agentradar-cli 0.3.3 → 0.3.5

package/dist/secrets.js

@@ -17,7 +17,8 @@ import { join } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 export const SECRETS_FILE = join(".agentradar", "secrets.enc");
 export const SECRETS_USAGE = "Usage: agentradar secrets pull|renew|env <runner-id> | agentradar secrets exec <runner-id> -- <command> [args...]"
-    + " | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--replace --approval-details '<json>'] [--token <token>]";
+    + " | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--replace --approval-details '<json>'] [--token <token>]"
+    + " | agentradar secrets rotate <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--token <token>]";
 /** The names the supervisor reserves for itself (supervise-agent.sh); a role secret never overrides one. */
 const RESERVED = /^(HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_[A-Z]+|TMPDIR|NODE_OPTIONS|CLAUDE_[A-Z_]+|CODEX_HOME|AR_[A-Z_]+|ANTHROPIC_API_KEY|AWP_[A-Z_]+|TMUX_SESSION|AGENT_PID_PATTERN|DISABLE_AUTOUPDATER)$/;
 /** The runner's own origin and key: its env file, else a hosted agent's run env (as tool-run.ts awpRequest). */
@@ -161,8 +162,9 @@ async function promptHidden(name) {
 /**
  * Vadym 11074: `agentradar secrets upload`. Values come from this machine (a .env file, the environment, a hidden prompt)
  * and never from the command line. Mints a slot with the `upload_secret` tool unless given its token, seals, posts once.
+ * SECRETS-PERMS (Vadym 11295): `agentradar secrets rotate` is the same with `rotate_secret`, for existing company secrets.
  */
-export async function secretsUpload(runnerId, flags, deps = {}) {
+export async function secretsUpload(runnerId, flags, deps = {}, tool = "upload_secret") {
     const opts = new Map();
     for (let i = 0; i < flags.length; i++) {
         const flag = flags[i];
@@ -200,8 +202,8 @@ export async function secretsUpload(runnerId, flags, deps = {}) {
     let token = opts.get("token");
     if (!token) {
         const approvalDetails = opts.has("approval-details") ? JSON.parse(opts.get("approval-details")) : undefined;
-        const said = await awpRequest(runnerId, "tools/call", { name: "upload_secret",
-            arguments: { names: Object.keys(values), replace: opts.has("replace") || undefined, approvalDetails } }, deps);
+        const said = await awpRequest(runnerId, "tools/call", { name: tool, arguments: tool === "rotate_secret" ? { names: Object.keys(values) }
+                : { names: Object.keys(values), replace: opts.has("replace") || undefined, approvalDetails } }, deps);
         const minted = JSON.parse(said?.result?.content?.[0]?.text ?? "{}");
         if (!minted.ok || !minted.token)
             throw new Error(minted.error ?? "AgentRadar did not open an upload.");
@@ -237,6 +239,8 @@ export async function secretsOverCli(args, deps = {}) {
             return await secretsExec(runnerId, command, deps);
         if (verb === "upload" && runnerId)
             return await secretsUpload(runnerId, args.slice(2), deps);
+        if (verb === "rotate" && runnerId)
+            return await secretsUpload(runnerId, args.slice(2), deps, "rotate_secret");
     }
     catch (error) {
         (deps.logError ?? console.error)(error instanceof Error ? error.message : String(error));

package/dist/vendor-runner/supervisor/install-agent.sh

@@ -89,6 +89,6 @@ else
       echo "LOADED: agentradar-agent@${AGENT_NAME} (could not enable linger; run 'loginctl enable-linger ${USER:-$(id -un)}' for boot-survival)"
     fi
   else
-    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER})"
+    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER:-$(id -un)})"
   fi
 fi

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -138,6 +138,13 @@ else
   # `agentradar join` pins `--resume <id>` / `--session-id <id>` so the service never resumes the vendor's
   # own conversation in the same folder; an env file that sets nothing keeps `--continue`.
   AR_RESUME_FLAGS="${AR_RESUME_FLAGS:---continue}"
+  # A heal (below) wrote its new session id next to the env file; a restart honors it, so it never resumes the poisoned id.
+  # Only while newer than the env file: a re-join rewrites the env file and its pin wins again.
+  _SID_FILE="${ENV_FILE}.session-id"
+  if [ -f "${_SID_FILE}" ] && [ "${_SID_FILE}" -nt "${ENV_FILE}" ] && IFS= read -r _saved_sid < "${_SID_FILE}" \
+     && [[ "${_saved_sid}" =~ ^[0-9a-fA-F-]{36}$ ]]; then
+    AR_RESUME_FLAGS="--resume ${_saved_sid}"; AR_FRESH_FLAGS="--session-id ${_saved_sid}"
+  fi
   : "${MCP_CONFIG:?MCP_CONFIG required (path to awp-only.json)}"
   # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
   # shellcheck disable=SC2086
@@ -332,7 +339,8 @@ ensure_agent() {
     case "${AR_AGENT_HARNESS}:${AR_RESUME_FLAGS} ${AR_FRESH_FLAGS}" in
       claude:*--resume\ *|claude:*--session-id\ *)
         _new_sid="$(node -e 'process.stdout.write(require("crypto").randomUUID())')" || die "could not generate a fresh session id"
-        _resume_now="--session-id ${_new_sid}"; AR_RESUME_FLAGS="--resume ${_new_sid}"; AR_FRESH_FLAGS="--session-id ${_new_sid}" ;;
+        _resume_now="--session-id ${_new_sid}"; AR_RESUME_FLAGS="--resume ${_new_sid}"; AR_FRESH_FLAGS="--session-id ${_new_sid}"
+        printf '%s\n' "${_new_sid}" > "${_SID_FILE}.tmp" && mv "${_SID_FILE}.tmp" "${_SID_FILE}" || log "WARN could not save the new session id to ${_SID_FILE}" ;;
     esac
     _FORCE_FRESH=0
   fi
@@ -392,6 +400,14 @@ ensure_agent() {
   # would run as a separate, UNISOLATED command in the supervisor's own shell. `bash -n` passes on
   # that — it is semantic, not syntactic — and a colour gate cannot see it either, because a pane that
   # never starts has nothing to colour. Caught by disc counting the args tmux actually received.
+  #
+  # The tmux CLIENT runs under `env -i` too. When this new-session starts the user's tmux server (first
+  # tmux after a reboot), the client's environment becomes the server's GLOBAL environment, inherited by
+  # every session anyone creates on that server later. Unscrubbed, the daemon's CLAUDE_CONFIG_DIR /
+  # CLAUDE_SETTINGS / plugin cache leaked into an unrelated always-on Claude session on the same Mac
+  # (2026-10-07): it read this agent's config dir, lost its trust state and transcript, and crash-looped.
+  env -i HOME="${HOME}" PATH="${PATH}" USER="${USER:-}" LANG="${LANG:-en_US.UTF-8}" \
+    LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" TMUX_TMPDIR="${TMUX_TMPDIR:-}" \
   "${TMUX_BIN}" new-session -d -s "${TMUX_SESSION}" -c "${AR_BASE}" \
     env -i \
       HOME="${HOME}" PATH="${PATH}" USER="${USER:-}" LOGNAME="${LOGNAME:-}" SHELL="${SHELL:-/bin/sh}" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "engines": {
     "node": ">=20"
   },