agentradar-cli 0.3.5 → 0.3.7

package/dist/setup.js

@@ -8,6 +8,7 @@ import { homedir } from "node:os";
 import * as tls from "node:tls";
 import { promisify } from "node:util";
 import { syncJoinedSkills } from "./skill-install.js";
+import { cliHeader, noteCliUpdate } from "./update.js";
 const DEFAULT_API_URL = "https://vendor.agentradar.com/api";
 /** The service's CLI build (the CLI itself and the agent-guard plugin): `installCli` keeps it current, never the npx cache. */
 const cliDist = (home) => join(home, ".agentradar", "cli", "current", "dist");
@@ -28,11 +29,13 @@ const SUPERVISOR_HARNESS = {
     generic: "generic",
 };
 async function postJson(fetchImpl, url, body) {
-    return fetchImpl(url, {
+    const response = await fetchImpl(url, {
         method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json", "cache-control": "no-store" },
+        headers: { ...(await cliHeader()), "content-type": "application/json", accept: "application/json", "cache-control": "no-store" },
         body: JSON.stringify(body),
     });
+    await noteCliUpdate(response.headers);
+    return response;
 }
 /**
  * The server's own words for a refusal, when it sent any.
@@ -117,7 +120,7 @@ export function trustedMcpEndpoint(value) {
         endpoint.hostname.endsWith(".localhost"));
     return endpoint.protocol === "https:" || loopbackHttp ? endpoint : null;
 }
-/** `installation: null` (join) removes the project's `agentradar` entry: a joined agent acts through `agentradar run`. */
+/** AgentRadar is CLI-only: a project entry for `agentradar` is only ever removed (never written), and an agent acts through `agentradar run`. */
 async function installProjectMcp(configPath, cwd, installation, trust, 
 /** Vadym 10342: a joined Claude Code agent's AgentRadar channel (`agentradar channel <runner-id>`, stdio). */
 channel) {
@@ -153,14 +156,6 @@ channel) {
     if (channel) {
         mcpServers.agentradar = channel;
     }
-    else if (installation && endpoint) {
-        mcpServers.agentradar = {
-            type: "http",
-            url: endpoint.toString(),
-            headers: { Authorization: `Bearer ${installation.bearer}` },
-            timeout: 1_800_000,
-        };
-    }
     else {
         delete mcpServers.agentradar;
     }
@@ -178,6 +173,68 @@ channel) {
     await chmod(configPath, 0o600);
     return projectPath;
 }
+/** Drop the `[mcp_servers.agentradar]` table (and its sub-tables) when it is the old HTTP one (has a `url`). Null = nothing to drop. */
+export function stripCodexAgentradar(toml) {
+    const lines = toml.split("\n");
+    const out = [];
+    let dropped = false;
+    for (let i = 0; i < lines.length; i++) {
+        if (!/^\s*\[\s*mcp_servers\s*\.\s*["']?agentradar["']?\s*[\].]/.test(lines[i])) {
+            out.push(lines[i]);
+            continue;
+        }
+        let end = i + 1;
+        while (end < lines.length && !/^\s*\[/.test(lines[end]))
+            end++;
+        // A following [mcp_servers.agentradar.http_headers] belongs to the same entry.
+        while (end < lines.length && /^\s*\[\s*mcp_servers\s*\.\s*["']?agentradar["']?\s*\./.test(lines[end])) {
+            end++;
+            while (end < lines.length && !/^\s*\[/.test(lines[end]))
+                end++;
+        }
+        if (/^\s*url\s*=/m.test(lines.slice(i, end).join("\n"))) {
+            dropped = true;
+            i = end - 1;
+        }
+        else
+            out.push(lines[i]);
+    }
+    return dropped ? out.join("\n") : null;
+}
+/** Upgrade and sync: remove the old AgentRadar HTTP MCP entry an older `agentradar setup` or join wrote: Claude's project entry, the project .mcp.json and ~/.codex/config.toml. Silent unless it removes one. */
+export async function dropStaleMcp(cwd, home, log = console.log, env = process.env) {
+    const said = (where) => log(`Removed the old AgentRadar MCP entry from ${where}: AgentRadar is CLI-only now, use agentradar run <runner-id> <tool>.`);
+    const configPath = claudeConfigPath(home, env);
+    try {
+        const projectPath = await realpath(cwd);
+        const config = JSON.parse(await readFile(configPath, "utf8"));
+        if (config.projects?.[projectPath]?.mcpServers?.agentradar?.type === "http") {
+            await installProjectMcp(configPath, cwd, null, false);
+            said(configPath);
+        }
+    }
+    catch { /* no Claude config, or not a project it knows: nothing stale to remove */ }
+    const mcpJson = join(cwd, ".mcp.json");
+    try {
+        const parsed = JSON.parse(await readFile(mcpJson, "utf8"));
+        const entry = parsed.mcpServers?.agentradar;
+        if (entry && (entry.type === "http" || entry.url)) {
+            delete parsed.mcpServers.agentradar;
+            await writeFile(mcpJson, `${JSON.stringify(parsed, null, 2)}\n`);
+            said(mcpJson);
+        }
+    }
+    catch { /* no .mcp.json, or not JSON we can edit: leave it */ }
+    const codexToml = join(env.CODEX_HOME?.trim() || join(home, ".codex"), "config.toml");
+    try {
+        const stripped = stripCodexAgentradar(await readFile(codexToml, "utf8"));
+        if (stripped !== null) {
+            await writeFile(codexToml, stripped);
+            said(codexToml);
+        }
+    }
+    catch { /* no Codex config: nothing stale to remove */ }
+}
 export function shellValue(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -392,7 +449,7 @@ async function installRunner(home, projectPath, approved, service, feed) {
     const envPath = join(agentDir, `${approved.runnerId}.env`);
     const joined = [];
     if (service) {
-        joined.push(`AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`, `AR_AGENTRADAR_BIN=${shellValue(join(cliDist(home), "index.js"))}`);
+        joined.push(`AR_AGENTRADAR_BIN=${shellValue(join(cliDist(home), "index.js"))}`);
         let toolKeys = [];
         if (harness === "codex") {
             const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
@@ -412,32 +469,43 @@ async function installRunner(home, projectPath, approved, service, feed) {
             ...(service.env.AGENTRADAR_INPUT_READY_PATTERN ? [`AR_INPUT_READY_PATTERN=${shellValue(service.env.AGENTRADAR_INPUT_READY_PATTERN)}`] : []), `AGENT_PID_PATTERN=${shellValue(basename(bin).replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))}`);
         }
         else {
-            // The caller's own conversation, both times: a resume that fails tries it once more, never a fresh session.
-            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`);
-            // A person's model switch: the feeder and agent-guard's hooks meet in this directory, keyed by the session.
-            joined.push(`AR_CLAUDE_SESSION_ID=${shellValue(service.sessionId)}`, `AR_MODEL_SWITCH_DIR=${shellValue(join(configDir, "model-switch"))}`);
-            const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
-            if (configDirEnv)
-                joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
+            if (service.inPlace)
+                joined.push("AR_INPLACE=1"); // the user's own launcher runs claude; no supervisor reads this file
+            else {
+                // The caller's own conversation, both times: a resume that fails tries it once more, never a fresh session.
+                joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`);
+                // A person's model switch: the feeder and agent-guard's hooks meet in this directory, keyed by the session.
+                joined.push(`AR_CLAUDE_SESSION_ID=${shellValue(service.sessionId)}`, `AR_MODEL_SWITCH_DIR=${shellValue(join(configDir, "model-switch"))}`);
+                const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
+                if (configDirEnv)
+                    joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
+            }
             // agent-guard, enabled for this session only (`--settings`), loaded from the copy inside this package, with
             // its plugin state under the runner's config so the vendor's own Claude plugins are never touched.
             const settings = join(configDir, "agentradar-settings.json");
             await writePrivateFile(settings, `${JSON.stringify({
                 extraKnownMarketplaces: { agentradar: { source: { source: "directory", path: join(cliDist(home), "agent-guard") } } },
                 enabledPlugins: { "agent-guard@agentradar": true },
+                // Vadym 12201: AskUserQuestion blocks the turn on a pick nobody at the pane makes, stalling every channel.
+                permissions: { deny: ["AskUserQuestion"] },
                 // Nobody sits at the pane to accept bypass mode's warning screen; the operator's consent was given at approval.
                 ...(service.bypass ? { skipDangerousModePermissionPrompt: true } : {}),
             }, null, 2)}\n`);
-            if (service.bypass)
-                joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
-            joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
+            if (!service.inPlace) {
+                if (service.bypass)
+                    joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
+                joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
+                // Vadym 13444: the agent keeps every MCP and channel it already has; AgentRadar's channel is added next to them.
+                joined.push("AR_MCP_STRICT=0");
+            }
         }
         if (service.attach) {
             // The caller's own tmux pane: the feeder types into it; the supervisor never starts, kills or streams it.
             // TMUX names the caller's tmux server, which a service started by launchd or systemd would not find.
             joined.push("AR_ATTACH=1", `TMUX_SESSION=${shellValue(service.attach)}`, "TERMINAL_BRIDGE_ENABLED=0", ...(service.env.TMUX ? [`TMUX=${shellValue(service.env.TMUX)}`] : []), ...(harness === "generic" ? [] : [`AGENT_PID_PATTERN=${shellValue(`(^|/)${harness ?? "claude"}( |$)`)}`]));
         }
-        const toolEnv = Object.entries(service.env)
+        // An in-place join has no supervisor to read tool.env, so the caller's gateway credentials are not copied to disk.
+        const toolEnv = service.inPlace ? [] : Object.entries(service.env)
             .filter(([key, value]) => (TOOL_ENV.test(key) || toolKeys.includes(key)) && key !== "ANTHROPIC_API_KEY" && value && !value.includes("\n"))
             .map(([key, value]) => `${key}=${value}`);
         if (toolEnv.length) {
@@ -450,21 +518,15 @@ async function installRunner(home, projectPath, approved, service, feed) {
     // the service runs; the supervisor adds --dangerously-load-development-channels server:agentradar.
     await writePrivateFile(mcpConfig, `${JSON.stringify(feed === "push"
         ? { mcpServers: { agentradar: { type: "stdio", command: process.execPath, args: [join(cliDist(home), "index.js"), "channel", approved.runnerId] } } }
-        : service ? { mcpServers: {} } : {
-            mcpServers: {
-                agentradar: {
-                    type: "http",
-                    url: endpoint.toString(),
-                    headers: { Authorization: `Bearer ${approved.installation.bearer}` },
-                },
-            },
-        }, null, 2)}\n`);
+        : { mcpServers: {} }, null, 2)}\n`);
     await writePrivateFile(envPath, [
         `AGENT_NAME=${shellValue(approved.runnerId)}`,
         `AR_BASE=${shellValue(projectPath)}`,
         `AWP_MCP_URL=${shellValue(endpoint.toString())}`,
         `AWP_BEARER=${shellValue(approved.installation.bearer)}`,
         `MCP_CONFIG=${shellValue(mcpConfig)}`,
+        // Every convention line in the brief and skills says `agentradar run $AR_CLI_RUNNER_ID <tool>`.
+        `AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`,
         // Written only when the vendor declared a runtime. An absent variable is the supervisor's own
         // default, so writing `AR_AGENT_HARNESS=claude` unconditionally would change nothing except to make
         // every existing env file look as though a choice had been made.
@@ -542,17 +604,17 @@ export async function setupVendorAgent(deps = {}) {
         const runnerEnv = await installRunner(home, projectPath, approved);
         // Print the path, not just "installed". D3 was a silent write to the wrong file under a
         // relocated CLAUDE_CONFIG_DIR; naming the target turns that class of failure into a glance.
-        log(`AgentRadar MCP installed for this project → ${configPath}`);
+        log(`AgentRadar runner set up for this project (no MCP entry; the agent acts through agentradar run) → ${configPath}`);
         log(trust
             ? `--trust: pre-accepted the trust dialog for ${projectPath}. Claude Code will run this folder's existing hooks and settings without asking.`
-            : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just this MCP. Re-run with --trust for unattended onboarding.`);
+            : `Claude Code will ask you to trust ${projectPath} on first launch — approve it there. Not pre-accepted, because that would trust everything already in the folder, not just AgentRadar. Re-run with --trust for unattended onboarding.`);
         log(`Runner installed → ${runnerEnv}`);
         if ((approved.harness ?? "").trim().toLowerCase() === "codex") {
             // Said BEFORE the vendor runs the runner, because the supervisor's refusal comes after they
             // think setup succeeded. Codex reads its MCP servers from $CODEX_HOME/config.toml — there is no
             // `--strict-mcp-config` to point at the file this setup just wrote — so the isolation boundary is
             // a per-agent home the vendor supplies, and the supervisor fails closed without it.
-            log(`This agent runs on Codex. Set CODEX_HOME in ${runnerEnv} to a per-agent Codex home whose config.toml declares ONLY the AgentRadar MCP server; the runner refuses to start without it.`);
+            log(`This agent runs on Codex. Set CODEX_HOME in ${runnerEnv} to a per-agent Codex home whose config.toml declares no MCP servers (the agent acts through the CLI); the runner refuses to start without it.`);
         }
         log(`Start it with: agentradar runner start ${approved.runnerId}`);
         log("On macOS the runner uses your existing Claude Code Keychain-backed login. CLAUDE_CODE_OAUTH_TOKEN is ignored; ANTHROPIC_API_KEY is prohibited.");
@@ -561,6 +623,7 @@ export async function setupVendorAgent(deps = {}) {
     throw new Error("AgentRadar setup code expired; run setup again");
 }
 export const bypassOnNotice = (link) => `Bypass-permissions mode is ON on this machine: the agent runs without permission prompts. To turn it off: agentradar join ${link} --revoke-bypass`;
+export const CLAUDE_CHANNEL_ONLY = "A Claude Code agent receives work only through the AgentRadar channel. --feeder, AGENTRADAR_FEED=feeder, --attach-tmux and --attach-current are for Codex and other CLIs; run join again without them.";
 export const BYPASS_REVOKED = "Bypass-permissions mode is off on this machine now; the agent asks before acting again.";
 /** A sortable key for `x.y.z[-pre]`; a release sorts above its prereleases. ponytail: prereleases of one version tie. */
 const versionRank = (version) => {
@@ -667,36 +730,34 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         }
     }
     const label = harness === "generic" ? basename((env.AGENTRADAR_AGENT_BIN ?? "").trim()) : harness === "claude" ? "Claude Code" : "Codex";
-    // Vadym 10342: every Claude Code agent connects through the AgentRadar channel. The tmux feeder is the fallback:
-    // another CLI, an explicit opt-in (--feeder, AGENTRADAR_FEED=feeder, or a pane named with --attach-*), or a
-    // channel the session never confirms (channel.ts reports it and tells the operator to re-run with --feeder).
-    const channel = harness === "claude" && !deps.feeder && env.AGENTRADAR_FEED?.trim().toLowerCase() !== "feeder" && !deps.attach;
+    // Vadym 10342 + 13430: a Claude Code agent connects through the AgentRadar channel only; nothing is ever typed
+    // into its input. The tmux feeder is for the CLIs that have no channel (Codex, generic).
+    const channel = harness === "claude";
+    // Vadym 13444: a Claude Code agent joins in place. Nothing is started, resumed or replaced; the user's own launcher
+    // gets two files and the flags to add (channel-only-claude.md §2). `--service` keeps the AgentRadar-run service.
+    const inPlace = channel && !deps.service;
+    if (channel && (deps.feeder || env.AGENTRADAR_FEED?.trim().toLowerCase() === "feeder" || deps.attach))
+        throw new Error(CLAUDE_CHANNEL_ONLY);
     // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
     // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
     // Which session the agent is, settled before any request: a key is issued once, so never claim one for a session that cannot run.
     const settle = async () => {
         const tmux = deps.tmux ?? (async (args) => (await promisify(execFile)(env.TMUX_BIN || "tmux", args, { env })).stdout);
-        // Attach to the caller when it already lives in tmux: asked for by flag, or a Claude Code session in a tmux
-        // pane. The service's own session (join-<request>) re-running join is not a caller to attach to.
+        // Attach to the caller's tmux pane when asked for by flag (Codex and generic only; Claude Code is refused above).
         let attach = deps.attach === "current" ? env.TMUX_PANE : deps.attach;
         if (deps.attach === "current" && !attach)
             throw new Error("--attach-current needs a session running inside tmux");
-        // Never in channel mode: nothing types into the caller's pane.
-        if (!channel && !deps.attach && harness === "claude" && env.CLAUDECODE && env.TMUX && env.TMUX_PANE)
-            attach = env.TMUX_PANE;
         if (attach) {
             // A pane id (%3) dies with the tmux server; session:window.pane comes back when its session is recreated.
             attach = (await tmux(["display-message", "-p", "-t", attach, "#{session_name}:#{window_index}.#{pane_index}"])).trim();
             if (!attach)
                 throw new Error("tmux found no such pane");
-            if (!deps.attach && attach.startsWith("join-"))
-                attach = undefined;
         }
         // Unattended, the service resumes the caller's own Claude conversation, never a stranger's. An attached
         // pane is never started from here, so there its session id only keys the model switch.
-        const sessionId = harness !== "claude" ? undefined
-            : await callerSession(deps, env, home, await realpath(cwd)).catch((error) => { if (attach || channel)
-                return undefined; throw error; });
+        const sessionId = harness !== "claude" || inPlace ? undefined
+            : await callerSession(deps, env, home, await realpath(cwd)).catch((error) => { if (deps.session)
+                throw error; return undefined; });
         return { attach, sessionId };
     };
     let where;
@@ -705,14 +766,14 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
      * 10-04, after the Codex run stopped on an approval prompt nobody could answer); `--revoke-bypass` takes it
      * back on this machine. An attached pane keeps the permission mode it already runs in.
      */
-    const localBypass = (approvedBypass, revoked) => approvedBypass && !revoked && !where.attach;
+    const localBypass = (approvedBypass, revoked) => approvedBypass && !revoked && !where.attach && !inPlace;
     const startJoined = async (requestId, agentId, installation, approvedBypass, bypass, saved) => {
         const runnerId = `join-${requestId}`;
         const { attach } = where;
         const projectPath = harness === "claude"
             ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
             : await realpath(cwd);
-        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId: where.sessionId ?? requestId, env, attach, bypass }, channel ? "push" : undefined);
+        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId: where.sessionId ?? requestId, env, attach, bypass, inPlace }, channel ? "push" : undefined);
         await saved?.();
         log(`Runner installed → ${runnerEnv}`);
         if (bypass)
@@ -721,6 +782,15 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         await syncJoinedSkills(runnerId, { home, fetch: fetchImpl, log }).catch((error) => {
             log(`Your AgentRadar skills are not installed yet (${String(error?.message ?? error).split("\n")[0]}); the runner installs them once it is running.`);
         });
+        if (inPlace) {
+            const config = join(home, ".agentradar", "config", runnerId);
+            if (approvedBypass)
+                log("Your company allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
+            log(`Connected, nothing started: your session, its MCPs and its channels are untouched. To receive client messages, restart your agent ONCE with these flags added to its own launch command (keep what it already has, including --continue):
+  --mcp-config ${join(config, "awp-only.json")} --dangerously-load-development-channels server:agentradar --settings ${join(config, "agentradar-settings.json")}
+and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time development-channel prompt when it appears. To stop: agentradar leave ${runnerId}, then drop those flags.`);
+            return 0;
+        }
         try {
             await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
         }
@@ -738,14 +808,10 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         const mode = bypass ? ", in bypass-permissions mode as your company allowed" : "";
         if (channel) {
             log(`Connected through the AgentRadar channel. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): client messages are pushed into it and it answers there, with no restart from you. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`);
-            log(`If your company's Claude plan blocks channels, deliver with the feeder instead: agentradar join ${enrolmentUrl} --feeder`);
             log("Running as a service; it restarts on crash and reboot.");
             return 0;
         }
-        // Only Claude resumes the caller's own conversation; Codex and a generic CLI start their own session.
-        log(harness === "claude"
-            ? `Connected. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`
-            : `Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        log(`Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
         log("Running as a service; it restarts on crash and reboot.");
         return 0;
     };
@@ -937,8 +1003,8 @@ export async function leaveOrganisation(runnerId, deps = {}) {
         await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
     }
     // The service stopping leaves the session running; `=` matches the tmux session name exactly.
-    // An attached pane is the caller's own session: it stays.
-    if (envValue(saved, "AR_ATTACH") !== "1")
+    // An attached pane or an in-place join is the caller's own session: it stays.
+    if (envValue(saved, "AR_ATTACH") !== "1" && envValue(saved, "AR_INPLACE") !== "1")
         await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
     for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
         await rm(path, { force: true });

package/dist/skill-install.js

@@ -1,9 +1,8 @@
-import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { basename, dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 const MANAGED_MARK = ".agentradar-managed";
-const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,99}$/;
 async function ensureDirectory(path) {
     try {
         const info = await lstat(path);
@@ -44,76 +43,10 @@ export async function installVendorSkill(deps = {}) {
     await writeFile(join(skillDir, MANAGED_MARK), "Written by AgentRadar; replaced on every sync.\n");
     (deps.log ?? console.log)("AgentRadar vendor skill installed for this project.");
 }
-const isManaged = async (dir) => (await lstat(dir).then((info) => info.isDirectory(), () => false)) && (await lstat(join(dir, MANAGED_MARK)).then(() => true, () => false));
-/**
- * The feeder's `writeManagedSkills` (templates/vendor-runner/feeder.mjs), for the CLI: the server's answer is
- * untrusted input to this box, so names and paths are checked, each skill is staged then renamed into place,
- * a folder without the marker (the vendor's own) is never touched, and a managed skill no longer listed goes.
- */
-const sameSkill = async (dir, files) => {
-    try {
-        const have = [];
-        for (const p of await readdir(dir, { recursive: true }))
-            if (p !== MANAGED_MARK && (await stat(join(dir, p))).isFile())
-                have.push(p);
-        for (const f of files)
-            if (await readFile(join(dir, f.path), "utf8") !== f.content)
-                return false;
-        return have.length === files.length;
-    }
-    catch {
-        return false;
-    }
-};
+const runnerSkills = () => import(new URL(import.meta.url.endsWith(".ts")
+    ? "../../../templates/vendor-runner/feeder.mjs" : "./vendor-runner/feeder.mjs", import.meta.url).href);
 export async function writeManagedSkills(skillsDir, skills) {
-    await mkdir(skillsDir, { recursive: true });
-    const written = new Set();
-    for (const skill of skills) {
-        const name = String(skill?.name ?? "");
-        const target = join(skillsDir, name);
-        if (!SKILL_NAME.test(name))
-            continue;
-        if (await lstat(target).then(() => true, () => false) && !(await isManaged(target)))
-            continue;
-        const files = (Array.isArray(skill.files) ? skill.files : []);
-        if (files.some((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
-            || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path))))
-            continue;
-        // An unchanged skill is not rewritten: the agent's CLI may be reading it.
-        if (await sameSkill(target, files)) {
-            written.add(name);
-            continue;
-        }
-        const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
-        const old = join(skillsDir, `.${name}.old-${process.pid}`);
-        try {
-            await rm(staging, { recursive: true, force: true });
-            for (const f of files) {
-                await mkdir(dirname(join(staging, f.path)), { recursive: true });
-                await writeFile(join(staging, f.path), f.content);
-            }
-            await writeFile(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
-            // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
-            await rm(old, { recursive: true, force: true });
-            await rename(target, old).catch((err) => { if (err?.code !== "ENOENT")
-                throw err; });
-            await rename(staging, target);
-            await rm(old, { recursive: true, force: true });
-            written.add(name);
-        }
-        catch {
-            await rm(staging, { recursive: true, force: true });
-            if (!(await lstat(target).then(() => true, () => false)))
-                await rename(old, target).catch(() => { });
-            if (await isManaged(target))
-                written.add(name);
-        }
-    }
-    for (const entry of await readdir(skillsDir)) {
-        if (!written.has(entry) && await isManaged(join(skillsDir, entry)))
-            await rm(join(skillsDir, entry), { recursive: true, force: true });
-    }
-    return [...written];
+    return (await runnerSkills()).writeManagedSkills(skillsDir, skills);
 }
 /**
  * R650 — a joined agent's AgentRadar skills (`my_skills`: the bundled set plus the ones linked to it), written
@@ -149,22 +82,25 @@ export function skillsDirFor(harness, env) {
     return dir.includes("\0") ? null : join(dir);
 }
 export async function syncJoinedSkills(runnerId, deps) {
-    const env = await readFile(join(deps.home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
-    const harness = envValue(env, "AR_AGENT_HARNESS");
-    const skillsDir = skillsDirFor(harness, (name) => name === "HOME" ? deps.home : envValue(env, name));
+    const file = await readFile(join(deps.home, ".agentradar", "agents", `${runnerId}.env`), "utf8").catch(() => null);
+    // A hosted session has no runner file: it is Claude Code, and its channel's env carries AR_BASE (hosted-session-start.mjs).
+    const value = (name) => file === null ? process.env[name] ?? null : envValue(file, name);
+    const harness = file === null ? "claude" : value("AR_AGENT_HARNESS");
+    const skillsDir = skillsDirFor(harness, (name) => name === "HOME" ? deps.home : value(name));
     if (!skillsDir)
         return;
     const codex = harness === "codex";
-    const root = (codex ? envValue(env, "CODEX_HOME") : envValue(env, "AR_BASE")) ?? "";
+    const root = (codex ? value("CODEX_HOME") : value("AR_BASE")) ?? "";
     // Vadym 9988: the server's start instructions with this agent's brief, before its first session starts.
     // Same file and mark as the runner's feeder, which keeps it fresh from then on.
     const init = await awpRequest(runnerId, "initialize", {
         protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-cli", version: "1.0.0" },
-    }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
     const briefFile = codex ? join(root, "AGENTS.md") : join(root, ".claude", "rules", "agentradar-brief.md");
     if (root && init?.result?.instructions)
         await writeBrief(briefFile, init.result.instructions);
-    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: {} }, { home: deps.home, fetch: deps.fetch, logError: deps.log });
+    const have = (await runnerSkills()).heldSkillZips(skillsDir);
+    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: { have } }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
     const text = body?.result?.content?.find((c) => c.type === "text")?.text;
     const answer = (text ? JSON.parse(text) : {});
     if (!answer.ok || !Array.isArray(answer.skills))