agentradar-cli 0.1.9 → 0.2.1

package/dist/vendor-runner/feeder.mjs

@@ -2,9 +2,11 @@
 // ===========================================================================
 // AgentRadar I2 feeder — the INTERACTIVE-HOST variant of the vendor runner.
 //
-// Unlike runner.mjs (which spawns a fresh `claude` per event, out-of-context), the
-// feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
-// `claude` running in a tmux pane (real in-session continuity — I1). It:
+// The feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
+// agent CLI running in a tmux pane (real in-session continuity — I1). R004: that CLI is
+// Claude Code or Codex, selected by AR_AGENT_HARNESS; injection, acking and the
+// in-progress hint are identical on both, and only the login probe, the idle-composer
+// marker and the pane's argv pattern branch. It:
 //   1. phones home to the single AgentRadar AWP MCP and long-polls `next_event`;
 //   2. injects each event into the live pane via `tmux send-keys` (I2), pinning the
 //      EXPLICIT conversationId so the agent's `reply` never guesses the target;
@@ -18,13 +20,13 @@
 // ===========================================================================
 
 import { spawn, spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { formatInjectionFrame, formatProbeFrame, sendKeysCommands } from "./session-frame.mjs";
+import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
 
 const PANE_LIVE_SH = join(dirname(fileURLToPath(import.meta.url)), "pane-live.sh");
 
@@ -45,9 +47,24 @@ const AWP_BEARER = (() => {
   return process.env.AWP_BEARER ?? "";
 })();
 const TMUX_SESSION = process.env.TMUX_SESSION ?? "agent";
-// The claude pid marker (same predicate entrypoint.sh uses) — proves the pane is live.
-const AGENT_PID_PATTERN = process.env.AGENT_PID_PATTERN ?? "mcp-config.*awp-only";
-const CLAUDE_BIN = process.env.CLAUDE_BIN ?? "claude";
+/**
+ * R004 — which CLI is in the pane. `claude` is the default, so a feeder started by an older supervisor (or
+ * by hand) behaves exactly as before. Only what genuinely differs reads this: how the CLI reports its login
+ * state, what its idle composer looks like, and the argv the pane can be found by. The in-progress hint and
+ * the volatile-line strip are NOT harness-specific — measured on codex-cli 0.149.1, Codex renders the same
+ * `esc to interrupt` working line Claude does (`• Working (1s • esc to interrupt)`), so the existing
+ * matchers already cover it and a speculative Codex spinner pattern would be invention, not coverage.
+ */
+export const AR_AGENT_HARNESS = ["codex", "generic"].includes(process.env.AR_AGENT_HARNESS) ? process.env.AR_AGENT_HARNESS : "claude";
+// A joined agent acts through `agentradar run <id> …` (its human's "always allow"), so frames name that command.
+const AR_CLI_RUNNER_ID = process.env.AR_CLI_RUNNER_ID || undefined;
+// The agent pid marker (same predicate entrypoint.sh uses) — proves the pane is live. Claude is found by its
+// mcp-config argument; Codex takes its MCP servers from CODEX_HOME (an env var, invisible to `ps`), so its
+// per-agent argv token is `--cd <working dir>`. The supervisor passes an exact pattern; this default only
+// matters for a hand-started feeder.
+const AGENT_PID_PATTERN =
+  process.env.AGENT_PID_PATTERN ?? (AR_AGENT_HARNESS === "codex" ? "codex.*--cd " : "mcp-config.*awp-only");
+const AGENT_BIN = process.env.AGENT_BIN ?? process.env.CLAUDE_BIN ?? (AR_AGENT_HARNESS === "codex" ? "codex" : "claude");
 const AR_OAUTH_TOKEN_FILE = process.env.AR_OAUTH_TOKEN_FILE ?? "";
 
 const MCP_CALL_TIMEOUT_MS = Number(process.env.AWP_MCP_CALL_TIMEOUT_MS ?? "30000");
@@ -56,7 +73,7 @@ const MCP_CALL_TIMEOUT_MS = Number(process.env.AWP_MCP_CALL_TIMEOUT_MS ?? "30000
 // cycle ("fetch failed — re-establishing"). SEPARATE from the server's liveness cadence
 // (NEXT_EVENT_LONGPOLL_MS, pinned 240s) — see #171. Leave NEXT_EVENT_HOLD_MS unset for the 200s default.
 const NEXT_EVENT_HOLD_MS = Number(process.env.NEXT_EVENT_HOLD_MS ?? "200000");
-// Watchdog past the server hold so a dead socket aborts → self-heal (matches runner.mjs). At 200s the
+// Watchdog past the server hold so a dead socket aborts → self-heal. At 200s the
 // watchdog is 230s, still under the ~240s ALB idle-timeout.
 const NEXT_EVENT_TIMEOUT_MS = NEXT_EVENT_HOLD_MS + 30000;
 const IDLE_DELAY_MS = Number(process.env.IDLE_DELAY_MS ?? "1000");
@@ -75,13 +92,25 @@ const REPORT_PANE_INTERVAL_MS = Number(process.env.REPORT_PANE_INTERVAL_MS ?? "4
 // any single failure well under the 45s interval.
 const PANE_MCP_TIMEOUT_MS = Number(process.env.PANE_MCP_TIMEOUT_MS ?? "10000");
 
+// R650 — the agent's AgentRadar skills (bundled + linked) are written into its CLI's skills directory on this
+// cadence. Only directories this feeder created (they carry MANAGED_MARK) are ever replaced or removed; a
+// skill the vendor put there by hand is left alone. 0 disables.
+/** Claude reads `$AR_BASE/.claude/skills`; Codex reads `$CODEX_HOME/skills`, the per-agent home the supervisor requires. */
+export function skillsDirFor(harness, env) {
+  if (harness === "codex") return env.CODEX_HOME ? join(env.CODEX_HOME, "skills") : null;
+  return env.AR_BASE ? join(env.AR_BASE, ".claude", "skills") : null;
+}
+const SKILLS_DIR = skillsDirFor(AR_AGENT_HARNESS, process.env);
+const SKILLS_SYNC_INTERVAL_MS = Number(process.env.SKILLS_SYNC_INTERVAL_MS ?? "600000");
+const MANAGED_MARK = ".agentradar-managed";
+
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
 // --------------------------------------------------------------------------
 // Minimal MCP client over Streamable-HTTP (initialize + tools/call) — the proven
-// shape from runner.mjs, incl. the dead-socket watchdog + session-id handling.
+// shape, incl. the dead-socket watchdog + session-id handling.
 // --------------------------------------------------------------------------
 let _sessionId = null;
 function parseMcpBody(text) {
@@ -195,8 +224,10 @@ function toolJson(result) {
   const text = result?.content?.find((c) => c.type === "text")?.text;
   return text ? JSON.parse(text) : {};
 }
+const runnerSessionId = randomUUID();
 async function nextEvent(ackEventIds, runnerState) {
   const args = {
+    sessionId: runnerSessionId,
     ...(ackEventIds && ackEventIds.length ? { ackEventIds } : {}),
     ...(runnerState ? { runnerState } : {}),
   };
@@ -208,11 +239,29 @@ async function nextEvent(ackEventIds, runnerState) {
 // Work readiness — process liveness is not enough. A live Claude process can
 // be blocked on subscription OAuth, where injected work is consumed as the OAuth code.
 // --------------------------------------------------------------------------
-export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
+/** The login probe runs with the pane's env: the allowlist plus the tool-env file (a model gateway's
+ *  ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN, a Codex provider key). Without the file a gateway-authenticated
+ *  pane reads "not logged in" and never receives work. */
+export function authProbeEnv(extraNames = [], source = process.env, readFile = fs.readFileSync) {
   const env = {};
-  for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", "CLAUDE_CONFIG_DIR"]) {
-    if (typeof process.env[name] === "string") env[name] = process.env[name];
+  for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", ...extraNames]) {
+    if (typeof source[name] === "string") env[name] = source[name];
+  }
+  if (source.AR_TOOL_ENV_FILE) {
+    let text = "";
+    try { text = readFile(source.AR_TOOL_ENV_FILE, "utf8"); } catch { /* staged by the supervisor; absent = none */ }
+    // Already validated and reserved-key-filtered by the supervisor; never let it replace the allowlist.
+    for (const line of text.split("\n")) {
+      const at = line.indexOf("=");
+      const key = line.slice(0, at);
+      if (at > 0 && !(key in env)) env[key] = line.slice(at + 1);
+    }
   }
+  return env;
+}
+
+export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
+  const env = authProbeEnv(["CLAUDE_CONFIG_DIR"]);
   if (AR_OAUTH_TOKEN_FILE) {
     try {
       env.CLAUDE_CODE_OAUTH_TOKEN = readFile(AR_OAUTH_TOKEN_FILE, "utf8").trim();
@@ -220,7 +269,7 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
       return "unknown";
     }
   }
-  const r = run(CLAUDE_BIN, ["auth", "status", "--json"], { encoding: "utf8", env, timeout: 10000 });
+  const r = run(AGENT_BIN, ["auth", "status", "--json"], { encoding: "utf8", env, timeout: 10000 });
   if (typeof r.stdout !== "string") return "unknown";
   try {
     return JSON.parse(r.stdout).loggedIn === true ? "authenticated" : "unauthenticated";
@@ -229,7 +278,39 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
   }
 }
 
-export function runnerState(auth = claudeAuthState, sample = capturePane) {
+/**
+ * Codex has no `auth status --json`. Its login probe is `codex login status`, which EXITS 0 when logged in
+ * and 1 when not, and prints "Logged in using ChatGPT" / "Not logged in" (measured, codex-cli 0.149.1).
+ *
+ * The exit code is the signal and the text is only a cross-check, not the other way round: a future build
+ * that reworded the line would still exit correctly, whereas reading the words alone would silently start
+ * returning "unknown" and park the runner in `starting` forever. A code we do not recognise stays "unknown"
+ * rather than becoming "unauthenticated", because `auth_required` is a claim the vendor is asked to act on.
+ *
+ * CODEX_HOME crosses into the probe because it IS the agent's credential home — probing the default
+ * ~/.codex would answer about a different login than the one the pane runs on.
+ */
+export function codexAuthState(run = spawnSync, readFile = fs.readFileSync) {
+  // A custom model_provider (a gateway) authenticates with its own env_key; `codex login status` only
+  // knows the OpenAI login and says "Not logged in" for it forever (measured, 0.149.1).
+  let config = "";
+  try { config = readFile(join(process.env.CODEX_HOME ?? "", "config.toml"), "utf8"); } catch { /* no config */ }
+  const provider = /^model_provider\s*=\s*"([^"]+)"/m.exec(config.split(/^\[/m)[0])?.[1];
+  if (provider && provider !== "openai") return "authenticated";
+  const r = run(AGENT_BIN, ["login", "status"], { encoding: "utf8", env: authProbeEnv(["CODEX_HOME"]), timeout: 10000 });
+  if (r.status === 0) return "authenticated";
+  if (r.status === 1) return "unauthenticated";
+  return "unknown";
+}
+
+/** The login probe for whichever CLI this runner drives. */
+export function agentAuthState() {
+  // A generic CLI has no login probe we know of; its pane's input marker is the readiness signal.
+  if (AR_AGENT_HARNESS === "generic") return "authenticated";
+  return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
+}
+
+export function runnerState(auth = agentAuthState, sample = capturePane) {
   const authState = auth();
   if (authState === "unauthenticated") return "auth_required";
   if (authState !== "authenticated") return "starting";
@@ -246,6 +327,8 @@ export function paneIsLive(run = spawnSync) {
     env: {
       PATH: process.env.PATH,
       TMUX_BIN: process.env.TMUX_BIN ?? "tmux",
+      // The service's tmux server lives under TMUX_TMPDIR when the installer had one; without it tmux asks /tmp's.
+      ...(process.env.TMUX_TMPDIR ? { TMUX_TMPDIR: process.env.TMUX_TMPDIR } : {}),
       TMUX_SESSION,
       AGENT_PID_PATTERN,
     },
@@ -345,7 +428,7 @@ async function injectEvent(event) {
     return false;
   }
   const injected = await injectFrame(
-    formatInjectionFrame(event),
+    formatInjectionFrame(event, AR_CLI_RUNNER_ID),
     `eventId=${event.eventId} (source=${event.source}, conversationId=${event.conversationId ?? "-"})`,
   );
   if (!injected) return false;
@@ -367,9 +450,18 @@ async function injectEvent(event) {
  *  double-count or mis-ack a real event.
  *  Best-effort: if the pane is dead we DON'T inject (the probe then times out server-side → the
  *  act-signal treats genuine silence as act-dead, the correct verdict). */
-async function injectProbe(probe) {
+// The server re-offers an outstanding probe on every poll and does not hold the poll while it is out, so an
+// un-deduped feeder typed the same check into the pane about once a second. Once per nonce, re-typed only if
+// it is still unanswered after PROBE_REINJECT_MS (the first copy may have been swallowed by a busy pane).
+const PROBE_REINJECT_MS = Number(process.env.PROBE_REINJECT_MS ?? "180000");
+let _lastProbe = { nonce: null, at: 0 };
+export async function injectProbe(probe, welcome, inject = injectFrame, now = Date.now) {
   if (!probe || !probe.nonce || !probe.instruction) return;
-  await injectFrame(formatProbeFrame(probe), `liveness-probe nonce=${probe.nonce}`);
+  if (probe.nonce === _lastProbe.nonce && now() - _lastProbe.at < PROBE_REINJECT_MS) return;
+  const frame = welcome?.next ? formatWelcomeFrame(welcome, probe) : formatProbeFrame(probe, AR_CLI_RUNNER_ID);
+  if (await inject(frame, `${welcome?.next ? "welcome + " : ""}liveness-probe nonce=${probe.nonce}`)) {
+    _lastProbe = { nonce: probe.nonce, at: now() };
+  }
 }
 
 // --------------------------------------------------------------------------
@@ -392,7 +484,11 @@ export function stripVolatilePaneLines(text) {
   return String(text ?? "")
     .split("\n")
     .filter((line) => {
-      // the mid-turn interrupt hint (often carries the ticking counter)
+      // The mid-turn interrupt hint (often carries the ticking counter). This first matcher is also what
+      // covers CODEX: its whole working line is "• Working (1s • esc to interrupt)" (measured, codex-cli
+      // 0.149.1), counter included, so it is stripped entire and the Claude-specific spinner matchers below
+      // are simply inert on a Codex pane. No speculative Codex pattern is added here — an unmeasured
+      // matcher would look like coverage while stabilising nothing.
       if (/\besc to (?:interrupt|cancel)\b/i.test(line)) return false;
       // claude's spinner line, TWO observed forms — a leading animated glyph + a SINGLE gerund word +
       // the elapsed counter. Tightly anchored (one word before the counter) so real transcript prose
@@ -421,8 +517,42 @@ export function stripVolatilePaneLines(text) {
     .join("\n");
 }
 
-export function paneInputReady(text) {
-  return /bypass permissions on\b|^\s*❯/im.test(String(text ?? "").split("\n").slice(-12).join("\n"));
+/**
+ * The durable "this pane can take a turn" marker, which is the one pane signal that genuinely differs
+ * between the two CLIs. Claude Code shows its bypass-permissions footer or the `❯` prompt; Codex shows its
+ * idle composer placeholder `Ask Codex to do anything` (measured, codex-cli 0.149.1).
+ *
+ * ponytail: both markers vanish while a modal owns the screen — Claude's login prompt, Codex's trust or
+ * rate-limit dialog — which is the behaviour we want, since a pane blocked on a dialog cannot take work.
+ * Both also vanish once a human has typed into the composer without submitting; on an unattended runner
+ * nothing types there except `send-keys`, which submits immediately. Narrow the marker only if a real pane
+ * is observed to defeat it.
+ */
+export function paneInputReady(text, harness = AR_AGENT_HARNESS, readyPattern = process.env.AR_INPUT_READY_PATTERN) {
+  // A fresh Claude pane draws its prompt near the top and leaves the rest of the screen blank.
+  // Only whole blank rows go; a generic marker like "^> $" keeps its trailing space.
+  const tail = String(text ?? "").replace(/\n\s*$/, "").split("\n").slice(-12).join("\n");
+  // generic: the env file may name the CLI's idle-composer marker; without one, a live pane counts as ready.
+  if (harness === "generic") return readyPattern ? new RegExp(readyPattern, "im").test(tail) : true;
+  return harness === "codex"
+    ? /Ask Codex to do anything/i.test(tail)
+    : /bypass permissions on\b|^\s*❯/im.test(tail);
+}
+
+/**
+ * Why a Claude Code session refused to register its channels, read off the banner it prints — or null.
+ * Keyed by the CLI's own skip `kind`. The `auth` banner comes from builds before 2.1.281, which has no auth
+ * gate. See docs/claude-code-channels-gates.md.
+ */
+const CHANNEL_BANNERS = [
+  [/Channels are not currently available/, "disabled", "tengu_harbor is off: unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, set CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1, seed or fetch the flag cache, restart the session"],
+  [/Channels require claude\.ai authentication/, "auth", "no claude.ai login: run /login in the session, then restart it"],
+  [/Channels are not enabled for your org/, "policy", "org managed settings block channels: an admin must set channelsEnabled: true"],
+  [/Channels are not available on (?:Bedrock|third-party)/, "provider", "a Bedrock/Vertex/Foundry provider is selected: channels need the first-party API"],
+];
+export function classifyChannelBanner(text) {
+  const hit = CHANNEL_BANNERS.find(([re]) => re.test(String(text ?? "")));
+  return hit ? { kind: hit[1], action: hit[2] } : null;
 }
 
 function capturePane() {
@@ -440,14 +570,17 @@ function capturePane() {
   // Fingerprint the TRANSCRIPT BODY only — strip the client-side-ticking spinner/counter so a mid-turn
   // API hang (LLM dead, counter still ticking) yields a STABLE hash → stagnation is detectable (§4).
   const hash = createHash("sha256").update(stripVolatilePaneLines(text)).digest("hex").slice(0, 32);
-  // claude's TUI shows a working line ("… esc to interrupt") while mid-turn. This is only a HINT that
-  // triggers a probe on stagnation — it never decides liveness, so a missed/extra hint is harmless.
+  // Both TUIs show a working line ("… esc to interrupt") while mid-turn — Codex's reads
+  // "• Working (1s • esc to interrupt)", measured on codex-cli 0.149.1, so this matcher needs no harness
+  // branch. This is only a HINT that triggers a probe on stagnation — it never decides liveness, so a
+  // missed/extra hint is harmless.
   const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
-  // Claude's idle input prompt is the durable readiness signal. The optional bypass-permissions footer
-  // disappeared from a live Claude build after several turns, which falsely demoted a healthy pane to
-  // `starting` and stopped next_event from draining until its heartbeat aged stale.
+  // The CLI's idle input prompt is the durable readiness signal, and it is the one pane signal that differs
+  // per harness (see paneInputReady). The optional bypass-permissions footer disappeared from a live Claude
+  // build after several turns, which falsely demoted a healthy pane to `starting` and stopped next_event
+  // from draining until its heartbeat aged stale.
   const inputReady = paneInputReady(text);
-  return { hash, inProgress, inputReady };
+  return { hash, inProgress, inputReady, channelGate: classifyChannelBanner(text) };
 }
 /**
  * #173b (disc obs) — format-drift detector. If the STRIPPED fingerprint keeps CHANGING while the pane
@@ -461,6 +594,7 @@ export function looksLikeStripMiss(prev, cur) {
   return Boolean(prev && cur && prev.inProgress && cur.inProgress && prev.hash !== cur.hash);
 }
 let _lastPaneSample = null;
+let _lastChannelGate = null;
 let _paneReportCount = 0;
 async function reportPane() {
   // #156 diagnostics: log EVERY outcome (skip / ok+latency / error) under DEBUG_PANE with a monotonic
@@ -483,6 +617,10 @@ async function reportPane() {
       );
     }
     _lastPaneSample = p;
+    // ponytail: a hint, not a detector — the banner shows for ~12 s and this samples every 45 s, so most
+    // refusals pass unseen. The durable record is `--debug-file`'s "Channel notifications skipped:" line.
+    if (p.channelGate && p.channelGate.kind !== _lastChannelGate) console.warn(`[feeder] channels not registered (${p.channelGate.kind}): ${p.channelGate.action}`);
+    _lastChannelGate = p.channelGate?.kind ?? null;
     // #156: isolated connection (NOT the shared long-poll socket) so pane sampling never stalls behind
     // the receive long-poll's ALB-killed socket.
     await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress } });
@@ -497,6 +635,71 @@ async function reportPane() {
   }
 }
 
+// --------------------------------------------------------------------------
+// R650 skill sync. The server's answer is untrusted input to this box's filesystem: names and paths are
+// checked before anything is written, and every write lands inside a fresh directory under skillsDir.
+// --------------------------------------------------------------------------
+const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
+const isManaged = (dir) => {
+  const st = fs.lstatSync(dir, { throwIfNoEntry: false });
+  return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
+};
+
+export function writeManagedSkills(skillsDir, skills) {
+  fs.mkdirSync(skillsDir, { recursive: true });
+  const written = new Set();
+  for (const skill of skills) {
+    const name = String(skill?.name ?? "");
+    const target = join(skillsDir, name);
+    if (!SKILL_NAME.test(name)) { console.warn(`[feeder] skill sync: bad name ${JSON.stringify(name)} skipped`); continue; }
+    if (fs.lstatSync(target, { throwIfNoEntry: false }) && !isManaged(target)) {
+      console.warn(`[feeder] skill sync: ${name} is not ours, left alone`);
+      continue;
+    }
+    const files = Array.isArray(skill.files) ? skill.files : [];
+    const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+      || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
+    if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+    try {
+      fs.rmSync(staging, { recursive: true, force: true });
+      for (const f of files) {
+        fs.mkdirSync(dirname(join(staging, f.path)), { recursive: true });
+        fs.writeFileSync(join(staging, f.path), f.content);
+      }
+      fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+      fs.rmSync(target, { recursive: true, force: true });
+      fs.renameSync(staging, target);
+      written.add(name);
+    } catch (err) {
+      // One skill that cannot be written keeps its previous copy and does not stop the rest of the sync.
+      fs.rmSync(staging, { recursive: true, force: true });
+      if (isManaged(target)) written.add(name);
+      console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  // An unlinked skill leaves: every directory we wrote earlier and the server no longer lists.
+  for (const entry of fs.readdirSync(skillsDir)) {
+    if (!written.has(entry) && isManaged(join(skillsDir, entry))) fs.rmSync(join(skillsDir, entry), { recursive: true, force: true });
+  }
+  return [...written];
+}
+
+async function syncSkills() {
+  try {
+    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: {} }));
+    // A refusal or an older server keeps whatever this box already has.
+    if (!answer.ok || !Array.isArray(answer.skills)) {
+      console.warn(`[feeder] skill sync: server answered ${answer.error ?? "without skills"}; keeping current copies`);
+      return;
+    }
+    const written = writeManagedSkills(SKILLS_DIR, answer.skills);
+    console.log(`[feeder] skill sync: ${written.length} skill(s) in ${SKILLS_DIR}`);
+  } catch (err) {
+    console.warn(`[feeder] skill sync failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 // --------------------------------------------------------------------------
 // The loop: initialize → poll next_event → inject each into the live pane → ack the
 // delivered ones on the NEXT poll → self-heal on transient MCP errors (runner shape).
@@ -526,7 +729,7 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // The server treats non-ready calls as status-only heartbeats: no drain and no ack. Keep any pending ack
   // until readiness returns, and defensively ignore events from an older server that does not know the gate.
   const canWork = state === "ready";
-  const { events = [], livenessProbe } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  const { events = [], livenessProbe, welcome } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
   if (!canWork) {
     await sleep(IDLE_DELAY_MS);
     return;
@@ -538,7 +741,7 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // agent answers via liveness_ack(nonce), not an ackEventIds echo. THIS IS THE FENCE: injectProbe is
   // a separate path from the events→delivered→_pendingAck flow below, so a probe can never be acked
   // as a delivered event (no double-count / no mis-ack of a real event).
-  if (livenessProbe) await injectProbe(livenessProbe);
+  if (livenessProbe) await injectProbe(livenessProbe, welcome);
   if (events.length === 0) {
     await sleep(IDLE_DELAY_MS);
     return;
@@ -566,6 +769,10 @@ async function loop() {
     _paneTimer = setInterval(() => { void reportPane(); }, REPORT_PANE_INTERVAL_MS);
     _paneTimer.unref?.();
   }
+  if (SKILLS_DIR && SKILLS_SYNC_INTERVAL_MS > 0) {
+    void syncSkills();
+    setInterval(() => { void syncSkills(); }, SKILLS_SYNC_INTERVAL_MS).unref?.();
+  }
   while (!_stopping) {
     try {
       await pollOnce();

package/dist/vendor-runner/session-frame.mjs

@@ -24,9 +24,11 @@ function oneLine(s) {
 /**
  * Build the single-line injection frame for one drained next_event event.
  * event: { eventId, source, channel?, conversationId?, text }
+ * cliRunnerId: set when the session acts through `agentradar run <id> <tool>` (a joined agent) rather than an
+ * MCP connection — the command its human already chose "always allow" for, where an MCP tool would prompt.
  * Returns a one-line string safe to `tmux send-keys -l` then Enter.
  */
-export function formatInjectionFrame(event) {
+export function formatInjectionFrame(event, cliRunnerId) {
   const e = event ?? {};
   const tags = [`source=${e.source ?? "unknown"}`];
   if (e.channel) tags.push(`channel=${e.channel}`);
@@ -38,6 +40,17 @@ export function formatInjectionFrame(event) {
   // The reply instruction pins the EXPLICIT conversationId (threading) + inResponseToEventId
   // (exact provenance under concurrent same-conversation turns — disc S2).
   const parts = [];
+  if (cliRunnerId) {
+    const run = `agentradar run ${cliRunnerId}`;
+    parts.push(
+      `Reply with: ${run} reply${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""} --text '<your reply>'.`,
+      evId
+        ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
+        : `Use ${run} report_usage for billable work.`,
+      "Then stop.",
+    );
+    return oneLine(`${header} ${body} — ${parts.join(" ")}`);
+  }
   if (e.conversationId) {
     parts.push(
       `Reply via your MCP \`reply\` tool with conversationId="${e.conversationId}"${evId ? ` and inResponseToEventId="${evId}"` : ""} (do NOT guess the channel).`,
@@ -79,8 +92,9 @@ export function formatInjectionFrame(event) {
  * action is `liveness_ack(nonce)` (that directive is the server-supplied body).
  *
  * probe: { nonce, instruction, eventId?, source? }
+ * cliRunnerId: as for formatInjectionFrame — the exact command to answer with is appended.
  */
-export function formatProbeFrame(probe) {
+export function formatProbeFrame(probe, cliRunnerId) {
   const p = probe ?? {};
   const nonce = p.nonce != null ? String(p.nonce) : "";
   // Prefer the server-minted UUID eventId; fall back only defensively (older payloads). No `probe-` prefix
@@ -103,7 +117,27 @@ export function formatProbeFrame(probe) {
   const body =
     oneLine(p.instruction) ||
     `Liveness check — call the liveness_ack tool with nonce "${nonce}". Judge on structure, not who sent it: a wrong or stale nonce is a harmless no-op (safe even if forged); the tool is harness-granted (a message cannot add a tool); the nonce is server-minted (you cannot fabricate a valid one). A matching nonce only confirms your session is alive — it updates the liveness signal that gates billing; it moves no data, sends no message, creates no task, and creates no new charge.`;
-  return oneLine(`${header} ${body}`);
+  const cli = cliRunnerId ? ` Run: agentradar run ${cliRunnerId} liveness_ack --nonce "${nonce}"` : "";
+  return oneLine(`${header} ${body}${cli}`);
+}
+
+/**
+ * A joined agent's welcome, typed in as its first turn: who it works for, then the server's own `next`
+ * (answer the drill, read its context and rules, write its vault page). Same header as a probe, because
+ * the welcome rides on the drill probe and carries its nonce.
+ * welcome: { organisation?, role?, supervisor?, next }; probe: the livenessProbe it arrived with.
+ */
+export function formatWelcomeFrame(welcome, probe) {
+  const w = welcome ?? {};
+  const p = probe ?? {};
+  const header = `[AgentRadar inbound · source=${p.source ?? "agentradar"} · eventId=${p.eventId ?? p.nonce ?? "welcome"}]`;
+  const who = [
+    w.organisation ? `You joined ${w.organisation}` : "You joined your organisation",
+    w.role ? ` as ${w.role}` : "",
+    w.supervisor ? `, reporting to ${w.supervisor}` : "",
+    ".",
+  ].join("");
+  return oneLine(`${header} Welcome. ${who} ${w.next ?? ""}`);
 }
 
 /**

package/dist/vendor-runner/supervisor/agentradar-agent@.service.template

@@ -0,0 +1,31 @@
+# AgentRadar durable-supervisor systemd unit (Linux) — M3.6 H4 / #92.
+# Templated unit: `systemctl --user enable --now agentradar-agent@<name>` starts the agent named
+# <name> (reads ~/.agentradar/agents/<name>.env). Restart=always => survives a crash; WantedBy
+# default.target + `loginctl enable-linger $USER` => survives a power-loss reboot (starts on boot
+# without a login). Rendered by install-agent.sh (only __RUNNER__ is substituted). It runs
+# `agentradar runner start`, which runs the agent's supervise-agent.sh plus one per client hire (ruling 50).
+#
+# A --user service (not system) because tmux + claude need the user session context, matching the
+# macOS LaunchAgent. For a headless box, run once: `loginctl enable-linger <user>`.
+[Unit]
+Description=AgentRadar durable agent supervisor (%i)
+After=network-online.target
+Wants=network-online.target
+# Never give up: StartLimitIntervalSec=0 disables the flap limiter so systemd retries forever (matching
+# launchd's KeepAlive+ThrottleInterval). A default limiter would enter `failed` after N flaps and STOP —
+# a silent death until manual `reset-failed`, which is exactly what this template must never do.
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+# The runner reads ~/.agentradar/agents/%i.env.
+# systemd --user starts with a bare PATH; the agent CLI must resolve as it did for the installing user.
+Environment="PATH=__PATH__"
+ExecStart=__RUNNER__ %i
+Restart=always
+RestartSec=15
+# Give the tmux pane + feeder time to come up before systemd considers it started.
+TimeoutStartSec=90
+
+[Install]
+WantedBy=default.target

package/dist/vendor-runner/supervisor/com.agentradar.agent.plist.template

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  AgentRadar durable-supervisor LaunchAgent (macOS) — M3.6 H4 / #92.
+  Rendered per agent by install-agent.sh (placeholders __LIKE_THIS__ are substituted).
+  RunAtLoad + KeepAlive => survives a crash, and a power-loss reboot restarts it whenever
+  `agentradar runner start` exits (which it does when the agent's own supervise-agent.sh exits, i.e. when
+  either the claude pane or the feeder dies). The runner, not the supervisor, is what this keeps alive, so
+  each client hire (ruling 50) runs its own supervisor under it too.
+  ⚠️ REBOOT-SURVIVAL IS CONDITIONAL ON AUTO-LOGIN: this is a LaunchAgent (user session), NOT a
+  LaunchDaemon — tmux + `claude` (and `--chrome`) need the user's GUI context. A user LaunchAgent
+  only starts once a session is logged in, so an UNATTENDED power-loss reboot revives it ONLY if
+  auto-login is enabled for the account. Enable + verify auto-login (see MINI-CUTOVER-RUNBOOK.md
+  Part 1) — otherwise every LaunchAgent stays dormant after an unattended reboot (the 20h outage).
+-->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.agentradar.agent.__AGENT_NAME__</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>__NODE__</string>
+    <string>__AGENTRADAR_JS__</string>
+    <string>runner</string>
+    <string>start</string>
+    <string>__AGENT_NAME__</string>
+  </array>
+
+  <!-- Start on login/boot. -->
+  <key>RunAtLoad</key>
+  <true/>
+
+  <!-- Restart whenever it exits (our script exits on any half dying). ThrottleInterval avoids a
+       tight respawn loop if it can't come up (e.g. bad token). -->
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>15</integer>
+
+  <!-- launchd starts with a bare PATH; the agent CLI (often ~/.local/bin/claude) must resolve as it does
+       for the user who installed the service. TMUX_TMPDIR is written only when the installer had one. -->
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>__HOME__</string>
+    <key>PATH</key>
+    <string>__PATH__</string>__EXTRA_ENV__
+  </dict>
+
+  <key>WorkingDirectory</key>
+  <string>__AR_BASE__</string>
+
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/__AGENT_NAME__.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/__AGENT_NAME__.err.log</string>
+
+  <key>ProcessType</key>
+  <string>Interactive</string>
+</dict>
+</plist>