agentradar-cli 0.3.1 → 0.3.3

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -24,7 +24,7 @@ The Stop hook runs the same check and will not let you stop while something is o
 
 - Answer every message in the channel it came from. A human who wrote is waiting for you; answer them first.
 - Talk is not a task. Reply conversationally by default; create a task only for trackable, billable work.
-- Write to people so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a list of ideas), no ids, paths, tool names or internal terms unless asked. Say money in dollars, never cents; give every link with what it opens. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
+- Write to humans so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a list of ideas), no ids, paths, tool names or internal terms unless asked. Say money in dollars, never cents; give every link with what it opens. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
 - Never ask for, print or pass on a credential. AgentRadar holds the keys.
 - When you ask another agent or a human something, call `expect_reply` on that thread with the time you need the answer by. If nobody answers, `next_event` wakes you with kind `followup`: chase them in the thread. If they stay silent, you may escalate to the next human up the chain from the person you wait on; that is your call, never required.
 - Only a human accepts your work. Asked to "mark it done": record the final state with `append_task_log`, then reply that it is finished and ready for them to accept. Never call `decide_outcome` or `declare_outcome` on your own task.

package/dist/agentradar-vendor/SKILL.md

@@ -20,15 +20,15 @@ You work on the vendor's computer and connect to AgentRadar through the `agentra
 
 Call `get_my_context` on the AgentRadar MCP FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
 
-Keep each person's page in company memory current, every fact cited, as the People section of the `agentradar-memory-and-skills` skill says. A page is knowledge, never permission.
+Keep each human's page in company memory current, every fact cited, as the Humans section of the `agentradar-memory-and-skills` skill says. A page is knowledge, never permission.
 
 In your first session, call `read_onboarding_obligations` once (reading them acknowledges the safety rules), then `read_readiness`.
 
-Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a person told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
+Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
 
-## Talking to people
+## Talking to humans
 
-Write to people so a 13-year-old would understand: a few short plain lines, then one next step, not a list of ideas. No ids, paths, tool names, task codes or internal terms unless asked (say "your team", "company memory"; name a plan with its monthly price). Say money in dollars, never cents; give every link with what it opens. Answer only what was asked, and say it once. Talk to the event's `sender` as "you", never by name or as "the owner"; no persona from another chat carries over. Keep to what a person told you all chat, say so before a step they may not expect (a web search, sending, hiring), and never offer to contact anyone unless asked. Never talk about how messages reach you. Do the obvious thing for "undo that"; if unclear, offer short choices. Check your tools before saying what is scheduled or done, never from memory.
+Write to humans so a 13-year-old would understand: a few short plain lines, then one next step, not a list of ideas. No ids, paths, tool names, task codes or internal terms unless asked (say "your team", "company memory"; name a plan with its monthly price). Say money in dollars, never cents; give every link with what it opens. Answer only what was asked, and say it once. Talk to the event's `sender` as "you", never by name or as "the owner"; no persona from another chat carries over. Keep to what a human told you all chat, say so before a step they may not expect (a web search, sending, hiring), and never offer to contact anyone unless asked. Never talk about how messages reach you. Do the obvious thing for "undo that"; if unclear, offer short choices. Check your tools before saying what is scheduled or done, never from memory.
 
 ## Work loop
 

package/dist/channel.js

@@ -7,13 +7,15 @@ import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { envValue } from "./tool-run.js";
 import { trustedMcpEndpoint } from "./setup.js";
+import { syncJoinedSkills } from "./skill-install.js";
 export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Call next_event to receive the events, then pass their eventIds as ackEventIds on your next call. Answer livenessProbe with liveness_ack. Never acknowledge an event you have not read. Never poll next_event on your own or keep a loop running: when a channel message arrives, drain it, then end your turn.";
-export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: run your join again with --feeder (agentradar join <your join link> --feeder). Your organisation sees this agent as not receiving messages until one or the other works.";
+export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: run your join again with --feeder (agentradar join <your join link> --feeder). Your company sees this agent as not receiving messages until one or the other works.";
 /** One local MCP, forwarding tools to AWP. Wake signals never consume the durable queue. */
 export async function startChannel(runnerId, deps = {}) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
         throw new Error("Invalid runner ID");
-    const config = await readFile(join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.env`), "utf8");
+    const home = deps.home ?? homedir();
+    const config = await readFile(join(home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
     const endpoint = trustedMcpEndpoint(envValue(config, "AWP_MCP_URL") ?? "");
     const bearer = envValue(config, "AWP_BEARER");
     if (!endpoint || !bearer)
@@ -29,6 +31,7 @@ export async function startChannel(runnerId, deps = {}) {
     // the agent is not receiving messages; "ready" again once the session does call next_event.
     let unconfirmed = null;
     let warning;
+    let skillSync;
     const send = (value) => new Promise((resolve, reject) => {
         output.write(`${JSON.stringify(value)}\n`, (error) => error ? reject(error) : resolve());
     });
@@ -36,12 +39,14 @@ export async function startChannel(runnerId, deps = {}) {
         const response = await (deps.fetch ?? fetch)(endpoint, {
             method: "POST",
             redirect: "error",
-            headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json", accept: "application/json, text/event-stream" },
+            headers: { "x-agentradar-cli": createRequire(import.meta.url)("../package.json").version, authorization: `Bearer ${bearer}`, "content-type": "application/json", accept: "application/json, text/event-stream" },
             body: JSON.stringify({ jsonrpc: "2.0", id: ++sequence, method, params }),
             signal: AbortSignal.any([stop.signal, AbortSignal.timeout(230_000)]),
         });
-        if (!response.ok)
-            throw new Error(`AgentRadar refused the channel call (${response.status})`);
+        if (!response.ok) {
+            const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;
+            throw new Error(said ?? `AgentRadar refused the channel call (${response.status})`);
+        }
         const text = await response.text();
         const json = text.trim().startsWith("{") ? text : text.split("\n").find((line) => line.startsWith("data:"))?.slice(5);
         if (!json)
@@ -90,7 +95,7 @@ export async function startChannel(runnerId, deps = {}) {
                 const wake = JSON.stringify([events.map((event) => event.eventId), payload.livenessProbe?.nonce, Boolean(payload.onboarding)]);
                 if ((events.length || payload.livenessProbe || payload.onboarding) && (wake !== lastWake || Date.now() - lastSent >= 30_000)) {
                     await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: {
-                            content: `${events.length} new AgentRadar events; call next_event${payload.livenessProbe ? " to receive your liveness check" : ""}.`,
+                            content: `${payload.firstStep ? `${payload.firstStep} ` : ""}${events.length} new AgentRadar events; call next_event${payload.livenessProbe ? " to receive your liveness check" : ""}.`,
                             meta: { count: String(events.length) },
                         } });
                     lastWake = wake;
@@ -98,9 +103,11 @@ export async function startChannel(runnerId, deps = {}) {
                 }
                 // Never ack a count-only wake: only the agent's tool call confirms receipt of event content.
             }
-            catch {
+            catch (error) {
+                const said = error.message;
+                // Below the server's minimum CLI the retry cannot succeed: say how to upgrade instead.
                 if (!stop.signal.aborted)
-                    logError("AgentRadar channel poll failed; retrying. Check connectivity and the runner key.");
+                    logError(/below the minimum/.test(said) ? said : "AgentRadar channel poll failed; retrying. Check connectivity and the runner key.");
             }
             await pause();
         }
@@ -122,6 +129,13 @@ export async function startChannel(runnerId, deps = {}) {
                     unconfirmed = "pending";
                 } }, deps.confirmMs ?? 30_000);
                 void poll();
+                // Vadym 11038: a push-mode session runs no feeder, so the channel keeps its skills and brief current as the feeder
+                // does: at connect and every 10 minutes, dropping skills no longer linked. stdout is the MCP stream; logs go to stderr.
+                const sync = () => syncJoinedSkills(runnerId, { home, fetch: deps.fetch, log: logError })
+                    .catch((error) => logError(`AgentRadar skill sync failed; keeping current copies (${String(error?.message ?? error).split("\n")[0]}).`));
+                void sync();
+                skillSync = setInterval(() => { void sync(); }, deps.skillsSyncMs ?? 600_000);
+                skillSync.unref?.();
             }
         }
         else if (message.id !== undefined) {
@@ -159,6 +173,7 @@ export async function startChannel(runnerId, deps = {}) {
     }
     finally {
         clearTimeout(warning);
+        clearInterval(skillSync);
         stop.abort();
     }
 }

package/dist/index.js

@@ -3,11 +3,12 @@ import { createRequire } from "node:module";
 import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
-import { cancelJoin, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
-import { callAwpTool, callToolOverCli, createTaskOverCli, INBOX_SEARCH_USAGE, inboxSearchOverCli, LISTING_DESCRIBE_USAGE, listServiceToolsOverCli, parseCallArgs, PERMISSION_VERB_TOOLS, runServiceToolOverCli, TASK_VERB_TOOLS } from "./tool-run.js";
+import { cancelJoin, CODEX_GUARD_REFUSAL, ensureCodexGuard, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
+import { callAwpTool, callToolOverCli, createTaskOverCli, INBOX_SEARCH_USAGE, METRIC_REPORT_USAGE, PROPOSE_HUMAN_USAGE, inboxSearchOverCli, LISTING_DESCRIBE_USAGE, listServiceToolsOverCli, parseCallArgs, PERMISSION_VERB_TOOLS, runServiceToolOverCli, TASK_VERB_TOOLS } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 import { importVaultOverCli } from "./vault-import.js";
 import { cloneVaultOverCli } from "./vault-clone.js";
+import { secretsOverCli } from "./secrets.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
 // covers a whole session: `run <link>` (or `run join <link>`) joins, `run <runner-id> <tool>` calls a tool.
 export const runArgs = (raw) => raw[0] !== "run" ? raw
@@ -17,7 +18,7 @@ export const runArgs = (raw) => raw[0] !== "run" ? raw
 async function main() {
     const args = runArgs(process.argv.slice(2));
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...] | agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write] | agentradar vault clone <runner-id> <vault-id> [dir] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...] | agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write] | agentradar vault clone <runner-id> <vault-id> [dir] | agentradar metric report <runner-id> --metric-id <id> --value <n> --period-start <iso> --period-end <iso> [--evidence <text>] | agentradar secrets pull|renew <runner-id> | agentradar secrets exec <runner-id> -- <command> | agentradar propose-human <runner-id> --name <name> --email <email> --role-id <id> | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
         console.log([
             "agentradar run <runner-id> <noun> <verb> [--<argument> <value> ...] [--dry-run] [--json]",
             "  Every agent tool, grouped in AgentRadar terms: inbox, thread, message, task, metric, vault, ...",
@@ -41,6 +42,19 @@ async function main() {
         console.log(installed ? `agentradar upgraded to ${installed}` : `agentradar ${await runningVersion()} is the latest`);
         return;
     }
+    // The supervisor asks before every Codex launch (CODEX_HOME and CODEX_BIN from its env): exit 1 keeps Codex down.
+    if (args.length === 1 && args[0] === "codex-guard") {
+        try {
+            if (!process.env.CODEX_HOME)
+                throw new Error(CODEX_GUARD_REFUSAL);
+            await ensureCodexGuard(process.env.CODEX_HOME, process.env);
+        }
+        catch (error) {
+            console.error(error.message);
+            process.exitCode = 1;
+        }
+        return;
+    }
     if (args[0] === "leave" && args.length === 2) {
         process.exitCode = await leaveOrganisation(args[1]);
         return;
@@ -164,6 +178,28 @@ async function main() {
         process.exitCode = await inboxSearchOverCli(parsed.runnerId, parsed.flags, args.includes("--json"));
         return;
     }
+    if (args[0] === "metric" && args[1] === "report") {
+        // report_metric over the same endpoint and key: an agent's own metric, a subordinate's, or a person's below it.
+        const parsed = parseCallArgs([...args.slice(2), "report_metric"]);
+        if (!parsed || !parsed.flags.some(([flag]) => flag === "metric-id")) {
+            console.error(METRIC_REPORT_USAGE);
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await callToolOverCli(parsed.runnerId, parsed.tool, undefined, {}, parsed.flags);
+        return;
+    }
+    if (args[0] === "propose-human") {
+        // R013: the Chief invites a human it found into a vacant role, the MCP `propose_human` over the same endpoint and key.
+        const parsed = parseCallArgs([...args.slice(1), "propose_human"]);
+        if (!parsed || !["name", "email", "role-id"].every((k) => parsed.flags.some(([flag]) => flag === k))) {
+            console.error(PROPOSE_HUMAN_USAGE);
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = await callToolOverCli(parsed.runnerId, parsed.tool, undefined, {}, parsed.flags);
+        return;
+    }
     if (args[0] === "listing" && args[1] === "describe") {
         // UAT U1: the agent's public catalog description, the MCP `set_listing_description` over the same endpoint and key.
         const parsed = parseCallArgs([...args.slice(2), "set_listing_description"]);
@@ -179,13 +215,17 @@ async function main() {
         const tool = PERMISSION_VERB_TOOLS[args[1]];
         const parsed = parseCallArgs([...args.slice(2), tool]);
         if (!parsed || parsed.tool !== tool) {
-            console.error("Usage: agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...]");
+            console.error("Usage: agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...]");
             process.exitCode = 1;
             return;
         }
         process.exitCode = await callToolOverCli(parsed.runnerId, tool, parsed.json, {}, parsed.flags);
         return;
     }
+    if (args[0] === "secrets") {
+        process.exitCode = await secretsOverCli(args.slice(1));
+        return;
+    }
     if (args[0] === "task" && args[1] && Object.hasOwn(TASK_VERB_TOOLS, args[1])) {
         if (args.length !== 5 || args[3] !== "--args") {
             console.error("Usage: agentradar task create|repeat|make-recurring <runner-id> --args '<json>'");
@@ -217,7 +257,7 @@ async function main() {
         return;
     }
     const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
-    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
+    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...] | agentradar metric report <runner-id> --metric-id <id> --value <n> --period-start <iso> --period-end <iso> [--evidence <text>] | agentradar secrets pull|renew <runner-id> | agentradar secrets exec <runner-id> -- <command> | agentradar propose-human <runner-id> --name <name> --email <email> --role-id <id> | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]");
     if (!help)
         process.exitCode = 1;
 }

package/dist/runner.js

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { shellValue, trustedMcpEndpoint, writePrivateFile } from "./setup.js";
 import { callAwpTool, envValue } from "./tool-run.js";
-import { installedVersion, runningVersion, selfUpdate } from "./update.js";
+import { installedVersion, revertCli, runningVersion, selfUpdate } from "./update.js";
 const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ENGAGEMENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 // Per-hire bearers are ordinary agent keys (`pcp_…`); the runner's own is an AWP key (`ar_…`).
@@ -461,14 +461,36 @@ export async function startVendorRunner(runnerId, home = homedir(), deps = {}) {
         // waits for every pane to finish its turn, for at most an hour.
         let nextCheck = 0;
         let told = "";
+        let failing = "";
+        let failedChecks = 0;
+        // Self-release card 4: AgentRadar can hold every runner's updates while a bad release is fixed. Only an explicit
+        // hold counts: a runner whose key cannot read get_my_context (a vendor agent nobody hired yet) still updates.
+        const held = deps.held ?? (async () => {
+            let said = {};
+            const code = await callAwpTool(runnerId, "get_my_context", {}, {
+                home, log: (text) => { try {
+                    said = JSON.parse(text);
+                }
+                catch { /* not JSON: hold */ } }, logError: () => { },
+            });
+            return code === 0 && said.cli?.hold === true;
+        });
+        // Self-release card 3: before restarting onto a new version, prove it starts and reaches AgentRadar with this
+        // runner's key. One that cannot is put aside (`current` back, marked bad) and this runner stays as it is.
+        const probe = deps.probe ?? ((version) => run(process.execPath, [join(home, ".agentradar", "cli", version, "dist", "index.js"), "call", runnerId, "get_self"], { timeout: 60_000 })
+            .then(() => true, () => false));
         const autoUpdate = async () => {
             try {
                 if (running && !(await optedOut())) {
                     if (Date.now() >= nextCheck) {
                         nextCheck = Date.now() + (deps.updateEveryMs ?? 86_400_000);
-                        const fresh = await (deps.update ?? selfUpdate)();
-                        if (fresh)
-                            log(`AgentRadar CLI ${fresh} installed (was ${running})`);
+                        if (await held())
+                            log(`AgentRadar is holding CLI updates; staying on ${running}`);
+                        else {
+                            const fresh = await (deps.update ?? selfUpdate)();
+                            if (fresh)
+                                log(`AgentRadar CLI ${fresh} installed (was ${running})`);
+                        }
                     }
                     const onDisk = await installed();
                     if (onDisk !== running && !serviced) {
@@ -476,6 +498,25 @@ export async function startVendorRunner(runnerId, home = homedir(), deps = {}) {
                             log(`AgentRadar CLI ${onDisk} is installed; restart this runner to use it`);
                         told = onDisk;
                     }
+                    else if (onDisk !== running && await held()) {
+                        // A hold also stops a restart onto a version already on disk (another runner may have installed it).
+                        if (told !== `held ${onDisk}`)
+                            log(`AgentRadar is holding CLI updates; not restarting onto ${onDisk}`);
+                        told = `held ${onDisk}`;
+                    }
+                    else if (onDisk !== running && !(await probe(onDisk))) {
+                        // One failed check can be the network; two in a row, a minute apart, put the version aside.
+                        failedChecks = failing === onDisk ? failedChecks + 1 : 1;
+                        failing = onDisk;
+                        if (failedChecks >= 2) {
+                            await revertCli(home, running, onDisk);
+                            // Counted afresh: when the day is up and it is installed again, one blip must not put it aside again.
+                            failedChecks = 0;
+                            log(`AgentRadar CLI ${onDisk} failed its check twice (start + get_self); staying on ${running} and skipping ${onDisk} for a day`);
+                        }
+                        else
+                            log(`AgentRadar CLI ${onDisk} failed its check once; checking again before restarting`);
+                    }
                     else if (onDisk !== running) {
                         for (let i = 0; i < 240 && !stopped && await midTurn(); i += 1) {
                             await new Promise((resolveWait) => setTimeout(resolveWait, deps.idlePollMs ?? 15_000));

package/dist/secrets.js

@@ -0,0 +1,248 @@
+/**
+ * Bible #40 (Vadym 10582), mode 3: `agentradar secrets pull | renew | exec`.
+ *
+ * pull  writes the role's leasable secrets, ENCRYPTED, to `.agentradar/secrets.enc` (0600) in the workspace and
+ *       prints only their names. The key stays with AgentRadar under a 24 h lease.
+ * renew extends the lease while this agent still holds the role; a retired or replaced holder is refused.
+ * exec  fetches the key while the lease is live, decrypts in this process, and runs a command with the values in
+ *       its env. Nothing is written in plaintext, and the command's output passes through a value matcher.
+ * env   prints `export KEY='value'` lines for the supervisor's launch wrapper to eval into the agent's env at start.
+ *       Nothing is written to disk; with nothing pulled it prints nothing.
+ */
+import { spawn } from "node:child_process";
+import { createCipheriv, createDecipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { awpRequest, envValue } from "./tool-run.js";
+export const SECRETS_FILE = join(".agentradar", "secrets.enc");
+export const SECRETS_USAGE = "Usage: agentradar secrets pull|renew|env <runner-id> | agentradar secrets exec <runner-id> -- <command> [args...]"
+    + " | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--replace --approval-details '<json>'] [--token <token>]";
+/** The names the supervisor reserves for itself (supervise-agent.sh); a role secret never overrides one. */
+const RESERVED = /^(HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_[A-Z]+|TMPDIR|NODE_OPTIONS|CLAUDE_[A-Z_]+|CODEX_HOME|AR_[A-Z_]+|ANTHROPIC_API_KEY|AWP_[A-Z_]+|TMUX_SESSION|AGENT_PID_PATTERN|DISABLE_AUTOUPDATER)$/;
+/** The runner's own origin and key: its env file, else a hosted agent's run env (as tool-run.ts awpRequest). */
+async function credentials(runnerId, deps) {
+    const contents = await readFile(join(deps.home ?? homedir(), ".agentradar", "agents", `${runnerId}.env`), "utf8").catch(() => null);
+    const env = deps.env ?? process.env;
+    const url = contents !== null ? envValue(contents, "AWP_MCP_URL") : env.PAPERCLIP_API_URL ? `${env.PAPERCLIP_API_URL}/api/mcp` : null;
+    const bearer = contents !== null ? envValue(contents, "AWP_BEARER") : env.PAPERCLIP_API_KEY ?? null;
+    if (!url || !bearer)
+        throw new Error(`No runner named ${runnerId}. Run agentradar setup first.`);
+    return { origin: new URL(url).origin, bearer };
+}
+async function post(runnerId, path, body, deps) {
+    const { origin, bearer } = await credentials(runnerId, deps);
+    const res = await (deps.fetch ?? fetch)(`${origin}/api/agent/${path}`, {
+        method: "POST", headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" }, body: JSON.stringify(body ?? {}),
+    });
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok)
+        throw new Error(json.error ?? `AgentRadar answered ${res.status}`);
+    return json;
+}
+/**
+ * Replace every value in a text with [secret], however short (Bible #40: no value in any output). A short value also
+ * masks the same characters in ordinary words; that over-redaction is the price of never printing it.
+ */
+export function redactValues(text, values) {
+    return values.filter((v) => v.length > 0).sort((a, b) => b.length - a.length)
+        .reduce((out, value) => out.split(value).join("[secret]"), text);
+}
+export async function secretsPull(runnerId, deps = {}) {
+    const pulled = await post(runnerId, "role-secrets/pull", {}, deps);
+    const dir = join(deps.cwd ?? process.cwd(), ".agentradar");
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const file = join(deps.cwd ?? process.cwd(), SECRETS_FILE);
+    await writeFile(`${file}.tmp`, JSON.stringify({ runnerId, ...pulled }), { mode: 0o600 });
+    await rename(`${file}.tmp`, file);
+    (deps.log ?? console.log)(`Pulled ${pulled.names.length} secret${pulled.names.length === 1 ? "" : "s"} (${pulled.names.join(", ")}), encrypted, to ${file}. `
+        + `Use them with: agentradar secrets exec ${runnerId} -- <command>. The lease ends ${pulled.expiresAt} unless renewed.`);
+    return 0;
+}
+async function readPulled(deps) {
+    const text = await readFile(join(deps.cwd ?? process.cwd(), SECRETS_FILE), "utf8").catch(() => null);
+    if (!text)
+        throw new Error("No pulled secrets here. Run agentradar secrets pull <runner-id> first.");
+    return JSON.parse(text);
+}
+export async function secretsRenew(runnerId, deps = {}) {
+    const { leaseId } = await readPulled(deps);
+    const renewed = await post(runnerId, "role-secrets/renew", { leaseId }, deps);
+    (deps.log ?? console.log)(`Lease renewed until ${renewed.expiresAt}.`);
+    return 0;
+}
+/** The decrypted values, in memory only. */
+export async function decryptPulled(runnerId, deps = {}) {
+    const pulled = await readPulled(deps);
+    const { key } = await post(runnerId, "role-secrets/unlock", { leaseId: pulled.leaseId }, deps);
+    const decipher = createDecipheriv("aes-256-gcm", Buffer.from(key, "base64"), Buffer.from(pulled.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(pulled.tag, "base64"));
+    return JSON.parse(Buffer.concat([decipher.update(Buffer.from(pulled.ciphertext, "base64")), decipher.final()]).toString("utf8"));
+}
+export async function secretsExec(runnerId, command, deps = {}) {
+    if (!command.length)
+        throw new Error(SECRETS_USAGE);
+    const values = await decryptPulled(runnerId, deps);
+    const secrets = Object.values(values);
+    const child = spawn(command[0], command.slice(1), { env: { ...(deps.env ?? process.env), ...values }, stdio: ["inherit", "pipe", "pipe"] });
+    // Whole lines only, so a value split across two chunks is still matched.
+    // ponytail: a value printed inside one very long unterminated line waits for the close to be flushed.
+    const pipe = (from, to) => {
+        let held = "";
+        from.on("data", (chunk) => {
+            held += chunk.toString("utf8");
+            const cut = held.lastIndexOf("\n") + 1;
+            if (cut) {
+                to.write(redactValues(held.slice(0, cut), secrets));
+                held = held.slice(cut);
+            }
+        });
+        from.on("end", () => { if (held)
+            to.write(redactValues(held, secrets)); });
+    };
+    pipe(child.stdout, process.stdout);
+    pipe(child.stderr, process.stderr);
+    return new Promise((resolve) => child.on("close", (code) => resolve(code ?? 1)));
+}
+/** `KEY=value` lines of a .env file; comments, blanks and `export ` prefixes skipped, one pair of quotes stripped. */
+export function parseEnvFile(text) {
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*?)\s*$/.exec(line);
+        if (!m || line.trimStart().startsWith("#"))
+            continue;
+        const v = m[2];
+        out[m[1]] = /^(['"]).*\1$/.test(v) && v.length >= 2 ? v.slice(1, -1) : v;
+    }
+    return out;
+}
+/** Seal values to a slot token (`<slot>.<server public key>`): X25519, HKDF-SHA256, AES-256-GCM, AAD = slot hash and names. */
+export function sealForSlot(token, values) {
+    const [slot, serverKey] = token.split(".");
+    if (!slot || !serverKey)
+        throw new Error("That is not an upload token.");
+    const slotHash = createHash("sha256").update(slot).digest("hex");
+    const mine = generateKeyPairSync("x25519");
+    const shared = diffieHellman({ privateKey: mine.privateKey,
+        publicKey: createPublicKey({ key: Buffer.from(serverKey, "base64url"), format: "der", type: "spki" }) });
+    const key = Buffer.from(hkdfSync("sha256", shared, Buffer.from(slotHash), "agentradar-secret-upload-v1", 32));
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    cipher.setAAD(Buffer.from(`${slotHash}\n${Object.keys(values).sort().join(",")}`));
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(values), "utf8"), cipher.final()]);
+    return { slot, body: { ephemeralPublicKey: mine.publicKey.export({ type: "spki", format: "der" }).toString("base64url"),
+            iv: iv.toString("base64url"), tag: cipher.getAuthTag().toString("base64url"), ciphertext: ciphertext.toString("base64url") } };
+}
+/** A value typed at a hidden prompt: nothing is echoed, nothing reaches shell history. */
+async function promptHidden(name) {
+    const stdin = process.stdin;
+    if (!stdin.isTTY)
+        throw new Error("--prompt needs a terminal.");
+    process.stderr.write(`${name}: `);
+    stdin.setRawMode(true);
+    stdin.resume();
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const onData = (chunk) => {
+            for (const ch of chunk.toString("utf8")) {
+                if (ch === "\r" || ch === "\n" || ch === "\u0003") {
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.off("data", onData);
+                    process.stderr.write("\n");
+                    return ch === "\u0003" ? reject(new Error("Cancelled.")) : resolve(value);
+                }
+                value = ch === "\u007f" ? value.slice(0, -1) : value + ch;
+            }
+        };
+        stdin.on("data", onData);
+    });
+}
+/**
+ * Vadym 11074: `agentradar secrets upload`. Values come from this machine (a .env file, the environment, a hidden prompt)
+ * and never from the command line. Mints a slot with the `upload_secret` tool unless given its token, seals, posts once.
+ */
+export async function secretsUpload(runnerId, flags, deps = {}) {
+    const opts = new Map();
+    for (let i = 0; i < flags.length; i++) {
+        const flag = flags[i];
+        if (flag === "--replace") {
+            opts.set("replace", "1");
+            continue;
+        }
+        if (!["--env-file", "--from-env", "--prompt", "--only", "--approval-details", "--token"].includes(flag) || flags[i + 1] === undefined) {
+            throw new Error(`${flag.startsWith("--") ? `Unknown option ${flag}` : "Values are never taken on the command line"}. ${SECRETS_USAGE}`);
+        }
+        opts.set(flag.slice(2), flags[++i]);
+    }
+    const list = (v) => (v ?? "").split(",").map((n) => n.trim()).filter(Boolean);
+    const env = deps.env ?? process.env;
+    let values = {};
+    if (opts.has("env-file"))
+        values = parseEnvFile(await readFile(opts.get("env-file"), "utf8"));
+    for (const name of list(opts.get("from-env"))) {
+        if (!env[name])
+            throw new Error(`${name} is not set in this environment.`);
+        values[name] = env[name];
+    }
+    if (opts.has("prompt"))
+        values[opts.get("prompt")] = await promptHidden(opts.get("prompt"));
+    const only = list(opts.get("only"));
+    if (only.length)
+        values = Object.fromEntries(only.map((n) => {
+            if (!values[n])
+                throw new Error(`${n} has no value in what you gave.`);
+            return [n, values[n]];
+        }));
+    values = Object.fromEntries(Object.entries(values).filter(([, v]) => v.length > 0));
+    if (!Object.keys(values).length)
+        throw new Error(`No values to upload. ${SECRETS_USAGE}`);
+    let token = opts.get("token");
+    if (!token) {
+        const approvalDetails = opts.has("approval-details") ? JSON.parse(opts.get("approval-details")) : undefined;
+        const said = await awpRequest(runnerId, "tools/call", { name: "upload_secret",
+            arguments: { names: Object.keys(values), replace: opts.has("replace") || undefined, approvalDetails } }, deps);
+        const minted = JSON.parse(said?.result?.content?.[0]?.text ?? "{}");
+        if (!minted.ok || !minted.token)
+            throw new Error(minted.error ?? "AgentRadar did not open an upload.");
+        token = minted.token;
+    }
+    const { slot, body } = sealForSlot(token, values);
+    const { outcomes } = await post(runnerId, `secret-uploads/${encodeURIComponent(slot)}`, body, deps);
+    for (const o of outcomes) {
+        (deps.log ?? console.log)(`${o.name}: ${o.status.replace("_", " ")}${o.reason ? ` (${o.reason})` : ""}${o.approvalId ? ` (approval ${o.approvalId})` : ""}`);
+    }
+    return outcomes.some((o) => o.status === "refused") ? 1 : 0;
+}
+export async function secretsEnv(runnerId, deps = {}) {
+    const text = await readFile(join(deps.cwd ?? process.cwd(), SECRETS_FILE), "utf8").catch(() => null);
+    if (!text)
+        return 0;
+    const values = await decryptPulled(runnerId, deps);
+    const quote = (v) => `'${v.replace(/'/g, "'\\''")}'`;
+    (deps.log ?? console.log)(Object.entries(values).filter(([k]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k) && !RESERVED.test(k))
+        .map(([k, v]) => `export ${k}=${quote(v)}`).join("\n"));
+    return 0;
+}
+export async function secretsOverCli(args, deps = {}) {
+    const [verb, runnerId, sep, ...command] = args;
+    try {
+        if (verb === "pull" && runnerId && !sep)
+            return await secretsPull(runnerId, deps);
+        if (verb === "renew" && runnerId && !sep)
+            return await secretsRenew(runnerId, deps);
+        if (verb === "env" && runnerId && !sep)
+            return await secretsEnv(runnerId, deps);
+        if (verb === "exec" && runnerId && sep === "--")
+            return await secretsExec(runnerId, command, deps);
+        if (verb === "upload" && runnerId)
+            return await secretsUpload(runnerId, args.slice(2), deps);
+    }
+    catch (error) {
+        (deps.logError ?? console.error)(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    (deps.logError ?? console.error)(SECRETS_USAGE);
+    return 1;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/setup.js

@@ -289,6 +289,8 @@ async function codexServiceHome(home, runnerId, env) {
         await writePrivateFile(join(codexHome, "config.toml"), `${config.replace(/\n*$/, "\n")}${trusted
             .map(({ key, hash }) => `\n[hooks.state.${JSON.stringify(key)}]\ntrusted_hash = ${JSON.stringify(hash)}\n`).join("")}`);
     }
+    if (!(await codexGuardTrusted(codexHome, env)))
+        throw new Error(CODEX_GUARD_REFUSAL);
     await cp(join(source, "rules"), join(codexHome, "rules"), { recursive: true, force: true }).catch((error) => {
         if (error.code !== "ENOENT")
             throw error;
@@ -301,11 +303,38 @@ async function codexServiceHome(home, runnerId, env) {
     }
     return { codexHome, keys: [...config.matchAll(/^\s*env_key\s*=\s*"([A-Za-z_][A-Za-z0-9_]*)"/gm)].map((match) => match[1]) };
 }
+export const CODEX_GUARD_REFUSAL = "Codex did not accept AgentRadar's guard hooks, and the agent does not start without its guard. Fix: run `codex update` (an older Codex: `npm install -g @openai/codex@latest`). A connected agent then starts by itself within a minute; during join, run join again.";
+/**
+ * `agentradar codex-guard`, which the supervisor runs before every Codex launch. Trust Codex dropped (an upgrade
+ * can) is recorded again exactly as join records it, from the vendor's ~/.codex, and Codex is asked once more;
+ * only a Codex that still refuses keeps the agent down, with CODEX_GUARD_REFUSAL naming the fix.
+ * ponytail: a vendor who joined with a custom CODEX_HOME gets ~/.codex's config on repair; re-run join if it bites.
+ */
+export async function ensureCodexGuard(codexHome, env, home = homedir()) {
+    if (await codexGuardTrusted(codexHome, env))
+        return;
+    const runnerId = basename(codexHome);
+    // Only a service home join made; never write trust into any other Codex home.
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId) || resolve(codexHome) !== join(home, ".agentradar", "codex", runnerId)) {
+        throw new Error(CODEX_GUARD_REFUSAL);
+    }
+    const { CODEX_HOME: _serviceHome, ...vendorEnv } = env;
+    await codexServiceHome(home, runnerId, vendorEnv);
+}
+/**
+ * Retire-legacy step 1 (Vadym 11054): Codex starts only with AgentRadar's guard. True only when Codex itself lists
+ * both guard hooks from `<codexHome>/hooks.json` as trusted. Asked at join and, through `agentradar codex-guard`,
+ * by the supervisor before every launch, since a Codex upgrade can drop the trust it recorded.
+ */
+export async function codexGuardTrusted(codexHome, env) {
+    const hooks = await codexHookHashes(codexHome, env).catch(() => []);
+    return hooks.length === 2 && hooks.every((hook) => hook.trusted);
+}
 /**
  * Codex runs a user hook only once its hash is recorded as trusted (`[hooks.state."<key>"] trusted_hash`),
  * which is what its /hooks review writes. Asks Codex itself for the keys and hashes of the hooks in
  * `<codexHome>/hooks.json` (app-server `hooks/list`), so the hash is never recomputed here. Any failure
- * leaves them untrusted: Codex then skips them, and the agent runs without the guard rather than not at all.
+ * leaves them untrusted, and `codexGuardTrusted` then refuses to start the agent.
  */
 async function codexHookHashes(codexHome, env) {
     const child = spawn(env.CODEX_BIN || "codex", ["app-server"], { cwd: codexHome, env: { ...env, CODEX_HOME: codexHome }, stdio: ["pipe", "pipe", "ignore"] });
@@ -332,7 +361,7 @@ async function codexHookHashes(codexHome, env) {
                 continue;
             return (message.result?.data ?? []).flatMap((entry) => entry.hooks ?? [])
                 .filter((hook) => hook.source === "user" && basename(hook.sourcePath) === "hooks.json")
-                .map((hook) => ({ key: hook.key, hash: hook.currentHash }));
+                .map((hook) => ({ key: hook.key, hash: hook.currentHash, trusted: hook.trustStatus === "trusted" }));
         }
         return [];
     }
@@ -702,14 +731,14 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         if (attach) {
             log(`Connected. Your welcome and every client message are typed into this session (tmux ${attach}), and you answer here. Nothing else was started. To stop: agentradar leave ${runnerId}`);
             if (approvedBypass)
-                log("Your organisation allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
+                log("Your company allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
             log("Running as a service; the delivery restarts on crash and reboot.");
             return 0;
         }
-        const mode = bypass ? ", in bypass-permissions mode as your organisation allowed" : "";
+        const mode = bypass ? ", in bypass-permissions mode as your company allowed" : "";
         if (channel) {
             log(`Connected through the AgentRadar channel. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): client messages are pushed into it and it answers there, with no restart from you. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`);
-            log(`If your organisation's Claude plan blocks channels, deliver with the feeder instead: agentradar join ${enrolmentUrl} --feeder`);
+            log(`If your company's Claude plan blocks channels, deliver with the feeder instead: agentradar join ${enrolmentUrl} --feeder`);
             log("Running as a service; it restarts on crash and reboot.");
             return 0;
         }
@@ -725,7 +754,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         link = new URL(enrolmentUrl);
     }
     catch {
-        throw new Error("Pass the join link your organisation gave you, e.g. https://…/invite/<token>");
+        throw new Error("Pass the join link your company gave you, e.g. https://…/invite/<token>");
     }
     const token = /^\/(?:api\/invites|invite)\/([^/]+?)(?:\.md)?(?:\/|$)/.exec(link.pathname)?.[1];
     if (!token || !trustedMcpEndpoint(link.origin)) {
@@ -751,7 +780,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         const { envValue } = await import("./tool-run.js");
         const bearer = envValue(saved, "AWP_BEARER");
         if (!bearer)
-            throw new Error("This machine left that organisation (agentradar leave). A key is issued once; ask your organisation for a new join link.");
+            throw new Error("This machine left that company (agentradar leave). A key is issued once; ask your company for a new join link.");
         // `--revoke-bypass` is remembered on this machine, so a later re-run keeps the prompts on.
         if (deps.revokeBypass && state.bypassConfirmed !== false) {
             state = { ...state, bypassConfirmed: false };
@@ -776,7 +805,7 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         });
         if (!response.ok) {
             throw new Error(response.status === 404
-                ? "This join link has expired, was already used, or was withdrawn. Ask your organisation for a new link."
+                ? "This join link has expired, was already used, or was withdrawn. Ask your company for a new link."
                 : `This join link cannot be used. ${await failureMessage(response)}`);
         }
         const accepted = await response.json();
@@ -786,14 +815,14 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         state = { requestId: accepted.id, claimSecret: accepted.claimSecret, ...(typeof accepted.approvalUrl === "string" ? { approvalUrl: accepted.approvalUrl } : {}) };
         await writePrivateFile(statePath, JSON.stringify(state));
     }
-    log("Join request sent. Waiting for your organisation to approve it…");
+    log("Join request sent. Waiting for your company to approve it…");
     if (state.approvalUrl)
         log(`Approval link: ${state.approvalUrl}\nSend it to your own human once; they approve after signing in. Never send anything else from this folder.`);
     const claimUrl = api(`join-requests/${encodeURIComponent(state.requestId)}/claim-api-key`);
     // Named off the join request, which exists before the key does, so the server can record it at claim.
     const runnerId = `join-${state.requestId}`;
     for (let poll = 1;; poll++) {
-        if (poll > (deps.polls ?? 9)) {
+        if (poll > (deps.polls ?? Infinity)) {
             log(`Still waiting for approval. Run this same command again: agentradar run ${enrolmentUrl}`);
             return 0;
         }
@@ -824,13 +853,13 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             continue;
         }
         if (response.status === 409 && said.includes("rejected")) {
-            throw new Error("Your organisation declined this join request. Ask it for a new join link.");
+            throw new Error("Your company declined this join request. Ask it for a new join link.");
         }
         if (response.status === 409 && said.includes("withdrawn")) {
-            throw new Error("This join request was withdrawn (agentradar join cancel). Ask your organisation for a new join link.");
+            throw new Error("This join request was withdrawn (agentradar join cancel). Ask your company for a new join link.");
         }
         if (response.status === 409 && /already (?:used|claimed)/.test(said)) {
-            throw new Error("This join link's key was already claimed. A key is issued once and cannot be claimed again; ask your organisation for a new join link.");
+            throw new Error("This join link's key was already claimed. A key is issued once and cannot be claimed again; ask your company for a new join link.");
         }
         throw new Error(said);
     }
@@ -863,7 +892,7 @@ export async function cancelJoin(target, deps = {}) {
         return 1;
     }
     if (state.agentId) {
-        log(`That join was already approved. To leave the organisation: agentradar leave join-${state.requestId}`);
+        log(`That join was already approved. To leave the company: agentradar leave join-${state.requestId}`);
         return 1;
     }
     // The secret goes only back to the AgentRadar host that issued it.

package/dist/skill-install.js

@@ -1,6 +1,6 @@
 import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 const MANAGED_MARK = ".agentradar-managed";
 const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
@@ -132,20 +132,37 @@ async function writeBrief(file, text) {
     await writeFile(temporary, `${BRIEF_MARK}\n${text.trim()}\n`);
     await rename(temporary, file);
 }
+/** Where each CLI reads skills. The same table as templates/vendor-runner/feeder.mjs; skill-install.test.ts pins them equal. */
+export const SKILL_DIRS = {
+    claude: "$AR_BASE/.claude/skills",
+    codex: "$CODEX_HOME/skills",
+    gemini: "$HOME/.gemini/skills",
+    "cursor-agent": "$HOME/.cursor/skills",
+    agent: "$HOME/.cursor/skills",
+    pi: "$HOME/.pi/agent/skills",
+    hermes: "$HOME/.hermes/skills",
+    opencode: "$HOME/.claude/skills",
+};
+export function skillsDirFor(harness, env) {
+    const name = harness === "generic" ? basename(env("AR_AGENT_BIN") ?? "") : harness ?? "claude";
+    const dir = (SKILL_DIRS[name] ?? SKILL_DIRS.claude).replace(/\$(\w+)/, (_, v) => env(v) ?? "\0");
+    return dir.includes("\0") ? null : join(dir);
+}
 export async function syncJoinedSkills(runnerId, deps) {
     const env = await readFile(join(deps.home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
-    const root = envValue(env, "AR_AGENT_HARNESS") === "codex" ? envValue(env, "CODEX_HOME") : envValue(env, "AR_BASE");
-    if (!root)
+    const harness = envValue(env, "AR_AGENT_HARNESS");
+    const skillsDir = skillsDirFor(harness, (name) => name === "HOME" ? deps.home : envValue(env, name));
+    if (!skillsDir)
         return;
-    const codex = envValue(env, "AR_AGENT_HARNESS") === "codex";
-    const skillsDir = codex ? join(root, "skills") : join(root, ".claude", "skills");
+    const codex = harness === "codex";
+    const root = (codex ? envValue(env, "CODEX_HOME") : envValue(env, "AR_BASE")) ?? "";
     // Vadym 9988: the server's start instructions with this agent's brief, before its first session starts.
     // Same file and mark as the runner's feeder, which keeps it fresh from then on.
     const init = await awpRequest(runnerId, "initialize", {
         protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-cli", version: "1.0.0" },
     }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
     const briefFile = codex ? join(root, "AGENTS.md") : join(root, ".claude", "rules", "agentradar-brief.md");
-    if (init?.result?.instructions)
+    if (root && init?.result?.instructions)
         await writeBrief(briefFile, init.result.instructions);
     const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: {} }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
     const text = body?.result?.content?.find((c) => c.type === "text")?.text;

package/dist/tool-run.js

@@ -2,7 +2,7 @@ import { readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { commandFor, DEPRECATED_TOOLS, toolFor } from "./commands.js";
-import { newer, runningVersion } from "./update.js";
+import { cliHeader, newer, runningVersion } from "./update.js";
 /**
  * One `KEY='value'` line as `setup.ts` wrote it, single-quoted with `'` escaped as `'\''`.
  * Nothing here is printed: the file holds the runner's bearer.
@@ -238,6 +238,10 @@ function coerce(type, value) {
         return type === undefined ? value : undefined;
     }
 }
+// The parity test (server human-metrics-ext-realpg) fails when report_metric gains an argument this line does not name.
+export const METRIC_REPORT_USAGE = "Usage: agentradar metric report <runner-id> --metric-id <id> --value <n> --period-start <iso> --period-end <iso> [--evidence <text>] [--from-event-id <id>] [--comment <text>]";
+// The parity test (server r013-propose-human-realpg) fails when propose_human gains an argument this line does not name.
+export const PROPOSE_HUMAN_USAGE = "Usage: agentradar propose-human <runner-id> --name <name> --email <email> --role-id <id>";
 // The parity test (server listing-description-realpg) fails when set_listing_description gains an argument this line does not name.
 export const LISTING_DESCRIBE_USAGE = "Usage: agentradar listing describe <runner-id> --capabilities <text>";
 // The parity test (server inbox-search-realpg) fails when inbox_search gains an argument this line does not name.
@@ -267,7 +271,7 @@ function inboxLines(text) {
     return [...results.map((r) => `${r.at}  ${r.channel}  ${r.sender?.name ?? r.from ?? ""}\n  thread ${r.threadId}  message ${r.messageId}\n  ${r.snippet}`), ...pages].join("\n");
 }
 /**
- * Vadym 10719 — `agentradar permissions mine|roles|set|request <runner-id> [--<argument> <value> ...]`: the MCP permission
+ * Vadym 10719 — `agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...]`: the MCP permission
  * tools on the same endpoint with the same key. The parity test (server permission-tools-realpg) fails when one drifts.
  */
 export const PERMISSION_VERB_TOOLS = {
@@ -275,6 +279,7 @@ export const PERMISSION_VERB_TOOLS = {
     roles: "read_role_permissions",
     set: "set_role_permission",
     request: "request_permission",
+    "grant-tool": "propose_tool_assignment",
 };
 /**
  * Ruling 49 — `agentradar task create|repeat|make-recurring <runner-id> --args '<json>'`: the agent's own
@@ -402,6 +407,7 @@ async function postAwp(url, bearer, method, params, deps) {
     const response = await (deps.fetch ?? fetch)(url, {
         method: "POST",
         headers: {
+            ...(await cliHeader()),
             authorization: `Bearer ${bearer}`,
             "content-type": "application/json",
             // Both, because the endpoint answers JSON only when the client says it takes JSON.
@@ -415,7 +421,9 @@ async function postAwp(url, bearer, method, params, deps) {
         }),
     });
     if (!response.ok) {
-        logError(`AgentRadar refused the tool call (${response.status}).`);
+        // 426: this CLI is below the server's minimum; its sentence says how to upgrade.
+        const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;
+        logError(said ?? `AgentRadar refused the tool call (${response.status}).`);
         return null;
     }
     const body = await response.json();

package/dist/update.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
@@ -8,12 +8,16 @@ import { installCli } from "./setup.js";
 const LATEST = "https://registry.npmjs.org/agentradar-cli/latest";
 const TARBALL = /^https:\/\/registry\.npmjs\.org\/agentradar-cli\/-\/agentradar-cli-\d+\.\d+\.\d+\.tgz$/;
 const VERSION = /^(\d+)\.(\d+)\.(\d+)$/;
+/** How long a version that failed its check twice is skipped by the daily install. */
+const BAD_FOR_MS = 24 * 3_600_000;
 /** This package's folder: the CLI, the runner scripts and the agent-guard plugin all live in it. */
 export const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 /** A service's copy, made by `agentradar join` at ~/.agentradar/cli/<version>; the service runs ~/.agentradar/cli/current. */
 const serviceCopy = (root) => basename(dirname(root)) === "cli" && basename(dirname(dirname(root))) === ".agentradar";
 /** The version this process runs, whatever `current` points at now. */
 export const runningVersion = async () => JSON.parse(await readFile(join(PACKAGE_ROOT, "package.json"), "utf8")).version;
+/** Sent as `x-agentradar-cli` on every MCP call, so the server can refuse a CLI below its minimum (self-release card 2). */
+export const cliHeader = async () => ({ "x-agentradar-cli": await runningVersion().catch(() => "") });
 /** The version on disk: for a service's copy, the one `current` points at, which another runner may have moved. */
 export const installedVersion = async (root = PACKAGE_ROOT) => JSON.parse(await readFile(join(serviceCopy(root) ? join(dirname(root), "current") : root, "package.json"), "utf8")).version;
 export const newer = (a, b) => {
@@ -45,6 +49,12 @@ export async function selfUpdate(deps = {}) {
     const version = latest.version ?? "";
     if (!newer(version, current))
         return null;
+    // A version a runner on this machine already reverted (self-release card 3) is not installed again.
+    // For a day: the failure may have been ours (the network), so the version gets another chance after that, and
+    // its check runs again before any restart.
+    const bad = await stat(join(dirname(root), `${version}.bad`)).catch(() => null);
+    if (serviceCopy(root) && bad && Date.now() - bad.mtimeMs < BAD_FOR_MS)
+        return null;
     const tarballUrl = latest.dist?.tarball ?? "";
     const integrity = latest.dist?.integrity ?? "";
     if (!TARBALL.test(tarballUrl) || !tarballUrl.endsWith(`-${version}.tgz`) || !integrity.startsWith("sha512-")) {
@@ -91,4 +101,16 @@ export async function selfUpdate(deps = {}) {
     }
     return version;
 }
+/**
+ * Self-release card 3: put a failed version aside. `current` points back at the version still running (its folder
+ * is untouched), and `<version>.bad` stops the daily check installing the failed one again.
+ */
+export async function revertCli(home, to, bad) {
+    const cli = join(home, ".agentradar", "cli");
+    const link = join(cli, `current.${process.pid}.revert`);
+    await rm(link, { force: true });
+    await symlink(to, link);
+    await rename(link, join(cli, "current"));
+    await writeFile(join(cli, `${bad}.bad`), `${new Date().toISOString()} failed its check; reverted to ${to}\n`);
+}
 //# sourceMappingURL=update.js.map

package/dist/vendor-runner/feeder.mjs

@@ -25,7 +25,7 @@ import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
 
@@ -96,10 +96,28 @@ const PANE_MCP_TIMEOUT_MS = Number(process.env.PANE_MCP_TIMEOUT_MS ?? "10000");
 // R650 — the agent's AgentRadar skills (bundled + linked) are written into its CLI's skills directory on this
 // cadence. Only directories this feeder created (they carry MANAGED_MARK) are ever replaced or removed; a
 // skill the vendor put there by hand is left alone. 0 disables.
-/** Claude reads `$AR_BASE/.claude/skills`; Codex reads `$CODEX_HOME/skills`, the per-agent home the supervisor requires. */
+/**
+ * Where each CLI reads skills, the same paths the heartbeat adapters use. Claude (and Grok, which reads the
+ * workspace's `.claude/skills`) is the default; Codex reads `$CODEX_HOME/skills`, the per-agent home the supervisor
+ * requires. A `generic` runner is looked up by its binary's name. packages/agentradar-cli/src/skill-install.ts
+ * keeps the same table (skill-install.test.ts pins them equal).
+ * ponytail: gemini/cursor/pi/opencode/hermes read $HOME, so two joined agents on one box share one directory; add a
+ * per-agent HOME when that happens.
+ */
+export const SKILL_DIRS = {
+  claude: "$AR_BASE/.claude/skills",
+  codex: "$CODEX_HOME/skills",
+  gemini: "$HOME/.gemini/skills",
+  "cursor-agent": "$HOME/.cursor/skills",
+  agent: "$HOME/.cursor/skills",
+  pi: "$HOME/.pi/agent/skills",
+  hermes: "$HOME/.hermes/skills",
+  opencode: "$HOME/.claude/skills",
+};
 export function skillsDirFor(harness, env) {
-  if (harness === "codex") return env.CODEX_HOME ? join(env.CODEX_HOME, "skills") : null;
-  return env.AR_BASE ? join(env.AR_BASE, ".claude", "skills") : null;
+  const name = harness === "generic" ? basename(env.AR_AGENT_BIN ?? "") : harness;
+  const dir = (SKILL_DIRS[name] ?? SKILL_DIRS.claude).replace(/\$(\w+)/, (_, v) => env[v] ?? "\0");
+  return dir.includes("\0") ? null : join(dir);
 }
 const SKILLS_DIR = skillsDirFor(AR_AGENT_HARNESS, process.env);
 /**
@@ -974,7 +992,7 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   // The server treats non-ready calls as status-only heartbeats: no drain and no ack. Keep any pending ack
   // until readiness returns, and defensively ignore events from an older server that does not know the gate.
   const canWork = state === "ready";
-  const { events = [], livenessProbe, welcome, modelSwitch } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
+  const { events = [], livenessProbe, welcome, modelSwitch, firstStep } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
   _nextSwitch = modelSwitch ?? null;
   if (!canWork) {
     await sleep(IDLE_DELAY_MS);
@@ -997,7 +1015,7 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   for (const e of events) {
     // Inject in order; ack ONLY the ones that reached a live pane (no-phantom).
     // eslint-disable-next-line no-await-in-loop
-    if (await deliverEvent(e)) delivered.push(e.eventId);
+    if (await deliverEvent(firstStep ? { ...e, firstStep } : e)) delivered.push(e.eventId);
     // eslint-disable-next-line no-await-in-loop
     else break; // pane went away mid-batch → stop; unacked events re-deliver in order.
     // eslint-disable-next-line no-await-in-loop

package/dist/vendor-runner/session-frame.mjs

@@ -23,7 +23,7 @@ function oneLine(s) {
 
 /**
  * Build the single-line injection frame for one drained next_event event.
- * event: { eventId, source, channel?, conversationId?, text }
+ * event: { eventId, source, channel?, conversationId?, text, firstStep? }
  * cliRunnerId: set when the session acts through `agentradar run <id> <tool>` (a joined agent) rather than an
  * MCP connection — the command its human already chose "always allow" for, where an MCP tool would prompt.
  * Returns a one-line string safe to `tmux send-keys -l` then Enter.
@@ -35,7 +35,8 @@ export function formatInjectionFrame(event, cliRunnerId) {
   if (e.conversationId) tags.push(`conversationId=${e.conversationId}`);
   if (e.taskId) tags.push(`taskId=${e.taskId}`); // assignment events: the agent works THIS task, not one dug out of its log
   if (e.eventId) tags.push(`eventId=${e.eventId}`);
-  const header = `[AgentRadar inbound · ${tags.join(" · ")}]`;
+  // Vadym 11025: the server's `firstStep` (get_my_context first) opens every frame that carries work.
+  const header = `[AgentRadar inbound · ${tags.join(" · ")}]${e.firstStep ? ` ${oneLine(e.firstStep)} Message:` : ""}`;
   const body = oneLine(e.text) || "(no text)";
   const evId = e.eventId ? String(e.eventId) : null;
   // The reply instruction pins the EXPLICIT conversationId (threading) + inResponseToEventId

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -317,8 +317,25 @@ ensure_agent() {
     "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true
   fi
   [ -n "${AR_GUARD_MARKER}" ] && rm -f "${AR_GUARD_MARKER}"   # this launch must prove the guard afresh
+  # Retire-legacy step 1 (Vadym 11054): Codex starts only with AgentRadar's guard. Its SessionStart hook does not
+  # fire at an idle start, so there is no marker to wait for; Codex is asked, before every launch, whether it
+  # trusts both guard hooks (a Codex upgrade can drop that trust). No answer, no start.
+  # The guard records lost trust again itself; what it still refuses, its message names the fix for.
+  if [ "${AR_AGENT_HARNESS}" = "codex" ] && ! _guard_out=$(CODEX_HOME="${CODEX_HOME}" CODEX_BIN="${AGENT_BIN}" node "${AR_AGENTRADAR_BIN:-${HOME}/.agentradar/cli/current/dist/index.js}" codex-guard 2>&1); then
+    die "not starting Codex: ${_guard_out:-the AgentRadar guard check gave no answer}"
+  fi
   _resume_now="${AR_RESUME_FLAGS}"
-  if [ "${_FORCE_FRESH:-0}" = 1 ]; then _resume_now="${AR_FRESH_FLAGS}"; _FORCE_FRESH=0; fi   # poisoned history: do not resume it
+  if [ "${_FORCE_FRESH:-0}" = 1 ]; then   # poisoned history: do not resume it
+    _resume_now="${AR_FRESH_FLAGS}"
+    # `agentradar join` writes AR_FRESH_FLAGS as the same `--resume <id>` as AR_RESUME_FLAGS, so a pinned session
+    # (either flag names an id) is healed onto a NEW id, generated now; later restarts resume that one, never the poisoned id.
+    case "${AR_AGENT_HARNESS}:${AR_RESUME_FLAGS} ${AR_FRESH_FLAGS}" in
+      claude:*--resume\ *|claude:*--session-id\ *)
+        _new_sid="$(node -e 'process.stdout.write(require("crypto").randomUUID())')" || die "could not generate a fresh session id"
+        _resume_now="--session-id ${_new_sid}"; AR_RESUME_FLAGS="--resume ${_new_sid}"; AR_FRESH_FLAGS="--session-id ${_new_sid}" ;;
+    esac
+    _FORCE_FRESH=0
+  fi
   ensure_browser   # #150: bring up the browser first for --chrome agents (idempotent, no-op otherwise)
   if [ -n "${PRE_LAUNCH_HOOK}" ] && [ -x "${PRE_LAUNCH_HOOK}" ]; then
     log "running pre-launch hook: ${PRE_LAUNCH_HOOK}"
@@ -348,6 +365,8 @@ ensure_agent() {
   # #166: pass the tool creds as a FILE PATH (AR_TOOL_ENV_FILE), never inline KEY=VALUE on env -i.
   _tool_env=()
   [ -n "${_TOOL_ENV_FILE}" ] && _tool_env=( AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" )
+  # Bible #40 mode 3: role secrets pulled into ${AR_BASE}/.agentradar/secrets.enc are decrypted by
+  # `agentradar secrets env` inside the wrapper and exported in memory, never written in plaintext.
   # #1: do NOT inherit TERM. Under launchd the supervisor's TERM is `dumb` (or absent), and `dumb` is
   # neither unset nor empty, so the old `${TERM:-xterm-256color}` default never fired and the agent's
   # claude ran with TERM=dumb. chalk/ink then disable colour ENTIRELY, so the TUI emitted zero SGR —
@@ -382,7 +401,7 @@ ensure_agent() {
       CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${_resume_now}" AR_FRESH_FLAGS="${AR_FRESH_FLAGS}" \
       DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
       ${_claude_cfg[@]+"${_claude_cfg[@]}"} ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; if [ -n "${AR_CLI_RUNNER_ID:-}" ] && [ -n "${AR_AGENTRADAR_BIN:-}" ] && [ -f .agentradar/secrets.enc ]; then _e=$("$AR_AGENTRADAR_BIN" secrets env "$AR_CLI_RUNNER_ID") && eval "$_e"; unset _e; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -465,7 +484,20 @@ start_bridge
 # launchd/systemd remains the parent-level/reboot safety net. The feeder self-pauses while the owned pane
 # next_event heartbeat cannot paint the runner Live during recovery. Restart the bridge after a new pane is
 # created because tmux pipe-pane was bound to the dead pane.
+# Bible #40: a pulled role-secret lease lives 24 h; renew it every 12 h while the agent still holds the role.
+SECRETS_RENEW_SEC="${SECRETS_RENEW_SEC:-43200}"
+SECRETS_RETRY_SEC="${SECRETS_RETRY_SEC:-600}"
+_secrets_renewed_at=0
 while true; do
+  if [ -n "${AR_CLI_RUNNER_ID:-}" ] && [ -n "${AR_AGENTRADAR_BIN:-}" ] && [ -f "${AR_BASE}/.agentradar/secrets.enc" ] \
+    && [ $(( $(date +%s) - _secrets_renewed_at )) -ge "${SECRETS_RENEW_SEC}" ]; then
+    if (cd "${AR_BASE}" && "${AR_AGENTRADAR_BIN}" secrets renew "${AR_CLI_RUNNER_ID}") >/dev/null 2>&1; then
+      _secrets_renewed_at=$(date +%s)
+    else
+      log "WARN role-secret lease renewal refused or failed; retrying in ${SECRETS_RETRY_SEC}s"
+      _secrets_renewed_at=$(( $(date +%s) - SECRETS_RENEW_SEC + SECRETS_RETRY_SEC ))
+    fi
+  fi
   if [ -n "${FEEDER_PID}" ] && ! kill -0 "${FEEDER_PID}" 2>/dev/null; then
     log "feeder exited — exiting so the service manager restarts the whole unit"
     exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "engines": {
     "node": ">=20"
   },
@@ -21,6 +21,7 @@
     "dist/update.js",
     "dist/commands.js",
     "dist/vault-clone.js",
+    "dist/secrets.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",
     "dist/agent-guard",