agentradar-cli 0.1.9 → 0.2.1

package/dist/runner.js

@@ -1,17 +1,443 @@
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { mkdir, readdir, readFile, realpath, rename, rm, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-export async function startVendorRunner(runnerId, home = homedir()) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId)) {
+import { promisify } from "node:util";
+import { shellValue, trustedMcpEndpoint, writePrivateFile } from "./setup.js";
+import { callAwpTool, envValue } from "./tool-run.js";
+const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const ENGAGEMENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// Per-hire bearers are ordinary agent keys (`pcp_…`); the runner's own is an AWP key (`ar_…`).
+const HIRE_BEARER = /^(ar|pcp)_[A-Za-z0-9_-]+$/;
+// What a hire's env file sets for itself; the catalog agent's values for these never reach it.
+// A hire always runs Claude, whose MCP config it owns; a Codex home would be the catalog agent's.
+const HIRE_OWN_KEYS = /^(export\s+)?(AGENT_NAME|AR_BASE|AWP_MCP_URL|AWP_BEARER|AWP_BEARER_FILE|MCP_CONFIG|TMUX_SESSION|AGENT_PID_PATTERN|AR_AGENT_HARNESS|CODEX_HOME)=/;
+const CODEX_HARNESS = /^(export\s+)?AR_AGENT_HARNESS=\s*["']?codex\b/m;
+const run = promisify(execFile);
+/** Run from outside the target harness: the command deliberately replaces that harness process. */
+export async function runRestartSelftest(runnerId, deps = {}) {
+    const call = deps.call ?? (async (args) => {
+        let value = {};
+        let failure = "Self-test request failed";
+        const code = await callAwpTool(runnerId, "run_selftest", args, {
+            home: deps.home, log: (text) => { value = JSON.parse(text); }, logError: (text) => { failure = text; },
+        });
+        if (code || value.ok === false)
+            throw new Error(typeof value.error === "string" ? value.error : failure);
+        return value;
+    });
+    const wait = async (args, done, timedOut = "Self-test timed out; persistence is not proven.") => {
+        const deadline = Date.now() + (deps.waitMs ?? 120_000);
+        do {
+            const value = await call(args);
+            if (done(value))
+                return value;
+            await new Promise((resolve) => setTimeout(resolve, 500));
+        } while (Date.now() < deadline);
+        throw new Error(timedOut);
+    };
+    const unanswered = `The agent did not act on the check: it is not polling next_event and no channel push reached it. Have it poll (agentradar run ${runnerId} next_event), then run this again.`;
+    const restart = deps.restart ?? ((beforeRestart) => restartRunnerHarness(runnerId, deps.home, run, beforeRestart));
+    // Refuse before the drill starts: run every restart check, stopping exactly where the real restart would begin.
+    const checked = new Error("restart checks passed");
+    await restart(async () => { throw checked; }).catch((error) => { if (error !== checked)
+        throw error; });
+    await call({});
+    await wait({ statusOnly: true }, (value) => value.state === "answered", unanswered);
+    const prepared = await call({ persistence: "prepare" });
+    if (typeof prepared.runId !== "string")
+        throw new Error("Self-test returned no run ID.");
+    const runId = prepared.runId;
+    await wait({ persistence: "status", runId }, (value) => value.markerReceived === true && value.markerStored === true);
+    // Persist the recall event before replacement, then release it only after observing the new process.
+    // The server does not certify caller-supplied PIDs; the outside CLI owns that local measurement.
+    const process = await restart(async () => { await call({ persistence: "recall", runId }); });
+    if (process.previousPid === process.currentPid)
+        throw new Error("The harness process did not change.");
+    const afterRestart = await call({ persistence: "status", runId });
+    const restartedAt = Date.parse(String(afterRestart.observedAt));
+    if (!Number.isFinite(restartedAt))
+        throw new Error("No server timestamp for harness replacement.");
+    await call({});
+    await wait({ statusOnly: true }, (value) => value.state === "answered", unanswered);
+    await call({ persistence: "resume", runId });
+    const result = await wait({ persistence: "status", runId }, (value) => value.state === "recalled");
+    if (Date.parse(String(result.recallAnsweredAt)) < restartedAt || Date.parse(String(result.recallReceivedAt)) < restartedAt
+        || !Number.isFinite(Date.parse(String(result.recallAnsweredAt))) || !Number.isFinite(Date.parse(String(result.recallReceivedAt)))
+        || result.selftestEventsReceived !== 2 || JSON.stringify(result.selftestReplyCounts) !== "[1,1]") {
+        throw new Error("Self-test did not prove both events survived with one reply each after harness replacement.");
+    }
+    (deps.log ?? console.log)(JSON.stringify({ ...result, ...process, harnessRestart: "passed", machineRestart: "not measured" }));
+}
+/** Restart only the named runner's owned pane, not its feeder or a user's native channel session. */
+export async function restartRunnerHarness(runnerId, home = homedir(), execute = run, beforeRestart) {
+    if (!RUNNER_ID.test(runnerId))
         throw new Error("Invalid runner ID");
+    const contents = await readFile(join(home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
+    const session = envValue(contents, "TMUX_SESSION") ?? runnerId;
+    const base = envValue(contents, "AR_BASE");
+    const config = envValue(contents, "MCP_CONFIG");
+    const harness = envValue(contents, "AR_AGENT_HARNESS") ?? "claude";
+    // JOIN.md's default install writes no MCP_CONFIG: its Claude hosts `agentradar channel` instead.
+    if (!config && harness === "claude")
+        return restartChannelSession(runnerId, execute, beforeRestart);
+    // What the supervisor launches per harness: the resume flags its pane carries, the per-agent value in
+    // that pane command, the per-agent argv token, and the executable (Codex's npm wrapper is `node`).
+    const codexHome = envValue(contents, "CODEX_HOME");
+    const owned = harness === "codex"
+        ? { resume: `AR_RESUME_FLAGS=${envValue(contents, "AR_RESUME_FLAGS") ?? "resume --last"}`, token: codexHome && `CODEX_HOME=${codexHome}`, argv: (args) => args.endsWith(` --cd ${base}`), bin: /(^|\/)codex$/ }
+        : harness === "claude" ? { resume: `AR_RESUME_FLAGS=${envValue(contents, "AR_RESUME_FLAGS") ?? "--continue"}`, token: config, argv: (args) => args.includes(`--mcp-config=${config}`), bin: /(^|\/)claude$/ }
+            : null;
+    if (!/^_?[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/.test(session) || !base || !owned?.token) {
+        throw new Error("Restart self-test requires an installed Claude or Codex runner with its own tmux pane.");
+    }
+    const tmux = envValue(contents, "TMUX_BIN") ?? "tmux";
+    const { stdout } = await execute(tmux, ["list-panes", "-s", "-t", `=${session}`, "-F", "#{pane_id}\t#{pane_pid}\t#{pane_start_path}\t#{pane_start_command}"]);
+    const panes = stdout.trim().split("\n");
+    if (panes.length !== 1)
+        throw new Error("Restart refused: the runner must own exactly one pane.");
+    const [pane, root, cwd, command] = panes[0].split("\t");
+    if (!pane || !/^%\d+$/.test(pane) || !root || !/^\d+$/.test(root)
+        || !cwd || await realpath(cwd) !== await realpath(base)
+        || !command?.includes(owned.resume) || !command.includes(owned.token)) {
+        throw new Error("Restart refused: this pane is not the installed runner's resumable harness.");
+    }
+    const findHarness = async (rootPid) => {
+        const rows = await processRows(execute);
+        const descendants = new Set([rootPid]);
+        for (let depth = 0; depth < 8; depth++) {
+            for (const row of rows)
+                if (descendants.has(row.parent))
+                    descendants.add(row.pid);
+        }
+        if (descendants.has(process.pid))
+            throw new Error("Run --restart from a separate terminal, not from inside the target harness.");
+        const matches = [];
+        for (const row of rows) {
+            if (!descendants.has(row.pid) || row.uid !== process.getuid?.()
+                || !owned.argv(row.args))
+                continue;
+            // macOS truncates comm when another column follows it; read the executable on its own.
+            const executable = await execute("ps", ["-p", String(row.pid), "-o", "comm="]).then((result) => result.stdout.trim(), () => "");
+            if (owned.bin.test(executable))
+                matches.push(row.pid);
+        }
+        return matches.length === 1 ? matches[0] : null;
+    };
+    const previousPid = await findHarness(Number(root));
+    if (!previousPid)
+        throw new Error("Restart refused: no unique live Claude or Codex process belongs to the runner pane.");
+    // respawn-pane reuses the supervisor's scrubbed, resuming launch command. No shell reconstruction,
+    // no global process pattern, and no neighbouring session is stopped.
+    await beforeRestart?.();
+    await execute(tmux, ["respawn-pane", "-k", "-t", pane]);
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        const { stdout: currentRoot } = await execute(tmux, ["display-message", "-p", "-t", pane, "#{pane_pid}"]);
+        const currentPid = await findHarness(Number(currentRoot.trim()));
+        const oldAlive = await execute("ps", ["-p", String(previousPid), "-o", "pid="]).then(() => true, () => false);
+        if (!oldAlive && currentPid && currentPid !== previousPid)
+            return { previousPid, currentPid };
+        await new Promise((resolve) => setTimeout(resolve, 250));
+    }
+    throw new Error("Harness restart not confirmed within 30 seconds; persistence is not proven.");
+}
+const processRows = async (execute) => (await execute("ps", ["-axo", "pid=,ppid=,uid=,args="])).stdout.split("\n").flatMap((line) => {
+    const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/);
+    return match ? [{ pid: Number(match[1]), parent: Number(match[2]), uid: Number(match[3]), args: match[4] }] : [];
+});
+/**
+ * JOIN.md's default: the operator's interactive Claude hosts `agentradar channel <id>` as a stdio MCP.
+ * End that one session and resume it (--continue, same folder) in this terminal with this shell's
+ * environment, where the operator can accept the channel prompt. No runner, tmux or other session is touched.
+ */
+export async function restartChannelSession(runnerId, execute = run, beforeRestart, deps = {}) {
+    if (!RUNNER_ID.test(runnerId))
+        throw new Error("Invalid runner ID");
+    const rows = await processRows(execute);
+    const channel = new RegExp(`(^|[\\s/])agentradar channel ${runnerId}$`);
+    const hosts = new Set(rows.filter((row) => row.uid === process.getuid?.() && channel.test(row.args)).map((row) => row.parent));
+    if (hosts.size !== 1)
+        throw new Error("Restart refused: no single live session of yours runs this agent. Start it, then run this again from a separate terminal.");
+    const [previousPid] = [...hosts];
+    for (let pid = process.pid, depth = 0; pid > 1 && depth < 64; depth++) {
+        if (pid === previousPid)
+            throw new Error("Run --restart from a separate terminal, not from inside the target harness.");
+        pid = rows.find((row) => row.pid === pid)?.parent ?? 0;
+    }
+    const executable = await execute("ps", ["-p", String(previousPid), "-o", "comm="]).then((result) => result.stdout.trim(), () => "");
+    if (!/(^|\/)claude$/.test(executable))
+        throw new Error("Restart refused: the channel's host is not Claude Code.");
+    const cwd = process.platform === "linux" ? await realpath(`/proc/${previousPid}/cwd`).catch(() => "")
+        : (await execute("lsof", ["-a", "-p", String(previousPid), "-d", "cwd", "-Fn"]).catch(() => ({ stdout: "" })))
+            .stdout.split("\n").find((line) => line.startsWith("n/"))?.slice(1) ?? "";
+    if (!cwd)
+        throw new Error("Restart refused: the session's folder could not be read.");
+    const signal = deps.signal ?? ((pid, name) => { process.kill(pid, name); });
+    await beforeRestart?.();
+    signal(previousPid, "SIGTERM");
+    const alive = () => { try {
+        signal(previousPid, 0);
+        return true;
     }
+    catch {
+        return false;
+    } };
+    for (const deadline = Date.now() + 30_000; alive();) {
+        if (Date.now() > deadline)
+            throw new Error("The old session did not exit within 30 seconds; persistence is not proven.");
+        await new Promise((resolve) => setTimeout(resolve, 250));
+    }
+    const launch = deps.launch ?? ((command, args, folder) => new Promise((resolve, reject) => {
+        console.log("Resuming your agent's session in this terminal. Accept the channel prompt; the self-test result prints after you exit it.");
+        process.on("SIGINT", () => undefined); // Ctrl-C belongs to the resumed session, not to this CLI.
+        const child = spawn(command, args, { cwd: folder, stdio: "inherit" });
+        child.once("spawn", () => resolve(child.pid));
+        child.once("error", reject);
+    }));
+    return { previousPid, currentPid: await launch(executable, ["--continue", "--dangerously-load-development-channels", "server:agentradar"], cwd) };
+}
+/**
+ * `agentradar runner start` — the catalog agent's shared supervisor, plus one supervisor per hire.
+ *
+ * Ruling 50: a hire is its own agent row in the client's company with its own bearer, and one agent
+ * serving two clients is two separate runtimes. So each claimed hire gets its own env file, its own
+ * AWP-only MCP config, its own tmux session and its own folder (a `git clone` of the brain), and runs
+ * its own supervisor — the same one the shared bearer runs under, unchanged. The shared supervisor keeps
+ * serving every hire made before ruling 50, and it stays the runner's lifetime: when it exits,
+ * the hires are stopped and its code is returned, as before. A hire's supervisor exiting touches no other
+ * runtime. The shared bearer is never in a hire's env file or environment, so neither its supervisor
+ * nor its pane holds the key to the doors that hand out every client's bearer.
+ * ponytail: separate, not sandboxed — every hire runs as the vendor's user and can read its siblings'
+ * files, the shared env file included; a user or container per hire when a vendor needs that.
+ *
+ * Every tick claims new bearers, writes them, and acks what it wrote; then retires every hire whose
+ * bearer AgentRadar now refuses (the hire ended, or its key was revoked): its supervisor and tmux session
+ * stop and its env and bearer files go, while its folder stays, with the work. Then it launches each
+ * `<runnerId>--<engagementId>.env` that is not running — after a restart, and after a supervisor exits.
+ */
+export async function startVendorRunner(runnerId, home = homedir(), deps = {}) {
+    if (!RUNNER_ID.test(runnerId))
+        throw new Error("Invalid runner ID");
+    const log = deps.log ?? console.log;
     const envPath = join(home, ".agentradar", "agents", `${runnerId}.env`);
+    const agentDir = dirname(envPath);
     const supervisor = join(dirname(fileURLToPath(import.meta.url)), "vendor-runner", "supervisor", "supervise-agent.sh");
-    return new Promise((resolve, reject) => {
-        const child = spawn("bash", [supervisor, envPath], { stdio: "inherit", env: process.env });
-        child.once("error", reject);
-        child.once("exit", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+    const spawnChild = deps.spawn ?? ((command, args) => spawn(command, args, { stdio: "inherit", env: process.env }));
+    const hires = new Map();
+    let timer;
+    let stopped = false;
+    const runHire = (hireEnv) => {
+        if (stopped || hires.has(hireEnv))
+            return;
+        const child = spawnChild("bash", [supervisor, hireEnv]);
+        hires.set(hireEnv, child);
+        child.once("error", (error) => log(`Hire supervisor ${hireEnv} failed to start: ${error.message}`));
+        child.once("exit", (code) => {
+            hires.delete(hireEnv);
+            if (!stopped)
+                log(`Hire supervisor ${hireEnv} exited (${code ?? "signal"}); the next tick restarts it`);
+        });
+    };
+    // Checks the catalog agent can run hires at all, then returns the tick that launches and claims them.
+    const hireTick = async () => {
+        const shared = await readFile(envPath, "utf8");
+        const mcpUrl = trustedMcpEndpoint(envValue(shared, "AWP_MCP_URL") ?? "");
+        const bearer = envValue(shared, "AWP_BEARER");
+        const brain = envValue(shared, "AR_BASE");
+        if (!mcpUrl || !bearer || !brain)
+            throw new Error(`${envPath} lacks AWP_MCP_URL, AWP_BEARER or AR_BASE`);
+        // A Codex agent's MCP servers live in its CODEX_HOME, which a hire would share with the catalog agent,
+        // shared bearer included — so Codex vendors stay on the shared bearer until a hire can get its own home.
+        if (CODEX_HARNESS.test(shared))
+            throw new Error("Codex agents keep one shared bearer");
+        // An agent that joined an organisation is that organisation's own; it is never hired.
+        if (envValue(shared, "AR_CLI_RUNNER_ID"))
+            throw new Error("a joined agent has no hires");
+        // Each hire's folder is a clone of the brain; copying a plain folder would carry the other clients' work.
+        await run("git", ["-C", brain, "rev-parse", "--is-inside-work-tree"]).catch(() => {
+            throw new Error(`AR_BASE ${brain} is not a git repository, so each hire cannot get its own clone`);
+        });
+        const base = resolve(brain);
+        const prefix = `${runnerId}--`;
+        const folderOf = (engagementId) => `${base}--${engagementId}`;
+        // The server's REST API sits beside its MCP endpoint (`…/api/mcp` → `…/api/agent-hires/…`).
+        // Under launchd PATH is bare, so tmux is looked up where the supervisor looks for it.
+        const killSession = (name) => spawnChild("bash", [
+            "-c", 'PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"; exec "${TMUX_BIN:-tmux}" kill-session -t "$1"', "tmux", `=_${name}`,
+        ]).once("error", () => { });
+        const post = (path, body, token = bearer) => (deps.fetch ?? fetch)(new URL(path, mcpUrl), {
+            method: "POST",
+            headers: { authorization: `Bearer ${token}`, accept: "application/json", "content-type": "application/json", "cache-control": "no-store" },
+            body: JSON.stringify(body ?? {}),
+            signal: AbortSignal.timeout(30_000),
+        });
+        const launchAll = async () => {
+            for (const file of await readdir(agentDir)) {
+                const engagementId = file.startsWith(prefix) && file.endsWith(".env") ? file.slice(prefix.length, -".env".length) : "";
+                const hireEnv = join(agentDir, file);
+                if (!ENGAGEMENT_ID.test(engagementId) || hires.has(hireEnv) || stopped)
+                    continue;
+                try {
+                    const folder = folderOf(engagementId);
+                    if (!(await stat(folder).catch(() => null))) {
+                        // Cloned aside and renamed, so a runner killed mid-clone never leaves a half folder that runs.
+                        // Without `origin` a hire cannot push to or fetch from the brain the other runtimes share.
+                        const partial = `${folder}.partial`;
+                        await rm(partial, { recursive: true, force: true });
+                        await run("git", ["clone", "--quiet", "--", base, partial]);
+                        await run("git", ["-C", partial, "remote", "remove", "origin"]);
+                        await rename(partial, folder);
+                    }
+                    await copyProjectTrust(join(home, ".claude.json"), base, folder);
+                    runHire(hireEnv);
+                }
+                catch (error) {
+                    log(`Hire ${engagementId} could not start: ${error.message}`);
+                }
+            }
+        };
+        const claim = async () => {
+            const response = await post("agent-hires/bearers/claim");
+            if (!response.ok)
+                throw new Error(`claim refused (${response.status})`);
+            const { hires: claimed } = await response.json();
+            const written = [];
+            for (const hire of claimed) {
+                if (!ENGAGEMENT_ID.test(hire.engagementId) || !HIRE_BEARER.test(hire.bearer)) {
+                    log(`AgentRadar returned an invalid hire; skipped`);
+                    continue;
+                }
+                const name = `${prefix}${hire.engagementId}`;
+                try {
+                    const configDir = join(home, ".agentradar", "config", name);
+                    await mkdir(configDir, { recursive: true, mode: 0o700 });
+                    const mcpConfig = join(configDir, "awp-only.json");
+                    await writePrivateFile(mcpConfig, `${JSON.stringify({
+                        mcpServers: { agentradar: { type: "http", url: mcpUrl.toString(), headers: { Authorization: `Bearer ${hire.bearer}` } } },
+                    }, null, 2)}\n`);
+                    // Every setting the vendor put in the catalog agent's env (tool env, harness flags) is copied, as
+                    // read when the runner started, except the ones this hire sets for itself — the shared bearer among
+                    // them. Copied rather than sourced: sourcing would put the shared bearer in the hire's supervisor.
+                    // The hire's own values come first, so a copied `$AR_BASE` means the hire's folder, and again last,
+                    // so nothing copied can move them. With no AGENT_PID_PATTERN the supervisor derives it from MCP_CONFIG.
+                    // ponytail: line by line, so a multi-line quoted value is copied only in part; parse it when one appears.
+                    const own = [
+                        `AGENT_NAME=${shellValue(name)}`,
+                        `AR_BASE=${shellValue(folderOf(hire.engagementId))}`,
+                        `AWP_MCP_URL=${shellValue(mcpUrl.toString())}`,
+                        `AWP_BEARER=${shellValue(hire.bearer)}`,
+                        `MCP_CONFIG=${shellValue(mcpConfig)}`,
+                        `AR_AGENT_HARNESS='claude'`,
+                        // tmux resolves `-t name` by prefix when no session is named exactly that, so the shared
+                        // session `<runnerId>` must never be a prefix of a hire's. A runner ID cannot start with `_`.
+                        `TMUX_SESSION=${shellValue(`_${name}`)}`,
+                    ];
+                    const copied = shared.split("\n").filter((line) => line.trim() && !HIRE_OWN_KEYS.test(line.trimStart()) && !line.includes(bearer));
+                    await writePrivateFile(join(agentDir, `${name}.env`), [...own, ...copied, ...own, ""].join("\n"));
+                    written.push(hire.engagementId);
+                    log(`Hire ${hire.engagementId} claimed → ${name}`);
+                }
+                catch (error) {
+                    log(`Hire ${hire.engagementId} could not be written, claiming it again next tick: ${error.message}`);
+                }
+            }
+            // Acked only once on disk: until then the server hands the bearer out again.
+            if (written.length > 0) {
+                const ack = await post("agent-hires/bearers/ack", { engagementIds: written });
+                if (!ack.ok)
+                    throw new Error(`ack refused (${ack.status})`);
+            }
+        };
+        // Asks AgentRadar about each hire's bearer, with that bearer, at a door that changes nothing. Only a
+        // 401 retires a hire, only from the server that issued it, and only after the shared bearer's claim
+        // succeeded this tick, so a runner re-pointed or cut off never deletes a bearer it cannot vouch for.
+        const retireEnded = async () => {
+            for (const file of await readdir(agentDir)) {
+                const engagementId = file.startsWith(prefix) && file.endsWith(".env") ? file.slice(prefix.length, -".env".length) : "";
+                if (!ENGAGEMENT_ID.test(engagementId) || stopped)
+                    continue;
+                const name = `${prefix}${engagementId}`;
+                const hireEnv = join(agentDir, file);
+                const contents = await readFile(hireEnv, "utf8");
+                const hireBearer = envValue(contents, "AWP_BEARER");
+                if (!hireBearer || envValue(contents, "AWP_MCP_URL") !== mcpUrl.toString())
+                    continue;
+                if ((await post("agent-hires/bearers/claim", undefined, hireBearer)).status !== 401)
+                    continue;
+                await rm(hireEnv, { force: true });
+                await rm(join(home, ".agentradar", "config", name), { recursive: true, force: true });
+                await rm(join(home, ".agentradar", "run", name), { recursive: true, force: true });
+                // The session goes only once its supervisor has exited, or the supervisor would start it again.
+                // `=` makes tmux match the session name exactly, never by prefix.
+                const child = hires.get(hireEnv);
+                if (child) {
+                    child.once("exit", () => killSession(name));
+                    child.kill("SIGTERM");
+                }
+                else {
+                    killSession(name);
+                }
+                log(`Hire ${engagementId} ended or its key was revoked: stopped, bearer deleted, folder ${folderOf(engagementId)} kept`);
+            }
+        };
+        // Retiring runs before launching, so a hire that ended while the runner was down never starts;
+        // launching runs even when AgentRadar is unreachable, so the hires already written keep working.
+        return async () => {
+            try {
+                await claim();
+                await retireEnded();
+            }
+            catch (error) {
+                log(`Per-hire tick failed, retrying: ${error.message}`);
+            }
+            await launchAll().catch((error) => log(`Per-hire launch failed, retrying: ${error.message}`));
+        };
+    };
+    return new Promise((resolvePromise, reject) => {
+        const stop = () => {
+            stopped = true;
+            clearTimeout(timer);
+            for (const child of hires.values())
+                child.kill("SIGTERM");
+        };
+        const shared = spawnChild("bash", [supervisor, envPath]);
+        shared.once("error", (error) => { stop(); reject(error); });
+        shared.once("exit", (code, signal) => { stop(); resolvePromise(code ?? (signal ? 1 : 0)); });
+        hireTick()
+            .then((tick) => {
+            // The next tick is scheduled only after this one finishes, so a slow clone never overlaps another.
+            const loop = async () => {
+                await tick();
+                if (!stopped)
+                    timer = setTimeout(loop, deps.tickMs ?? 60_000);
+            };
+            return loop();
+        })
+            .catch((error) => log(`Per-hire runtimes are off: ${error.message}`));
     });
 }
+/**
+ * A hire's folder is new, so Claude Code would stop at its trust dialog with nobody at the pane. It is a
+ * clone of the brain the vendor already trusted, so that decision carries over — and only that one: a
+ * brain never trusted stays untrusted here too (see `installProjectMcp` in setup.ts on why trust is
+ * never inferred). The supervisor unsets CLAUDE_CONFIG_DIR, so Claude reads `~/.claude.json`.
+ * ponytail: read-modify-write while the catalog agent's Claude may also write this file; lock if it bites.
+ */
+async function copyProjectTrust(configPath, from, to) {
+    let config;
+    try {
+        config = JSON.parse(await readFile(configPath, "utf8"));
+    }
+    catch {
+        return;
+    }
+    const projects = config.projects;
+    const target = await realpath(to);
+    if (projects?.[await realpath(from)]?.hasTrustDialogAccepted !== true || projects[target]?.hasTrustDialogAccepted === true)
+        return;
+    projects[target] = { ...projects[target], hasTrustDialogAccepted: true };
+    await writePrivateFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}
 //# sourceMappingURL=runner.js.map