agentradar-cli 0.1.9 → 0.2.1

package/dist/tool-run.js

@@ -0,0 +1,300 @@
+import { readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+/**
+ * One `KEY='value'` line as `setup.ts` wrote it, single-quoted with `'` escaped as `'\''`.
+ * Nothing here is printed: the file holds the runner's bearer.
+ */
+export function envValue(contents, key) {
+    const line = contents.split("\n").find((row) => row.startsWith(`${key}=`));
+    if (!line)
+        return null;
+    const raw = line.slice(key.length + 1).trim();
+    const quoted = raw.startsWith("'") && raw.endsWith("'") && raw.length >= 2;
+    return (quoted ? raw.slice(1, -1).replaceAll("'\\''", "'") : raw) || null;
+}
+export async function runServiceToolOverCli(runnerId, toolKey, argumentsJson, deps = {}) {
+    const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    return await callAwpTool(runnerId, "run_service_tool", { toolKey, arguments: parameters, entryPoint: "cli" }, deps);
+}
+/** `agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>']`: any AWP tool from a shell, so a just-joined agent works before its harness reloads MCP tools. */
+export async function callToolOverCli(runnerId, tool, argumentsJson, deps = {}, flags = []) {
+    const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    if (flags.length) {
+        const typed = await flagArguments(runnerId, tool, flags, deps);
+        if (!typed)
+            return 1;
+        Object.assign(parameters, typed);
+    }
+    if (tool !== "next_event" || !RUNNER_ID.test(runnerId))
+        return await callAwpTool(runnerId, tool, parameters, deps);
+    // A bare poll acknowledges the batch the previous poll printed, so the command stays byte-identical and
+    // an operator can allow it once. Asking for the next event means the last one was read; a lost or
+    // failed poll leaves the file as it was, so delivery stays at-least-once.
+    const delivered = join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.delivered.json`);
+    if (parameters.ackEventIds === undefined) {
+        const ids = await readFile(delivered, "utf8").then((text) => JSON.parse(text), () => []);
+        if (Array.isArray(ids) && ids.length)
+            parameters.ackEventIds = ids;
+    }
+    let said = "";
+    const code = await callAwpTool(runnerId, tool, parameters, { ...deps, log: (text) => { said = text; (deps.log ?? console.log)(text); } });
+    if (code !== 0)
+        return code;
+    let events = [];
+    try {
+        events = JSON.parse(said).events;
+    }
+    catch { /* not a batch: nothing to acknowledge */ }
+    const ids = Array.isArray(events) ? events.map((event) => event?.eventId).filter((id) => typeof id === "string") : [];
+    await writeFile(delivered, JSON.stringify(ids), { mode: 0o600 }).catch(() => undefined);
+    return 0;
+}
+/**
+ * `agentradar run <runner-id> listen`: bare `next_event` polls (each held by the server, each acking the
+ * batch before it) until work, a liveness probe or the welcome arrives, or until the next hold could run
+ * past `budgetMs`. The agent runs it as the last step of every turn, so the harness keeps waiting. Nine
+ * minutes stays under Claude Code's 10-minute Bash cap; Codex waits on it in 5-minute chunks.
+ */
+export async function listenOverCli(runnerId, deps = {}, budgetMs = 540_000) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const start = now();
+    let longest = 0;
+    for (;;) {
+        const began = now();
+        let said = "";
+        const code = await callToolOverCli(runnerId, "next_event", undefined, { ...deps, log: (text) => { said = text; } });
+        if (code !== 0)
+            return code;
+        let batch = null;
+        try {
+            batch = JSON.parse(said);
+        }
+        catch { /* not a batch: keep waiting */ }
+        // Wake on work, a liveness probe or the welcome; anything else (events: null, an unknown key) waits.
+        if ((Array.isArray(batch?.events) && batch.events.length) || batch?.livenessProbe || batch?.welcome) {
+            (deps.log ?? console.log)(said);
+            return 0;
+        }
+        // A caller the server does not hold (not yet hired, a run JWT) answers at once; do not spin on it.
+        if (now() - began < 10_000)
+            await sleep(10_000 - (now() - began));
+        longest = Math.max(longest, now() - began);
+        if (now() - start + longest > budgetMs) {
+            (deps.log ?? console.log)(`No client message in ${Math.round((now() - start) / 60_000)} minutes. Run agentradar run ${runnerId} listen again.`);
+            return 0;
+        }
+    }
+}
+/** Split `<runner-id> <tool> [--args '<json>'] [--<argument> <value> ...]`; null when it is not that shape. */
+export function parseCallArgs(rest) {
+    const positional = [];
+    const flags = [];
+    let json;
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (!arg.startsWith("--")) {
+            positional.push(arg);
+            continue;
+        }
+        const value = rest[++i];
+        if (value === undefined)
+            return null;
+        if (arg === "--args")
+            json = value;
+        else
+            flags.push([arg.slice(2), value]);
+    }
+    return positional.length === 2 ? { runnerId: positional[0], tool: positional[1], json, flags } : null;
+}
+/**
+ * `--text "hi" --conversation-id X` as the tool's own arguments, typed by the inputSchema the server
+ * advertises, so an agent never types JSON (braces and quotes) into a shell command.
+ */
+async function flagArguments(runnerId, tool, flags, deps) {
+    const logError = deps.logError ?? console.error;
+    const listed = await awpRequest(runnerId, "tools/list", {}, deps);
+    if (!listed)
+        return null;
+    const schema = listed.result?.tools?.find((entry) => entry.name === tool)?.inputSchema?.properties ?? {};
+    const out = {};
+    const camel = (flag) => flag.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+    for (let [flag, value] of flags) {
+        // --body-file page.md: the argument read from a file, so a multi-line page never sits in a quoted
+        // shell argument (Claude Code prompts on a newline followed by # inside one).
+        if (flag.endsWith("-file") && !(flag in schema) && !(camel(flag) in schema)) {
+            const text = await readArgumentFile(value, deps.cwd ?? process.cwd(), deps.home ?? homedir()).catch((error) => error);
+            if (text instanceof Error) {
+                logError(`--${flag}: ${text.message}`);
+                return null;
+            }
+            [flag, value] = [flag.slice(0, -"-file".length), text];
+        }
+        // --text is what agents reach for on append_task_log, whose argument is --entry.
+        const key = flag in schema ? flag : flag === "text" && "entry" in schema ? "entry" : camel(flag);
+        if (!(key in schema)) {
+            logError(`${tool} has no argument --${flag}. Its arguments: ${Object.keys(schema).map((name) => `--${name}`).join(" ") || "none"}`);
+            return null;
+        }
+        const type = [schema[key].type].flat()[0];
+        const typed = coerce(type === "array" ? [schema[key].items?.type].flat()[0] : type, value);
+        if (typed === undefined) {
+            logError(`--${flag} must be ${type === "array" ? "a list of " + schema[key].items?.type : "a " + type}`);
+            return null;
+        }
+        // A repeated flag builds a list: --message-ids a --message-ids b.
+        out[key] = type === "array" ? [...(out[key] ?? []), typed] : typed;
+    }
+    return out;
+}
+/**
+ * `agentradar run` is always-allowed, so a file flag must not read and upload any file the agent names:
+ * only a regular file inside the working folder (after symlinks), and at most 256 KB — and never one in
+ * ~/.agentradar, which holds the runner's own key even when the working folder is $HOME.
+ * ponytail: a hard link to the key is not caught (same inode, different path); making one is the agent's own act.
+ */
+async function readArgumentFile(path, cwd, home) {
+    const real = await realpath(resolve(cwd, path)).catch(() => { throw new Error(`cannot read ${path}`); });
+    const within = (dir) => { const inside = relative(dir, real); return inside !== ".." && !inside.startsWith(`..${sep}`) && !isAbsolute(inside); };
+    const own = await realpath(join(home, ".agentradar")).catch(() => null);
+    if (own && within(own))
+        throw new Error(`${path} is refused: a file flag never reads AgentRadar's own folder (~/.agentradar), which holds this agent's key`);
+    const info = await stat(real);
+    if (!info.isFile() || !within(await realpath(cwd)) || info.size > 256 * 1024) {
+        throw new Error(`${path} is refused: a file flag reads only a regular file inside the current folder, up to 256 KB`);
+    }
+    return await readFile(real, "utf8");
+}
+function coerce(type, value) {
+    if (type === "string")
+        return value;
+    if (type === "number" || type === "integer") {
+        const number = value.trim() === "" ? NaN : Number(value);
+        return Number.isFinite(number) && (type === "number" || Number.isInteger(number)) ? number : undefined;
+    }
+    if (type === "boolean")
+        return value === "true" ? true : value === "false" ? false : undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return type === undefined ? value : undefined;
+    }
+}
+/**
+ * Ruling 49 — `agentradar task create|repeat <runner-id> --args '<json>'`: the agent's own `create_task`
+ * or `create_recurring_task`, on the same AWP endpoint with the same key, so who it may assign to is the
+ * server's decision exactly as it is over MCP.
+ */
+export async function createTaskOverCli(runnerId, recurring, argumentsJson, deps = {}) {
+    const parameters = parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
+    if (!parameters)
+        return 1;
+    return await callAwpTool(runnerId, recurring ? "create_recurring_task" : "create_task", parameters, deps);
+}
+function parseArgumentsObject(argumentsJson, logError) {
+    let parsed;
+    try {
+        parsed = JSON.parse(argumentsJson);
+    }
+    catch {
+        logError("--args must be a JSON object, e.g. --args '{\"title\":\"a real issue\"}'");
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        logError("--args must be a JSON object");
+        return null;
+    }
+    return parsed;
+}
+/**
+ * R251 — `agentradar tool list <runner-id>`: the server's own `list_service_tools`, printed as it
+ * answered. The listing is the policy's preview for this agent, so the CLI computes nothing — a second
+ * copy of the decision here could only drift from the one the MCP tool and every real call make.
+ */
+export async function listServiceToolsOverCli(runnerId, deps = {}) {
+    return await callAwpTool(runnerId, "list_service_tools", {}, deps);
+}
+/** One `tools/call` on the runner's AWP MCP endpoint with the runner's own key; the answer is printed verbatim. */
+export async function callAwpTool(runnerId, name, toolArguments, deps) {
+    const log = deps.log ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const body = await awpRequest(runnerId, "tools/call", { name, arguments: toolArguments }, deps);
+    if (!body)
+        return 1;
+    const text = body.result?.content?.[0]?.text;
+    const said = typeof text === "string" ? text : JSON.stringify(body.result ?? {});
+    // A refusal is the server's sentence and belongs on stderr with a non-zero exit, or a script that
+    // pipes stdout reads "the tool ran" from a body that says it was refused.
+    if (body.result?.isError) {
+        logError(said);
+        return 1;
+    }
+    log(said);
+    return 0;
+}
+const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
+async function awpRequest(runnerId, method, params, deps) {
+    const logError = deps.logError ?? console.error;
+    if (!RUNNER_ID.test(runnerId)) {
+        logError("Invalid runner ID");
+        return null;
+    }
+    const envPath = join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.env`);
+    let url;
+    let bearer;
+    const contents = await readFile(envPath, "utf8").catch(() => null);
+    if (contents !== null) {
+        url = envValue(contents, "AWP_MCP_URL");
+        bearer = envValue(contents, "AWP_BEARER");
+        if (!url || !bearer) {
+            logError(`${envPath} is missing AWP_MCP_URL or AWP_BEARER. Run agentradar setup again.`);
+            return null;
+        }
+    }
+    else {
+        // Ruling 41 — a hosted agent has no runner file. Its run already carries the server's origin and its
+        // per-run JWT (`PAPERCLIP_API_URL`/`PAPERCLIP_API_KEY`), which the AWP MCP admits for a vendorless
+        // hosted agent (`server/src/awp/resolve.ts`). The runner file, when present, still wins.
+        const env = deps.env ?? process.env;
+        const origin = env.PAPERCLIP_API_URL?.trim().replace(/\/+$/, "");
+        bearer = env.PAPERCLIP_API_KEY?.trim() || null;
+        if (!origin || !bearer) {
+            logError(`No runner named ${runnerId}: ${envPath} does not exist. Run agentradar setup first.`);
+            return null;
+        }
+        url = `${origin}/api/mcp`;
+    }
+    const response = await (deps.fetch ?? fetch)(url, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${bearer}`,
+            "content-type": "application/json",
+            // Both, because the endpoint answers JSON only when the client says it takes JSON.
+            accept: "application/json, text/event-stream",
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method,
+            params,
+        }),
+    });
+    if (!response.ok) {
+        logError(`AgentRadar refused the tool call (${response.status}).`);
+        return null;
+    }
+    const body = await response.json();
+    if (body.error) {
+        logError(typeof body.error.message === "string" ? body.error.message : "AgentRadar returned an error");
+        return null;
+    }
+    return body;
+}
+//# sourceMappingURL=tool-run.js.map