agentradar-cli 0.3.6 → 0.3.8

package/dist/agent-guard/hooks/hooks.json

@@ -1,12 +1,12 @@
 {
   "description": "Marks the session as guarded (the runner reports ready only then); blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; reports compactions to AgentRadar; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
   "hooks": {
-    "SessionStart": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" start", "timeout": 10 }] }],
-    "Stop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
-    "PreCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }, { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PreCompact", "timeout": 30 }] }],
-    "PostCompact": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }, { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PostCompact", "timeout": 30 }] }],
-    "PreModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreModelSwitch || exit 2", "timeout": 30 }] }],
-    "PostModelSwitch": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostModelSwitch", "timeout": 30 }] }]
+    "SessionStart": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" start", "timeout": 10 }] }],
+    "Stop": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
+    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
+    "PreCompact": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PreCompact", "timeout": 30 }] }],
+    "PostCompact": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PostCompact", "timeout": 30 }] }],
+    "PreModelSwitch": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreModelSwitch || exit 2", "timeout": 30 }] }],
+    "PostModelSwitch": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostModelSwitch", "timeout": 30 }] }]
   }
 }

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -20,6 +20,12 @@ You act through `agentradar call <runner-id> <tool>`. Your runner id is in `$AR_
 
 The Stop hook runs the same check and will not let you stop while something is owed.
 
+## Hosted workspace lifetime
+
+There is no runtime cap. Running turns, tools and background jobs keep your hosted workspace awake, even when they are silent; only a truly idle workspace auto-stops. Save checkpoints and results to files as you work: a deployment or unexpected stop can still end processes. After a restart notice, check those files and restart unfinished work idempotently; never assume an old background process resumed.
+
+In a hosted workspace, every teammate you start keeps its own process in the workspace memory, even while it waits. At most 2 can run at once; a 3rd start is refused. As soon as a teammate is idle or its work is done, stop it: `SendMessage` it `{"type":"shutdown_request"}` and let it shut down. Start a new one when new work needs it.
+
 ## Always
 
 - Answer every message in the channel it came from. A human who wrote is waiting for you; answer them first.

package/dist/agentradar-vendor/SKILL.md

@@ -26,7 +26,7 @@ Keep each human's page in company memory current, every fact cited, as the Human
 
 In your first session, call `read_onboarding_obligations` once (reading them acknowledges the safety rules), then `read_readiness`.
 
-Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
+Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`, `start_recurring_task`, `archive_recurring_task`, `restore_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
 
 ## Talking to humans
 

package/dist/channel.js

@@ -1,28 +1,44 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, statSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { readFile, rm } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
-import { envValue } from "./tool-run.js";
+import { awpEndpoint } from "./tool-run.js";
 import { noteCliUpdate } from "./update.js";
 import { trustedMcpEndpoint } from "./setup.js";
 import { syncJoinedSkills } from "./skill-install.js";
 export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Receive the events with `agentradar run $AR_CLI_RUNNER_ID inbox next`; the next call acknowledges the batch you read. Answer a liveness check with `agentradar run $AR_CLI_RUNNER_ID liveness_ack --nonce <nonce>`. Never acknowledge an event you have not read. Never poll on your own or keep a loop running: when a channel message arrives, drain it, then end your turn.";
-export const CHANNEL_BLOCKED = "AgentRadar has not seen this session run `agentradar run $AR_CLI_RUNNER_ID inbox next`. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Until then, deliver with the feeder: run your join again with --feeder (agentradar join <your join link> --feeder). Your company sees this agent as not receiving messages until one or the other works.";
+export const CHANNEL_BLOCKED = "AgentRadar has not seen this session run `agentradar run $AR_CLI_RUNNER_ID inbox next`. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Your company sees this agent as not receiving messages until the channel works.";
+// The runner's frame text (templates/vendor-runner, shipped beside this file as dist/vendor-runner), so both say a restart one way.
+const runnerFrame = () => import(new URL(import.meta.url.endsWith(".ts")
+    ? "../../../templates/vendor-runner/session-frame.mjs" : "./vendor-runner/session-frame.mjs", import.meta.url).href);
 /** The channel: a local stdio MCP with no tools, only wake signals. The agent acts through the CLI; wake signals never consume the durable queue. */
+/** The wake line. Zero events never says "run inbox next": that call has nothing to return. Each reason names its own tool. */
+export function wakeText(runnerId, count, payload) {
+    const run = `agentradar run ${runnerId}`;
+    if (count)
+        return `${payload.firstStep ? `${payload.firstStep} ` : ""}${count} new AgentRadar events; run \`${run} inbox next\`${payload.livenessProbe ? " to receive your liveness check" : ""}.`;
+    return [
+        payload.onboarding && `AgentRadar session started, no messages waiting. Run \`${run} get_my_context\` now for your identity, peers and rules.`,
+        payload.livenessProbe && `AgentRadar liveness check, no messages waiting. Run \`${run} liveness_ack --nonce ${payload.livenessProbe.nonce}\` now.`,
+    ].filter(Boolean).join(" ");
+}
 export async function startChannel(runnerId, deps = {}) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
         throw new Error("Invalid runner ID");
     const home = deps.home ?? homedir();
-    const config = await readFile(join(home, ".agentradar", "agents", `${runnerId}.env`), "utf8");
-    const endpoint = trustedMcpEndpoint(envValue(config, "AWP_MCP_URL") ?? "");
-    const bearer = envValue(config, "AWP_BEARER");
-    if (!endpoint || !bearer)
-        throw new Error("Runner configuration requires a trusted AWP_MCP_URL and AWP_BEARER");
     const output = deps.output ?? process.stdout;
     const logError = deps.logError ?? console.error;
+    // The runner file, else a hosted session's own PAPERCLIP_API_* (hosted-session-start.mjs puts them in this server's env).
+    const target = await awpEndpoint(runnerId, { home, logError });
+    const endpoint = trustedMcpEndpoint(target?.url ?? "");
+    const bearer = target?.bearer;
+    if (!endpoint || !bearer)
+        throw new Error("Runner configuration requires a trusted AWP_MCP_URL and AWP_BEARER");
+    // TRC-RESTART-REASON: the hosted bridge leaves why the last workspace stopped; the first wake with work says it, once.
+    const notice = join(home, ".agentradar", "run", "restart-notice.json");
     const sessionId = randomUUID();
     const stop = new AbortController();
     let sequence = 0;
@@ -55,7 +71,7 @@ export async function startChannel(runnerId, deps = {}) {
         });
         await noteCliUpdate(response.headers, logError);
         if (!response.ok) {
-            const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;
+            const said = await response.json().then((body) => body.error?.message).catch(() => null);
             throw new Error(said ?? `AgentRadar refused the channel call (${response.status})`);
         }
         const text = await response.text();
@@ -65,9 +81,14 @@ export async function startChannel(runnerId, deps = {}) {
         return JSON.parse(json);
     };
     const next = (args = {}) => remote("tools/call", { name: "next_event", arguments: { ...args, sessionId } });
-    const pause = () => new Promise((resolve) => {
-        const done = () => { clearTimeout(timer); stop.signal.removeEventListener("abort", done); resolve(); };
+    // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
+    const guardLoaded = () => !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
+    const pause = (until) => new Promise((resolve) => {
+        const done = () => { clearTimeout(timer); clearInterval(watch); stop.signal.removeEventListener("abort", done); resolve(); };
         const timer = setTimeout(done, deps.retryMs ?? 3_000);
+        // COLD-START-WARMUP: a booting session's work is held until it polls ready, so poll the moment the marker lands.
+        const watch = until && setInterval(() => { if (until())
+            done(); }, 100);
         stop.signal.addEventListener("abort", done, { once: true });
         if (stop.signal.aborted)
             done();
@@ -76,8 +97,10 @@ export async function startChannel(runnerId, deps = {}) {
         let lastWake = "";
         let lastSent = 0;
         let selftestStarted = false;
+        let guarded = true;
         while (!stop.signal.aborted) {
             try {
+                guarded = guardLoaded(); // first, so a call that throws after the marker lands still gets the full pause
                 if (!selftestStarted) {
                     // Establish the heartbeat without entering the empty queue's 200-second hold first.
                     const connected = await next({ runnerState: "starting" });
@@ -95,8 +118,6 @@ export async function startChannel(runnerId, deps = {}) {
                 if (unconfirmed === "reported" && polled())
                     unconfirmed = null;
                 // While reported, no runnerState: the stored state stands, and the poll still drains for wake signals.
-                // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
-                const guarded = !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
                 const response = await next(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" });
                 if (response.error || response.result?.isError)
                     throw new Error("AgentRadar refused next_event; check the runner key and its poll permission");
@@ -105,10 +126,13 @@ export async function startChannel(runnerId, deps = {}) {
                 const events = payload.events ?? [];
                 const wake = JSON.stringify([events.map((event) => event.eventId), payload.livenessProbe?.nonce, Boolean(payload.onboarding)]);
                 if ((events.length || payload.livenessProbe || payload.onboarding) && (wake !== lastWake || Date.now() - lastSent >= 30_000)) {
+                    const restart = events.length ? (await runnerFrame()).restartLine(await readFile(notice, "utf8").then(JSON.parse, () => null), runnerId) : "";
                     await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: {
-                            content: `${payload.firstStep ? `${payload.firstStep} ` : ""}${events.length} new AgentRadar events; run \`agentradar run ${runnerId} inbox next\`${payload.livenessProbe ? " to receive your liveness check" : ""}.`,
+                            content: `${restart ? `${restart} ` : ""}${wakeText(runnerId, events.length, payload)}`,
                             meta: { count: String(events.length) },
                         } });
+                    if (restart)
+                        await rm(notice, { force: true });
                     lastWake = wake;
                     lastSent = Date.now();
                 }
@@ -120,7 +144,7 @@ export async function startChannel(runnerId, deps = {}) {
                 if (!stop.signal.aborted)
                     logError(/below the minimum/.test(said) ? said : "AgentRadar channel poll failed; retrying. Check connectivity and the runner key.");
             }
-            await pause();
+            await pause(guarded ? undefined : guardLoaded);
         }
     };
     const handle = async (message) => {

package/dist/index.js

@@ -5,7 +5,7 @@ import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
 import { cancelJoin, CODEX_GUARD_REFUSAL, dropStaleMcp, ensureCodexGuard, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
-import { callAwpTool, callToolOverCli, createTaskOverCli, INBOX_SEARCH_USAGE, METRIC_REPORT_USAGE, PROPOSE_HUMAN_USAGE, inboxSearchOverCli, LISTING_DESCRIBE_USAGE, listServiceToolsOverCli, parseCallArgs, PERMISSION_VERB_TOOLS, runServiceToolOverCli, TASK_VERB_TOOLS } from "./tool-run.js";
+import { callAwpTool, callToolOverCli, EXIT, parseCallArgs } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 import { importVaultOverCli } from "./vault-import.js";
 import { cloneVaultOverCli } from "./vault-clone.js";
@@ -17,25 +17,41 @@ export const runArgs = (raw) => raw[0] !== "run" ? raw
     : raw[1] === "join" ? raw.slice(1)
         : /^https?:\/\//.test(raw[1] ?? "") ? ["join", ...raw.slice(1)]
             : ["call", ...raw.slice(1)];
+const USAGE = [
+    "Usage: agentradar <noun> [<sub-noun>] <verb> [--<flag> <value> | --<flag>-file <path> ...] [--dry-run] [--json] [--runner <id>]",
+    "  Every agent command comes from the server. agentradar --help lists the groups (as $AR_CLI_RUNNER_ID),",
+    "  agentradar <group> --help a group's commands, agentradar <command> --help its flags.",
+    "  Examples:",
+    "    agentradar inbox next",
+    "    agentradar channels reply --thread-id <id> --text \"On it\"",
+    "    agentradar tasks create --title \"Draft the brief\" --dry-run",
+    "  The runner is $AR_CLI_RUNNER_ID, or --runner <id>. --dry-run prints the exact call and sends nothing.",
+    "  Exit codes: 0 done; 1 refused or unreachable (the reason is on stderr); 2 the command was wrong.",
+    "Local commands:",
+    "  agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--no-service | --service]",
+    "  agentradar join cancel <join-link|request-id>",
+    "  agentradar setup [--trust] [--harness claude|codex]",
+    "  agentradar leave <runner-id>",
+    "  agentradar channel <runner-id>",
+    "  agentradar selftest <runner-id> [--status|--restart]",
+    "  agentradar runner start <runner-id>",
+    "  agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--args '<json>']",
+    "  agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write]",
+    "  agentradar vault clone <runner-id> <vault-id> [dir]",
+    "  agentradar secrets pull|renew|env <runner-id> | agentradar secrets exec <runner-id> -- <command>",
+    "  agentradar secrets upload|rotate <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace]",
+    "  agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]",
+    "  agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>",
+    "  agentradar upgrade | agentradar --version",
+].join("\n");
 async function main() {
     const args = runArgs(process.argv.slice(2));
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-        console.log("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] [--harness claude|codex] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...] | agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write] | agentradar vault clone <runner-id> <vault-id> [dir] | agentradar metric report <runner-id> --metric-id <id> --value <n> --period-start <iso> --period-end <iso> [--evidence <text>] | agentradar secrets pull|renew <runner-id> | agentradar secrets exec <runner-id> -- <command> | agentradar propose-human <runner-id> --name <name> --email <email> --role-id <id> | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>] | agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>");
-        console.log([
-            "agentradar run <runner-id> <noun> <verb> [--<argument> <value> ...] [--dry-run] [--json]",
-            "  Every agent tool, grouped in AgentRadar terms: inbox, thread, message, task, metric, vault, ...",
-            "  agentradar run <runner-id> --help           the command groups",
-            "  agentradar run <runner-id> thread --help    a group's verbs",
-            "  agentradar run <runner-id> thread reply --help   one command's arguments",
-            "  Examples:",
-            "    agentradar run r1 inbox next",
-            "    agentradar run r1 thread reply --thread-id <id> --text \"On it\"",
-            "    agentradar run r1 inbox ack --message-ids <id> --message-ids <id>",
-            "    agentradar run r1 task create --title \"Draft the brief\" --dry-run",
-            "  --dry-run prints the exact call and sends nothing. Output is JSON. Exit codes: 0 done; 1 refused or",
-            "  unreachable (reason on stderr); 2 the command was wrong.",
-            "agentradar upgrade   install the latest agentradar-cli",
-        ].join("\n"));
+        console.log(USAGE);
+        // The agent's own groups, from its server, when this shell is a runner's.
+        const runner = process.env.AR_CLI_RUNNER_ID;
+        if (runner)
+            process.exitCode = await callToolOverCli(runner, "", undefined, {}, [["help", ""]]);
         return;
     }
     if (args.length === 1 && args[0] === "upgrade") {
@@ -70,7 +86,7 @@ async function main() {
         await startChannel(args[1]);
         return;
     }
-    if (args[0] === "selftest" && args.length === 3 && args[2] === "--restart") {
+    if (args[0] === "selftest" && args[1] !== "run" && args.length === 3 && args[2] === "--restart") {
         // A native-channel session resumes in this terminal; print the result after it closes, not over its screen.
         const report = [];
         process.once("exit", () => { if (report.length)
@@ -78,7 +94,7 @@ async function main() {
         await runRestartSelftest(args[1], { log: (text) => report.push(text) });
         return;
     }
-    if (args[0] === "selftest" && (args.length === 2 || (args.length === 3 && args[2] === "--status"))) {
+    if (args[0] === "selftest" && args[1] !== "run" && (args.length === 2 || (args.length === 3 && args[2] === "--status"))) {
         process.exitCode = await callAwpTool(args[1], "run_selftest", { statusOnly: args[2] === "--status" }, {});
         return;
     }
@@ -110,18 +126,18 @@ async function main() {
         for (let i = 1; i < args.length; i++) {
             if (["--name", "--model", "--attach-tmux", "--session"].includes(args[i]))
                 named[args[i].slice(2)] = args[++i] ?? "-";
-            else if (!["--trust", "--attach-current", "--allow-bypass", "--revoke-bypass", "--feeder"].includes(args[i]))
+            else if (!["--trust", "--attach-current", "--allow-bypass", "--revoke-bypass", "--feeder", "--service", "--no-service"].includes(args[i]))
                 urls.push(args[i]);
         }
-        if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-")) || (named["attach-tmux"] && args.includes("--attach-current"))) {
-            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current] [--session <claude session id>] [--revoke-bypass] [--feeder]");
+        if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-")) || (named["attach-tmux"] && args.includes("--attach-current")) || (args.includes("--service") && args.includes("--no-service"))) {
+            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current (Codex and other CLIs)] [--session <claude session id>] [--revoke-bypass] [--no-service | --service]");
             process.exitCode = 1;
             return;
         }
         process.exitCode = await joinOrganisation(urls[0], {
             trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
             attach: args.includes("--attach-current") ? "current" : named["attach-tmux"],
-            revokeBypass: args.includes("--revoke-bypass"), feeder: args.includes("--feeder"),
+            revokeBypass: args.includes("--revoke-bypass"), feeder: args.includes("--feeder"), service: args.includes("--service"),
         });
         return;
     }
@@ -134,21 +150,16 @@ async function main() {
         process.exitCode = await startVendorRunner(args[2]);
         return;
     }
-    if (args.length === 3 && args[0] === "tool" && args[1] === "list") {
-        process.exitCode = await listServiceToolsOverCli(args[2]);
-        return;
-    }
-    if ((args[0] === "tool" && args[1] === "run") || args[0] === "call") {
-        const call = args[0] === "call";
-        const parsed = parseCallArgs(args.slice(call ? 1 : 2));
-        if (!parsed || (!call && parsed.flags.length)) {
-            console.error(call ? "Usage: agentradar run <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar run <runner-id> [<tool>] --help" : "Usage: agentradar tool run <runner-id> <tool-key> [--args '<json>']");
-            process.exitCode = 1;
+    if (args[0] === "call") {
+        // `call <runner-id> <tool | command>`: the runner named in place, for a shell that has no AR_CLI_RUNNER_ID.
+        const parsed = parseCallArgs(args.slice(1));
+        const [runnerId, ...words] = parsed?.words ?? [];
+        if (!parsed || !runnerId || words.length > 3 || (!words.length && !parsed.flags.some(([flag]) => flag === "help"))) {
+            console.error("Usage: agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--args '<json>'] | agentradar call <runner-id> [<command>] --help");
+            process.exitCode = EXIT.usage;
             return;
         }
-        process.exitCode = call
-            ? await callToolOverCli(parsed.runnerId, parsed.tool, parsed.json, {}, parsed.flags)
-            : await runServiceToolOverCli(parsed.runnerId, parsed.tool, parsed.json);
+        process.exitCode = await callToolOverCli(runnerId, words.join(" "), parsed.json, {}, parsed.flags);
         return;
     }
     if (args[0] === "vault" && args[1] === "import") {
@@ -171,61 +182,8 @@ async function main() {
         process.exitCode = await cloneVaultOverCli(args[2], args[3], args[4]);
         return;
     }
-    if (args[0] === "inbox" && args[1] === "search") {
-        const parsed = parseCallArgs([...args.slice(2).filter((arg) => arg !== "--json"), "inbox_search"]);
-        if (!parsed || parsed.tool !== "inbox_search") {
-            console.error(INBOX_SEARCH_USAGE);
-            process.exitCode = 1;
-            return;
-        }
-        process.exitCode = await inboxSearchOverCli(parsed.runnerId, parsed.flags, args.includes("--json"));
-        return;
-    }
-    if (args[0] === "metric" && args[1] === "report") {
-        // report_metric over the same endpoint and key: an agent's own metric, a subordinate's, or a person's below it.
-        const parsed = parseCallArgs([...args.slice(2), "report_metric"]);
-        if (!parsed || !parsed.flags.some(([flag]) => flag === "metric-id")) {
-            console.error(METRIC_REPORT_USAGE);
-            process.exitCode = 1;
-            return;
-        }
-        process.exitCode = await callToolOverCli(parsed.runnerId, parsed.tool, undefined, {}, parsed.flags);
-        return;
-    }
-    if (args[0] === "propose-human") {
-        // R013: the Chief invites a human it found into a vacant role, the MCP `propose_human` over the same endpoint and key.
-        const parsed = parseCallArgs([...args.slice(1), "propose_human"]);
-        if (!parsed || !["name", "email", "role-id"].every((k) => parsed.flags.some(([flag]) => flag === k))) {
-            console.error(PROPOSE_HUMAN_USAGE);
-            process.exitCode = 1;
-            return;
-        }
-        process.exitCode = await callToolOverCli(parsed.runnerId, parsed.tool, undefined, {}, parsed.flags);
-        return;
-    }
-    if (args[0] === "listing" && args[1] === "describe") {
-        // UAT U1: the agent's public catalog description, the MCP `set_listing_description` over the same endpoint and key.
-        const parsed = parseCallArgs([...args.slice(2), "set_listing_description"]);
-        if (!parsed || !parsed.flags.some(([flag]) => flag === "capabilities")) {
-            console.error(LISTING_DESCRIBE_USAGE);
-            process.exitCode = 1;
-            return;
-        }
-        process.exitCode = await callToolOverCli(parsed.runnerId, parsed.tool, undefined, {}, parsed.flags);
-        return;
-    }
-    if (args[0] === "permissions" && args[1] && Object.hasOwn(PERMISSION_VERB_TOOLS, args[1])) {
-        const tool = PERMISSION_VERB_TOOLS[args[1]];
-        const parsed = parseCallArgs([...args.slice(2), tool]);
-        if (!parsed || parsed.tool !== tool) {
-            console.error("Usage: agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...]");
-            process.exitCode = 1;
-            return;
-        }
-        process.exitCode = await callToolOverCli(parsed.runnerId, tool, parsed.json, {}, parsed.flags);
-        return;
-    }
-    if (args[0] === "secrets") {
+    // The local secrets verbs take the runner in place; `secrets list|upload|grant|revoke|rotate --<flag>` are the server's.
+    if (args[0] === "secrets" && ["pull", "renew", "env", "exec", "upload", "rotate"].includes(args[1] ?? "") && args[2] && !args[2].startsWith("-")) {
         process.exitCode = await secretsOverCli(args.slice(1));
         return;
     }
@@ -233,15 +191,6 @@ async function main() {
         process.exitCode = await adminOverCli(args.slice(1));
         return;
     }
-    if (args[0] === "task" && args[1] && Object.hasOwn(TASK_VERB_TOOLS, args[1])) {
-        if (args.length !== 5 || args[3] !== "--args") {
-            console.error("Usage: agentradar task create|repeat|make-recurring <runner-id> --args '<json>'");
-            process.exitCode = 1;
-            return;
-        }
-        process.exitCode = await createTaskOverCli(args[2], args[1], args[4]);
-        return;
-    }
     if (args.length === 2 && args[0] === "skill" && args[1] === "install") {
         await installVendorSkill();
         return;
@@ -264,10 +213,17 @@ async function main() {
         process.exitCode = await syncAgentDir(args[1]);
         return;
     }
-    const help = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
-    (help ? console.log : console.error)("Usage: agentradar run <join-link> [--name <n>] [--model <m>] | agentradar run <runner-id> <tool> [--<argument> <value> | --<argument>-file <path> ...] | agentradar setup [--trust] | agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--feeder] | agentradar join cancel <join-link|request-id> | agentradar leave <runner-id> | agentradar channel <runner-id> | agentradar selftest <runner-id> [--status|--restart] | agentradar runner start <runner-id> | agentradar tool list <runner-id> | agentradar tool run <runner-id> <tool-key> [--args '<json>'] | agentradar call <runner-id> <tool> [--<argument> <value> ...] [--args '<json>'] | agentradar task create|repeat|make-recurring <runner-id> --args '<json>' | agentradar inbox search <runner-id> [--query <text>] [--<filter> <value> ...] [--json] | agentradar listing describe <runner-id> --capabilities <text> | agentradar permissions mine|roles|set|request|grant-tool <runner-id> [--<argument> <value> ...] | agentradar metric report <runner-id> --metric-id <id> --value <n> --period-start <iso> --period-end <iso> [--evidence <text>] | agentradar secrets pull|renew <runner-id> | agentradar secrets exec <runner-id> -- <command> | agentradar propose-human <runner-id> --name <name> --email <email> --role-id <id> | agentradar secrets upload <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace] | agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>] | agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>");
-    if (!help)
-        process.exitCode = 1;
+    // #1871: every other command is the server's, `<noun> [<sub-noun>] <verb>`, run as this shell's runner.
+    const parsed = parseCallArgs(args);
+    const runner = parsed?.flags.find(([flag]) => flag === "runner")?.[1] ?? process.env.AR_CLI_RUNNER_ID;
+    if (!parsed || !runner || parsed.words.length > 3 || (!parsed.words.length && !parsed.flags.some(([flag]) => flag === "help"))) {
+        console.error(USAGE);
+        if (parsed && !runner)
+            console.error("Agent commands run as a runner: set AR_CLI_RUNNER_ID or pass --runner <id>.");
+        process.exitCode = EXIT.usage;
+        return;
+    }
+    process.exitCode = await callToolOverCli(runner, parsed.words.join(" "), parsed.json, {}, parsed.flags.filter(([flag]) => flag !== "runner"));
 }
 /**
  * 🔴 `error.message` ALONE IS TWO WORDS ON THE FAILURE A VENDOR IS MOST LIKELY TO HIT. Node's `fetch`

package/dist/setup.js

@@ -469,13 +469,17 @@ async function installRunner(home, projectPath, approved, service, feed) {
             ...(service.env.AGENTRADAR_INPUT_READY_PATTERN ? [`AR_INPUT_READY_PATTERN=${shellValue(service.env.AGENTRADAR_INPUT_READY_PATTERN)}`] : []), `AGENT_PID_PATTERN=${shellValue(basename(bin).replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))}`);
         }
         else {
-            // The caller's own conversation, both times: a resume that fails tries it once more, never a fresh session.
-            joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`);
-            // A person's model switch: the feeder and agent-guard's hooks meet in this directory, keyed by the session.
-            joined.push(`AR_CLAUDE_SESSION_ID=${shellValue(service.sessionId)}`, `AR_MODEL_SWITCH_DIR=${shellValue(join(configDir, "model-switch"))}`);
-            const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
-            if (configDirEnv)
-                joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
+            if (service.inPlace)
+                joined.push("AR_INPLACE=1"); // the user's own launcher runs claude; no supervisor reads this file
+            else {
+                // The caller's own conversation, both times: a resume that fails tries it once more, never a fresh session.
+                joined.push(`AR_RESUME_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`, `AR_FRESH_FLAGS=${shellValue(`--resume ${service.sessionId}`)}`);
+                // A person's model switch: the feeder and agent-guard's hooks meet in this directory, keyed by the session.
+                joined.push(`AR_CLAUDE_SESSION_ID=${shellValue(service.sessionId)}`, `AR_MODEL_SWITCH_DIR=${shellValue(join(configDir, "model-switch"))}`);
+                const configDirEnv = service.env.CLAUDE_CONFIG_DIR?.trim();
+                if (configDirEnv)
+                    joined.push(`CLAUDE_CONFIG_DIR=${shellValue(resolve(configDirEnv))}`);
+            }
             // agent-guard, enabled for this session only (`--settings`), loaded from the copy inside this package, with
             // its plugin state under the runner's config so the vendor's own Claude plugins are never touched.
             const settings = join(configDir, "agentradar-settings.json");
@@ -487,16 +491,21 @@ async function installRunner(home, projectPath, approved, service, feed) {
                 // Nobody sits at the pane to accept bypass mode's warning screen; the operator's consent was given at approval.
                 ...(service.bypass ? { skipDangerousModePermissionPrompt: true } : {}),
             }, null, 2)}\n`);
-            if (service.bypass)
-                joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
-            joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
+            if (!service.inPlace) {
+                if (service.bypass)
+                    joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
+                joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
+                // Vadym 13444: the agent keeps every MCP and channel it already has; AgentRadar's channel is added next to them.
+                joined.push("AR_MCP_STRICT=0");
+            }
         }
         if (service.attach) {
             // The caller's own tmux pane: the feeder types into it; the supervisor never starts, kills or streams it.
             // TMUX names the caller's tmux server, which a service started by launchd or systemd would not find.
             joined.push("AR_ATTACH=1", `TMUX_SESSION=${shellValue(service.attach)}`, "TERMINAL_BRIDGE_ENABLED=0", ...(service.env.TMUX ? [`TMUX=${shellValue(service.env.TMUX)}`] : []), ...(harness === "generic" ? [] : [`AGENT_PID_PATTERN=${shellValue(`(^|/)${harness ?? "claude"}( |$)`)}`]));
         }
-        const toolEnv = Object.entries(service.env)
+        // An in-place join has no supervisor to read tool.env, so the caller's gateway credentials are not copied to disk.
+        const toolEnv = service.inPlace ? [] : Object.entries(service.env)
             .filter(([key, value]) => (TOOL_ENV.test(key) || toolKeys.includes(key)) && key !== "ANTHROPIC_API_KEY" && value && !value.includes("\n"))
             .map(([key, value]) => `${key}=${value}`);
         if (toolEnv.length) {
@@ -614,6 +623,7 @@ export async function setupVendorAgent(deps = {}) {
     throw new Error("AgentRadar setup code expired; run setup again");
 }
 export const bypassOnNotice = (link) => `Bypass-permissions mode is ON on this machine: the agent runs without permission prompts. To turn it off: agentradar join ${link} --revoke-bypass`;
+export const CLAUDE_CHANNEL_ONLY = "A Claude Code agent receives work only through the AgentRadar channel. --feeder, AGENTRADAR_FEED=feeder, --attach-tmux and --attach-current are for Codex and other CLIs; run join again without them.";
 export const BYPASS_REVOKED = "Bypass-permissions mode is off on this machine now; the agent asks before acting again.";
 /** A sortable key for `x.y.z[-pre]`; a release sorts above its prereleases. ponytail: prereleases of one version tie. */
 const versionRank = (version) => {
@@ -720,36 +730,34 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         }
     }
     const label = harness === "generic" ? basename((env.AGENTRADAR_AGENT_BIN ?? "").trim()) : harness === "claude" ? "Claude Code" : "Codex";
-    // Vadym 10342: every Claude Code agent connects through the AgentRadar channel. The tmux feeder is the fallback:
-    // another CLI, an explicit opt-in (--feeder, AGENTRADAR_FEED=feeder, or a pane named with --attach-*), or a
-    // channel the session never confirms (channel.ts reports it and tells the operator to re-run with --feeder).
-    const channel = harness === "claude" && !deps.feeder && env.AGENTRADAR_FEED?.trim().toLowerCase() !== "feeder" && !deps.attach;
+    // Vadym 10342 + 13430: a Claude Code agent connects through the AgentRadar channel only; nothing is ever typed
+    // into its input. The tmux feeder is for the CLIs that have no channel (Codex, generic).
+    const channel = harness === "claude";
+    // Vadym 13444: a Claude Code agent joins in place. Nothing is started, resumed or replaced; the user's own launcher
+    // gets two files and the flags to add (channel-only-claude.md §2). `--service` keeps the AgentRadar-run service.
+    const inPlace = channel && !deps.service;
+    if (channel && (deps.feeder || env.AGENTRADAR_FEED?.trim().toLowerCase() === "feeder" || deps.attach))
+        throw new Error(CLAUDE_CHANNEL_ONLY);
     // The agent is a persistent session the service owns, not this one: no MCP entry in this folder (it acts
     // through `agentradar run`), a runner env pinned to its own session, and a LaunchAgent / systemd unit.
     // Which session the agent is, settled before any request: a key is issued once, so never claim one for a session that cannot run.
     const settle = async () => {
         const tmux = deps.tmux ?? (async (args) => (await promisify(execFile)(env.TMUX_BIN || "tmux", args, { env })).stdout);
-        // Attach to the caller when it already lives in tmux: asked for by flag, or a Claude Code session in a tmux
-        // pane. The service's own session (join-<request>) re-running join is not a caller to attach to.
+        // Attach to the caller's tmux pane when asked for by flag (Codex and generic only; Claude Code is refused above).
         let attach = deps.attach === "current" ? env.TMUX_PANE : deps.attach;
         if (deps.attach === "current" && !attach)
             throw new Error("--attach-current needs a session running inside tmux");
-        // Never in channel mode: nothing types into the caller's pane.
-        if (!channel && !deps.attach && harness === "claude" && env.CLAUDECODE && env.TMUX && env.TMUX_PANE)
-            attach = env.TMUX_PANE;
         if (attach) {
             // A pane id (%3) dies with the tmux server; session:window.pane comes back when its session is recreated.
             attach = (await tmux(["display-message", "-p", "-t", attach, "#{session_name}:#{window_index}.#{pane_index}"])).trim();
             if (!attach)
                 throw new Error("tmux found no such pane");
-            if (!deps.attach && attach.startsWith("join-"))
-                attach = undefined;
         }
         // Unattended, the service resumes the caller's own Claude conversation, never a stranger's. An attached
         // pane is never started from here, so there its session id only keys the model switch.
-        const sessionId = harness !== "claude" ? undefined
-            : await callerSession(deps, env, home, await realpath(cwd)).catch((error) => { if (attach || channel)
-                return undefined; throw error; });
+        const sessionId = harness !== "claude" || inPlace ? undefined
+            : await callerSession(deps, env, home, await realpath(cwd)).catch((error) => { if (deps.session)
+                throw error; return undefined; });
         return { attach, sessionId };
     };
     let where;
@@ -758,14 +766,14 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
      * 10-04, after the Codex run stopped on an approval prompt nobody could answer); `--revoke-bypass` takes it
      * back on this machine. An attached pane keeps the permission mode it already runs in.
      */
-    const localBypass = (approvedBypass, revoked) => approvedBypass && !revoked && !where.attach;
+    const localBypass = (approvedBypass, revoked) => approvedBypass && !revoked && !where.attach && !inPlace;
     const startJoined = async (requestId, agentId, installation, approvedBypass, bypass, saved) => {
         const runnerId = `join-${requestId}`;
         const { attach } = where;
         const projectPath = harness === "claude"
             ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
             : await realpath(cwd);
-        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId: where.sessionId ?? requestId, env, attach, bypass }, channel ? "push" : undefined);
+        const runnerEnv = await installRunner(home, projectPath, { status: "approved", agentId, runnerId, installation, harness }, { sessionId: where.sessionId ?? requestId, env, attach, bypass, inPlace }, channel ? "push" : undefined);
         await saved?.();
         log(`Runner installed → ${runnerEnv}`);
         if (bypass)
@@ -774,6 +782,15 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         await syncJoinedSkills(runnerId, { home, fetch: fetchImpl, log }).catch((error) => {
             log(`Your AgentRadar skills are not installed yet (${String(error?.message ?? error).split("\n")[0]}); the runner installs them once it is running.`);
         });
+        if (inPlace) {
+            const config = join(home, ".agentradar", "config", runnerId);
+            if (approvedBypass)
+                log("Your company allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
+            log(`Connected, nothing started: your session, its MCPs and its channels are untouched. To receive client messages, restart your agent ONCE with these flags added to its own launch command (keep what it already has, including --continue):
+  --mcp-config ${join(config, "awp-only.json")} --dangerously-load-development-channels server:agentradar --settings ${join(config, "agentradar-settings.json")}
+and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time development-channel prompt when it appears. To stop: agentradar leave ${runnerId}, then drop those flags.`);
+            return 0;
+        }
         try {
             await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
         }
@@ -791,14 +808,10 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
         const mode = bypass ? ", in bypass-permissions mode as your company allowed" : "";
         if (channel) {
             log(`Connected through the AgentRadar channel. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): client messages are pushed into it and it answers there, with no restart from you. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`);
-            log(`If your company's Claude plan blocks channels, deliver with the feeder instead: agentradar join ${enrolmentUrl} --feeder`);
             log("Running as a service; it restarts on crash and reboot.");
             return 0;
         }
-        // Only Claude resumes the caller's own conversation; Codex and a generic CLI start their own session.
-        log(harness === "claude"
-            ? `Connected. This conversation now continues as a service in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. Exit this session now (/exit) so only the service carries on; watch it with: tmux attach -t ${runnerId}. To stop it: agentradar leave ${runnerId}`
-            : `Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
+        log(`Connected. Your agent now runs in its own ${label} session in ${projectPath} (tmux session ${runnerId}${mode}): your welcome and every client message are typed into it, and it answers there. There is nothing more to do in this session. To stop it: agentradar leave ${runnerId}`);
         log("Running as a service; it restarts on crash and reboot.");
         return 0;
     };
@@ -990,8 +1003,8 @@ export async function leaveOrganisation(runnerId, deps = {}) {
         await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
     }
     // The service stopping leaves the session running; `=` matches the tmux session name exactly.
-    // An attached pane is the caller's own session: it stays.
-    if (envValue(saved, "AR_ATTACH") !== "1")
+    // An attached pane or an in-place join is the caller's own session: it stays.
+    if (envValue(saved, "AR_ATTACH") !== "1" && envValue(saved, "AR_INPLACE") !== "1")
         await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
     for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
         await rm(path, { force: true });