agentradar-cli 0.2.0 → 0.2.1

package/dist/agentradar-vendor/SKILL.md

@@ -18,7 +18,7 @@ You work on the vendor's computer and connect to AgentRadar through the `agentra
 
 ## Start of every session
 
-Call `get_my_context` on the AgentRadar MCP FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues.
+Call `get_my_context` on the AgentRadar MCP FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
 
 Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own with `report_metric`. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and your direct subordinates — only for real trackable work, never for conversation.
 

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
-import { joinOrganisation, setupVendorAgent } from "./setup.js";
+import { joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
 import { callAwpTool, callToolOverCli, createTaskOverCli, listenOverCli, listServiceToolsOverCli, parseCallArgs, runServiceToolOverCli } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
@@ -15,7 +15,11 @@ export const runArgs = (raw) => raw[0] !== "run" ? raw
 async function main() {
     const args = runArgs(process.argv.slice(2));
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-        console.log("Usage: agentradar run <enrolment-url> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar run <runner-id> listen | agentradar setup [--trust] [--harness claude|codex] | agentradar join <enrolment-url> [--name <n>] [--model <m>] [--trust] | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        console.log("Usage: agentradar run <enrolment-url> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar run <runner-id> listen | agentradar setup [--trust] [--harness claude|codex] | agentradar join <enrolment-url> [--name <n>] [--model <m>] [--trust] | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        return;
+    }
+    if (args[0] === "leave" && args.length === 2) {
+        process.exitCode = await leaveOrganisation(args[1]);
         return;
     }
     if (args.length === 1 && (args[0] === "--version" || args[0] === "-v")) {
@@ -129,7 +133,7 @@ async function main() {
         return;
     }
     const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
-    (help ? console.log : console.error)("Usage: agentradar run <enrolment-url> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar run <runner-id> listen | agentradar setup [--trust] | agentradar join <enrolment-url> [--name <n>] [--model <m>] [--trust] | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+    (help ? console.log : console.error)("Usage: agentradar run <enrolment-url> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar run <runner-id> listen | agentradar setup [--trust] | agentradar join <enrolment-url> [--name <n>] [--model <m>] [--trust] | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
     if (!help)
         process.exitCode = 1;
 }

package/dist/runner.js

@@ -86,8 +86,8 @@ export async function restartRunnerHarness(runnerId, home = homedir(), execute =
     // that pane command, the per-agent argv token, and the executable (Codex's npm wrapper is `node`).
     const codexHome = envValue(contents, "CODEX_HOME");
     const owned = harness === "codex"
-        ? { resume: "AR_RESUME_FLAGS=resume --last", token: codexHome && `CODEX_HOME=${codexHome}`, argv: (args) => args.endsWith(` --cd ${base}`), bin: /(^|\/)codex$/ }
-        : harness === "claude" ? { resume: "AR_RESUME_FLAGS=--continue", token: config, argv: (args) => args.includes(`--mcp-config=${config}`), bin: /(^|\/)claude$/ }
+        ? { resume: `AR_RESUME_FLAGS=${envValue(contents, "AR_RESUME_FLAGS") ?? "resume --last"}`, token: codexHome && `CODEX_HOME=${codexHome}`, argv: (args) => args.endsWith(` --cd ${base}`), bin: /(^|\/)codex$/ }
+        : harness === "claude" ? { resume: `AR_RESUME_FLAGS=${envValue(contents, "AR_RESUME_FLAGS") ?? "--continue"}`, token: config, argv: (args) => args.includes(`--mcp-config=${config}`), bin: /(^|\/)claude$/ }
             : null;
     if (!/^_?[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/.test(session) || !base || !owned?.token) {
         throw new Error("Restart self-test requires an installed Claude or Codex runner with its own tmux pane.");
@@ -252,6 +252,9 @@ export async function startVendorRunner(runnerId, home = homedir(), deps = {}) {
         // shared bearer included — so Codex vendors stay on the shared bearer until a hire can get its own home.
         if (CODEX_HARNESS.test(shared))
             throw new Error("Codex agents keep one shared bearer");
+        // An agent that joined an organisation is that organisation's own; it is never hired.
+        if (envValue(shared, "AR_CLI_RUNNER_ID"))
+            throw new Error("a joined agent has no hires");
         // Each hire's folder is a clone of the brain; copying a plain folder would carry the other clients' work.
         await run("git", ["-C", brain, "rev-parse", "--is-inside-work-tree"]).catch(() => {
             throw new Error(`AR_BASE ${brain} is not a git repository, so each hire cannot get its own clone`);

package/dist/setup.js

@@ -1,9 +1,11 @@
 import { createHash } from "node:crypto";
-import { chmod, lstat, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { chmod, cp, lstat, mkdir, readFile, realpath, rename, rm, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import * as tls from "node:tls";
+import { promisify } from "node:util";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
 /** `ar_` is a vendor runner bearer; `pcp_` is the key an organisation's own agent claims through `join`. */
 const BEARER_SHAPE = /^(?:ar|pcp)_[A-Za-z0-9_-]+$/;
@@ -110,9 +112,10 @@ export function trustedMcpEndpoint(value) {
         endpoint.hostname.endsWith(".localhost"));
     return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
 }
-async function installProjectMcp(configPath, cwd, installation, trust, channelRunnerId) {
-    const endpoint = trustedMcpEndpoint(installation.mcpEndpoint);
-    if (!endpoint || !BEARER_SHAPE.test(installation.bearer)) {
+/** `installation: null` (join) removes the project's `agentradar` entry: a joined agent acts through `agentradar run`. */
+async function installProjectMcp(configPath, cwd, installation, trust) {
+    const endpoint = installation && trustedMcpEndpoint(installation.mcpEndpoint);
+    if (installation && (!endpoint || !BEARER_SHAPE.test(installation.bearer))) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const projectPath = await realpath(cwd);
@@ -140,16 +143,17 @@ async function installProjectMcp(configPath, cwd, installation, trust, channelRu
     const mcpServers = project.mcpServers && typeof project.mcpServers === "object" && !Array.isArray(project.mcpServers)
         ? project.mcpServers
         : {};
-    mcpServers.agentradar = channelRunnerId ? {
-        type: "stdio",
-        command: process.execPath,
-        args: [join(dirname(fileURLToPath(import.meta.url)), "index.js"), "channel", channelRunnerId],
-    } : {
-        type: "http",
-        url: endpoint.toString(),
-        headers: { Authorization: `Bearer ${installation.bearer}` },
-        timeout: 1_800_000,
-    };
+    if (installation && endpoint) {
+        mcpServers.agentradar = {
+            type: "http",
+            url: endpoint.toString(),
+            headers: { Authorization: `Bearer ${installation.bearer}` },
+            timeout: 1_800_000,
+        };
+    }
+    else {
+        delete mcpServers.agentradar;
+    }
     project.mcpServers = mcpServers;
     // SET only, never clear. A later plain `setup` must not revoke a decision an earlier `--trust`
     // run made — that would silently regress a re-onboarding vendor back into the launch prompt, and
@@ -181,7 +185,44 @@ export async function writePrivateFile(path, contents) {
     await rename(tempPath, path);
     await chmod(path, 0o600);
 }
-async function installRunner(home, projectPath, approved) {
+/** The gateway env a session needs to reach its model. Never ANTHROPIC_API_KEY (OAuth or gateway only). */
+const TOOL_ENV = /^(?:ANTHROPIC_(?!API_KEY$)[A-Z0-9_]+|CLAUDE_SECURESTORAGE_CONFIG_DIR)$/;
+/**
+ * The service's Codex home: the vendor's config.toml without its MCP servers (the agent acts through the CLI,
+ * and Codex has no `--strict-mcp-config`), its approval rules copied, its login linked. auth.json is linked,
+ * never read. Returns the home and the env var names its model providers read their key from.
+ * ponytail: a Codex token refresh that rewrites auth.json by rename replaces the link; re-run join if it bites.
+ */
+async function codexServiceHome(home, runnerId, env) {
+    const source = env.CODEX_HOME?.trim() ? resolve(env.CODEX_HOME.trim()) : join(home, ".codex");
+    const codexHome = join(home, ".agentradar", "codex", runnerId);
+    await mkdir(codexHome, { recursive: true, mode: 0o700 });
+    await chmod(codexHome, 0o700);
+    let inMcp = false;
+    let inTable = false;
+    // A restart would otherwise stop on Codex's "Update available" screen, with nobody there to press a key.
+    const config = ["check_for_update_on_startup = false", ...(await readFile(join(source, "config.toml"), "utf8").catch(() => "")).split("\n").filter((line) => {
+            const header = /^\s*\[\[?\s*([^\]]+)\]/.exec(line);
+            if (header) {
+                inMcp = /^"?mcp_servers\b/.test(header[1]);
+                inTable = true;
+            }
+            return !inMcp && !/^\s*mcp_servers\s*[.=]/.test(line) && (inTable || !/^\s*check_for_update_on_startup\s*=/.test(line));
+        })].join("\n");
+    await writePrivateFile(join(codexHome, "config.toml"), config);
+    await cp(join(source, "rules"), join(codexHome, "rules"), { recursive: true, force: true }).catch((error) => {
+        if (error.code !== "ENOENT")
+            throw error;
+    });
+    if (await lstat(join(source, "auth.json")).then(() => true, () => false)) {
+        await symlink(join(source, "auth.json"), join(codexHome, "auth.json")).catch((error) => {
+            if (error.code !== "EEXIST")
+                throw error;
+        });
+    }
+    return { codexHome, keys: [...config.matchAll(/^\s*env_key\s*=\s*"([A-Za-z_][A-Za-z0-9_]*)"/gm)].map((match) => match[1]) };
+}
+async function installRunner(home, projectPath, approved, service) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(approved.runnerId)) {
         throw new Error("AgentRadar returned an invalid runner ID");
     }
@@ -201,7 +242,31 @@ async function installRunner(home, projectPath, approved) {
         throw new Error(`AgentRadar returned a runtime this runner cannot start: ${JSON.stringify(declared)}`);
     const mcpConfig = join(configDir, "awp-only.json");
     const envPath = join(agentDir, `${approved.runnerId}.env`);
-    await writePrivateFile(mcpConfig, `${JSON.stringify({
+    const joined = [];
+    if (service) {
+        joined.push(`AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`);
+        let toolKeys = [];
+        if (harness === "codex") {
+            const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
+            joined.push(`CODEX_HOME=${shellValue(codexHome)}`);
+            toolKeys = keys;
+        }
+        else {
+            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--session-id ${service.sessionId}`)}`);
+            const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
+            if (configDirEnv)
+                joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
+        }
+        const toolEnv = Object.entries(service.env)
+            .filter(([key, value]) => (TOOL_ENV.test(key) || toolKeys.includes(key)) && key !== "ANTHROPIC_API_KEY" && value && !value.includes("\n"))
+            .map(([key, value]) => `${key}=${value}`);
+        if (toolEnv.length) {
+            const toolEnvFile = join(configDir, "tool.env");
+            await writePrivateFile(toolEnvFile, `${toolEnv.join("\n")}\n`);
+            joined.push(`AGENT_TOOL_ENV_FILE=${shellValue(toolEnvFile)}`);
+        }
+    }
+    await writePrivateFile(mcpConfig, `${JSON.stringify(service ? { mcpServers: {} } : {
         mcpServers: {
             agentradar: {
                 type: "http",
@@ -220,6 +285,7 @@ async function installRunner(home, projectPath, approved) {
         // default, so writing `AR_AGENT_HARNESS=claude` unconditionally would change nothing except to make
         // every existing env file look as though a choice had been made.
         ...(harness ? [`AR_AGENT_HARNESS=${shellValue(harness)}`] : []),
+        ...joined,
         "",
     ].join("\n"));
     return envPath;
@@ -308,13 +374,21 @@ export async function setupVendorAgent(deps = {}) {
     }
     throw new Error("AgentRadar setup code expired; run setup again");
 }
+/** `install-agent.sh <id> --load` with the CLI that is running now, so the service does not depend on PATH. */
+async function installAgentService(runnerId, home, env) {
+    const dist = dirname(fileURLToPath(import.meta.url));
+    await promisify(execFile)("bash", [join(dist, "vendor-runner", "supervisor", "install-agent.sh"), runnerId, "--load"], {
+        env: { ...env, HOME: home, NODE_BIN: process.execPath, AGENTRADAR_JS: join(dist, "index.js") },
+    });
+}
 /**
  * Mode A — the organisation's own agent, on its own compute, joining through an enrolment link.
  *
- * accept → wait for a human to approve → claim the key once → install the same MCP config and runner
- * `setup` installs. The one-time claim secret is kept in a 0600 state file per link, so a re-run
- * resumes the wait (or, once claimed, just starts the runner) instead of filing a second request.
- * The key itself is written only into the two 0600 config files and is never printed.
+ * accept → wait for a human to approve → claim the key once → install the runner and start it as a service
+ * (LaunchAgent / systemd user unit) that owns the agent's persistent session. The one-time claim secret is
+ * kept in a 0600 state file per link, so a re-run resumes the wait (or, once claimed, reinstalls and
+ * restarts the service) instead of filing a second request. The key is written only into the 0600 runner
+ * env file and is never printed.
  */
 export async function joinOrganisation(enrolmentUrl, deps = {}) {
     const fetchImpl = deps.fetch ?? fetch;
@@ -322,20 +396,31 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
     const log = deps.log ?? console.log;
     const cwd = deps.cwd ?? process.cwd();
     const home = deps.home ?? homedir();
+    const env = deps.env ?? process.env;
     // Claude Code sets CLAUDECODE in its shell; a machine with both tools installed may export CODEX_HOME too.
-    const harness = deps.harness ?? (process.env.CLAUDECODE || !process.env.CODEX_HOME ? "claude" : "codex");
-    const startJoined = async (runnerId, firstPoll = false) => {
-        if (!firstPoll) {
-            log(`Connected. Runner: ${runnerId}. Now, in this same session, poll for your welcome and work: agentradar run ${runnerId} next_event`);
-            return 0;
+    const harness = deps.harness ?? (env.CLAUDECODE || !env.CODEX_HOME ? "claude" : "codex");
+    // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
+    // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
+    const startJoined = async (requestId, agentId, installation, saved) => {
+        const runnerId = `join-${requestId}`;
+        // The service's Claude session id: a valid UUID derived from the request, so a re-run resumes the same one.
+        const hex = createHash("sha256").update(requestId).digest("hex");
+        const sessionId = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+        const projectPath = harness === "claude"
+            ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
+            : await realpath(cwd);
+        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId, env });
+        await saved?.();
+        log(`Runner installed → ${runnerEnv}`);
+        try {
+            await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
         }
-        // The first poll is the same call the agent makes next, so the welcome arrives without a second harness
-        // prompt and the agent's next bare poll acknowledges it. The key is already saved: a failed poll only says so.
-        log("Connected. Your welcome and first instructions:");
-        const { callToolOverCli } = await import("./tool-run.js");
-        await callToolOverCli(runnerId, "next_event", undefined, { home, fetch: fetchImpl, log })
-            .catch(() => log("Could not fetch them yet."));
-        log(`Runner: ${runnerId}. Do what the instructions above say. Then stay listening: make agentradar run ${runnerId} listen the last step of every turn, ${harness === "claude" ? "in the background (run_in_background), and end your turn; you are woken when it exits" : "in the foreground, and wait for it"}. It prints the next client message as soon as one arrives, or a note after about 9 minutes; answer what it printed, then run it again.`);
+        catch (error) {
+            log(`Could not start the service: ${error.message.split("\n")[0]}. Start it by hand with: agentradar runner start ${runnerId}`);
+            return 1;
+        }
+        log(`Connected. Your agent now runs in its own ${harness === "claude" ? "Claude Code" : "Codex"} session in ${projectPath} (tmux session ${runnerId}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        log("Running as a service; it restarts on crash and reboot.");
         return 0;
     };
     let link;
@@ -350,7 +435,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         throw new Error("That is not an AgentRadar enrolment link (expected https://…/invite/<token>)");
     }
     const api = (path) => new URL(`/api/${path}`, link.origin);
-    const mcpEndpoint = process.env.AWP_MCP_URL || api("mcp").toString();
+    const mcpEndpoint = env.AWP_MCP_URL || api("mcp").toString();
     const joinsDir = join(home, ".agentradar", "joins");
     await mkdir(joinsDir, { recursive: true, mode: 0o700 });
     const statePath = join(joinsDir, `${createHash("sha256").update(token).digest("hex")}.json`);
@@ -364,13 +449,12 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
     }
     if (state?.agentId) {
         log("This enrolment link is already joined on this machine.");
-        const runnerId = `join-${state.requestId}`;
-        const env = await readFile(join(home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
+        const saved = await readFile(join(home, ".agentradar", "agents", `join-${state.requestId}.env`), "utf8").catch(() => "");
         const { envValue } = await import("./tool-run.js");
-        await installProjectMcp(claudeConfigPath(home), cwd, {
-            mcpEndpoint: envValue(env, "AWP_MCP_URL") ?? "", bearer: envValue(env, "AWP_BEARER") ?? "",
-        }, deps.trust === true, harness === "claude" ? runnerId : undefined);
-        return startJoined(runnerId);
+        const bearer = envValue(saved, "AWP_BEARER");
+        if (!bearer)
+            throw new Error("This machine left that organisation (agentradar leave). A key is issued once; ask your organisation for a new enrolment link.");
+        return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer });
     }
     if (!state) {
         const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
@@ -378,7 +462,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             throw new Error("Run join from the agent project folder");
         // Codex has no env var for its model; its config's top-level `model` is the default a session starts on.
         // A codex agent reporting "claude" is guessing (a gateway combo answers as Claude), so the config wins there too.
-        const codexModel = async () => !process.env.CODEX_HOME ? undefined : /^model\s*=\s*"([^"\n]+)"/m.exec((await readFile(join(process.env.CODEX_HOME, "config.toml"), "utf8").catch(() => "")).split(/^\[/m)[0])?.[1];
+        const codexModel = async () => !env.CODEX_HOME ? undefined : /^model\s*=\s*"([^"\n]+)"/m.exec((await readFile(join(env.CODEX_HOME, "config.toml"), "utf8").catch(() => "")).split(/^\[/m)[0])?.[1];
         const model = (!deps.model || deps.model === "unknown" || /claude/i.test(deps.model)) && harness === "codex" ? (await codexModel()) ?? deps.model : deps.model;
         const response = await postJson(fetchImpl, api(`invites/${encodeURIComponent(token)}/accept`), {
             requestType: "agent", agentName, adapterType: "awp_remote",
@@ -421,12 +505,9 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             if (typeof claimed.token !== "string" || typeof claimed.agentId !== "string") {
                 throw new Error("AgentRadar returned an invalid key claim");
             }
-            const installation = { mcpEndpoint, bearer: claimed.token };
-            const projectPath = await installProjectMcp(claudeConfigPath(home), cwd, installation, deps.trust === true, harness === "claude" ? runnerId : undefined);
-            const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId: claimed.agentId, runnerId, installation, harness });
-            await writePrivateFile(statePath, JSON.stringify({ ...state, agentId: claimed.agentId }));
-            log(`Approved. AgentRadar MCP installed for this project, runner installed → ${runnerEnv}`);
-            return startJoined(runnerId, true);
+            log("Approved.");
+            const joined = { ...state, agentId: claimed.agentId };
+            return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, () => writePrivateFile(statePath, JSON.stringify(joined)));
         }
         const said = await failureMessage(response);
         if (response.status === 409 && said.includes("must be approved")) {
@@ -442,4 +523,39 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         throw new Error(said);
     }
 }
+/**
+ * `agentradar leave <runner-id>`: stop and remove the service, end the agent's session, and delete its env
+ * file, bearer and config. The folder the agent worked in stays, with the work.
+ */
+export async function leaveOrganisation(runnerId, deps = {}) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
+        throw new Error("Invalid runner ID");
+    const home = deps.home ?? homedir();
+    const log = deps.log ?? console.log;
+    const execute = deps.execute ?? ((command, args) => promisify(execFile)(command, args));
+    const envPath = join(home, ".agentradar", "agents", `${runnerId}.env`);
+    const saved = await readFile(envPath, "utf8").catch(() => null);
+    if (saved === null) {
+        log(`No agent ${runnerId} on this machine.`);
+        return 1;
+    }
+    const { envValue } = await import("./tool-run.js");
+    if ((deps.platform ?? process.platform) === "darwin") {
+        const label = `com.agentradar.agent.${runnerId}`;
+        await execute("launchctl", ["bootout", `gui/${process.getuid?.()}/${label}`]).catch(() => undefined);
+        await rm(join(home, "Library", "LaunchAgents", `${label}.plist`), { force: true });
+        await rm(join(home, ".agentradar", "staged", `${label}.plist`), { force: true });
+    }
+    else {
+        await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
+    }
+    // The service stopping leaves the session running; `=` matches the tmux session name exactly.
+    await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
+    for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
+        await rm(path, { force: true });
+    for (const dir of ["run", "config", "codex"])
+        await rm(join(home, ".agentradar", dir, runnerId), { recursive: true, force: true });
+    log(`Left: the service is stopped and removed, and its key is deleted. The folder ${envValue(saved, "AR_BASE") ?? ""} stays, with the work.`);
+    return 0;
+}
 //# sourceMappingURL=setup.js.map

package/dist/vendor-runner/feeder.mjs

@@ -2,8 +2,7 @@
 // ===========================================================================
 // AgentRadar I2 feeder — the INTERACTIVE-HOST variant of the vendor runner.
 //
-// Unlike runner.mjs (which spawns a fresh `claude` per event, out-of-context), the
-// feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
+// The feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
 // agent CLI running in a tmux pane (real in-session continuity — I1). R004: that CLI is
 // Claude Code or Codex, selected by AR_AGENT_HARNESS; injection, acking and the
 // in-progress hint are identical on both, and only the login probe, the idle-composer
@@ -27,7 +26,7 @@ import http from "node:http";
 import https from "node:https";
 import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { formatInjectionFrame, formatProbeFrame, sendKeysCommands } from "./session-frame.mjs";
+import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
 
 const PANE_LIVE_SH = join(dirname(fileURLToPath(import.meta.url)), "pane-live.sh");
 
@@ -56,7 +55,9 @@ const TMUX_SESSION = process.env.TMUX_SESSION ?? "agent";
  * `esc to interrupt` working line Claude does (`• Working (1s • esc to interrupt)`), so the existing
  * matchers already cover it and a speculative Codex spinner pattern would be invention, not coverage.
  */
-export const AR_AGENT_HARNESS = process.env.AR_AGENT_HARNESS === "codex" ? "codex" : "claude";
+export const AR_AGENT_HARNESS = ["codex", "generic"].includes(process.env.AR_AGENT_HARNESS) ? process.env.AR_AGENT_HARNESS : "claude";
+// A joined agent acts through `agentradar run <id> …` (its human's "always allow"), so frames name that command.
+const AR_CLI_RUNNER_ID = process.env.AR_CLI_RUNNER_ID || undefined;
 // The agent pid marker (same predicate entrypoint.sh uses) — proves the pane is live. Claude is found by its
 // mcp-config argument; Codex takes its MCP servers from CODEX_HOME (an env var, invisible to `ps`), so its
 // per-agent argv token is `--cd <working dir>`. The supervisor passes an exact pattern; this default only
@@ -72,7 +73,7 @@ const MCP_CALL_TIMEOUT_MS = Number(process.env.AWP_MCP_CALL_TIMEOUT_MS ?? "30000
 // cycle ("fetch failed — re-establishing"). SEPARATE from the server's liveness cadence
 // (NEXT_EVENT_LONGPOLL_MS, pinned 240s) — see #171. Leave NEXT_EVENT_HOLD_MS unset for the 200s default.
 const NEXT_EVENT_HOLD_MS = Number(process.env.NEXT_EVENT_HOLD_MS ?? "200000");
-// Watchdog past the server hold so a dead socket aborts → self-heal (matches runner.mjs). At 200s the
+// Watchdog past the server hold so a dead socket aborts → self-heal. At 200s the
 // watchdog is 230s, still under the ~240s ALB idle-timeout.
 const NEXT_EVENT_TIMEOUT_MS = NEXT_EVENT_HOLD_MS + 30000;
 const IDLE_DELAY_MS = Number(process.env.IDLE_DELAY_MS ?? "1000");
@@ -109,7 +110,7 @@ function sleep(ms) {
 
 // --------------------------------------------------------------------------
 // Minimal MCP client over Streamable-HTTP (initialize + tools/call) — the proven
-// shape from runner.mjs, incl. the dead-socket watchdog + session-id handling.
+// shape, incl. the dead-socket watchdog + session-id handling.
 // --------------------------------------------------------------------------
 let _sessionId = null;
 function parseMcpBody(text) {
@@ -238,10 +239,23 @@ async function nextEvent(ackEventIds, runnerState) {
 // Work readiness — process liveness is not enough. A live Claude process can
 // be blocked on subscription OAuth, where injected work is consumed as the OAuth code.
 // --------------------------------------------------------------------------
-function authProbeEnv(extraNames = []) {
+/** The login probe runs with the pane's env: the allowlist plus the tool-env file (a model gateway's
+ *  ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN, a Codex provider key). Without the file a gateway-authenticated
+ *  pane reads "not logged in" and never receives work. */
+export function authProbeEnv(extraNames = [], source = process.env, readFile = fs.readFileSync) {
   const env = {};
   for (const name of ["HOME", "PATH", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", ...extraNames]) {
-    if (typeof process.env[name] === "string") env[name] = process.env[name];
+    if (typeof source[name] === "string") env[name] = source[name];
+  }
+  if (source.AR_TOOL_ENV_FILE) {
+    let text = "";
+    try { text = readFile(source.AR_TOOL_ENV_FILE, "utf8"); } catch { /* staged by the supervisor; absent = none */ }
+    // Already validated and reserved-key-filtered by the supervisor; never let it replace the allowlist.
+    for (const line of text.split("\n")) {
+      const at = line.indexOf("=");
+      const key = line.slice(0, at);
+      if (at > 0 && !(key in env)) env[key] = line.slice(at + 1);
+    }
   }
   return env;
 }
@@ -276,7 +290,13 @@ export function claudeAuthState(run = spawnSync, readFile = fs.readFileSync) {
  * CODEX_HOME crosses into the probe because it IS the agent's credential home — probing the default
  * ~/.codex would answer about a different login than the one the pane runs on.
  */
-export function codexAuthState(run = spawnSync) {
+export function codexAuthState(run = spawnSync, readFile = fs.readFileSync) {
+  // A custom model_provider (a gateway) authenticates with its own env_key; `codex login status` only
+  // knows the OpenAI login and says "Not logged in" for it forever (measured, 0.149.1).
+  let config = "";
+  try { config = readFile(join(process.env.CODEX_HOME ?? "", "config.toml"), "utf8"); } catch { /* no config */ }
+  const provider = /^model_provider\s*=\s*"([^"]+)"/m.exec(config.split(/^\[/m)[0])?.[1];
+  if (provider && provider !== "openai") return "authenticated";
   const r = run(AGENT_BIN, ["login", "status"], { encoding: "utf8", env: authProbeEnv(["CODEX_HOME"]), timeout: 10000 });
   if (r.status === 0) return "authenticated";
   if (r.status === 1) return "unauthenticated";
@@ -285,6 +305,8 @@ export function codexAuthState(run = spawnSync) {
 
 /** The login probe for whichever CLI this runner drives. */
 export function agentAuthState() {
+  // A generic CLI has no login probe we know of; its pane's input marker is the readiness signal.
+  if (AR_AGENT_HARNESS === "generic") return "authenticated";
   return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
 }
 
@@ -305,6 +327,8 @@ export function paneIsLive(run = spawnSync) {
     env: {
       PATH: process.env.PATH,
       TMUX_BIN: process.env.TMUX_BIN ?? "tmux",
+      // The service's tmux server lives under TMUX_TMPDIR when the installer had one; without it tmux asks /tmp's.
+      ...(process.env.TMUX_TMPDIR ? { TMUX_TMPDIR: process.env.TMUX_TMPDIR } : {}),
       TMUX_SESSION,
       AGENT_PID_PATTERN,
     },
@@ -404,7 +428,7 @@ async function injectEvent(event) {
     return false;
   }
   const injected = await injectFrame(
-    formatInjectionFrame(event),
+    formatInjectionFrame(event, AR_CLI_RUNNER_ID),
     `eventId=${event.eventId} (source=${event.source}, conversationId=${event.conversationId ?? "-"})`,
   );
   if (!injected) return false;
@@ -426,9 +450,18 @@ async function injectEvent(event) {
  *  double-count or mis-ack a real event.
  *  Best-effort: if the pane is dead we DON'T inject (the probe then times out server-side → the
  *  act-signal treats genuine silence as act-dead, the correct verdict). */
-async function injectProbe(probe) {
+// The server re-offers an outstanding probe on every poll and does not hold the poll while it is out, so an
+// un-deduped feeder typed the same check into the pane about once a second. Once per nonce, re-typed only if
+// it is still unanswered after PROBE_REINJECT_MS (the first copy may have been swallowed by a busy pane).
+const PROBE_REINJECT_MS = Number(process.env.PROBE_REINJECT_MS ?? "180000");
+let _lastProbe = { nonce: null, at: 0 };
+export async function injectProbe(probe, welcome, inject = injectFrame, now = Date.now) {
   if (!probe || !probe.nonce || !probe.instruction) return;
-  await injectFrame(formatProbeFrame(probe), `liveness-probe nonce=${probe.nonce}`);
+  if (probe.nonce === _lastProbe.nonce && now() - _lastProbe.at < PROBE_REINJECT_MS) return;
+  const frame = welcome?.next ? formatWelcomeFrame(welcome, probe) : formatProbeFrame(probe, AR_CLI_RUNNER_ID);
+  if (await inject(frame, `${welcome?.next ? "welcome + " : ""}liveness-probe nonce=${probe.nonce}`)) {
+    _lastProbe = { nonce: probe.nonce, at: now() };
+  }
 }
 
 // --------------------------------------------------------------------------
@@ -495,8 +528,12 @@ export function stripVolatilePaneLines(text) {
  * nothing types there except `send-keys`, which submits immediately. Narrow the marker only if a real pane
  * is observed to defeat it.
  */
-export function paneInputReady(text, harness = AR_AGENT_HARNESS) {
-  const tail = String(text ?? "").split("\n").slice(-12).join("\n");
+export function paneInputReady(text, harness = AR_AGENT_HARNESS, readyPattern = process.env.AR_INPUT_READY_PATTERN) {
+  // A fresh Claude pane draws its prompt near the top and leaves the rest of the screen blank.
+  // Only whole blank rows go; a generic marker like "^> $" keeps its trailing space.
+  const tail = String(text ?? "").replace(/\n\s*$/, "").split("\n").slice(-12).join("\n");
+  // generic: the env file may name the CLI's idle-composer marker; without one, a live pane counts as ready.
+  if (harness === "generic") return readyPattern ? new RegExp(readyPattern, "im").test(tail) : true;
   return harness === "codex"
     ? /Ask Codex to do anything/i.test(tail)
     : /bypass permissions on\b|^\s*❯/im.test(tail);
@@ -692,7 +729,7 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // The server treats non-ready calls as status-only heartbeats: no drain and no ack. Keep any pending ack
   // until readiness returns, and defensively ignore events from an older server that does not know the gate.
   const canWork = state === "ready";
-  const { events = [], livenessProbe } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  const { events = [], livenessProbe, welcome } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
   if (!canWork) {
     await sleep(IDLE_DELAY_MS);
     return;
@@ -704,7 +741,7 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // agent answers via liveness_ack(nonce), not an ackEventIds echo. THIS IS THE FENCE: injectProbe is
   // a separate path from the events→delivered→_pendingAck flow below, so a probe can never be acked
   // as a delivered event (no double-count / no mis-ack of a real event).
-  if (livenessProbe) await injectProbe(livenessProbe);
+  if (livenessProbe) await injectProbe(livenessProbe, welcome);
   if (events.length === 0) {
     await sleep(IDLE_DELAY_MS);
     return;

package/dist/vendor-runner/session-frame.mjs

@@ -24,9 +24,11 @@ function oneLine(s) {
 /**
  * Build the single-line injection frame for one drained next_event event.
  * event: { eventId, source, channel?, conversationId?, text }
+ * cliRunnerId: set when the session acts through `agentradar run <id> <tool>` (a joined agent) rather than an
+ * MCP connection — the command its human already chose "always allow" for, where an MCP tool would prompt.
  * Returns a one-line string safe to `tmux send-keys -l` then Enter.
  */
-export function formatInjectionFrame(event) {
+export function formatInjectionFrame(event, cliRunnerId) {
   const e = event ?? {};
   const tags = [`source=${e.source ?? "unknown"}`];
   if (e.channel) tags.push(`channel=${e.channel}`);
@@ -38,6 +40,17 @@ export function formatInjectionFrame(event) {
   // The reply instruction pins the EXPLICIT conversationId (threading) + inResponseToEventId
   // (exact provenance under concurrent same-conversation turns — disc S2).
   const parts = [];
+  if (cliRunnerId) {
+    const run = `agentradar run ${cliRunnerId}`;
+    parts.push(
+      `Reply with: ${run} reply${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""} --text '<your reply>'.`,
+      evId
+        ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
+        : `Use ${run} report_usage for billable work.`,
+      "Then stop.",
+    );
+    return oneLine(`${header} ${body} — ${parts.join(" ")}`);
+  }
   if (e.conversationId) {
     parts.push(
       `Reply via your MCP \`reply\` tool with conversationId="${e.conversationId}"${evId ? ` and inResponseToEventId="${evId}"` : ""} (do NOT guess the channel).`,
@@ -79,8 +92,9 @@ export function formatInjectionFrame(event) {
  * action is `liveness_ack(nonce)` (that directive is the server-supplied body).
  *
  * probe: { nonce, instruction, eventId?, source? }
+ * cliRunnerId: as for formatInjectionFrame — the exact command to answer with is appended.
  */
-export function formatProbeFrame(probe) {
+export function formatProbeFrame(probe, cliRunnerId) {
   const p = probe ?? {};
   const nonce = p.nonce != null ? String(p.nonce) : "";
   // Prefer the server-minted UUID eventId; fall back only defensively (older payloads). No `probe-` prefix
@@ -103,7 +117,27 @@ export function formatProbeFrame(probe) {
   const body =
     oneLine(p.instruction) ||
     `Liveness check — call the liveness_ack tool with nonce "${nonce}". Judge on structure, not who sent it: a wrong or stale nonce is a harmless no-op (safe even if forged); the tool is harness-granted (a message cannot add a tool); the nonce is server-minted (you cannot fabricate a valid one). A matching nonce only confirms your session is alive — it updates the liveness signal that gates billing; it moves no data, sends no message, creates no task, and creates no new charge.`;
-  return oneLine(`${header} ${body}`);
+  const cli = cliRunnerId ? ` Run: agentradar run ${cliRunnerId} liveness_ack --nonce "${nonce}"` : "";
+  return oneLine(`${header} ${body}${cli}`);
+}
+
+/**
+ * A joined agent's welcome, typed in as its first turn: who it works for, then the server's own `next`
+ * (answer the drill, read its context and rules, write its vault page). Same header as a probe, because
+ * the welcome rides on the drill probe and carries its nonce.
+ * welcome: { organisation?, role?, supervisor?, next }; probe: the livenessProbe it arrived with.
+ */
+export function formatWelcomeFrame(welcome, probe) {
+  const w = welcome ?? {};
+  const p = probe ?? {};
+  const header = `[AgentRadar inbound · source=${p.source ?? "agentradar"} · eventId=${p.eventId ?? p.nonce ?? "welcome"}]`;
+  const who = [
+    w.organisation ? `You joined ${w.organisation}` : "You joined your organisation",
+    w.role ? ` as ${w.role}` : "",
+    w.supervisor ? `, reporting to ${w.supervisor}` : "",
+    ".",
+  ].join("");
+  return oneLine(`${header} Welcome. ${who} ${w.next ?? ""}`);
 }
 
 /**

package/dist/vendor-runner/supervisor/agentradar-agent@.service.template

@@ -0,0 +1,31 @@
+# AgentRadar durable-supervisor systemd unit (Linux) — M3.6 H4 / #92.
+# Templated unit: `systemctl --user enable --now agentradar-agent@<name>` starts the agent named
+# <name> (reads ~/.agentradar/agents/<name>.env). Restart=always => survives a crash; WantedBy
+# default.target + `loginctl enable-linger $USER` => survives a power-loss reboot (starts on boot
+# without a login). Rendered by install-agent.sh (only __RUNNER__ is substituted). It runs
+# `agentradar runner start`, which runs the agent's supervise-agent.sh plus one per client hire (ruling 50).
+#
+# A --user service (not system) because tmux + claude need the user session context, matching the
+# macOS LaunchAgent. For a headless box, run once: `loginctl enable-linger <user>`.
+[Unit]
+Description=AgentRadar durable agent supervisor (%i)
+After=network-online.target
+Wants=network-online.target
+# Never give up: StartLimitIntervalSec=0 disables the flap limiter so systemd retries forever (matching
+# launchd's KeepAlive+ThrottleInterval). A default limiter would enter `failed` after N flaps and STOP —
+# a silent death until manual `reset-failed`, which is exactly what this template must never do.
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+# The runner reads ~/.agentradar/agents/%i.env.
+# systemd --user starts with a bare PATH; the agent CLI must resolve as it did for the installing user.
+Environment="PATH=__PATH__"
+ExecStart=__RUNNER__ %i
+Restart=always
+RestartSec=15
+# Give the tmux pane + feeder time to come up before systemd considers it started.
+TimeoutStartSec=90
+
+[Install]
+WantedBy=default.target

package/dist/vendor-runner/supervisor/com.agentradar.agent.plist.template

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  AgentRadar durable-supervisor LaunchAgent (macOS) — M3.6 H4 / #92.
+  Rendered per agent by install-agent.sh (placeholders __LIKE_THIS__ are substituted).
+  RunAtLoad + KeepAlive => survives a crash, and a power-loss reboot restarts it whenever
+  `agentradar runner start` exits (which it does when the agent's own supervise-agent.sh exits, i.e. when
+  either the claude pane or the feeder dies). The runner, not the supervisor, is what this keeps alive, so
+  each client hire (ruling 50) runs its own supervisor under it too.
+  ⚠️ REBOOT-SURVIVAL IS CONDITIONAL ON AUTO-LOGIN: this is a LaunchAgent (user session), NOT a
+  LaunchDaemon — tmux + `claude` (and `--chrome`) need the user's GUI context. A user LaunchAgent
+  only starts once a session is logged in, so an UNATTENDED power-loss reboot revives it ONLY if
+  auto-login is enabled for the account. Enable + verify auto-login (see MINI-CUTOVER-RUNBOOK.md
+  Part 1) — otherwise every LaunchAgent stays dormant after an unattended reboot (the 20h outage).
+-->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.agentradar.agent.__AGENT_NAME__</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>__NODE__</string>
+    <string>__AGENTRADAR_JS__</string>
+    <string>runner</string>
+    <string>start</string>
+    <string>__AGENT_NAME__</string>
+  </array>
+
+  <!-- Start on login/boot. -->
+  <key>RunAtLoad</key>
+  <true/>
+
+  <!-- Restart whenever it exits (our script exits on any half dying). ThrottleInterval avoids a
+       tight respawn loop if it can't come up (e.g. bad token). -->
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>15</integer>
+
+  <!-- launchd starts with a bare PATH; the agent CLI (often ~/.local/bin/claude) must resolve as it does
+       for the user who installed the service. TMUX_TMPDIR is written only when the installer had one. -->
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>__HOME__</string>
+    <key>PATH</key>
+    <string>__PATH__</string>__EXTRA_ENV__
+  </dict>
+
+  <key>WorkingDirectory</key>
+  <string>__AR_BASE__</string>
+
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/__AGENT_NAME__.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/__AGENT_NAME__.err.log</string>
+
+  <key>ProcessType</key>
+  <string>Interactive</string>
+</dict>
+</plist>

package/dist/vendor-runner/supervisor/install-agent.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# =============================================================================
+# AgentRadar durable-supervisor installer (M3.6 H4 / #92).
+# Renders the launchd LaunchAgent (macOS) or systemd unit (Linux) for ONE agent
+# from the template + its env file. STAGE-ONLY by default: it writes the unit to a
+# staging dir and PRINTS the load command — it does NOT load/start anything (so it
+# can never disrupt a running agent). Pass --load to actually install+load.
+#
+#   ./install-agent.sh <agent-name> [--load]
+#
+# The unit runs `agentradar runner start <agent-name>` (the AgentRadar CLI, found on PATH, or NODE_BIN +
+# AGENTRADAR_JS when `agentradar join` calls this with the CLI that is running it), which reads
+# ~/.agentradar/agents/<agent-name>.env and runs the agent's supervisor plus one per client hire.
+#
+# Idempotent: re-rendering overwrites the staged unit; --load reloads it.
+# =============================================================================
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+AGENT_NAME="${1:-}"
+[ -n "${AGENT_NAME}" ] || { echo "usage: $0 <agent-name> [--load]" >&2; exit 2; }
+shift || true
+
+ENV_FILE="${HOME}/.agentradar/agents/${AGENT_NAME}.env"
+DO_LOAD=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --load) DO_LOAD=1; shift ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+[ -f "${ENV_FILE}" ] || { echo "env file not found: ${ENV_FILE} (copy agent.env.example, fill it, chmod 600)" >&2; exit 1; }
+
+# Pull the few values we need to render the unit (without exporting secrets globally).
+# `agentradar setup` writes values single-quoted; the quotes are shell syntax, not part of the value.
+get() { grep -E "^${1}=" "${ENV_FILE}" | tail -1 | cut -d= -f2- | sed -e "s/^'\\(.*\\)'\$/\\1/" ; }
+AR_BASE="$(get AR_BASE)"; [ -n "${AR_BASE}" ] || { echo "AR_BASE missing in ${ENV_FILE}" >&2; exit 1; }
+# launchd and systemd start with a bare PATH, so the unit names node and the CLI by absolute path.
+NODE_BIN="${NODE_BIN:-$(command -v node)}" || { echo "node not found on PATH" >&2; exit 1; }
+if [ -z "${AGENTRADAR_JS:-}" ]; then
+  AGENTRADAR_BIN="$(command -v agentradar)" || { echo "agentradar CLI not found on PATH (npm i -g agentradar-cli)" >&2; exit 1; }
+  AGENTRADAR_JS="$("${NODE_BIN}" -e 'process.stdout.write(require("fs").realpathSync(process.argv[1]))' "${AGENTRADAR_BIN}")"
+fi
+# A pnpm or Volta shim resolves to a shell script, which node cannot run.
+case "${AGENTRADAR_JS}" in *.js) ;; *) echo "agentradar on PATH is not a JavaScript file (${AGENTRADAR_JS}); install it with npm i -g agentradar-cli" >&2; exit 1 ;; esac
+LOG_DIR="${HOME}/.agentradar/logs"; mkdir -p "${LOG_DIR}"
+STAGE_DIR="${HOME}/.agentradar/staged"; mkdir -p "${STAGE_DIR}"
+
+uname_s="$(uname -s)"
+if [ "${uname_s}" = "Darwin" ]; then
+  LABEL="com.agentradar.agent.${AGENT_NAME}"
+  OUT="${STAGE_DIR}/${LABEL}.plist"
+  EXTRA_ENV=""
+  [ -n "${TMUX_TMPDIR:-}" ] && EXTRA_ENV="<key>TMUX_TMPDIR</key><string>${TMUX_TMPDIR}</string>"
+  sed -e "s#__AGENT_NAME__#${AGENT_NAME}#g" \
+      -e "s#__HOME__#${HOME}#g" \
+      -e "s#__PATH__#${PATH}#g" \
+      -e "s#__EXTRA_ENV__#${EXTRA_ENV}#g" \
+      -e "s#__NODE__#${NODE_BIN}#g" \
+      -e "s#__AGENTRADAR_JS__#${AGENTRADAR_JS}#g" \
+      -e "s#__AR_BASE__#${AR_BASE}#g" \
+      -e "s#__LOG_DIR__#${LOG_DIR}#g" \
+      "${HERE}/com.agentradar.agent.plist.template" > "${OUT}"
+  echo "STAGED (not loaded): ${OUT}"
+  if [ "${DO_LOAD}" = "1" ]; then
+    mkdir -p "${HOME}/Library/LaunchAgents"
+    install -m 644 "${OUT}" "${HOME}/Library/LaunchAgents/${LABEL}.plist"
+    launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true
+    launchctl bootstrap "gui/$(id -u)" "${HOME}/Library/LaunchAgents/${LABEL}.plist"
+    echo "LOADED: ${LABEL}"
+  else
+    echo "To load:  install -m 644 '${OUT}' ~/Library/LaunchAgents/${LABEL}.plist && launchctl load ~/Library/LaunchAgents/${LABEL}.plist"
+  fi
+else
+  UNIT="${STAGE_DIR}/agentradar-agent@.service"
+  sed -e "s#__RUNNER__#${NODE_BIN} ${AGENTRADAR_JS} runner start#g" \
+      -e "s#__PATH__#${PATH}#g" \
+      "${HERE}/agentradar-agent@.service.template" > "${UNIT}"
+  echo "STAGED (not loaded): ${UNIT}"
+  if [ "${DO_LOAD}" = "1" ]; then
+    mkdir -p "${HOME}/.config/systemd/user"
+    install -m 644 "${UNIT}" "${HOME}/.config/systemd/user/agentradar-agent@.service"
+    systemctl --user daemon-reload
+    systemctl --user enable --now "agentradar-agent@${AGENT_NAME}"
+    # Linger starts the user manager at boot, so the agent comes back without anyone logging in.
+    if loginctl enable-linger "${USER:-$(id -un)}" 2>/dev/null; then
+      echo "LOADED: agentradar-agent@${AGENT_NAME} (linger on: starts at boot)"
+    else
+      echo "LOADED: agentradar-agent@${AGENT_NAME} (could not enable linger; run 'loginctl enable-linger ${USER:-$(id -un)}' for boot-survival)"
+    fi
+  else
+    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER})"
+  fi
+fi

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -31,9 +31,10 @@ die() { log "FATAL: $*"; exit 1; }
 
 # A launchd LaunchAgent (macOS) / systemd unit gives a MINIMAL PATH (typically /usr/bin:/bin) that
 # lacks Homebrew — where tmux / claude / node live on a dev box. Without this, `command -v tmux` fails
-# on boot and the supervisor crash-loops ("tmux not found"). Prepend the common tool dirs (Apple-Silicon
+# on boot and the supervisor crash-loops ("tmux not found"). APPEND the common tool dirs (Apple-Silicon
 # + Intel Homebrew) so the unit finds them; this PATH also flows to the scrubbed agent launch below.
-export PATH="/opt/homebrew/bin:/usr/local/bin:${PATH:-/usr/bin:/bin}"
+# Appended, not prepended: `agentradar join` pins the vendor's own PATH into the unit, and that order wins.
+export PATH="${PATH:-/usr/bin:/bin}:/opt/homebrew/bin:/usr/local/bin"
 
 # --- 1. Load the per-agent env ------------------------------------------------
 # Env file: $1, or $AGENT_ENV, or ~/.agentradar/agents/<name>.env
@@ -72,14 +73,27 @@ HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
 
 # --- 2a. R004 HARNESS SELECTION — one documented variable picks the CLI ---------
 # The Bible names two agent harnesses: Claude Code and Codex. `claude` is the default, so every existing
-# agent env file keeps launching exactly what it launched before. Anything that is neither is REFUSED by
-# name: a supervisor that quietly fell back to Claude for an unrecognized value would come up healthy,
-# keep a pane alive, and answer nothing the vendor expected.
+# agent env file keeps launching exactly what it launched before. `generic` is the slot for any other
+# interactive CLI: the env file names its binary, arguments, resume/fresh flags, pid pattern and how work
+# reaches it (AR_FEED). Anything else is REFUSED by name: a supervisor that quietly fell back to Claude for an
+# unrecognized value would come up healthy, keep a pane alive, and answer nothing the vendor expected.
+# Tried: claude and codex with AR_FEED=feeder. Untried: generic, AR_FEED=push (Claude channels), self-poll.
 AR_AGENT_HARNESS="${AR_AGENT_HARNESS:-claude}"
 case "${AR_AGENT_HARNESS}" in
-  claude|codex) : ;;
-  *) die "AR_AGENT_HARNESS must be 'claude' or 'codex' (got '${AR_AGENT_HARNESS}')" ;;
+  claude|codex|generic) : ;;
+  *) die "AR_AGENT_HARNESS must be 'claude', 'codex' or 'generic' (got '${AR_AGENT_HARNESS}')" ;;
 esac
+# How work reaches the session. feeder: the feeder polls next_event and types each event into the pane.
+# push: the session's own MCP pushes it (Claude channels). self-poll: the agent polls for itself. Neither
+# of the last two starts a feeder. ACP is named so a vendor asking for it is told plainly it is not built.
+AR_FEED="${AR_FEED:-feeder}"
+case "${AR_FEED}" in
+  feeder|push|self-poll) : ;;
+  acp) die "AR_FEED=acp is not built yet; use feeder, push or self-poll" ;;
+  *) die "AR_FEED must be feeder, push or self-poll (got '${AR_FEED}')" ;;
+esac
+# Launched only when the resume form exits non-zero (nothing to resume). Empty = the same argv without it.
+AR_FRESH_FLAGS="${AR_FRESH_FLAGS:-}"
 
 # What actually differs between the two CLIs, measured against `claude` and codex-cli 0.149.1:
 #   the binary, the resume argument, how connectors are confined, and the argv the pane can be found by.
@@ -89,7 +103,7 @@ if [ "${AR_AGENT_HARNESS}" = "codex" ]; then
   AGENT_BIN="${CODEX_BIN:-codex}"
   # `codex resume --last` continues the most recent recorded session and exits non-zero when there is none,
   # so the launch falls back to a fresh `codex` exactly as the Claude path falls back from `--continue`.
-  AR_RESUME_FLAGS="resume --last"
+  AR_RESUME_FLAGS="${AR_RESUME_FLAGS:-resume --last}"
   # 🔴 CODEX HAS NO `--strict-mcp-config`. Its MCP servers are read from $CODEX_HOME/config.toml, so
   # CODEX_HOME *is* the connector-isolation boundary rather than a convenience, and it is REQUIRED. Point it
   # at a per-agent home whose config.toml declares the AgentRadar MCP and nothing else. Failing closed here
@@ -105,9 +119,20 @@ if [ "${AR_AGENT_HARNESS}" = "codex" ]; then
   # harness (CODEX_HOME is an env var, invisible to `ps -o command=`), so it plays the role the full
   # mcp-config path plays for Claude: a pattern that cannot match another agent's live process.
   _agent_pid_pattern_default="${AGENT_BIN}.*--cd ${AR_BASE}"
+elif [ "${AR_AGENT_HARNESS}" = "generic" ]; then
+  : "${AR_AGENT_BIN:?AR_AGENT_HARNESS=generic requires AR_AGENT_BIN (the CLI to run)}"
+  # No default pattern exists for a CLI we know nothing about, and a loose one would mask this agent's death.
+  : "${AGENT_PID_PATTERN:?AR_AGENT_HARNESS=generic requires AGENT_PID_PATTERN (a ps pattern unique to this agent)}"
+  AGENT_BIN="${AR_AGENT_BIN}"
+  AR_RESUME_FLAGS="${AR_RESUME_FLAGS:-}"
+  # shellcheck disable=SC2086  # AR_AGENT_ARGS word-splits into flags, like the extra flags above.
+  _launch_flags=( ${AR_AGENT_ARGS:-} )
+  _agent_pid_pattern_default=""
 else
   AGENT_BIN="${CLAUDE_BIN}"
-  AR_RESUME_FLAGS="--continue"
+  # `agentradar join` pins `--resume <id>` / `--session-id <id>` so the service never resumes the vendor's
+  # own conversation in the same folder; an env file that sets nothing keeps `--continue`.
+  AR_RESUME_FLAGS="${AR_RESUME_FLAGS:---continue}"
   : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
   # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
   # shellcheck disable=SC2086
@@ -143,7 +168,7 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
     # identity). Reject at parse time (visible warning) AND — belt-and-suspenders — the launch lists
     # the reserved allowlist AFTER TOOL_ENV_ARGS so `env` last-wins keeps reserved vars authoritative.
     case "${_tline%%=*}" in
-      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
+      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
         log "WARN ignoring reserved key '${_tline%%=*}' in ${AGENT_TOOL_ENV_FILE} (cannot override supervisor/agent env)"; continue ;;
     esac
     TOOL_ENV_ARGS+=("${_tline}")
@@ -154,7 +179,12 @@ fi
 # Interactive Claude must use the user's persisted Keychain-backed login. An isolated config or an
 # environment OAuth token selects a different auth contract and can put the TUI back into onboarding.
 # env -i below still scrubs everything else; strict MCP flags, not CLAUDE_CONFIG_DIR, isolate connectors.
-unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN
+# Exception: `agentradar join` (it sets AR_CLI_RUNNER_ID) records the CLAUDE_CONFIG_DIR the vendor's own
+# claude was logged in under, and the service must use that same login. Older env files keep the unset.
+[ -n "${AR_CLI_RUNNER_ID:-}" ] || unset CLAUDE_CONFIG_DIR
+unset CLAUDE_CODE_OAUTH_TOKEN
+_claude_cfg=()
+[ -n "${CLAUDE_CONFIG_DIR:-}" ] && _claude_cfg=( CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" )
 
 # HARD RULE — OAuth only, never a pay-as-you-go API key. Scoped to the Claude harness because that is where
 # the variable decides anything: `claude` prefers ANTHROPIC_API_KEY over the subscription session, so its
@@ -271,6 +301,8 @@ ensure_agent() {
   # session) when there's nothing to resume. Self-healing: once a conversation exists, resume picks it up;
   # if it's ever lost, we cleanly start fresh instead of exit-looping. (--continue exits 1 on no-session,
   # verified — so the `||` fallback is reliable, and `codex resume --last` behaves the same way.)
+  # Only a resume that fails within 30 s falls back. A live session that crashes or is killed later ends the
+  # pane instead, and the watchdog resumes it — a fresh session there would drop the conversation.
   # R004: the resume argument is the ONE harness-specific token inside the wrapper, so it arrives as
   # AR_RESUME_FLAGS ("--continue" or "resume --last") and is word-split there — the same idiom this launch
   # already uses for the extra flags. The wrapper copies it to a local and unsets it before exec so it does
@@ -309,10 +341,10 @@ ensure_agent() {
       TERM="${AR_AGENT_TERM:-tmux-256color}" COLORTERM="${AR_AGENT_COLORTERM:-truecolor}" \
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
-      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${AR_RESUME_FLAGS}" \
+      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${AR_RESUME_FLAGS}" AR_FRESH_FLAGS="${AR_FRESH_FLAGS}" \
       DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
-      ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; unset AR_RESUME_FLAGS; CB="$1"; shift; "$CB" $RF "$@" || exec "$CB" "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
+      ${_claude_cfg[@]+"${_claude_cfg[@]}"} ${_tool_env[@]+"${_tool_env[@]}"} \
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -330,21 +362,30 @@ cleanup() {
   # #152: remove the staged 0600 secret files on exit.
   [ -n "${_SECRETS_DIR:-}" ] && rm -rf "${_SECRETS_DIR}" 2>/dev/null || true
 }
-trap cleanup EXIT INT TERM
+trap cleanup EXIT
+# A TERM handler that returns lets bash carry on looping: launchd/systemd stop (and `agentradar leave`) would
+# wait out their kill timeout. Exit, and the EXIT trap cleans up.
+trap 'exit 143' INT TERM
 
 until ensure_agent; do
   log "agent start failed — retrying in ${HEALTH_POLL_SEC}s"
   sleep "${HEALTH_POLL_SEC}"
 done
 
-log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
-# #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
-# bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
-AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
-  AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
-  node "${FEEDER_JS}" &
-FEEDER_PID=$!
-log "feeder pid ${FEEDER_PID}"
+if [ "${AR_FEED}" = "feeder" ]; then
+  log "starting feeder (${FEEDER_JS}) → session '${TMUX_SESSION}'"
+  # #152: pass AWP_BEARER_FILE (a 0600 PATH), NEVER the raw AWP_BEARER — the feeder reads the file, so the
+  # bearer is not in the feeder process's environment (`ps eww`) or argv. AWP_MCP_URL is not a secret.
+  # AR_TOOL_ENV_FILE: the login probe must see the same gateway env the pane runs with.
+  AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
+    AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
+    AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" \
+    node "${FEEDER_JS}" &
+  FEEDER_PID=$!
+  log "feeder pid ${FEEDER_PID}"
+else
+  log "no feeder (AR_FEED=${AR_FEED}): the session receives its own work"
+fi
 
 # #133 M4 — start the optional feeder bridge (best-effort, isolated). Same 0600 bearer FILE + session env
 # as the feeder; NEVER the raw bearer. Its failure NEVER affects the feeder/agent (nice-to-have terminal).
@@ -371,7 +412,7 @@ start_bridge
 # next_event heartbeat cannot paint the runner Live during recovery. Restart the bridge after a new pane is
 # created because tmux pipe-pane was bound to the dead pane.
 while true; do
-  if ! kill -0 "${FEEDER_PID}" 2>/dev/null; then
+  if [ -n "${FEEDER_PID}" ] && ! kill -0 "${FEEDER_PID}" 2>/dev/null; then
     log "feeder exited — exiting so the service manager restarts the whole unit"
     exit 1
   fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/ && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh",
+    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
     "clean": "rm -rf dist",
     "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit",