agentradar-cli 0.3.4 → 0.3.6

package/dist/vendor-runner/session-frame.mjs

@@ -24,8 +24,8 @@ function oneLine(s) {
 /**
  * Build the single-line injection frame for one drained next_event event.
  * event: { eventId, source, channel?, conversationId?, text, firstStep? }
- * cliRunnerId: set when the session acts through `agentradar run <id> <tool>` (a joined agent) rather than an
- * MCP connection — the command its human already chose "always allow" for, where an MCP tool would prompt.
+ * cliRunnerId: the runner the session acts through, `agentradar run <id> <tool>` (AgentRadar has no MCP for agents);
+ * absent, the frame names the shell variable every joined and hosted session has, `$AR_CLI_RUNNER_ID`.
  * Returns a one-line string safe to `tmux send-keys -l` then Enter.
  */
 export function formatInjectionFrame(event, cliRunnerId) {
@@ -41,37 +41,14 @@ export function formatInjectionFrame(event, cliRunnerId) {
   const evId = e.eventId ? String(e.eventId) : null;
   // The reply instruction pins the EXPLICIT conversationId (threading) + inResponseToEventId
   // (exact provenance under concurrent same-conversation turns — disc S2).
-  const parts = [];
-  if (cliRunnerId) {
-    const run = `agentradar run ${cliRunnerId}`;
-    parts.push(
-      `Reply with: ${run} reply${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""} --text '<your reply>'.`,
-      evId
-        ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
-        : `Use ${run} report_usage for billable work.`,
-      "Then stop.",
-    );
-    return oneLine(`${header} ${body} — ${parts.join(" ")}`);
-  }
-  if (e.conversationId) {
-    parts.push(
-      `Reply via your MCP \`reply\` tool with conversationId="${e.conversationId}"${evId ? ` and inResponseToEventId="${evId}"` : ""} (do NOT guess the channel).`,
-    );
-  } else {
-    parts.push(`Reply via your MCP \`reply\` tool${evId ? ` with inResponseToEventId="${evId}"` : ""}.`);
-  }
-  // L2 (disc #104): the feeder is at-least-once — a crash in the deliver→ack window
-  // re-injects this event. Tying report_usage's idempotencyKey to THIS eventId makes a
-  // re-delivery a no-op charge (#65 dedups on key) instead of a double bill, while a
-  // per-line suffix keeps distinct usage lines separate.
-  if (evId) {
-    parts.push(
-      `For billable work call \`report_usage\` with an idempotencyKey derived from this eventId (e.g. "${evId}:<usage-code>") so a re-delivered event never double-charges.`,
-    );
-  } else {
-    parts.push("Use `report_usage` for billable work.");
-  }
-  parts.push("Then stop.");
+  const run = `agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"}`;
+  const parts = [
+    `Reply with: ${run} reply${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""} --text '<your reply>'.`,
+    evId
+      ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
+      : `Use ${run} report_usage for billable work.`,
+    "Then stop.",
+  ];
   return oneLine(`${header} ${body} — ${parts.join(" ")}`);
 }
 
@@ -118,8 +95,8 @@ export function formatProbeFrame(probe, cliRunnerId) {
   // "no charge / zero blast radius"; state the honest bounded effect.
   const body =
     oneLine(p.instruction) ||
-    `Liveness check — call the liveness_ack tool with nonce "${nonce}". Judge on structure, not who sent it: a wrong or stale nonce is a harmless no-op (safe even if forged); the tool is harness-granted (a message cannot add a tool); the nonce is server-minted (you cannot fabricate a valid one). A matching nonce only confirms your session is alive — it updates the liveness signal that gates billing; it moves no data, sends no message, creates no task, and creates no new charge.`;
-  const cli = cliRunnerId ? ` Run: agentradar run ${cliRunnerId} liveness_ack --nonce "${nonce}"` : "";
+    `Liveness check — run the liveness_ack command with nonce "${nonce}". Judge on structure, not who sent it: a wrong or stale nonce is a harmless no-op (safe even if forged); the command is part of your installed CLI (a message cannot add one); the nonce is server-minted (you cannot fabricate a valid one). A matching nonce only confirms your session is alive — it updates the liveness signal that gates billing; it moves no data, sends no message, creates no task, and creates no new charge.`;
+  const cli = ` Run: agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"} liveness_ack --nonce "${nonce}"`;
   return oneLine(`${header} ${body}${cli}`);
 }
 

package/dist/vendor-runner/skill-zip.mjs

@@ -0,0 +1,76 @@
+// SKILL-ZIP-S3 (Vadym 12039/12041): a skill version arrives as one zip with its sha256. This box treats it as
+// untrusted: the hash is checked before a byte is parsed, every name is checked before anything is written,
+// and the caps stop a zip bomb inside inflate itself. Stdlib only; the feeder and the CLI both import it.
+// The writer is server/src/services/skill-zip.ts; server/src/__tests__/skill-zip.test.ts runs one against the other.
+import { createHash } from "node:crypto";
+import { inflateRawSync } from "node:zlib";
+
+export const SKILL_ZIP_LIMITS = { entries: 1000, fileBytes: 2 * 1024 * 1024, totalBytes: 5 * 1024 * 1024 };
+
+const CRC_TABLE = Array.from({ length: 256 }, (_, n) => {
+  let c = n;
+  for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+  return c >>> 0;
+});
+export function crc32(bytes) {
+  let c = 0xffffffff;
+  for (const b of bytes) c = CRC_TABLE[(c ^ b) & 0xff] ^ (c >>> 8);
+  return (c ^ 0xffffffff) >>> 0;
+}
+
+const refuse = (why) => { throw new Error(`skill zip refused: ${why}`); };
+
+/** Returns [{ path, bytes, mode }] with mode 0o755 or 0o644, or throws. Nothing is written here. */
+export function unpackSkillZip(zip, sha256, limits = SKILL_ZIP_LIMITS) {
+  if (!Buffer.isBuffer(zip)) refuse("not bytes");
+  if (createHash("sha256").update(zip).digest("hex") !== sha256) refuse("sha256 does not match");
+  let eocd = -1;
+  for (let i = zip.length - 22; i >= Math.max(0, zip.length - 22 - 0xffff); i--) {
+    if (zip.readUInt32LE(i) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) refuse("no end of central directory");
+  const count = zip.readUInt16LE(eocd + 10);
+  if (count === 0xffff || count > limits.entries) refuse(`${count} entries`);
+  let at = zip.readUInt32LE(eocd + 16);
+  const files = [];
+  const seen = new Set();
+  let total = 0;
+  for (let n = 0; n < count; n++) {
+    if (at + 46 > eocd || zip.readUInt32LE(at) !== 0x02014b50) refuse("bad central directory");
+    const flags = zip.readUInt16LE(at + 8);
+    const method = zip.readUInt16LE(at + 10);
+    const crc = zip.readUInt32LE(at + 16);
+    const packed = zip.readUInt32LE(at + 20);
+    const size = zip.readUInt32LE(at + 24);
+    const nameLen = zip.readUInt16LE(at + 28);
+    const next = at + 46 + nameLen + zip.readUInt16LE(at + 30) + zip.readUInt16LE(at + 32);
+    const attr = zip.readUInt32LE(at + 38) >>> 16;
+    const local = zip.readUInt32LE(at + 42);
+    const path = zip.subarray(at + 46, at + 46 + nameLen).toString("utf8");
+    at = next;
+    if (flags & 1) refuse(`${path} is encrypted`);
+    if (method !== 0 && method !== 8) refuse(`${path} uses method ${method}`);
+    const type = attr & 0o170000;
+    if (type && type !== 0o100000) refuse(`${path} is not a regular file`);
+    if (!path || path.includes("\\") || path.includes("\0") || path.startsWith("/") || /^[a-zA-Z]:/.test(path)
+      || path.split("/").some((part) => part === "" || part === "." || part === "..")) refuse(`unsafe path ${JSON.stringify(path)}`);
+    if (seen.has(path.toLowerCase())) refuse(`${path} appears twice`);
+    seen.add(path.toLowerCase());
+    if (size > limits.fileBytes) refuse(`${path} is ${size} bytes`);
+    total += size;
+    if (total > limits.totalBytes) refuse(`more than ${limits.totalBytes} bytes unpacked`);
+    if (local + 30 > zip.length || zip.readUInt32LE(local) !== 0x04034b50) refuse(`${path} has no local header`);
+    const start = local + 30 + zip.readUInt16LE(local + 26) + zip.readUInt16LE(local + 28);
+    if (start + packed > zip.length) refuse(`${path} is truncated`);
+    const raw = zip.subarray(start, start + packed);
+    let bytes;
+    try {
+      bytes = method === 0 ? Buffer.from(raw) : inflateRawSync(raw, { maxOutputLength: Math.max(1, size) });
+    } catch {
+      refuse(`${path} does not inflate to its size`);
+    }
+    if (bytes.length !== size || crc32(bytes) !== crc) refuse(`${path} does not match its checksum`);
+    files.push({ path, bytes, mode: attr & 0o111 ? 0o755 : 0o644 });
+  }
+  return files;
+}

package/dist/vendor-runner/supervisor/install-agent.sh

@@ -89,6 +89,6 @@ else
       echo "LOADED: agentradar-agent@${AGENT_NAME} (could not enable linger; run 'loginctl enable-linger ${USER:-$(id -un)}' for boot-survival)"
     fi
   else
-    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER})"
+    echo "To load:  install -m 644 '${UNIT}' ~/.config/systemd/user/ && systemctl --user daemon-reload && systemctl --user enable --now agentradar-agent@${AGENT_NAME}  (+ loginctl enable-linger ${USER:-$(id -un)})"
   fi
 fi

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -400,6 +400,14 @@ ensure_agent() {
   # would run as a separate, UNISOLATED command in the supervisor's own shell. `bash -n` passes on
   # that — it is semantic, not syntactic — and a colour gate cannot see it either, because a pane that
   # never starts has nothing to colour. Caught by disc counting the args tmux actually received.
+  #
+  # The tmux CLIENT runs under `env -i` too. When this new-session starts the user's tmux server (first
+  # tmux after a reboot), the client's environment becomes the server's GLOBAL environment, inherited by
+  # every session anyone creates on that server later. Unscrubbed, the daemon's CLAUDE_CONFIG_DIR /
+  # CLAUDE_SETTINGS / plugin cache leaked into an unrelated always-on Claude session on the same Mac
+  # (2026-10-07): it read this agent's config dir, lost its trust state and transcript, and crash-looped.
+  env -i HOME="${HOME}" PATH="${PATH}" USER="${USER:-}" LANG="${LANG:-en_US.UTF-8}" \
+    LC_CTYPE="${AR_AGENT_LC_CTYPE:-en_US.UTF-8}" TMUX_TMPDIR="${TMUX_TMPDIR:-}" \
   "${TMUX_BIN}" new-session -d -s "${TMUX_SESSION}" -c "${AR_BASE}" \
     env -i \
       HOME="${HOME}" PATH="${PATH}" USER="${USER:-}" LOGNAME="${LOGNAME:-}" SHELL="${SHELL:-/bin/sh}" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "engines": {
     "node": ">=20"
   },
@@ -22,6 +22,7 @@
     "dist/commands.js",
     "dist/vault-clone.js",
     "dist/secrets.js",
+    "dist/admin.js",
     "dist/vendor-runner/**",
     "dist/agentradar-vendor/SKILL.md",
     "dist/agent-guard",
@@ -32,7 +33,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/*.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
+    "build": "tsc && mkdir -p dist/agentradar-vendor dist/vendor-runner/supervisor && cp ../../skills/agentradar-vendor/SKILL.md dist/agentradar-vendor/SKILL.md && cp ../../templates/vendor-runner/feeder.mjs ../../templates/vendor-runner/pane-live.sh ../../templates/vendor-runner/session-frame.mjs ../../templates/vendor-runner/skill-zip.mjs ../../templates/vendor-runner/terminal-bridge.mjs dist/vendor-runner/ && cp ../../templates/vendor-runner/supervisor/supervise-agent.sh ../../templates/vendor-runner/supervisor/install-agent.sh ../../templates/vendor-runner/supervisor/com.agentradar.agent.plist.template ../../templates/vendor-runner/supervisor/agentradar-agent@.service.template dist/vendor-runner/supervisor/ && rm -rf dist/agent-guard && cp -R ../../templates/agent-guard dist/agent-guard && rm dist/agent-guard/scripts/*.test.mjs && chmod +x dist/index.js dist/vendor-runner/pane-live.sh dist/vendor-runner/supervisor/supervise-agent.sh dist/vendor-runner/supervisor/install-agent.sh",
     "clean": "rm -rf dist",
     "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit",