agentradar-cli 0.1.9 → 0.2.0

package/dist/vendor-runner/feeder.mjs

@@ -4,7 +4,10 @@
 //
 // Unlike runner.mjs (which spawns a fresh `claude` per event, out-of-context), the
 // feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
-// `claude` running in a tmux pane (real in-session continuity — I1). It:
+// agent CLI running in a tmux pane (real in-session continuity — I1). R004: that CLI is
+// Claude Code or Codex, selected by AR_AGENT_HARNESS; injection, acking and the
+// in-progress hint are identical on both, and only the login probe, the idle-composer
+// marker and the pane's argv pattern branch. It:
 //   1. phones home to the single AgentRadar AWP MCP and long-polls `next_event`;
 //   2. injects each event into the live pane via `tmux send-keys` (I2), pinning the
 //      EXPLICIT conversationId so the agent's `reply` never guesses the target;
@@ -18,11 +21,11 @@
 // ===========================================================================
 
 import { spawn, spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, sendKeysCommands } from "./session-frame.mjs";
 
@@ -45,9 +48,22 @@ const AWP_BEARER = (() => {
   return process.env.AWP_BEARER ?? "";
 })();
 const TMUX_SESSION = process.env.TMUX_SESSION ?? "agent";
-// The claude pid marker (same predicate entrypoint.sh uses) — proves the pane is live.
-const AGENT_PID_PATTERN = process.env.AGENT_PID_PATTERN ?? "mcp-config.*awp-only";
-const CLAUDE_BIN = process.env.CLAUDE_BIN ?? "claude";
+/**
+ * R004 — which CLI is in the pane. `claude` is the default, so a feeder started by an older supervisor (or
+ * by hand) behaves exactly as before. Only what genuinely differs reads this: how the CLI reports its login
+ * state, what its idle composer looks like, and the argv the pane can be found by. The in-progress hint and
+ * the volatile-line strip are NOT harness-specific — measured on codex-cli 0.149.1, Codex renders the same
+ * `esc to interrupt` working line Claude does (`• Working (1s • esc to interrupt)`), so the existing
+ * matchers already cover it and a speculative Codex spinner pattern would be invention, not coverage.
+ */
+export const AR_AGENT_HARNESS = process.env.AR_AGENT_HARNESS === "codex" ? "codex" : "claude";
+// The agent pid marker (same predicate entrypoint.sh uses) — proves the pane is live. Claude is found by its
+// mcp-config argument; Codex takes its MCP servers from CODEX_HOME (an env var, invisible to `ps`), so its
+// per-agent argv token is `--cd <working dir>`. The supervisor passes an exact pattern; this default only
+// matters for a hand-started feeder.
+const AGENT_PID_PATTERN =
+  process.env.AGENT_PID_PATTERN ?? (AR_AGENT_HARNESS === "codex" ? "codex.*--cd " : "mcp-config.*awp-only");
+const AGENT_BIN = process.env.AGENT_BIN ?? process.env.CLAUDE_BIN ?? (AR_AGENT_HARNESS === "codex" ? "codex" : "claude");
 const AR_OAUTH_TOKEN_FILE = process.env.AR_OAUTH_TOKEN_FILE ?? "";
 
 const MCP_CALL_TIMEOUT_MS = Number(process.env.AWP_MCP_CALL_TIMEOUT_MS ?? "30000");
@@ -75,6 +91,18 @@ const REPORT_PANE_INTERVAL_MS = Number(process.env.REPORT_PANE_INTERVAL_MS ?? "4
 // any single failure well under the 45s interval.
 const PANE_MCP_TIMEOUT_MS = Number(process.env.PANE_MCP_TIMEOUT_MS ?? "10000");
 
+// R650 — the agent's AgentRadar skills (bundled + linked) are written into its CLI's skills directory on this
+// cadence. Only directories this feeder created (they carry MANAGED_MARK) are ever replaced or removed; a
+// skill the vendor put there by hand is left alone. 0 disables.
+/** Claude reads `$AR_BASE/.claude/skills`; Codex reads `$CODEX_HOME/skills`, the per-agent home the supervisor requires. */
+export function skillsDirFor(harness, env) {
+  if (harness === "codex") return env.CODEX_HOME ? join(env.CODEX_HOME, "skills") : null;
+  return env.AR_BASE ? join(env.AR_BASE, ".claude", "skills") : null;
+}
+const SKILLS_DIR = skillsDirFor(AR_AGENT_HARNESS, process.env);
+const SKILLS_SYNC_INTERVAL_MS = Number(process.env.SKILLS_SYNC_INTERVAL_MS ?? "600000");
+const MANAGED_MARK = ".agentradar-managed";
+
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
@@ -195,8 +223,10 @@ function toolJson(result) {
   const text = result?.content?.find((c) => c.type === "text")?.text;
   return text ? JSON.parse(text) : {};
 }
+const runnerSessionId = randomUUID();
 async function nextEvent(ackEventIds, runnerState) {
   const args = {
+    sessionId: runnerSessionId,
     ...(ackEventIds && ackEventIds.length ? { ackEventIds } : {}),
     ...(runnerState ? { runnerState } : {}),
   };
@@ -208,11 +238,16 @@ async function nextEvent(ackEventIds, runnerState) {
 // Work readiness — process liveness is not enough. A live Claude process can
 // be blocked on subscription OAuth, where injected work is consumed as the OAuth code.
 // --------------------------------------------------------------------------
-export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
+function authProbeEnv(extraNames = []) {
   const env = {};
-  for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", "CLAUDE_CONFIG_DIR"]) {
+  for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", ...extraNames]) {
     if (typeof process.env[name] === "string") env[name] = process.env[name];
   }
+  return env;
+}
+
+export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
+  const env = authProbeEnv(["CLAUDE_CONFIG_DIR"]);
   if (AR_OAUTH_TOKEN_FILE) {
     try {
       env.CLAUDE_CODE_OAUTH_TOKEN = readFile(AR_OAUTH_TOKEN_FILE, "utf8").trim();
@@ -220,7 +255,7 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
       return "unknown";
     }
   }
-  const r = run(CLAUDE_BIN, ["auth", "status", "--json"], { encoding: "utf8", env, timeout: 10000 });
+  const r = run(AGENT_BIN, ["auth", "status", "--json"], { encoding: "utf8", env, timeout: 10000 });
   if (typeof r.stdout !== "string") return "unknown";
   try {
     return JSON.parse(r.stdout).loggedIn === true ? "authenticated" : "unauthenticated";
@@ -229,7 +264,31 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
   }
 }
 
-export function runnerState(auth = claudeAuthState, sample = capturePane) {
+/**
+ * Codex has no `auth status --json`. Its login probe is `codex login status`, which EXITS 0 when logged in
+ * and 1 when not, and prints "Logged in using ChatGPT" / "Not logged in" (measured, codex-cli 0.149.1).
+ *
+ * The exit code is the signal and the text is only a cross-check, not the other way round: a future build
+ * that reworded the line would still exit correctly, whereas reading the words alone would silently start
+ * returning "unknown" and park the runner in `starting` forever. A code we do not recognise stays "unknown"
+ * rather than becoming "unauthenticated", because `auth_required` is a claim the vendor is asked to act on.
+ *
+ * CODEX_HOME crosses into the probe because it IS the agent's credential home — probing the default
+ * ~/.codex would answer about a different login than the one the pane runs on.
+ */
+export function codexAuthState(run = spawnSync) {
+  const r = run(AGENT_BIN, ["login", "status"], { encoding: "utf8", env: authProbeEnv(["CODEX_HOME"]), timeout: 10000 });
+  if (r.status === 0) return "authenticated";
+  if (r.status === 1) return "unauthenticated";
+  return "unknown";
+}
+
+/** The login probe for whichever CLI this runner drives. */
+export function agentAuthState() {
+  return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
+}
+
+export function runnerState(auth = agentAuthState, sample = capturePane) {
   const authState = auth();
   if (authState === "unauthenticated") return "auth_required";
   if (authState !== "authenticated") return "starting";
@@ -392,7 +451,11 @@ export function stripVolatilePaneLines(text) {
   return String(text ?? "")
     .split("\n")
     .filter((line) => {
-      // the mid-turn interrupt hint (often carries the ticking counter)
+      // The mid-turn interrupt hint (often carries the ticking counter). This first matcher is also what
+      // covers CODEX: its whole working line is "• Working (1s • esc to interrupt)" (measured, codex-cli
+      // 0.149.1), counter included, so it is stripped entire and the Claude-specific spinner matchers below
+      // are simply inert on a Codex pane. No speculative Codex pattern is added here — an unmeasured
+      // matcher would look like coverage while stabilising nothing.
       if (/\besc to (?:interrupt|cancel)\b/i.test(line)) return false;
       // claude's spinner line, TWO observed forms — a leading animated glyph + a SINGLE gerund word +
       // the elapsed counter. Tightly anchored (one word before the counter) so real transcript prose
@@ -421,8 +484,38 @@ export function stripVolatilePaneLines(text) {
     .join("\n");
 }
 
-export function paneInputReady(text) {
-  return /bypass permissions on\b|^\s*❯/im.test(String(text ?? "").split("\n").slice(-12).join("\n"));
+/**
+ * The durable "this pane can take a turn" marker, which is the one pane signal that genuinely differs
+ * between the two CLIs. Claude Code shows its bypass-permissions footer or the `❯` prompt; Codex shows its
+ * idle composer placeholder `Ask Codex to do anything` (measured, codex-cli 0.149.1).
+ *
+ * ponytail: both markers vanish while a modal owns the screen — Claude's login prompt, Codex's trust or
+ * rate-limit dialog — which is the behaviour we want, since a pane blocked on a dialog cannot take work.
+ * Both also vanish once a human has typed into the composer without submitting; on an unattended runner
+ * nothing types there except `send-keys`, which submits immediately. Narrow the marker only if a real pane
+ * is observed to defeat it.
+ */
+export function paneInputReady(text, harness = AR_AGENT_HARNESS) {
+  const tail = String(text ?? "").split("\n").slice(-12).join("\n");
+  return harness === "codex"
+    ? /Ask Codex to do anything/i.test(tail)
+    : /bypass permissions on\b|^\s*❯/im.test(tail);
+}
+
+/**
+ * Why a Claude Code session refused to register its channels, read off the banner it prints — or null.
+ * Keyed by the CLI's own skip `kind`. The `auth` banner comes from builds before 2.1.281, which has no auth
+ * gate. See docs/claude-code-channels-gates.md.
+ */
+const CHANNEL_BANNERS = [
+  [/Channels are not currently available/, "disabled", "tengu_harbor is off: unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, set CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1, seed or fetch the flag cache, restart the session"],
+  [/Channels require claude\.ai authentication/, "auth", "no claude.ai login: run /login in the session, then restart it"],
+  [/Channels are not enabled for your org/, "policy", "org managed settings block channels: an admin must set channelsEnabled: true"],
+  [/Channels are not available on (?:Bedrock|third-party)/, "provider", "a Bedrock/Vertex/Foundry provider is selected: channels need the first-party API"],
+];
+export function classifyChannelBanner(text) {
+  const hit = CHANNEL_BANNERS.find(([re]) => re.test(String(text ?? "")));
+  return hit ? { kind: hit[1], action: hit[2] } : null;
 }
 
 function capturePane() {
@@ -440,14 +533,17 @@ function capturePane() {
   // Fingerprint the TRANSCRIPT BODY only — strip the client-side-ticking spinner/counter so a mid-turn
   // API hang (LLM dead, counter still ticking) yields a STABLE hash → stagnation is detectable (§4).
   const hash = createHash("sha256").update(stripVolatilePaneLines(text)).digest("hex").slice(0, 32);
-  // claude's TUI shows a working line ("… esc to interrupt") while mid-turn. This is only a HINT that
-  // triggers a probe on stagnation — it never decides liveness, so a missed/extra hint is harmless.
+  // Both TUIs show a working line ("… esc to interrupt") while mid-turn — Codex's reads
+  // "• Working (1s • esc to interrupt)", measured on codex-cli 0.149.1, so this matcher needs no harness
+  // branch. This is only a HINT that triggers a probe on stagnation — it never decides liveness, so a
+  // missed/extra hint is harmless.
   const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
-  // Claude's idle input prompt is the durable readiness signal. The optional bypass-permissions footer
-  // disappeared from a live Claude build after several turns, which falsely demoted a healthy pane to
-  // `starting` and stopped next_event from draining until its heartbeat aged stale.
+  // The CLI's idle input prompt is the durable readiness signal, and it is the one pane signal that differs
+  // per harness (see paneInputReady). The optional bypass-permissions footer disappeared from a live Claude
+  // build after several turns, which falsely demoted a healthy pane to `starting` and stopped next_event
+  // from draining until its heartbeat aged stale.
   const inputReady = paneInputReady(text);
-  return { hash, inProgress, inputReady };
+  return { hash, inProgress, inputReady, channelGate: classifyChannelBanner(text) };
 }
 /**
  * #173b (disc obs) — format-drift detector. If the STRIPPED fingerprint keeps CHANGING while the pane
@@ -461,6 +557,7 @@ export function looksLikeStripMiss(prev, cur) {
   return Boolean(prev && cur && prev.inProgress && cur.inProgress && prev.hash !== cur.hash);
 }
 let _lastPaneSample = null;
+let _lastChannelGate = null;
 let _paneReportCount = 0;
 async function reportPane() {
   // #156 diagnostics: log EVERY outcome (skip / ok+latency / error) under DEBUG_PANE with a monotonic
@@ -483,6 +580,10 @@ async function reportPane() {
       );
     }
     _lastPaneSample = p;
+    // ponytail: a hint, not a detector — the banner shows for ~12 s and this samples every 45 s, so most
+    // refusals pass unseen. The durable record is `--debug-file`'s "Channel notifications skipped:" line.
+    if (p.channelGate && p.channelGate.kind !== _lastChannelGate) console.warn(`[feeder] channels not registered (${p.channelGate.kind}): ${p.channelGate.action}`);
+    _lastChannelGate = p.channelGate?.kind ?? null;
     // #156: isolated connection (NOT the shared long-poll socket) so pane sampling never stalls behind
     // the receive long-poll's ALB-killed socket.
     await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress } });
@@ -497,6 +598,71 @@ async function reportPane() {
   }
 }
 
+// --------------------------------------------------------------------------
+// R650 skill sync. The server's answer is untrusted input to this box's filesystem: names and paths are
+// checked before anything is written, and every write lands inside a fresh directory under skillsDir.
+// --------------------------------------------------------------------------
+const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
+const isManaged = (dir) => {
+  const st = fs.lstatSync(dir, { throwIfNoEntry: false });
+  return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
+};
+
+export function writeManagedSkills(skillsDir, skills) {
+  fs.mkdirSync(skillsDir, { recursive: true });
+  const written = new Set();
+  for (const skill of skills) {
+    const name = String(skill?.name ?? "");
+    const target = join(skillsDir, name);
+    if (!SKILL_NAME.test(name)) { console.warn(`[feeder] skill sync: bad name ${JSON.stringify(name)} skipped`); continue; }
+    if (fs.lstatSync(target, { throwIfNoEntry: false }) && !isManaged(target)) {
+      console.warn(`[feeder] skill sync: ${name} is not ours, left alone`);
+      continue;
+    }
+    const files = Array.isArray(skill.files) ? skill.files : [];
+    const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+      || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
+    if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+    try {
+      fs.rmSync(staging, { recursive: true, force: true });
+      for (const f of files) {
+        fs.mkdirSync(dirname(join(staging, f.path)), { recursive: true });
+        fs.writeFileSync(join(staging, f.path), f.content);
+      }
+      fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+      fs.rmSync(target, { recursive: true, force: true });
+      fs.renameSync(staging, target);
+      written.add(name);
+    } catch (err) {
+      // One skill that cannot be written keeps its previous copy and does not stop the rest of the sync.
+      fs.rmSync(staging, { recursive: true, force: true });
+      if (isManaged(target)) written.add(name);
+      console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  // An unlinked skill leaves: every directory we wrote earlier and the server no longer lists.
+  for (const entry of fs.readdirSync(skillsDir)) {
+    if (!written.has(entry) && isManaged(join(skillsDir, entry))) fs.rmSync(join(skillsDir, entry), { recursive: true, force: true });
+  }
+  return [...written];
+}
+
+async function syncSkills() {
+  try {
+    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: {} }));
+    // A refusal or an older server keeps whatever this box already has.
+    if (!answer.ok || !Array.isArray(answer.skills)) {
+      console.warn(`[feeder] skill sync: server answered ${answer.error ?? "without skills"}; keeping current copies`);
+      return;
+    }
+    const written = writeManagedSkills(SKILLS_DIR, answer.skills);
+    console.log(`[feeder] skill sync: ${written.length} skill(s) in ${SKILLS_DIR}`);
+  } catch (err) {
+    console.warn(`[feeder] skill sync failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 // --------------------------------------------------------------------------
 // The loop: initialize → poll next_event → inject each into the live pane → ack the
 // delivered ones on the NEXT poll → self-heal on transient MCP errors (runner shape).
@@ -566,6 +732,10 @@ async function loop() {
     _paneTimer = setInterval(() => { void reportPane(); }, REPORT_PANE_INTERVAL_MS);
     _paneTimer.unref?.();
   }
+  if (SKILLS_DIR && SKILLS_SYNC_INTERVAL_MS > 0) {
+    void syncSkills();
+    setInterval(() => { void syncSkills(); }, SKILLS_SYNC_INTERVAL_MS).unref?.();
+  }
   while (!_stopping) {
     try {
       await pollOnce();

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -7,10 +7,11 @@
 # all env params). It idempotently ensures BOTH halves of an always-on agent are
 # up, then blocks so KeepAlive/Restart revives the whole thing on any death:
 #
-#   1. a tmux session ($TMUX_SESSION) running the agent:
+#   1. a tmux session ($TMUX_SESSION) running the agent CLI named by $AR_AGENT_HARNESS:
 #        claude --continue $CLAUDE_EXTRA_FLAGS --strict-mcp-config --mcp-config=$MCP_CONFIG
-#      in $AR_BASE, with a SCRUBBED allowlist env + the macOS user's normal
-#      Keychain-backed Claude session. Strict MCP flags allow ONLY AgentRadar's config;
+#        codex resume --last $CODEX_EXTRA_FLAGS --cd $AR_BASE   (MCP confined by $CODEX_HOME)
+#      in $AR_BASE, with a SCRUBBED allowlist env + the CLI's own persisted login.
+#      Strict MCP flags (Claude) / a per-agent CODEX_HOME (Codex) allow ONLY AgentRadar's config;
 #   2. the feeder ($FEEDER_JS) OUTSIDE that session, holding $AWP_BEARER, long-
 #      polling next_event and tmux-injecting each event into the pane.
 #
@@ -20,7 +21,8 @@
 # starts it on boot → same. Composes with the stateless AWP MCP (#111/#112:
 # reconnect, no -32001) + `claude --continue` (context resumes) = hands-free revive.
 #
-# HARD RULE: claude.ai OAuth ONLY. Refuses to start if ANTHROPIC_API_KEY is set.
+# HARD RULE (claude harness): claude.ai OAuth ONLY. Refuses to start if
+# ANTHROPIC_API_KEY is set. Codex authenticates only through $CODEX_HOME/auth.json.
 # =============================================================================
 set -euo pipefail
 
@@ -51,7 +53,6 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-: "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
 FEEDER_JS="${FEEDER_JS:-$(cd "$(dirname "$0")/.." && pwd)/feeder.mjs}"
 PANE_LIVE_SH="${PANE_LIVE_SH:-$(cd "$(dirname "$0")/.." && pwd)/pane-live.sh}"
@@ -68,11 +69,56 @@ BROWSER_APP="${BROWSER_APP:-Google Chrome}"          # #150: app to ensure-up fo
 BROWSER_READY_MAX_SEC="${BROWSER_READY_MAX_SEC:-20}" # #150: bounded wait for the browser proc on cold boot
 BROWSER_READY_SETTLE_SEC="${BROWSER_READY_SETTLE_SEC:-3}" # #150: settle for extension/native-host after cold launch
 HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
-# Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
-# differs by directory), NOT the basename: on a multi-agent box every agent's config is named
-# `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
-# death (silent death — the exact failure #145 kills). Override per agent for extra scoping if needed.
-AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-mcp-config.*${MCP_CONFIG}}"
+
+# --- 2a. R004 HARNESS SELECTION — one documented variable picks the CLI ---------
+# The Bible names two agent harnesses: Claude Code and Codex. `claude` is the default, so every existing
+# agent env file keeps launching exactly what it launched before. Anything that is neither is REFUSED by
+# name: a supervisor that quietly fell back to Claude for an unrecognized value would come up healthy,
+# keep a pane alive, and answer nothing the vendor expected.
+AR_AGENT_HARNESS="${AR_AGENT_HARNESS:-claude}"
+case "${AR_AGENT_HARNESS}" in
+  claude|codex) : ;;
+  *) die "AR_AGENT_HARNESS must be 'claude' or 'codex' (got '${AR_AGENT_HARNESS}')" ;;
+esac
+
+# What actually differs between the two CLIs, measured against `claude` and codex-cli 0.149.1:
+#   the binary, the resume argument, how connectors are confined, and the argv the pane can be found by.
+# Everything else below — the env -i allowlist, the 0600 bearer file, the feeder, the bridge, the recovery
+# loop — is shared, because nothing about it is harness-specific.
+if [ "${AR_AGENT_HARNESS}" = "codex" ]; then
+  AGENT_BIN="${CODEX_BIN:-codex}"
+  # `codex resume --last` continues the most recent recorded session and exits non-zero when there is none,
+  # so the launch falls back to a fresh `codex` exactly as the Claude path falls back from `--continue`.
+  AR_RESUME_FLAGS="resume --last"
+  # 🔴 CODEX HAS NO `--strict-mcp-config`. Its MCP servers are read from $CODEX_HOME/config.toml, so
+  # CODEX_HOME *is* the connector-isolation boundary rather than a convenience, and it is REQUIRED. Point it
+  # at a per-agent home whose config.toml declares the AgentRadar MCP and nothing else. Failing closed here
+  # is the point: letting it default to the vendor's own ~/.codex would hand the client's agent every MCP
+  # server that vendor has ever configured — exactly the exposure `--strict-mcp-config` closes on the Claude
+  # path, and it would present as a working agent.
+  [ -n "${CODEX_HOME:-}" ] || die "AR_AGENT_HARNESS=codex requires CODEX_HOME — a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server"
+  [ -d "${CODEX_HOME}" ] || die "CODEX_HOME not found: ${CODEX_HOME}"
+  CODEX_EXTRA_FLAGS="${CODEX_EXTRA_FLAGS:-}"
+  # shellcheck disable=SC2086  # CODEX_EXTRA_FLAGS is intentionally unquoted so it word-splits into flags.
+  _launch_flags=( ${CODEX_EXTRA_FLAGS} --cd "${AR_BASE}" )
+  # Pane-alive predicate — MUST be unique per agent. `--cd <AR_BASE>` is the per-agent argv token on this
+  # harness (CODEX_HOME is an env var, invisible to `ps -o command=`), so it plays the role the full
+  # mcp-config path plays for Claude: a pattern that cannot match another agent's live process.
+  _agent_pid_pattern_default="${AGENT_BIN}.*--cd ${AR_BASE}"
+else
+  AGENT_BIN="${CLAUDE_BIN}"
+  AR_RESUME_FLAGS="--continue"
+  : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
+  # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
+  # shellcheck disable=SC2086
+  _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
+  # differs by directory), NOT the basename: on a multi-agent box every agent's config is named
+  # `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
+  # death (silent death — the exact failure #145 kills). Override per agent for extra scoping if needed.
+  _agent_pid_pattern_default="mcp-config.*${MCP_CONFIG}"
+fi
+AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-${_agent_pid_pattern_default}}"
 
 # Optional per-agent TOOL credentials — a vendor brain's OWN MCP-tool API keys (e.g. an SEO agent's
 # WEBFLOW_TOKEN / PERPLEXITY_API_KEY). These are ADDED to the scrubbed launch env so the agent's own
@@ -97,7 +143,7 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
     # identity). Reject at parse time (visible warning) AND — belt-and-suspenders — the launch lists
     # the reserved allowlist AFTER TOOL_ENV_ARGS so `env` last-wins keeps reserved vars authoritative.
     case "${_tline%%=*}" in
-      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
+      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
         log "WARN ignoring reserved key '${_tline%%=*}' in ${AGENT_TOOL_ENV_FILE} (cannot override supervisor/agent env)"; continue ;;
     esac
     TOOL_ENV_ARGS+=("${_tline}")
@@ -110,11 +156,18 @@ fi
 # env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
 unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
 
-# HARD RULE — OAuth only, never a pay-as-you-go API key.
-[ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
+# HARD RULE — OAuth only, never a pay-as-you-go API key. Scoped to the Claude harness because that is where
+# the variable decides anything: `claude` prefers ANTHROPIC_API_KEY over the subscription session, so its
+# mere presence changes who pays. `codex` (>= 0.122) ignores OPENAI_API_KEY entirely and reads credentials
+# only from $CODEX_HOME/auth.json, so there is no equivalent env var to refuse — a Codex vendor chooses
+# subscription or API-key billing by how that home was logged in, and a refusal here would guard nothing
+# while blocking boxes that carry the variable for unrelated work.
+if [ "${AR_AGENT_HARNESS}" = "claude" ]; then
+  [ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
+fi
 
 command -v "${TMUX_BIN}" >/dev/null 2>&1 || die "tmux not found (${TMUX_BIN})"
-command -v "${CLAUDE_BIN}" >/dev/null 2>&1 || die "claude CLI not found (${CLAUDE_BIN})"
+command -v "${AGENT_BIN}" >/dev/null 2>&1 || die "${AR_AGENT_HARNESS} CLI not found (${AGENT_BIN})"
 [ -f "${FEEDER_JS}" ] || die "feeder not found: ${FEEDER_JS}"
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
@@ -210,17 +263,18 @@ ensure_agent() {
   # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
-  log "starting agent in tmux '${TMUX_SESSION}' (flags: ${CLAUDE_EXTRA_FLAGS:-none}; tool-env file: ${_TOOL_ENV_FILE:-none})"
-  # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
+  log "starting agent (${AR_AGENT_HARNESS}) in tmux '${TMUX_SESSION}' (tool-env file: ${_TOOL_ENV_FILE:-none})"
   # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
   # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
-  # crash-loops. So try `--continue`, and FALL BACK to a fresh `claude` (which stays up AND creates the
-  # session) when there's nothing to resume. Self-healing: once a conversation exists, --continue resumes it;
+  # crash-loops. So try the resume form, and FALL BACK to a fresh session (which stays up AND creates the
+  # session) when there's nothing to resume. Self-healing: once a conversation exists, resume picks it up;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
-  # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
-  # shellcheck disable=SC2086
-  _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # verified — so the `||` fallback is reliable, and `codex resume --last` behaves the same way.)
+  # R004: the resume argument is the ONE harness-specific token inside the wrapper, so it arrives as
+  # AR_RESUME_FLAGS ("--continue" or "resume --last") and is word-split there — the same idiom this launch
+  # already uses for the extra flags. The wrapper copies it to a local and unsets it before exec so it does
+  # not linger in the agent's environment.
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
@@ -239,6 +293,10 @@ ensure_agent() {
   # visible once there is colour to look at. LC_ALL stays empty on purpose: an empty LC_ALL does not
   # override, so LC_CTYPE governs and a vendor can still set LANG per agent.
   #
+  # Channels: CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 keeps the tengu_harbor flag readable from the
+  # disk cache even if telemetry is off, and it and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC are reserved so a
+  # tool file cannot turn channels off. See docs/claude-code-channels-gates.md.
+  #
   # 🔴 This comment block lives ABOVE the command, not inside it. A `#` comment between two
   # `\`-continued lines TERMINATES the command at its unescaped newline: tmux would receive only the
   # args up to SHELL=…, the pane would start with no `claude` at all, and the `TERM=… claude` tail
@@ -251,9 +309,10 @@ ensure_agent() {
       TERM="${AR_AGENT_TERM:-tmux-256color}" COLORTERM="${AR_AGENT_COLORTERM:-truecolor}" \
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
-      DISABLE_AUTOUPDATER=1 \
+      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${AR_RESUME_FLAGS}" \
+      DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
       ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; unset AR_RESUME_FLAGS; CB="$1"; shift; "$CB" $RF "$@" || exec "$CB" "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -282,7 +341,8 @@ log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
 # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
 # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
 AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" node "${FEEDER_JS}" &
+  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
+  node "${FEEDER_JS}" &
 FEEDER_PID=$!
 log "feeder pid ${FEEDER_PID}"
 
@@ -316,7 +376,7 @@ while true; do
     exit 1
   fi
   if ! pane_alive; then
-    log "agent claude pane died — recovering it in place"
+    log "agent pane died — recovering it in place"
     if ensure_agent; then
       if [ -n "${BRIDGE_PID}" ]; then
         kill "${BRIDGE_PID}" 2>/dev/null || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {
@@ -10,7 +10,9 @@
     "dist/index.js",
     "dist/setup.js",
     "dist/runner.js",
+    "dist/channel.js",
     "dist/skill-install.js",
+    "dist/tool-run.js",
     "dist/sync.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",