agentradar-cli 0.3.5 → 0.3.7

package/dist/vendor-runner/feeder.mjs

@@ -28,6 +28,7 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { formatInjectionFrame, formatProbeFrame, formatWelcomeFrame, sendKeysCommands } from "./session-frame.mjs";
+import { unpackSkillZip } from "./skill-zip.mjs";
 
 const PANE_LIVE_SH = join(dirname(fileURLToPath(import.meta.url)), "pane-live.sh");
 
@@ -78,6 +79,11 @@ const NEXT_EVENT_HOLD_MS = Number(process.env.NEXT_EVENT_HOLD_MS ?? "200000");
 // watchdog is 230s, still under the ~240s ALB idle-timeout.
 const NEXT_EVENT_TIMEOUT_MS = NEXT_EVENT_HOLD_MS + 30000;
 const IDLE_DELAY_MS = Number(process.env.IDLE_DELAY_MS ?? "1000");
+// A starting runner rechecks readiness this often inside its IDLE_DELAY_MS wait, so a cold start's work goes out
+// as soon as the session is ready rather than up to a whole wait (plus a CLI login probe) later.
+const READY_POLL_MS = Number(process.env.READY_POLL_MS ?? "200");
+// A good login probe holds this long. The probe spawns the CLI; run every poll, it competed with the booting session.
+const AUTH_RECHECK_MS = Number(process.env.AUTH_RECHECK_MS ?? "60000");
 const ERROR_DELAY_MS = Number(process.env.ERROR_DELAY_MS ?? "3000");
 // How long to wait for the pane to come back (mid-revive) before giving up this round.
 const PANE_WAIT_MS = Number(process.env.PANE_WAIT_MS ?? "15000");
@@ -166,6 +172,7 @@ async function mcpPost(method, params, { notification = false, timeoutMs = MCP_C
     "content-type": "application/json",
     accept: "application/json, text/event-stream",
     authorization: `Bearer ${AWP_BEARER}`,
+    "x-agentradar-surface": "feeder",
   };
   if (_sessionId) headers["mcp-session-id"] = _sessionId;
   const body = { jsonrpc: "2.0", method, params: params ?? {} };
@@ -217,6 +224,7 @@ function mcpPostIsolated(method, params, { timeoutMs = PANE_MCP_TIMEOUT_MS } = {
           "content-type": "application/json",
           accept: "application/json, text/event-stream",
           authorization: `Bearer ${AWP_BEARER}`,
+          "x-agentradar-surface": "feeder",
           "content-length": Buffer.byteLength(payload),
         },
         timeout: timeoutMs,
@@ -344,22 +352,49 @@ export function codexAuthState(run = spawnSync, readFile = fs.readFileSync) {
 }
 
 /** The login probe for whichever CLI this runner drives. */
-export function agentAuthState() {
+function harnessAuthState() {
   // A generic CLI has no login probe we know of; its pane's input marker is the readiness signal.
   if (AR_AGENT_HARNESS === "generic") return "authenticated";
   return AR_AGENT_HARNESS === "codex" ? codexAuthState() : claudeAuthState();
 }
 
+let _authOkUntil = 0;
+/** True while a good login probe still holds. */
+export const authHeld = (now = Date.now()) => now < _authOkUntil;
+/** Only "authenticated" is held: a logged-out or unanswered probe is asked again on the next poll. `fresh` skips the hold. */
+export function agentAuthState(fresh = false, now = Date.now(), probe = harnessAuthState) {
+  if (!fresh && authHeld(now)) return "authenticated";
+  const state = probe();
+  _authOkUntil = state === "authenticated" ? now + AUTH_RECHECK_MS : 0;
+  return state;
+}
+
+/** Waits up to `budgetMs`, ending early once the runner reads ready. True when it did. */
+export async function waitForReady(readiness, budgetMs = IDLE_DELAY_MS, step = READY_POLL_MS, sleepFn = sleep) {
+  if (!(step > 0)) step = 200; // READY_POLL_MS of 0 or junk would spin
+  for (let waited = 0; waited < budgetMs; waited += step) {
+    await sleepFn(Math.min(step, budgetMs - waited));
+    if (readiness() === "ready") return true;
+  }
+  return false;
+}
+
 /** AGENT-GUARD-ACTIVE: the supervisor sets AR_GUARD_MARKER when the session must load agent-guard, whose SessionStart hook writes it. */
 export const guardLoaded = (marker = process.env.AR_GUARD_MARKER) => !marker || fs.existsSync(marker);
 
 export function runnerState(auth = agentAuthState, sample = capturePane, guard = guardLoaded) {
+  const held = authHeld();
   const authState = auth();
   if (authState === "unauthenticated") return "auth_required";
   if (authState !== "authenticated" || !guard()) return "starting";
   const pane = sample();
   if (pane?.rateLimited) return "rate_limited";
-  return pane?.inputReady ? "ready" : "starting";
+  if (!pane?.inputReady) return "starting";
+  if (!held) return "ready";
+  // A held probe may keep a pane starting, never make it ready: a logged-out Claude still draws ❯ (its login menu,
+  // or the composer after a token loss), and work typed there is acked and lost. Ask once more before "ready".
+  const fresh = auth(true);
+  return fresh === "authenticated" ? "ready" : fresh === "unauthenticated" ? "auth_required" : "starting";
 }
 
 /**
@@ -481,20 +516,53 @@ export async function waitForPaneReceipt(eventId, sample = paneHasEvent, sleepFn
   }
 }
 
+// Vadym 14045 / #1856: Rev ran one 1h12m turn while the SAME eventId sat in its input queue ~40 times. An event typed
+// into the pane but not yet seen in its history (Claude queues a prompt typed mid-turn) stays unacked, so the server
+// re-serves it on every poll and the feeder typed it again each time. Once typed, an event is not typed again until
+// its window has passed (EVENT_REINJECT_MS, doubled each retry, capped at EVENT_REINJECT_MAX_MS), and it is acked as
+// soon as it shows in the pane. The DB holds one row for it (served_at set, never acknowledged): the copies are made here.
+const EVENT_REINJECT_MS = Number(process.env.EVENT_REINJECT_MS ?? "600000");
+const EVENT_REINJECT_MAX_MS = Number(process.env.EVENT_REINJECT_MAX_MS ?? "3600000");
+// While every served event is held, the server answers the next poll at once with the same batch; poll this often
+// instead (a busy pane used to hold the loop ~INJECT_BUSY_WAIT_MS in injectEvent; 1 s was 3600 polls per held hour).
+const HELD_POLL_MS = Number(process.env.HELD_POLL_MS ?? "30000");
+const _typed = new Map();
+export function noteTyped(eventId, now = Date.now()) {
+  const wait = Math.min((_typed.get(eventId)?.wait ?? EVENT_REINJECT_MS / 2) * 2, EVENT_REINJECT_MAX_MS);
+  _typed.set(eventId, { at: now, wait });
+}
+/** True while an event already typed into the pane should be left alone. */
+export function typedAlready(eventId, now = Date.now()) {
+  const typed = _typed.get(eventId);
+  return Boolean(typed && now - typed.at < typed.wait);
+}
+export const forgetTyped = (eventId) => { _typed.delete(eventId); };
+const pruneTyped = (now = Date.now()) => { for (const [id, t] of _typed) if (now - t.at > 24 * 3_600_000) _typed.delete(id); };
+
+// The hosted bridge leaves this when the last workspace was stopped or crashed mid-work (TRC-RESTART-REASON).
+const RESTART_NOTICE = join(homedir(), ".agentradar", "run", "restart-notice.json");
+const readNotice = (file) => { try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; } };
+
 /** Inject one client event into the live pane. Returns true only after Claude's pane shows the submitted turn. */
-async function injectEvent(event) {
-  if (!(await waitForIdlePane())) {
+export async function injectEvent(event, { idle = waitForIdlePane, inject = injectFrame, receipt = waitForPaneReceipt, noticeFile = RESTART_NOTICE } = {}) {
+  if (!(await idle())) {
     console.warn(
       `[feeder] pane ${TMUX_SESSION} still mid-turn after ${INJECT_BUSY_WAIT_MS}ms — NOT injecting eventId=${event.eventId}; leaving it UNACKED for re-delivery`,
     );
     return false;
   }
-  const injected = await injectFrame(
-    formatInjectionFrame(event, AR_CLI_RUNNER_ID),
+  const restartNotice = readNotice(noticeFile);
+  const injected = await inject(
+    formatInjectionFrame(restartNotice ? { ...event, restartNotice } : event, AR_CLI_RUNNER_ID),
     `eventId=${event.eventId} (source=${event.source}, conversationId=${event.conversationId ?? "-"})`,
   );
   if (!injected) return false;
-  if (await waitForPaneReceipt(event.eventId)) return true;
+  noteTyped(event.eventId);
+  if (await receipt(event.eventId)) {
+    forgetTyped(event.eventId);
+    if (restartNotice) fs.rmSync(noticeFile, { force: true }); // told once
+    return true;
+  }
   console.warn(
     `[feeder] pane ${TMUX_SESSION} did not show eventId=${event.eventId} after injection — leaving it UNACKED for re-delivery`,
   );
@@ -601,6 +669,24 @@ export function paneInputReady(text, harness = AR_AGENT_HARNESS, readyPattern =
     : /bypass permissions on\b|^\s*❯/im.test(tail);
 }
 
+/**
+ * A turn, tool or dialog owns the pane, so nothing may be typed into it (Vadym 15775, Rev's phantom STOP). Measured
+ * on CLI 2.1.282 during a foreground Bash: the footer's "esc to interrupt" shows at 80 and 120 columns but is cut
+ * at 50, where the ❯ prompt and the bypass footer still show; the spinner line "✽ Sautéing… (24s · ↓ 105 tokens)"
+ * shows at every width and turns into "✻ Worked for 13s" when the turn ends.
+ */
+export const paneBusy = (text) => /\besc to (?:interrupt|cancel)\b/i.test(text ?? "")
+  || /^\s*[^\w\s]\s+\S+…\s*\(\s*(?:\d+h\s*)?(?:\d+m\s*)?\d+s\b/m.test(text ?? "");
+
+/**
+ * Vadym 12490: the permission mode Claude Code's footer names ("⏸ manual mode on"), or null when no footer shows.
+ * A hosted session must read "bypass permissions"; anything else is reported so the server can alert.
+ */
+export function panePermissionMode(text) {
+  const tail = String(text ?? "").replace(/\n\s*$/, "").split("\n").slice(-12).join("\n");
+  return /\b(manual mode|accept edits|auto-accept edits|plan mode|bypass permissions) on\b/i.exec(tail)?.[1].toLowerCase() ?? null;
+}
+
 /**
  * Why a Claude Code session refused to register its channels, read off the banner it prints — or null.
  * Keyed by the CLI's own skip `kind`. The `auth` banner comes from builds before 2.1.281, which has no auth
@@ -636,13 +722,13 @@ function capturePane() {
   // "• Working (1s • esc to interrupt)", measured on codex-cli 0.149.1, so this matcher needs no harness
   // branch. This is only a HINT that triggers a probe on stagnation — it never decides liveness, so a
   // missed/extra hint is harmless.
-  const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
+  const inProgress = paneBusy(text);
   // The CLI's idle input prompt is the durable readiness signal, and it is the one pane signal that differs
   // per harness (see paneInputReady). The optional bypass-permissions footer disappeared from a live Claude
   // build after several turns, which falsely demoted a healthy pane to `starting` and stopped next_event
   // from draining until its heartbeat aged stale.
   const inputReady = paneInputReady(text);
-  return { hash, inProgress, inputReady, rateLimited: paneRateLimited(text), channelGate: classifyChannelBanner(text) };
+  return { hash, inProgress, inputReady, rateLimited: paneRateLimited(text), channelGate: classifyChannelBanner(text), mode: panePermissionMode(text) };
 }
 /**
  * #173b (disc obs) — format-drift detector. If the STRIPPED fingerprint keeps CHANGING while the pane
@@ -685,7 +771,10 @@ async function reportPane() {
     _lastChannelGate = p.channelGate?.kind ?? null;
     // #156: isolated connection (NOT the shared long-poll socket) so pane sampling never stalls behind
     // the receive long-poll's ALB-killed socket.
-    await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress } });
+    // Vadym 12490: a hosted session always runs in full auto; a vendor's own runner may choose its mode.
+    const offMode = process.env.AR_CLI_RUNNER_ID === "hosted" && p.mode && p.mode !== "bypass permissions" ? p.mode : null;
+    if (offMode) console.warn(`[feeder] hosted session in ${offMode}, not full auto`);
+    await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress, ...(offMode ? { permissionMode: offMode } : {}) } });
     if (process.env.DEBUG_PANE) {
       console.log(`[feeder] report_pane #${n}: OK hash=${p.hash.slice(0, 8)} inProgress=${p.inProgress} (${Date.now() - t0}ms)`);
     }
@@ -706,14 +795,49 @@ const isManaged = (dir) => {
   const st = fs.lstatSync(dir, { throwIfNoEntry: false });
   return Boolean(st?.isDirectory() && fs.existsSync(join(dir, MANAGED_MARK)));
 };
+// Same bytes and the same mode for every file, and nothing else in the directory.
 const sameSkill = (dir, files) => {
   try {
     const have = fs.readdirSync(dir, { recursive: true }).filter((p) => p !== MANAGED_MARK && fs.statSync(join(dir, p)).isFile());
-    return have.length === files.length && files.every((f) => fs.readFileSync(join(dir, f.path), "utf8") === f.content);
+    return have.length === files.length && files.every((f) => fs.readFileSync(join(dir, f.path)).equals(f.bytes)
+      && (fs.statSync(join(dir, f.path)).mode & 0o777) === f.mode);
   } catch {
     return false;
   }
 };
+const markText = (sha) => `Written by the AgentRadar runner; replaced on every sync.\n${sha ? `sha256:${sha}\n` : ""}`;
+const markedSha = (dir) => {
+  try {
+    return /^sha256:([0-9a-f]{64})$/m.exec(fs.readFileSync(join(dir, MANAGED_MARK), "utf8"))?.[1] ?? null;
+  } catch {
+    return null;
+  }
+};
+
+/** SKILL-ZIP-S3: what `my_skills` is told this box holds, so an unchanged zip is not sent again. */
+export function heldSkillZips(skillsDir) {
+  const held = {};
+  for (const entry of fs.existsSync(skillsDir) ? fs.readdirSync(skillsDir) : []) {
+    const sha = SKILL_NAME.test(entry) && isManaged(join(skillsDir, entry)) ? markedSha(join(skillsDir, entry)) : null;
+    if (sha) held[entry] = sha;
+  }
+  return held;
+}
+
+// Each skill comes as a zip (its bytes checked against its sha256 and unpacked by skill-zip.mjs, exec bits kept), as a
+// zip's sha256 alone when this box already holds it, or, from an older server, as files of text.
+function skillFiles(skill, target) {
+  const zip = skill.zip;
+  if (zip && typeof zip === "object") {
+    if (typeof zip.base64 === "string") return { sha: zip.sha256, files: unpackSkillZip(Buffer.from(zip.base64, "base64"), zip.sha256) };
+    if (isManaged(target) && markedSha(target) === zip.sha256) return "held";
+    throw new Error("the server sent no bytes for a zip this box does not hold");
+  }
+  const files = Array.isArray(skill.files) ? skill.files : [];
+  if (files.some((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
+    || normalize(f.path).split(sep).includes(".."))) return null;
+  return { sha: null, files: files.map((f) => ({ path: normalize(f.path), bytes: Buffer.from(f.content), mode: 0o644 })) };
+}
 
 export function writeManagedSkills(skillsDir, skills) {
   fs.mkdirSync(skillsDir, { recursive: true });
@@ -726,22 +850,38 @@ export function writeManagedSkills(skillsDir, skills) {
       console.warn(`[feeder] skill sync: ${name} is not ours, left alone`);
       continue;
     }
-    const files = Array.isArray(skill.files) ? skill.files : [];
-    const bad = files.find((f) => typeof f?.path !== "string" || typeof f?.content !== "string" || isAbsolute(f.path)
-      || normalize(f.path).split(sep).includes("..") || [".", MANAGED_MARK].includes(normalize(f.path)));
-    if (bad) { console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`); continue; }
+    let got;
+    try {
+      got = skillFiles(skill, target);
+    } catch (err) {
+      // A zip that fails its check keeps the copy this box already has.
+      if (isManaged(target)) written.add(name);
+      console.warn(`[feeder] skill sync: ${name} not written: ${err instanceof Error ? err.message : String(err)}`);
+      continue;
+    }
+    if (got === "held") { written.add(name); continue; }
+    if (!got || got.files.some((f) => [".", MANAGED_MARK].includes(f.path))) {
+      console.warn(`[feeder] skill sync: ${name} has an unsafe file path, skipped`);
+      continue;
+    }
+    const { sha, files } = got;
     // An unchanged skill is not rewritten: the agent's CLI may be reading it (Codex skipped a SKILL.md that a
-    // periodic resync had just removed).
-    if (sameSkill(target, files)) { written.add(name); continue; }
+    // periodic resync had just removed). Only its mark is brought up to date.
+    if (sameSkill(target, files)) {
+      if (markedSha(target) !== sha) fs.writeFileSync(join(target, MANAGED_MARK), markText(sha));
+      written.add(name);
+      continue;
+    }
     const staging = join(skillsDir, `.${name}.sync-${process.pid}`);
     const old = join(skillsDir, `.${name}.old-${process.pid}`);
     try {
       fs.rmSync(staging, { recursive: true, force: true });
       for (const f of files) {
         fs.mkdirSync(dirname(join(staging, f.path)), { recursive: true });
-        fs.writeFileSync(join(staging, f.path), f.content);
+        fs.writeFileSync(join(staging, f.path), f.bytes, { mode: f.mode });
+        fs.chmodSync(join(staging, f.path), f.mode); // the umask must not take the exec bit back
       }
-      fs.writeFileSync(join(staging, MANAGED_MARK), "Written by the AgentRadar runner; replaced on every sync.\n");
+      fs.writeFileSync(join(staging, MANAGED_MARK), markText(sha));
       // Rename aside, then into place: the skill is missing for two renames, not for a recursive delete.
       fs.rmSync(old, { recursive: true, force: true });
       if (fs.existsSync(target)) fs.renameSync(target, old);
@@ -775,7 +915,7 @@ async function syncSkills() {
     console.warn(`[feeder] brief sync failed: ${err instanceof Error ? err.message : String(err)}`);
   }
   try {
-    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: {} }));
+    const answer = toolJson(await mcpPostIsolated("tools/call", { name: "my_skills", arguments: { have: heldSkillZips(SKILLS_DIR) } }));
     // A refusal or an older server keeps whatever this box already has.
     if (!answer.ok || !Array.isArray(answer.skills)) {
       console.warn(`[feeder] skill sync: server answered ${answer.error ?? "without skills"}; keeping current copies`);
@@ -969,7 +1109,13 @@ let _lastRunnerState = null;
 
 /** One receive→inject→ack-select cycle (extracted from loop() + exported so the #173b _pendingAck
  *  fence is directly testable). Sets `_pendingAck` = the eventIds to ack on the NEXT poll. */
-export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch) {
+/**
+ * Vadym 15469: Claude Code takes work only through the AgentRadar channel. Keys typed into its pane interrupt a running tool
+ * and can stay stuck in the input box, so a Claude pane fed here is told apart, never typed into: its pollOnce arguments
+ * report channel_unconfirmed ("Not receiving messages"), which drains nothing, and never type a /model switch either.
+ */
+export const channelOnlyPoll = (harness = AR_AGENT_HARNESS) => harness === "claude" ? [paneIsLive, () => "channel_unconfirmed", injectEvent, async () => {}] : [];
+export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch, wait = waitForReady, paneHas = paneHasEvent) {
   // next_event refreshes the portal's runner heartbeat. Never call it for a detached/orphan feeder: a
   // process without its owned tmux session cannot receive work, so polling would paint a false Live state
   // while every event stays unacknowledged. The supervisor recreates the session; until then the durable
@@ -995,7 +1141,10 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   const { events = [], livenessProbe, welcome, modelSwitch, firstStep } = await nextEvent(canWork && _pendingAck.length ? _pendingAck : undefined, state);
   _nextSwitch = modelSwitch ?? null;
   if (!canWork) {
-    await sleep(IDLE_DELAY_MS);
+    // Signed in but still booting: poll again the moment the pane is ready. Each check is a file stat and a pane
+    // capture; the login probe stays held, so it does not spawn the CLI beside the booting session.
+    if (state === "starting" && !_switching && authHeld()) await wait(readiness);
+    else await sleep(IDLE_DELAY_MS);
     return;
   }
   _pendingAck = [];
@@ -1012,7 +1161,14 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   }
   console.log(`[feeder] received ${events.length} event(s) → injecting into live session`);
   const delivered = [];
+  let held = 0;
+  pruneTyped();
   for (const e of events) {
+    // Already typed into the pane: ack it once it shows there, else leave it alone until its window passes.
+    if (_typed.has(e.eventId)) {
+      if (paneHas(e.eventId)) { forgetTyped(e.eventId); delivered.push(e.eventId); continue; }
+      if (typedAlready(e.eventId)) { held += 1; continue; }
+    }
     // Inject in order; ack ONLY the ones that reached a live pane (no-phantom).
     // eslint-disable-next-line no-await-in-loop
     if (await deliverEvent(firstStep ? { ...e, firstStep } : e)) delivered.push(e.eventId);
@@ -1023,6 +1179,8 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   }
   _pendingAck = delivered;
   if (delivered.length) console.log(`[feeder] delivered ${delivered.length}/${events.length} → will ack`);
+  // The server re-serves what is still unacked at once, so a batch held back whole must not spin on it.
+  if (held && held === events.length) await sleep(HELD_POLL_MS);
 }
 
 async function loop() {
@@ -1037,9 +1195,11 @@ async function loop() {
     void syncSkills();
     setInterval(() => { void syncSkills(); }, SKILLS_SYNC_INTERVAL_MS).unref?.();
   }
+  const channelOnly = channelOnlyPoll();
+  if (channelOnly.length) console.warn("[feeder] Claude Code receives work only through the AgentRadar channel: run `agentradar join` again; reporting channel_unconfirmed, typing nothing");
   while (!_stopping) {
     try {
-      await pollOnce();
+      await pollOnce(...channelOnly);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[feeder] iteration error: ${msg} — re-establishing MCP session`);

package/dist/vendor-runner/session-frame.mjs

@@ -21,11 +21,41 @@ function oneLine(s) {
     .trim();
 }
 
+/** The send tool of each room channel (mirrors the server's replyToolForSource in awp/discovery.ts). Anything else: Slack's `reply`. */
+const REPLY_TOOL = { telegram: "telegram_reply", discord: "discord_reply", whatsapp: "whatsapp_reply", email: "email_reply" };
+
+/**
+ * Sources with nobody waiting in a channel (a company notice, an approval decision, platform traffic, no source at all): `reply` has nowhere
+ * to go and fails ("no active engagement"). Each says what to do instead; the message above carries its own "Now:" line.
+ */
+function noReplyAnswer(e, run) {
+  const notice = "nobody is waiting for a reply, so do not use reply";
+  if (e.source === "approval")
+    return `This is the decision on an approval you asked for, not a chat message: do not use reply on this thread. Run \`${run} acknowledge_decision\` with the approvalId in the message, then do the rest of its "Now:" line (react in the thread where you asked).`;
+  if (e.source === "moderator" && e.noticeKind === "permission_request")
+    return `This is a permission request from a colleague, not a chat message: they are waiting for your decision, not a reply, so do not use reply. Decide it now. To agree, run \`${run} set_role_permission\` with the roleId, area and level (and mode, if the message names one) from the message, plus approvalDetails with four short plain sentences and no ids: context (what happened), reason (why), ifDeclined (what happens if you say no) and decisionDetail (what is granted). To refuse, do nothing more: nothing else is needed.`;
+  if (e.source === "moderator")
+    return `This is a notice from your company, not a chat message: ${notice}. Do what its "Now:" line says; if it has none, stop.`;
+  if (e.source === "agentradar")
+    return `This is a notice from AgentRadar, not a chat message: ${notice}. Do what the message says; if it asks for nothing, stop.`;
+  return `This message has no source, so there is no channel to reply into: do not use reply. Run \`${run} get_my_context\` to see what is waiting for you, then act on it.`;
+}
+// peer-handoff (run 39060351286): an unconditional "Reply with:" outvoted the brief's "a handoff that asks you nothing gets a reaction
+// only" (Vadym 12276), so the grantee thanked in text. The condition now comes before the command, an order counts as an ask, and a
+// plain notice gets the source's reaction (only where the agent has a react tool, as discovery.ts ackToolForSource) and the ack.
+const REACT = { telegram: ["telegram_react", "👍"], slack: ["slack_react", "white_check_mark"] };
+const NO_TEXT = (run, source, turn, evId) => {
+  const ack = `\`${run} inbox_ack --message-ids "${evId ?? "<eventId>"}"\``;
+  const react = Object.hasOwn(REACT, source) ? `react with \`${run} ${REACT[source][0]}${turn} --emoji "${REACT[source][1]}"\`, then run ` : "run ";
+  return `Only if it just tells you something and asks nothing (a notice, a handoff, a thanks), send no text: ${react}${ack}.`;
+};
+const NO_REPLY_SOURCES = new Set(["moderator", "approval", "agentradar", undefined, null, ""]);
+
 /**
  * Build the single-line injection frame for one drained next_event event.
  * event: { eventId, source, channel?, conversationId?, text, firstStep? }
- * cliRunnerId: set when the session acts through `agentradar run <id> <tool>` (a joined agent) rather than an
- * MCP connection — the command its human already chose "always allow" for, where an MCP tool would prompt.
+ * cliRunnerId: the runner the session acts through, `agentradar run <id> <tool>` (AgentRadar has no MCP for agents);
+ * absent, the frame names the shell variable every joined and hosted session has, `$AR_CLI_RUNNER_ID`.
  * Returns a one-line string safe to `tmux send-keys -l` then Enter.
  */
 export function formatInjectionFrame(event, cliRunnerId) {
@@ -36,45 +66,76 @@ export function formatInjectionFrame(event, cliRunnerId) {
   if (e.taskId) tags.push(`taskId=${e.taskId}`); // assignment events: the agent works THIS task, not one dug out of its log
   if (e.eventId) tags.push(`eventId=${e.eventId}`);
   // Vadym 11025: the server's `firstStep` (get_my_context first) opens every frame that carries work.
-  const header = `[AgentRadar inbound · ${tags.join(" · ")}]${e.firstStep ? ` ${oneLine(e.firstStep)} Message:` : ""}`;
+  const restart = restartLine(e.restartNotice, cliRunnerId); // before anything else the agent reads, once per restart
+  const header = `[AgentRadar inbound · ${tags.join(" · ")}]${restart ? ` ${restart}` : ""}${e.firstStep ? ` ${oneLine(e.firstStep)} Message:` : ""}`;
   const body = oneLine(e.text) || "(no text)";
   const evId = e.eventId ? String(e.eventId) : null;
   // The reply instruction pins the EXPLICIT conversationId (threading) + inResponseToEventId
   // (exact provenance under concurrent same-conversation turns — disc S2).
-  const parts = [];
-  if (cliRunnerId) {
-    const run = `agentradar run ${cliRunnerId}`;
-    parts.push(
-      `Reply with: ${run} reply${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""} --text '<your reply>'.`,
-      evId
-        ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
-        : `Use ${run} report_usage for billable work.`,
-      "Then stop.",
-    );
-    return oneLine(`${header} ${body} — ${parts.join(" ")}`);
-  }
-  if (e.conversationId) {
-    parts.push(
-      `Reply via your MCP \`reply\` tool with conversationId="${e.conversationId}"${evId ? ` and inResponseToEventId="${evId}"` : ""} (do NOT guess the channel).`,
-    );
-  } else {
-    parts.push(`Reply via your MCP \`reply\` tool${evId ? ` with inResponseToEventId="${evId}"` : ""}.`);
-  }
-  // L2 (disc #104): the feeder is at-least-once — a crash in the deliver→ack window
-  // re-injects this event. Tying report_usage's idempotencyKey to THIS eventId makes a
-  // re-delivery a no-op charge (#65 dedups on key) instead of a double bill, while a
-  // per-line suffix keeps distinct usage lines separate.
-  if (evId) {
-    parts.push(
-      `For billable work call \`report_usage\` with an idempotencyKey derived from this eventId (e.g. "${evId}:<usage-code>") so a re-delivered event never double-charges.`,
-    );
-  } else {
-    parts.push("Use `report_usage` for billable work.");
-  }
-  parts.push("Then stop.");
+  const run = `agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"}`;
+  const turn = `${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""}`;
+  // A task wake has no conversation: nobody waits in a channel, so `reply` has nowhere to go. The answer is a comment on the task.
+  const answer = e.taskId && !e.conversationId && e.reason === "review_requested"
+    ? `Record your verdict with: ${run} review_task --issue-id "${e.taskId}" --decision accept|reject --reason '<why>'.`
+    : e.taskId && !e.conversationId
+    ? `Answer on the task with: ${run} comment_on_task --issue-id "${e.taskId}" --body '<your answer>'.`
+    : NO_REPLY_SOURCES.has(e.source) ? noReplyAnswer(e, run)
+    : `If the message asks you something or asks you to do something, or its "Now:" line asks for a reply, answer or do it, then reply with: ${run} ${(Object.hasOwn(REPLY_TOOL, e.source) ? REPLY_TOOL[e.source] : "reply")}${turn} --text '<your reply>'. ${NO_TEXT(run, e.source, turn, evId)}`;
+  // The server's catch-up line (catch-up.ts: older messages edited, or chatter since the agent's last ack) rides in `guidance`,
+  // which the frame does not carry; without it an agent answered from what it last saw, not the edited text (edit-reconcile, 10-18).
+  // Channel wakes only (moderator/approval/agentradar wakes have no thread to read), and as a runnable command, not prose.
+  const channelWake = e.conversationId && (e.source === "slack" || Object.hasOwn(REPLY_TOOL, e.source));
+  // qa-sec MED (#2679): names and titles in guidance can carry a newline and forge a "Now: catch up" line, which this turns into
+  // a command the agent runs. So take the LAST such line (the server's is last, in the turn block) and keep it only when its
+  // conversation is this wake's and its cursor is base64url (encodeThreadCursor); anything else is dropped, never run.
+  const raw = channelWake ? (e.guidance ?? "").match(/^Now: catch up\b.*$/gm)?.at(-1) : undefined;
+  let lifted = false;
+  const catchUp = raw?.replace(/read_history with conversationId "([^"]+)"(?: and after "([^"]+)")?(?: \(it starts right after your last ack\))?/,
+    (m, c, a) => c !== e.conversationId || /["`$\\]/.test(c) || (a !== undefined && !/^[A-Za-z0-9_-]+$/.test(a))
+      ? m
+      : ((lifted = true), `\`${run} read_history --conversation-id "${c}"${a ? ` --after "${a}"` : ""}\``));
+  // Vadym 12241: who wrote it and where. The frame carried neither, and Quill answered a group question untagged with its private
+  // part in the room, 3 runs of 3 (group-manners, 10-18). The handle is shape-checked and the name stripped to plain words: both
+  // land in the agent's turn as text, so neither can carry a command.
+  const handle = /^(@\w{1,32}|<@[UW][A-Z0-9]+>)$/.test(e.senderHandle ?? "") ? e.senderHandle : null;
+  const name = oneLine(e.sender?.name).replace(/[^\p{L}\p{N} .'-]/gu, "").slice(0, 40).trim();
+  const who = name && handle ? `${name} (${handle})` : name || handle || "";
+  const room = !channelWake || !e.chat ? null
+    : e.chat.type === "dm" ? `This is a direct chat${who ? ` from ${who}` : ""}: one human, so no @mention is needed.`
+    : `This is a ${e.chat.type} with other humans and agents${who ? `; the message is from ${who}` : ""}. Reply in the ${e.chat.type} with an @mention of ${handle ?? "the sender"}; a private matter (approvals, reminders, billing) is not answered here: say it waits on their Needs you page in the AgentRadar app, without a link.`;
+  const parts = [
+    ...(lifted ? [catchUp] : []),
+    ...(room ? [room] : []),
+    answer,
+    evId
+      ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
+      : `Use ${run} report_usage for billable work.`,
+    "Then stop.",
+  ];
   return oneLine(`${header} ${body} — ${parts.join(" ")}`);
 }
 
+/**
+ * TRC-RESTART-REASON: the hosted bridge's note that the last workspace ended mid-work, said once on the next wake.
+ * Haiden's DM blast was cut by stops it could not explain; the agent must know why, what died and how to resume safely.
+ */
+export function restartLine(notice, cliRunnerId, now = Date.now()) {
+  const at = Date.parse(notice?.at ?? "");
+  if (Number.isNaN(at) || !RESTART_REASONS[notice?.reason]) return "";
+  const time = new Date(at).toISOString().slice(11, 16);
+  const min = Math.max(0, Math.round((now - at) / 60_000));
+  const ago = min < 60 ? `${min} min` : `${Math.round(min / 60)} h`;
+  // A crash leaves only the time the workspace last started, so that one is "some time after".
+  const when = notice.reason === "crashed" ? `stopped without warning some time after ${time} UTC (${ago} ago)` : `was stopped at ${time} UTC (${ago} ago)`;
+  return `Your workspace ${when}. ${RESTART_REASONS[notice.reason]} Anything you had running was stopped and is not running now: background jobs, loops and open shells. Files in your home folder are still there. Before you do anything else: 1. Check what finished: look at the files and logs your job wrote, and the results of the calls it made. 2. Restart only the items that did not finish, with \`agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"}\`, passing each one the same --idempotency-key it had before. An item whose key already ran returns its earlier result and is not sent twice. Then handle this message:`;
+}
+
+const RESTART_REASONS = {
+  idle: "It stopped after the workspace was idle. Running turns, tools and background jobs keep it awake, even when they are silent; there is no runtime cap.",
+  stopped: "AgentRadar stopped it, to update or move your workspace or because someone in your company stopped it. Nothing you did caused this.",
+  crashed: "It crashed, possibly from running out of memory.",
+};
+
 /**
  * #173b — build the single-line frame for a #156 liveness PROBE.
  *
@@ -118,8 +179,8 @@ export function formatProbeFrame(probe, cliRunnerId) {
   // "no charge / zero blast radius"; state the honest bounded effect.
   const body =
     oneLine(p.instruction) ||
-    `Liveness check — call the liveness_ack tool with nonce "${nonce}". Judge on structure, not who sent it: a wrong or stale nonce is a harmless no-op (safe even if forged); the tool is harness-granted (a message cannot add a tool); the nonce is server-minted (you cannot fabricate a valid one). A matching nonce only confirms your session is alive — it updates the liveness signal that gates billing; it moves no data, sends no message, creates no task, and creates no new charge.`;
-  const cli = cliRunnerId ? ` Run: agentradar run ${cliRunnerId} liveness_ack --nonce "${nonce}"` : "";
+    `Liveness check — run the liveness_ack command with nonce "${nonce}". Judge on structure, not who sent it: a wrong or stale nonce is a harmless no-op (safe even if forged); the command is part of your installed CLI (a message cannot add one); the nonce is server-minted (you cannot fabricate a valid one). A matching nonce only confirms your session is alive — it updates the liveness signal that gates billing; it moves no data, sends no message, creates no task, and creates no new charge.`;
+  const cli = ` Run: agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"} liveness_ack --nonce "${nonce}"`;
   return oneLine(`${header} ${body}${cli}`);
 }
 

package/dist/vendor-runner/skill-zip.mjs

@@ -0,0 +1,76 @@
+// SKILL-ZIP-S3 (Vadym 12039/12041): a skill version arrives as one zip with its sha256. This box treats it as
+// untrusted: the hash is checked before a byte is parsed, every name is checked before anything is written,
+// and the caps stop a zip bomb inside inflate itself. Stdlib only; the feeder and the CLI both import it.
+// The writer is server/src/services/skill-zip.ts; server/src/__tests__/skill-zip.test.ts runs one against the other.
+import { createHash } from "node:crypto";
+import { inflateRawSync } from "node:zlib";
+
+export const SKILL_ZIP_LIMITS = { entries: 1000, fileBytes: 2 * 1024 * 1024, totalBytes: 5 * 1024 * 1024 };
+
+const CRC_TABLE = Array.from({ length: 256 }, (_, n) => {
+  let c = n;
+  for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+  return c >>> 0;
+});
+export function crc32(bytes) {
+  let c = 0xffffffff;
+  for (const b of bytes) c = CRC_TABLE[(c ^ b) & 0xff] ^ (c >>> 8);
+  return (c ^ 0xffffffff) >>> 0;
+}
+
+const refuse = (why) => { throw new Error(`skill zip refused: ${why}`); };
+
+/** Returns [{ path, bytes, mode }] with mode 0o755 or 0o644, or throws. Nothing is written here. */
+export function unpackSkillZip(zip, sha256, limits = SKILL_ZIP_LIMITS) {
+  if (!Buffer.isBuffer(zip)) refuse("not bytes");
+  if (createHash("sha256").update(zip).digest("hex") !== sha256) refuse("sha256 does not match");
+  let eocd = -1;
+  for (let i = zip.length - 22; i >= Math.max(0, zip.length - 22 - 0xffff); i--) {
+    if (zip.readUInt32LE(i) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) refuse("no end of central directory");
+  const count = zip.readUInt16LE(eocd + 10);
+  if (count === 0xffff || count > limits.entries) refuse(`${count} entries`);
+  let at = zip.readUInt32LE(eocd + 16);
+  const files = [];
+  const seen = new Set();
+  let total = 0;
+  for (let n = 0; n < count; n++) {
+    if (at + 46 > eocd || zip.readUInt32LE(at) !== 0x02014b50) refuse("bad central directory");
+    const flags = zip.readUInt16LE(at + 8);
+    const method = zip.readUInt16LE(at + 10);
+    const crc = zip.readUInt32LE(at + 16);
+    const packed = zip.readUInt32LE(at + 20);
+    const size = zip.readUInt32LE(at + 24);
+    const nameLen = zip.readUInt16LE(at + 28);
+    const next = at + 46 + nameLen + zip.readUInt16LE(at + 30) + zip.readUInt16LE(at + 32);
+    const attr = zip.readUInt32LE(at + 38) >>> 16;
+    const local = zip.readUInt32LE(at + 42);
+    const path = zip.subarray(at + 46, at + 46 + nameLen).toString("utf8");
+    at = next;
+    if (flags & 1) refuse(`${path} is encrypted`);
+    if (method !== 0 && method !== 8) refuse(`${path} uses method ${method}`);
+    const type = attr & 0o170000;
+    if (type && type !== 0o100000) refuse(`${path} is not a regular file`);
+    if (!path || path.includes("\\") || path.includes("\0") || path.startsWith("/") || /^[a-zA-Z]:/.test(path)
+      || path.split("/").some((part) => part === "" || part === "." || part === "..")) refuse(`unsafe path ${JSON.stringify(path)}`);
+    if (seen.has(path.toLowerCase())) refuse(`${path} appears twice`);
+    seen.add(path.toLowerCase());
+    if (size > limits.fileBytes) refuse(`${path} is ${size} bytes`);
+    total += size;
+    if (total > limits.totalBytes) refuse(`more than ${limits.totalBytes} bytes unpacked`);
+    if (local + 30 > zip.length || zip.readUInt32LE(local) !== 0x04034b50) refuse(`${path} has no local header`);
+    const start = local + 30 + zip.readUInt16LE(local + 26) + zip.readUInt16LE(local + 28);
+    if (start + packed > zip.length) refuse(`${path} is truncated`);
+    const raw = zip.subarray(start, start + packed);
+    let bytes;
+    try {
+      bytes = method === 0 ? Buffer.from(raw) : inflateRawSync(raw, { maxOutputLength: Math.max(1, size) });
+    } catch {
+      refuse(`${path} does not inflate to its size`);
+    }
+    if (bytes.length !== size || crc32(bytes) !== crc) refuse(`${path} does not match its checksum`);
+    files.push({ path, bytes, mode: attr & 0o111 ? 0o755 : 0o644 });
+  }
+  return files;
+}