agentradar-cli 0.2.10 → 0.3.0

package/dist/agent-guard/hooks/hooks.json

@@ -1,6 +1,7 @@
 {
-  "description": "Blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
+  "description": "Marks the session as guarded (the runner reports ready only then); blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
   "hooks": {
+    "SessionStart": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" start", "timeout": 10 }] }],
     "Stop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
     "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
     "PreCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }] }],

package/dist/agent-guard/scripts/guard.mjs

@@ -6,6 +6,8 @@
 //         blocks the stop while a message or task is unacknowledged, at most MAX_BLOCKS times in a row.
 //         Tasks still in progress get one reminder. Anything unexpected (no runner, server down, bad
 //         output) lets the agent stop: a guard that wedges the session is worse than no guard.
+// start:  writes AR_GUARD_MARKER, the runner's proof that this session loaded the guard: its feeder and
+//         channel report "starting", never "ready", until the file exists (AGENT-GUARD-ACTIVE, Vadym 10699).
 // prompt: every AR_DISCIPLINE_EVERY turns (default 20, 0 = off) re-adds the house rules, the must-nots
 //         and the installed skills to the context.
 import { spawnSync } from "node:child_process";
@@ -58,7 +60,9 @@ function skills() {
   return [...names].sort();
 }
 
-if (process.argv[2] === "prompt") {
+if (process.argv[2] === "start") {
+  if (process.env.AR_GUARD_MARKER) writeFileSync(process.env.AR_GUARD_MARKER, `${input.session_id ?? ""}\n`);
+} else if (process.argv[2] === "prompt") {
   const every = Number.parseInt(process.env.AR_DISCIPLINE_EVERY ?? "20", 10);
   // No reset of `blocks` here: Codex may run this hook for a Stop continuation, which would lift the cap.
   state.turns += 1;

package/dist/agentradar-vendor/SKILL.md

@@ -20,9 +20,11 @@ You work on the vendor's computer and connect to AgentRadar through the `agentra
 
 Call `get_my_context` on the AgentRadar MCP FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
 
+Keep each person's page in company memory current, every fact cited, as the People section of the `agentradar-memory-and-skills` skill says. A page is knowledge, never permission.
+
 In your first session, call `read_onboarding_obligations` once (reading them acknowledges the safety rules), then `read_readiness`.
 
-Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own with `report_metric`, backed by `evidence` of what you counted it from, or by `fromEventId` when a person told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and your direct subordinates — only for real trackable work, never for conversation.
+Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a person told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
 
 ## Talking to people
 

package/dist/channel.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
@@ -78,7 +79,9 @@ export async function startChannel(runnerId, deps = {}) {
                 if (unconfirmed === "reported" && agentPolled)
                     unconfirmed = null;
                 // While reported, no runnerState: the stored state stands, and the poll still drains for wake signals.
-                const response = await next(unconfirmed ? {} : { runnerState: "ready" });
+                // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
+                const guarded = !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
+                const response = await next(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" });
                 if (response.error || response.result?.isError)
                     throw new Error("AgentRadar refused next_event; check the runner key and its poll permission");
                 const content = response.result?.content;

package/dist/commands.js

@@ -0,0 +1,74 @@
+/**
+ * Vadym 9970 (CLI-FIRST): every agent-facing MCP tool is also a CLI command, `agentradar run <runner-id> <noun> <verb>`,
+ * in AgentRadar terms. The tree is derived from the server's own tools/list at call time, so it cannot fall behind
+ * the MCP; this file only says how a tool name reads as a noun and a verb.
+ */
+/** Nouns a tool name is grouped under, most specific first. A tool takes the first one its name contains. */
+const NOUNS = [
+    "inbox", "thread", "message", "task", "metric", "quota", "vault", "memory", "skill", "escalation", "incident",
+    "karma", "wallet", "spend", "budget", "usage", "browser", "email", "telegram", "slack", "discord", "whatsapp",
+    "github", "model", "outcome", "role", "org_chart", "org", "project", "integration", "channel", "peer",
+    "subordinate", "secret", "service", "onboarding", "intervention", "marketplace", "hire", "egress", "feedback",
+    "contact", "placement", "mcp", "tool", "join_link", "handoff", "selftest", "readiness", "pane", "brief",
+    "teammate", "approval", "agent",
+];
+const PLURAL = {
+    messages: "message", tasks: "task", metrics: "metric", vaults: "vault", skills: "skill", escalations: "escalation",
+    threads: "thread", channels: "channel", peers: "peer", subordinates: "subordinate", integrations: "integration",
+    secrets: "secret", agents: "agent", interventions: "intervention", events: "event", retrospectives: "retrospective",
+};
+/** Where the rule above would put a tool somewhere an agent would not look for it. */
+const OVERRIDES = {
+    next_event: ["inbox", "next"],
+    mark_messages_read: ["inbox", "mark-read"],
+    search_history: ["thread", "history"],
+    reply: ["thread", "reply"],
+    read_history: ["thread", "read"],
+    mark_read: ["thread", "mark-read"],
+    expect_reply: ["thread", "expect-reply"],
+    clear_reply_allowance: ["thread", "clear-reply-allowance"],
+    request_reply_clearance: ["thread", "request-reply-clearance"],
+    github_thread: ["github", "thread"],
+    post_escalation_discussion_message: ["escalation", "post-message"],
+    read_escalation_discussion: ["escalation", "read-discussion"],
+    get_self: ["agent", "self"],
+    get_my_context: ["agent", "context"],
+    liveness_ack: ["agent", "liveness-ack"],
+    remember: ["memory", "remember"],
+    recall: ["memory", "recall"],
+    my_skills: ["skill", "mine"],
+    list_my_threads: ["thread", "list"],
+    list_my_metrics: ["metric", "list"],
+    read_my_usage: ["usage", "read"],
+    // #496 (APPROVAL-ASK): the comment thread on an approval, and the decision it acknowledges.
+    approval_comments: ["approval", "comments"],
+    approval_comment: ["approval", "comment"],
+    acknowledge_decision: ["approval", "acknowledge"],
+};
+/** One-release aliases: still on the MCP, never given a command of their own. */
+export const DEPRECATED_TOOLS = new Set(["acknowledge_messages"]);
+/** `<noun> <verb>` for a tool name. */
+export function commandFor(tool) {
+    const fixed = OVERRIDES[tool];
+    if (fixed)
+        return fixed;
+    // Plurals fold only to FIND the noun (list_tasks is a task command); the verb keeps the tool's own words, so
+    // slack_list_channels reads "list-channels" as slack_list_users reads "list-users".
+    const raw = tool.split("_");
+    const words = raw.map((word) => PLURAL[word] ?? word);
+    for (const noun of NOUNS) {
+        const parts = noun.split("_");
+        for (let i = 0; i + parts.length <= words.length; i++) {
+            if (parts.every((part, k) => words[i + k] === part)) {
+                const rest = [...raw.slice(0, i), ...raw.slice(i + parts.length)];
+                return [noun.replace(/_/g, "-"), rest.join("-") || "get"];
+            }
+        }
+    }
+    return ["agent", raw.join("-")];
+}
+/** The tool a `<noun> <verb>` names among the server's tools, or undefined. */
+export function toolFor(noun, verb, tools) {
+    return tools.find((tool) => !DEPRECATED_TOOLS.has(tool) && commandFor(tool).join(" ") === `${noun} ${verb}`);
+}
+//# sourceMappingURL=commands.js.map

package/dist/index.js

@@ -4,8 +4,10 @@ import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
 import { cancelJoin, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
-import { callAwpTool, callToolOverCli, createTaskOverCli, listServiceToolsOverCli, parseCallArgs, runServiceToolOverCli } from "./tool-run.js";
+import { callAwpTool, callToolOverCli, createTaskOverCli, INBOX_SEARCH_USAGE, inboxSearchOverCli, LISTING_DESCRIBE_USAGE, listServiceToolsOverCli, parseCallArgs, PERMISSION_VERB_TOOLS, runServiceToolOverCli, TASK_VERB_TOOLS } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
+import { importVaultOverCli } from "./vault-import.js";
+import { cloneVaultOverCli } from "./vault-clone.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
 // covers a whole session: `run <link>` (or `run join <link>`) joins, `run <runner-id> <tool>` calls a tool.
 export const runArgs = (raw) => raw[0] !== "run" ? raw
@@ -15,7 +17,28 @@ export const runArgs = (raw) => raw[0] !== "run" ? raw
 async function main() {
     const args = runArgs(process.argv.slice(2));
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...] | agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write] | agentradar vault clone <runner-id> <vault-id> [dir] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        console.log([
+            "agentradar run <runner-id> <noun> <verb> [--<argument> <value> ...] [--dry-run] [--json]",
+            "  Every agent tool, grouped in AgentRadar terms: inbox, thread, message, task, metric, vault, ...",
+            "  agentradar run <runner-id> --help           the command groups",
+            "  agentradar run <runner-id> thread --help    a group's verbs",
+            "  agentradar run <runner-id> thread reply --help   one command's arguments",
+            "  Examples:",
+            "    agentradar run r1 inbox next",
+            "    agentradar run r1 thread reply --thread-id <id> --text \"On it\"",
+            "    agentradar run r1 inbox ack --message-ids <id> --message-ids <id>",
+            "    agentradar run r1 task create --title \"Draft the brief\" --dry-run",
+            "  --dry-run prints the exact call and sends nothing. Output is JSON. Exit codes: 0 done; 1 refused or",
+            "  unreachable (reason on stderr); 2 the command was wrong.",
+            "agentradar upgrade   install the latest agentradar-cli",
+        ].join("\n"));
+        return;
+    }
+    if (args.length === 1 && args[0] === "upgrade") {
+        const { selfUpdate, runningVersion } = await import("./update.js");
+        const installed = await selfUpdate();
+        console.log(installed ? `agentradar upgraded to ${installed}` : `agentradar ${await runningVersion()} is the latest`);
         return;
     }
     if (args[0] === "leave" && args.length === 2) {
@@ -111,13 +134,65 @@ async function main() {
             : await runServiceToolOverCli(parsed.runnerId, parsed.tool, parsed.json);
         return;
     }
-    if (args[0] === "task" && (args[1] === "create" || args[1] === "repeat")) {
+    if (args[0] === "vault" && args[1] === "import") {
+        const [runnerId, dir, ...rest] = args.slice(2);
+        const flag = (name) => { const at = rest.indexOf(`--${name}`); return at >= 0 ? rest[at + 1] : undefined; };
+        if (!runnerId || !dir || rest.some((arg) => arg.startsWith("--") && !["--vault", "--source", "--write"].includes(arg))) {
+            console.error("Usage: agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write]");
+            process.exitCode = 2;
+            return;
+        }
+        process.exitCode = await importVaultOverCli(runnerId, dir, { vaultId: flag("vault"), source: flag("source"), write: rest.includes("--write") });
+        return;
+    }
+    if (args[0] === "vault" && args[1] === "clone") {
+        if (args.length < 4 || args.length > 5) {
+            console.error("Usage: agentradar vault clone <runner-id> <vault-id> [dir]");
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await cloneVaultOverCli(args[2], args[3], args[4]);
+        return;
+    }
+    if (args[0] === "inbox" && args[1] === "search") {
+        const parsed = parseCallArgs([...args.slice(2).filter((arg) => arg !== "--json"), "inbox_search"]);
+        if (!parsed || parsed.tool !== "inbox_search") {
+            console.error(INBOX_SEARCH_USAGE);
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await inboxSearchOverCli(parsed.runnerId, parsed.flags, args.includes("--json"));
+        return;
+    }
+    if (args[0] === "listing" && args[1] === "describe") {
+        // UAT U1: the agent's public catalog description, the MCP `set_listing_description` over the same endpoint and key.
+        const parsed = parseCallArgs([...args.slice(2), "set_listing_description"]);
+        if (!parsed || !parsed.flags.some(([flag]) => flag === "capabilities")) {
+            console.error(LISTING_DESCRIBE_USAGE);
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await callToolOverCli(parsed.runnerId, parsed.tool, undefined, {}, parsed.flags);
+        return;
+    }
+    if (args[0] === "permissions" && args[1] && Object.hasOwn(PERMISSION_VERB_TOOLS, args[1])) {
+        const tool = PERMISSION_VERB_TOOLS[args[1]];
+        const parsed = parseCallArgs([...args.slice(2), tool]);
+        if (!parsed || parsed.tool !== tool) {
+            console.error("Usage: agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...]");
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await callToolOverCli(parsed.runnerId, tool, parsed.json, {}, parsed.flags);
+        return;
+    }
+    if (args[0] === "task" && args[1] && Object.hasOwn(TASK_VERB_TOOLS, args[1])) {
         if (args.length !== 5 || args[3] !== "--args") {
-            console.error("Usage: agentradar task create|repeat <runner-id> --args '<json>'");
+            console.error("Usage: agentradar task create|repeat|make-recurring <runner-id> --args '<json>'");
             process.exitCode = 1;
             return;
         }
-        process.exitCode = await createTaskOverCli(args[2], args[1] === "repeat", args[4]);
+        process.exitCode = await createTaskOverCli(args[2], args[1], args[4]);
         return;
     }
     if (args.length === 2 && args[0] === "skill" && args[1] === "install") {
@@ -142,7 +217,7 @@ async function main() {
         return;
     }
     const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
-    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
     if (!help)
         process.exitCode = 1;
 }

package/dist/skill-install.js

@@ -121,12 +121,32 @@ export async function writeManagedSkills(skillsDir, skills) {
  * Codex `$CODEX_HOME/skills`. Done here because a session that acts only through `agentradar run` has no
  * feeder; where the service runs, its feeder keeps them current.
  */
+const BRIEF_MARK = "<!-- Written by AgentRadar and replaced on every sync; edits here are lost. -->";
+/** Replaces the file itself, never a symlink's target, and never a file it did not write (a vendor's AGENTS.md). */
+async function writeBrief(file, text) {
+    const current = await lstat(file).catch(() => null);
+    if (current && (!current.isFile() || !(await readFile(file, "utf8")).startsWith(BRIEF_MARK)))
+        return;
+    await mkdir(dirname(file), { recursive: true });
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    await writeFile(temporary, `${BRIEF_MARK}\n${text.trim()}\n`);
+    await rename(temporary, file);
+}
 export async function syncJoinedSkills(runnerId, deps) {
     const env = await readFile(join(deps.home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
     const root = envValue(env, "AR_AGENT_HARNESS") === "codex" ? envValue(env, "CODEX_HOME") : envValue(env, "AR_BASE");
     if (!root)
         return;
-    const skillsDir = envValue(env, "AR_AGENT_HARNESS") === "codex" ? join(root, "skills") : join(root, ".claude", "skills");
+    const codex = envValue(env, "AR_AGENT_HARNESS") === "codex";
+    const skillsDir = codex ? join(root, "skills") : join(root, ".claude", "skills");
+    // Vadym 9988: the server's start instructions with this agent's brief, before its first session starts.
+    // Same file and mark as the runner's feeder, which keeps it fresh from then on.
+    const init = await awpRequest(runnerId, "initialize", {
+        protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-cli", version: "1.0.0" },
+    }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    const briefFile = codex ? join(root, "AGENTS.md") : join(root, ".claude", "rules", "agentradar-brief.md");
+    if (init?.result?.instructions)
+        await writeBrief(briefFile, init.result.instructions);
     const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: {} }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
     const text = body?.result?.content?.find((c) => c.type === "text")?.text;
     const answer = (text ? JSON.parse(text) : {});

package/dist/tool-run.js

@@ -1,6 +1,8 @@
 import { readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { commandFor, DEPRECATED_TOOLS, toolFor } from "./commands.js";
+import { newer, runningVersion } from "./update.js";
 /**
  * One `KEY='value'` line as `setup.ts` wrote it, single-quoted with `'` escaped as `'\''`.
  * Nothing here is printed: the file holds the runner's bearer.
@@ -21,17 +23,31 @@ export async function runServiceToolOverCli(runnerId, toolKey, argumentsJson, de
 }
 /** `agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>']`: any AWP tool from a shell, so a just-joined agent works before its harness reloads MCP tools. */
 export async function callToolOverCli(runnerId, tool, argumentsJson, deps = {}, flags = []) {
-    if (flags.some(([flag]) => flag === "help"))
+    const switches = new Set(flags.filter(([flag]) => ["help", "dry-run", "json"].includes(flag)).map(([flag]) => flag));
+    flags = flags.filter(([flag]) => !switches.has(flag));
+    // A noun has no underscore; a tool name has one unless it is a single word (reply, recall), which the resolver returns as is.
+    if (tool.includes(" ") || (switches.has("help") && tool !== "" && !tool.includes("_"))) {
+        const resolved = await resolveCommand(runnerId, tool, switches.has("help"), deps);
+        if (typeof resolved === "number")
+            return resolved;
+        tool = resolved;
+    }
+    if (switches.has("help"))
         return await describeTools(runnerId, tool, deps);
     const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
     if (!parameters)
-        return 1;
+        return EXIT.usage;
     if (flags.length) {
         const typed = await flagArguments(runnerId, tool, flags, deps);
         if (!typed)
-            return 1;
+            return EXIT.usage;
         Object.assign(parameters, typed);
     }
+    // --dry-run: say exactly what would be sent, and send nothing.
+    if (switches.has("dry-run")) {
+        (deps.log ?? console.log)(JSON.stringify({ dryRun: true, tool, arguments: parameters }));
+        return EXIT.ok;
+    }
     if (tool !== "next_event" || !RUNNER_ID.test(runnerId))
         return await callAwpTool(runnerId, tool, parameters, deps);
     // A bare poll acknowledges the batch the previous poll printed, so the command stays byte-identical and
@@ -56,6 +72,35 @@ export async function callToolOverCli(runnerId, tool, argumentsJson, deps = {},
     await writeFile(delivered, JSON.stringify(ids), { mode: 0o600 }).catch(() => undefined);
     return 0;
 }
+/**
+ * Stable exit codes, the same for every command: 0 done; 1 the server refused or could not be reached
+ * (its sentence is on stderr); 2 the command itself was wrong (unknown command, missing or mistyped argument).
+ */
+export const EXIT = { ok: 0, refused: 1, usage: 2 };
+/**
+ * `<noun> <verb>` → the tool it names on this server; or an exit code once `<noun> --help` has listed its
+ * verbs, or after saying what is wrong.
+ */
+async function resolveCommand(runnerId, command, help, deps) {
+    const tools = await listedTools(runnerId, deps);
+    if (!tools)
+        return EXIT.refused;
+    const names = tools.map((entry) => entry.name ?? "").filter((name) => name && !DEPRECATED_TOOLS.has(name));
+    const [noun, verb] = command.split(" ");
+    if (!verb && names.includes(noun))
+        return noun;
+    if (verb) {
+        const tool = toolFor(noun, verb, names);
+        if (tool)
+            return tool;
+    }
+    const verbs = names.filter((name) => commandFor(name)[0] === noun).map((name) => commandFor(name)[1]).sort();
+    const log = help && !verb ? deps.log ?? console.log : deps.logError ?? console.error;
+    log(verbs.length
+        ? `${verb ? `${noun} ${verb} is not a command. ` : ""}agentradar run ${runnerId} ${noun} <verb>: ${verbs.join(" ")}. Add --help to a command for its arguments.`
+        : `${noun} is not a command group. Groups: ${[...new Set(names.map((name) => commandFor(name)[0]))].sort().join(" ")}.`);
+    return help && !verb && verbs.length ? EXIT.ok : EXIT.usage;
+}
 /** Split `<runner-id> <tool> [--args '<json>'] [--<argument> <value> ...]`; null when it is not that shape. */
 export function parseCallArgs(rest) {
     const positional = [];
@@ -67,8 +112,8 @@ export function parseCallArgs(rest) {
             positional.push(arg);
             continue;
         }
-        if (arg === "--help") {
-            flags.push(["help", ""]);
+        if (arg === "--help" || arg === "--dry-run" || arg === "--json") {
+            flags.push([arg.slice(2), ""]);
             continue;
         }
         const value = rest[++i];
@@ -80,6 +125,9 @@ export function parseCallArgs(rest) {
             flags.push([arg.slice(2), value]);
     }
     const help = flags.some(([flag]) => flag === "help");
+    // `<runner-id> <noun> <verb>` (Vadym 9970) names the same tool as `<runner-id> <tool>`; resolved against the server's list.
+    if (positional.length === 3)
+        return { runnerId: positional[0], tool: `${positional[1]} ${positional[2]}`, json, flags };
     return positional.length === 2 || (help && positional.length === 1)
         ? { runnerId: positional[0], tool: positional[1] ?? "", json, flags } : null;
 }
@@ -112,7 +160,7 @@ async function describeTools(runnerId, tool, deps) {
     return 0;
 }
 /**
- * `--text "hi" --conversation-id X` as the tool's own arguments, typed by the inputSchema the server
+ * `--text "hi" --thread-id X` as the tool's own arguments, typed by the inputSchema the server
  * advertises, so an agent never types JSON (braces and quotes) into a shell command.
  */
 async function flagArguments(runnerId, tool, flags, deps) {
@@ -190,16 +238,59 @@ function coerce(type, value) {
         return type === undefined ? value : undefined;
     }
 }
+// The parity test (server listing-description-realpg) fails when set_listing_description gains an argument this line does not name.
+export const LISTING_DESCRIBE_USAGE = "Usage: agentradar listing describe <runner-id> --capabilities <text>";
+// The parity test (server inbox-search-realpg) fails when inbox_search gains an argument this line does not name.
+export const INBOX_SEARCH_USAGE = "Usage: agentradar inbox search <runner-id> [--query <text>] [--channel <c>] [--thread-id <id>] [--sender <s>] [--from <iso>] [--to <iso>] [--has-attachment true] [--unread true] [--unacked true] [--limit <n>] [--before <cursor>] [--after <cursor>] [--around <message-id>] [--json]";
 /**
- * Ruling 49 — `agentradar task create|repeat <runner-id> --args '<json>'`: the agent's own `create_task`
- * or `create_recurring_task`, on the same AWP endpoint with the same key, so who it may assign to is the
- * server's decision exactly as it is over MCP.
+ * INBOX-SEARCH (Vadym 9974) — `agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json]`:
+ * the MCP `inbox_search` on the same endpoint with the same key. One block per message, or the tool's JSON with --json.
  */
-export async function createTaskOverCli(runnerId, recurring, argumentsJson, deps = {}) {
+export async function inboxSearchOverCli(runnerId, flags, json, deps = {}) {
+    const log = deps.log ?? console.log;
+    return await callToolOverCli(runnerId, "inbox_search", undefined, json ? deps : { ...deps, log: (text) => log(inboxLines(text)) }, flags);
+}
+function inboxLines(text) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+    const results = body.results;
+    if (!Array.isArray(results))
+        return text;
+    if (!results.length)
+        return "No messages found.";
+    const pages = [body.older && `Older: --before ${body.older}`, body.newer && `Newer: --after ${body.newer}`].filter(Boolean);
+    return [...results.map((r) => `${r.at}  ${r.channel}  ${r.sender?.name ?? r.from ?? ""}\n  thread ${r.threadId}  message ${r.messageId}\n  ${r.snippet}`), ...pages].join("\n");
+}
+/**
+ * Vadym 10719 — `agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...]`: the MCP permission
+ * tools on the same endpoint with the same key. The parity test (server permission-tools-realpg) fails when one drifts.
+ */
+export const PERMISSION_VERB_TOOLS = {
+    mine: "my_permissions",
+    roles: "read_role_permissions",
+    set: "set_role_permission",
+    request: "request_permission",
+};
+/**
+ * Ruling 49 — `agentradar task create|repeat|make-recurring <runner-id> --args '<json>'`: the agent's own
+ * `create_task`, `create_recurring_task` or `make_task_recurring` (Vadym 10317), on the same AWP endpoint
+ * with the same key, so who it may assign to is the server's decision exactly as it is over MCP.
+ */
+export const TASK_VERB_TOOLS = {
+    create: "create_task",
+    repeat: "create_recurring_task",
+    "make-recurring": "make_task_recurring",
+};
+export async function createTaskOverCli(runnerId, verb, argumentsJson, deps = {}) {
     const parameters = parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
     if (!parameters)
         return 1;
-    return await callAwpTool(runnerId, recurring ? "create_recurring_task" : "create_task", parameters, deps);
+    return await callAwpTool(runnerId, TASK_VERB_TOOLS[verb], parameters, deps);
 }
 function parseArgumentsObject(argumentsJson, logError) {
     let parsed;
@@ -240,11 +331,40 @@ export async function callAwpTool(runnerId, name, toolArguments, deps) {
         return 1;
     }
     log(said);
+    await cliVersionNotice(said, logError);
     return 0;
 }
+/**
+ * Vadym 9970: the server names the CLI it expects (`cli: { latest, min }`, on a successful get_my_context).
+ * When this one is behind, the agent reads it in its own output (stderr, so --json stdout stays parseable).
+ */
+async function cliVersionNotice(said, logError) {
+    let cli;
+    try {
+        cli = JSON.parse(said).cli;
+    }
+    catch {
+        return;
+    }
+    if (!cli || typeof cli.latest !== "string")
+        return;
+    const mine = await runningVersion().catch(() => null);
+    if (!mine || !newer(cli.latest, mine))
+        return;
+    logError(typeof cli.min === "string" && newer(cli.min, mine)
+        ? `agentradar ${mine} is below the minimum ${cli.min}: upgrade required. Run \`agentradar upgrade\`.`
+        : `agentradar ${cli.latest} is available (you run ${mine}). Run \`agentradar upgrade\`.`);
+}
 const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 /** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
 export async function awpRequest(runnerId, method, params, deps) {
+    const target = await awpEndpoint(runnerId, deps);
+    if (!target)
+        return null;
+    return postAwp(target.url, target.bearer, method, params, deps);
+}
+/** The runner's MCP endpoint and bearer: its runner file, else a hosted run's own environment. */
+export async function awpEndpoint(runnerId, deps) {
     const logError = deps.logError ?? console.error;
     if (!RUNNER_ID.test(runnerId)) {
         logError("Invalid runner ID");
@@ -275,6 +395,10 @@ export async function awpRequest(runnerId, method, params, deps) {
         }
         url = `${origin}/api/mcp`;
     }
+    return { url, bearer };
+}
+async function postAwp(url, bearer, method, params, deps) {
+    const logError = deps.logError ?? console.error;
     const response = await (deps.fetch ?? fetch)(url, {
         method: "POST",
         headers: {

package/dist/update.js

@@ -16,7 +16,7 @@ const serviceCopy = (root) => basename(dirname(root)) === "cli" && basename(dirn
 export const runningVersion = async () => JSON.parse(await readFile(join(PACKAGE_ROOT, "package.json"), "utf8")).version;
 /** The version on disk: for a service's copy, the one `current` points at, which another runner may have moved. */
 export const installedVersion = async (root = PACKAGE_ROOT) => JSON.parse(await readFile(join(serviceCopy(root) ? join(dirname(root), "current") : root, "package.json"), "utf8")).version;
-const newer = (a, b) => {
+export const newer = (a, b) => {
     const [x, y] = [VERSION.exec(a), VERSION.exec(b)];
     if (!x || !y)
         return false;

package/dist/vault-clone.js

@@ -0,0 +1,59 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { awpEndpoint, awpRequest } from "./tool-run.js";
+/**
+ * VAULT-GIT (Vadym 10186): `agentradar vault clone <runner-id> <vault-id> [dir]` — the vault as a git repository.
+ * `export_vault` mints a 15-minute link to a git bundle of the documents this agent can read; this downloads it and
+ * clones from it, so each revision is a commit with its author and `git log` / `git blame` work locally.
+ */
+export async function cloneVaultOverCli(runnerId, vaultId, dir, deps = {}) {
+    const log = deps.log ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const target = resolve(dir ?? `vault-${vaultId.slice(0, 8)}`);
+    // git clone refuses a non-empty target; say so before asking the server for anything.
+    if (await stat(target).then(() => true, () => false)) {
+        logError(`${target} already exists. Pick a new folder.`);
+        return 1;
+    }
+    const endpoint = await awpEndpoint(runnerId, deps);
+    const body = endpoint && await awpRequest(runnerId, "tools/call", { name: "export_vault", arguments: { vaultId } }, deps);
+    if (!endpoint || !body)
+        return 1;
+    const text = body.result?.content?.[0]?.text;
+    const answer = (() => { try {
+        return JSON.parse(String(text));
+    }
+    catch {
+        return null;
+    } })();
+    if (body.result?.isError || !answer?.ok || !answer.url) {
+        logError(answer?.error ?? (typeof text === "string" ? text : "AgentRadar did not export the vault."));
+        return 1;
+    }
+    // The link is relative when the server does not know its public address: it is on the MCP's own origin.
+    const bundleUrl = new URL(answer.url, endpoint.url);
+    const download = await (deps.fetch ?? fetch)(bundleUrl);
+    if (!download.ok) {
+        logError(`The export link was refused (${download.status}). It lasts 15 minutes; run the clone again.`);
+        return 1;
+    }
+    const scratch = await mkdtemp(join(tmpdir(), "agentradar-vault-"));
+    try {
+        const bundle = join(scratch, "vault.bundle");
+        await writeFile(bundle, Buffer.from(await download.arrayBuffer()));
+        await (deps.git ?? ((args) => promisify(execFile)("git", args).then(() => undefined)))(["clone", "--quiet", bundle, target]);
+    }
+    catch (error) {
+        logError(`git could not clone the vault: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+    log(`Cloned vault ${vaultId} into ${target}: one commit per revision; git log and git blame work there.`);
+    return 0;
+}
+//# sourceMappingURL=vault-clone.js.map

package/dist/vault-import.js

@@ -0,0 +1,135 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { basename, join, posix, relative, resolve, sep } from "node:path";
+import { awpRequest } from "./tool-run.js";
+/**
+ * VAULT-IMPORT (Vadym 10190): `agentradar vault import <runner-id> <dir> [--vault <id>] [--source <name>] [--write]`.
+ * Reads a folder of Markdown and skills (an Obsidian vault, or a Notion, Confluence or GitBook export) and sends it
+ * to `import_vault` in batches. Every batch is dry-run first, so a secret or a refusal anywhere stops the import
+ * before any batch is written; `--write` then writes them. Without `--write` it only reports.
+ */
+const LIMITS = { files: 2_000, fileBytes: 1_000_000, totalBytes: 50_000_000, batchBytes: 8_000_000 };
+const DOCUMENT = /\.(md|markdown|txt)$/i;
+/** Images and PDFs travel as base64, up to what fits one request; anything else as its path only. */
+const ATTACHMENT = /\.(png|jpe?g|gif|webp|pdf)$/i;
+const ATTACHMENT_BYTES = 6_000_000;
+const SKIPPED_DIRS = new Set([".git", ".obsidian", ".trash", "node_modules"]);
+async function walk(root, dir = root, out = []) {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+            if (!SKIPPED_DIRS.has(entry.name))
+                await walk(root, join(dir, entry.name), out);
+        }
+        else if (entry.isFile())
+            out.push(relative(root, join(dir, entry.name)).split(sep).join("/"));
+    }
+    return out;
+}
+export async function importVaultOverCli(runnerId, dir, options, deps = {}) {
+    const log = deps.log ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const root = resolve(dir);
+    if (!(await stat(root).catch(() => null))?.isDirectory()) {
+        logError(`${dir} is not a folder.`);
+        return 2;
+    }
+    const paths = (await walk(root)).sort();
+    if (paths.length > LIMITS.files) {
+        logError(`${paths.length} files: an import is at most ${LIMITS.files}. Nothing was sent.`);
+        return 2;
+    }
+    const skillRoots = paths.filter((p) => posix.basename(p).toLowerCase() === "skill.md").map((p) => posix.dirname(p));
+    const skillOf = (p) => skillRoots.find((r) => r === "." || p.startsWith(`${r}/`));
+    // A skill folder travels whole in one batch; an attachment travels as its path only, so the server can report it.
+    const groups = new Map();
+    let total = 0;
+    for (const p of paths) {
+        const skill = skillOf(p);
+        let content = null;
+        let contentBase64;
+        if (skill === undefined && ATTACHMENT.test(p)) {
+            const bytes = await readFile(join(root, p));
+            total += bytes.length;
+            if (bytes.length <= ATTACHMENT_BYTES)
+                contentBase64 = bytes.toString("base64");
+        }
+        else if (skill !== undefined || DOCUMENT.test(p)) {
+            const bytes = await readFile(join(root, p));
+            if (bytes.length > LIMITS.fileBytes) {
+                logError(`${p} is over ${LIMITS.fileBytes} bytes. Nothing was sent.`);
+                return 2;
+            }
+            total += bytes.length;
+            content = bytes.toString("utf8");
+        }
+        const key = skill ?? p;
+        groups.set(key, [...(groups.get(key) ?? []), { path: p, content, ...(contentBase64 ? { contentBase64 } : {}) }]);
+    }
+    if (total > LIMITS.totalBytes) {
+        logError(`${total} bytes: an import is at most ${LIMITS.totalBytes}. Nothing was sent.`);
+        return 2;
+    }
+    const batches = [[]];
+    let size = 0;
+    for (const group of groups.values()) {
+        const bytes = group.reduce((sum, file) => sum + Buffer.byteLength(file.content ?? "") + (file.contentBase64?.length ?? 0) + file.path.length, 0);
+        if (size + bytes > LIMITS.batchBytes && batches.at(-1).length) {
+            batches.push([]);
+            size = 0;
+        }
+        batches.at(-1).push(...group);
+        size += bytes;
+    }
+    const source = options.source ?? `folder:${basename(root)}`;
+    const send = async (files, dryRun) => {
+        const body = await awpRequest(runnerId, "tools/call", { name: "import_vault", arguments: {
+                ...(options.vaultId ? { vaultId: options.vaultId } : {}), files, source, dryRun, sourcePaths: paths, sourceBytes: total,
+            } }, deps);
+        const text = body?.result?.content?.[0]?.text;
+        return typeof text === "string" ? JSON.parse(text) : null;
+    };
+    const run = async (dryRun) => {
+        const counts = {};
+        const refused = [];
+        let notInSource = [];
+        for (const [n, batch] of batches.entries()) {
+            const answer = await send(batch, dryRun);
+            // Each call is all-or-nothing; earlier calls of a write stay written, and a rerun skips them as unchanged.
+            const done = !dryRun && n > 0 ? ` ${n} of ${batches.length} batches were imported before this one; run the import again to finish (unchanged pages are skipped).` : "";
+            if (!answer) {
+                if (done)
+                    logError(done.trim());
+                return null;
+            }
+            if (!answer.ok) {
+                logError(`${answer.error ?? "AgentRadar refused the import."}${done}`);
+                return null;
+            }
+            for (const [action, n] of Object.entries(answer.counts ?? {}))
+                counts[action] = (counts[action] ?? 0) + n;
+            refused.push(...(answer.files ?? []).filter((f) => f.action === "refuse").map((f) => `${f.source}: ${f.reason}`));
+            notInSource = answer.notInSource ?? notInSource;
+        }
+        return { counts, refused, notInSource };
+    };
+    const planned = await run(true);
+    if (!planned)
+        return 1;
+    const report = (r, verb) => {
+        log(`${verb}: ${r.counts.new ?? 0} new, ${r.counts.update ?? 0} updated, ${r.counts.skip ?? 0} unchanged, ${r.counts.refuse ?? 0} left out, ${r.counts.skill ?? 0} skill files (source ${source}).`);
+        for (const line of r.refused)
+            log(`  left out ${line}`);
+        if (r.notInSource.length)
+            log(`  imported before from ${source} and no longer in the folder (kept): ${r.notInSource.join(", ")}`);
+    };
+    if (!options.write) {
+        report(planned, "Dry run");
+        log("Nothing was written. Add --write to import.");
+        return 0;
+    }
+    const written = await run(false);
+    if (!written)
+        return 1;
+    report(written, "Imported");
+    return 0;
+}
+//# sourceMappingURL=vault-import.js.map

package/dist/vendor-runner/feeder.mjs

@@ -102,6 +102,26 @@ export function skillsDirFor(harness, env) {
   return env.AR_BASE ? join(env.AR_BASE, ".claude", "skills") : null;
 }
 const SKILLS_DIR = skillsDirFor(AR_AGENT_HARNESS, process.env);
+/**
+ * Vadym 9988: the server's start instructions with this agent's brief, where the harness reads standing rules at
+ * every session start: Claude's project rules, Codex's per-agent AGENTS.md. Refreshed on the skills cadence.
+ */
+export function briefFileFor(harness, env) {
+  if (harness === "codex") return env.CODEX_HOME ? join(env.CODEX_HOME, "AGENTS.md") : null;
+  return env.AR_BASE ? join(env.AR_BASE, ".claude", "rules", "agentradar-brief.md") : null;
+}
+const BRIEF_FILE = briefFileFor(AR_AGENT_HARNESS, process.env);
+export const BRIEF_MARK = "<!-- Written by AgentRadar and replaced on every sync; edits here are lost. -->";
+/** Replaces the file itself, never a symlink's target, and never a file it did not write (a vendor's AGENTS.md). */
+export function writeBrief(file, text) {
+  const current = fs.lstatSync(file, { throwIfNoEntry: false });
+  if (current && (!current.isFile() || !fs.readFileSync(file, "utf8").startsWith(BRIEF_MARK))) return false;
+  fs.mkdirSync(dirname(file), { recursive: true });
+  const temporary = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(temporary, `${BRIEF_MARK}\n${text.trim()}\n`);
+  fs.renameSync(temporary, file);
+  return true;
+}
 const SKILLS_SYNC_INTERVAL_MS = Number(process.env.SKILLS_SYNC_INTERVAL_MS ?? "600000");
 const MANAGED_MARK = ".agentradar-managed";
 
@@ -312,10 +332,13 @@ export function agentAuthState() {
   return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
 }
 
-export function runnerState(auth = agentAuthState, sample = capturePane) {
+/** AGENT-GUARD-ACTIVE: the supervisor sets AR_GUARD_MARKER when the session must load agent-guard, whose SessionStart hook writes it. */
+export const guardLoaded = (marker = process.env.AR_GUARD_MARKER) => !marker || fs.existsSync(marker);
+
+export function runnerState(auth = agentAuthState, sample = capturePane, guard = guardLoaded) {
   const authState = auth();
   if (authState === "unauthenticated") return "auth_required";
-  if (authState !== "authenticated") return "starting";
+  if (authState !== "authenticated" || !guard()) return "starting";
   const pane = sample();
   if (pane?.rateLimited) return "rate_limited";
   return pane?.inputReady ? "ready" : "starting";
@@ -723,6 +746,16 @@ export function writeManagedSkills(skillsDir, skills) {
 }
 
 async function syncSkills() {
+  try {
+    const init = await mcpPostIsolated("initialize", {
+      protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-i2-feeder", version: "1.0.0" },
+    });
+    if (BRIEF_FILE && init?.instructions && !writeBrief(BRIEF_FILE, init.instructions)) {
+      console.warn(`[feeder] brief sync: ${BRIEF_FILE} is not AgentRadar's; left alone`);
+    }
+  } catch (err) {
+    console.warn(`[feeder] brief sync failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
     const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: {} }));
     // A refusal or an older server keeps whatever this box already has.

package/dist/vendor-runner/session-frame.mjs

@@ -33,6 +33,7 @@ export function formatInjectionFrame(event, cliRunnerId) {
   const tags = [`source=${e.source ?? "unknown"}`];
   if (e.channel) tags.push(`channel=${e.channel}`);
   if (e.conversationId) tags.push(`conversationId=${e.conversationId}`);
+  if (e.taskId) tags.push(`taskId=${e.taskId}`); // assignment events: the agent works THIS task, not one dug out of its log
   if (e.eventId) tags.push(`eventId=${e.eventId}`);
   const header = `[AgentRadar inbound · ${tags.join(" · ")}]`;
   const body = oneLine(e.text) || "(no text)";

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -70,6 +70,8 @@ BROWSER_APP="${BROWSER_APP:-Google Chrome}"          # #150: app to ensure-up fo
 BROWSER_READY_MAX_SEC="${BROWSER_READY_MAX_SEC:-20}" # #150: bounded wait for the browser proc on cold boot
 BROWSER_READY_SETTLE_SEC="${BROWSER_READY_SETTLE_SEC:-3}" # #150: settle for extension/native-host after cold launch
 HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
+AR_API400_LOOP_MAX="${AR_API400_LOOP_MAX:-3}"          # same `API Error: 400` this many times in the pane = poisoned session
+AR_API400_COOLDOWN_SEC="${AR_API400_COOLDOWN_SEC:-300}" # at most one fresh-session heal per this window
 
 # --- 2a. R004 HARNESS SELECTION — one documented variable picks the CLI ---------
 # The Bible names two agent harnesses: Claude Code and Codex. `claude` is the default, so every existing
@@ -175,7 +177,7 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
     # identity). Reject at parse time (visible warning) AND — belt-and-suspenders — the launch lists
     # the reserved allowlist AFTER TOOL_ENV_ARGS so `env` last-wins keeps reserved vars authoritative.
     case "${_tline%%=*}" in
-      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
+      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
         log "WARN ignoring reserved key '${_tline%%=*}' in ${AGENT_TOOL_ENV_FILE} (cannot override supervisor/agent env)"; continue ;;
     esac
     TOOL_ENV_ARGS+=("${_tline}")
@@ -193,7 +195,13 @@ unset CLAUDE_CODE_OAUTH_TOKEN
 _claude_cfg=()
 [ -n "${CLAUDE_CONFIG_DIR:-}" ] && _claude_cfg=( CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" )
 # agent-guard (templates/agent-guard): its hooks ask the server what this runner still owes through the CLI.
-for _k in AR_CLI_RUNNER_ID AR_AGENTRADAR_BIN AR_DISCIPLINE_EVERY AR_MODEL_SWITCH_DIR CLAUDE_CODE_PLUGIN_CACHE_DIR; do
+# AGENT-GUARD-ACTIVE (Vadym 10699): the guard's SessionStart hook writes AR_GUARD_MARKER, and the feeder and the
+# channel report "starting", never "ready", until it exists. A session that did not load the guard gets no work.
+# Outside the secrets dir, which goes on exit: a pane that outlives this supervisor keeps its proof.
+# The caller's own pane (AR_ATTACH) was not started with --settings, so it is not gated here.
+AR_GUARD_MARKER=""
+[ "${AR_AGENT_HARNESS}" = "claude" ] && [ -n "${CLAUDE_SETTINGS:-}" ] && [ "${AR_ATTACH:-}" != "1" ] && AR_GUARD_MARKER="${HOME}/.agentradar/run/${AGENT_NAME}.guard-loaded"
+for _k in AR_CLI_RUNNER_ID AR_AGENTRADAR_BIN AR_DISCIPLINE_EVERY AR_MODEL_SWITCH_DIR CLAUDE_CODE_PLUGIN_CACHE_DIR AR_GUARD_MARKER; do
   [ -n "${!_k:-}" ] && _claude_cfg+=( "${_k}=${!_k}" )
 done
 
@@ -282,6 +290,16 @@ ensure_browser() {
   log "WARN browser '${BROWSER_APP}' not detected within ${BROWSER_READY_MAX_SEC}s — launching --chrome anyway (it will retry-connect)"
 }
 
+# A session whose history the API rejects (e.g. `messages.240.content.0.thinking: each thinking block must
+# contain thinking`) answers every new turn with the same 400 forever; resuming it replays the same history.
+# True when one identical `API Error: 400` line (digits normalised: the message index moves) fills the pane
+# scrollback AR_API400_LOOP_MAX times. ponytail: only the last 200 lines are read, so a very slow loop could slip by.
+api_error_loop() {
+  "${TMUX_BIN}" capture-pane -p -J -t "${TMUX_SESSION}" -S -200 2>/dev/null \
+    | grep -o 'API Error: 400 .*' | sed -E 's/[0-9]+/N/g' | sort | uniq -c | sort -rn \
+    | awk -v m="${AR_API400_LOOP_MAX}" 'NR==1{ok=($1>=m)} END{exit !ok}'
+}
+
 # --- 3. Ensure the agent's tmux+claude session (idempotent) -------------------
 ensure_agent() {
   if session_exists && pane_alive; then
@@ -298,6 +316,9 @@ ensure_agent() {
     log "session '${TMUX_SESSION}' exists but claude pane is dead — recreating"
     "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true
   fi
+  [ -n "${AR_GUARD_MARKER}" ] && rm -f "${AR_GUARD_MARKER}"   # this launch must prove the guard afresh
+  _resume_now="${AR_RESUME_FLAGS}"
+  if [ "${_FORCE_FRESH:-0}" = 1 ]; then _resume_now="${AR_FRESH_FLAGS}"; _FORCE_FRESH=0; fi   # poisoned history: do not resume it
   ensure_browser   # #150: bring up the browser first for --chrome agents (idempotent, no-op otherwise)
   if [ -n "${PRE_LAUNCH_HOOK}" ] && [ -x "${PRE_LAUNCH_HOOK}" ]; then
     log "running pre-launch hook: ${PRE_LAUNCH_HOOK}"
@@ -358,10 +379,10 @@ ensure_agent() {
       TERM="${AR_AGENT_TERM:-tmux-256color}" COLORTERM="${AR_AGENT_COLORTERM:-truecolor}" \
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
-      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${AR_RESUME_FLAGS}" AR_FRESH_FLAGS="${AR_FRESH_FLAGS}" \
+      CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${_resume_now}" AR_FRESH_FLAGS="${AR_FRESH_FLAGS}" \
       DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
       ${_claude_cfg[@]+"${_claude_cfg[@]}"} ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -412,7 +433,7 @@ if [ "${AR_FEED}" = "feeder" ]; then
   # AR_TOOL_ENV_FILE: the login probe must see the same gateway env the pane runs with.
   AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
     AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
-    AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" \
+    AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" AR_GUARD_MARKER="${AR_GUARD_MARKER}" \
     node "${FEEDER_JS}" &
   FEEDER_PID=$!
   log "feeder pid ${FEEDER_PID}"
@@ -449,8 +470,16 @@ while true; do
     log "feeder exited — exiting so the service manager restarts the whole unit"
     exit 1
   fi
+  _heal=0
   if ! pane_alive; then
     log "agent pane died — recovering it in place"
+    _heal=1
+  elif [ "${AR_ATTACH:-}" != "1" ] && [ $(( $(date +%s) - ${_LAST_HEAL:-0} )) -ge "${AR_API400_COOLDOWN_SEC}" ] && api_error_loop; then
+    log "agent pane is looping on the same API 400 — replacing it with a FRESH session"
+    _LAST_HEAL=$(date +%s); _FORCE_FRESH=1; _heal=1
+    "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true
+  fi
+  if [ "${_heal}" = 1 ]; then
     if ensure_agent; then
       if [ -n "${BRIDGE_PID}" ]; then
         kill "${BRIDGE_PID}" 2>/dev/null || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.2.10",
+  "version": "0.3.0",
   "engines": {
     "node": ">=20"
   },
@@ -17,7 +17,10 @@
     "dist/skill-install.js",
     "dist/tool-run.js",
     "dist/sync.js",
+    "dist/vault-import.js",
     "dist/update.js",
+    "dist/commands.js",
+    "dist/vault-clone.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",
     "dist/agent-guard",