agentradar-cli 0.2.7 → 0.2.9

package/dist/agent-guard/hooks/hooks.json

@@ -1,7 +1,11 @@
 {
-  "description": "Blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns.",
+  "description": "Blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
   "hooks": {
     "Stop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }]
+    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
+    "PreCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }] }],
+    "PostCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }] }],
+    "PreModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreModelSwitch || exit 2", "timeout": 30 }] }],
+    "PostModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostModelSwitch", "timeout": 30 }] }]
   }
 }

package/dist/agent-guard/scripts/model-switch.mjs

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+// AgentRadar compact-then-switch controller. Registered for PreCompact, PostCompact, PreModelSwitch and
+// PostModelSwitch as `model-switch.mjs <event>`; JSON on stdin. A block exits 2, so a hook that fails for
+// any reason refuses our model switch, while compactions that are not ours always go through.
+import { spawnSync } from "node:child_process";
+import { linkSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const ID = /^[a-zA-Z0-9_-]{1,100}$/;
+// Runtime ids can carry a context-window suffix, e.g. claude-opus-5[1m].
+const MODEL = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,199}(\[[a-z0-9]{1,16}\])?$/;
+const NONCE = "AgentRadar model switch ";
+// An issued switch with no receipt keeps its session slot this long past expiry, for a late receipt.
+const UNKNOWN_GRACE_MS = 10 * 60_000;
+const DENY = { decision: "block", reason: "AgentRadar could not verify this compact-then-switch request." };
+const ALLOW = { hookSpecificOutput: { hookEventName: "PreModelSwitch", permissionDecision: "allow" } };
+const read = (path) => {
+  try { return JSON.parse(readFileSync(path, "utf8")); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+};
+function once(path, value) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temporary, JSON.stringify(value), { flag: "wx", mode: 0o600 });
+  try {
+    // Link publishes a complete file exclusively; readers never observe half-written JSON.
+    linkSync(temporary, path);
+    return true;
+  } catch (error) { if (error.code === "EEXIST") return false; throw error; }
+  finally { unlinkSync(temporary); }
+}
+// One pending switch per session. Slots are numbered and only ever created exclusively, never moved or
+// removed, so a hook can never read "nothing pending" while a switch is live. A slot is free once its switch
+// is released or aged out; the next request then claims the next number. A slot this code cannot use (corrupt,
+// or without a valid id and expiresAt) ages out from its write time, so it never locks a session forever.
+// ponytail: one small file per switch per session accumulates; prune free slots if that ever matters.
+function currentSlot(root, sessionId, now) {
+  let names;
+  try { names = readdirSync(root); } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  const prefix = `session-${sessionId}.`;
+  const n = Math.max(-1, ...names.filter((name) => name.startsWith(prefix) && /^\d{1,9}\.json$/.test(name.slice(prefix.length)))
+    .map((name) => Number(name.slice(prefix.length, -".json".length))));
+  if (n < 0) return null;
+  const slot = join(root, `${prefix}${n}.json`);
+  let pending = null;
+  try { pending = read(slot); } catch { /* corrupt: ages out below */ }
+  const id = ID.test(pending?.id ?? "") ? pending.id : null;
+  const expiresAt = Date.parse(pending?.expiresAt);
+  const until = id && Number.isFinite(expiresAt) ? expiresAt : statSync(slot).mtimeMs;
+  const released = id !== null && read(join(root, id, "released.json")) !== null;
+  return { n, id, free: released || until + UNKNOWN_GRACE_MS <= now };
+}
+
+/** Local receipts belong to vendor-owned compute, not independent server attestation. */
+export function switchState(root, command, now = Date.now()) {
+  if (!ID.test(command?.id ?? "") || !ID.test(command?.sessionId ?? "")
+    || !MODEL.test(command?.model ?? "") || !Number.isFinite(Date.parse(command?.expiresAt))) {
+    throw new Error("Invalid model switch.");
+  }
+  const dir = join(root, command.id);
+  const path = (name) => join(dir, `${name}.json`);
+  const existing = read(path("command"));
+  if (!existing && Date.parse(command.expiresAt) <= now) throw new Error("Expired model switch.");
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const bound = { id: command.id, sessionId: command.sessionId, model: command.model, expiresAt: command.expiresAt };
+  once(path("command"), bound);
+  if (JSON.stringify(read(path("command"))) !== JSON.stringify(bound)) throw new Error("Model switch identity changed.");
+  // The session slot is claimed only by an exclusive create; no lock, so no lock to go stale.
+  for (let attempt = 0; ; attempt++) {
+    const pending = currentSlot(root, command.sessionId, now);
+    if (pending?.id === command.id) break;
+    if (attempt >= 3) throw new Error("This session's model switch slot is contended.");
+    // An abandoned switch (feeder gone, receipt lost) must not disable switching for the session.
+    if (pending && !pending.free) throw new Error("This session already has a pending model switch.");
+    once(join(root, `session-${command.sessionId}.${(pending?.n ?? -1) + 1}.json`), { id: command.id, expiresAt: command.expiresAt });
+  }
+  return {
+    command: bound,
+    read: (name) => read(path(name)),
+    once: (name, value = {}) => once(path(name), value),
+    release: () => once(path("released"), {}),
+  };
+}
+
+/** Every exception becomes an explicit blocking decision, including receipt storage errors. */
+export async function modelSwitchHook(state, input, authorize, now = Date.now) {
+  try { return await handleHook(state, input, authorize, now); }
+  catch { return DENY; }
+}
+
+async function handleHook(state, input, authorize, now) {
+  const command = state.command;
+  const event = input.hook_event_name;
+  const ours = input.session_id === command.sessionId;
+  const expired = () => Date.parse(command.expiresAt) <= now();
+  if (event === "PreCompact") {
+    // Natural/automatic compaction belongs to the runtime, whatever the session.
+    if (input.trigger !== "manual" || input.custom_instructions !== `${NONCE}${command.id}`) {
+      // A person's manual compaction after ours started means ours never finished; its PostCompact is not ours.
+      // ponytail: assumes one session runs compactions one at a time; a per-compaction id if that ever breaks.
+      if (ours && input.trigger === "manual" && state.read("compact-started") && !state.read("compacted")) state.once("compact-superseded");
+      return {};
+    }
+    if (!ours || expired() || state.read("failed") || state.read("denied") || state.read("superseded")
+      || !state.read("compact-issued") || state.read("switch-issued")) return DENY;
+    // prompt_id names the /compact invocation (observed on 2.1.281 PreCompact); PostCompact must repeat it.
+    if (!ID.test(input.prompt_id ?? "")) return DENY;
+    state.once("compact-started", { promptId: input.prompt_id });
+    return {};
+  }
+  if (!ours) return {};
+  if (event === "PostModelSwitch") {
+    const started = state.read("model-started");
+    if (started && input.source === "command" && input.from_model === started.fromModel
+      && input.to_model === started.model && input.requested_model === command.model) state.once("applied", started);
+    return {};
+  }
+  if (event === "PostCompact") {
+    // Only the PostCompact of our own /compact invocation is our receipt.
+    const started = state.read("compact-started");
+    if (input.trigger === "manual" && started && input.prompt_id === started.promptId
+      && !state.read("compact-superseded") && !state.read("switch-issued")) {
+      state.once("compacted");
+    }
+    return {};
+  }
+  if (event !== "PreModelSwitch") return {};
+  // Only the /model we issued is ours. A person's own change (picker, their /model) always goes through
+  // and cancels the pending request.
+  if (input.source !== "command" || input.requested_model !== command.model || !state.read("switch-issued")) {
+    if (!state.read("applied")) state.once("superseded", { model: MODEL.test(input.to_model ?? "") ? input.to_model : null });
+    return {};
+  }
+  const same = (started) => started?.fromModel === input.from_model && started?.model === input.to_model;
+  // A duplicate registration of this hook repeats the decision already made instead of contradicting it.
+  if (state.read("model-started")) return same(state.read("model-started")) ? ALLOW : DENY;
+  const deny = () => { state.once("denied"); return DENY; };
+  if (expired() || state.read("failed") || state.read("denied") || state.read("superseded") || !state.read("compacted")
+    || !MODEL.test(input.from_model ?? "") || !MODEL.test(input.to_model ?? "")) return deny();
+  // adapterConfig.model may be null or an alias. The hook names the actual runtime models; the server
+  // must re-authorize this resolved target against both the original request and current route/plan.
+  const resolved = { ...command, requestedModel: command.model, fromModel: input.from_model, model: input.to_model };
+  let allowed = false;
+  try { allowed = await authorize(resolved) === true; } catch { /* deny below, durably if storage works */ }
+  if (state.read("model-started")) return same(state.read("model-started")) ? ALLOW : DENY;
+  if (!allowed || expired() || state.read("failed") || state.read("denied") || state.read("superseded")) return deny();
+  if (state.once("model-started", { fromModel: input.from_model, model: input.to_model })) return ALLOW;
+  return same(state.read("model-started")) ? ALLOW : DENY;
+}
+
+/** Hook process body: finds this session's pending switch, if any. Errors refuse only what could be ours. */
+export async function runHook(root, event, input, authorize, now = Date.now) {
+  // We only ever switch by /model (source "command"); a picker or other named source is a person's and
+  // always goes through. An unreadable payload could be ours, so it is refused.
+  const blocking = (event === "PreModelSwitch" && (typeof input?.source !== "string" || input.source === "command"))
+    || (event === "PreCompact" && input?.trigger === "manual" && String(input?.custom_instructions ?? "").startsWith(NONCE));
+  try {
+    if (input?.hook_event_name !== event || !ID.test(input.session_id ?? "")) throw new Error("Bad hook input.");
+    const pending = currentSlot(root, input.session_id, now());
+    if (!pending || pending.free) return {};
+    if (!pending.id) throw new Error("Bad session slot.");
+    const state = switchState(root, read(join(root, pending.id, "command.json")), now());
+    return await modelSwitchHook(state, input, authorize, now);
+  } catch { return blocking ? DENY : {}; }
+}
+
+/** One feeder step. Claim before sending: a crash cannot replay a possibly-applied command. */
+export async function advanceModelSwitch(state, { ready, send, current = () => null, now = Date.now }) {
+  const terminal = (outcome) => { state.release(); return outcome; };
+  const unknown = () => (now() >= Date.parse(state.command.expiresAt) + UNKNOWN_GRACE_MS ? terminal("unknown") : "unknown");
+  if (state.read("applied")) return terminal("applied");
+  if (state.read("superseded")) return terminal("superseded");
+  if (state.read("compact-superseded") && !state.read("compacted")) return terminal("failed");
+  // Any refusal blocks the runtime's switch, even if a duplicate hook allowed it.
+  if (state.read("denied")) return terminal("not-applied");
+  // A feeder that gave up holds the receipt the hook admits by, so no /model of ours can have landed.
+  if (state.read("failed")) return state.read("switch-issued") && !state.read("model-started")?.gaveUp ? unknown() : terminal("failed");
+  if (Date.parse(state.command.expiresAt) <= now()) return state.read("switch-issued") ? unknown() : terminal("expired");
+  if (state.read("switch-issued")) return "awaiting-model-receipt";
+  if (!ready()) return "waiting-for-idle";
+  // Already on the target: the runtime fires no switch hooks for a no-op, so there is nothing to compact.
+  if (current() === state.command.model) {
+    state.once("applied", { fromModel: state.command.model, model: state.command.model });
+    return terminal("applied");
+  }
+  const compacted = state.read("compacted");
+  const phase = compacted ? "switch-issued" : "compact-issued";
+  if (!state.once(phase)) return "awaiting-compact-receipt";
+  const text = compacted ? `/model ${state.command.model}` : `/compact ${NONCE}${state.command.id}`;
+  try { if (!await send(text)) state.once("failed", { phase }); }
+  catch { state.once("failed", { phase }); }
+  if (state.read("failed")) return compacted ? unknown() : terminal("failed");
+  return compacted ? "awaiting-model-receipt" : "awaiting-compact-receipt";
+}
+
+// The server re-checks the resolved target against the request, route and plan.
+function authorizeOnServer(resolved) {
+  const runner = process.env.AR_CLI_RUNNER_ID ?? "";
+  if (!runner) return false;
+  const run = spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
+    ["call", runner, "authorize_model_switch", "--args", JSON.stringify(resolved)], { encoding: "utf8", timeout: 20_000 });
+  try { return run.status === 0 && JSON.parse(run.stdout).allowed === true; } catch { return false; }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const event = process.argv[2];
+  let input = null;
+  try { input = JSON.parse(readFileSync(0, "utf8")); } catch {}
+  // The runner sets AR_MODEL_SWITCH_DIR so its feeder and these hooks share one directory.
+  const root = process.env.AR_MODEL_SWITCH_DIR || join(process.env.CLAUDE_PLUGIN_DATA || tmpdir(), "agentradar-model-switch");
+  const result = await runHook(root, event, input, authorizeOnServer);
+  if (result.decision === "block") {
+    process.stderr.write(`${result.reason}\n`);
+    process.exit(2);
+  }
+  process.stdout.write(JSON.stringify(result));
+}

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -24,7 +24,7 @@ The Stop hook runs the same check and will not let you stop while something is o
 
 - Answer every message in the channel it came from. A human who wrote is waiting for you; answer them first.
 - Talk is not a task. Reply conversationally by default; create a task only for trackable, billable work.
-- Write to people so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a menu of options), no ids, tool names or internal terms unless asked. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
+- Write to people so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a list of ideas), no ids, paths, tool names or internal terms unless asked. Say money in dollars, never cents; give every link with what it opens. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
 - Never ask for, print or pass on a credential. AgentRadar holds the keys.
 - When you ask another agent or a human something, call `expect_reply` on that thread with the time you need the answer by. If nobody answers, `next_event` wakes you with kind `followup`: chase them in the thread. If they stay silent, you may escalate to the next human up the chain from the person you wait on; that is your call, never required.
 - Only a human accepts your work. Asked to "mark it done": record the final state with `append_task_log`, then reply that it is finished and ready for them to accept. Never call `decide_outcome` or `declare_outcome` on your own task.

package/dist/agentradar-vendor/SKILL.md

@@ -26,7 +26,7 @@ Your primary objective is to reach your quotas and drive the organisation forwar
 
 ## Talking to people
 
-Write to people so a 13-year-old would understand: a few short plain lines, then one next step, not a menu. No ids, tool names or internal terms unless asked (say "the owner", "your team", "company memory"; name a plan with its monthly price). Answer only what was asked, and say it once. Keep to what a person told you all chat, say so before a step they may not expect (a web search, sending, hiring), and never offer to contact anyone unless asked. Never talk about how messages reach you. Do the obvious thing for "undo that"; if unclear, offer short choices. Check your tools before saying what is scheduled or done; never answer from memory.
+Write to people so a 13-year-old would understand: a few short plain lines, then one next step, not a list of ideas. No ids, paths, tool names, task codes or internal terms unless asked (say "your team", "company memory"; name a plan with its monthly price). Say money in dollars, never cents; give every link with what it opens. Answer only what was asked, and say it once. Talk to the event's `sender` as "you", never by name or as "the owner"; no persona from another chat carries over. Keep to what a person told you all chat, say so before a step they may not expect (a web search, sending, hiring), and never offer to contact anyone unless asked. Never talk about how messages reach you. Do the obvious thing for "undo that"; if unclear, offer short choices. Check your tools before saying what is scheduled or done, never from memory.
 
 ## Work loop
 

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
-import { joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
+import { cancelJoin, joinOrganisation, leaveOrganisation, setupVendorAgent, terminalConfirm } from "./setup.js";
 import { callAwpTool, callToolOverCli, createTaskOverCli, listServiceToolsOverCli, parseCallArgs, runServiceToolOverCli } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
@@ -15,7 +15,7 @@ export const runArgs = (raw) => raw[0] !== "run" ? raw
 async function main() {
     const args = runArgs(process.argv.slice(2));
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
         return;
     }
     if (args[0] === "leave" && args.length === 2) {
@@ -55,21 +55,34 @@ async function main() {
         await setupVendorAgent({ trust: others.includes("--trust"), harness });
         return;
     }
+    if (args[0] === "join" && args[1] === "cancel") {
+        if (args.length !== 3 || args[2].startsWith("-")) {
+            console.error("Usage: agentradar join cancel <join-link|request-id>");
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await cancelJoin(args[2]);
+        return;
+    }
     if (args[0] === "join") {
         const named = {};
         const urls = [];
         for (let i = 1; i < args.length; i++) {
-            if (args[i] === "--name" || args[i] === "--model")
+            if (["--name", "--model", "--attach-tmux", "--session"].includes(args[i]))
                 named[args[i].slice(2)] = args[++i] ?? "-";
-            else if (args[i] !== "--trust")
+            else if (!["--trust", "--attach-current", "--allow-bypass", "--revoke-bypass"].includes(args[i]))
                 urls.push(args[i]);
         }
-        if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-"))) {
-            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust]");
+        if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-")) || (named["attach-tmux"] && args.includes("--attach-current"))) {
+            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current] [--session <claude session id>] [--allow-bypass | --revoke-bypass]");
             process.exitCode = 1;
             return;
         }
-        process.exitCode = await joinOrganisation(urls[0], { trust: args.includes("--trust"), agentName: named.name, model: named.model });
+        process.exitCode = await joinOrganisation(urls[0], {
+            trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
+            attach: args.includes("--attach-current") ? "current" : named["attach-tmux"],
+            allowBypass: args.includes("--allow-bypass"), revokeBypass: args.includes("--revoke-bypass"), confirm: terminalConfirm(),
+        });
         return;
     }
     if (args.length === 2 && args[0] === "runner" && args[1] === "start") {
@@ -89,7 +102,7 @@ async function main() {
         const call = args[0] === "call";
         const parsed = parseCallArgs(args.slice(call ? 1 : 2));
         if (!parsed || (!call && parsed.flags.length)) {
-            console.error(call ? "Usage: agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>']" : "Usage: agentradar tool run <runner-id> <tool-key> [--args '<json>']");
+            console.error(call ? "Usage: agentradar run <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar run <runner-id> [<tool>] --help" : "Usage: agentradar tool run <runner-id> <tool-key> [--args '<json>']");
             process.exitCode = 1;
             return;
         }
@@ -129,7 +142,7 @@ async function main() {
         return;
     }
     const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
-    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
     if (!help)
         process.exitCode = 1;
 }

package/dist/setup.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
-import { chmod, cp, lstat, mkdir, readFile, readlink, realpath, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { chmod, cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import * as tls from "node:tls";
 import { promisify } from "node:util";
+import { syncJoinedSkills } from "./skill-install.js";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
 /** The service's CLI build (the CLI itself and the agent-guard plugin): `installCli` keeps it current, never the npx cache. */
 const cliDist = (home) => join(home, ".agentradar", "cli", "current", "dist");
@@ -362,6 +363,8 @@ async function installRunner(home, projectPath, approved, service) {
         if (harness === "codex") {
             const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
             joined.push(`CODEX_HOME=${shellValue(codexHome)}`);
+            if (service.bypass)
+                joined.push(`CODEX_EXTRA_FLAGS=${shellValue("--dangerously-bypass-approvals-and-sandbox")}`);
             toolKeys = keys;
         }
         else if (harness === "generic") {
@@ -375,7 +378,10 @@ async function installRunner(home, projectPath, approved, service) {
             ...(service.env.AGENTRADAR_INPUT_READY_PATTERN ? [`AR_INPUT_READY_PATTERN=${shellValue(service.env.AGENTRADAR_INPUT_READY_PATTERN)}`] : []), `AGENT_PID_PATTERN=${shellValue(basename(bin).replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))}`);
         }
         else {
-            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--session-id ${service.sessionId}`)}`);
+            // The caller's own conversation, both times: a resume that fails tries it once more, never a fresh session.
+            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`);
+            // A person's model switch: the feeder and agent-guard's hooks meet in this directory, keyed by the session.
+            joined.push(`AR_CLAUDE_SESSION_ID=${shellValue(service.sessionId)}`, `AR_MODEL_SWITCH_DIR=${shellValue(join(configDir, "model-switch"))}`);
             const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
             if (configDirEnv)
                 joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
@@ -385,9 +391,18 @@ async function installRunner(home, projectPath, approved, service) {
             await writePrivateFile(settings, `${JSON.stringify({
                 extraKnownMarketplaces: { agentradar: { source: { source: "directory", path: join(cliDist(home), "agent-guard") } } },
                 enabledPlugins: { "agent-guard@agentradar": true },
+                // Nobody sits at the pane to accept bypass mode's warning screen; the operator's consent was given at approval.
+                ...(service.bypass ? { skipDangerousModePermissionPrompt: true } : {}),
             }, null, 2)}\n`);
+            if (service.bypass)
+                joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
             joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
         }
+        if (service.attach) {
+            // The caller's own tmux pane: the feeder types into it; the supervisor never starts, kills or streams it.
+            // TMUX names the caller's tmux server, which a service started by launchd or systemd would not find.
+            joined.push("AR_ATTACH=1", `TMUX_SESSION=${shellValue(service.attach)}`, "TERMINAL_BRIDGE_ENABLED=0", ...(service.env.TMUX ? [`TMUX=${shellValue(service.env.TMUX)}`] : []), ...(harness === "generic" ? [] : [`AGENT_PID_PATTERN=${shellValue(`(^|/)${harness ?? "claude"}( |$)`)}`]));
+        }
         const toolEnv = Object.entries(service.env)
             .filter(([key, value]) => (TOOL_ENV.test(key) || toolKeys.includes(key)) && key !== "ANTHROPIC_API_KEY" && value && !value.includes("\n"))
             .map(([key, value]) => `${key}=${value}`);
@@ -505,6 +520,27 @@ export async function setupVendorAgent(deps = {}) {
     }
     throw new Error("AgentRadar setup code expired; run setup again");
 }
+/** "[y/N]": only y or yes (any case) is a yes; Enter alone is No. */
+export const saidYes = (answer) => /^y(es)?$/i.test(answer.trim());
+/** The default `confirm`: a real terminal only, "[y/N]" with No unless they type y or yes. */
+export function terminalConfirm() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return undefined;
+    return async (question) => {
+        const { createInterface } = await import("node:readline/promises");
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            return saidYes(await rl.question(`${question} [y/N] `));
+        }
+        finally {
+            rl.close();
+        }
+    };
+}
+export const bypassOnNotice = (link) => `Bypass-permissions mode is ON on this machine: the agent runs without permission prompts. To turn it off: agentradar join ${link} --revoke-bypass`;
+export const BYPASS_REVOKED = "Bypass-permissions mode is off on this machine now; the agent asks before acting again.";
+export const BYPASS_QUESTION = "Allow this agent to run without permission prompts on this machine?";
+export const BYPASS_NOT_CONFIRMED = "Bypass-permissions mode stays off: your organisation allowed it, but nobody on this machine confirmed it. Run the join again in a terminal and answer yes, or add --allow-bypass.";
 /** A sortable key for `x.y.z[-pre]`; a release sorts above its prereleases. ponytail: prereleases of one version tie. */
 const versionRank = (version) => {
     const [core = "", pre] = version.split(/-(.*)/);
@@ -554,6 +590,25 @@ async function installAgentService(runnerId, home, env) {
         env: { ...env, HOME: home, NODE_BIN: process.execPath, AGENTRADAR_JS: join(dist, "index.js") },
     });
 }
+/**
+ * The Claude conversation that ran `agentradar join`: `--session`, else the CLAUDE_CODE_SESSION_ID Claude Code
+ * sets in its shell, else the newest transcript Claude Code keeps for this folder. Never a fresh one.
+ */
+async function callerSession(deps, env, home, projectPath) {
+    let id = deps.session ?? env.CLAUDE_CODE_SESSION_ID;
+    if (!id) {
+        const config = env.CLAUDE_CONFIG_DIR?.trim() ? resolve(env.CLAUDE_CONFIG_DIR.trim()) : join(home, ".claude");
+        const dir = join(config, "projects", projectPath.replace(/[^A-Za-z0-9]/g, "-"));
+        const transcripts = await Promise.all((await readdir(dir).catch(() => [])).filter((name) => name.endsWith(".jsonl"))
+            .map(async (name) => ({ id: name.slice(0, -6), at: (await stat(join(dir, name))).mtimeMs })));
+        id = transcripts.sort((a, b) => b.at - a.at)[0]?.id;
+    }
+    if (!id)
+        throw new Error("Found no Claude Code conversation in this folder to continue. Run join from inside your agent's session, or pass --session <id>.");
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id))
+        throw new Error(`Not a Claude Code session id: ${JSON.stringify(id)}`);
+    return id;
+}
 /**
  * Mode A — the organisation's own agent, on its own compute, joining through a join link.
  *
@@ -593,17 +648,60 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
     const label = harness === "generic" ? basename((env.AGENTRADAR_AGENT_BIN ?? "").trim()) : harness === "claude" ? "Claude Code" : "Codex";
     // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
     // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
-    const startJoined = async (requestId, agentId, installation, saved) => {
+    // Which session the agent is, settled before any request: a key is issued once, so never claim one for a session that cannot run.
+    const settle = async () => {
+        const tmux = deps.tmux ?? (async (args) => (await promisify(execFile)(env.TMUX_BIN || "tmux", args, { env })).stdout);
+        // Attach to the caller when it already lives in tmux: asked for by flag, or a Claude Code session in a tmux
+        // pane. The service's own session (join-<request>) re-running join is not a caller to attach to.
+        let attach = deps.attach === "current" ? env.TMUX_PANE : deps.attach;
+        if (deps.attach === "current" && !attach)
+            throw new Error("--attach-current needs a session running inside tmux");
+        if (!deps.attach && harness === "claude" && env.CLAUDECODE && env.TMUX && env.TMUX_PANE)
+            attach = env.TMUX_PANE;
+        if (attach) {
+            // A pane id (%3) dies with the tmux server; session:window.pane comes back when its session is recreated.
+            attach = (await tmux(["display-message", "-p", "-t", attach, "#{session_name}:#{window_index}.#{pane_index}"])).trim();
+            if (!attach)
+                throw new Error("tmux found no such pane");
+            if (!deps.attach && attach.startsWith("join-"))
+                attach = undefined;
+        }
+        // Unattended, the service resumes the caller's own Claude conversation, never a stranger's. An attached
+        // pane is never started from here, so there its session id only keys the model switch.
+        const sessionId = harness !== "claude" ? undefined
+            : await callerSession(deps, env, home, await realpath(cwd)).catch((error) => { if (attach)
+                return undefined; throw error; });
+        return { attach, sessionId };
+    };
+    let where;
+    /**
+     * Lead 10-04: the approver's consent alone never turns bypass on here. This machine says yes too: a flag, or
+     * a person at the terminal; with neither (an agent running the join, a script) it stays off and says why.
+     * Asked only when it would apply: approved, and not an attached pane (that keeps its own mode).
+     */
+    const localBypass = async (approvedBypass, confirmedBefore) => {
+        if (!approvedBypass || where.attach)
+            return false;
+        const yes = confirmedBefore || deps.allowBypass === true || (deps.confirm ? await deps.confirm(BYPASS_QUESTION) : false);
+        if (!yes)
+            log(BYPASS_NOT_CONFIRMED);
+        return yes;
+    };
+    const startJoined = async (requestId, agentId, installation, approvedBypass, bypass, saved) => {
         const runnerId = `join-${requestId}`;
-        // The service's Claude session id: a valid UUID derived from the request, so a re-run resumes the same one.
-        const hex = createHash("sha256").update(requestId).digest("hex");
-        const sessionId = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+        const { attach } = where;
         const projectPath = harness === "claude"
             ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
             : await realpath(cwd);
-        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId, env });
+        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId: where.sessionId ?? requestId, env, attach, bypass });
         await saved?.();
         log(`Runner installed → ${runnerEnv}`);
+        if (bypass)
+            log(bypassOnNotice(enrolmentUrl));
+        // Best effort: a failed first sync never stops the join; the service's feeder syncs them again.
+        await syncJoinedSkills(runnerId, { home, fetch: fetchImpl, log }).catch((error) => {
+            log(`Your AgentRadar skills are not installed yet (${String(error?.message ?? error).split("\n")[0]}); the runner installs them once it is running.`);
+        });
         try {
             await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
         }
@@ -611,7 +709,18 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             log(`Could not start the service: ${error.message.split("\n")[0]}. Start it by hand with: agentradar runner start ${runnerId}`);
             return 1;
         }
-        log(`Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        if (attach) {
+            log(`Connected. Your welcome and every client message are typed into this session (tmux ${attach}), and you answer here. Nothing else was started. To stop: agentradar leave ${runnerId}`);
+            if (approvedBypass)
+                log("Your organisation allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
+            log("Running as a service; the delivery restarts on crash and reboot.");
+            return 0;
+        }
+        const mode = bypass ? ", in bypass-permissions mode as your organisation allowed and this machine confirmed" : "";
+        // Only Claude resumes the caller's own conversation; Codex and a generic CLI start their own session.
+        log(harness === "claude"
+            ? `Connected. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`
+            : `Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
         log("Running as a service; it restarts on crash and reboot.");
         return 0;
     };
@@ -627,6 +736,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         throw new Error("That is not an AgentRadar join link (expected https://…/invite/<token>)");
     }
     const api = (path) => new URL(`/api/${path}`, link.origin);
+    where = await settle();
     const mcpEndpoint = env.AWP_MCP_URL || api("mcp").toString();
     const joinsDir = join(home, ".agentradar", "joins");
     await mkdir(joinsDir, { recursive: true, mode: 0o700 });
@@ -646,7 +756,15 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         const bearer = envValue(saved, "AWP_BEARER");
         if (!bearer)
             throw new Error("This machine left that organisation (agentradar leave). A key is issued once; ask your organisation for a new join link.");
-        return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer });
+        // Lead 10-04: the remembered yes is revocable. `--revoke-bypass` forgets it and the service runs with prompts.
+        if (deps.revokeBypass && state.bypassConfirmed) {
+            state = { ...state, bypassConfirmed: false };
+            await writePrivateFile(statePath, JSON.stringify(state));
+            log(BYPASS_REVOKED);
+        }
+        const approvedBypass = state.bypassPermissions === true;
+        const bypass = deps.revokeBypass ? false : await localBypass(approvedBypass, state.bypassConfirmed === true);
+        return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer }, approvedBypass, bypass);
     }
     if (!state) {
         const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
@@ -698,8 +816,11 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
                 throw new Error("AgentRadar returned an invalid key claim");
             }
             log("Approved.");
-            const joined = { ...state, agentId: claimed.agentId };
-            return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, () => writePrivateFile(statePath, JSON.stringify(joined)));
+            // Bypass-permissions only when the operator consented at approval; the server says so with the key.
+            const approvedBypass = claimed.bypassPermissions === true;
+            const bypass = await localBypass(approvedBypass, false);
+            const joined = { ...state, agentId: claimed.agentId, ...(approvedBypass ? { bypassPermissions: true } : {}), ...(bypass ? { bypassConfirmed: true } : {}) };
+            return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, approvedBypass, bypass, () => writePrivateFile(statePath, JSON.stringify(joined)));
         }
         const said = await failureMessage(response);
         if (response.status === 409 && said.includes("must be approved")) {
@@ -709,12 +830,61 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         if (response.status === 409 && said.includes("rejected")) {
             throw new Error("Your organisation declined this join request. Ask it for a new join link.");
         }
+        if (response.status === 409 && said.includes("withdrawn")) {
+            throw new Error("This join request was withdrawn (agentradar join cancel). Ask your organisation for a new join link.");
+        }
         if (response.status === 409 && /already (?:used|claimed)/.test(said)) {
             throw new Error("This join link's key was already claimed. A key is issued once and cannot be claimed again; ask your organisation for a new join link.");
         }
         throw new Error(said);
     }
 }
+/**
+ * `agentradar join cancel <join-link|request-id>`: withdraw this machine's pending join request. Only the
+ * claim secret saved here proves it is the requester; the state file goes once the server agrees.
+ */
+export async function cancelJoin(target, deps = {}) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const log = deps.log ?? console.log;
+    const joinsDir = join(deps.home ?? homedir(), ".agentradar", "joins");
+    const token = /^https?:\/\//.test(target)
+        ? /^\/(?:api\/invites|invite)\/([^/]+?)(?:\.md)?(?:\/|$)/.exec(new URL(target).pathname)?.[1]
+        : undefined;
+    let statePath;
+    let state;
+    for (const name of token ? [`${createHash("sha256").update(token).digest("hex")}.json`] : await readdir(joinsDir).catch(() => [])) {
+        if (!name.endsWith(".json"))
+            continue;
+        const read = await readFile(join(joinsDir, name), "utf8").then((text) => JSON.parse(text), () => undefined);
+        if (read && (token || read.requestId === target)) {
+            statePath = join(joinsDir, name);
+            state = read;
+            break;
+        }
+    }
+    if (!state || !statePath) {
+        log(`No join request from this machine for ${target}.`);
+        return 1;
+    }
+    if (state.agentId) {
+        log(`That join was already approved. To leave the organisation: agentradar leave join-${state.requestId}`);
+        return 1;
+    }
+    // The secret goes only back to the AgentRadar host that issued it.
+    const origin = token ? new URL(target).origin : state.approvalUrl ? new URL(state.approvalUrl).origin : "";
+    if (!origin || !trustedMcpEndpoint(origin)) {
+        log("Pass the join link instead of the request id: agentradar join cancel <join-link>");
+        return 1;
+    }
+    const response = await postJson(fetchImpl, new URL(`/api/join-requests/${encodeURIComponent(state.requestId)}/cancel`, origin), { claimSecret: state.claimSecret });
+    if (!response.ok) {
+        log(`Could not withdraw the join request: ${await failureMessage(response)}`);
+        return 1;
+    }
+    await rm(statePath, { force: true });
+    log("Join request withdrawn. Nobody can approve it now, and the name you asked for is free again.");
+    return 0;
+}
 /**
  * `agentradar leave <runner-id>`: stop and remove the service, end the agent's session, and delete its env
  * file, bearer and config. The folder the agent worked in stays, with the work.
@@ -742,7 +912,9 @@ export async function leaveOrganisation(runnerId, deps = {}) {
         await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
     }
     // The service stopping leaves the session running; `=` matches the tmux session name exactly.
-    await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
+    // An attached pane is the caller's own session: it stays.
+    if (envValue(saved, "AR_ATTACH") !== "1")
+        await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
     for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
         await rm(path, { force: true });
     for (const dir of ["run", "config", "codex"])

package/dist/skill-install.js

@@ -1,6 +1,9 @@
-import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { awpRequest, envValue } from "./tool-run.js";
+const MANAGED_MARK = ".agentradar-managed";
+const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
 async function ensureDirectory(path) {
     try {
         const info = await lstat(path);
@@ -38,7 +41,98 @@ export async function installVendorSkill(deps = {}) {
         });
     }
     // The runner keeps this skill current from AgentRadar; the marker says the folder is AgentRadar's to replace.
-    await writeFile(join(skillDir, ".agentradar-managed"), "Written by AgentRadar; replaced on every sync.\n");
+    await writeFile(join(skillDir, MANAGED_MARK), "Written by AgentRadar; replaced on every sync.\n");
     (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
 }
+const isManaged = async (dir) => (await lstat(dir).then((info) => info.isDirectory(), () => false)) && (await lstat(join(dir, MANAGED_MARK)).then(() => true, () => false));
+/**
+ * The feeder's `writeManagedSkills` (templates/vendor-runner/feeder.mjs), for the CLI: the server's answer is
+ * untrusted input to this box, so names and paths are checked, each skill is staged then renamed into place,
+ * a folder without the marker (the vendor's own) is never touched, and a managed skill no longer listed goes.
+ */
+const sameSkill = async (dir, files) => {
+    try {
+        const have = [];
+        for (const p of await readdir(dir, { recursive: true }))
+            if (p !== MANAGED_MARK && (await stat(join(dir, p))).isFile())
+                have.push(p);
+        for (const f of files)
+            if (await readFile(join(dir, f.path), "utf8") !== f.content)
+                return false;
+        return have.length === files.length;
+    }
+    catch {
+        return false;
+    }
+};
+export async function writeManagedSkills(skillsDir, skills) {
+    await mkdir(skillsDir, { recursive: true });
+    const written = new Set();
+    for (const skill of skills) {
+        const name = String(skill?.name ?? "");
+        const target = join(skillsDir, name);
+        if (!SKILL_NAME.test(name))
+            continue;
+        if (await lstat(target).then(() => true, () => false) && !(await isManaged(target)))
+            continue;
+        const files = (Array.isArray(skill.files) ? skill.files : []);
+        if (files.some((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+            || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path))))
+            continue;
+        // An unchanged skill is not rewritten: the agent's CLI may be reading it.
+        if (await sameSkill(target, files)) {
+            written.add(name);
+            continue;
+        }
+        const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+        const old = join(skillsDir, `.${name}.old-${process.pid}`);
+        try {
+            await rm(staging, { recursive: true, force: true });
+            for (const f of files) {
+                await mkdir(dirname(join(staging, f.path)), { recursive: true });
+                await writeFile(join(staging, f.path), f.content);
+            }
+            await writeFile(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+            // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
+            await rm(old, { recursive: true, force: true });
+            await rename(target, old).catch((err) => { if (err?.code !== "ENOENT")
+                throw err; });
+            await rename(staging, target);
+            await rm(old, { recursive: true, force: true });
+            written.add(name);
+        }
+        catch {
+            await rm(staging, { recursive: true, force: true });
+            if (!(await lstat(target).then(() => true, () => false)))
+                await rename(old, target).catch(() => { });
+            if (await isManaged(target))
+                written.add(name);
+        }
+    }
+    for (const entry of await readdir(skillsDir)) {
+        if (!written.has(entry) && await isManaged(join(skillsDir, entry)))
+            await rm(join(skillsDir, entry), { recursive: true, force: true });
+    }
+    return [...written];
+}
+/**
+ * R650 — a joined agent's AgentRadar skills (`my_skills`: the bundled set plus the ones linked to it), written
+ * at join into the directory its CLI reads, the feeder's `skillsDirFor`: Claude `$AR_BASE/.claude/skills`,
+ * Codex `$CODEX_HOME/skills`. Done here because a session that acts only through `agentradar run` has no
+ * feeder; where the service runs, its feeder keeps them current.
+ */
+export async function syncJoinedSkills(runnerId, deps) {
+    const env = await readFile(join(deps.home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
+    const root = envValue(env, "AR_AGENT_HARNESS") === "codex" ? envValue(env, "CODEX_HOME") : envValue(env, "AR_BASE");
+    if (!root)
+        return;
+    const skillsDir = envValue(env, "AR_AGENT_HARNESS") === "codex" ? join(root, "skills") : join(root, ".claude", "skills");
+    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: {} }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    const text = body?.result?.content?.find((c) => c.type === "text")?.text;
+    const answer = (text ? JSON.parse(text) : {});
+    if (!answer.ok || !Array.isArray(answer.skills))
+        throw new Error("AgentRadar did not return your skills");
+    const written = await writeManagedSkills(skillsDir, answer.skills);
+    deps.log(`Installed ${written.length} AgentRadar skill(s) in ${skillsDir}.`);
+}
 //# sourceMappingURL=skill-install.js.map

package/dist/tool-run.js

@@ -21,6 +21,8 @@ export async function runServiceToolOverCli(runnerId, toolKey, argumentsJson, de
 }
 /** `agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>']`: any AWP tool from a shell, so a just-joined agent works before its harness reloads MCP tools. */
 export async function callToolOverCli(runnerId, tool, argumentsJson, deps = {}, flags = []) {
+    if (flags.some(([flag]) => flag === "help"))
+        return await describeTools(runnerId, tool, deps);
     const parameters = argumentsJson === undefined ? {} : parseArgumentsObject(argumentsJson, deps.logError ?? console.error);
     if (!parameters)
         return 1;
@@ -65,6 +67,10 @@ export function parseCallArgs(rest) {
             positional.push(arg);
             continue;
         }
+        if (arg === "--help") {
+            flags.push(["help", ""]);
+            continue;
+        }
         const value = rest[++i];
         if (value === undefined)
             return null;
@@ -73,7 +79,37 @@ export function parseCallArgs(rest) {
         else
             flags.push([arg.slice(2), value]);
     }
-    return positional.length === 2 ? { runnerId: positional[0], tool: positional[1], json, flags } : null;
+    const help = flags.some(([flag]) => flag === "help");
+    return positional.length === 2 || (help && positional.length === 1)
+        ? { runnerId: positional[0], tool: positional[1] ?? "", json, flags } : null;
+}
+async function listedTools(runnerId, deps) {
+    const listed = await awpRequest(runnerId, "tools/list", {}, deps);
+    return listed ? listed.result?.tools ?? [] : null;
+}
+// An agent that guessed a tool name from memory needs the real list, or it goes looking with commands
+// its harness has not allowed and the session stalls on a permission prompt.
+const unknownTool = (runnerId, tool, tools) => `${tool} is not a tool on this server. Its tools: ${tools.map((entry) => entry.name).join(" ")}. `
+    + `\`agentradar run ${runnerId} <tool> --help\` shows a tool's arguments.`;
+/** `agentradar run <runner-id> [<tool>] --help`: the server's own tool list or one tool's arguments. */
+async function describeTools(runnerId, tool, deps) {
+    const tools = await listedTools(runnerId, deps);
+    if (!tools)
+        return 1;
+    const log = deps.log ?? console.log;
+    if (!tool) {
+        log(`Tools: ${tools.map((entry) => entry.name).join(" ")}. \`agentradar run ${runnerId} <tool> --help\` shows a tool's arguments.`);
+        return 0;
+    }
+    const entry = tools.find((candidate) => candidate.name === tool);
+    if (!entry) {
+        (deps.logError ?? console.error)(unknownTool(runnerId, tool, tools));
+        return 1;
+    }
+    const required = entry.inputSchema?.required ?? [];
+    const names = Object.keys(entry.inputSchema?.properties ?? {}).map((name) => `--${name}${required.includes(name) ? " (required)" : ""}`);
+    log(`${tool}: ${entry.description ?? ""}\nArguments: ${names.join(" ") || "none"}`);
+    return 0;
 }
 /**
  * `--text "hi" --conversation-id X` as the tool's own arguments, typed by the inputSchema the server
@@ -81,10 +117,15 @@ export function parseCallArgs(rest) {
  */
 async function flagArguments(runnerId, tool, flags, deps) {
     const logError = deps.logError ?? console.error;
-    const listed = await awpRequest(runnerId, "tools/list", {}, deps);
-    if (!listed)
+    const tools = await listedTools(runnerId, deps);
+    if (!tools)
+        return null;
+    const entry = tools.find((candidate) => candidate.name === tool);
+    if (!entry) {
+        logError(unknownTool(runnerId, tool, tools));
         return null;
-    const schema = listed.result?.tools?.find((entry) => entry.name === tool)?.inputSchema?.properties ?? {};
+    }
+    const schema = entry.inputSchema?.properties ?? {};
     const out = {};
     const camel = (flag) => flag.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
     for (let [flag, value] of flags) {
@@ -203,7 +244,7 @@ export async function callAwpTool(runnerId, name, toolArguments, deps) {
 }
 const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 /** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
-async function awpRequest(runnerId, method, params, deps) {
+export async function awpRequest(runnerId, method, params, deps) {
     const logError = deps.logError ?? console.error;
     if (!RUNNER_ID.test(runnerId)) {
         logError("Invalid runner ID");

package/dist/vendor-runner/feeder.mjs

@@ -24,6 +24,7 @@ import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
+import { homedir } from "node:os";
 import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
@@ -230,6 +231,7 @@ async function nextEvent(ackEventIds, runnerState) {
     sessionId: runnerSessionId,
     ...(ackEventIds && ackEventIds.length ? { ackEventIds } : {}),
     ...(runnerState ? { runnerState } : {}),
+    ...(_switchId ? { modelSwitchId: _switchId } : {}),
   };
   const result = await mcpPost("tools/call", { name: "next_event", arguments: args }, { timeoutMs: NEXT_EVENT_TIMEOUT_MS });
   return toolJson(result); // { events: [...] }
@@ -663,6 +665,14 @@ const isManaged = (dir) => {
   const st = fs.lstatSync(dir, { throwIfNoEntry: false });
   return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
 };
+const sameSkill = (dir, files) => {
+  try {
+    const have = fs.readdirSync(dir, { recursive: true }).filter((p) => p !== MANAGED_MARK && fs.statSync(join(dir, p)).isFile());
+    return have.length === files.length && files.every((f) => fs.readFileSync(join(dir, f.path), "utf8") === f.content);
+  } catch {
+    return false;
+  }
+};
 
 export function writeManagedSkills(skillsDir, skills) {
   fs.mkdirSync(skillsDir, { recursive: true });
@@ -679,7 +689,11 @@ export function writeManagedSkills(skillsDir, skills) {
     const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
       || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
     if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    // An unchanged skill is not rewritten: the agent's CLI may be reading it (Codex skipped a SKILL.md that a
+    // periodic resync had just removed).
+    if (sameSkill(target, files)) { written.add(name); continue; }
     const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+    const old = join(skillsDir, `.${name}.old-${process.pid}`);
     try {
       fs.rmSync(staging, { recursive: true, force: true });
       for (const f of files) {
@@ -687,12 +701,16 @@ export function writeManagedSkills(skillsDir, skills) {
         fs.writeFileSync(join(staging, f.path), f.content);
       }
       fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
-      fs.rmSync(target, { recursive: true, force: true });
+      // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
+      fs.rmSync(old, { recursive: true, force: true });
+      if (fs.existsSync(target)) fs.renameSync(target, old);
       fs.renameSync(staging, target);
+      fs.rmSync(old, { recursive: true, force: true });
       written.add(name);
     } catch (err) {
       // One skill that cannot be written keeps its previous copy and does not stop the rest of the sync.
       fs.rmSync(staging, { recursive: true, force: true });
+      if (!fs.existsSync(target) && fs.existsSync(old)) fs.renameSync(old, target);
       if (isManaged(target)) written.add(name);
       console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -719,6 +737,176 @@ async function syncSkills() {
   }
 }
 
+// --------------------------------------------------------------------------
+// A person's model switch (switch_model). The runner compacts, then types /model; agent-guard's hooks write
+// the receipts and ask the server to re-authorize the model the runtime resolved. This side types and reports.
+// --------------------------------------------------------------------------
+const MODEL_SWITCH_STEP_MS = 2000;
+// How long clients wait on a /model whose receipt never came before the pane is theirs again.
+const MODEL_SWITCH_CONFIRM_MS = 2 * 60_000;
+let _switchId = null;
+let _switching = false;
+let _nextSwitch = null;
+
+const readJson = (path) => { try { return JSON.parse(fs.readFileSync(path, "utf8")); } catch { return null; } };
+function writeJson(path, value) {
+  const temporary = `${path}.${process.pid}.tmp`;
+  fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: fs.statSync(path, { throwIfNoEntry: false })?.mode ?? 0o600 });
+  fs.renameSync(temporary, path);
+}
+
+/**
+ * The model the session last ran on: the newest transcript line that names one; null when unknown.
+ * ponytail: a restart onto a model changed outside the session (settings edited by hand) still reads the last
+ * turn's model; ask the runtime directly if that ever happens.
+ */
+export function sessionModel(home, sessionId) {
+  return transcript(home, sessionId)?.model ?? null;
+}
+
+/** Claude Code declines /compact on a near-empty session (PreCompact fires, PostCompact never does); its own line says so. */
+export function compactDeclined(home, sessionId, id) {
+  return transcript(home, sessionId)?.declined.has(`AgentRadar model switch ${id}`) ?? false;
+}
+
+// Read every step while a switch waits, so incrementally: each read parses only the whole lines appended since
+// the last. A first read starts this far from the end; an older model line reads as unknown, so the switch runs.
+const TRANSCRIPT_TAIL = 1 << 20;
+const _transcripts = new Map();
+function transcript(home, sessionId) {
+  let projects;
+  try { projects = fs.readdirSync(join(home, "projects")); } catch { return null; }
+  for (const project of projects) {
+    const path = join(home, "projects", project, `${sessionId}.jsonl`);
+    let fd;
+    try { fd = fs.openSync(path, "r"); } catch { continue; }
+    try {
+      const size = fs.fstatSync(fd).size;
+      let seen = _transcripts.get(path);
+      if (!seen || size < seen.offset) {
+        _transcripts.set(path, seen = { offset: Math.max(0, size - TRANSCRIPT_TAIL), model: null, declined: new Set() });
+      }
+      const buffer = Buffer.alloc(size - seen.offset);
+      fs.readSync(fd, buffer, 0, buffer.length, seen.offset);
+      const whole = buffer.lastIndexOf(10) + 1;
+      seen.offset += whole;
+      // A line cut by the first read fails to parse and is skipped.
+      for (const line of buffer.subarray(0, whole).toString("utf8").split("\n")) {
+        let entry;
+        try { entry = JSON.parse(line); } catch { continue; }
+        // A /model (ours or a person's) names the new model only by marketing name, and none follows until the
+        // next turn: unknown, so the switch runs rather than being wrongly taken as already applied.
+        if (entry?.type === "user" && String(entry.message?.content).includes("<command-name>/model</command-name>")) seen.model = null;
+        const model = entry?.type === "assistant" ? entry.message?.model
+          : entry?.attachment?.type === "model" ? entry.attachment.identity?.modelId : null;
+        // "<synthetic>" marks a message Claude Code made locally, not a model.
+        if (typeof model === "string" && /^[a-zA-Z0-9]/.test(model)) seen.model = model;
+        if (entry?.subtype === "local_command" && entry.commandRun?.command === "compact"
+          && String(entry.content).includes("Not enough messages to compact.")) seen.declined.add(entry.commandRun.args);
+      }
+      return seen;
+    } finally { fs.closeSync(fd); }
+  }
+  return null;
+}
+
+/**
+ * /model also saves its pick as the default for every new session on this login. That default is the
+ * vendor's, so it goes back; the runner's own --settings file keeps the switch across this runner's restarts.
+ * ponytail: a person's own /model later is not written there, so a restart returns to the last requested switch.
+ */
+function keepSwitchedModel(state, result, home, ownSettings) {
+  const before = state.read("user-default");
+  const path = join(home, "settings.json");
+  const user = before && readJson(path);
+  if (user && [state.command.model, result.model].includes(user.model)) {
+    if (before.model === undefined) delete user.model;
+    else user.model = before.model;
+    writeJson(path, user);
+  }
+  const own = ownSettings && readJson(ownSettings);
+  if (own && result.outcome === "applied") writeJson(ownSettings, { ...own, model: result.model });
+}
+
+async function reportModelSwitch(args) {
+  const answer = toolJson(await mcpPostIsolated("tools/call", { name: "model_switch_result", arguments: args }));
+  if (!answer.ok) throw new Error(answer.error ?? "model_switch_result refused");
+}
+
+const paneIdle = () => { const p = capturePane(); return Boolean(p && !p.inProgress && p.inputReady); };
+
+/** Carry out one model switch from next_event, then report how it ended. Single-flight; never throws. */
+export async function driveModelSwitch(command, {
+  dir = process.env.AR_MODEL_SWITCH_DIR,
+  sessionId = process.env.AR_CLAUDE_SESSION_ID,
+  home = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"),
+  ownSettings = process.env.CLAUDE_SETTINGS,
+  ready = paneIdle,
+  type = (text) => injectFrame(text, "model switch"),
+  current = () => sessionModel(home, sessionId),
+  declined = (id) => compactDeclined(home, sessionId, id),
+  report = reportModelSwitch,
+  step = MODEL_SWITCH_STEP_MS,
+  confirmWait = MODEL_SWITCH_CONFIRM_MS,
+  now = Date.now,
+} = {}) {
+  if (_switching || !command?.id || _switchId === command.id) return;
+  _switchId = command.id;
+  _switching = true;
+  let result = { outcome: "failed" };
+  try {
+    // Only Claude Code has the compact and model-switch hooks this relies on.
+    if (AR_AGENT_HARNESS !== "claude" || !dir || !sessionId) throw new Error("this runner cannot switch models");
+    const { switchState, advanceModelSwitch } = await import("../agent-guard/scripts/model-switch.mjs");
+    const state = switchState(dir, { ...command, sessionId });
+    const send = (text) => {
+      if (text.startsWith("/model ")) {
+        state.once("user-default", { model: readJson(join(home, "settings.json"))?.model });
+        state.once("model-sent", { at: now() });
+      }
+      return type(text);
+    };
+    const giveUpAt = Date.parse(command.expiresAt) + confirmWait + 60_000;
+    // ponytail: a fixed 2 s step; watch the receipt files if switch latency ever matters.
+    for (;;) {
+      const outcome = await advanceModelSwitch(state, { ready, send, current });
+      if (state.read("released")) {
+        result = { outcome, ...(state.read("applied") ?? state.read("model-started") ?? state.read("superseded") ?? {}) };
+        break;
+      }
+      // Nothing to compact is as good as compacted: the next step types /model.
+      if (state.read("compact-started") && !state.read("compacted") && declined(command.id)) state.once("compacted", { declined: true });
+      const sent = state.read("model-sent");
+      if ((sent && now() - sent.at >= confirmWait) || now() > giveUpAt) {
+        // No receipt in time: hand the pane back to clients. Marked failed, the hooks refuse our /model if it
+        // lands late; the session slot stays held until it ages out, so a new switch waits for that too.
+        // Giving up claims the receipt the hook's admit claims, exclusively: exactly one wins. A hook that
+        // loses refuses our /model; one that won made the switch, which may or may not have landed.
+        // A re-drive after a lost report finds its own earlier claim.
+        const gaveUp = state.once("model-started", { gaveUp: true }) || state.read("model-started")?.gaveUp === true;
+        if (gaveUp) state.once("failed", { phase: "gave-up" });
+        result = gaveUp ? { outcome: "failed" } : { outcome: "unknown", ...state.read("model-started") };
+        break;
+      }
+      await sleep(step);
+    }
+    // A person's own pick stays their default; any other ending puts back what our /model changed.
+    if (result.outcome !== "superseded") keepSwitchedModel(state, result, home, ownSettings);
+  } catch (err) {
+    console.warn(`[feeder] model switch ${command.id}: ${err instanceof Error ? err.message : String(err)}`);
+  } finally {
+    _switching = false;
+  }
+  try {
+    await report({ id: command.id, outcome: result.outcome, fromModel: result.fromModel ?? null, model: result.model ?? null });
+    console.log(`[feeder] model switch ${command.id}: ${result.outcome}`);
+  } catch (err) {
+    // The server keeps offering an unreported switch; driving it again only re-reads its ending and reports.
+    console.warn(`[feeder] model switch ${command.id}: report failed: ${err instanceof Error ? err.message : String(err)}`);
+    setTimeout(() => { if (_switchId === command.id) _switchId = null; }, ERROR_DELAY_MS).unref?.();
+  }
+}
+
 // --------------------------------------------------------------------------
 // The loop: initialize → poll next_event → inject each into the live pane → ack the
 // delivered ones on the NEXT poll → self-heal on transient MCP errors (runner shape).
@@ -730,7 +918,7 @@ let _lastRunnerState = null;
 
 /** One receive→inject→ack-select cycle (extracted from loop() + exported so the #173b _pendingAck
  *  fence is directly testable). Sets `_pendingAck` = the eventIds to ack on the NEXT poll. */
-export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent) {
+export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch) {
   // next_event refreshes the portal's runner heartbeat. Never call it for a detached/orphan feeder: a
   // process without its owned tmux session cannot receive work, so polling would paint a false Live state
   // while every event stays unacknowledged. The supervisor recreates the session; until then the durable
@@ -740,7 +928,12 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
     await sleep(IDLE_DELAY_MS);
     return;
   }
-  const state = readiness();
+  // A switch from the last poll starts after that poll's batch was typed, so it never types over one.
+  if (_nextSwitch) void drive(_nextSwitch);
+  _nextSwitch = null;
+  let state = readiness();
+  // The switch owns the pane until it ends: nothing is drained meanwhile, so nothing is typed over it.
+  if (_switching && state === "ready") state = "starting";
   if (state !== _lastRunnerState) {
     console.log(`[feeder] runner state ${_lastRunnerState ?? "unknown"} → ${state}`);
     _lastRunnerState = state;
@@ -748,7 +941,8 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // The server treats non-ready calls as status-only heartbeats: no drain and no ack. Keep any pending ack
   // until readiness returns, and defensively ignore events from an older server that does not know the gate.
   const canWork = state === "ready";
-  const { events = [], livenessProbe, welcome } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  const { events = [], livenessProbe, welcome, modelSwitch } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  _nextSwitch = modelSwitch ?? null;
   if (!canWork) {
     await sleep(IDLE_DELAY_MS);
     return;

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -189,7 +189,7 @@ unset CLAUDE_CODE_OAUTH_TOKEN
 _claude_cfg=()
 [ -n "${CLAUDE_CONFIG_DIR:-}" ] && _claude_cfg=( CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" )
 # agent-guard (templates/agent-guard): its hooks ask the server what this runner still owes through the CLI.
-for _k in AR_CLI_RUNNER_ID AR_AGENTRADAR_BIN AR_DISCIPLINE_EVERY CLAUDE_CODE_PLUGIN_CACHE_DIR; do
+for _k in AR_CLI_RUNNER_ID AR_AGENTRADAR_BIN AR_DISCIPLINE_EVERY AR_MODEL_SWITCH_DIR CLAUDE_CODE_PLUGIN_CACHE_DIR; do
   [ -n "${!_k:-}" ] && _claude_cfg+=( "${_k}=${!_k}" )
 done
 
@@ -284,6 +284,12 @@ ensure_agent() {
     log "agent session '${TMUX_SESSION}' already live"
     return 0
   fi
+  # AR_ATTACH=1 (`agentradar join` from a session already in tmux): the pane is the caller's own. Never start,
+  # kill or replace it; whatever supervises it brings it back, and the feeder waits until then.
+  if [ "${AR_ATTACH:-}" = "1" ]; then
+    log "attached pane '${TMUX_SESSION}' has no live ${AR_AGENT_HARNESS}; waiting for its own supervisor"
+    return 1
+  fi
   if session_exists && ! pane_alive; then
     log "session '${TMUX_SESSION}' exists but claude pane is dead — recreating"
     "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "engines": {
     "node": ">=20"
   },
@@ -28,7 +28,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/guard.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
+    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/*.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
     "clean": "rm -rf dist",
     "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit",