentRadar's to replace.
+    await writeFile(join(skillDir, ".agentradar-managed"), "Written by AgentRadar; replaced on every sync.\n");
     (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
 }
 //# sourceMappingURL=skill-install.js.map

package/dist/tool-run.js

@@ -0,0 +1,300 @@
+import { readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+/**
+ * One `KEY='value'` line as `setup.ts` wrote it, single-quoted with `'` escaped as `'\''`.
+ * Nothing here is printed: the file holds the runner's bearer.
+ */
+export function envValue(contents, key) {
+    const line = contents.split("\n").find((row) => row.startsWith(`${key}=`));
+    if (!line)
+        return null;
+    const raw = line.slice(key.length + 1).trim();
+    const quoted = raw.startsWith("'") && raw.endsWith("'") && raw.length >= 2;
+    return (quoted ? raw.slice(1, -1).replaceAll("'\\''", "'") : raw) || null;
+}
+export async function runServiceToolOverCli(runnerId, toolKey, argumentsJson, deps = {}) {
+    const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    return await callAwpTool(runnerId, "run_service_tool", { toolKey, arguments: parameters, entryPoint: "cli" }, deps);
+}
+/** `agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>']`: any AWP tool from a shell, so a just-joined agent works before its harness reloads MCP tools. */
+export async function callToolOverCli(runnerId, tool, argumentsJson, deps = {}, flags = []) {
+    const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    if (flags.length) {
+        const typed = await flagArguments(runnerId, tool, flags, deps);
+        if (!typed)
+            return 1;
+        Object.assign(parameters, typed);
+    }
+    if (tool !== "next_event" || !RUNNER_ID.test(runnerId))
+        return await callAwpTool(runnerId, tool, parameters, deps);
+    // A bare poll acknowledges the batch the previous poll printed, so the command stays byte-identical and
+    // an operator can allow it once. Asking for the next event means the last one was read; a lost or
+    // failed poll leaves the file as it was, so delivery stays at-least-once.
+    const delivered = join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.delivered.json`);
+    if (parameters.ackEventIds === undefined) {
+        const ids = await readFile(delivered, "utf8").then((text) => JSON.parse(text), () => []);
+        if (Array.isArray(ids) && ids.length)
+            parameters.ackEventIds = ids;
+    }
+    let said = "";
+    const code = await callAwpTool(runnerId, tool, parameters, { ...deps, log: (text) => { said = text; (deps.log ?? console.log)(text); } });
+    if (code !== 0)
+        return code;
+    let events = [];
+    try {
+        events = JSON.parse(said).events;
+    }
+    catch { /* not a batch: nothing to acknowledge */ }
+    const ids = Array.isArray(events) ? events.map((event) => event?.eventId).filter((id) => typeof id === "string") : [];
+    await writeFile(delivered, JSON.stringify(ids), { mode: 0o600 }).catch(() => undefined);
+    return 0;
+}
+/**
+ * `agentradar run <runner-id> listen`: bare `next_event` polls (each held by the server, each acking the
+ * batch before it) until work, a liveness probe or the welcome arrives, or until the next hold could run
+ * past `budgetMs`. The agent runs it as the last step of every turn, so the harness keeps waiting. Nine
+ * minutes stays under Claude Code's 10-minute Bash cap; Codex waits on it in 5-minute chunks.
+ */
+export async function listenOverCli(runnerId, deps = {}, budgetMs = 540_000) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const start = now();
+    let longest = 0;
+    for (;;) {
+        const began = now();
+        let said = "";
+        const code = await callToolOverCli(runnerId, "next_event", undefined, { ...deps, log: (text) => { said = text; } });
+        if (code !== 0)
+            return code;
+        let batch = null;
+        try {
+            batch = JSON.parse(said);
+        }
+        catch { /* not a batch: keep waiting */ }
+        // Wake on work, a liveness probe or the welcome; anything else (events: null, an unknown key) waits.
+        if ((Array.isArray(batch?.events) && batch.events.length) || batch?.livenessProbe || batch?.welcome) {
+            (deps.log ?? console.log)(said);
+            return 0;
+        }
+        // A caller the server does not hold (not yet hired, a run JWT) answers at once; do not spin on it.
+        if (now() - began < 10_000)
+            await sleep(10_000 - (now() - began));
+        longest = Math.max(longest, now() - began);
+        if (now() - start + longest > budgetMs) {
+            (deps.log ?? console.log)(`No client message in ${Math.round((now() - start) / 60_000)} minutes. Run agentradar run ${runnerId} listen again.`);
+            return 0;
+        }
+    }
+}
+/** Split `<runner-id> <tool> [--args '<json>'] [--<argument> <value> ...]`; null when it is not that shape. */
+export function parseCallArgs(rest) {
+    const positional = [];
+    const flags = [];
+    let json;
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (!arg.startsWith("--")) {
+            positional.push(arg);
+            continue;
+        }
+        const value = rest[++i];
+        if (value === undefined)
+            return null;
+        if (arg === "--args")
+            json = value;
+        else
+            flags.push([arg.slice(2), value]);
+    }
+    return positional.length === 2 ? { runnerId: positional[0], tool: positional[1], json, flags } : null;
+}
+/**
+ * `--text "hi" --conversation-id X` as the tool's own arguments, typed by the inputSchema the server
+ * advertises, so an agent never types JSON (braces and quotes) into a shell command.
+ */
+async function flagArguments(runnerId, tool, flags, deps) {
+    const logError = deps.logError ?? console.error;
+    const listed = await awpRequest(runnerId, "tools/list", {}, deps);
+    if (!listed)
+        return null;
+    const schema = listed.result?.tools?.find((entry) => entry.name === tool)?.inputSchema?.properties ?? {};
+    const out = {};
+    const camel = (flag) => flag.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+    for (let [flag, value] of flags) {
+        // --body-file page.md: the argument read from a file, so a multi-line page never sits in a quoted
+        // shell argument (Claude Code prompts on a newline followed by # inside one).
+        if (flag.endsWith("-file") && !(flag in schema) && !(camel(flag) in schema)) {
+            const text = await readArgumentFile(value, deps.cwd ?? process.cwd(), deps.home ?? homedir()).catch((error) => error);
+            if (text instanceof Error) {
+                logError(`--${flag}: ${text.message}`);
+                return null;
+            }
+            [flag, value] = [flag.slice(0, -"-file".length), text];
+        }
+        // --text is what agents reach for on append_task_log, whose argument is --entry.
+        const key = flag in schema ? flag : flag === "text" && "entry" in schema ? "entry" : camel(flag);
+        if (!(key in schema)) {
+            logError(`${tool} has no argument --${flag}. Its arguments: ${Object.keys(schema).map((name) => `--${name}`).join(" ") || "none"}`);
+            return null;
+        }
+        const type = [schema[key].type].flat()[0];
+        const typed = coerce(type === "array" ? [schema[key].items?.type].flat()[0] : type, value);
+        if (typed === undefined) {
+            logError(`--${flag} must be ${type === "array" ? "a list of " + schema[key].items?.type : "a " + type}`);
+            return null;
+        }
+        // A repeated flag builds a list: --message-ids a --message-ids b.
+        out[key] = type === "array" ? [...(out[key] ?? []), typed] : typed;
+    }
+    return out;
+}
+/**
+ * `agentradar run` is always-allowed, so a file flag must not read and upload any file the agent names:
+ * only a regular file inside the working folder (after symlinks), and at most 256 KB — and never one in
+ * ~/.agentradar, which holds the runner's own key even when the working folder is $HOME.
+ * ponytail: a hard link to the key is not caught (same inode, different path); making one is the agent's own act.
+ */
+async function readArgumentFile(path, cwd, home) {
+    const real = await realpath(resolve(cwd, path)).catch(() => { throw new Error(`cannot read ${path}`); });
+    const within = (dir) => { const inside = relative(dir, real); return inside !== ".." && !inside.startsWith(`..${sep}`) && !isAbsolute(inside); };
+    const own = await realpath(join(home, ".agentradar")).catch(() => null);
+    if (own && within(own))
+        throw new Error(`${path} is refused: a file flag never reads AgentRadar's own folder (~/.agentradar), which holds this agent's key`);
+    const info = await stat(real);
+    if (!info.isFile() || !within(await realpath(cwd)) || info.size > 256 * 1024) {
+        throw new Error(`${path} is refused: a file flag reads only a regular file inside the current folder, up to 256 KB`);
+    }
+    return await readFile(real, "utf8");
+}
+function coerce(type, value) {
+    if (type === "string")
+        return value;
+    if (type === "number" || type === "integer") {
+        const number = value.trim() === "" ? NaN : Number(value);
+        return Number.isFinite(number) && (type === "number" || Number.isInteger(number)) ? number : undefined;
+    }
+    if (type === "boolean")
+        return value === "true" ? true : value === "false" ? false : undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return type === undefined ? value : undefined;
+    }
+}
+/**
+ * Ruling 49 — `agentradar task create|repeat <runner-id> --args '<json>'`: the agent's own `create_task`
+ * or `create_recurring_task`, on the same AWP endpoint with the same key, so who it may assign to is the
+ * server's decision exactly as it is over MCP.
+ */
+export async function createTaskOverCli(runnerId, recurring, argumentsJson, deps = {}) {
+    const parameters = parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    return await callAwpTool(runnerId, recurring ? "create_recurring_task" : "create_task", parameters, deps);
+}
+function parseArgumentsObject(argumentsJson, logError) {
+    let parsed;
+    try {
+        parsed = JSON.parse(argumentsJson);
+    }
+    catch {
+        logError("--args must be a JSON object, e.g. --args '{\"title\":\"a real issue\"}'");
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        logError("--args must be a JSON object");
+        return null;
+    }
+    return parsed;
+}
+/**
+ * R251 — `agentradar tool list <runner-id>`: the server's own `list_service_tools`, printed as it
+ * answered. The listing is the policy's preview for this agent, so the CLI computes nothing — a second
+ * copy of the decision here could only drift from the one the MCP tool and every real call make.
+ */
+export async function listServiceToolsOverCli(runnerId, deps = {}) {
+    return await callAwpTool(runnerId, "list_service_tools", {}, deps);
+}
+/** One `tools/call` on the runner's AWP MCP endpoint with the runner's own key; the answer is printed verbatim. */
+export async function callAwpTool(runnerId, name, toolArguments, deps) {
+    const log = deps.log ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const body = await awpRequest(runnerId, "tools/call", { name, arguments: toolArguments }, deps);
+    if (!body)
+        return 1;
+    const text = body.result?.content?.[0]?.text;
+    const said = typeof text === "string" ? text : JSON.stringify(body.result ?? {});
+    // A refusal is the server's sentence and belongs on stderr with a non-zero exit, or a script that
+    // pipes stdout reads "the tool ran" from a body that says it was refused.
+    if (body.result?.isError) {
+        logError(said);
+        return 1;
+    }
+    log(said);
+    return 0;
+}
+const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
+async function awpRequest(runnerId, method, params, deps) {
+    const logError = deps.logError ?? console.error;
+    if (!RUNNER_ID.test(runnerId)) {
+        logError("Invalid runner ID");
+        return null;
+    }
+    const envPath = join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.env`);
+    let url;
+    let bearer;
+    const contents = await readFile(envPath, "utf8").catch(() => null);
+    if (contents !== null) {
+        url = envValue(contents, "AWP_MCP_URL");
+        bearer = envValue(contents, "AWP_BEARER");
+        if (!url || !bearer) {
+            logError(`${envPath} is missing AWP_MCP_URL or AWP_BEARER. Run agentradar setup again.`);
+            return null;
+        }
+    }
+    else {
+        // Ruling 41 — a hosted agent has no runner file. Its run already carries the server's origin and its
+        // per-run JWT (`PAPERCLIP_API_URL`/`PAPERCLIP_API_KEY`), which the AWP MCP admits for a vendorless
+        // hosted agent (`server/src/awp/resolve.ts`). The runner file, when present, still wins.
+        const env = deps.env ?? process.env;
+        const origin = env.PAPERCLIP_API_URL?.trim().replace(/\/+$/, "");
+        bearer = env.PAPERCLIP_API_KEY?.trim() || null;
+        if (!origin || !bearer) {
+            logError(`No runner named ${runnerId}: ${envPath} does not exist. Run agentradar setup first.`);
+            return null;
+        }
+        url = `${origin}/api/mcp`;
+    }
+    const response = await (deps.fetch ?? fetch)(url, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${bearer}`,
+            "content-type": "application/json",
+            // Both, because the endpoint answers JSON only when the client says it takes JSON.
+            accept: "application/json, text/event-stream",
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method,
+            params,
+        }),
+    });
+    if (!response.ok) {
+        logError(`AgentRadar refused the tool call (${response.status}).`);
+        return null;
+    }
+    const body = await response.json();
+    if (body.error) {
+        logError(typeof body.error.message === "string" ? body.error.message : "AgentRadar returned an error");
+        return null;
+    }
+    return body;
+}
+//# sourceMappingURL=tool-run.js.map