agentradar-cli 0.3.6 → 0.3.8

package/dist/vendor-runner/feeder.mjs

@@ -516,20 +516,53 @@ export async function waitForPaneReceipt(eventId, sample = paneHasEvent, sleepFn
   }
 }
 
+// Vadym 14045 / #1856: Rev ran one 1h12m turn while the SAME eventId sat in its input queue ~40 times. An event typed
+// into the pane but not yet seen in its history (Claude queues a prompt typed mid-turn) stays unacked, so the server
+// re-serves it on every poll and the feeder typed it again each time. Once typed, an event is not typed again until
+// its window has passed (EVENT_REINJECT_MS, doubled each retry, capped at EVENT_REINJECT_MAX_MS), and it is acked as
+// soon as it shows in the pane. The DB holds one row for it (served_at set, never acknowledged): the copies are made here.
+const EVENT_REINJECT_MS = Number(process.env.EVENT_REINJECT_MS ?? "600000");
+const EVENT_REINJECT_MAX_MS = Number(process.env.EVENT_REINJECT_MAX_MS ?? "3600000");
+// While every served event is held, the server answers the next poll at once with the same batch; poll this often
+// instead (a busy pane used to hold the loop ~INJECT_BUSY_WAIT_MS in injectEvent; 1 s was 3600 polls per held hour).
+const HELD_POLL_MS = Number(process.env.HELD_POLL_MS ?? "30000");
+const _typed = new Map();
+export function noteTyped(eventId, now = Date.now()) {
+  const wait = Math.min((_typed.get(eventId)?.wait ?? EVENT_REINJECT_MS / 2) * 2, EVENT_REINJECT_MAX_MS);
+  _typed.set(eventId, { at: now, wait });
+}
+/** True while an event already typed into the pane should be left alone. */
+export function typedAlready(eventId, now = Date.now()) {
+  const typed = _typed.get(eventId);
+  return Boolean(typed && now - typed.at < typed.wait);
+}
+export const forgetTyped = (eventId) => { _typed.delete(eventId); };
+const pruneTyped = (now = Date.now()) => { for (const [id, t] of _typed) if (now - t.at > 24 * 3_600_000) _typed.delete(id); };
+
+// The hosted bridge leaves this when the last workspace was stopped or crashed mid-work (TRC-RESTART-REASON).
+const RESTART_NOTICE = join(homedir(), ".agentradar", "run", "restart-notice.json");
+const readNotice = (file) => { try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; } };
+
 /** Inject one client event into the live pane. Returns true only after Claude's pane shows the submitted turn. */
-async function injectEvent(event) {
-  if (!(await waitForIdlePane())) {
+export async function injectEvent(event, { idle = waitForIdlePane, inject = injectFrame, receipt = waitForPaneReceipt, noticeFile = RESTART_NOTICE } = {}) {
+  if (!(await idle())) {
     console.warn(
       `[feeder] pane ${TMUX_SESSION} still mid-turn after ${INJECT_BUSY_WAIT_MS}ms — NOT injecting eventId=${event.eventId}; leaving it UNACKED for re-delivery`,
     );
     return false;
   }
-  const injected = await injectFrame(
-    formatInjectionFrame(event, AR_CLI_RUNNER_ID),
+  const restartNotice = readNotice(noticeFile);
+  const injected = await inject(
+    formatInjectionFrame(restartNotice ? { ...event, restartNotice } : event, AR_CLI_RUNNER_ID),
     `eventId=${event.eventId} (source=${event.source}, conversationId=${event.conversationId ?? "-"})`,
   );
   if (!injected) return false;
-  if (await waitForPaneReceipt(event.eventId)) return true;
+  noteTyped(event.eventId);
+  if (await receipt(event.eventId)) {
+    forgetTyped(event.eventId);
+    if (restartNotice) fs.rmSync(noticeFile, { force: true }); // told once
+    return true;
+  }
   console.warn(
     `[feeder] pane ${TMUX_SESSION} did not show eventId=${event.eventId} after injection — leaving it UNACKED for re-delivery`,
   );
@@ -636,6 +669,15 @@ export function paneInputReady(text, harness = AR_AGENT_HARNESS, readyPattern =
     : /bypass permissions on\b|^\s*❯/im.test(tail);
 }
 
+/**
+ * A turn, tool or dialog owns the pane, so nothing may be typed into it (Vadym 15775, Rev's phantom STOP). Measured
+ * on CLI 2.1.282 during a foreground Bash: the footer's "esc to interrupt" shows at 80 and 120 columns but is cut
+ * at 50, where the ❯ prompt and the bypass footer still show; the spinner line "✽ Sautéing… (24s · ↓ 105 tokens)"
+ * shows at every width and turns into "✻ Worked for 13s" when the turn ends.
+ */
+export const paneBusy = (text) => /\besc to (?:interrupt|cancel)\b/i.test(text ?? "")
+  || /^\s*[^\w\s]\s+\S+…\s*\(\s*(?:\d+h\s*)?(?:\d+m\s*)?\d+s\b/m.test(text ?? "");
+
 /**
  * Vadym 12490: the permission mode Claude Code's footer names ("⏸ manual mode on"), or null when no footer shows.
  * A hosted session must read "bypass permissions"; anything else is reported so the server can alert.
@@ -680,7 +722,7 @@ function capturePane() {
   // "• Working (1s • esc to interrupt)", measured on codex-cli 0.149.1, so this matcher needs no harness
   // branch. This is only a HINT that triggers a probe on stagnation — it never decides liveness, so a
   // missed/extra hint is harmless.
-  const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
+  const inProgress = paneBusy(text);
   // The CLI's idle input prompt is the durable readiness signal, and it is the one pane signal that differs
   // per harness (see paneInputReady). The optional bypass-permissions footer disappeared from a live Claude
   // build after several turns, which falsely demoted a healthy pane to `starting` and stopped next_event
@@ -1067,7 +1109,13 @@ let _lastRunnerState = null;
 
 /** One receive→inject→ack-select cycle (extracted from loop() + exported so the #173b _pendingAck
  *  fence is directly testable). Sets `_pendingAck` = the eventIds to ack on the NEXT poll. */
-export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch, wait = waitForReady) {
+/**
+ * Vadym 15469: Claude Code takes work only through the AgentRadar channel. Keys typed into its pane interrupt a running tool
+ * and can stay stuck in the input box, so a Claude pane fed here is told apart, never typed into: its pollOnce arguments
+ * report channel_unconfirmed ("Not receiving messages"), which drains nothing, and never type a /model switch either.
+ */
+export const channelOnlyPoll = (harness = AR_AGENT_HARNESS) => harness === "claude" ? [paneIsLive, () => "channel_unconfirmed", injectEvent, async () => {}] : [];
+export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, deliverEvent = injectEvent, drive = driveModelSwitch, wait = waitForReady, paneHas = paneHasEvent) {
   // next_event refreshes the portal's runner heartbeat. Never call it for a detached/orphan feeder: a
   // process without its owned tmux session cannot receive work, so polling would paint a false Live state
   // while every event stays unacknowledged. The supervisor recreates the session; until then the durable
@@ -1113,7 +1161,14 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   }
   console.log(`[feeder] received ${events.length} event(s) → injecting into live session`);
   const delivered = [];
+  let held = 0;
+  pruneTyped();
   for (const e of events) {
+    // Already typed into the pane: ack it once it shows there, else leave it alone until its window passes.
+    if (_typed.has(e.eventId)) {
+      if (paneHas(e.eventId)) { forgetTyped(e.eventId); delivered.push(e.eventId); continue; }
+      if (typedAlready(e.eventId)) { held += 1; continue; }
+    }
     // Inject in order; ack ONLY the ones that reached a live pane (no-phantom).
     // eslint-disable-next-line no-await-in-loop
     if (await deliverEvent(firstStep ? { ...e, firstStep } : e)) delivered.push(e.eventId);
@@ -1124,6 +1179,8 @@ export async function pollOnce(paneLive = paneIsLive, readiness = runnerState, d
   }
   _pendingAck = delivered;
   if (delivered.length) console.log(`[feeder] delivered ${delivered.length}/${events.length} → will ack`);
+  // The server re-serves what is still unacked at once, so a batch held back whole must not spin on it.
+  if (held && held === events.length) await sleep(HELD_POLL_MS);
 }
 
 async function loop() {
@@ -1138,9 +1195,11 @@ async function loop() {
     void syncSkills();
     setInterval(() => { void syncSkills(); }, SKILLS_SYNC_INTERVAL_MS).unref?.();
   }
+  const channelOnly = channelOnlyPoll();
+  if (channelOnly.length) console.warn("[feeder] Claude Code receives work only through the AgentRadar channel: run `agentradar join` again; reporting channel_unconfirmed, typing nothing");
   while (!_stopping) {
     try {
-      await pollOnce();
+      await pollOnce(...channelOnly);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[feeder] iteration error: ${msg} — re-establishing MCP session`);

package/dist/vendor-runner/session-frame.mjs

@@ -21,6 +21,36 @@ function oneLine(s) {
     .trim();
 }
 
+/** The send tool of each room channel (mirrors the server's replyToolForSource in awp/discovery.ts). Anything else: Slack's `reply`. */
+const REPLY_TOOL = { telegram: "telegram_reply", discord: "discord_reply", whatsapp: "whatsapp_reply", email: "email_reply" };
+
+/**
+ * Sources with nobody waiting in a channel (a company notice, an approval decision, platform traffic, no source at all): `reply` has nowhere
+ * to go and fails ("no active engagement"). Each says what to do instead; the message above carries its own "Now:" line.
+ */
+function noReplyAnswer(e, run) {
+  const notice = "nobody is waiting for a reply, so do not use reply";
+  if (e.source === "approval")
+    return `This is the decision on an approval you asked for, not a chat message: do not use reply on this thread. Run \`${run} acknowledge_decision\` with the approvalId in the message, then do the rest of its "Now:" line (react in the thread where you asked).`;
+  if (e.source === "moderator" && e.noticeKind === "permission_request")
+    return `This is a permission request from a colleague, not a chat message: they are waiting for your decision, not a reply, so do not use reply. Decide it now. To agree, run \`${run} set_role_permission\` with the roleId, area and level (and mode, if the message names one) from the message, plus approvalDetails with four short plain sentences and no ids: context (what happened), reason (why), ifDeclined (what happens if you say no) and decisionDetail (what is granted). To refuse, do nothing more: nothing else is needed.`;
+  if (e.source === "moderator")
+    return `This is a notice from your company, not a chat message: ${notice}. Do what its "Now:" line says; if it has none, stop.`;
+  if (e.source === "agentradar")
+    return `This is a notice from AgentRadar, not a chat message: ${notice}. Do what the message says; if it asks for nothing, stop.`;
+  return `This message has no source, so there is no channel to reply into: do not use reply. Run \`${run} get_my_context\` to see what is waiting for you, then act on it.`;
+}
+// peer-handoff (run 39060351286): an unconditional "Reply with:" outvoted the brief's "a handoff that asks you nothing gets a reaction
+// only" (Vadym 12276), so the grantee thanked in text. The condition now comes before the command, an order counts as an ask, and a
+// plain notice gets the source's reaction (only where the agent has a react tool, as discovery.ts ackToolForSource) and the ack.
+const REACT = { telegram: ["telegram_react", "👍"], slack: ["slack_react", "white_check_mark"] };
+const NO_TEXT = (run, source, turn, evId) => {
+  const ack = `\`${run} inbox_ack --message-ids "${evId ?? "<eventId>"}"\``;
+  const react = Object.hasOwn(REACT, source) ? `react with \`${run} ${REACT[source][0]}${turn} --emoji "${REACT[source][1]}"\`, then run ` : "run ";
+  return `Only if it just tells you something and asks nothing (a notice, a handoff, a thanks), send no text: ${react}${ack}.`;
+};
+const NO_REPLY_SOURCES = new Set(["moderator", "approval", "agentradar", undefined, null, ""]);
+
 /**
  * Build the single-line injection frame for one drained next_event event.
  * event: { eventId, source, channel?, conversationId?, text, firstStep? }
@@ -36,14 +66,47 @@ export function formatInjectionFrame(event, cliRunnerId) {
   if (e.taskId) tags.push(`taskId=${e.taskId}`); // assignment events: the agent works THIS task, not one dug out of its log
   if (e.eventId) tags.push(`eventId=${e.eventId}`);
   // Vadym 11025: the server's `firstStep` (get_my_context first) opens every frame that carries work.
-  const header = `[AgentRadar inbound · ${tags.join(" · ")}]${e.firstStep ? ` ${oneLine(e.firstStep)} Message:` : ""}`;
+  const restart = restartLine(e.restartNotice, cliRunnerId); // before anything else the agent reads, once per restart
+  const header = `[AgentRadar inbound · ${tags.join(" · ")}]${restart ? ` ${restart}` : ""}${e.firstStep ? ` ${oneLine(e.firstStep)} Message:` : ""}`;
   const body = oneLine(e.text) || "(no text)";
   const evId = e.eventId ? String(e.eventId) : null;
   // The reply instruction pins the EXPLICIT conversationId (threading) + inResponseToEventId
   // (exact provenance under concurrent same-conversation turns — disc S2).
   const run = `agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"}`;
+  const turn = `${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""}`;
+  // A task wake has no conversation: nobody waits in a channel, so `reply` has nowhere to go. The answer is a comment on the task.
+  const answer = e.taskId && !e.conversationId && e.reason === "review_requested"
+    ? `Record your verdict with: ${run} review_task --issue-id "${e.taskId}" --decision accept|reject --reason '<why>'.`
+    : e.taskId && !e.conversationId
+    ? `Answer on the task with: ${run} comment_on_task --issue-id "${e.taskId}" --body '<your answer>'.`
+    : NO_REPLY_SOURCES.has(e.source) ? noReplyAnswer(e, run)
+    : `If the message asks you something or asks you to do something, or its "Now:" line asks for a reply, answer or do it, then reply with: ${run} ${(Object.hasOwn(REPLY_TOOL, e.source) ? REPLY_TOOL[e.source] : "reply")}${turn} --text '<your reply>'. ${NO_TEXT(run, e.source, turn, evId)}`;
+  // The server's catch-up line (catch-up.ts: older messages edited, or chatter since the agent's last ack) rides in `guidance`,
+  // which the frame does not carry; without it an agent answered from what it last saw, not the edited text (edit-reconcile, 10-18).
+  // Channel wakes only (moderator/approval/agentradar wakes have no thread to read), and as a runnable command, not prose.
+  const channelWake = e.conversationId && (e.source === "slack" || Object.hasOwn(REPLY_TOOL, e.source));
+  // qa-sec MED (#2679): names and titles in guidance can carry a newline and forge a "Now: catch up" line, which this turns into
+  // a command the agent runs. So take the LAST such line (the server's is last, in the turn block) and keep it only when its
+  // conversation is this wake's and its cursor is base64url (encodeThreadCursor); anything else is dropped, never run.
+  const raw = channelWake ? (e.guidance ?? "").match(/^Now: catch up\b.*$/gm)?.at(-1) : undefined;
+  let lifted = false;
+  const catchUp = raw?.replace(/read_history with conversationId "([^"]+)"(?: and after "([^"]+)")?(?: \(it starts right after your last ack\))?/,
+    (m, c, a) => c !== e.conversationId || /["`$\\]/.test(c) || (a !== undefined && !/^[A-Za-z0-9_-]+$/.test(a))
+      ? m
+      : ((lifted = true), `\`${run} read_history --conversation-id "${c}"${a ? ` --after "${a}"` : ""}\``));
+  // Vadym 12241: who wrote it and where. The frame carried neither, and Quill answered a group question untagged with its private
+  // part in the room, 3 runs of 3 (group-manners, 10-18). The handle is shape-checked and the name stripped to plain words: both
+  // land in the agent's turn as text, so neither can carry a command.
+  const handle = /^(@\w{1,32}|<@[UW][A-Z0-9]+>)$/.test(e.senderHandle ?? "") ? e.senderHandle : null;
+  const name = oneLine(e.sender?.name).replace(/[^\p{L}\p{N} .'-]/gu, "").slice(0, 40).trim();
+  const who = name && handle ? `${name} (${handle})` : name || handle || "";
+  const room = !channelWake || !e.chat ? null
+    : e.chat.type === "dm" ? `This is a direct chat${who ? ` from ${who}` : ""}: one human, so no @mention is needed.`
+    : `This is a ${e.chat.type} with other humans and agents${who ? `; the message is from ${who}` : ""}. Reply in the ${e.chat.type} with an @mention of ${handle ?? "the sender"}; a private matter (approvals, reminders, billing) is not answered here: say it waits on their Needs you page in the AgentRadar app, without a link.`;
   const parts = [
-    `Reply with: ${run} reply${e.conversationId ? ` --conversation-id "${e.conversationId}"` : ""}${evId ? ` --in-response-to-event-id "${evId}"` : ""} --text '<your reply>'.`,
+    ...(lifted ? [catchUp] : []),
+    ...(room ? [room] : []),
+    answer,
     evId
       ? `For billable work run ${run} report_usage with --idempotency-key "${evId}:<usage-code>" so a re-delivered event never double-charges.`
       : `Use ${run} report_usage for billable work.`,
@@ -52,6 +115,27 @@ export function formatInjectionFrame(event, cliRunnerId) {
   return oneLine(`${header} ${body} — ${parts.join(" ")}`);
 }
 
+/**
+ * TRC-RESTART-REASON: the hosted bridge's note that the last workspace ended mid-work, said once on the next wake.
+ * Haiden's DM blast was cut by stops it could not explain; the agent must know why, what died and how to resume safely.
+ */
+export function restartLine(notice, cliRunnerId, now = Date.now()) {
+  const at = Date.parse(notice?.at ?? "");
+  if (Number.isNaN(at) || !RESTART_REASONS[notice?.reason]) return "";
+  const time = new Date(at).toISOString().slice(11, 16);
+  const min = Math.max(0, Math.round((now - at) / 60_000));
+  const ago = min < 60 ? `${min} min` : `${Math.round(min / 60)} h`;
+  // A crash leaves only the time the workspace last started, so that one is "some time after".
+  const when = notice.reason === "crashed" ? `stopped without warning some time after ${time} UTC (${ago} ago)` : `was stopped at ${time} UTC (${ago} ago)`;
+  return `Your workspace ${when}. ${RESTART_REASONS[notice.reason]} Anything you had running was stopped and is not running now: background jobs, loops and open shells. Files in your home folder are still there. Before you do anything else: 1. Check what finished: look at the files and logs your job wrote, and the results of the calls it made. 2. Restart only the items that did not finish, with \`agentradar run ${cliRunnerId || "$AR_CLI_RUNNER_ID"}\`, passing each one the same --idempotency-key it had before. An item whose key already ran returns its earlier result and is not sent twice. Then handle this message:`;
+}
+
+const RESTART_REASONS = {
+  idle: "It stopped after the workspace was idle. Running turns, tools and background jobs keep it awake, even when they are silent; there is no runtime cap.",
+  stopped: "AgentRadar stopped it, to update or move your workspace or because someone in your company stopped it. Nothing you did caused this.",
+  crashed: "It crashed, possibly from running out of memory.",
+};
+
 /**
  * #173b — build the single-line frame for a #156 liveness PROBE.
  *

package/dist/vendor-runner/supervisor/supervise-agent.sh

@@ -48,6 +48,7 @@ set -a
 # shellcheck source=/dev/null
 . "${ENV_FILE}"
 set +a
+[ "${2:-}" = "--dry-run" ] && AR_DRY_RUN=1
 
 # --- 2. Validate + defaults ---------------------------------------------------
 : "${AGENT_NAME:?AGENT_NAME required in env}"
@@ -66,6 +67,11 @@ CLAUDE_BIN="${CLAUDE_BIN:-claude}"
 TMUX_BIN="${TMUX_BIN:-tmux}"
 CLAUDE_EXTRA_FLAGS="${CLAUDE_EXTRA_FLAGS:-}"          # e.g. "--chrome" (Spielberg/Sam); empty (Liza)
 PRE_LAUNCH_HOOK="${PRE_LAUNCH_HOOK:-}"                # optional per-agent script run once before claude
+PRE_LAUNCH_HOOK_REQUIRED="${PRE_LAUNCH_HOOK_REQUIRED:-0}" # 1: a failing or missing hook aborts the launch; the loop retries (e.g. wait for the gateway)
+AR_LAUNCH_ARGS_FILE="${AR_LAUNCH_ARGS_FILE:-}"        # extra launch args, one VERBATIM arg per line (`@file:<path>` = that file's whole content as one arg)
+AR_PROMPT_WATCH_SEC="${AR_PROMPT_WATCH_SEC:-180}"     # how long to answer startup prompts (dev channels, Chrome intro, resume summary)
+AR_READY_PORTS="${AR_READY_PORTS:-}"                  # e.g. "8769 8770": none up after the watch = deaf session, kill the pane so it is recreated
+AR_DRY_RUN="${AR_DRY_RUN:-0}"                         # 1 (or a 2nd argument --dry-run): print the exact argv and env, start nothing
 BROWSER_APP="${BROWSER_APP:-Google Chrome}"          # #150: app to ensure-up for --chrome agents (macOS)
 BROWSER_READY_MAX_SEC="${BROWSER_READY_MAX_SEC:-20}" # #150: bounded wait for the browser proc on cold boot
 BROWSER_READY_SETTLE_SEC="${BROWSER_READY_SETTLE_SEC:-3}" # #150: settle for extension/native-host after cold launch
@@ -149,6 +155,9 @@ else
   # SC2086: CLAUDE_EXTRA_FLAGS is intentionally UNQUOTED so "--chrome" (etc.) word-splits into flags.
   # shellcheck disable=SC2086
   _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --strict-mcp-config --mcp-config="${MCP_CONFIG}" )
+  # AR_MCP_STRICT=0 (written by `agentradar join`): AgentRadar joins the agent's own MCPs and channels instead of
+  # replacing them (Vadym 13444). The default stays strict: hosted and vendor-fleet agents still get only $MCP_CONFIG.
+  [ "${AR_MCP_STRICT:-1}" = 0 ] && _launch_flags=( ${CLAUDE_EXTRA_FLAGS} --mcp-config="${MCP_CONFIG}" )
   # `agentradar join` enables the agent-guard plugin for this session only, through a settings file.
   [ -n "${CLAUDE_SETTINGS:-}" ] && _launch_flags+=( --settings "${CLAUDE_SETTINGS}" )
   # R764 + Vadym 10342: the AgentRadar channel (the stdio MCP `agentradar` in $MCP_CONFIG) pushes work in; no feeder types.
@@ -161,6 +170,24 @@ else
 fi
 AGENT_PID_PATTERN="${AGENT_PID_PATTERN:-${_agent_pid_pattern_default}}"
 
+# The launcher for a session that already has its own launch command (the secretary: model pin, plugin dirs, channels,
+# --append-system-prompt): its flags go here verbatim, after ours. CLAUDE_EXTRA_FLAGS word-splits and cannot carry them.
+AR_ARGS_CHROME=""
+if [ -n "${AR_LAUNCH_ARGS_FILE}" ]; then
+  [ -f "${AR_LAUNCH_ARGS_FILE}" ] || die "AR_LAUNCH_ARGS_FILE not found: ${AR_LAUNCH_ARGS_FILE}"
+  while IFS= read -r _a || [ -n "${_a}" ]; do
+    case "${_a}" in
+      ''|'#'*) continue ;;
+      '@file:'*) [ -f "${_a#@file:}" ] || die "AR_LAUNCH_ARGS_FILE names a missing file: ${_a#@file:}"; _a="$(cat "${_a#@file:}")" ;;
+    esac
+    [ "${_a}" = "--chrome" ] && AR_ARGS_CHROME="--chrome"
+    _launch_flags+=( "${_a}" )
+  done < "${AR_LAUNCH_ARGS_FILE}"
+fi
+if [ "${PRE_LAUNCH_HOOK_REQUIRED}" = 1 ] && [ ! -x "${PRE_LAUNCH_HOOK}" ]; then
+  die "PRE_LAUNCH_HOOK_REQUIRED=1 but PRE_LAUNCH_HOOK is not an executable file: '${PRE_LAUNCH_HOOK}'"
+fi
+
 # Optional per-agent TOOL credentials — a vendor brain's OWN MCP-tool API keys (e.g. an SEO agent's
 # WEBFLOW_TOKEN / PERPLEXITY_API_KEY). These are ADDED to the scrubbed launch env so the agent's own
 # tool servers (declared in its --mcp-config) get their creds, WITHOUT widening the daemon's
@@ -228,6 +255,24 @@ command -v "${AGENT_BIN}" >/dev/null 2>&1 || die "${AR_AGENT_HARNESS} CLI not fo
 [ -f "${PANE_LIVE_SH}" ] || die "pane liveness check not found: ${PANE_LIVE_SH}"
 [ -d "${AR_BASE}" ] || die "AR_BASE dir not found: ${AR_BASE}"
 
+# --- 2a-bis. Dry run: the exact launch, printed, nothing started or written. Secret values show only their length.
+# Same argv/env as the launch below: `env -i` allowlist + claude cfg + tool-env entries, then the resume args and flags.
+if [ "${AR_DRY_RUN}" = 1 ]; then
+  # redact by (case-insensitive) name or by value shape: a secret in a name we did not foresee still shows only its length
+  _show() { local _n; _n=$(printf %s "$1" | tr a-z A-Z); case "${_n}" in *TOKEN*|*KEY*|*SECRET*|*BEARER*|*PASS*|*AUTH*|*COOKIE*|*CRED*|PAT|*_PAT|PAT_*|*_PAT_*) printf 'ENV %s=<redacted:%s chars>\n' "$1" "${#2}"; return ;; esac
+    case "$2" in *://*:*@*|*[Bb]earer\ *) printf 'ENV %s=<redacted:%s chars>\n' "$1" "${#2}" ;; *) printf 'ENV %s=%s\n' "$1" "$2" ;; esac; }
+  _showarg() { case "$1" in *[Bb]earer*|*://*:*@*|*[Tt]oken=*|*[Ss]ecret=*|*[Kk]ey=*) printf 'ARGV <redacted:%s chars>\n' "${#1}" ;; *) printf 'ARGV %q\n' "$1" ;; esac; }
+  printf 'DRY_RUN session=%s cwd=%s harness=%s feed=%s resume=%s fresh=%s\n' "${TMUX_SESSION}" "${AR_BASE}" "${AR_AGENT_HARNESS}" "${AR_FEED}" "${AR_RESUME_FLAGS}" "${AR_FRESH_FLAGS}"
+  for _k in HOME PATH USER LOGNAME SHELL LANG LC_ALL TMPDIR NODE_OPTIONS CODEX_HOME; do _show "${_k}" "${!_k:-}"; done
+  _show TERM "${AR_AGENT_TERM:-tmux-256color}"; _show COLORTERM "${AR_AGENT_COLORTERM:-truecolor}"; _show LC_CTYPE "${AR_AGENT_LC_CTYPE:-en_US.UTF-8}"
+  _show DISABLE_AUTOUPDATER 1; _show CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF 1
+  for _kv in ${_claude_cfg[@]+"${_claude_cfg[@]}"} ${TOOL_ENV_ARGS[@]+"${TOOL_ENV_ARGS[@]}"}; do _show "${_kv%%=*}" "${_kv#*=}"; done
+  printf 'ARGV %q\n' "${AGENT_BIN}"
+  # shellcheck disable=SC2086  # the resume args word-split in the pane wrapper too
+  for _a in ${AR_RESUME_FLAGS} ${_launch_flags[@]+"${_launch_flags[@]}"}; do _showarg "${_a}"; done
+  exit 0
+fi
+
 # --- 2b. Credential hygiene (#152): secrets to 0600 files, OUT of argv+env ------
 # The AWP bearer must not linger in any long-lived process's ARGV (`ps aux`) or ENVIRONMENT
 # (`ps eww`), where a co-resident process on the box could read it. Stage it into a per-agent 0600
@@ -253,7 +298,7 @@ if [ "${#TOOL_ENV_ARGS[@]}" -gt 0 ]; then
   TOOL_ENV_ARGS=()   # #166: no longer passed inline on the env -i line
 fi
 
-session_exists() { "${TMUX_BIN}" has-session -t "${TMUX_SESSION}" 2>/dev/null; }
+session_exists() { "${TMUX_BIN}" has-session -t "=${TMUX_SESSION}" 2>/dev/null; }
 pane_alive() {
   TMUX_BIN="${TMUX_BIN}" TMUX_SESSION="${TMUX_SESSION}" AGENT_PID_PATTERN="${AGENT_PID_PATTERN}" \
     /bin/sh "${PANE_LIVE_SH}"
@@ -266,7 +311,7 @@ pane_alive() {
 # Overridable via BROWSER_APP (default "Google Chrome"). macOS-only; documented no-op elsewhere (on Linux,
 # launch the browser in your runner env / at login). Belt-and-suspenders alongside a Login-Items entry.
 ensure_browser() {
-  case " ${CLAUDE_EXTRA_FLAGS} " in
+  case " ${CLAUDE_EXTRA_FLAGS} ${AR_ARGS_CHROME} " in
     *" --chrome "*) : ;;   # --chrome as a WHOLE space-bounded token (won't false-match e.g. --chromeless)
     *) return 0 ;;         # not a --chrome agent → nothing to do
   esac
@@ -302,7 +347,7 @@ ensure_browser() {
 # True when one identical `API Error: 400` line (digits normalised: the message index moves) fills the pane
 # scrollback AR_API400_LOOP_MAX times. ponytail: only the last 200 lines are read, so a very slow loop could slip by.
 api_error_loop() {
-  "${TMUX_BIN}" capture-pane -p -J -t "${TMUX_SESSION}" -S -200 2>/dev/null \
+  "${TMUX_BIN}" capture-pane -p -J -t "=${TMUX_SESSION}:" -S -200 2>/dev/null \
     | grep -o 'API Error: 400 .*' | sed -E 's/[0-9]+/N/g' | sort | uniq -c | sort -rn \
     | awk -v m="${AR_API400_LOOP_MAX}" 'NR==1{ok=($1>=m)} END{exit !ok}'
 }
@@ -321,7 +366,7 @@ ensure_agent() {
   fi
   if session_exists && ! pane_alive; then
     log "session '${TMUX_SESSION}' exists but claude pane is dead — recreating"
-    "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true
+    "${TMUX_BIN}" kill-session -t "=${TMUX_SESSION}" 2>/dev/null || true
   fi
   [ -n "${AR_GUARD_MARKER}" ] && rm -f "${AR_GUARD_MARKER}"   # this launch must prove the guard afresh
   # Retire-legacy step 1 (Vadym 11054): Codex starts only with AgentRadar's guard. Its SessionStart hook does not
@@ -347,7 +392,10 @@ ensure_agent() {
   ensure_browser   # #150: bring up the browser first for --chrome agents (idempotent, no-op otherwise)
   if [ -n "${PRE_LAUNCH_HOOK}" ] && [ -x "${PRE_LAUNCH_HOOK}" ]; then
     log "running pre-launch hook: ${PRE_LAUNCH_HOOK}"
-    "${PRE_LAUNCH_HOOK}" || log "WARN pre-launch hook exited non-zero (continuing)"
+    if ! "${PRE_LAUNCH_HOOK}"; then
+      [ "${PRE_LAUNCH_HOOK_REQUIRED}" = 1 ] && { log "pre-launch hook failed and is required — not launching"; return 1; }
+      log "WARN pre-launch hook exited non-zero (continuing)"
+    fi
   fi
   # SCRUBBED launch: env -i with a strict allowlist so the agent inherits nothing from this daemon
   # (AWP_BEARER, AWP_MCP_URL, etc. never reach the pane). CONNECTOR ISOLATION is enforced by
@@ -428,19 +476,37 @@ ensure_agent() {
   return 1
 }
 
-# A pushed session starts on Claude Code's "Loading development channels" warning, and nobody sits at an unattended
-# pane to confirm it. The channel is this machine's own installed CLI (`agentradar channel <runner>`), so the
-# service confirms it, once per launch, only while that exact warning is on screen.
+# A pushed session starts on Claude Code's "Loading development channels" warning ("I am using this for local
+# development" / "Exit"), once per development channel, and nobody sits at an unattended pane to confirm it. A launcher
+# that carries its own launch args (AR_LAUNCH_ARGS_FILE) names those channels itself, so it answers every one of them,
+# however late, plus the Chrome intro and the "Resume from summary" modal, for AR_PROMPT_WATCH_SEC (same strings and
+# keys as the secretary's watchdog). Then, if AR_READY_PORTS names channel ports and none is listening, the session is
+# deaf: kill the pane so the monitor loop recreates it.
 accept_dev_channels() {
-  [ "${AR_FEED}" = "push" ] || return 0
-  for _ in $(seq 1 30); do
-    if "${TMUX_BIN}" capture-pane -p -t "=${TMUX_SESSION}:" 2>/dev/null | grep -q "Loading development channels"; then
-      "${TMUX_BIN}" send-keys -t "=${TMUX_SESSION}:" Enter
-      log "confirmed Claude Code's development-channels warning for the AgentRadar channel"
-      return 0
+  { [ "${AR_FEED}" = "push" ] || [ -n "${AR_LAUNCH_ARGS_FILE}" ]; } || return 0
+  local _pane _now _t0 _last=0 _chrome=0 _resume=0 _p _up=0 _presses=0
+  _t0=$(date +%s)
+  while _now=$(date +%s); [ $(( _now - _t0 )) -lt "${AR_PROMPT_WATCH_SEC}" ]; do
+    _pane="$("${TMUX_BIN}" capture-pane -p -t "=${TMUX_SESSION}:" 2>/dev/null || true)"
+    if [ "${_presses}" -lt 6 ] && [ $(( _now - _last )) -ge 2 ] && { grep -q "I am using this for local development" <<< "${_pane}" || grep -q "Loading development channels" <<< "${_pane}"; }; then
+      "${TMUX_BIN}" send-keys -t "=${TMUX_SESSION}:" 1 Enter
+      _last=${_now}; _presses=$(( _presses + 1 ))   # cap: text the agent itself prints must not type into its conversation forever
+      log "confirmed Claude Code's development-channels warning for a launch channel"
+    fi
+    if [ "${_chrome}" = 0 ] && grep -q "Claude in Chrome (Beta)" <<< "${_pane}"; then
+      "${TMUX_BIN}" send-keys -t "=${TMUX_SESSION}:" Enter; _chrome=1; log "dismissed the Claude-in-Chrome intro"
+    fi
+    if [ "${_resume}" = 0 ] && grep -q "Resume from summary" <<< "${_pane}"; then
+      "${TMUX_BIN}" send-keys -t "=${TMUX_SESSION}:" Enter; _resume=1; log "took the default of the resume-from-summary modal"
     fi
     sleep 1
   done
+  [ -n "${AR_READY_PORTS}" ] || return 0
+  for _p in ${AR_READY_PORTS}; do (exec 3<>"/dev/tcp/127.0.0.1/${_p}") 2>/dev/null && _up=1; done
+  if [ "${_up}" = 0 ]; then
+    log "WARNING: no channel port of '${AR_READY_PORTS}' is up after ${AR_PROMPT_WATCH_SEC}s: killing the pane so it is recreated"
+    "${TMUX_BIN}" kill-session -t "=${TMUX_SESSION}" 2>/dev/null || true   # "=": exact match, never a prefix (join-req-1 killed join-req-12)
+  fi
 }
 
 # --- 4. Run: ensure agent, run feeder in foreground, monitor both -------------
@@ -525,7 +591,7 @@ while true; do
   elif [ "${AR_ATTACH:-}" != "1" ] && [ $(( $(date +%s) - ${_LAST_HEAL:-0} )) -ge "${AR_API400_COOLDOWN_SEC}" ] && api_error_loop; then
     log "agent pane is looping on the same API 400 — replacing it with a FRESH session"
     _LAST_HEAL=$(date +%s); _FORCE_FRESH=1; _heal=1
-    "${TMUX_BIN}" kill-session -t "${TMUX_SESSION}" 2>/dev/null || true
+    "${TMUX_BIN}" kill-session -t "=${TMUX_SESSION}" 2>/dev/null || true
   fi
   if [ "${_heal}" = 1 ]; then
     if ensure_agent; then

package/dist/vendor-runner/terminal-bridge.mjs

@@ -351,6 +351,11 @@ class TerminalBridge {
       case "detach":
         this.stopPipe();
         break;
+      case "clear":
+        // An engagement ended or changed: drop the scrollback so the next client's snapshot (capture-pane -S)
+        // cannot replay the previous one's. The visible screen of the live session is not touched.
+        tmux(["clear-history", "-t", TMUX_SESSION]);
+        break;
       case "input":
         if (typeof obj.data === "string") tmux(["send-keys", "-t", TMUX_SESSION, "-l", obj.data]);
         break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "engines": {
     "node": ">=20"
   },
@@ -19,7 +19,6 @@
     "dist/sync.js",
     "dist/vault-import.js",
     "dist/update.js",
-    "dist/commands.js",
     "dist/vault-clone.js",
     "dist/secrets.js",
     "dist/admin.js",

package/dist/commands.js

@@ -1,74 +0,0 @@
-/**
- * Vadym 9970 (CLI-FIRST): every agent-facing MCP tool is also a CLI command, `agentradar run <runner-id> <noun> <verb>`,
- * in AgentRadar terms. The tree is derived from the server's own tools/list at call time, so it cannot fall behind
- * the MCP; this file only says how a tool name reads as a noun and a verb.
- */
-/** Nouns a tool name is grouped under, most specific first. A tool takes the first one its name contains. */
-const NOUNS = [
-    "inbox", "thread", "message", "task", "metric", "quota", "vault", "memory", "skill", "escalation", "incident",
-    "karma", "wallet", "spend", "budget", "usage", "browser", "email", "telegram", "slack", "discord", "whatsapp",
-    "github", "model", "outcome", "role", "org_chart", "org", "project", "integration", "channel", "peer",
-    "subordinate", "secret", "service", "onboarding", "intervention", "marketplace", "hire", "egress", "feedback",
-    "contact", "placement", "mcp", "tool", "join_link", "handoff", "selftest", "readiness", "pane", "brief",
-    "teammate", "approval", "agent",
-];
-const PLURAL = {
-    messages: "message", tasks: "task", metrics: "metric", vaults: "vault", skills: "skill", escalations: "escalation",
-    threads: "thread", channels: "channel", peers: "peer", subordinates: "subordinate", integrations: "integration",
-    secrets: "secret", agents: "agent", interventions: "intervention", events: "event", retrospectives: "retrospective",
-};
-/** Where the rule above would put a tool somewhere an agent would not look for it. */
-const OVERRIDES = {
-    next_event: ["inbox", "next"],
-    mark_messages_read: ["inbox", "mark-read"],
-    search_history: ["thread", "history"],
-    reply: ["thread", "reply"],
-    read_history: ["thread", "read"],
-    mark_read: ["thread", "mark-read"],
-    expect_reply: ["thread", "expect-reply"],
-    clear_reply_allowance: ["thread", "clear-reply-allowance"],
-    request_reply_clearance: ["thread", "request-reply-clearance"],
-    github_thread: ["github", "thread"],
-    post_escalation_discussion_message: ["escalation", "post-message"],
-    read_escalation_discussion: ["escalation", "read-discussion"],
-    get_self: ["agent", "self"],
-    get_my_context: ["agent", "context"],
-    liveness_ack: ["agent", "liveness-ack"],
-    remember: ["memory", "remember"],
-    recall: ["memory", "recall"],
-    my_skills: ["skill", "mine"],
-    list_my_threads: ["thread", "list"],
-    list_my_metrics: ["metric", "list"],
-    read_my_usage: ["usage", "read"],
-    // #496 (APPROVAL-ASK): the comment thread on an approval, and the decision it acknowledges.
-    approval_comments: ["approval", "comments"],
-    approval_comment: ["approval", "comment"],
-    acknowledge_decision: ["approval", "acknowledge"],
-};
-/** One-release aliases: still on the MCP, never given a command of their own. */
-export const DEPRECATED_TOOLS = new Set(["acknowledge_messages"]);
-/** `<noun> <verb>` for a tool name. */
-export function commandFor(tool) {
-    const fixed = OVERRIDES[tool];
-    if (fixed)
-        return fixed;
-    // Plurals fold only to FIND the noun (list_tasks is a task command); the verb keeps the tool's own words, so
-    // slack_list_channels reads "list-channels" as slack_list_users reads "list-users".
-    const raw = tool.split("_");
-    const words = raw.map((word) => PLURAL[word] ?? word);
-    for (const noun of NOUNS) {
-        const parts = noun.split("_");
-        for (let i = 0; i + parts.length <= words.length; i++) {
-            if (parts.every((part, k) => words[i + k] === part)) {
-                const rest = [...raw.slice(0, i), ...raw.slice(i + parts.length)];
-                return [noun.replace(/_/g, "-"), rest.join("-") || "get"];
-            }
-        }
-    }
-    return ["agent", raw.join("-")];
-}
-/** The tool a `<noun> <verb>` names among the server's tools, or undefined. */
-export function toolFor(noun, verb, tools) {
-    return tools.find((tool) => !DEPRECATED_TOOLS.has(tool) && commandFor(tool).join(" ") === `${noun} ${verb}`);
-}
-//# sourceMappingURL=commands.js.map