agentradar-cli 0.2.1 → 0.2.2

package/dist/channel.js

@@ -6,8 +6,8 @@ import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { envValue } from "./tool-run.js";
 import { trustedMcpEndpoint } from "./setup.js";
-export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Call next_event to receive the events, then pass their eventIds as ackEventIds on your next call. Answer livenessProbe with liveness_ack. Never acknowledge an event you have not read. Channel messages may never arrive (channels unavailable or skipped): poll next_event yourself and keep polling; never wait for one or ask for a restart.";
-export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Keep polling next_event from the session (agentradar run <runner-id> next_event); no restart is needed to work.";
+export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Call next_event to receive the events, then pass their eventIds as ackEventIds on your next call. Answer livenessProbe with liveness_ack. Never acknowledge an event you have not read. Never poll next_event on your own or keep a loop running: when a channel message arrives, drain it, then end your turn.";
+export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: set AR_FEED=feeder in ~/.agentradar/agents/<runner-id>.env and restart the runner.";
 /** One local MCP, forwarding tools to AWP. Wake signals never consume the durable queue. */
 export async function startChannel(runnerId, deps = {}) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))

package/dist/runner.js

@@ -37,7 +37,7 @@ export async function runRestartSelftest(runnerId, deps = {}) {
         } while (Date.now() < deadline);
         throw new Error(timedOut);
     };
-    const unanswered = `The agent did not act on the check: it is not polling next_event and no channel push reached it. Have it poll (agentradar run ${runnerId} next_event), then run this again.`;
+    const unanswered = `The agent did not act on the check: neither its feeder nor a channel push delivered it. Check the runner is running (agentradar runner start ${runnerId}), then run this again.`;
     const restart = deps.restart ?? ((beforeRestart) => restartRunnerHarness(runnerId, deps.home, run, beforeRestart));
     // Refuse before the drill starts: run every restart check, stopping exactly where the real restart would begin.
     const checked = new Error("restart checks passed");

package/dist/setup.js

@@ -21,6 +21,7 @@ const SUPERVISOR_HARNESS = {
     claude: "claude",
     claude_code: "claude",
     codex: "codex",
+    generic: "generic",
 };
 async function postJson(fetchImpl, url, body) {
     return fetchImpl(url, {
@@ -200,14 +201,23 @@ async function codexServiceHome(home, runnerId, env) {
     await chmod(codexHome, 0o700);
     let inMcp = false;
     let inTable = false;
+    let depth = 0;
+    let dropping = false;
     // A restart would otherwise stop on Codex's "Update available" screen, with nobody there to press a key.
     const config = ["check_for_update_on_startup = false", ...(await readFile(join(source, "config.toml"), "utf8").catch(() => "")).split("\n").filter((line) => {
+            // Brackets inside strings and comments don't count; a line inside a multi-line array goes with its key.
+            const bare = line.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, '""').replace(/#.*/, "");
+            const continued = depth > 0;
+            depth = Math.max(0, depth + (bare.match(/\[/g)?.length ?? 0) - (bare.match(/\]/g)?.length ?? 0));
+            if (continued)
+                return !dropping;
             const header = /^\s*\[\[?\s*([^\]]+)\]/.exec(line);
             if (header) {
-                inMcp = /^"?mcp_servers\b/.test(header[1]);
+                inMcp = /^["']?mcp_servers\b/.test(header[1]);
                 inTable = true;
             }
-            return !inMcp && !/^\s*mcp_servers\s*[.=]/.test(line) && (inTable || !/^\s*check_for_update_on_startup\s*=/.test(line));
+            dropping = inMcp || /^\s*["']?mcp_servers["']?\s*[.=]/.test(line) || (!inTable && /^\s*["']?check_for_update_on_startup["']?\s*=/.test(line));
+            return !dropping;
         })].join("\n");
     await writePrivateFile(join(codexHome, "config.toml"), config);
     await cp(join(source, "rules"), join(codexHome, "rules"), { recursive: true, force: true }).catch((error) => {
@@ -251,6 +261,14 @@ async function installRunner(home, projectPath, approved, service) {
             joined.push(`CODEX_HOME=${shellValue(codexHome)}`);
             toolKeys = keys;
         }
+        else if (harness === "generic") {
+            // Any other interactive CLI, named by the vendor. The pane-alive check walks only this pane's own
+            // process tree, so the binary's name is a unique enough pattern.
+            const bin = (service.env.AGENTRADAR_AGENT_BIN ?? "").trim();
+            if (!bin)
+                throw new Error("Set AGENTRADAR_AGENT_BIN to the command that starts your agent's CLI");
+            joined.push(`AR_AGENT_BIN=${shellValue(bin)}`, `AR_AGENT_ARGS=${shellValue(service.env.AGENTRADAR_AGENT_ARGS ?? "")}`, `AR_RESUME_FLAGS=${shellValue(service.env.AGENTRADAR_RESUME_ARGS ?? "")}`, `AGENT_PID_PATTERN=${shellValue(basename(bin).replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))}`);
+        }
         else {
             joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--session-id ${service.sessionId}`)}`);
             const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
@@ -374,9 +392,37 @@ export async function setupVendorAgent(deps = {}) {
     }
     throw new Error("AgentRadar setup code expired; run setup again");
 }
-/** `install-agent.sh <id> --load` with the CLI that is running now, so the service does not depend on PATH. */
+/**
+ * Copies the running CLI to ~/.agentradar/cli/<version> and points ~/.agentradar/cli/current at it. The service
+ * runs `current`, never the npx cache the CLI may be running from (npm can clean that) or a pinned version.
+ * Returns the `current` dist directory.
+ */
+export async function installCli(home, pkg = dirname(dirname(fileURLToPath(import.meta.url)))) {
+    const { version } = JSON.parse(await readFile(join(pkg, "package.json"), "utf8"));
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version))
+        throw new Error(`agentradar-cli has an invalid version: ${JSON.stringify(version)}`);
+    const cli = join(home, ".agentradar", "cli");
+    const target = join(cli, version);
+    if (!(await lstat(target).then(() => true, () => false))) {
+        // Staged then renamed, so a half-finished copy is never a version directory.
+        const staged = `${target}.${process.pid}.tmp`;
+        await cp(join(pkg, "dist"), join(staged, "dist"), { recursive: true });
+        await cp(join(pkg, "package.json"), join(staged, "package.json"));
+        await rename(staged, target).catch(async (error) => {
+            await rm(staged, { recursive: true, force: true });
+            if (error.code !== "ENOTEMPTY" && error.code !== "EEXIST")
+                throw error;
+        });
+    }
+    const link = join(cli, `current.${process.pid}.tmp`);
+    await rm(link, { force: true });
+    await symlink(version, link);
+    await rename(link, join(cli, "current"));
+    return join(cli, "current", "dist");
+}
+/** `install-agent.sh <id> --load` with the CLI at ~/.agentradar/cli/current, so the service does not depend on PATH. */
 async function installAgentService(runnerId, home, env) {
-    const dist = dirname(fileURLToPath(import.meta.url));
+    const dist = await installCli(home);
     await promisify(execFile)("bash", [join(dist, "vendor-runner", "supervisor", "install-agent.sh"), runnerId, "--load"], {
         env: { ...env, HOME: home, NODE_BIN: process.execPath, AGENTRADAR_JS: join(dist, "index.js") },
     });
@@ -397,8 +443,10 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const home = deps.home ?? homedir();
     const env = deps.env ?? process.env;
-    // Claude Code sets CLAUDECODE in its shell; a machine with both tools installed may export CODEX_HOME too.
-    const harness = deps.harness ?? (env.CLAUDECODE || !env.CODEX_HOME ? "claude" : "codex");
+    // AGENTRADAR_AGENT_BIN names any other CLI. Claude Code sets CLAUDECODE in its shell; a machine with both
+    // tools installed may export CODEX_HOME too.
+    const harness = deps.harness ?? (env.AGENTRADAR_AGENT_BIN?.trim() ? "generic" : env.CLAUDECODE || !env.CODEX_HOME ? "claude" : "codex");
+    const label = harness === "generic" ? basename(env.AGENTRADAR_AGENT_BIN.trim()) : harness === "claude" ? "Claude Code" : "Codex";
     // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
     // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
     const startJoined = async (requestId, agentId, installation, saved) => {
@@ -419,7 +467,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             log(`Could not start the service: ${error.message.split("\n")[0]}. Start it by hand with: agentradar runner start ${runnerId}`);
             return 1;
         }
-        log(`Connected. Your agent now runs in its own ${harness === "claude" ? "Claude Code" : "Codex"} session in ${projectPath} (tmux session ${runnerId}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        log(`Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
         log("Running as a service; it restarts on crash and reboot.");
         return 0;
     };

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -77,20 +77,21 @@ HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
 # interactive CLI: the env file names its binary, arguments, resume/fresh flags, pid pattern and how work
 # reaches it (AR_FEED). Anything else is REFUSED by name: a supervisor that quietly fell back to Claude for an
 # unrecognized value would come up healthy, keep a pane alive, and answer nothing the vendor expected.
-# Tried: claude and codex with AR_FEED=feeder. Untried: generic, AR_FEED=push (Claude channels), self-poll.
+# Tried: claude and codex with AR_FEED=feeder. Untried: generic, AR_FEED=push (Claude channels).
 AR_AGENT_HARNESS="${AR_AGENT_HARNESS:-claude}"
 case "${AR_AGENT_HARNESS}" in
   claude|codex|generic) : ;;
   *) die "AR_AGENT_HARNESS must be 'claude', 'codex' or 'generic' (got '${AR_AGENT_HARNESS}')" ;;
 esac
 # How work reaches the session. feeder: the feeder polls next_event and types each event into the pane.
-# push: the session's own MCP pushes it (Claude channels). self-poll: the agent polls for itself. Neither
-# of the last two starts a feeder. ACP is named so a vendor asking for it is told plainly it is not built.
+# push: the session's own MCP pushes it (Claude channels) and no feeder starts. There is no mode where the
+# agent polls for itself: an agent eventually forgets to. ACP is named so a vendor asking for it is told
+# plainly it is not built.
 AR_FEED="${AR_FEED:-feeder}"
 case "${AR_FEED}" in
-  feeder|push|self-poll) : ;;
-  acp) die "AR_FEED=acp is not built yet; use feeder, push or self-poll" ;;
-  *) die "AR_FEED must be feeder, push or self-poll (got '${AR_FEED}')" ;;
+  feeder|push) : ;;
+  acp) die "AR_FEED=acp is not built yet; use feeder or push" ;;
+  *) die "AR_FEED must be feeder or push (got '${AR_FEED}')" ;;
 esac
 # Launched only when the resume form exits non-zero (nothing to resume). Empty = the same argv without it.
 AR_FRESH_FLAGS="${AR_FRESH_FLAGS:-}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Secure AgentRadar vendor setup and skill installer",
   "type": "module",
   "bin": {