agentradar-cli 0.1.9 → 0.2.1

package/dist/setup.js

@@ -1,8 +1,27 @@
-import { chmod, lstat, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
-import { basename, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { chmod, cp, lstat, mkdir, readFile, realpath, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import * as tls from "node:tls";
+import { promisify } from "node:util";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
+/** `ar_` is a vendor runner bearer; `pcp_` is the key an organisation's own agent claims through `join`. */
+const BEARER_SHAPE = /^(?:ar|pcp)_[A-Za-z0-9_-]+$/;
+/**
+ * R004 — the server's harness id, in the words `supervise-agent.sh` accepts.
+ *
+ * Two vocabularies, deliberately: the server stores `claude_code` (its internal id, the key of
+ * `HARNESS_PROFILES`, and what lands in `adapterConfig.harness`), while the supervisor's
+ * `AR_AGENT_HARNESS` takes `claude`. Translating here rather than widening either side keeps the
+ * refusal in one place — the supervisor dies by name on an unrecognised value, and so does this.
+ */
+const SUPERVISOR_HARNESS = {
+    claude: "claude",
+    claude_code: "claude",
+    codex: "codex",
+};
 async function postJson(fetchImpl, url, body) {
     return fetchImpl(url, {
         method: "POST",
@@ -10,9 +29,35 @@ async function postJson(fetchImpl, url, body) {
         body: JSON.stringify(body),
     });
 }
+/**
+ * The server's own words for a refusal, when it sent any.
+ *
+ * 🔴 THE BODY WAS BEING THROWN AWAY ON THE FAILURE PATH, one function above the `console.error` that
+ * would have printed it. `POST /vendor/agent-setups` answers a configuration problem with
+ * `{ error: "vendor_setup_not_configured", message: "Vendor setup is unavailable until the public
+ * MCP and vendor portal URLs are configured." }` (`server/src/routes/vendor.ts`), and the vendor read
+ * `AgentRadar setup request failed (503)` — on the FIRST door they touch in the product.
+ *
+ * Reads `message` before `error` because this door sends both and only `message` is a sentence;
+ * elsewhere the servers' convention is a bare `{ error: <sentence> }`, so both are tried. A non-JSON
+ * body (an HTML error page from a proxy, an empty 502) throws in `json()` and falls back to the
+ * status line — which is why the parse is inside the try and not beside it.
+ */
+async function failureMessage(response) {
+    const line = `AgentRadar setup request failed (${response.status})`;
+    try {
+        const body = await response.json();
+        const said = [body?.message, body?.error]
+            .find((value) => typeof value === "string" && value.trim().length > 0);
+        return said ? `${line}: ${said.trim()}` : line;
+    }
+    catch {
+        return line;
+    }
+}
 async function responseJson(response) {
     if (!response.ok)
-        throw new Error(`AgentRadar setup request failed (${response.status})`);
+        throw new Error(await failureMessage(response));
     return response.json();
 }
 /**
@@ -59,7 +104,7 @@ export function claudeConfigPath(home, env = process.env) {
  *
  * Returns the resolved project path so the caller can name it in the trust guidance.
  */
-function trustedMcpEndpoint(value) {
+export function trustedMcpEndpoint(value) {
     const endpoint = new URL(value);
     const loopbackHttp = endpoint.protocol === "http:" && (endpoint.hostname === "localhost" ||
         endpoint.hostname === "127.0.0.1" ||
@@ -67,9 +112,10 @@ function trustedMcpEndpoint(value) {
         endpoint.hostname.endsWith(".localhost"));
     return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
 }
+/** `installation: null` (join) removes the project's `agentradar` entry: a joined agent acts through `agentradar run`. */
 async function installProjectMcp(configPath, cwd, installation, trust) {
-    const endpoint = trustedMcpEndpoint(installation.mcpEndpoint);
-    if (!endpoint || !/^ar_[A-Za-z0-9_-]+$/.test(installation.bearer)) {
+    const endpoint = installation && trustedMcpEndpoint(installation.mcpEndpoint);
+    if (installation && (!endpoint || !BEARER_SHAPE.test(installation.bearer))) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const projectPath = await realpath(cwd);
@@ -97,12 +143,17 @@ async function installProjectMcp(configPath, cwd, installation, trust) {
     const mcpServers = project.mcpServers && typeof project.mcpServers === "object" && !Array.isArray(project.mcpServers)
         ? project.mcpServers
         : {};
-    mcpServers.agentradar = {
-        type: "http",
-        url: endpoint.toString(),
-        headers: { Authorization: `Bearer ${installation.bearer}` },
-        timeout: 1_800_000,
-    };
+    if (installation && endpoint) {
+        mcpServers.agentradar = {
+            type: "http",
+            url: endpoint.toString(),
+            headers: { Authorization: `Bearer ${installation.bearer}` },
+            timeout: 1_800_000,
+        };
+    }
+    else {
+        delete mcpServers.agentradar;
+    }
     project.mcpServers = mcpServers;
     // SET only, never clear. A later plain `setup` must not revoke a decision an earlier `--trust`
     // run made — that would silently regress a re-onboarding vendor back into the launch prompt, and
@@ -117,10 +168,10 @@ async function installProjectMcp(configPath, cwd, installation, trust) {
     await chmod(configPath, 0o600);
     return projectPath;
 }
-function shellValue(value) {
+export function shellValue(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
-async function writePrivateFile(path, contents) {
+export async function writePrivateFile(path, contents) {
     try {
         if ((await lstat(path)).isSymbolicLink())
             throw new Error(`Refusing to replace a symlinked ${path}`);
@@ -134,12 +185,49 @@ async function writePrivateFile(path, contents) {
     await rename(tempPath, path);
     await chmod(path, 0o600);
 }
-async function installRunner(home, projectPath, approved) {
+/** The gateway env a session needs to reach its model. Never ANTHROPIC_API_KEY (OAuth or gateway only). */
+const TOOL_ENV = /^(?:ANTHROPIC_(?!API_KEY$)[A-Z0-9_]+|CLAUDE_SECURESTORAGE_CONFIG_DIR)$/;
+/**
+ * The service's Codex home: the vendor's config.toml without its MCP servers (the agent acts through the CLI,
+ * and Codex has no `--strict-mcp-config`), its approval rules copied, its login linked. auth.json is linked,
+ * never read. Returns the home and the env var names its model providers read their key from.
+ * ponytail: a Codex token refresh that rewrites auth.json by rename replaces the link; re-run join if it bites.
+ */
+async function codexServiceHome(home, runnerId, env) {
+    const source = env.CODEX_HOME?.trim() ? resolve(env.CODEX_HOME.trim()) : join(home, ".codex");
+    const codexHome = join(home, ".agentradar", "codex", runnerId);
+    await mkdir(codexHome, { recursive: true, mode: 0o700 });
+    await chmod(codexHome, 0o700);
+    let inMcp = false;
+    let inTable = false;
+    // A restart would otherwise stop on Codex's "Update available" screen, with nobody there to press a key.
+    const config = ["check_for_update_on_startup = false", ...(await readFile(join(source, "config.toml"), "utf8").catch(() => "")).split("\n").filter((line) => {
+            const header = /^\s*\[\[?\s*([^\]]+)\]/.exec(line);
+            if (header) {
+                inMcp = /^"?mcp_servers\b/.test(header[1]);
+                inTable = true;
+            }
+            return !inMcp && !/^\s*mcp_servers\s*[.=]/.test(line) && (inTable || !/^\s*check_for_update_on_startup\s*=/.test(line));
+        })].join("\n");
+    await writePrivateFile(join(codexHome, "config.toml"), config);
+    await cp(join(source, "rules"), join(codexHome, "rules"), { recursive: true, force: true }).catch((error) => {
+        if (error.code !== "ENOENT")
+            throw error;
+    });
+    if (await lstat(join(source, "auth.json")).then(() => true, () => false)) {
+        await symlink(join(source, "auth.json"), join(codexHome, "auth.json")).catch((error) => {
+            if (error.code !== "EEXIST")
+                throw error;
+        });
+    }
+    return { codexHome, keys: [...config.matchAll(/^\s*env_key\s*=\s*"([A-Za-z_][A-Za-z0-9_]*)"/gm)].map((match) => match[1]) };
+}
+async function installRunner(home, projectPath, approved, service) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(approved.runnerId)) {
         throw new Error("AgentRadar returned an invalid runner ID");
     }
     const endpoint = trustedMcpEndpoint(approved.installation.mcpEndpoint);
-    if (!endpoint || !/^ar_[A-Za-z0-9_-]+$/.test(approved.installation.bearer)) {
+    if (!endpoint || !BEARER_SHAPE.test(approved.installation.bearer)) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const agentDir = join(home, ".agentradar", "agents");
@@ -148,9 +236,37 @@ async function installRunner(home, projectPath, approved) {
     await mkdir(configDir, { recursive: true, mode: 0o700 });
     await chmod(agentDir, 0o700);
     await chmod(configDir, 0o700);
+    const declared = (approved.harness ?? "").trim().toLowerCase();
+    const harness = declared ? SUPERVISOR_HARNESS[declared] : undefined;
+    if (declared && !harness)
+        throw new Error(`AgentRadar returned a runtime this runner cannot start: ${JSON.stringify(declared)}`);
     const mcpConfig = join(configDir, "awp-only.json");
     const envPath = join(agentDir, `${approved.runnerId}.env`);
-    await writePrivateFile(mcpConfig, `${JSON.stringify({
+    const joined = [];
+    if (service) {
+        joined.push(`AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`);
+        let toolKeys = [];
+        if (harness === "codex") {
+            const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
+            joined.push(`CODEX_HOME=${shellValue(codexHome)}`);
+            toolKeys = keys;
+        }
+        else {
+            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--session-id ${service.sessionId}`)}`);
+            const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
+            if (configDirEnv)
+                joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
+        }
+        const toolEnv = Object.entries(service.env)
+            .filter(([key, value]) => (TOOL_ENV.test(key) || toolKeys.includes(key)) && key !== "ANTHROPIC_API_KEY" && value && !value.includes("\n"))
+            .map(([key, value]) => `${key}=${value}`);
+        if (toolEnv.length) {
+            const toolEnvFile = join(configDir, "tool.env");
+            await writePrivateFile(toolEnvFile, `${toolEnv.join("\n")}\n`);
+            joined.push(`AGENT_TOOL_ENV_FILE=${shellValue(toolEnvFile)}`);
+        }
+    }
+    await writePrivateFile(mcpConfig, `${JSON.stringify(service ? { mcpServers: {} } : {
         mcpServers: {
             agentradar: {
                 type: "http",
@@ -165,6 +281,11 @@ async function installRunner(home, projectPath, approved) {
         `AWP_MCP_URL=${shellValue(endpoint.toString())}`,
         `AWP_BEARER=${shellValue(approved.installation.bearer)}`,
         `MCP_CONFIG=${shellValue(mcpConfig)}`,
+        // Written only when the vendor declared a runtime. An absent variable is the supervisor's own
+        // default, so writing `AR_AGENT_HARNESS=claude` unconditionally would change nothing except to make
+        // every existing env file look as though a choice had been made.
+        ...(harness ? [`AR_AGENT_HARNESS=${shellValue(harness)}`] : []),
+        ...joined,
         "",
     ].join("\n"));
     return envPath;
@@ -183,7 +304,13 @@ export async function setupVendorAgent(deps = {}) {
         throw new Error("Run setup from the agent project folder");
     const apiBase = deps.apiUrl ?? process.env.AGENTRADAR_API_URL ?? DEFAULT_API_URL;
     const setupUrl = new URL("vendor/agent-setups", `${apiBase.replace(/\/+$/, "")}/`);
-    const started = await responseJson(await postJson(fetchImpl, setupUrl, { name: agentName }));
+    const requestedHarness = (deps.harness ?? process.env.AGENTRADAR_AGENT_HARNESS ?? "").trim();
+    const started = await responseJson(await postJson(fetchImpl, setupUrl, {
+        name: agentName,
+        // Sent only when asked for. The server refuses a value it cannot run — by name, in its own words —
+        // so an unrecognised `--harness` fails at the first door rather than at `runner start`, hours later.
+        ...(requestedHarness ? { harness: requestedHarness } : {}),
+    }));
     if (!/^ars_[A-Za-z0-9_-]+$/.test(started.deviceCode) || !/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(started.userCode)) {
         throw new Error("AgentRadar returned an invalid setup challenge");
     }
@@ -191,9 +318,31 @@ export async function setupVendorAgent(deps = {}) {
     log("Waiting for approval…");
     const tokenUrl = new URL("vendor/agent-setups/token", `${apiBase.replace(/\/+$/, "")}/`);
     const expiresAt = Date.now() + started.expiresIn * 1000;
+    // 🔴 A DROPPED CONNECTION MUST NOT DISCARD AN APPROVAL A HUMAN ALREADY GAVE. This poll used to be a
+    // bare `await` in the loop, so one blip — a laptop sleeping, wifi switching, a proxy hiccup — threw
+    // straight out of setup and the vendor had to re-run it and approve a SECOND code while the first sat
+    // pending server-side. Only a definitive answer from the server ends this loop now: approved, denied,
+    // or expired. A transport failure is retried, on a backoff that grows with consecutive failures.
+    //
+    // It cannot spin forever, and the bound is not new: `Date.now() < expiresAt` is the code's own
+    // ten-minute TTL, which the server sent as `expiresIn`. If that TTL ever grows enough that a retry
+    // loop could outlive the code's validity, this needs its own deadline as well.
+    let consecutiveFailures = 0;
     while (Date.now() < expiresAt) {
-        await sleep(Math.max(1, started.interval) * 1000);
-        const response = await postJson(fetchImpl, tokenUrl, { deviceCode: started.deviceCode });
+        await sleep(Math.max(1, started.interval) * 1000 * Math.min(consecutiveFailures + 1, 5));
+        let response;
+        try {
+            response = await postJson(fetchImpl, tokenUrl, { deviceCode: started.deviceCode });
+        }
+        catch {
+            consecutiveFailures += 1;
+            // Said out loud, and naming the HOST rather than the error: a silent retry is indistinguishable
+            // from a hang to the person watching, and `fetch` rejects with the two words "fetch failed",
+            // which name nothing. The host is the fact worth printing and we already hold it.
+            log(`Could not reach ${tokenUrl.host} — the code is still valid, retrying…`);
+            continue;
+        }
+        consecutiveFailures = 0;
         if (response.status === 202)
             continue;
         if (response.status === 410)
@@ -212,10 +361,201 @@ export async function setupVendorAgent(deps = {}) {
             ? `--trust: pre-accepted the trust dialog for ${projectPath}. Claude Code will run this folder's existing hooks and settings without asking.`
             : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
+        if ((approved.harness ?? "").trim().toLowerCase() === "codex") {
+            // Said BEFORE the vendor runs the runner, because the supervisor's refusal comes after they
+            // think setup succeeded. Codex reads its MCP servers from $CODEX_HOME/config.toml — there is no
+            // `--strict-mcp-config` to point at the file this setup just wrote — so the isolation boundary is
+            // a per-agent home the vendor supplies, and the supervisor fails closed without it.
+            log(`This agent runs on Codex. Set CODEX_HOME in ${runnerEnv} to a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server; the runner refuses to start without it.`);
+        }
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
         log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");
         return;
     }
     throw new Error("AgentRadar setup code expired; run setup again");
 }
+/** `install-agent.sh <id> --load` with the CLI that is running now, so the service does not depend on PATH. */
+async function installAgentService(runnerId, home, env) {
+    const dist = dirname(fileURLToPath(import.meta.url));
+    await promisify(execFile)("bash", [join(dist, "vendor-runner", "supervisor", "install-agent.sh"), runnerId, "--load"], {
+        env: { ...env, HOME: home, NODE_BIN: process.execPath, AGENTRADAR_JS: join(dist, "index.js") },
+    });
+}
+/**
+ * Mode A — the organisation's own agent, on its own compute, joining through an enrolment link.
+ *
+ * accept → wait for a human to approve → claim the key once → install the runner and start it as a service
+ * (LaunchAgent / systemd user unit) that owns the agent's persistent session. The one-time claim secret is
+ * kept in a 0600 state file per link, so a re-run resumes the wait (or, once claimed, reinstalls and
+ * restarts the service) instead of filing a second request. The key is written only into the 0600 runner
+ * env file and is never printed.
+ */
+export async function joinOrganisation(enrolmentUrl, deps = {}) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const log = deps.log ?? console.log;
+    const cwd = deps.cwd ?? process.cwd();
+    const home = deps.home ?? homedir();
+    const env = deps.env ?? process.env;
+    // Claude Code sets CLAUDECODE in its shell; a machine with both tools installed may export CODEX_HOME too.
+    const harness = deps.harness ?? (env.CLAUDECODE || !env.CODEX_HOME ? "claude" : "codex");
+    // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
+    // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
+    const startJoined = async (requestId, agentId, installation, saved) => {
+        const runnerId = `join-${requestId}`;
+        // The service's Claude session id: a valid UUID derived from the request, so a re-run resumes the same one.
+        const hex = createHash("sha256").update(requestId).digest("hex");
+        const sessionId = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+        const projectPath = harness === "claude"
+            ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
+            : await realpath(cwd);
+        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId, env });
+        await saved?.();
+        log(`Runner installed → ${runnerEnv}`);
+        try {
+            await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
+        }
+        catch (error) {
+            log(`Could not start the service: ${error.message.split("\n")[0]}. Start it by hand with: agentradar runner start ${runnerId}`);
+            return 1;
+        }
+        log(`Connected. Your agent now runs in its own ${harness === "claude" ? "Claude Code" : "Codex"} session in ${projectPath} (tmux session ${runnerId}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        log("Running as a service; it restarts on crash and reboot.");
+        return 0;
+    };
+    let link;
+    try {
+        link = new URL(enrolmentUrl);
+    }
+    catch {
+        throw new Error("Pass the enrolment link your organisation gave you, e.g. https://…/invite/<token>");
+    }
+    const token = /^\/(?:api\/invites|invite)\/([^/]+?)(?:\.md)?(?:\/|$)/.exec(link.pathname)?.[1];
+    if (!token || !trustedMcpEndpoint(link.origin)) {
+        throw new Error("That is not an AgentRadar enrolment link (expected https://…/invite/<token>)");
+    }
+    const api = (path) => new URL(`/api/${path}`, link.origin);
+    const mcpEndpoint = env.AWP_MCP_URL || api("mcp").toString();
+    const joinsDir = join(home, ".agentradar", "joins");
+    await mkdir(joinsDir, { recursive: true, mode: 0o700 });
+    const statePath = join(joinsDir, `${createHash("sha256").update(token).digest("hex")}.json`);
+    let state = null;
+    try {
+        state = JSON.parse(await readFile(statePath, "utf8"));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (state?.agentId) {
+        log("This enrolment link is already joined on this machine.");
+        const saved = await readFile(join(home, ".agentradar", "agents", `join-${state.requestId}.env`), "utf8").catch(() => "");
+        const { envValue } = await import("./tool-run.js");
+        const bearer = envValue(saved, "AWP_BEARER");
+        if (!bearer)
+            throw new Error("This machine left that organisation (agentradar leave). A key is issued once; ask your organisation for a new enrolment link.");
+        return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer });
+    }
+    if (!state) {
+        const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
+        if (!agentName)
+            throw new Error("Run join from the agent project folder");
+        // Codex has no env var for its model; its config's top-level `model` is the default a session starts on.
+        // A codex agent reporting "claude" is guessing (a gateway combo answers as Claude), so the config wins there too.
+        const codexModel = async () => !env.CODEX_HOME ? undefined : /^model\s*=\s*"([^"\n]+)"/m.exec((await readFile(join(env.CODEX_HOME, "config.toml"), "utf8").catch(() => "")).split(/^\[/m)[0])?.[1];
+        const model = (!deps.model || deps.model === "unknown" || /claude/i.test(deps.model)) && harness === "codex" ? (await codexModel()) ?? deps.model : deps.model;
+        const response = await postJson(fetchImpl, api(`invites/${encodeURIComponent(token)}/accept`), {
+            requestType: "agent", agentName, adapterType: "awp_remote",
+            agentDefaultsPayload: { harness, ...(model ? { model } : {}) },
+        });
+        if (!response.ok) {
+            throw new Error(response.status === 404
+                ? "This join link has expired, was already used, or was withdrawn. Ask your organisation for a new link."
+                : `This join link cannot be used. ${await failureMessage(response)}`);
+        }
+        const accepted = await response.json();
+        if (typeof accepted.id !== "string" || typeof accepted.claimSecret !== "string") {
+            throw new Error("AgentRadar returned an invalid join response");
+        }
+        state = { requestId: accepted.id, claimSecret: accepted.claimSecret, ...(typeof accepted.approvalUrl === "string" ? { approvalUrl: accepted.approvalUrl } : {}) };
+        await writePrivateFile(statePath, JSON.stringify(state));
+    }
+    log("Join request sent. Waiting for your organisation to approve it…");
+    if (state.approvalUrl)
+        log(`Approval link: ${state.approvalUrl}\nSend it to your own human once; they approve after signing in. Never send anything else from this folder.`);
+    const claimUrl = api(`join-requests/${encodeURIComponent(state.requestId)}/claim-api-key`);
+    // Named off the join request, which exists before the key does, so the server can record it at claim.
+    const runnerId = `join-${state.requestId}`;
+    for (let poll = 1;; poll++) {
+        if (poll > (deps.polls ?? 9)) {
+            log(`Still waiting for approval. Run this same command again: agentradar run ${enrolmentUrl}`);
+            return 0;
+        }
+        let response;
+        try {
+            response = await postJson(fetchImpl, claimUrl, { claimSecret: state.claimSecret, runnerId });
+        }
+        catch {
+            log(`Could not reach ${claimUrl.host}; retrying…`);
+            await sleep(10_000);
+            continue;
+        }
+        if (response.status === 201) {
+            const claimed = await response.json();
+            if (typeof claimed.token !== "string" || typeof claimed.agentId !== "string") {
+                throw new Error("AgentRadar returned an invalid key claim");
+            }
+            log("Approved.");
+            const joined = { ...state, agentId: claimed.agentId };
+            return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, () => writePrivateFile(statePath, JSON.stringify(joined)));
+        }
+        const said = await failureMessage(response);
+        if (response.status === 409 && said.includes("must be approved")) {
+            await sleep(10_000);
+            continue;
+        }
+        if (response.status === 409 && said.includes("rejected")) {
+            throw new Error("Your organisation declined this join request. Ask it for a new enrolment link.");
+        }
+        if (response.status === 409 && /already (?:used|claimed)/.test(said)) {
+            throw new Error("This enrolment link's key was already claimed. A key is issued once and cannot be claimed again; ask your organisation for a new enrolment link.");
+        }
+        throw new Error(said);
+    }
+}
+/**
+ * `agentradar leave <runner-id>`: stop and remove the service, end the agent's session, and delete its env
+ * file, bearer and config. The folder the agent worked in stays, with the work.
+ */
+export async function leaveOrganisation(runnerId, deps = {}) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
+        throw new Error("Invalid runner ID");
+    const home = deps.home ?? homedir();
+    const log = deps.log ?? console.log;
+    const execute = deps.execute ?? ((command, args) => promisify(execFile)(command, args));
+    const envPath = join(home, ".agentradar", "agents", `${runnerId}.env`);
+    const saved = await readFile(envPath, "utf8").catch(() => null);
+    if (saved === null) {
+        log(`No agent ${runnerId} on this machine.`);
+        return 1;
+    }
+    const { envValue } = await import("./tool-run.js");
+    if ((deps.platform ?? process.platform) === "darwin") {
+        const label = `com.agentradar.agent.${runnerId}`;
+        await execute("launchctl", ["bootout", `gui/${process.getuid?.()}/${label}`]).catch(() => undefined);
+        await rm(join(home, "Library", "LaunchAgents", `${label}.plist`), { force: true });
+        await rm(join(home, ".agentradar", "staged", `${label}.plist`), { force: true });
+    }
+    else {
+        await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
+    }
+    // The service stopping leaves the session running; `=` matches the tmux session name exactly.
+    await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
+    for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
+        await rm(path, { force: true });
+    for (const dir of ["run", "config", "codex"])
+        await rm(join(home, ".agentradar", dir, runnerId), { recursive: true, force: true });
+    log(`Left: the service is stopped and removed, and its key is deleted. The folder ${envValue(saved, "AR_BASE") ?? ""} stays, with the work.`);
+    return 0;
+}
 //# sourceMappingURL=setup.js.map

package/dist/skill-install.js

@@ -37,6 +37,8 @@ export async function installVendorSkill(deps = {}) {
                 throw error;
         });
     }
+    // The runner keeps this skill current from AgentRadar; the marker says the folder is AgentRadar's to replace.
+    await writeFile(join(skillDir, ".agentradar-managed"), "Written by AgentRadar; replaced on every sync.\n");
     (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
 }
 //# sourceMappingURL=skill-install.js.map