agentradar-cli 0.3.17 → 0.3.20

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -77,7 +77,7 @@ BROWSER_READY_MAX_SEC="${BROWSER_READY_MAX_SEC:-20}" # #150: bounded wait for th
 BROWSER_READY_SETTLE_SEC="${BROWSER_READY_SETTLE_SEC:-3}" # #150: settle for extension/native-host after cold launch
 HEALTH_POLL_SEC="${HEALTH_POLL_SEC:-15}"
 AR_API400_LOOP_MAX="${AR_API400_LOOP_MAX:-3}"          # same `API Error: 400`/413 line this many times in the pane = poisoned session
-AR_API400_COOLDOWN_SEC="${AR_API400_COOLDOWN_SEC:-300}" # at most one fresh-session heal per this window
+AR_API400_COOLDOWN_SEC="${AR_API400_COOLDOWN_SEC:-300}" # at most one refused-turn heal (/compact) per this window
 
 # --- 2a. R004 HARNESS SELECTION — one documented variable picks the CLI ---------
 # The Bible names two agent harnesses: Claude Code and Codex. `claude` is the default, so every existing
@@ -144,7 +144,7 @@ else
   # `agentradar join` pins `--resume <id>` / `--session-id <id>` so the service never resumes the vendor's
   # own conversation in the same folder; an env file that sets nothing keeps `--continue`.
   AR_RESUME_FLAGS="${AR_RESUME_FLAGS:---continue}"
-  # A heal (below) wrote its new session id next to the env file; a restart honors it, so it never resumes the poisoned id.
+  # A fresh-session heal of an older build wrote its new session id next to the env file; a restart honors it, so it never resumes the poisoned id.
   # Only while newer than the env file: a re-join rewrites the env file and its pin wins again.
   _SID_FILE="${ENV_FILE}.session-id"
   if [ -f "${_SID_FILE}" ] && [ "${_SID_FILE}" -nt "${ENV_FILE}" ] && IFS= read -r _saved_sid < "${_SID_FILE}" \
@@ -211,7 +211,7 @@ if [ -n "${AGENT_TOOL_ENV_FILE}" ]; then
     # identity). Reject at parse time (visible warning) AND — belt-and-suspenders — the launch lists
     # the reserved allowlist AFTER TOOL_ENV_ARGS so `env` last-wins keeps reserved vars authoritative.
     case "${_tline%%=*}" in
-      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
+      HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN)
         log "WARN ignoring reserved key '${_tline%%=*}' in ${AGENT_TOOL_ENV_FILE} (cannot override supervisor/agent env)"; continue ;;
     esac
     TOOL_ENV_ARGS+=("${_tline}")
@@ -347,12 +347,73 @@ ensure_browser() {
 # A session grown past the gateway's request cap gets 413 on every turn and on every auto compaction, so it can
 # never shrink (COMPACTION-LOOP-GUARD, Levels 11-03: 6 MB hosted OCX cap); Claude Code 2.1.295 prints that turn as
 # `Request too large (max 32MB). ...` (no `API Error: 413`, and a failed compaction prints nothing).
+# A context filled with images refuses every turn with `⎿  Context limit reached · /compact or /clear to continue`, and
+# /compact with `⎿  Compaction failed · attached media exceeds size limits` (HOSTED-MEDIA-COMPACT-LOOP, Cupcake 10-31..11-02:
+# 126 refused turns; hosted keeps auto compaction on, so the first line means it already failed). Both are matched as whole
+# CLI lines ([^ ]+ for the glyphs, which a non-UTF-8 tmux may print as _), never inside tool output; one media line is enough.
 # True when one identical such line (digits normalised: the message index moves; trailing padding cut) fills the
 # pane scrollback AR_API400_LOOP_MAX times. ponytail: only the last 200 lines are read, so a very slow loop could slip by.
 api_error_loop() {
+  # Only lines after the last `⎿  Compacted` count: a loop that /compact already healed stays on screen (compact_in_place).
   "${TMUX_BIN}" capture-pane -p -J -t "=${TMUX_SESSION}:" -S -200 2>/dev/null \
-    | grep -oE 'API Error: 4(00|13) .*|Request too large .*' | sed -E 's/[0-9]+/N/g; s/[[:space:]]+$//' | sort | uniq -c | sort -rn \
-    | awk -v m="${AR_API400_LOOP_MAX}" 'NR==1{ok=($1>=m)} END{exit !ok}'
+    | awk '/^ *[^ ]+ +Compacted( |$)/{b=""; next} {b=b $0 "\n"} END{printf "%s", b}' \
+    | grep -oE 'API Error: 4(00|13) .*|Request too large .*|^ *[^ ]+ +(Context limit reached [^ ]+ /compact or /clear to continue|Compaction failed [^ ]+ attached media exceeds size limits) *$' \
+    | sed -E 's/[0-9]+/N/g; s/[[:space:]]+$//' | sort | uniq -c | sort -rn \
+    | awk -v m="${AR_API400_LOOP_MAX}" '$1>=m || /attached media/{ok=1} END{exit !ok}'
+}
+
+# CONTEXT-RESET-IN-PLACE (Vadym 19475 + the lead 19:5x: "NEVER start a fresh session"): a refused-turn loop is healed by
+# typing /compact into the same session with the hosted pre-stop sender, retried once. When that cannot heal it, it sets
+# _park_reason and returns 1 (park_agent): harness (codex or generic: the sender reads only Claude's transcript), media (the
+# media line: Claude's own /compact already failed on the images), reloop (the loop is back within 30 min of a compaction),
+# compact_failed (no compact_boundary twice: busy or stuck pane, compaction error or timeout, at most ~5 min each).
+compact_in_place() {
+  local run="${HOME}/.agentradar/run" try
+  _park_reason=""
+  [ "${AR_AGENT_HARNESS}" = "claude" ] || { _park_reason=harness; return 1; }
+  [ $(( $(date +%s) - ${_LAST_COMPACT_HEAL:-0} )) -ge 1800 ] || { _park_reason=reloop; return 1; }
+  "${TMUX_BIN}" capture-pane -p -J -t "=${TMUX_SESSION}:" -S -200 2>/dev/null \
+    | grep -qE '^ *[^ ]+ +Compaction failed [^ ]+ attached media exceeds size limits *$' && { _park_reason=media; return 1; }
+  for try in 1 2; do
+    # uid -1: talk to the supervisor's own tmux server (the sender's uid 1000 switch is for a root bridge). minTokens 0: a
+    # small poisoned history is compacted too, it is the only way to keep the session.
+    AR_COMPACT_JS="$(cd "$(dirname "$0")/.." && pwd)/pre-stop-compact.mjs" TMUX_BIN="${TMUX_BIN}" TMUX_SESSION="${TMUX_SESSION}" \
+      node --input-type=module -e '
+        import { spawn, spawnSync } from "node:child_process"; import { join } from "node:path";
+        const { compactBeforeStop, paneTail, tmux, sessionProjectsDir } = await import(process.env.AR_COMPACT_JS);
+        const bin = process.env.TMUX_BIN, session = `=${process.env.TMUX_SESSION}:`;
+        const dir = process.env.CLAUDE_CONFIG_DIR ? join(process.env.CLAUDE_CONFIG_DIR, "projects") : sessionProjectsDir();
+        const r = await compactBeforeStop({ dir, session, workloadBusy: () => false, report: () => {}, minTokens: 0,
+          run: (argv) => tmux(argv, { uid: -1, spawnFn: (_c, a, o) => spawn(bin, a, o) }),
+          capture: () => paneTail(session, { uid: -1, run: (_c, a, o) => spawnSync(bin, a, o) }) });
+        process.exit(r.compacted ? 0 : 1);' && break
+    [ "${try}" = 2 ] && { _park_reason=compact_failed; return 1; }
+    log "/compact did not heal it — typing it once more"
+  done
+  _LAST_COMPACT_HEAL=$(date +%s)
+  mkdir -p "${run}" && printf '{"reason":"context_compacted","at":"%s"}' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "${run}/restart-notice.json" \
+    || log "WARN could not leave the compaction handoff in ${run}"
+}
+
+# A loop compact_in_place could not heal parks the agent; it is never replaced by a fresh session. Its session id and
+# transcript stay; only its process stops (kill-session), so the refused turn is not sent again and nothing is typed into
+# it: the feeder stops polling a pane that is not live and new events wait on the server. No heal runs while _PARKED is set,
+# so the next start (an operator restart of the unit) resumes the same conversation. A hosted runner reports the park
+# (report_compaction context_parked): the instance admins are emailed, never the owner (19089). A vendor box has no
+# hosted session env, so there only this log says it.
+park_agent() {
+  log "PARKED (${_park_reason}): the refused-turn loop did not heal in place. No fresh session: stopping the agent's process; its conversation is kept. Screen:"
+  "${TMUX_BIN}" capture-pane -p -t "=${TMUX_SESSION}:" 2>/dev/null | tail -20
+  _PARKED=1
+  "${TMUX_BIN}" kill-session -t "=${TMUX_SESSION}" 2>/dev/null || true
+  if AR_COMPACT_JS="$(cd "$(dirname "$0")/.." && pwd)/pre-stop-compact.mjs" REASON="${_park_reason}" node --input-type=module -e '
+      const { reportToServer } = await import(process.env.AR_COMPACT_JS);
+      const dir = process.env.AR_SESSION_DIR;
+      process.exit(reportToServer({ phase: "context_parked", reason: process.env.REASON }, dir ? { dir } : {}) ? 0 : 1);'; then
+    log "parked: the operators were alerted"
+  else
+    log "WARN parked, but the operators could not be alerted (no hosted session env here, or the report failed)"
+  fi
 }
 
 # --- 3. Ensure the agent's tmux+claude session (idempotent) -------------------
@@ -380,18 +441,6 @@ ensure_agent() {
     die "not starting Codex: ${_guard_out:-the AgentRadar guard check gave no answer}"
   fi
   _resume_now="${AR_RESUME_FLAGS}"
-  if [ "${_FORCE_FRESH:-0}" = 1 ]; then   # poisoned history: do not resume it
-    _resume_now="${AR_FRESH_FLAGS}"
-    # `agentradar join` writes AR_FRESH_FLAGS as the same `--resume <id>` as AR_RESUME_FLAGS, so a pinned session
-    # (either flag names an id) is healed onto a NEW id, generated now; later restarts resume that one, never the poisoned id.
-    case "${AR_AGENT_HARNESS}:${AR_RESUME_FLAGS} ${AR_FRESH_FLAGS}" in
-      claude:*--resume\ *|claude:*--session-id\ *)
-        _new_sid="$(node -e 'process.stdout.write(require("crypto").randomUUID())')" || die "could not generate a fresh session id"
-        _resume_now="--session-id ${_new_sid}"; AR_RESUME_FLAGS="--resume ${_new_sid}"; AR_FRESH_FLAGS="--session-id ${_new_sid}"
-        printf '%s\n' "${_new_sid}" > "${_SID_FILE}.tmp" && mv "${_SID_FILE}.tmp" "${_SID_FILE}" || log "WARN could not save the new session id to ${_SID_FILE}" ;;
-    esac
-    _FORCE_FRESH=0
-  fi
   ensure_browser   # #150: bring up the browser first for --chrome agents (idempotent, no-op otherwise)
   if [ -n "${PRE_LAUNCH_HOOK}" ] && [ -x "${PRE_LAUNCH_HOOK}" ]; then
     log "running pre-launch hook: ${PRE_LAUNCH_HOOK}"
@@ -407,7 +456,8 @@ ensure_agent() {
   # The agent's own tool creds (from AGENT_TOOL_ENV_FILE) are NOT inlined here anymore (#166): they were staged to a 0600 file in 2b and are passed only as the PATH
   # AR_TOOL_ENV_FILE, which the wrapper reads+exports before exec — so no tool VALUE appears on the env -i
   # argv / tmux pane_start_command. Reserved keys were already rejected at tool-file parse time (2b).
-  log "starting agent (${AR_AGENT_HARNESS}) in tmux '${TMUX_SESSION}' (tool-env file: ${_TOOL_ENV_FILE:-none})"
+  # TEAMMATE-HANG-CULPRIT-1105A: tmux comes from apt unpinned in the hosted image, so its version goes in the log.
+  log "starting agent (${AR_AGENT_HARNESS}) in tmux '${TMUX_SESSION}' ($("${TMUX_BIN}" -V 2>/dev/null || echo "tmux version unknown")) (tool-env file: ${_TOOL_ENV_FILE:-none})"
   # _tool_env uses the ${arr[@]+"${arr[@]}"} form so an EMPTY array is safe under `set -u` (bash 3.2).
   # First-launch handling (#153/H4 durable-feeder): `claude --continue` EXITS 1 when the cwd has NO prior
   # conversation (for example, a fresh engagement folder) → the pane dies → the supervisor
@@ -446,6 +496,8 @@ ensure_agent() {
   # visible once there is colour to look at. LC_ALL stays empty on purpose: an empty LC_ALL does not
   # override, so LC_CTYPE governs and a vendor can still set LANG per agent.
   #
+  # CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false (LEAK-1-CACHE-REBUILD-19165): Claude Code's next-prompt suggestion is a
+  # background model call after a turn (~30 output tokens, seconds after it); session-host/loop.sh already turns it off; reserved so a tool env file cannot switch it back on (SUGGEST-ENV-RESERVED-4908).
   # Channels: CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 keeps the tengu_harbor flag readable from the
   # disk cache even if telemetry is off, and it and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC are reserved so a
   # tool file cannot turn channels off. See docs/claude-code-channels-gates.md.
@@ -471,9 +523,9 @@ ensure_agent() {
       LANG="${LANG:-en_US.UTF-8}" LC_ALL="${LC_ALL:-}" LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" \
       TMPDIR="${TMPDIR:-/tmp}" NODE_OPTIONS="${NODE_OPTIONS:-}" \
       CODEX_HOME="${CODEX_HOME:-}" AR_RESUME_FLAGS="${_resume_now}" AR_FRESH_FLAGS="${AR_FRESH_FLAGS}" \
-      DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 \
+      DISABLE_AUTOUPDATER=1 CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF=1 CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false \
       ${_claude_cfg[@]+"${_claude_cfg[@]}"} ${_tool_env[@]+"${_tool_env[@]}"} \
-      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; if [ -n "${AR_CLI_RUNNER_ID:-}" ] && [ -n "${AR_AGENTRADAR_BIN:-}" ] && [ -f .agentradar/secrets.enc ]; then _e=$("$AR_AGENTRADAR_BIN" secrets env "$AR_CLI_RUNNER_ID") && eval "$_e"; unset _e; fi; if [ -n "${AR_CLI_RUNNER_ID:-}" ] && [ -n "${AR_AGENTRADAR_BIN:-}" ]; then _g="$HOME/.agentradar/run/github/$AR_CLI_RUNNER_ID"; _n=${GIT_CONFIG_COUNT:-0}; case "$_n" in ""|*[!0-9]*) _n=0 ;; esac; _n=${_n#"${_n%%[!0]*}"}; _n=${_n:-0}; export PATH="$_g/bin:$PATH" "GIT_CONFIG_KEY_$_n=include.path" "GIT_CONFIG_VALUE_$_n=$_g/gitconfig" GIT_CONFIG_COUNT=$((_n + 1)); "$AR_AGENTRADAR_BIN" github setup "$AR_CLI_RUNNER_ID" >/dev/null 2>&1 & unset _g _n; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
+      /bin/sh -c 'if [ -n "${AR_TOOL_ENV_FILE:-}" ]; then while IFS= read -r _l || [ -n "$_l" ]; do case "$_l" in ""|\#*) continue ;; esac; _k=${_l%%=*}; _v=${_l#*=}; case "$_k" in HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_ALL|LC_CTYPE|TMPDIR|NODE_OPTIONS|CLAUDE_CONFIG_DIR|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC|CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF|CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION|CODEX_HOME|AR_CLI_RUNNER_ID|AR_AGENTRADAR_BIN|AR_DISCIPLINE_EVERY|CLAUDE_CODE_PLUGIN_CACHE_DIR|AR_GUARD_MARKER|AR_RESUME_FLAGS|AR_FRESH_FLAGS|AR_OAUTH_TOKEN_FILE|AR_TOOL_ENV_FILE|ANTHROPIC_API_KEY|AWP_BEARER|AWP_BEARER_FILE|AWP_MCP_URL|TMUX_SESSION|AGENT_PID_PATTERN) continue ;; esac; export "$_k=$_v"; done < "$AR_TOOL_ENV_FILE"; unset AR_TOOL_ENV_FILE _l _k _v; fi; if [ -n "${AR_CLI_RUNNER_ID:-}" ] && [ -n "${AR_AGENTRADAR_BIN:-}" ] && [ -f .agentradar/secrets.enc ]; then _e=$("$AR_AGENTRADAR_BIN" secrets env "$AR_CLI_RUNNER_ID") && eval "$_e"; unset _e; fi; if [ -n "${AR_CLI_RUNNER_ID:-}" ] && [ -n "${AR_AGENTRADAR_BIN:-}" ]; then _g="$HOME/.agentradar/run/github/$AR_CLI_RUNNER_ID"; _n=${GIT_CONFIG_COUNT:-0}; case "$_n" in ""|*[!0-9]*) _n=0 ;; esac; _n=${_n#"${_n%%[!0]*}"}; _n=${_n:-0}; export PATH="$_g/bin:$PATH" "GIT_CONFIG_KEY_$_n=include.path" "GIT_CONFIG_VALUE_$_n=$_g/gitconfig" GIT_CONFIG_COUNT=$((_n + 1)); "$AR_AGENTRADAR_BIN" github setup "$AR_CLI_RUNNER_ID" >/dev/null 2>&1 & unset _g _n; fi; RF="${AR_RESUME_FLAGS:-}"; FF="${AR_FRESH_FLAGS:-}"; unset AR_RESUME_FLAGS AR_FRESH_FLAGS; CB="$1"; shift; S=$(date +%s); "$CB" $RF "$@" || [ $(( $(date +%s) - S )) -ge 30 ] || exec "$CB" $FF "$@"' sh "${AGENT_BIN}" "${_launch_flags[@]}" || {
         log "tmux could not start agent session '${TMUX_SESSION}'"
         return 1
       }
@@ -543,14 +595,14 @@ if [ "${AR_FEED}" = "feeder" ]; then
   # AR_TOOL_ENV_FILE: the login probe must see the same gateway env the pane runs with.
   AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" \
     AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_AGENT_HARNESS="${AR_AGENT_HARNESS}" AGENT_BIN="${AGENT_BIN}" \
-    AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" AR_GUARD_MARKER="${AR_GUARD_MARKER}" \
+    AR_TOOL_ENV_FILE="${_TOOL_ENV_FILE}" AR_GUARD_MARKER="${AR_GUARD_MARKER}" AR_REARM_PROMPT="${AR_REARM_PROMPT:-}" \
     node "${FEEDER_JS}" &
   FEEDER_PID=$!
   log "feeder pid ${FEEDER_PID}"
 else
   log "no feeder (AR_FEED=${AR_FEED}): the session receives its own work; the feeder only reports the pane"
   # Best-effort like the bridge: its exit never restarts the unit. Same 0600 bearer FILE, never the raw bearer.
-  AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" AR_FEED=push \
+  AWP_MCP_URL="${AWP_MCP_URL}" AWP_BEARER_FILE="${AWP_BEARER_FILE}" TMUX_SESSION="${TMUX_SESSION}" AR_FEED=push AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" AR_REARM_PROMPT="${AR_REARM_PROMPT:-}" \
     node "${FEEDER_JS}" &
   PANE_REPORT_PID=$!
 fi
@@ -598,13 +650,19 @@ while true; do
     exit 1
   fi
   _heal=0
-  if ! pane_alive; then
+  if [ "${_PARKED:-0}" = 1 ]; then
+    :   # parked (park_agent): no heal and no fresh session until an operator restarts the unit
+  elif ! pane_alive; then
     log "agent pane died — recovering it in place"
     _heal=1
   elif [ "${AR_ATTACH:-}" != "1" ] && [ $(( $(date +%s) - ${_LAST_HEAL:-0} )) -ge "${AR_API400_COOLDOWN_SEC}" ] && api_error_loop; then
-    log "agent pane is looping on the same API 400 — replacing it with a FRESH session"
-    _LAST_HEAL=$(date +%s); _FORCE_FRESH=1; _heal=1
-    "${TMUX_BIN}" kill-session -t "=${TMUX_SESSION}" 2>/dev/null || true
+    log "agent pane is looping on the same refused turn (API 400/413 or a full context) — typing /compact into it first"
+    if compact_in_place; then
+      log "compacted in place: the agent keeps its conversation"
+      _LAST_HEAL=$(date +%s)
+    else
+      park_agent
+    fi
   fi
   if [ "${_heal}" = 1 ]; then
     if ensure_agent; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.17",
+  "version": "0.3.20",
   "engines": {
     "node": ">=20"
   },
@@ -30,19 +30,19 @@
     "README.md"
   ],
   "license": "MIT",
+  "reservedEnv": "^(HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_[A-Z]+|TMPDIR|NODE_(OPTIONS|PATH|EXTRA_CA_CERTS|TLS_REJECT_UNAUTHORIZED)|CLAUDE_[A-Z_]+|CODEX_[A-Z_]+|AR_[A-Z_]+|ANTHROPIC_[A-Z_]+|OPENAI_BASE_URL|AWP_[A-Z_]+|PAPERCLIP_[A-Z_]+|AGENTRADAR_[A-Z_]+|TMUX_SESSION|AGENT_PID_PATTERN|DISABLE_AUTOUPDATER|[A-Z0-9]+_PROXY|SSL_CERT_(FILE|DIR)|(REQUESTS|CURL)_CA_BUNDLE|GIT_[A-Z0-9_]+|SSH_(ASKPASS|ASKPASS_REQUIRE|AUTH_SOCK|SK_PROVIDER)|PYTHON[A-Z_]*|PERL5(OPT|LIB|DB)|PERLLIB|RUBY(OPT|LIB)|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|JDK_JAVA_OPTIONS|NPM_CONFIG_[A-Z0-9_]+|PIP_[A-Z0-9_]+|UV_(?![A-Z0-9_]*_(USERNAME|PASSWORD|TOKEN)$)[A-Z0-9_]+|YARN_(?![A-Z0-9_]*_AUTH_(TOKEN|IDENT)$)[A-Z0-9_]+|BUN_CONFIG_(?!TOKEN$)[A-Z0-9_]+|GO(PROXY|SUMDB|NOSUMDB|NOSUMCHECK|PRIVATE|NOPROXY|INSECURE|FLAGS|TOOLCHAIN|ENV|ROOT|TOOLDIR)|CARGO_(?![A-Z0-9_]*TOKEN$)[A-Z0-9_]+|RUSTC(_WRAPPER|_WORKSPACE_WRAPPER)?|RUST(DOC)?FLAGS|RUSTDOC|CC|CXX|RUSTUP_[A-Z0-9_]+|EDITOR|VISUAL|PAGER|PROMPT_COMMAND|ZDOTDIR|(LD|DYLD)_[A-Z_]+|BASH_ENV|ENV)$",
   "publishConfig": {
     "access": "public"
   },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.8"
+  },
   "scripts": {
     "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/skill-zip.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/*.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
     "clean": "rm -rf dist",
-    "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
-  },
-  "devDependencies": {
-    "@types/node": "^22.20.5",
-    "typescript": "^5.7.3",
-    "vitest": "^4.1.8"
   }
-}
+}