agentradar-cli 0.3.5 → 0.3.6

package/dist/setup.js

@@ -8,6 +8,7 @@ import { homedir } from "node:os";
 import * as tls from "node:tls";
 import { promisify } from "node:util";
 import { syncJoinedSkills } from "./skill-install.js";
+import { cliHeader, noteCliUpdate } from "./update.js";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
 /** The service's CLI build (the CLI itself and the agent-guard plugin): `installCli` keeps it current, never the npx cache. */
 const cliDist = (home) => join(home, ".agentradar", "cli", "current", "dist");
@@ -28,11 +29,13 @@ const SUPERVISOR_HARNESS = {
     generic: "generic",
 };
 async function postJson(fetchImpl, url, body) {
-    return fetchImpl(url, {
+    const response = await fetchImpl(url, {
         method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json", "cache-control": "no-store" },
+        headers: { ...(await cliHeader()), "content-type": "application/json", accept: "application/json", "cache-control": "no-store" },
         body: JSON.stringify(body),
     });
+    await noteCliUpdate(response.headers);
+    return response;
 }
 /**
  * The server's own words for a refusal, when it sent any.
@@ -117,7 +120,7 @@ export function trustedMcpEndpoint(value) {
         endpoint.hostname.endsWith(".localhost"));
     return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
 }
-/** `installation: null` (join) removes the project's `agentradar` entry: a joined agent acts through `agentradar run`. */
+/** AgentRadar is CLI-only: a project entry for `agentradar` is only ever removed (never written), and an agent acts through `agentradar run`. */
 async function installProjectMcp(configPath, cwd, installation, trust, 
 /** Vadym 10342: a joined Claude Code agent's AgentRadar channel (`agentradar channel <runner-id>`, stdio). */
 channel) {
@@ -153,14 +156,6 @@ channel) {
     if (channel) {
         mcpServers.agentradar = channel;
     }
-    else if (installation && endpoint) {
-        mcpServers.agentradar = {
-            type: "http",
-            url: endpoint.toString(),
-            headers: { Authorization: `Bearer ${installation.bearer}` },
-            timeout: 1_800_000,
-        };
-    }
     else {
         delete mcpServers.agentradar;
     }
@@ -178,6 +173,68 @@ channel) {
     await chmod(configPath, 0o600);
     return projectPath;
 }
+/** Drop the `[mcp_servers.agentradar]` table (and its sub-tables) when it is the old HTTP one (has a `url`). Null = nothing to drop. */
+export function stripCodexAgentradar(toml) {
+    const lines = toml.split("\n");
+    const out = [];
+    let dropped = false;
+    for (let i = 0; i < lines.length; i++) {
+        if (!/^\s*\[\s*mcp_servers\s*\.\s*["']?agentradar["']?\s*[\].]/.test(lines[i])) {
+            out.push(lines[i]);
+            continue;
+        }
+        let end = i + 1;
+        while (end < lines.length && !/^\s*\[/.test(lines[end]))
+            end++;
+        // A following [mcp_servers.agentradar.http_headers] belongs to the same entry.
+        while (end < lines.length && /^\s*\[\s*mcp_servers\s*\.\s*["']?agentradar["']?\s*\./.test(lines[end])) {
+            end++;
+            while (end < lines.length && !/^\s*\[/.test(lines[end]))
+                end++;
+        }
+        if (/^\s*url\s*=/m.test(lines.slice(i, end).join("\n"))) {
+            dropped = true;
+            i = end - 1;
+        }
+        else
+            out.push(lines[i]);
+    }
+    return dropped ? out.join("\n") : null;
+}
+/** Upgrade and sync: remove the old AgentRadar HTTP MCP entry an older `agentradar setup` or join wrote: Claude's project entry, the project .mcp.json and ~/.codex/config.toml. Silent unless it removes one. */
+export async function dropStaleMcp(cwd, home, log = console.log, env = process.env) {
+    const said = (where) => log(`Removed the old AgentRadar MCP entry from ${where}: AgentRadar is CLI-only now, use agentradar run <runner-id> <tool>.`);
+    const configPath = claudeConfigPath(home, env);
+    try {
+        const projectPath = await realpath(cwd);
+        const config = JSON.parse(await readFile(configPath, "utf8"));
+        if (config.projects?.[projectPath]?.mcpServers?.agentradar?.type === "http") {
+            await installProjectMcp(configPath, cwd, null, false);
+            said(configPath);
+        }
+    }
+    catch { /* no Claude config, or not a project it knows: nothing stale to remove */ }
+    const mcpJson = join(cwd, ".mcp.json");
+    try {
+        const parsed = JSON.parse(await readFile(mcpJson, "utf8"));
+        const entry = parsed.mcpServers?.agentradar;
+        if (entry && (entry.type === "http" || entry.url)) {
+            delete parsed.mcpServers.agentradar;
+            await writeFile(mcpJson, `${JSON.stringify(parsed, null, 2)}\n`);
+            said(mcpJson);
+        }
+    }
+    catch { /* no .mcp.json, or not JSON we can edit: leave it */ }
+    const codexToml = join(env.CODEX_HOME?.trim() || join(home, ".codex"), "config.toml");
+    try {
+        const stripped = stripCodexAgentradar(await readFile(codexToml, "utf8"));
+        if (stripped !== null) {
+            await writeFile(codexToml, stripped);
+            said(codexToml);
+        }
+    }
+    catch { /* no Codex config: nothing stale to remove */ }
+}
 export function shellValue(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -392,7 +449,7 @@ async function installRunner(home, projectPath, approved, service, feed) {
     const envPath = join(agentDir, `${approved.runnerId}.env`);
     const joined = [];
     if (service) {
-        joined.push(`AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`, `AR_AGENTRADAR_BIN=${shellValue(join(cliDist(home), "index.js"))}`);
+        joined.push(`AR_AGENTRADAR_BIN=${shellValue(join(cliDist(home), "index.js"))}`);
         let toolKeys = [];
         if (harness === "codex") {
             const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
@@ -425,6 +482,8 @@ async function installRunner(home, projectPath, approved, service, feed) {
             await writePrivateFile(settings, `${JSON.stringify({
                 extraKnownMarketplaces: { agentradar: { source: { source: "directory", path: join(cliDist(home), "agent-guard") } } },
                 enabledPlugins: { "agent-guard@agentradar": true },
+                // Vadym 12201: AskUserQuestion blocks the turn on a pick nobody at the pane makes, stalling every channel.
+                permissions: { deny: ["AskUserQuestion"] },
                 // Nobody sits at the pane to accept bypass mode's warning screen; the operator's consent was given at approval.
                 ...(service.bypass ? { skipDangerousModePermissionPrompt: true } : {}),
             }, null, 2)}\n`);
@@ -450,21 +509,15 @@ async function installRunner(home, projectPath, approved, service, feed) {
     // the service runs; the supervisor adds --dangerously-load-development-channels server:agentradar.
     await writePrivateFile(mcpConfig, `${JSON.stringify(feed === "push"
         ? { mcpServers: { agentradar: { type: "stdio", command: process.execPath, args: [join(cliDist(home), "index.js"), "channel", approved.runnerId] } } }
-        : service ? { mcpServers: {} } : {
-            mcpServers: {
-                agentradar: {
-                    type: "http",
-                    url: endpoint.toString(),
-                    headers: { Authorization: `Bearer ${approved.installation.bearer}` },
-                },
-            },
-        }, null, 2)}\n`);
+        : { mcpServers: {} }, null, 2)}\n`);
     await writePrivateFile(envPath, [
         `AGENT_NAME=${shellValue(approved.runnerId)}`,
         `AR_BASE=${shellValue(projectPath)}`,
         `AWP_MCP_URL=${shellValue(endpoint.toString())}`,
         `AWP_BEARER=${shellValue(approved.installation.bearer)}`,
         `MCP_CONFIG=${shellValue(mcpConfig)}`,
+        // Every convention line in the brief and skills says `agentradar run $AR_CLI_RUNNER_ID <tool>`.
+        `AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`,
         // Written only when the vendor declared a runtime. An absent variable is the supervisor's own
         // default, so writing `AR_AGENT_HARNESS=claude` unconditionally would change nothing except to make
         // every existing env file look as though a choice had been made.
@@ -542,17 +595,17 @@ export async function setupVendorAgent(deps = {}) {
         const runnerEnv = await installRunner(home, projectPath, approved);
         // Print the path, not just "installed". D3 was a silent write to the wrong file under a
         // relocated CLAUDE_CONFIG_DIR; naming the target turns that class of failure into a glance.
-        log(`AgentRadar MCP installed for this project → ${configPath}`);
+        log(`AgentRadar runner set up for this project (no MCP entry; the agent acts through agentradar run) → ${configPath}`);
         log(trust
             ? `--trust: pre-accepted the trust dialog for ${projectPath}. Claude Code will run this folder's existing hooks and settings without asking.`
-            : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
+            : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just AgentRadar. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
         if ((approved.harness ?? "").trim().toLowerCase() === "codex") {
             // Said BEFORE the vendor runs the runner, because the supervisor's refusal comes after they
             // think setup succeeded. Codex reads its MCP servers from $CODEX_HOME/config.toml — there is no
             // `--strict-mcp-config` to point at the file this setup just wrote — so the isolation boundary is
             // a per-agent home the vendor supplies, and the supervisor fails closed without it.
-            log(`This agent runs on Codex. Set CODEX_HOME in ${runnerEnv} to a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server; the runner refuses to start without it.`);
+            log(`This agent runs on Codex. Set CODEX_HOME in ${runnerEnv} to a per-agent Codex home whose config.toml declares no MCP servers (the agent acts through the CLI); the runner refuses to start without it.`);
         }
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
         log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");

package/dist/skill-install.js

@@ -1,9 +1,8 @@
-import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { basename, dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 const MANAGED_MARK = ".agentradar-managed";
-const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
 async function ensureDirectory(path) {
     try {
         const info = await lstat(path);
@@ -44,76 +43,10 @@ export async function installVendorSkill(deps = {}) {
     await writeFile(join(skillDir, MANAGED_MARK), "Written by AgentRadar; replaced on every sync.\n");
     (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
 }
-const isManaged = async (dir) => (await lstat(dir).then((info) => info.isDirectory(), () => false)) && (await lstat(join(dir, MANAGED_MARK)).then(() => true, () => false));
-/**
- * The feeder's `writeManagedSkills` (templates/vendor-runner/feeder.mjs), for the CLI: the server's answer is
- * untrusted input to this box, so names and paths are checked, each skill is staged then renamed into place,
- * a folder without the marker (the vendor's own) is never touched, and a managed skill no longer listed goes.
- */
-const sameSkill = async (dir, files) => {
-    try {
-        const have = [];
-        for (const p of await readdir(dir, { recursive: true }))
-            if (p !== MANAGED_MARK && (await stat(join(dir, p))).isFile())
-                have.push(p);
-        for (const f of files)
-            if (await readFile(join(dir, f.path), "utf8") !== f.content)
-                return false;
-        return have.length === files.length;
-    }
-    catch {
-        return false;
-    }
-};
+const runnerSkills = () => import(new URL(import.meta.url.endsWith(".ts")
+    ? "../../../templates/vendor-runner/feeder.mjs" : "./vendor-runner/feeder.mjs", import.meta.url).href);
 export async function writeManagedSkills(skillsDir, skills) {
-    await mkdir(skillsDir, { recursive: true });
-    const written = new Set();
-    for (const skill of skills) {
-        const name = String(skill?.name ?? "");
-        const target = join(skillsDir, name);
-        if (!SKILL_NAME.test(name))
-            continue;
-        if (await lstat(target).then(() => true, () => false) && !(await isManaged(target)))
-            continue;
-        const files = (Array.isArray(skill.files) ? skill.files : []);
-        if (files.some((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
-            || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path))))
-            continue;
-        // An unchanged skill is not rewritten: the agent's CLI may be reading it.
-        if (await sameSkill(target, files)) {
-            written.add(name);
-            continue;
-        }
-        const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
-        const old = join(skillsDir, `.${name}.old-${process.pid}`);
-        try {
-            await rm(staging, { recursive: true, force: true });
-            for (const f of files) {
-                await mkdir(dirname(join(staging, f.path)), { recursive: true });
-                await writeFile(join(staging, f.path), f.content);
-            }
-            await writeFile(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
-            // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
-            await rm(old, { recursive: true, force: true });
-            await rename(target, old).catch((err) => { if (err?.code !== "ENOENT")
-                throw err; });
-            await rename(staging, target);
-            await rm(old, { recursive: true, force: true });
-            written.add(name);
-        }
-        catch {
-            await rm(staging, { recursive: true, force: true });
-            if (!(await lstat(target).then(() => true, () => false)))
-                await rename(old, target).catch(() => { });
-            if (await isManaged(target))
-                written.add(name);
-        }
-    }
-    for (const entry of await readdir(skillsDir)) {
-        if (!written.has(entry) && await isManaged(join(skillsDir, entry)))
-            await rm(join(skillsDir, entry), { recursive: true, force: true });
-    }
-    return [...written];
+    return (await runnerSkills()).writeManagedSkills(skillsDir, skills);
 }
 /**
  * R650 — a joined agent's AgentRadar skills (`my_skills`: the bundled set plus the ones linked to it), written
@@ -160,11 +93,12 @@ export async function syncJoinedSkills(runnerId, deps) {
     // Same file and mark as the runner's feeder, which keeps it fresh from then on.
     const init = await awpRequest(runnerId, "initialize", {
         protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-cli", version: "1.0.0" },
-    }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
     const briefFile = codex ? join(root, "AGENTS.md") : join(root, ".claude", "rules", "agentradar-brief.md");
     if (root && init?.result?.instructions)
         await writeBrief(briefFile, init.result.instructions);
-    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: {} }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    const have = (await runnerSkills()).heldSkillZips(skillsDir);
+    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: { have } }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
     const text = body?.result?.content?.find((c) => c.type === "text")?.text;
     const answer = (text ? JSON.parse(text) : {});
     if (!answer.ok || !Array.isArray(answer.skills))

package/dist/tool-run.js

@@ -2,7 +2,7 @@ import { readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { commandFor, DEPRECATED_TOOLS, toolFor } from "./commands.js";
-import { cliHeader, newer, runningVersion } from "./update.js";
+import { cliHeader, noteCliUpdate, withCliUpdate } from "./update.js";
 /**
  * One `KEY='value'` line as `setup.ts` wrote it, single-quoted with `'` escaped as `'\''`.
  * Nothing here is printed: the file holds the runner's bearer.
@@ -335,31 +335,9 @@ export async function callAwpTool(runnerId, name, toolArguments, deps) {
         logError(said);
         return 1;
     }
-    log(said);
-    await cliVersionNotice(said, logError);
+    log(withCliUpdate(said));
     return 0;
 }
-/**
- * Vadym 9970: the server names the CLI it expects (`cli: { latest, min }`, on a successful get_my_context).
- * When this one is behind, the agent reads it in its own output (stderr, so --json stdout stays parseable).
- */
-async function cliVersionNotice(said, logError) {
-    let cli;
-    try {
-        cli = JSON.parse(said).cli;
-    }
-    catch {
-        return;
-    }
-    if (!cli || typeof cli.latest !== "string")
-        return;
-    const mine = await runningVersion().catch(() => null);
-    if (!mine || !newer(cli.latest, mine))
-        return;
-    logError(typeof cli.min === "string" && newer(cli.min, mine)
-        ? `agentradar ${mine} is below the minimum ${cli.min}: upgrade required. Run \`agentradar upgrade\`.`
-        : `agentradar ${cli.latest} is available (you run ${mine}). Run \`agentradar upgrade\`.`);
-}
 const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 /** One JSON-RPC request on the runner's AWP MCP endpoint with the runner's own key; null after logging why it failed. */
 export async function awpRequest(runnerId, method, params, deps) {
@@ -407,7 +385,7 @@ async function postAwp(url, bearer, method, params, deps) {
     const response = await (deps.fetch ?? fetch)(url, {
         method: "POST",
         headers: {
-            ...(await cliHeader()),
+            ...(await cliHeader(deps.surface)),
             authorization: `Bearer ${bearer}`,
             "content-type": "application/json",
             // Both, because the endpoint answers JSON only when the client says it takes JSON.
@@ -420,6 +398,7 @@ async function postAwp(url, bearer, method, params, deps) {
             params,
         }),
     });
+    await noteCliUpdate(response.headers, logError);
     if (!response.ok) {
         // 426: this CLI is below the server's minimum; its sentence says how to upgrade.
         const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;

package/dist/update.js

@@ -16,8 +16,33 @@ export const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const serviceCopy = (root) => basename(dirname(root)) === "cli" && basename(dirname(dirname(root))) === ".agentradar";
 /** The version this process runs, whatever `current` points at now. */
 export const runningVersion = async () => JSON.parse(await readFile(join(PACKAGE_ROOT, "package.json"), "utf8")).version;
-/** Sent as `x-agentradar-cli` on every MCP call, so the server can refuse a CLI below its minimum (self-release card 2). */
-export const cliHeader = async () => ({ "x-agentradar-cli": await runningVersion().catch(() => "") });
+/**
+ * Sent as `x-agentradar-cli` on every MCP call, so the server can refuse a CLI below its minimum (self-release card 2),
+ * and as `x-agentradar-surface` so it can count which client a call came from (MCPR-1).
+ */
+export const cliHeader = async (surface = "cli") => ({ "x-agentradar-cli": await runningVersion().catch(() => ""), "x-agentradar-surface": surface });
+let behind = null;
+export const forgetCliUpdate = () => { behind = null; };
+export async function noteCliUpdate(headers, logError = console.error) {
+    const latest = headers?.get("x-agentradar-cli-latest");
+    const current = latest && !behind ? await runningVersion().catch(() => "") : "";
+    if (!latest || !current || !newer(latest, current) || behind)
+        return;
+    behind = { current, latest, command: "agentradar upgrade" };
+    logError(`agentradar ${latest} is available (you run ${current}). Run \`agentradar upgrade\`.`);
+}
+/** A JSON-object output with `cliUpdate` added when this CLI is behind; anything else, or a current CLI, unchanged. */
+export function withCliUpdate(text) {
+    if (!behind)
+        return text;
+    try {
+        const body = JSON.parse(text);
+        return body && typeof body === "object" && !Array.isArray(body) ? JSON.stringify({ ...body, cliUpdate: behind }, null, text.includes("\n") ? 2 : 0) : text;
+    }
+    catch {
+        return text;
+    }
+}
 /** The version on disk: for a service's copy, the one `current` points at, which another runner may have moved. */
 export const installedVersion = async (root = PACKAGE_ROOT) => JSON.parse(await readFile(join(serviceCopy(root) ? join(dirname(root), "current") : root, "package.json"), "utf8")).version;
 export const newer = (a, b) => {

package/dist/vendor-runner/feeder.mjs

@@ -28,6 +28,7 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
+import { unpackSkillZip } from "./skill-zip.mjs";
 
 const PANE_LIVE_SH = join(dirname(fileURLToPath(import.meta.url)), "pane-live.sh");
 
@@ -78,6 +79,11 @@ const NEXT_EVENT_HOLD_MS = Number(process.env.NEXT_EVENT_HOLD_MS ?? "200000");
 // watchdog is 230s, still under the ~240s ALB idle-timeout.
 const NEXT_EVENT_TIMEOUT_MS = NEXT_EVENT_HOLD_MS + 30000;
 const IDLE_DELAY_MS = Number(process.env.IDLE_DELAY_MS ?? "1000");
+// A starting runner rechecks readiness this often inside its IDLE_DELAY_MS wait, so a cold start's work goes out
+// as soon as the session is ready rather than up to a whole wait (plus a CLI login probe) later.
+const READY_POLL_MS = Number(process.env.READY_POLL_MS ?? "200");
+// A good login probe holds this long. The probe spawns the CLI; run every poll, it competed with the booting session.
+const AUTH_RECHECK_MS = Number(process.env.AUTH_RECHECK_MS ?? "60000");
 const ERROR_DELAY_MS = Number(process.env.ERROR_DELAY_MS ?? "3000");
 // How long to wait for the pane to come back (mid-revive) before giving up this round.
 const PANE_WAIT_MS = Number(process.env.PANE_WAIT_MS ?? "15000");
@@ -166,6 +172,7 @@ async function mcpPost(method, params, { notification = false, timeoutMs = MCP_C
     "content-type": "application/json",
     accept: "application/json, text/event-stream",
     authorization: `Bearer ${AWP_BEARER}`,
+    "x-agentradar-surface": "feeder",
   };
   if (_sessionId) headers["mcp-session-id"] = _sessionId;
   const body = { jsonrpc: "2.0", method, params: params ?? {} };
@@ -217,6 +224,7 @@ function mcpPostIsolated(method, params, { timeoutMs = PANE_MCP_TIMEOUT_MS } = {
           "content-type": "application/json",
           accept: "application/json, text/event-stream",
           authorization: `Bearer ${AWP_BEARER}`,
+          "x-agentradar-surface": "feeder",
           "content-length": Buffer.byteLength(payload),
         },
         timeout: timeoutMs,
@@ -344,22 +352,49 @@ export function codexAuthState(run = spawnSync, readFile = fs.readFileSync) {
 }
 
 /** The login probe for whichever CLI this runner drives. */
-export function agentAuthState() {
+function harnessAuthState() {
   // A generic CLI has no login probe we know of; its pane's input marker is the readiness signal.
   if (AR_AGENT_HARNESS === "generic") return "authenticated";
   return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
 }
 
+let _authOkUntil = 0;
+/** True while a good login probe still holds. */
+export const authHeld = (now = Date.now()) => now < _authOkUntil;
+/** Only "authenticated" is held: a logged-out or unanswered probe is asked again on the next poll. `fresh` skips the hold. */
+export function agentAuthState(fresh = false, now = Date.now(), probe = harnessAuthState) {
+  if (!fresh && authHeld(now)) return "authenticated";
+  const state = probe();
+  _authOkUntil = state === "authenticated" ? now + AUTH_RECHECK_MS : 0;
+  return state;
+}
+
+/** Waits up to `budgetMs`, ending early once the runner reads ready. True when it did. */
+export async function waitForReady(readiness, budgetMs = IDLE_DELAY_MS, step = READY_POLL_MS, sleepFn = sleep) {
+  if (!(step > 0)) step = 200; // READY_POLL_MS of 0 or junk would spin
+  for (let waited = 0; waited < budgetMs; waited += step) {
+    await sleepFn(Math.min(step, budgetMs - waited));
+    if (readiness() === "ready") return true;
+  }
+  return false;
+}
+
 /** AGENT-GUARD-ACTIVE: the supervisor sets AR_GUARD_MARKER when the session must load agent-guard, whose SessionStart hook writes it. */
 export const guardLoaded = (marker = process.env.AR_GUARD_MARKER) => !marker || fs.existsSync(marker);
 
 export function runnerState(auth = agentAuthState, sample = capturePane, guard = guardLoaded) {
+  const held = authHeld();
   const authState = auth();
   if (authState === "unauthenticated") return "auth_required";
   if (authState !== "authenticated" || !guard()) return "starting";
   const pane = sample();
   if (pane?.rateLimited) return "rate_limited";
-  return pane?.inputReady ? "ready" : "starting";
+  if (!pane?.inputReady) return "starting";
+  if (!held) return "ready";
+  // A held probe may keep a pane starting, never make it ready: a logged-out Claude still draws ❯ (its login menu,
+  // or the composer after a token loss), and work typed there is acked and lost. Ask once more before "ready".
+  const fresh = auth(true);
+  return fresh === "authenticated" ? "ready" : fresh === "unauthenticated" ? "auth_required" : "starting";
 }
 
 /**
@@ -601,6 +636,15 @@ export function paneInputReady(text, harness = AR_AGENT_HARNESS, readyPattern =
     : /bypass permissions on\b|^\s*❯/im.test(tail);
 }
 
+/**
+ * Vadym 12490: the permission mode Claude Code's footer names ("⏸ manual mode on"), or null when no footer shows.
+ * A hosted session must read "bypass permissions"; anything else is reported so the server can alert.
+ */
+export function panePermissionMode(text) {
+  const tail = String(text ?? "").replace(/\n\s*$/, "").split("\n").slice(-12).join("\n");
+  return /\b(manual mode|accept edits|auto-accept edits|plan mode|bypass permissions) on\b/i.exec(tail)?.[1].toLowerCase() ?? null;
+}
+
 /**
  * Why a Claude Code session refused to register its channels, read off the banner it prints — or null.
  * Keyed by the CLI's own skip `kind`. The `auth` banner comes from builds before 2.1.281, which has no auth
@@ -642,7 +686,7 @@ function capturePane() {
   // build after several turns, which falsely demoted a healthy pane to `starting` and stopped next_event
   // from draining until its heartbeat aged stale.
   const inputReady = paneInputReady(text);
-  return { hash, inProgress, inputReady, rateLimited: paneRateLimited(text), channelGate: classifyChannelBanner(text) };
+  return { hash, inProgress, inputReady, rateLimited: paneRateLimited(text), channelGate: classifyChannelBanner(text), mode: panePermissionMode(text) };
 }
 /**
  * #173b (disc obs) — format-drift detector. If the STRIPPED fingerprint keeps CHANGING while the pane
@@ -685,7 +729,10 @@ async function reportPane() {
     _lastChannelGate = p.channelGate?.kind ?? null;
     // #156: isolated connection (NOT the shared long-poll socket) so pane sampling never stalls behind
     // the receive long-poll's ALB-killed socket.
-    await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress } });
+    // Vadym 12490: a hosted session always runs in full auto; a vendor's own runner may choose its mode.
+    const offMode = process.env.AR_CLI_RUNNER_ID === "hosted" && p.mode && p.mode !== "bypass permissions" ? p.mode : null;
+    if (offMode) console.warn(`[feeder] hosted session in ${offMode}, not full auto`);
+    await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress, ...(offMode ? { permissionMode: offMode } : {}) } });
     if (process.env.DEBUG_PANE) {
       console.log(`[feeder] report_pane #${n}: OK hash=${p.hash.slice(0, 8)} inProgress=${p.inProgress} (${Date.now() - t0}ms)`);
     }
@@ -706,14 +753,49 @@ const isManaged = (dir) => {
   const st = fs.lstatSync(dir, { throwIfNoEntry: false });
   return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
 };
+// Same bytes and the same mode for every file, and nothing else in the directory.
 const sameSkill = (dir, files) => {
   try {
     const have = fs.readdirSync(dir, { recursive: true }).filter((p) => p !== MANAGED_MARK && fs.statSync(join(dir, p)).isFile());
-    return have.length === files.length && files.every((f) => fs.readFileSync(join(dir, f.path), "utf8") === f.content);
+    return have.length === files.length && files.every((f) => fs.readFileSync(join(dir, f.path)).equals(f.bytes)
+      && (fs.statSync(join(dir, f.path)).mode & 0o777) === f.mode);
   } catch {
     return false;
   }
 };
+const markText = (sha) => `Written by the AgentRadar runner; replaced on every sync.\n${sha ? `sha256:${sha}\n` : ""}`;
+const markedSha = (dir) => {
+  try {
+    return /^sha256:([0-9a-f]{64})$/m.exec(fs.readFileSync(join(dir, MANAGED_MARK), "utf8"))?.[1] ?? null;
+  } catch {
+    return null;
+  }
+};
+
+/** SKILL-ZIP-S3: what `my_skills` is told this box holds, so an unchanged zip is not sent again. */
+export function heldSkillZips(skillsDir) {
+  const held = {};
+  for (const entry of fs.existsSync(skillsDir) ? fs.readdirSync(skillsDir) : []) {
+    const sha = SKILL_NAME.test(entry) && isManaged(join(skillsDir, entry)) ? markedSha(join(skillsDir, entry)) : null;
+    if (sha) held[entry] = sha;
+  }
+  return held;
+}
+
+// Each skill comes as a zip (its bytes checked against its sha256 and unpacked by skill-zip.mjs, exec bits kept), as a
+// zip's sha256 alone when this box already holds it, or, from an older server, as files of text.
+function skillFiles(skill, target) {
+  const zip = skill.zip;
+  if (zip && typeof zip === "object") {
+    if (typeof zip.base64 === "string") return { sha: zip.sha256, files: unpackSkillZip(Buffer.from(zip.base64, "base64"), zip.sha256) };
+    if (isManaged(target) && markedSha(target) === zip.sha256) return "held";
+    throw new Error("the server sent no bytes for a zip this box does not hold");
+  }
+  const files = Array.isArray(skill.files) ? skill.files : [];
+  if (files.some((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+    || normalize(f.path).split(sep).includes(".."))) return null;
+  return { sha: null, files: files.map((f) => ({ path: normalize(f.path), bytes: Buffer.from(f.content), mode: 0o644 })) };
+}
 
 export function writeManagedSkills(skillsDir, skills) {
   fs.mkdirSync(skillsDir, { recursive: true });
@@ -726,22 +808,38 @@ export function writeManagedSkills(skillsDir, skills) {
       console.warn(`[feeder] skill sync: ${name} is not ours, left alone`);
       continue;
     }
-    const files = Array.isArray(skill.files) ? skill.files : [];
-    const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
-      || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
-    if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    let got;
+    try {
+      got = skillFiles(skill, target);
+    } catch (err) {
+      // A zip that fails its check keeps the copy this box already has.
+      if (isManaged(target)) written.add(name);
+      console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
+      continue;
+    }
+    if (got === "held") { written.add(name); continue; }
+    if (!got || got.files.some((f) => [".", MANAGED_MARK].includes(f.path))) {
+      console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`);
+      continue;
+    }
+    const { sha, files } = got;
     // An unchanged skill is not rewritten: the agent's CLI may be reading it (Codex skipped a SKILL.md that a
-    // periodic resync had just removed).
-    if (sameSkill(target, files)) { written.add(name); continue; }
+    // periodic resync had just removed). Only its mark is brought up to date.
+    if (sameSkill(target, files)) {
+      if (markedSha(target) !== sha) fs.writeFileSync(join(target, MANAGED_MARK), markText(sha));
+      written.add(name);
+      continue;
+    }
     const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
     const old = join(skillsDir, `.${name}.old-${process.pid}`);
     try {
       fs.rmSync(staging, { recursive: true, force: true });
       for (const f of files) {
         fs.mkdirSync(dirname(join(staging, f.path)), { recursive: true });
-        fs.writeFileSync(join(staging, f.path), f.content);
+        fs.writeFileSync(join(staging, f.path), f.bytes, { mode: f.mode });
+        fs.chmodSync(join(staging, f.path), f.mode); // the umask must not take the exec bit back
       }
-      fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+      fs.writeFileSync(join(staging, MANAGED_MARK), markText(sha));
       // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
       fs.rmSync(old, { recursive: true, force: true });
       if (fs.existsSync(target)) fs.renameSync(target, old);
@@ -775,7 +873,7 @@ async function syncSkills() {
     console.warn(`[feeder] brief sync failed: ${err instanceof Error ? err.message : String(err)}`);
   }
   try {
-    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: {} }));
+    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: { have: heldSkillZips(SKILLS_DIR) } }));
     // A refusal or an older server keeps whatever this box already has.
     if (!answer.ok || !Array.isArray(answer.skills)) {
       console.warn(`[feeder] skill sync: server answered ${answer.error ?? "without skills"}; keeping current copies`);
@@ -969,7 +1067,7 @@ let _lastRunnerState = null;
 
 /** One receive→inject→ack-select cycle (extracted from loop() + exported so the #173b _pendingAck
  *  fence is directly testable). Sets `_pendingAck` = the eventIds to ack on the NEXT poll. */
-export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch) {
+export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch, wait = waitForReady) {
   // next_event refreshes the portal's runner heartbeat. Never call it for a detached/orphan feeder: a
   // process without its owned tmux session cannot receive work, so polling would paint a false Live state
   // while every event stays unacknowledged. The supervisor recreates the session; until then the durable
@@ -995,7 +1093,10 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   const { events = [], livenessProbe, welcome, modelSwitch, firstStep } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
   _nextSwitch = modelSwitch ?? null;
   if (!canWork) {
-    await sleep(IDLE_DELAY_MS);
+    // Signed in but still booting: poll again the moment the pane is ready. Each check is a file stat and a pane
+    // capture; the login probe stays held, so it does not spawn the CLI beside the booting session.
+    if (state === "starting" && !_switching && authHeld()) await wait(readiness);
+    else await sleep(IDLE_DELAY_MS);
     return;
   }
   _pendingAck = [];