agentradar-cli 0.1.9 → 0.2.1

package/dist/vendor-runner/supervisor/install-agent.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# =============================================================================
+# AgentRadar durable-supervisor installer (M3.6 H4 / #92).
+# Renders the launchd LaunchAgent (macOS) or systemd unit (Linux) for ONE agent
+# from the template + its env file. STAGE-ONLY by default: it writes the unit to a
+# staging dir and PRINTS the load command — it does NOT load/start anything (so it
+# can never disrupt a running agent). Pass --load to actually install+load.
+#
+#   ./install-agent.sh <agent-name> [--load]
+#
+# The unit runs `agentradar runner start <agent-name>` (the AgentRadar CLI, found on PATH, or NODE_BIN +
+# AGENTRADAR_JS when `agentradar join` calls this with the CLI that is running it), which reads
+# ~/.agentradar/agents/<agent-name>.env and runs the agent's supervisor plus one per client hire.
+#
+# Idempotent: re-rendering overwrites the staged unit; --load reloads it.
+# =============================================================================
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+AGENT_NAME="${1:-}"
+[ -n "${AGENT_NAME}" ] || { echo "usage: $0 <agent-name> [--load]" >&2; exit 2; }
+shift || true
+
+ENV_FILE="${HOME}/.agentradar/agents/${AGENT_NAME}.env"
+DO_LOAD=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --load) DO_LOAD=1; shift ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+[ -f "${ENV_FILE}" ] || { echo "env file not found: ${ENV_FILE} (copy agent.env.example, fill it, chmod 600)" >&2; exit 1; }
+
+# Pull the few values we need to render the unit (without exporting secrets globally).
+# `agentradar setup` writes values single-quoted; the quotes are shell syntax, not part of the value.
+get() { grep -E "^${1}=" "${ENV_FILE}" | tail -1 | cut -d= -f2- | sed -e "s/^'\\(.*\\)'\$/\\1/" ; }
+AR_BASE="$(get AR_BASE)"; [ -n "${AR_BASE}" ] || { echo "AR_BASE missing in ${ENV_FILE}" >&2; exit 1; }
+# launchd and systemd start with a bare PATH, so the unit names node and the CLI by absolute path.
+NODE_BIN="${NODE_BIN:-$(command -v node)}" || { echo "node not found on PATH" >&2; exit 1; }
+if [ -z "${AGENTRADAR_JS:-}" ]; then
+  AGENTRADAR_BIN="$(command -v agentradar)" || { echo "agentradar CLI not found on PATH (npm i -g agentradar-cli)" >&2; exit 1; }
+  AGENTRADAR_JS="$("${NODE_BIN}" -e 'process.stdout.write(require("fs").realpathSync(process.argv[1]))' "${AGENTRADAR_BIN}")"
+fi
+# A pnpm or Volta shim resolves to a shell script, which node cannot run.
+case "${AGENTRADAR_JS}" in *.js) ;; *) echo "agentradar on PATH is not a JavaScript file (${AGENTRADAR_JS}); install it with npm i -g agentradar-cli" >&2; exit 1 ;; esac
+LOG_DIR="${HOME}/.agentradar/logs"; mkdir -p "${LOG_DIR}"
+STAGE_DIR="${HOME}/.agentradar/staged"; mkdir -p "${STAGE_DIR}"
+
+uname_s="$(uname -s)"
+if [ "${uname_s}" = "Darwin" ]; then
+  LABEL="com.agentradar.agent.${AGENT_NAME}"
+  OUT="${STAGE_DIR}/${LABEL}.plist"
+  EXTRA_ENV=""
+  [ -n "${TMUX_TMPDIR:-}" ] && EXTRA_ENV="<key>TMUX_TMPDIR</key><string>${TMUX_TMPDIR}</string>"
+  sed -e "s#__AGENT_NAME__#${AGENT_NAME}#g" \
+      -e "s#__HOME__#${HOME}#g" \
+      -e "s#__PATH__#${PATH}#g" \
+      -e "s#__EXTRA_ENV__#${EXTRA_ENV}#g" \
+      -e "s#__NODE__#${NODE_BIN}#g" \
+      -e "s#__AGENTRADAR_JS__#${AGENTRADAR_JS}#g" \
+      -e "s#__AR_BASE__#${AR_BASE}#g" \
+      -e "s#__LOG_DIR__#${LOG_DIR}#g" \
+      "${HERE}/com.agentradar.agent.plist.template" > "${OUT}"
+  echo "STAGED (not loaded): ${OUT}"
+  if [ "${DO_LOAD}" = "1" ]; then
+    mkdir -p "${HOME}/Library/LaunchAgents"
+    install -m 644 "${OUT}" "${HOME}/Library/LaunchAgents/${LABEL}.plist"
+    launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true
+    launchctl bootstrap "gui/$(id -u)" "${HOME}/Library/LaunchAgents/${LABEL}.plist"
+    echo "LOADED: ${LABEL}"
+  else
+    echo "To load:  install -m 644 '${OUT}' ~/Library/LaunchAgents/${LABEL}.plist && launchctl load ~/Library/LaunchAgents/${LABEL}.plist"
+  fi
+else
+  UNIT="${STAGE_DIR}/agentradar-agent@.service"
+  sed -e "s#__RUNNER__#${NODE_BIN} ${AGENTRADAR_JS} runner start#g" \
+      -e "s#__PATH__#${PATH}#g" \
+      "${HERE}/agentradar-agent@.service.template" > "${UNIT}"
+  echo "STAGED (not loaded): ${UNIT}"
+  if [ "${DO_LOAD}" = "1" ]; then
+    mkdir -p "${HOME}/.config/systemd/user"
+    install -m 644 "${UNIT}" "${HOME}/.config/systemd/user/agentradar-agent@.service"
+    systemctl --user daemon-reload
+    systemctl --user enable --now "agentradar-agent@${AGENT_NAME}"
+    # Linger starts the user manager at boot, so the agent comes back without anyone logging in.
+    if loginctl enable-linger "${USER:-$(id -un)}" 2>/dev/null; then
+      echo "LOADED: agentradar-agent@${AGENT_NAME} (linger on: starts at boot)"
+    else
+      echo "LOADED: agentradar-agent@${AGENT_NAME} (could not enable linger; run 'loginctl enable-linger ${USER:-$(id -un)}' for boot-survival)"
+    fi
+  else
+    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER})"
+  fi
+fi

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -7,10 +7,11 @@
 # all env params). It idempotently ensures BOTH halves of an always-on agent are
 # up, then blocks so KeepAlive/Restart revives the whole thing on any death:
 #
-#   1. a tmux session ($TMUX_SESSION) running the agent:
+#   1. a tmux session ($TMUX_SESSION) running the agent CLI named by $AR_AGENT_HARNESS:
 #        claude --continue $CLAUDE_EXTRA_FLAGS --strict-mcp-config --mcp-config=$MCP_CONFIG
-#      in $AR_BASE, with a SCRUBBED allowlist env + the macOS user's normal
-#      Keychain-backed Claude session. Strict MCP flags allow ONLY AgentRadar's config;
+#        codex resume --last $CODEX_EXTRA_FLAGS --cd $AR_BASE   (MCP confined by $CODEX_HOME)
+#      in $AR_BASE, with a SCRUBBED allowlist env + the CLI's own persisted login.
+#      Strict MCP flags (Claude) / a per-agent CODEX_HOME (Codex) allow ONLY AgentRadar's config;
 #   2. the feeder ($FEEDER_JS) OUTSIDE that session, holding $AWP_BEARER, long-
 #      polling next_event and tmux-injecting each event into the pane.
 #
@@ -20,7 +21,8 @@
 # starts it on boot → same. Composes with the stateless AWP MCP (#111/#112:
 # reconnect, no -32001) + `claude --continue` (context resumes) = hands-free revive.
 #
-# HARD RULE: claude.ai OAuth ONLY. Refuses to start if ANTHROPIC_API_KEY is set.
+# HARD RULE (claude harness): claude.ai OAuth ONLY. Refuses to start if
+# ANTHROPIC_API_KEY is set. Codex authenticates only through $CODEX_HOME/auth.json.
 # =============================================================================
 set -euo pipefail
 
@@ -29,9 +31,10 @@ die() { log "FATAL: $*"; exit 1; }
 
 # A launchd LaunchAgent (macOS) / systemd unit gives a MINIMAL PATH (typically /usr/bin:/bin) that
 # lacks Homebrew — where tmux / claude / node live on a dev box. Without this, `command -v tmux` fails
-# on boot and the supervisor crash-loops ("tmux not found"). Prepend the common tool dirs (Apple-Silicon
+# on boot and the supervisor crash-loops ("tmux not found"). APPEND the common tool dirs (Apple-Silicon
 # + Intel Homebrew) so the unit finds them; this PATH also flows to the scrubbed agent launch below.
-export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH:-/usr/bin:/bin}"
+# Appended, not prepended: `agentradar join` pins the vendor's own PATH into the unit, and that order wins.
+export PATH="${PATH:-/usr/bin:/bin}:/opt/homebrew/bin:/usr/local/bin"
 
 # --- 1. Load the per-agent env ------------------------------------------------
 # Env file: $1, or $AGENT_ENV, or ~/.agentradar/agents/<name>.env
@@ -51,7 +54,6 @@ set +a
 : "${AR_BASE:?AR_BASE required (the agent working dir)}"
 : "${AWP_MCP_URL:?AWP_MCP_URL required}"
 : "${AWP_BEARER:?AWP_BEARER required}"
-: "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
 TMUX_SESSION="${TMUX_SESSION:-${AGENT_NAME}}"
 FEEDER_JS="${FEEDER_JS:-$(cd "$(dirname "$0")/.." && pwd)/feeder.mjs}"
 PANE_LIVE_SH="${PANE_LIVE_SH:-$(cd "$(dirname "$0")/.." && pwd)/pane-live.sh}"
@@ -68,11 +70,80 @@ BROWSER_APP="${BROWSER_APP:-Google Chrome}"          # #150: app to ensure-up fo
 BROWSER_READY_MAX_SEC="${BROWSER_READY_MAX_SEC:-20}" # #150: bounded wait for the browser proc on cold boot
 BROWSER_READY_SETTLE_SEC="${BROWSER_READY_SETTLE_SEC:-3}" # #150: settle for extension/native-host after cold launch
 HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
-# Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
-# differs by directory), NOT the basename: on a multi-agent box every agent's config is named
-# `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
-# death (silent death — the exact failure #145 kills). Override per agent for extra scoping if needed.
-AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-mcp-config.*${MCP_CONFIG}}"
+
+# --- 2a. R004 HARNESS SELECTION — one documented variable picks the CLI ---------
+# The Bible names two agent harnesses: Claude Code and Codex. `claude` is the default, so every existing
+# agent env file keeps launching exactly what it launched before. `generic` is the slot for any other
+# interactive CLI: the env file names its binary, arguments, resume/fresh flags, pid pattern and how work
+# reaches it (AR_FEED). Anything else is REFUSED by name: a supervisor that quietly fell back to Claude for an
+# unrecognized value would come up healthy, keep a pane alive, and answer nothing the vendor expected.
+# Tried: claude and codex with AR_FEED=feeder. Untried: generic, AR_FEED=push (Claude channels), self-poll.
+AR_AGENT_HARNESS="${AR_AGENT_HARNESS:-claude}"
+case "${AR_AGENT_HARNESS}" in
+  claude|codex|generic) : ;;
+  *) die "AR_AGENT_HARNESS must be 'claude', 'codex' or 'generic' (got '${AR_AGENT_HARNESS}')" ;;
+esac
+# How work reaches the session. feeder: the feeder polls next_event and types each event into the pane.
+# push: the session's own MCP pushes it (Claude channels). self-poll: the agent polls for itself. Neither
+# of the last two starts a feeder. ACP is named so a vendor asking for it is told plainly it is not built.
+AR_FEED="${AR_FEED:-feeder}"
+case "${AR_FEED}" in
+  feeder|push|self-poll) : ;;
+  acp) die "AR_FEED=acp is not built yet; use feeder, push or self-poll" ;;
+  *) die "AR_FEED must be feeder, push or self-poll (got '${AR_FEED}')" ;;
+esac
+# Launched only when the resume form exits non-zero (nothing to resume). Empty = the same argv without it.
+AR_FRESH_FLAGS="${AR_FRESH_FLAGS:-}"
+
+# What actually differs between the two CLIs, measured against `claude` and codex-cli 0.149.1:
+#   the binary, the resume argument, how connectors are confined, and the argv the pane can be found by.
+# Everything else below — the env -i allowlist, the 0600 bearer file, the feeder, the bridge, the recovery
+# loop — is shared, because nothing about it is harness-specific.
+if [ "${AR_AGENT_HARNESS}" = "codex" ]; then
+  AGENT_BIN="${CODEX_BIN:-codex}"
+  # `codex resume --last` continues the most recent recorded session and exits non-zero when there is none,
+  # so the launch falls back to a fresh `codex` exactly as the Claude path falls back from `--continue`.
+  AR_RESUME_FLAGS="${AR_RESUME_FLAGS:-resume --last}"
+  # 🔴 CODEX HAS NO `--strict-mcp-config`. Its MCP servers are read from $CODEX_HOME/config.toml, so
+  # CODEX_HOME *is* the connector-isolation boundary rather than a convenience, and it is REQUIRED. Point it
+  # at a per-agent home whose config.toml declares the AgentRadar MCP and nothing else. Failing closed here
+  # is the point: letting it default to the vendor's own ~/.codex would hand the client's agent every MCP
+  # server that vendor has ever configured — exactly the exposure `--strict-mcp-config` closes on the Claude
+  # path, and it would present as a working agent.
+  [ -n "${CODEX_HOME:-}" ] || die "AR_AGENT_HARNESS=codex requires CODEX_HOME — a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server"
+  [ -d "${CODEX_HOME}" ] || die "CODEX_HOME not found: ${CODEX_HOME}"
+  CODEX_EXTRA_FLAGS="${CODEX_EXTRA_FLAGS:-}"
+  # shellcheck disable=SC2086  # CODEX_EXTRA_FLAGS is intentionally unquoted so it word-splits into flags.
+  _launch_flags=( ${CODEX_EXTRA_FLAGS} --cd "${AR_BASE}" )
+  # Pane-alive predicate — MUST be unique per agent. `--cd <AR_BASE>` is the per-agent argv token on this
+  # harness (CODEX_HOME is an env var, invisible to `ps -o command=`), so it plays the role the full
+  # mcp-config path plays for Claude: a pattern that cannot match another agent's live process.
+  _agent_pid_pattern_default="${AGENT_BIN}.*--cd ${AR_BASE}"
+elif [ "${AR_AGENT_HARNESS}" = "generic" ]; then
+  : "${AR_AGENT_BIN:?AR_AGENT_HARNESS=generic requires AR_AGENT_BIN (the CLI to run)}"
+  # No default pattern exists for a CLI we know nothing about, and a loose one would mask this agent's death.
+  : "${AGENT_PID_PATTERN:?AR_AGENT_HARNESS=generic requires AGENT_PID_PATTERN (a ps pattern unique to this agent)}"
+  AGENT_BIN="${AR_AGENT_BIN}"
+  AR_RESUME_FLAGS="${AR_RESUME_FLAGS:-}"
+  # shellcheck disable=SC2086  # AR_AGENT_ARGS word-splits into flags, like the extra flags above.
+  _launch_flags=( ${AR_AGENT_ARGS:-} )
+  _agent_pid_pattern_default=""
+else
+  AGENT_BIN="${CLAUDE_BIN}"
+  # `agentradar join` pins `--resume <id>` / `--session-id <id>` so the service never resumes the vendor's
+  # own conversation in the same folder; an env file that sets nothing keeps `--continue`.
+  AR_RESUME_FLAGS="${AR_RESUME_FLAGS:---continue}"
+  : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
+  # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
+  # shellcheck disable=SC2086
+  _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
+  # differs by directory), NOT the basename: on a multi-agent box every agent's config is named
+  # `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
+  # death (silent death — the exact failure #145 kills). Override per agent for extra scoping if needed.
+  _agent_pid_pattern_default="mcp-config.*${MCP_CONFIG}"
+fi
+AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-${_agent_pid_pattern_default}}"
 
 # Optional per-agent TOOL credentials — a vendor brain's OWN MCP-tool API keys (e.g. an SEO agent's
 # WEBFLOW_TOKEN / PERPLEXITY_API_KEY). These are ADDED to the scrubbed launch env so the agent's own
@@ -97,7 +168,7 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
     # identity). Reject at parse time (visible warning) AND — belt-and-suspenders — the launch lists
     # the reserved allowlist AFTER TOOL_ENV_ARGS so `env` last-wins keeps reserved vars authoritative.
     case "${_tline%%=*}" in
-      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
+      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
         log "WARN ignoring reserved key '${_tline%%=*}' in ${AGENT_TOOL_ENV_FILE} (cannot override supervisor/agent env)"; continue ;;
     esac
     TOOL_ENV_ARGS+=("${_tline}")
@@ -108,13 +179,25 @@ fi
 # Interactive Claude must use the user's persisted Keychain-backed login. An isolated config or an
 # environment OAuth token selects a different auth contract and can put the TUI back into onboarding.
 # env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
-unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
+# Exception: `agentradar join` (it sets AR_CLI_RUNNER_ID) records the CLAUDE_CONFIG_DIR the vendor's own
+# claude was logged in under, and the service must use that same login. Older env files keep the unset.
+[ -n "${AR_CLI_RUNNER_ID:-}" ] || unset CLAUDE_CONFIG_DIR
+unset CLAUDE_CODE_OAUTH_TOKEN
+_claude_cfg=()
+[ -n "${CLAUDE_CONFIG_DIR:-}" ] && _claude_cfg=( CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" )
 
-# HARD RULE — OAuth only, never a pay-as-you-go API key.
-[ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
+# HARD RULE — OAuth only, never a pay-as-you-go API key. Scoped to the Claude harness because that is where
+# the variable decides anything: `claude` prefers ANTHROPIC_API_KEY over the subscription session, so its
+# mere presence changes who pays. `codex` (>= 0.122) ignores OPENAI_API_KEY entirely and reads credentials
+# only from $CODEX_HOME/auth.json, so there is no equivalent env var to refuse — a Codex vendor chooses
+# subscription or API-key billing by how that home was logged in, and a refusal here would guard nothing
+# while blocking boxes that carry the variable for unrelated work.
+if [ "${AR_AGENT_HARNESS}" = "claude" ]; then
+  [ -z "${ANTHROPIC_API_KEY:-}" ] || die "ANTHROPIC_API_KEY is set — refuse to start (claude.ai OAuth only)"
+fi
 
 command -v "${TMUX_BIN}" >/dev/null 2>&1 || die "tmux not found (${TMUX_BIN})"
-command -v "${CLAUDE_BIN}" >/dev/null 2>&1 || die "claude CLI not found (${CLAUDE_BIN})"
+command -v "${AGENT_BIN}" >/dev/null 2>&1 || die "${AR_AGENT_HARNESS} CLI not found (${AGENT_BIN})"
 [ -f "${FEEDER_JS}" ] || die "feeder not found: ${FEEDER_JS}"
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
@@ -210,17 +293,20 @@ ensure_agent() {
   # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
-  log "starting agent in tmux '${TMUX_SESSION}' (flags: ${CLAUDE_EXTRA_FLAGS:-none}; tool-env file: ${_TOOL_ENV_FILE:-none})"
-  # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
+  log "starting agent (${AR_AGENT_HARNESS}) in tmux '${TMUX_SESSION}' (tool-env file: ${_TOOL_ENV_FILE:-none})"
   # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
   # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
-  # crash-loops. So try `--continue`, and FALL BACK to a fresh `claude` (which stays up AND creates the
-  # session) when there's nothing to resume. Self-healing: once a conversation exists, --continue resumes it;
+  # crash-loops. So try the resume form, and FALL BACK to a fresh session (which stays up AND creates the
+  # session) when there's nothing to resume. Self-healing: once a conversation exists, resume picks it up;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
-  # verified — so the `||` fallback is reliable.) The `/bin/sh -c` wrapper keeps EXTRA_FLAGS word-splitting.
-  # shellcheck disable=SC2086
-  _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # verified — so the `||` fallback is reliable, and `codex resume --last` behaves the same way.)
+  # Only a resume that fails within 30 s falls back. A live session that crashes or is killed later ends the
+  # pane instead, and the watchdog resumes it — a fresh session there would drop the conversation.
+  # R004: the resume argument is the ONE harness-specific token inside the wrapper, so it arrives as
+  # AR_RESUME_FLAGS ("--continue" or "resume --last") and is word-split there — the same idiom this launch
+  # already uses for the extra flags. The wrapper copies it to a local and unsets it before exec so it does
+  # not linger in the agent's environment.
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
@@ -239,6 +325,10 @@ ensure_agent() {
   # visible once there is colour to look at. LC_ALL stays empty on purpose: an empty LC_ALL does not
   # override, so LC_CTYPE governs and a vendor can still set LANG per agent.
   #
+  # Channels: CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 keeps the tengu_harbor flag readable from the
+  # disk cache even if telemetry is off, and it and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC are reserved so a
+  # tool file cannot turn channels off. See docs/claude-code-channels-gates.md.
+  #
   # 🔴 This comment block lives ABOVE the command, not inside it. A `#` comment between two
   # `\`-continued lines TERMINATES the command at its unescaped newline: tmux would receive only the
   # args up to SHELL=…, the pane would start with no `claude` at all, and the `TERM=… claude` tail
@@ -251,9 +341,10 @@ ensure_agent() {
       TERM="${AR_AGENT_TERM:-tmux-256color}" COLORTERM="${AR_AGENT_COLORTERM:-truecolor}" \
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
-      DISABLE_AUTOUPDATER=1 \
-      ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; CB="$1"; shift; "$CB" --continue "$@" || exec "$CB" "$@"' sh "${CLAUDE_BIN}" "${_launch_flags[@]}" || {
+      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${AR_RESUME_FLAGS}" AR_FRESH_FLAGS="${AR_FRESH_FLAGS}" \
+      DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
+      ${_claude_cfg[@]+"${_claude_cfg[@]}"} ${_tool_env[@]+"${_tool_env[@]}"} \
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -271,20 +362,30 @@ cleanup() {
   # #152: remove the staged 0600 secret files on exit.
   [ -n "${_SECRETS_DIR:-}" ] && rm -rf "${_SECRETS_DIR}" 2>/dev/null || true
 }
-trap cleanup EXIT INT TERM
+trap cleanup EXIT
+# A TERM handler that returns lets bash carry on looping: launchd/systemd stop (and `agentradar leave`) would
+# wait out their kill timeout. Exit, and the EXIT trap cleans up.
+trap 'exit 143' INT TERM
 
 until ensure_agent; do
   log "agent start failed — retrying in ${HEALTH_POLL_SEC}s"
   sleep "${HEALTH_POLL_SEC}"
 done
 
-log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
-# #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
-# bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
-AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" CLAUDE_BIN="${CLAUDE_BIN}" node "${FEEDER_JS}" &
-FEEDER_PID=$!
-log "feeder pid ${FEEDER_PID}"
+if [ "${AR_FEED}" = "feeder" ]; then
+  log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
+  # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
+  # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
+  # AR_TOOL_ENV_FILE: the login probe must see the same gateway env the pane runs with.
+  AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
+    AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
+    AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" \
+    node "${FEEDER_JS}" &
+  FEEDER_PID=$!
+  log "feeder pid ${FEEDER_PID}"
+else
+  log "no feeder (AR_FEED=${AR_FEED}): the session receives its own work"
+fi
 
 # #133 M4 — start the optional feeder bridge (best-effort, isolated). Same 0600 bearer FILE + session env
 # as the feeder; NEVER the raw bearer. Its failure NEVER affects the feeder/agent (nice-to-have terminal).
@@ -311,12 +412,12 @@ start_bridge
 # next_event heartbeat cannot paint the runner Live during recovery. Restart the bridge after a new pane is
 # created because tmux pipe-pane was bound to the dead pane.
 while true; do
-  if ! kill -0 "${FEEDER_PID}" 2>/dev/null; then
+  if [ -n "${FEEDER_PID}" ] && ! kill -0 "${FEEDER_PID}" 2>/dev/null; then
     log "feeder exited — exiting so the service manager restarts the whole unit"
     exit 1
   fi
   if ! pane_alive; then
-    log "agent claude pane died — recovering it in place"
+    log "agent pane died — recovering it in place"
     if ensure_agent; then
       if [ -n "${BRIDGE_PID}" ]; then
         kill "${BRIDGE_PID}" 2>/dev/null || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.1.9",
+  "version": "0.2.1",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {
@@ -10,7 +10,9 @@
     "dist/index.js",
     "dist/setup.js",
     "dist/runner.js",
+    "dist/channel.js",
     "dist/skill-install.js",
+    "dist/tool-run.js",
     "dist/sync.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",
@@ -21,7 +23,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/ && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh",
+    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
     "clean": "rm -rf dist",
     "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit",