agentradar-cli 0.3.4 → 0.3.5

package/dist/secrets.js

@@ -17,7 +17,8 @@ import { join } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 export const SECRETS_FILE = join(".agentradar", "secrets.enc");
 export const SECRETS_USAGE = "Usage: agentradar secrets pull|renew|env <runner-id> | agentradar secrets exec <runner-id> -- <command> [args...]"
-    + " | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--replace --approval-details '<json>'] [--token <token>]";
+    + " | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--replace --approval-details '<json>'] [--token <token>]"
+    + " | agentradar secrets rotate <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--only <NAME,...>] [--token <token>]";
 /** The names the supervisor reserves for itself (supervise-agent.sh); a role secret never overrides one. */
 const RESERVED = /^(HOME|PATH|USER|LOGNAME|SHELL|TERM|COLORTERM|LANG|LC_[A-Z]+|TMPDIR|NODE_OPTIONS|CLAUDE_[A-Z_]+|CODEX_HOME|AR_[A-Z_]+|ANTHROPIC_API_KEY|AWP_[A-Z_]+|TMUX_SESSION|AGENT_PID_PATTERN|DISABLE_AUTOUPDATER)$/;
 /** The runner's own origin and key: its env file, else a hosted agent's run env (as tool-run.ts awpRequest). */
@@ -161,8 +162,9 @@ async function promptHidden(name) {
 /**
  * Vadym 11074: `agentradar secrets upload`. Values come from this machine (a .env file, the environment, a hidden prompt)
  * and never from the command line. Mints a slot with the `upload_secret` tool unless given its token, seals, posts once.
+ * SECRETS-PERMS (Vadym 11295): `agentradar secrets rotate` is the same with `rotate_secret`, for existing company secrets.
  */
-export async function secretsUpload(runnerId, flags, deps = {}) {
+export async function secretsUpload(runnerId, flags, deps = {}, tool = "upload_secret") {
     const opts = new Map();
     for (let i = 0; i < flags.length; i++) {
         const flag = flags[i];
@@ -200,8 +202,8 @@ export async function secretsUpload(runnerId, flags, deps = {}) {
     let token = opts.get("token");
     if (!token) {
         const approvalDetails = opts.has("approval-details") ? JSON.parse(opts.get("approval-details")) : undefined;
-        const said = await awpRequest(runnerId, "tools/call", { name: "upload_secret",
-            arguments: { names: Object.keys(values), replace: opts.has("replace") || undefined, approvalDetails } }, deps);
+        const said = await awpRequest(runnerId, "tools/call", { name: tool, arguments: tool === "rotate_secret" ? { names: Object.keys(values) }
+                : { names: Object.keys(values), replace: opts.has("replace") || undefined, approvalDetails } }, deps);
         const minted = JSON.parse(said?.result?.content?.[0]?.text ?? "{}");
         if (!minted.ok || !minted.token)
             throw new Error(minted.error ?? "AgentRadar did not open an upload.");
@@ -237,6 +239,8 @@ export async function secretsOverCli(args, deps = {}) {
             return await secretsExec(runnerId, command, deps);
         if (verb === "upload" && runnerId)
             return await secretsUpload(runnerId, args.slice(2), deps);
+        if (verb === "rotate" && runnerId)
+            return await secretsUpload(runnerId, args.slice(2), deps, "rotate_secret");
     }
     catch (error) {
         (deps.logError ?? console.error)(error instanceof Error ? error.message : String(error));

package/dist/vendor-runner/supervisor/install-agent.sh

@@ -89,6 +89,6 @@ else
       echo "LOADED: agentradar-agent@${AGENT_NAME} (could not enable linger; run 'loginctl enable-linger ${USER:-$(id -un)}' for boot-survival)"
     fi
   else
-    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER})"
+    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER:-$(id -un)})"
   fi
 fi

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -400,6 +400,14 @@ ensure_agent() {
   # would run as a separate, UNISOLATED command in the supervisor's own shell. `bash -n` passes on
   # that — it is semantic, not syntactic — and a colour gate cannot see it either, because a pane that
   # never starts has nothing to colour. Caught by disc counting the args tmux actually received.
+  #
+  # The tmux CLIENT runs under `env -i` too. When this new-session starts the user's tmux server (first
+  # tmux after a reboot), the client's environment becomes the server's GLOBAL environment, inherited by
+  # every session anyone creates on that server later. Unscrubbed, the daemon's CLAUDE_CONFIG_DIR /
+  # CLAUDE_SETTINGS / plugin cache leaked into an unrelated always-on Claude session on the same Mac
+  # (2026-10-07): it read this agent's config dir, lost its trust state and transcript, and crash-looped.
+  env -i HOME="${HOME}" PATH="${PATH}" USER="${USER:-}" LANG="${LANG:-en_US.UTF-8}" \
+    LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" TMUX_TMPDIR="${TMUX_TMPDIR:-}" \
   "${TMUX_BIN}" new-session -d -s "${TMUX_SESSION}" -c "${AR_BASE}" \
     env -i \
       HOME="${HOME}" PATH="${PATH}" USER="${USER:-}" LOGNAME="${LOGNAME:-}" SHELL="${SHELL:-/bin/sh}" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "engines": {
     "node": ">=20"
   },