agentradar-cli 0.2.8 → 0.2.10

package/dist/agent-guard/hooks/hooks.json

@@ -1,7 +1,11 @@
 {
-  "description": "Blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns.",
+  "description": "Blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
   "hooks": {
     "Stop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }]
+    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
+    "PreCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }] }],
+    "PostCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }] }],
+    "PreModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreModelSwitch || exit 2", "timeout": 30 }] }],
+    "PostModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostModelSwitch", "timeout": 30 }] }]
   }
 }

package/dist/agent-guard/scripts/model-switch.mjs

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+// AgentRadar compact-then-switch controller. Registered for PreCompact, PostCompact, PreModelSwitch and
+// PostModelSwitch as `model-switch.mjs <event>`; JSON on stdin. A block exits 2, so a hook that fails for
+// any reason refuses our model switch, while compactions that are not ours always go through.
+import { spawnSync } from "node:child_process";
+import { linkSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const ID = /^[a-zA-Z0-9_-]{1,100}$/;
+// Runtime ids can carry a context-window suffix, e.g. claude-opus-5[1m].
+const MODEL = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,199}(\[[a-z0-9]{1,16}\])?$/;
+const NONCE = "AgentRadar model switch ";
+// An issued switch with no receipt keeps its session slot this long past expiry, for a late receipt.
+const UNKNOWN_GRACE_MS = 10 * 60_000;
+const DENY = { decision: "block", reason: "AgentRadar could not verify this compact-then-switch request." };
+const ALLOW = { hookSpecificOutput: { hookEventName: "PreModelSwitch", permissionDecision: "allow" } };
+const read = (path) => {
+  try { return JSON.parse(readFileSync(path, "utf8")); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+};
+function once(path, value) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temporary, JSON.stringify(value), { flag: "wx", mode: 0o600 });
+  try {
+    // Link publishes a complete file exclusively; readers never observe half-written JSON.
+    linkSync(temporary, path);
+    return true;
+  } catch (error) { if (error.code === "EEXIST") return false; throw error; }
+  finally { unlinkSync(temporary); }
+}
+// One pending switch per session. Slots are numbered and only ever created exclusively, never moved or
+// removed, so a hook can never read "nothing pending" while a switch is live. A slot is free once its switch
+// is released or aged out; the next request then claims the next number. A slot this code cannot use (corrupt,
+// or without a valid id and expiresAt) ages out from its write time, so it never locks a session forever.
+// ponytail: one small file per switch per session accumulates; prune free slots if that ever matters.
+function currentSlot(root, sessionId, now) {
+  let names;
+  try { names = readdirSync(root); } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  const prefix = `session-${sessionId}.`;
+  const n = Math.max(-1, ...names.filter((name) => name.startsWith(prefix) && /^\d{1,9}\.json$/.test(name.slice(prefix.length)))
+    .map((name) => Number(name.slice(prefix.length, -".json".length))));
+  if (n < 0) return null;
+  const slot = join(root, `${prefix}${n}.json`);
+  let pending = null;
+  try { pending = read(slot); } catch { /* corrupt: ages out below */ }
+  const id = ID.test(pending?.id ?? "") ? pending.id : null;
+  const expiresAt = Date.parse(pending?.expiresAt);
+  const until = id && Number.isFinite(expiresAt) ? expiresAt : statSync(slot).mtimeMs;
+  const released = id !== null && read(join(root, id, "released.json")) !== null;
+  return { n, id, free: released || until + UNKNOWN_GRACE_MS <= now };
+}
+
+/** Local receipts belong to vendor-owned compute, not independent server attestation. */
+export function switchState(root, command, now = Date.now()) {
+  if (!ID.test(command?.id ?? "") || !ID.test(command?.sessionId ?? "")
+    || !MODEL.test(command?.model ?? "") || !Number.isFinite(Date.parse(command?.expiresAt))) {
+    throw new Error("Invalid model switch.");
+  }
+  const dir = join(root, command.id);
+  const path = (name) => join(dir, `${name}.json`);
+  const existing = read(path("command"));
+  if (!existing && Date.parse(command.expiresAt) <= now) throw new Error("Expired model switch.");
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const bound = { id: command.id, sessionId: command.sessionId, model: command.model, expiresAt: command.expiresAt };
+  once(path("command"), bound);
+  if (JSON.stringify(read(path("command"))) !== JSON.stringify(bound)) throw new Error("Model switch identity changed.");
+  // The session slot is claimed only by an exclusive create; no lock, so no lock to go stale.
+  for (let attempt = 0; ; attempt++) {
+    const pending = currentSlot(root, command.sessionId, now);
+    if (pending?.id === command.id) break;
+    if (attempt >= 3) throw new Error("This session's model switch slot is contended.");
+    // An abandoned switch (feeder gone, receipt lost) must not disable switching for the session.
+    if (pending && !pending.free) throw new Error("This session already has a pending model switch.");
+    once(join(root, `session-${command.sessionId}.${(pending?.n ?? -1) + 1}.json`), { id: command.id, expiresAt: command.expiresAt });
+  }
+  return {
+    command: bound,
+    read: (name) => read(path(name)),
+    once: (name, value = {}) => once(path(name), value),
+    release: () => once(path("released"), {}),
+  };
+}
+
+/** Every exception becomes an explicit blocking decision, including receipt storage errors. */
+export async function modelSwitchHook(state, input, authorize, now = Date.now) {
+  try { return await handleHook(state, input, authorize, now); }
+  catch { return DENY; }
+}
+
+async function handleHook(state, input, authorize, now) {
+  const command = state.command;
+  const event = input.hook_event_name;
+  const ours = input.session_id === command.sessionId;
+  const expired = () => Date.parse(command.expiresAt) <= now();
+  if (event === "PreCompact") {
+    // Natural/automatic compaction belongs to the runtime, whatever the session.
+    if (input.trigger !== "manual" || input.custom_instructions !== `${NONCE}${command.id}`) {
+      // A person's manual compaction after ours started means ours never finished; its PostCompact is not ours.
+      // ponytail: assumes one session runs compactions one at a time; a per-compaction id if that ever breaks.
+      if (ours && input.trigger === "manual" && state.read("compact-started") && !state.read("compacted")) state.once("compact-superseded");
+      return {};
+    }
+    if (!ours || expired() || state.read("failed") || state.read("denied") || state.read("superseded")
+      || !state.read("compact-issued") || state.read("switch-issued")) return DENY;
+    // prompt_id names the /compact invocation (observed on 2.1.281 PreCompact); PostCompact must repeat it.
+    if (!ID.test(input.prompt_id ?? "")) return DENY;
+    state.once("compact-started", { promptId: input.prompt_id });
+    return {};
+  }
+  if (!ours) return {};
+  if (event === "PostModelSwitch") {
+    const started = state.read("model-started");
+    if (started && input.source === "command" && input.from_model === started.fromModel
+      && input.to_model === started.model && input.requested_model === command.model) state.once("applied", started);
+    return {};
+  }
+  if (event === "PostCompact") {
+    // Only the PostCompact of our own /compact invocation is our receipt.
+    const started = state.read("compact-started");
+    if (input.trigger === "manual" && started && input.prompt_id === started.promptId
+      && !state.read("compact-superseded") && !state.read("switch-issued")) {
+      state.once("compacted");
+    }
+    return {};
+  }
+  if (event !== "PreModelSwitch") return {};
+  // Only the /model we issued is ours. A person's own change (picker, their /model) always goes through
+  // and cancels the pending request.
+  if (input.source !== "command" || input.requested_model !== command.model || !state.read("switch-issued")) {
+    if (!state.read("applied")) state.once("superseded", { model: MODEL.test(input.to_model ?? "") ? input.to_model : null });
+    return {};
+  }
+  const same = (started) => started?.fromModel === input.from_model && started?.model === input.to_model;
+  // A duplicate registration of this hook repeats the decision already made instead of contradicting it.
+  if (state.read("model-started")) return same(state.read("model-started")) ? ALLOW : DENY;
+  const deny = () => { state.once("denied"); return DENY; };
+  if (expired() || state.read("failed") || state.read("denied") || state.read("superseded") || !state.read("compacted")
+    || !MODEL.test(input.from_model ?? "") || !MODEL.test(input.to_model ?? "")) return deny();
+  // adapterConfig.model may be null or an alias. The hook names the actual runtime models; the server
+  // must re-authorize this resolved target against both the original request and current route/plan.
+  const resolved = { ...command, requestedModel: command.model, fromModel: input.from_model, model: input.to_model };
+  let allowed = false;
+  try { allowed = await authorize(resolved) === true; } catch { /* deny below, durably if storage works */ }
+  if (state.read("model-started")) return same(state.read("model-started")) ? ALLOW : DENY;
+  if (!allowed || expired() || state.read("failed") || state.read("denied") || state.read("superseded")) return deny();
+  if (state.once("model-started", { fromModel: input.from_model, model: input.to_model })) return ALLOW;
+  return same(state.read("model-started")) ? ALLOW : DENY;
+}
+
+/** Hook process body: finds this session's pending switch, if any. Errors refuse only what could be ours. */
+export async function runHook(root, event, input, authorize, now = Date.now) {
+  // We only ever switch by /model (source "command"); a picker or other named source is a person's and
+  // always goes through. An unreadable payload could be ours, so it is refused.
+  const blocking = (event === "PreModelSwitch" && (typeof input?.source !== "string" || input.source === "command"))
+    || (event === "PreCompact" && input?.trigger === "manual" && String(input?.custom_instructions ?? "").startsWith(NONCE));
+  try {
+    if (input?.hook_event_name !== event || !ID.test(input.session_id ?? "")) throw new Error("Bad hook input.");
+    const pending = currentSlot(root, input.session_id, now());
+    if (!pending || pending.free) return {};
+    if (!pending.id) throw new Error("Bad session slot.");
+    const state = switchState(root, read(join(root, pending.id, "command.json")), now());
+    return await modelSwitchHook(state, input, authorize, now);
+  } catch { return blocking ? DENY : {}; }
+}
+
+/** One feeder step. Claim before sending: a crash cannot replay a possibly-applied command. */
+export async function advanceModelSwitch(state, { ready, send, current = () => null, now = Date.now }) {
+  const terminal = (outcome) => { state.release(); return outcome; };
+  const unknown = () => (now() >= Date.parse(state.command.expiresAt) + UNKNOWN_GRACE_MS ? terminal("unknown") : "unknown");
+  if (state.read("applied")) return terminal("applied");
+  if (state.read("superseded")) return terminal("superseded");
+  if (state.read("compact-superseded") && !state.read("compacted")) return terminal("failed");
+  // Any refusal blocks the runtime's switch, even if a duplicate hook allowed it.
+  if (state.read("denied")) return terminal("not-applied");
+  // A feeder that gave up holds the receipt the hook admits by, so no /model of ours can have landed.
+  if (state.read("failed")) return state.read("switch-issued") && !state.read("model-started")?.gaveUp ? unknown() : terminal("failed");
+  if (Date.parse(state.command.expiresAt) <= now()) return state.read("switch-issued") ? unknown() : terminal("expired");
+  if (state.read("switch-issued")) return "awaiting-model-receipt";
+  if (!ready()) return "waiting-for-idle";
+  // Already on the target: the runtime fires no switch hooks for a no-op, so there is nothing to compact.
+  if (current() === state.command.model) {
+    state.once("applied", { fromModel: state.command.model, model: state.command.model });
+    return terminal("applied");
+  }
+  const compacted = state.read("compacted");
+  const phase = compacted ? "switch-issued" : "compact-issued";
+  if (!state.once(phase)) return "awaiting-compact-receipt";
+  const text = compacted ? `/model ${state.command.model}` : `/compact ${NONCE}${state.command.id}`;
+  try { if (!await send(text)) state.once("failed", { phase }); }
+  catch { state.once("failed", { phase }); }
+  if (state.read("failed")) return compacted ? unknown() : terminal("failed");
+  return compacted ? "awaiting-model-receipt" : "awaiting-compact-receipt";
+}
+
+// The server re-checks the resolved target against the request, route and plan.
+function authorizeOnServer(resolved) {
+  const runner = process.env.AR_CLI_RUNNER_ID ?? "";
+  if (!runner) return false;
+  const run = spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
+    ["call", runner, "authorize_model_switch", "--args", JSON.stringify(resolved)], { encoding: "utf8", timeout: 20_000 });
+  try { return run.status === 0 && JSON.parse(run.stdout).allowed === true; } catch { return false; }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const event = process.argv[2];
+  let input = null;
+  try { input = JSON.parse(readFileSync(0, "utf8")); } catch {}
+  // The runner sets AR_MODEL_SWITCH_DIR so its feeder and these hooks share one directory.
+  const root = process.env.AR_MODEL_SWITCH_DIR || join(process.env.CLAUDE_PLUGIN_DATA || tmpdir(), "agentradar-model-switch");
+  const result = await runHook(root, event, input, authorizeOnServer);
+  if (result.decision === "block") {
+    process.stderr.write(`${result.reason}\n`);
+    process.exit(2);
+  }
+  process.stdout.write(JSON.stringify(result));
+}

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -24,7 +24,7 @@ The Stop hook runs the same check and will not let you stop while something is o
 
 - Answer every message in the channel it came from. A human who wrote is waiting for you; answer them first.
 - Talk is not a task. Reply conversationally by default; create a task only for trackable, billable work.
-- Write to people so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a menu of options), no ids, tool names or internal terms unless asked. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
+- Write to people so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a list of ideas), no ids, paths, tool names or internal terms unless asked. Say money in dollars, never cents; give every link with what it opens. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
 - Never ask for, print or pass on a credential. AgentRadar holds the keys.
 - When you ask another agent or a human something, call `expect_reply` on that thread with the time you need the answer by. If nobody answers, `next_event` wakes you with kind `followup`: chase them in the thread. If they stay silent, you may escalate to the next human up the chain from the person you wait on; that is your call, never required.
 - Only a human accepts your work. Asked to "mark it done": record the final state with `append_task_log`, then reply that it is finished and ready for them to accept. Never call `decide_outcome` or `declare_outcome` on your own task.

package/dist/agentradar-vendor/SKILL.md

@@ -22,11 +22,11 @@ Call `get_my_context` on the AgentRadar MCP FIRST, before any other tool. It ret
 
 In your first session, call `read_onboarding_obligations` once (reading them acknowledges the safety rules), then `read_readiness`.
 
-Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own with `report_metric`. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and your direct subordinates — only for real trackable work, never for conversation.
+Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own with `report_metric`, backed by `evidence` of what you counted it from, or by `fromEventId` when a person told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and your direct subordinates — only for real trackable work, never for conversation.
 
 ## Talking to people
 
-Write to people so a 13-year-old would understand: a few short plain lines, then one next step, not a menu. No ids, tool names or internal terms unless asked (say "the owner", "your team", "company memory"; name a plan with its monthly price). Answer only what was asked, and say it once. Keep to what a person told you all chat, say so before a step they may not expect (a web search, sending, hiring), and never offer to contact anyone unless asked. Never talk about how messages reach you. Do the obvious thing for "undo that"; if unclear, offer short choices. Check your tools before saying what is scheduled or done; never answer from memory.
+Write to people so a 13-year-old would understand: a few short plain lines, then one next step, not a list of ideas. No ids, paths, tool names, task codes or internal terms unless asked (say "your team", "company memory"; name a plan with its monthly price). Say money in dollars, never cents; give every link with what it opens. Answer only what was asked, and say it once. Talk to the event's `sender` as "you", never by name or as "the owner"; no persona from another chat carries over. Keep to what a person told you all chat, say so before a step they may not expect (a web search, sending, hiring), and never offer to contact anyone unless asked. Never talk about how messages reach you. Do the obvious thing for "undo that"; if unclear, offer short choices. Check your tools before saying what is scheduled or done, never from memory.
 
 ## Work loop
 

package/dist/channel.js

@@ -7,7 +7,7 @@ import { createInterface } from "node:readline";
 import { envValue } from "./tool-run.js";
 import { trustedMcpEndpoint } from "./setup.js";
 export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Call next_event to receive the events, then pass their eventIds as ackEventIds on your next call. Answer livenessProbe with liveness_ack. Never acknowledge an event you have not read. Never poll next_event on your own or keep a loop running: when a channel message arrives, drain it, then end your turn.";
-export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: set AR_FEED=feeder in ~/.agentradar/agents/<runner-id>.env and restart the runner.";
+export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: run your join again with --feeder (agentradar join <your join link> --feeder). Your organisation sees this agent as not receiving messages until one or the other works.";
 /** One local MCP, forwarding tools to AWP. Wake signals never consume the durable queue. */
 export async function startChannel(runnerId, deps = {}) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
@@ -24,6 +24,9 @@ export async function startChannel(runnerId, deps = {}) {
     let sequence = 0;
     let polling = false;
     let agentPolled = false;
+    // Vadym 10342: an unconfirmed channel is reported to AgentRadar (runnerState channel_unconfirmed), so the owner sees
+    // the agent is not receiving messages; "ready" again once the session does call next_event.
+    let unconfirmed = null;
     let warning;
     const send = (value) => new Promise((resolve, reject) => {
         output.write(`${JSON.stringify(value)}\n`, (error) => error ? reject(error) : resolve());
@@ -68,7 +71,14 @@ export async function startChannel(runnerId, deps = {}) {
                     if (!selftestStarted)
                         logError("AgentRadar self-test could not start; retrying after the next poll.");
                 }
-                const response = await next({ runnerState: "ready" });
+                if (unconfirmed === "pending") {
+                    await next({ runnerState: "channel_unconfirmed" });
+                    unconfirmed = "reported";
+                }
+                if (unconfirmed === "reported" && agentPolled)
+                    unconfirmed = null;
+                // While reported, no runnerState: the stored state stands, and the poll still drains for wake signals.
+                const response = await next(unconfirmed ? {} : { runnerState: "ready" });
                 if (response.error || response.result?.isError)
                     throw new Error("AgentRadar refused next_event; check the runner key and its poll permission");
                 const content = response.result?.content;
@@ -104,8 +114,10 @@ export async function startChannel(runnerId, deps = {}) {
         else if (message.method === "notifications/initialized") {
             if (!polling) {
                 polling = true;
-                warning = setTimeout(() => { if (!agentPolled)
-                    logError(CHANNEL_BLOCKED); }, 30_000);
+                warning = setTimeout(() => { if (!agentPolled) {
+                    logError(CHANNEL_BLOCKED);
+                    unconfirmed = "pending";
+                } }, deps.confirmMs ?? 30_000);
                 void poll();
             }
         }

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
-import { joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
+import { cancelJoin, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
 import { callAwpTool, callToolOverCli, createTaskOverCli, listServiceToolsOverCli, parseCallArgs, runServiceToolOverCli } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
@@ -15,7 +15,7 @@ export const runArgs = (raw) => raw[0] !== "run" ? raw
 async function main() {
     const args = runArgs(process.argv.slice(2));
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
         return;
     }
     if (args[0] === "leave" && args.length === 2) {
@@ -55,21 +55,34 @@ async function main() {
         await setupVendorAgent({ trust: others.includes("--trust"), harness });
         return;
     }
+    if (args[0] === "join" && args[1] === "cancel") {
+        if (args.length !== 3 || args[2].startsWith("-")) {
+            console.error("Usage: agentradar join cancel <join-link|request-id>");
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await cancelJoin(args[2]);
+        return;
+    }
     if (args[0] === "join") {
         const named = {};
         const urls = [];
         for (let i = 1; i < args.length; i++) {
-            if (args[i] === "--name" || args[i] === "--model")
+            if (["--name", "--model", "--attach-tmux", "--session"].includes(args[i]))
                 named[args[i].slice(2)] = args[++i] ?? "-";
-            else if (args[i] !== "--trust")
+            else if (!["--trust", "--attach-current", "--allow-bypass", "--revoke-bypass", "--feeder"].includes(args[i]))
                 urls.push(args[i]);
         }
-        if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-"))) {
-            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust]");
+        if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-")) || (named["attach-tmux"] && args.includes("--attach-current"))) {
+            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current] [--session <claude session id>] [--revoke-bypass] [--feeder]");
             process.exitCode = 1;
             return;
         }
-        process.exitCode = await joinOrganisation(urls[0], { trust: args.includes("--trust"), agentName: named.name, model: named.model });
+        process.exitCode = await joinOrganisation(urls[0], {
+            trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
+            attach: args.includes("--attach-current") ? "current" : named["attach-tmux"],
+            revokeBypass: args.includes("--revoke-bypass"), feeder: args.includes("--feeder"),
+        });
         return;
     }
     if (args.length === 2 && args[0] === "runner" && args[1] === "start") {
@@ -129,7 +142,7 @@ async function main() {
         return;
     }
     const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
-    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat <runner-id> --args '<json>' | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
     if (!help)
         process.exitCode = 1;
 }

package/dist/setup.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
-import { chmod, cp, lstat, mkdir, readFile, readlink, realpath, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { chmod, cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import * as tls from "node:tls";
 import { promisify } from "node:util";
+import { syncJoinedSkills } from "./skill-install.js";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
 /** The service's CLI build (the CLI itself and the agent-guard plugin): `installCli` keeps it current, never the npx cache. */
 const cliDist = (home) => join(home, ".agentradar", "cli", "current", "dist");
@@ -117,7 +118,9 @@ export function trustedMcpEndpoint(value) {
     return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
 }
 /** `installation: null` (join) removes the project's `agentradar` entry: a joined agent acts through `agentradar run`. */
-async function installProjectMcp(configPath, cwd, installation, trust) {
+async function installProjectMcp(configPath, cwd, installation, trust, 
+/** Vadym 10342: a joined Claude Code agent's AgentRadar channel (`agentradar channel <runner-id>`, stdio). */
+channel) {
     const endpoint = installation && trustedMcpEndpoint(installation.mcpEndpoint);
     if (installation && (!endpoint || !BEARER_SHAPE.test(installation.bearer))) {
         throw new Error("AgentRadar returned an invalid setup payload");
@@ -147,7 +150,10 @@ async function installProjectMcp(configPath, cwd, installation, trust) {
     const mcpServers = project.mcpServers && typeof project.mcpServers === "object" && !Array.isArray(project.mcpServers)
         ? project.mcpServers
         : {};
-    if (installation && endpoint) {
+    if (channel) {
+        mcpServers.agentradar = channel;
+    }
+    else if (installation && endpoint) {
         mcpServers.agentradar = {
             type: "http",
             url: endpoint.toString(),
@@ -335,7 +341,7 @@ async function codexHookHashes(codexHome, env) {
         child.kill();
     }
 }
-async function installRunner(home, projectPath, approved, service) {
+async function installRunner(home, projectPath, approved, service, feed) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(approved.runnerId)) {
         throw new Error("AgentRadar returned an invalid runner ID");
     }
@@ -362,6 +368,8 @@ async function installRunner(home, projectPath, approved, service) {
         if (harness === "codex") {
             const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
             joined.push(`CODEX_HOME=${shellValue(codexHome)}`);
+            if (service.bypass)
+                joined.push(`CODEX_EXTRA_FLAGS=${shellValue("--dangerously-bypass-approvals-and-sandbox")}`);
             toolKeys = keys;
         }
         else if (harness === "generic") {
@@ -375,7 +383,10 @@ async function installRunner(home, projectPath, approved, service) {
             ...(service.env.AGENTRADAR_INPUT_READY_PATTERN ? [`AR_INPUT_READY_PATTERN=${shellValue(service.env.AGENTRADAR_INPUT_READY_PATTERN)}`] : []), `AGENT_PID_PATTERN=${shellValue(basename(bin).replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))}`);
         }
         else {
-            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--session-id ${service.sessionId}`)}`);
+            // The caller's own conversation, both times: a resume that fails tries it once more, never a fresh session.
+            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`);
+            // A person's model switch: the feeder and agent-guard's hooks meet in this directory, keyed by the session.
+            joined.push(`AR_CLAUDE_SESSION_ID=${shellValue(service.sessionId)}`, `AR_MODEL_SWITCH_DIR=${shellValue(join(configDir, "model-switch"))}`);
             const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
             if (configDirEnv)
                 joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
@@ -385,9 +396,18 @@ async function installRunner(home, projectPath, approved, service) {
             await writePrivateFile(settings, `${JSON.stringify({
                 extraKnownMarketplaces: { agentradar: { source: { source: "directory", path: join(cliDist(home), "agent-guard") } } },
                 enabledPlugins: { "agent-guard@agentradar": true },
+                // Nobody sits at the pane to accept bypass mode's warning screen; the operator's consent was given at approval.
+                ...(service.bypass ? { skipDangerousModePermissionPrompt: true } : {}),
             }, null, 2)}\n`);
+            if (service.bypass)
+                joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
             joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
         }
+        if (service.attach) {
+            // The caller's own tmux pane: the feeder types into it; the supervisor never starts, kills or streams it.
+            // TMUX names the caller's tmux server, which a service started by launchd or systemd would not find.
+            joined.push("AR_ATTACH=1", `TMUX_SESSION=${shellValue(service.attach)}`, "TERMINAL_BRIDGE_ENABLED=0", ...(service.env.TMUX ? [`TMUX=${shellValue(service.env.TMUX)}`] : []), ...(harness === "generic" ? [] : [`AGENT_PID_PATTERN=${shellValue(`(^|/)${harness ?? "claude"}( |$)`)}`]));
+        }
         const toolEnv = Object.entries(service.env)
             .filter(([key, value]) => (TOOL_ENV.test(key) || toolKeys.includes(key)) && key !== "ANTHROPIC_API_KEY" && value && !value.includes("\n"))
             .map(([key, value]) => `${key}=${value}`);
@@ -397,15 +417,19 @@ async function installRunner(home, projectPath, approved, service) {
             joined.push(`AGENT_TOOL_ENV_FILE=${shellValue(toolEnvFile)}`);
         }
     }
-    await writePrivateFile(mcpConfig, `${JSON.stringify(service ? { mcpServers: {} } : {
-        mcpServers: {
-            agentradar: {
-                type: "http",
-                url: endpoint.toString(),
-                headers: { Authorization: `Bearer ${approved.installation.bearer}` },
+    // R764 + Vadym 10342: a pushed service session loads exactly one MCP, the AgentRadar channel, from the CLI copy
+    // the service runs; the supervisor adds --dangerously-load-development-channels server:agentradar.
+    await writePrivateFile(mcpConfig, `${JSON.stringify(feed === "push"
+        ? { mcpServers: { agentradar: { type: "stdio", command: process.execPath, args: [join(cliDist(home), "index.js"), "channel", approved.runnerId] } } }
+        : service ? { mcpServers: {} } : {
+            mcpServers: {
+                agentradar: {
+                    type: "http",
+                    url: endpoint.toString(),
+                    headers: { Authorization: `Bearer ${approved.installation.bearer}` },
+                },
             },
-        },
-    }, null, 2)}\n`);
+        }, null, 2)}\n`);
     await writePrivateFile(envPath, [
         `AGENT_NAME=${shellValue(approved.runnerId)}`,
         `AR_BASE=${shellValue(projectPath)}`,
@@ -416,6 +440,8 @@ async function installRunner(home, projectPath, approved, service) {
         // default, so writing `AR_AGENT_HARNESS=claude` unconditionally would change nothing except to make
         // every existing env file look as though a choice had been made.
         ...(harness ? [`AR_AGENT_HARNESS=${shellValue(harness)}`] : []),
+        // How work reaches the session (Vadym 10342): the Claude Code channel pushes it; without this line the feeder types it.
+        ...(feed ? [`AR_FEED=${feed}`] : []),
         ...joined,
         "",
     ].join("\n"));
@@ -505,6 +531,8 @@ export async function setupVendorAgent(deps = {}) {
     }
     throw new Error("AgentRadar setup code expired; run setup again");
 }
+export const bypassOnNotice = (link) => `Bypass-permissions mode is ON on this machine: the agent runs without permission prompts. To turn it off: agentradar join ${link} --revoke-bypass`;
+export const BYPASS_REVOKED = "Bypass-permissions mode is off on this machine now; the agent asks before acting again.";
 /** A sortable key for `x.y.z[-pre]`; a release sorts above its prereleases. ponytail: prereleases of one version tie. */
 const versionRank = (version) => {
     const [core = "", pre] = version.split(/-(.*)/);
@@ -554,6 +582,25 @@ async function installAgentService(runnerId, home, env) {
         env: { ...env, HOME: home, NODE_BIN: process.execPath, AGENTRADAR_JS: join(dist, "index.js") },
     });
 }
+/**
+ * The Claude conversation that ran `agentradar join`: `--session`, else the CLAUDE_CODE_SESSION_ID Claude Code
+ * sets in its shell, else the newest transcript Claude Code keeps for this folder. Never a fresh one.
+ */
+async function callerSession(deps, env, home, projectPath) {
+    let id = deps.session ?? env.CLAUDE_CODE_SESSION_ID;
+    if (!id) {
+        const config = env.CLAUDE_CONFIG_DIR?.trim() ? resolve(env.CLAUDE_CONFIG_DIR.trim()) : join(home, ".claude");
+        const dir = join(config, "projects", projectPath.replace(/[^A-Za-z0-9]/g, "-"));
+        const transcripts = await Promise.all((await readdir(dir).catch(() => [])).filter((name) => name.endsWith(".jsonl"))
+            .map(async (name) => ({ id: name.slice(0, -6), at: (await stat(join(dir, name))).mtimeMs })));
+        id = transcripts.sort((a, b) => b.at - a.at)[0]?.id;
+    }
+    if (!id)
+        throw new Error("Found no Claude Code conversation in this folder to continue. Run join from inside your agent's session, or pass --session <id>.");
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id))
+        throw new Error(`Not a Claude Code session id: ${JSON.stringify(id)}`);
+    return id;
+}
 /**
  * Mode A — the organisation's own agent, on its own compute, joining through a join link.
  *
@@ -591,19 +638,60 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         }
     }
     const label = harness === "generic" ? basename((env.AGENTRADAR_AGENT_BIN ?? "").trim()) : harness === "claude" ? "Claude Code" : "Codex";
+    // Vadym 10342: every Claude Code agent connects through the AgentRadar channel. The tmux feeder is the fallback:
+    // another CLI, an explicit opt-in (--feeder, AGENTRADAR_FEED=feeder, or a pane named with --attach-*), or a
+    // channel the session never confirms (channel.ts reports it and tells the operator to re-run with --feeder).
+    const channel = harness === "claude" && !deps.feeder && env.AGENTRADAR_FEED?.trim().toLowerCase() !== "feeder" && !deps.attach;
     // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
     // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
-    const startJoined = async (requestId, agentId, installation, saved) => {
+    // Which session the agent is, settled before any request: a key is issued once, so never claim one for a session that cannot run.
+    const settle = async () => {
+        const tmux = deps.tmux ?? (async (args) => (await promisify(execFile)(env.TMUX_BIN || "tmux", args, { env })).stdout);
+        // Attach to the caller when it already lives in tmux: asked for by flag, or a Claude Code session in a tmux
+        // pane. The service's own session (join-<request>) re-running join is not a caller to attach to.
+        let attach = deps.attach === "current" ? env.TMUX_PANE : deps.attach;
+        if (deps.attach === "current" && !attach)
+            throw new Error("--attach-current needs a session running inside tmux");
+        // Never in channel mode: nothing types into the caller's pane.
+        if (!channel && !deps.attach && harness === "claude" && env.CLAUDECODE && env.TMUX && env.TMUX_PANE)
+            attach = env.TMUX_PANE;
+        if (attach) {
+            // A pane id (%3) dies with the tmux server; session:window.pane comes back when its session is recreated.
+            attach = (await tmux(["display-message", "-p", "-t", attach, "#{session_name}:#{window_index}.#{pane_index}"])).trim();
+            if (!attach)
+                throw new Error("tmux found no such pane");
+            if (!deps.attach && attach.startsWith("join-"))
+                attach = undefined;
+        }
+        // Unattended, the service resumes the caller's own Claude conversation, never a stranger's. An attached
+        // pane is never started from here, so there its session id only keys the model switch.
+        const sessionId = harness !== "claude" ? undefined
+            : await callerSession(deps, env, home, await realpath(cwd)).catch((error) => { if (attach || channel)
+                return undefined; throw error; });
+        return { attach, sessionId };
+    };
+    let where;
+    /**
+     * The owner's bypass grant on the portal approval is the consent for an unattended service session (lead
+     * 10-04, after the Codex run stopped on an approval prompt nobody could answer); `--revoke-bypass` takes it
+     * back on this machine. An attached pane keeps the permission mode it already runs in.
+     */
+    const localBypass = (approvedBypass, revoked) => approvedBypass && !revoked && !where.attach;
+    const startJoined = async (requestId, agentId, installation, approvedBypass, bypass, saved) => {
         const runnerId = `join-${requestId}`;
-        // The service's Claude session id: a valid UUID derived from the request, so a re-run resumes the same one.
-        const hex = createHash("sha256").update(requestId).digest("hex");
-        const sessionId = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+        const { attach } = where;
         const projectPath = harness === "claude"
             ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
             : await realpath(cwd);
-        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId, env });
+        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId: where.sessionId ?? requestId, env, attach, bypass }, channel ? "push" : undefined);
         await saved?.();
         log(`Runner installed → ${runnerEnv}`);
+        if (bypass)
+            log(bypassOnNotice(enrolmentUrl));
+        // Best effort: a failed first sync never stops the join; the service's feeder syncs them again.
+        await syncJoinedSkills(runnerId, { home, fetch: fetchImpl, log }).catch((error) => {
+            log(`Your AgentRadar skills are not installed yet (${String(error?.message ?? error).split("\n")[0]}); the runner installs them once it is running.`);
+        });
         try {
             await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
         }
@@ -611,7 +699,24 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             log(`Could not start the service: ${error.message.split("\n")[0]}. Start it by hand with: agentradar runner start ${runnerId}`);
             return 1;
         }
-        log(`Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        if (attach) {
+            log(`Connected. Your welcome and every client message are typed into this session (tmux ${attach}), and you answer here. Nothing else was started. To stop: agentradar leave ${runnerId}`);
+            if (approvedBypass)
+                log("Your organisation allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
+            log("Running as a service; the delivery restarts on crash and reboot.");
+            return 0;
+        }
+        const mode = bypass ? ", in bypass-permissions mode as your organisation allowed" : "";
+        if (channel) {
+            log(`Connected through the AgentRadar channel. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): client messages are pushed into it and it answers there, with no restart from you. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`);
+            log(`If your organisation's Claude plan blocks channels, deliver with the feeder instead: agentradar join ${enrolmentUrl} --feeder`);
+            log("Running as a service; it restarts on crash and reboot.");
+            return 0;
+        }
+        // Only Claude resumes the caller's own conversation; Codex and a generic CLI start their own session.
+        log(harness === "claude"
+            ? `Connected. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`
+            : `Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
         log("Running as a service; it restarts on crash and reboot.");
         return 0;
     };
@@ -627,6 +732,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         throw new Error("That is not an AgentRadar join link (expected https://…/invite/<token>)");
     }
     const api = (path) => new URL(`/api/${path}`, link.origin);
+    where = await settle();
     const mcpEndpoint = env.AWP_MCP_URL || api("mcp").toString();
     const joinsDir = join(home, ".agentradar", "joins");
     await mkdir(joinsDir, { recursive: true, mode: 0o700 });
@@ -646,7 +752,15 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         const bearer = envValue(saved, "AWP_BEARER");
         if (!bearer)
             throw new Error("This machine left that organisation (agentradar leave). A key is issued once; ask your organisation for a new join link.");
-        return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer });
+        // `--revoke-bypass` is remembered on this machine, so a later re-run keeps the prompts on.
+        if (deps.revokeBypass && state.bypassConfirmed !== false) {
+            state = { ...state, bypassConfirmed: false };
+            await writePrivateFile(statePath, JSON.stringify(state));
+            log(BYPASS_REVOKED);
+        }
+        const approvedBypass = state.bypassPermissions === true;
+        const bypass = localBypass(approvedBypass, state.bypassConfirmed === false);
+        return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer }, approvedBypass, bypass);
     }
     if (!state) {
         const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
@@ -698,8 +812,11 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
                 throw new Error("AgentRadar returned an invalid key claim");
             }
             log("Approved.");
-            const joined = { ...state, agentId: claimed.agentId };
-            return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, () => writePrivateFile(statePath, JSON.stringify(joined)));
+            // Bypass-permissions only when the operator consented at approval; the server says so with the key.
+            const approvedBypass = claimed.bypassPermissions === true;
+            const bypass = localBypass(approvedBypass, false);
+            const joined = { ...state, agentId: claimed.agentId, ...(approvedBypass ? { bypassPermissions: true } : {}) };
+            return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, approvedBypass, bypass, () => writePrivateFile(statePath, JSON.stringify(joined)));
         }
         const said = await failureMessage(response);
         if (response.status === 409 && said.includes("must be approved")) {
@@ -709,12 +826,61 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         if (response.status === 409 && said.includes("rejected")) {
             throw new Error("Your organisation declined this join request. Ask it for a new join link.");
         }
+        if (response.status === 409 && said.includes("withdrawn")) {
+            throw new Error("This join request was withdrawn (agentradar join cancel). Ask your organisation for a new join link.");
+        }
         if (response.status === 409 && /already (?:used|claimed)/.test(said)) {
             throw new Error("This join link's key was already claimed. A key is issued once and cannot be claimed again; ask your organisation for a new join link.");
         }
         throw new Error(said);
     }
 }
+/**
+ * `agentradar join cancel <join-link|request-id>`: withdraw this machine's pending join request. Only the
+ * claim secret saved here proves it is the requester; the state file goes once the server agrees.
+ */
+export async function cancelJoin(target, deps = {}) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const log = deps.log ?? console.log;
+    const joinsDir = join(deps.home ?? homedir(), ".agentradar", "joins");
+    const token = /^https?:\/\//.test(target)
+        ? /^\/(?:api\/invites|invite)\/([^/]+?)(?:\.md)?(?:\/|$)/.exec(new URL(target).pathname)?.[1]
+        : undefined;
+    let statePath;
+    let state;
+    for (const name of token ? [`${createHash("sha256").update(token).digest("hex")}.json`] : await readdir(joinsDir).catch(() => [])) {
+        if (!name.endsWith(".json"))
+            continue;
+        const read = await readFile(join(joinsDir, name), "utf8").then((text) => JSON.parse(text), () => undefined);
+        if (read && (token || read.requestId === target)) {
+            statePath = join(joinsDir, name);
+            state = read;
+            break;
+        }
+    }
+    if (!state || !statePath) {
+        log(`No join request from this machine for ${target}.`);
+        return 1;
+    }
+    if (state.agentId) {
+        log(`That join was already approved. To leave the organisation: agentradar leave join-${state.requestId}`);
+        return 1;
+    }
+    // The secret goes only back to the AgentRadar host that issued it.
+    const origin = token ? new URL(target).origin : state.approvalUrl ? new URL(state.approvalUrl).origin : "";
+    if (!origin || !trustedMcpEndpoint(origin)) {
+        log("Pass the join link instead of the request id: agentradar join cancel <join-link>");
+        return 1;
+    }
+    const response = await postJson(fetchImpl, new URL(`/api/join-requests/${encodeURIComponent(state.requestId)}/cancel`, origin), { claimSecret: state.claimSecret });
+    if (!response.ok) {
+        log(`Could not withdraw the join request: ${await failureMessage(response)}`);
+        return 1;
+    }
+    await rm(statePath, { force: true });
+    log("Join request withdrawn. Nobody can approve it now, and the name you asked for is free again.");
+    return 0;
+}
 /**
  * `agentradar leave <runner-id>`: stop and remove the service, end the agent's session, and delete its env
  * file, bearer and config. The folder the agent worked in stays, with the work.
@@ -742,7 +908,9 @@ export async function leaveOrganisation(runnerId, deps = {}) {
         await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
     }
     // The service stopping leaves the session running; `=` matches the tmux session name exactly.
-    await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
+    // An attached pane is the caller's own session: it stays.
+    if (envValue(saved, "AR_ATTACH") !== "1")
+        await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
     for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
         await rm(path, { force: true });
     for (const dir of ["run", "config", "codex"])

package/dist/skill-install.js

@@ -1,6 +1,9 @@
-import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { awpRequest, envValue } from "./tool-run.js";
+const MANAGED_MARK = ".agentradar-managed";
+const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
 async function ensureDirectory(path) {
     try {
         const info = await lstat(path);
@@ -38,7 +41,98 @@ export async function installVendorSkill(deps = {}) {
         });
     }
     // The runner keeps this skill current from AgentRadar; the marker says the folder is AgentRadar's to replace.
-    await writeFile(join(skillDir, ".agentradar-managed"), "Written by AgentRadar; replaced on every sync.\n");
+    await writeFile(join(skillDir, MANAGED_MARK), "Written by AgentRadar; replaced on every sync.\n");
     (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
 }
+const isManaged = async (dir) => (await lstat(dir).then((info) => info.isDirectory(), () => false)) && (await lstat(join(dir, MANAGED_MARK)).then(() => true, () => false));
+/**
+ * The feeder's `writeManagedSkills` (templates/vendor-runner/feeder.mjs), for the CLI: the server's answer is
+ * untrusted input to this box, so names and paths are checked, each skill is staged then renamed into place,
+ * a folder without the marker (the vendor's own) is never touched, and a managed skill no longer listed goes.
+ */
+const sameSkill = async (dir, files) => {
+    try {
+        const have = [];
+        for (const p of await readdir(dir, { recursive: true }))
+            if (p !== MANAGED_MARK && (await stat(join(dir, p))).isFile())
+                have.push(p);
+        for (const f of files)
+            if (await readFile(join(dir, f.path), "utf8") !== f.content)
+                return false;
+        return have.length === files.length;
+    }
+    catch {
+        return false;
+    }
+};
+export async function writeManagedSkills(skillsDir, skills) {
+    await mkdir(skillsDir, { recursive: true });
+    const written = new Set();
+    for (const skill of skills) {
+        const name = String(skill?.name ?? "");
+        const target = join(skillsDir, name);
+        if (!SKILL_NAME.test(name))
+            continue;
+        if (await lstat(target).then(() => true, () => false) && !(await isManaged(target)))
+            continue;
+        const files = (Array.isArray(skill.files) ? skill.files : []);
+        if (files.some((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+            || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path))))
+            continue;
+        // An unchanged skill is not rewritten: the agent's CLI may be reading it.
+        if (await sameSkill(target, files)) {
+            written.add(name);
+            continue;
+        }
+        const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+        const old = join(skillsDir, `.${name}.old-${process.pid}`);
+        try {
+            await rm(staging, { recursive: true, force: true });
+            for (const f of files) {
+                await mkdir(dirname(join(staging, f.path)), { recursive: true });
+                await writeFile(join(staging, f.path), f.content);
+            }
+            await writeFile(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+            // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
+            await rm(old, { recursive: true, force: true });
+            await rename(target, old).catch((err) => { if (err?.code !== "ENOENT")
+                throw err; });
+            await rename(staging, target);
+            await rm(old, { recursive: true, force: true });
+            written.add(name);
+        }
+        catch {
+            await rm(staging, { recursive: true, force: true });
+            if (!(await lstat(target).then(() => true, () => false)))
+                await rename(old, target).catch(() => { });
+            if (await isManaged(target))
+                written.add(name);
+        }
+    }
+    for (const entry of await readdir(skillsDir)) {
+        if (!written.has(entry) && await isManaged(join(skillsDir, entry)))
+            await rm(join(skillsDir, entry), { recursive: true, force: true });
+    }
+    return [...written];
+}
+/**
+ * R650 — a joined agent's AgentRadar skills (`my_skills`: the bundled set plus the ones linked to it), written
+ * at join into the directory its CLI reads, the feeder's `skillsDirFor`: Claude `$AR_BASE/.claude/skills`,
+ * Codex `$CODEX_HOME/skills`. Done here because a session that acts only through `agentradar run` has no
+ * feeder; where the service runs, its feeder keeps them current.
+ */
+export async function syncJoinedSkills(runnerId, deps) {
+    const env = await readFile(join(deps.home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
+    const root = envValue(env, "AR_AGENT_HARNESS") === "codex" ? envValue(env, "CODEX_HOME") : envValue(env, "AR_BASE");
+    if (!root)
+        return;
+    const skillsDir = envValue(env, "AR_AGENT_HARNESS") === "codex" ? join(root, "skills") : join(root, ".claude", "skills");
+    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: {} }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    const text = body?.result?.content?.find((c) => c.type === "text")?.text;
+    const answer = (text ? JSON.parse(text) : {});
+    if (!answer.ok || !Array.isArray(answer.skills))
+        throw new Error("AgentRadar did not return your skills");
+    const written = await writeManagedSkills(skillsDir, answer.skills);
+    deps.log(`Installed ${written.length} AgentRadar skill(s) in ${skillsDir}.`);
+}
 //# sourceMappingURL=skill-install.js.map

package/dist/tool-run.js

@@ -244,7 +244,7 @@ export async function callAwpTool(runnerId, name, toolArguments, deps) {
 }
 const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 /** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
-async function awpRequest(runnerId, method, params, deps) {
+export async function awpRequest(runnerId, method, params, deps) {
     const logError = deps.logError ?? console.error;
     if (!RUNNER_ID.test(runnerId)) {
         logError("Invalid runner ID");

package/dist/vendor-runner/feeder.mjs

@@ -24,6 +24,7 @@ import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
+import { homedir } from "node:os";
 import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
@@ -230,6 +231,7 @@ async function nextEvent(ackEventIds, runnerState) {
     sessionId: runnerSessionId,
     ...(ackEventIds && ackEventIds.length ? { ackEventIds } : {}),
     ...(runnerState ? { runnerState } : {}),
+    ...(_switchId ? { modelSwitchId: _switchId } : {}),
   };
   const result = await mcpPost("tools/call", { name: "next_event", arguments: args }, { timeoutMs: NEXT_EVENT_TIMEOUT_MS });
   return toolJson(result); // { events: [...] }
@@ -663,6 +665,14 @@ const isManaged = (dir) => {
   const st = fs.lstatSync(dir, { throwIfNoEntry: false });
   return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
 };
+const sameSkill = (dir, files) => {
+  try {
+    const have = fs.readdirSync(dir, { recursive: true }).filter((p) => p !== MANAGED_MARK && fs.statSync(join(dir, p)).isFile());
+    return have.length === files.length && files.every((f) => fs.readFileSync(join(dir, f.path), "utf8") === f.content);
+  } catch {
+    return false;
+  }
+};
 
 export function writeManagedSkills(skillsDir, skills) {
   fs.mkdirSync(skillsDir, { recursive: true });
@@ -679,7 +689,11 @@ export function writeManagedSkills(skillsDir, skills) {
     const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
       || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
     if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    // An unchanged skill is not rewritten: the agent's CLI may be reading it (Codex skipped a SKILL.md that a
+    // periodic resync had just removed).
+    if (sameSkill(target, files)) { written.add(name); continue; }
     const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
+    const old = join(skillsDir, `.${name}.old-${process.pid}`);
     try {
       fs.rmSync(staging, { recursive: true, force: true });
       for (const f of files) {
@@ -687,12 +701,16 @@ export function writeManagedSkills(skillsDir, skills) {
         fs.writeFileSync(join(staging, f.path), f.content);
       }
       fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
-      fs.rmSync(target, { recursive: true, force: true });
+      // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
+      fs.rmSync(old, { recursive: true, force: true });
+      if (fs.existsSync(target)) fs.renameSync(target, old);
       fs.renameSync(staging, target);
+      fs.rmSync(old, { recursive: true, force: true });
       written.add(name);
     } catch (err) {
       // One skill that cannot be written keeps its previous copy and does not stop the rest of the sync.
       fs.rmSync(staging, { recursive: true, force: true });
+      if (!fs.existsSync(target) && fs.existsSync(old)) fs.renameSync(old, target);
       if (isManaged(target)) written.add(name);
       console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -719,6 +737,176 @@ async function syncSkills() {
   }
 }
 
+// --------------------------------------------------------------------------
+// A person's model switch (switch_model). The runner compacts, then types /model; agent-guard's hooks write
+// the receipts and ask the server to re-authorize the model the runtime resolved. This side types and reports.
+// --------------------------------------------------------------------------
+const MODEL_SWITCH_STEP_MS = 2000;
+// How long clients wait on a /model whose receipt never came before the pane is theirs again.
+const MODEL_SWITCH_CONFIRM_MS = 2 * 60_000;
+let _switchId = null;
+let _switching = false;
+let _nextSwitch = null;
+
+const readJson = (path) => { try { return JSON.parse(fs.readFileSync(path, "utf8")); } catch { return null; } };
+function writeJson(path, value) {
+  const temporary = `${path}.${process.pid}.tmp`;
+  fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: fs.statSync(path, { throwIfNoEntry: false })?.mode ?? 0o600 });
+  fs.renameSync(temporary, path);
+}
+
+/**
+ * The model the session last ran on: the newest transcript line that names one; null when unknown.
+ * ponytail: a restart onto a model changed outside the session (settings edited by hand) still reads the last
+ * turn's model; ask the runtime directly if that ever happens.
+ */
+export function sessionModel(home, sessionId) {
+  return transcript(home, sessionId)?.model ?? null;
+}
+
+/** Claude Code declines /compact on a near-empty session (PreCompact fires, PostCompact never does); its own line says so. */
+export function compactDeclined(home, sessionId, id) {
+  return transcript(home, sessionId)?.declined.has(`AgentRadar model switch ${id}`) ?? false;
+}
+
+// Read every step while a switch waits, so incrementally: each read parses only the whole lines appended since
+// the last. A first read starts this far from the end; an older model line reads as unknown, so the switch runs.
+const TRANSCRIPT_TAIL = 1 << 20;
+const _transcripts = new Map();
+function transcript(home, sessionId) {
+  let projects;
+  try { projects = fs.readdirSync(join(home, "projects")); } catch { return null; }
+  for (const project of projects) {
+    const path = join(home, "projects", project, `${sessionId}.jsonl`);
+    let fd;
+    try { fd = fs.openSync(path, "r"); } catch { continue; }
+    try {
+      const size = fs.fstatSync(fd).size;
+      let seen = _transcripts.get(path);
+      if (!seen || size < seen.offset) {
+        _transcripts.set(path, seen = { offset: Math.max(0, size - TRANSCRIPT_TAIL), model: null, declined: new Set() });
+      }
+      const buffer = Buffer.alloc(size - seen.offset);
+      fs.readSync(fd, buffer, 0, buffer.length, seen.offset);
+      const whole = buffer.lastIndexOf(10) + 1;
+      seen.offset += whole;
+      // A line cut by the first read fails to parse and is skipped.
+      for (const line of buffer.subarray(0, whole).toString("utf8").split("\n")) {
+        let entry;
+        try { entry = JSON.parse(line); } catch { continue; }
+        // A /model (ours or a person's) names the new model only by marketing name, and none follows until the
+        // next turn: unknown, so the switch runs rather than being wrongly taken as already applied.
+        if (entry?.type === "user" && String(entry.message?.content).includes("<command-name>/model</command-name>")) seen.model = null;
+        const model = entry?.type === "assistant" ? entry.message?.model
+          : entry?.attachment?.type === "model" ? entry.attachment.identity?.modelId : null;
+        // "<synthetic>" marks a message Claude Code made locally, not a model.
+        if (typeof model === "string" && /^[a-zA-Z0-9]/.test(model)) seen.model = model;
+        if (entry?.subtype === "local_command" && entry.commandRun?.command === "compact"
+          && String(entry.content).includes("Not enough messages to compact.")) seen.declined.add(entry.commandRun.args);
+      }
+      return seen;
+    } finally { fs.closeSync(fd); }
+  }
+  return null;
+}
+
+/**
+ * /model also saves its pick as the default for every new session on this login. That default is the
+ * vendor's, so it goes back; the runner's own --settings file keeps the switch across this runner's restarts.
+ * ponytail: a person's own /model later is not written there, so a restart returns to the last requested switch.
+ */
+function keepSwitchedModel(state, result, home, ownSettings) {
+  const before = state.read("user-default");
+  const path = join(home, "settings.json");
+  const user = before && readJson(path);
+  if (user && [state.command.model, result.model].includes(user.model)) {
+    if (before.model === undefined) delete user.model;
+    else user.model = before.model;
+    writeJson(path, user);
+  }
+  const own = ownSettings && readJson(ownSettings);
+  if (own && result.outcome === "applied") writeJson(ownSettings, { ...own, model: result.model });
+}
+
+async function reportModelSwitch(args) {
+  const answer = toolJson(await mcpPostIsolated("tools/call", { name: "model_switch_result", arguments: args }));
+  if (!answer.ok) throw new Error(answer.error ?? "model_switch_result refused");
+}
+
+const paneIdle = () => { const p = capturePane(); return Boolean(p && !p.inProgress && p.inputReady); };
+
+/** Carry out one model switch from next_event, then report how it ended. Single-flight; never throws. */
+export async function driveModelSwitch(command, {
+  dir = process.env.AR_MODEL_SWITCH_DIR,
+  sessionId = process.env.AR_CLAUDE_SESSION_ID,
+  home = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"),
+  ownSettings = process.env.CLAUDE_SETTINGS,
+  ready = paneIdle,
+  type = (text) => injectFrame(text, "model switch"),
+  current = () => sessionModel(home, sessionId),
+  declined = (id) => compactDeclined(home, sessionId, id),
+  report = reportModelSwitch,
+  step = MODEL_SWITCH_STEP_MS,
+  confirmWait = MODEL_SWITCH_CONFIRM_MS,
+  now = Date.now,
+} = {}) {
+  if (_switching || !command?.id || _switchId === command.id) return;
+  _switchId = command.id;
+  _switching = true;
+  let result = { outcome: "failed" };
+  try {
+    // Only Claude Code has the compact and model-switch hooks this relies on.
+    if (AR_AGENT_HARNESS !== "claude" || !dir || !sessionId) throw new Error("this runner cannot switch models");
+    const { switchState, advanceModelSwitch } = await import("../agent-guard/scripts/model-switch.mjs");
+    const state = switchState(dir, { ...command, sessionId });
+    const send = (text) => {
+      if (text.startsWith("/model ")) {
+        state.once("user-default", { model: readJson(join(home, "settings.json"))?.model });
+        state.once("model-sent", { at: now() });
+      }
+      return type(text);
+    };
+    const giveUpAt = Date.parse(command.expiresAt) + confirmWait + 60_000;
+    // ponytail: a fixed 2 s step; watch the receipt files if switch latency ever matters.
+    for (;;) {
+      const outcome = await advanceModelSwitch(state, { ready, send, current });
+      if (state.read("released")) {
+        result = { outcome, ...(state.read("applied") ?? state.read("model-started") ?? state.read("superseded") ?? {}) };
+        break;
+      }
+      // Nothing to compact is as good as compacted: the next step types /model.
+      if (state.read("compact-started") && !state.read("compacted") && declined(command.id)) state.once("compacted", { declined: true });
+      const sent = state.read("model-sent");
+      if ((sent && now() - sent.at >= confirmWait) || now() > giveUpAt) {
+        // No receipt in time: hand the pane back to clients. Marked failed, the hooks refuse our /model if it
+        // lands late; the session slot stays held until it ages out, so a new switch waits for that too.
+        // Giving up claims the receipt the hook's admit claims, exclusively: exactly one wins. A hook that
+        // loses refuses our /model; one that won made the switch, which may or may not have landed.
+        // A re-drive after a lost report finds its own earlier claim.
+        const gaveUp = state.once("model-started", { gaveUp: true }) || state.read("model-started")?.gaveUp === true;
+        if (gaveUp) state.once("failed", { phase: "gave-up" });
+        result = gaveUp ? { outcome: "failed" } : { outcome: "unknown", ...state.read("model-started") };
+        break;
+      }
+      await sleep(step);
+    }
+    // A person's own pick stays their default; any other ending puts back what our /model changed.
+    if (result.outcome !== "superseded") keepSwitchedModel(state, result, home, ownSettings);
+  } catch (err) {
+    console.warn(`[feeder] model switch ${command.id}: ${err instanceof Error ? err.message : String(err)}`);
+  } finally {
+    _switching = false;
+  }
+  try {
+    await report({ id: command.id, outcome: result.outcome, fromModel: result.fromModel ?? null, model: result.model ?? null });
+    console.log(`[feeder] model switch ${command.id}: ${result.outcome}`);
+  } catch (err) {
+    // The server keeps offering an unreported switch; driving it again only re-reads its ending and reports.
+    console.warn(`[feeder] model switch ${command.id}: report failed: ${err instanceof Error ? err.message : String(err)}`);
+    setTimeout(() => { if (_switchId === command.id) _switchId = null; }, ERROR_DELAY_MS).unref?.();
+  }
+}
+
 // --------------------------------------------------------------------------
 // The loop: initialize → poll next_event → inject each into the live pane → ack the
 // delivered ones on the NEXT poll → self-heal on transient MCP errors (runner shape).
@@ -730,7 +918,7 @@ let _lastRunnerState = null;
 
 /** One receive→inject→ack-select cycle (extracted from loop() + exported so the #173b _pendingAck
  *  fence is directly testable). Sets `_pendingAck` = the eventIds to ack on the NEXT poll. */
-export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent) {
+export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch) {
   // next_event refreshes the portal's runner heartbeat. Never call it for a detached/orphan feeder: a
   // process without its owned tmux session cannot receive work, so polling would paint a false Live state
   // while every event stays unacknowledged. The supervisor recreates the session; until then the durable
@@ -740,7 +928,12 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
     await sleep(IDLE_DELAY_MS);
     return;
   }
-  const state = readiness();
+  // A switch from the last poll starts after that poll's batch was typed, so it never types over one.
+  if (_nextSwitch) void drive(_nextSwitch);
+  _nextSwitch = null;
+  let state = readiness();
+  // The switch owns the pane until it ends: nothing is drained meanwhile, so nothing is typed over it.
+  if (_switching && state === "ready") state = "starting";
   if (state !== _lastRunnerState) {
     console.log(`[feeder] runner state ${_lastRunnerState ?? "unknown"} → ${state}`);
     _lastRunnerState = state;
@@ -748,7 +941,8 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // The server treats non-ready calls as status-only heartbeats: no drain and no ack. Keep any pending ack
   // until readiness returns, and defensively ignore events from an older server that does not know the gate.
   const canWork = state === "ready";
-  const { events = [], livenessProbe, welcome } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  const { events = [], livenessProbe, welcome, modelSwitch } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  _nextSwitch = modelSwitch ?? null;
   if (!canWork) {
     await sleep(IDLE_DELAY_MS);
     return;

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -77,7 +77,7 @@ HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
 # interactive CLI: the env file names its binary, arguments, resume/fresh flags, pid pattern and how work
 # reaches it (AR_FEED). Anything else is REFUSED by name: a supervisor that quietly fell back to Claude for an
 # unrecognized value would come up healthy, keep a pane alive, and answer nothing the vendor expected.
-# Tried: claude and codex with AR_FEED=feeder. Untried: generic, AR_FEED=push (Claude channels).
+# Tried: claude and codex with AR_FEED=feeder; claude with AR_FEED=push (the AgentRadar channel, R764). Untried: generic.
 AR_AGENT_HARNESS="${AR_AGENT_HARNESS:-claude}"
 case "${AR_AGENT_HARNESS}" in
   claude|codex|generic) : ;;
@@ -93,6 +93,8 @@ case "${AR_FEED}" in
   acp) die "AR_FEED=acp is not built yet; use feeder or push" ;;
   *) die "AR_FEED must be feeder or push (got '${AR_FEED}')" ;;
 esac
+# push is Claude Code channels only: no other harness has a channel to push into.
+[ "${AR_FEED}" = "push" ] && [ "${AR_AGENT_HARNESS}" != "claude" ] && die "AR_FEED=push needs AR_AGENT_HARNESS=claude (got '${AR_AGENT_HARNESS}')"
 # Launched only when the resume form exits non-zero (nothing to resume). Empty = the same argv without it.
 AR_FRESH_FLAGS="${AR_FRESH_FLAGS:-}"
 
@@ -140,6 +142,8 @@ else
   _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
   # `agentradar join` enables the agent-guard plugin for this session only, through a settings file.
   [ -n "${CLAUDE_SETTINGS:-}" ] && _launch_flags+=( --settings "${CLAUDE_SETTINGS}" )
+  # R764 + Vadym 10342: the AgentRadar channel (the stdio MCP `agentradar` in $MCP_CONFIG) pushes work in; no feeder types.
+  [ "${AR_FEED}" = "push" ] && _launch_flags+=( --dangerously-load-development-channels server:agentradar )
   # Pane-alive predicate — MUST be unique per agent. Default to the FULL mcp-config path (each agent's
   # differs by directory), NOT the basename: on a multi-agent box every agent's config is named
   # `awp-only.json`, so a basename match would find ANOTHER agent's live claude and mask THIS agent's
@@ -189,7 +193,7 @@ unset CLAUDE_CODE_OAUTH_TOKEN
 _claude_cfg=()
 [ -n "${CLAUDE_CONFIG_DIR:-}" ] && _claude_cfg=( CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR}" )
 # agent-guard (templates/agent-guard): its hooks ask the server what this runner still owes through the CLI.
-for _k in AR_CLI_RUNNER_ID AR_AGENTRADAR_BIN AR_DISCIPLINE_EVERY CLAUDE_CODE_PLUGIN_CACHE_DIR; do
+for _k in AR_CLI_RUNNER_ID AR_AGENTRADAR_BIN AR_DISCIPLINE_EVERY AR_MODEL_SWITCH_DIR CLAUDE_CODE_PLUGIN_CACHE_DIR; do
   [ -n "${!_k:-}" ] && _claude_cfg+=( "${_k}=${!_k}" )
 done
 
@@ -284,6 +288,12 @@ ensure_agent() {
     log "agent session '${TMUX_SESSION}' already live"
     return 0
   fi
+  # AR_ATTACH=1 (`agentradar join` from a session already in tmux): the pane is the caller's own. Never start,
+  # kill or replace it; whatever supervises it brings it back, and the feeder waits until then.
+  if [ "${AR_ATTACH:-}" = "1" ]; then
+    log "attached pane '${TMUX_SESSION}' has no live ${AR_AGENT_HARNESS}; waiting for its own supervisor"
+    return 1
+  fi
   if session_exists && ! pane_alive; then
     log "session '${TMUX_SESSION}' exists but claude pane is dead — recreating"
     "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true
@@ -356,11 +366,27 @@ ensure_agent() {
         return 1
       }
   # wait for the pane to come up
-  for _ in $(seq 1 30); do pane_alive && { log "agent pane is live"; return 0; }; sleep 1; done
+  # In the background: the watch must not hold up the monitor loop when the warning never shows.
+  for _ in $(seq 1 30); do pane_alive && { log "agent pane is live"; accept_dev_channels & return 0; }; sleep 1; done
   log "agent pane did not come up within 30s"
   return 1
 }
 
+# A pushed session starts on Claude Code's "Loading development channels" warning, and nobody sits at an unattended
+# pane to confirm it. The channel is this machine's own installed CLI (`agentradar channel <runner>`), so the
+# service confirms it, once per launch, only while that exact warning is on screen.
+accept_dev_channels() {
+  [ "${AR_FEED}" = "push" ] || return 0
+  for _ in $(seq 1 30); do
+    if "${TMUX_BIN}" capture-pane -p -t "=${TMUX_SESSION}:" 2>/dev/null | grep -q "Loading development channels"; then
+      "${TMUX_BIN}" send-keys -t "=${TMUX_SESSION}:" Enter
+      log "confirmed Claude Code's development-channels warning for the AgentRadar channel"
+      return 0
+    fi
+    sleep 1
+  done
+}
+
 # --- 4. Run: ensure agent, run feeder in foreground, monitor both -------------
 FEEDER_PID=""
 cleanup() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "engines": {
     "node": ">=20"
   },
@@ -28,7 +28,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/guard.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
+    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/*.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
     "clean": "rm -rf dist",
     "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit",