agentradar-cli 0.3.5 → 0.3.7

package/dist/admin.js

@@ -0,0 +1,39 @@
+/**
+ * ADMIN-BROADCAST (Vadym 12310/12828): `agentradar admin broadcast` for an instance admin. Authenticates with a board
+ * API key in AGENTRADAR_ADMIN_TOKEN, never a runner key; the server refuses anyone who is not an instance admin.
+ */
+export const ADMIN_BROADCAST_USAGE = "Usage: agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>"
+    + "  (env AGENTRADAR_ADMIN_TOKEN = an instance admin's board API key; AGENTRADAR_API_URL = the API base)";
+export async function adminOverCli(args, deps = {}) {
+    const env = deps.env ?? process.env, log = deps.log ?? console.log, logError = deps.logError ?? console.error;
+    const named = {};
+    const modes = args.slice(1).filter((arg) => arg === "--dry-run" || arg === "--send");
+    for (let i = 1; i < args.length; i++) {
+        if (["--target", "--text", "--cta"].includes(args[i]))
+            named[args[i].slice(2)] = args[++i] ?? "";
+        else if (!modes.includes(args[i]))
+            modes.push("?");
+    }
+    if (args[0] !== "broadcast" || modes.length !== 1 || modes[0] === "?" || named.target !== "all" || !named.text || !named.cta) {
+        logError(ADMIN_BROADCAST_USAGE);
+        return 2;
+    }
+    const token = env.AGENTRADAR_ADMIN_TOKEN?.trim();
+    if (!token) {
+        logError("Set AGENTRADAR_ADMIN_TOKEN to an instance admin's board API key");
+        return 2;
+    }
+    const base = (env.AGENTRADAR_API_URL ?? "https://vendor.agentradar.com/api").replace(/\/+$/, "");
+    const res = await (deps.fetch ?? fetch)(`${base}/admin/agent-broadcast`, {
+        method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+        body: JSON.stringify({ target: "all", text: named.text, cta: named.cta, dryRun: modes[0] === "--dry-run" }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        logError(`Refused (${res.status}): ${text}`);
+        return 1;
+    }
+    log(text);
+    return 0;
+}
+//# sourceMappingURL=admin.js.map

package/dist/agent-guard/hooks/hooks.json

@@ -1,12 +1,12 @@
 {
-  "description": "Marks the session as guarded (the runner reports ready only then); blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
+  "description": "Marks the session as guarded (the runner reports ready only then); blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; reports compactions to AgentRadar; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
   "hooks": {
-    "SessionStart": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" start", "timeout": 10 }] }],
-    "Stop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
-    "PreCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }] }],
-    "PostCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }] }],
-    "PreModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreModelSwitch || exit 2", "timeout": 30 }] }],
-    "PostModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostModelSwitch", "timeout": 30 }] }]
+    "SessionStart": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" start", "timeout": 10 }] }],
+    "Stop": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
+    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
+    "PreCompact": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PreCompact", "timeout": 30 }] }],
+    "PostCompact": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PostCompact", "timeout": 30 }] }],
+    "PreModelSwitch": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreModelSwitch || exit 2", "timeout": 30 }] }],
+    "PostModelSwitch": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostModelSwitch", "timeout": 30 }] }]
   }
 }

package/dist/agent-guard/scripts/compaction-report.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// Reports this session's compactions to AgentRadar (Vadym 11657). Registered for PreCompact and PostCompact as
+// `compaction-report.mjs <event>`; JSON on stdin. Observation only: it never blocks (exit 0 whatever happens).
+// PostCompact stdin carries no token counts, so they come from the transcript's compact_boundary line.
+import { spawn, spawnSync } from "node:child_process";
+import { closeSync, existsSync, fstatSync, openSync, readFileSync, readSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const ID = /^[a-zA-Z0-9_-]{1,100}$/;
+const TAIL_BYTES = 1024 * 1024;
+/** The last lines of a transcript, read from its last 1 MB only (a long session's file is far larger). */
+const tail = (path) => {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const { size } = fstatSync(fd);
+    const buf = Buffer.alloc(Math.min(size, TAIL_BYTES));
+    readSync(fd, buf, 0, buf.length, size - buf.length);
+    return buf.toString("utf8").split("\n").slice(-200);
+  } catch { return []; } finally { if (fd !== undefined) closeSync(fd); }
+};
+
+/** The newest compact_boundary written at or after `sinceMs`, as { preTokens, postTokens, durationMs }. */
+export function lastBoundary(transcriptPath, sinceMs) {
+  for (const line of tail(transcriptPath).reverse()) {
+    if (!line.includes('"compact_boundary"')) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (Date.parse(entry.timestamp) < sinceMs) return null;
+      const { preTokens = null, postTokens = null, durationMs = null } = entry.compactMetadata ?? {};
+      return { preTokens, postTokens, durationMs };
+    } catch { /* partial line: keep looking */ }
+  }
+  return null;
+}
+
+/** One hook call. `send` posts a report; `stateDir` holds the start time between the two hooks. */
+export async function reportCompaction(event, input, { send, followUp, stateDir = tmpdir(), now = Date.now }) {
+  if (input?.hook_event_name !== event || !ID.test(input.session_id ?? "")) return;
+  const marker = join(stateDir, `agentradar-compaction-${input.session_id}.json`);
+  const trigger = typeof input.trigger === "string" ? input.trigger.slice(0, 40) : null;
+  if (event === "PreCompact") {
+    writeFileSync(marker, JSON.stringify({ at: now() }), { mode: 0o600 });
+    return send({ phase: "start", trigger });
+  }
+  if (event !== "PostCompact") return;
+  let startedAt = now();
+  if (existsSync(marker)) { try { startedAt = JSON.parse(readFileSync(marker, "utf8")).at; } catch { /* keep now */ } }
+  rmSync(marker, { force: true });
+  // The compact_boundary line (the only source of token counts) is written after this hook returns, so it is
+  // reported separately, by a detached follow-up; this report must not wait for it.
+  send({ phase: "end", outcome: "ok", trigger, durationMs: now() - startedAt });
+  return followUp?.({ transcriptPath: input.transcript_path, startedAt, trigger });
+}
+
+/** Detached follow-up: waits up to `waitMs` for the boundary this compaction wrote, then reports its token counts. */
+export async function reportTokens({ transcriptPath, startedAt, trigger }, { send, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), waitMs = 60_000, pollMs = 500 }) {
+  for (let waited = 0; waited <= waitMs; waited += pollMs) {
+    const boundary = lastBoundary(transcriptPath, startedAt - 1_000);
+    if (boundary) return send({ phase: "tokens", trigger, ...boundary });
+    await sleep(pollMs);
+  }
+}
+
+const sendToServer = (report) => spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
+  ["call", process.env.AR_CLI_RUNNER_ID || "hosted", "report_compaction", "--args", JSON.stringify(report)], { encoding: "utf8", timeout: 20_000 });
+const spawnFollowUp = (job) => spawn(process.execPath, [fileURLToPath(import.meta.url), "tokens", JSON.stringify(job)], { detached: true, stdio: "ignore" }).unref();
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    if (process.argv[2] === "tokens") await reportTokens(JSON.parse(process.argv[3]), { send: sendToServer });
+    else await reportCompaction(process.argv[2], JSON.parse(readFileSync(0, "utf8")), { send: sendToServer, followUp: spawnFollowUp });
+  } catch { /* observation only */ }
+}

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -20,6 +20,12 @@ You act through `agentradar call <runner-id> <tool>`. Your runner id is in `$AR_
 
 The Stop hook runs the same check and will not let you stop while something is owed.
 
+## Hosted workspace lifetime
+
+There is no runtime cap. Running turns, tools and background jobs keep your hosted workspace awake, even when they are silent; only a truly idle workspace auto-stops. Save checkpoints and results to files as you work: a deployment or unexpected stop can still end processes. After a restart notice, check those files and restart unfinished work idempotently; never assume an old background process resumed.
+
+In a hosted workspace, every teammate you start keeps its own process in the workspace memory, even while it waits. At most 2 can run at once; a 3rd start is refused. As soon as a teammate is idle or its work is done, stop it: `SendMessage` it `{"type":"shutdown_request"}` and let it shut down. Start a new one when new work needs it.
+
 ## Always
 
 - Answer every message in the channel it came from. A human who wrote is waiting for you; answer them first.

package/dist/agentradar-vendor/SKILL.md

@@ -1,30 +1,32 @@
 ---
 name: agentradar-vendor
 description: >
-  Run an AgentRadar vendor agent on vendor-owned compute through the single
-  AgentRadar MCP. Use when receiving client work, replying, reporting usage,
+  Run an AgentRadar vendor agent on vendor-owned compute through the
+  AgentRadar CLI. Use when receiving client work, replying, reporting usage,
   or checking context for an AgentRadar engagement.
 ---
 
 # AgentRadar vendor agent
 
-You work on the vendor's computer and connect to AgentRadar through the `agentradar` MCP only. AgentRadar holds every client channel credential; never ask for or store a client's Slack, email, Telegram, or AgentRadar token.
+Every tool named in this skill runs as `agentradar run $AR_CLI_RUNNER_ID <tool>`; add `--help` for its arguments. AgentRadar is CLI-only: there is no AgentRadar MCP to connect to.
+
+You work on the vendor's computer and act on AgentRadar through the `agentradar` CLI only (`agentradar run $AR_CLI_RUNNER_ID <tool>`). AgentRadar holds every client channel credential; never ask for or store a client's Slack, email, Telegram, or AgentRadar token.
 
 ## Authentication
 
 - Authenticate Claude Code interactively with `/login` and the vendor's claude.ai subscription.
 - Never use `ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN`.
-- Never print, inspect, copy, or move the AgentRadar MCP authorization header. The setup CLI stores it in the project-local entry of `~/.claude.json`, outside the project repository.
+- Never print, inspect, copy, or move the AgentRadar key. The setup CLI stores it in your runner config under `~/.agentradar/agents/`, outside the project repository.
 
 ## Start of every session
 
-Call `get_my_context` on the AgentRadar MCP FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
+Run `get_my_context` FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
 
 Keep each human's page in company memory current, every fact cited, as the Humans section of the `agentradar-memory-and-skills` skill says. A page is knowledge, never permission.
 
 In your first session, call `read_onboarding_obligations` once (reading them acknowledges the safety rules), then `read_readiness`.
 
-Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
+Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`, `start_recurring_task`, `archive_recurring_task`, `restore_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
 
 ## Talking to humans
 
@@ -32,10 +34,10 @@ Write to humans so a 13-year-old would understand: a few short plain lines, then
 
 ## Work loop
 
-1. Use the AgentRadar MCP to receive the next event or assigned work.
+1. Run `agentradar run $AR_CLI_RUNNER_ID inbox next` to receive the next event or assigned work.
 2. Read the supplied engagement context before acting.
 3. Do the work in this project folder on the vendor's compute.
-4. Reply through the MCP so AgentRadar can enforce the client boundary and audit the action.
-5. Report actual usage through the MCP when the work incurs billable time or metered extras.
+4. Reply with `agentradar run $AR_CLI_RUNNER_ID reply` so AgentRadar can enforce the client boundary and audit the action.
+5. Report actual usage with `report_usage` when the work incurs billable time or metered extras.
 
-Do not connect directly to a client's workspace or bypass the MCP with direct channel/API calls.
+Do not connect directly to a client's workspace or bypass AgentRadar with direct channel/API calls.

package/dist/channel.js

@@ -1,34 +1,60 @@
 import { randomUUID } from "node:crypto";
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { existsSync, statSync } from "node:fs";
+import { readFile, rm } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
-import { envValue } from "./tool-run.js";
+import { awpEndpoint } from "./tool-run.js";
+import { noteCliUpdate } from "./update.js";
 import { trustedMcpEndpoint } from "./setup.js";
 import { syncJoinedSkills } from "./skill-install.js";
-export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Call next_event to receive the events, then pass their eventIds as ackEventIds on your next call. Answer livenessProbe with liveness_ack. Never acknowledge an event you have not read. Never poll next_event on your own or keep a loop running: when a channel message arrives, drain it, then end your turn.";
-export const CHANNEL_BLOCKED = "AgentRadar has not observed a next_event call from this session. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: run your join again with --feeder (agentradar join <your join link> --feeder). Your company sees this agent as not receiving messages until one or the other works.";
-/** One local MCP, forwarding tools to AWP. Wake signals never consume the durable queue. */
+export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Receive the events with `agentradar run $AR_CLI_RUNNER_ID inbox next`; the next call acknowledges the batch you read. Answer a liveness check with `agentradar run $AR_CLI_RUNNER_ID liveness_ack --nonce <nonce>`. Never acknowledge an event you have not read. Never poll on your own or keep a loop running: when a channel message arrives, drain it, then end your turn.";
+export const CHANNEL_BLOCKED = "AgentRadar has not seen this session run `agentradar run $AR_CLI_RUNNER_ID inbox next`. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Your company sees this agent as not receiving messages until the channel works.";
+// The runner's frame text (templates/vendor-runner, shipped beside this file as dist/vendor-runner), so both say a restart one way.
+const runnerFrame = () => import(new URL(import.meta.url.endsWith(".ts")
+    ? "../../../templates/vendor-runner/session-frame.mjs" : "./vendor-runner/session-frame.mjs", import.meta.url).href);
+/** The channel: a local stdio MCP with no tools, only wake signals. The agent acts through the CLI; wake signals never consume the durable queue. */
+/** The wake line. Zero events never says "run inbox next": that call has nothing to return. Each reason names its own tool. */
+export function wakeText(runnerId, count, payload) {
+    const run = `agentradar run ${runnerId}`;
+    if (count)
+        return `${payload.firstStep ? `${payload.firstStep} ` : ""}${count} new AgentRadar events; run \`${run} inbox next\`${payload.livenessProbe ? " to receive your liveness check" : ""}.`;
+    return [
+        payload.onboarding && `AgentRadar session started, no messages waiting. Run \`${run} get_my_context\` now for your identity, peers and rules.`,
+        payload.livenessProbe && `AgentRadar liveness check, no messages waiting. Run \`${run} liveness_ack --nonce ${payload.livenessProbe.nonce}\` now.`,
+    ].filter(Boolean).join(" ");
+}
 export async function startChannel(runnerId, deps = {}) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
         throw new Error("Invalid runner ID");
     const home = deps.home ?? homedir();
-    const config = await readFile(join(home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
-    const endpoint = trustedMcpEndpoint(envValue(config, "AWP_MCP_URL") ?? "");
-    const bearer = envValue(config, "AWP_BEARER");
-    if (!endpoint || !bearer)
-        throw new Error("Runner configuration requires a trusted AWP_MCP_URL and AWP_BEARER");
     const output = deps.output ?? process.stdout;
     const logError = deps.logError ?? console.error;
+    // The runner file, else a hosted session's own PAPERCLIP_API_* (hosted-session-start.mjs puts them in this server's env).
+    const target = await awpEndpoint(runnerId, { home, logError });
+    const endpoint = trustedMcpEndpoint(target?.url ?? "");
+    const bearer = target?.bearer;
+    if (!endpoint || !bearer)
+        throw new Error("Runner configuration requires a trusted AWP_MCP_URL and AWP_BEARER");
+    // TRC-RESTART-REASON: the hosted bridge leaves why the last workspace stopped; the first wake with work says it, once.
+    const notice = join(home, ".agentradar", "run", "restart-notice.json");
     const sessionId = randomUUID();
     const stop = new AbortController();
     let sequence = 0;
     let polling = false;
     let agentPolled = false;
+    const startedAt = Date.now();
+    // The CLI rewrites <runner>.delivered.json after every `inbox next`, so a newer mtime is the session having polled.
+    const delivered = join(home, ".agentradar", "agents", `${runnerId}.delivered.json`);
+    const polled = () => agentPolled ||= (() => { try {
+        return statSync(delivered).mtimeMs >= startedAt;
+    }
+    catch {
+        return false;
+    } })();
     // Vadym 10342: an unconfirmed channel is reported to AgentRadar (runnerState channel_unconfirmed), so the owner sees
-    // the agent is not receiving messages; "ready" again once the session does call next_event.
+    // the agent is not receiving messages; "ready" again once the session does run `inbox next`.
     let unconfirmed = null;
     let warning;
     let skillSync;
@@ -39,10 +65,11 @@ export async function startChannel(runnerId, deps = {}) {
         const response = await (deps.fetch ?? fetch)(endpoint, {
             method: "POST",
             redirect: "error",
-            headers: { "x-agentradar-cli": createRequire(import.meta.url)("../package.json").version, authorization: `Bearer ${bearer}`, "content-type": "application/json", accept: "application/json, text/event-stream" },
+            headers: { "x-agentradar-cli": createRequire(import.meta.url)("../package.json").version, "x-agentradar-surface": "channel", authorization: `Bearer ${bearer}`, "content-type": "application/json", accept: "application/json, text/event-stream" },
             body: JSON.stringify({ jsonrpc: "2.0", id: ++sequence, method, params }),
             signal: AbortSignal.any([stop.signal, AbortSignal.timeout(230_000)]),
         });
+        await noteCliUpdate(response.headers, logError);
         if (!response.ok) {
             const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;
             throw new Error(said ?? `AgentRadar refused the channel call (${response.status})`);
@@ -54,9 +81,14 @@ export async function startChannel(runnerId, deps = {}) {
         return JSON.parse(json);
     };
     const next = (args = {}) => remote("tools/call", { name: "next_event", arguments: { ...args, sessionId } });
-    const pause = () => new Promise((resolve) => {
-        const done = () => { clearTimeout(timer); stop.signal.removeEventListener("abort", done); resolve(); };
+    // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
+    const guardLoaded = () => !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
+    const pause = (until) => new Promise((resolve) => {
+        const done = () => { clearTimeout(timer); clearInterval(watch); stop.signal.removeEventListener("abort", done); resolve(); };
         const timer = setTimeout(done, deps.retryMs ?? 3_000);
+        // COLD-START-WARMUP: a booting session's work is held until it polls ready, so poll the moment the marker lands.
+        const watch = until && setInterval(() => { if (until())
+            done(); }, 100);
         stop.signal.addEventListener("abort", done, { once: true });
         if (stop.signal.aborted)
             done();
@@ -65,8 +97,10 @@ export async function startChannel(runnerId, deps = {}) {
         let lastWake = "";
         let lastSent = 0;
         let selftestStarted = false;
+        let guarded = true;
         while (!stop.signal.aborted) {
             try {
+                guarded = guardLoaded(); // first, so a call that throws after the marker lands still gets the full pause
                 if (!selftestStarted) {
                     // Establish the heartbeat without entering the empty queue's 200-second hold first.
                     const connected = await next({ runnerState: "starting" });
@@ -81,11 +115,9 @@ export async function startChannel(runnerId, deps = {}) {
                     await next({ runnerState: "channel_unconfirmed" });
                     unconfirmed = "reported";
                 }
-                if (unconfirmed === "reported" && agentPolled)
+                if (unconfirmed === "reported" && polled())
                     unconfirmed = null;
                 // While reported, no runnerState: the stored state stands, and the poll still drains for wake signals.
-                // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
-                const guarded = !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
                 const response = await next(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" });
                 if (response.error || response.result?.isError)
                     throw new Error("AgentRadar refused next_event; check the runner key and its poll permission");
@@ -94,10 +126,13 @@ export async function startChannel(runnerId, deps = {}) {
                 const events = payload.events ?? [];
                 const wake = JSON.stringify([events.map((event) => event.eventId), payload.livenessProbe?.nonce, Boolean(payload.onboarding)]);
                 if ((events.length || payload.livenessProbe || payload.onboarding) && (wake !== lastWake || Date.now() - lastSent >= 30_000)) {
+                    const restart = events.length ? (await runnerFrame()).restartLine(await readFile(notice, "utf8").then(JSON.parse, () => null), runnerId) : "";
                     await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: {
-                            content: `${payload.firstStep ? `${payload.firstStep} ` : ""}${events.length} new AgentRadar events; call next_event${payload.livenessProbe ? " to receive your liveness check" : ""}.`,
+                            content: `${restart ? `${restart} ` : ""}${wakeText(runnerId, events.length, payload)}`,
                             meta: { count: String(events.length) },
                         } });
+                    if (restart)
+                        await rm(notice, { force: true });
                     lastWake = wake;
                     lastSent = Date.now();
                 }
@@ -109,14 +144,14 @@ export async function startChannel(runnerId, deps = {}) {
                 if (!stop.signal.aborted)
                     logError(/below the minimum/.test(said) ? said : "AgentRadar channel poll failed; retrying. Check connectivity and the runner key.");
             }
-            await pause();
+            await pause(guarded ? undefined : guardLoaded);
         }
     };
     const handle = async (message) => {
         if (message.method === "initialize") {
             await send({ jsonrpc: "2.0", id: message.id, result: {
                     protocolVersion: "2024-11-05",
-                    capabilities: { tools: {}, experimental: { "claude/channel": {} } },
+                    capabilities: { experimental: { "claude/channel": {} } },
                     serverInfo: { name: "agentradar", version: createRequire(import.meta.url)("../package.json").version },
                     instructions: CHANNEL_GUIDANCE,
                 } });
@@ -124,7 +159,7 @@ export async function startChannel(runnerId, deps = {}) {
         else if (message.method === "notifications/initialized") {
             if (!polling) {
                 polling = true;
-                warning = setTimeout(() => { if (!agentPolled) {
+                warning = setTimeout(() => { if (!polled()) {
                     logError(CHANNEL_BLOCKED);
                     unconfirmed = "pending";
                 } }, deps.confirmMs ?? 30_000);
@@ -142,16 +177,6 @@ export async function startChannel(runnerId, deps = {}) {
             if (message.method === "ping") {
                 await send({ jsonrpc: "2.0", id: message.id, result: {} });
             }
-            else if (message.method === "tools/list" || message.method === "tools/call") {
-                const params = message.params ?? {};
-                const isNext = message.method === "tools/call" && params.name === "next_event";
-                const response = isNext ? await next(params.arguments ?? {}) : await remote(message.method, params);
-                if (isNext && !response.error && !response.result?.isError) {
-                    agentPolled = true;
-                    clearTimeout(warning);
-                }
-                await send({ jsonrpc: "2.0", id: message.id, ...(response.error ? { error: response.error } : { result: response.result }) });
-            }
             else {
                 await send({ jsonrpc: "2.0", id: message.id, error: { code: -32601, message: "Method not found" } });
             }