agentradar-cli 0.3.7 → 0.3.8

package/dist/channel.js

@@ -71,7 +71,7 @@ export async function startChannel(runnerId, deps = {}) {
         });
         await noteCliUpdate(response.headers, logError);
         if (!response.ok) {
-            const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;
+            const said = await response.json().then((body) => body.error?.message).catch(() => null);
             throw new Error(said ?? `AgentRadar refused the channel call (${response.status})`);
         }
         const text = await response.text();

package/dist/tool-run.js

@@ -129,6 +129,23 @@ export function parseCallArgs(rest) {
 const pathOf = (tool) => typeof tool._meta?.cli?.path === "string" ? tool._meta.cli.path : undefined;
 const kebab = (name) => name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
 const firstSentence = (text = "") => text.split(/(?<=[.!?])\s/)[0].trim();
+// Vadym 14075: a hosted agent tried ~10 key sets for approvalDetails on request_egress and never found the real ones,
+// so --help spells out a JSON argument's fields and these commands carry one complete example each.
+// The approvals and browser skills quote this output word for word (tool-run.test.ts checks it).
+const APPROVAL_EXAMPLES = {
+    request_egress: `--host supplier.example.com --reason 'The price list task needs this supplier website.' --approval-details '{"context":"The price list task needs prices from a supplier website.","reason":"No connector has these prices, and the website is the only source.","ifDeclined":"The price list stays unfinished.","decisionDetail":"Let my browser reach supplier.example.com."}'`,
+    request_spend_limit: `--monthly-limit-cents 5000 --reason 'The weekly reports need more AI time.' --approval-details '{"context":"I used most of my monthly AI limit by the 20th.","reason":"The weekly reports added this month need more AI time.","ifDeclined":"I pause the weekly reports until next month.","decisionDetail":"Raise my monthly AI limit to $50."}'`,
+    request_hire: `--title 'Support agent' --approval-details '{"context":"Customer emails wait two days for an answer.","reason":"Nobody on the team has time to answer them.","ifDeclined":"Emails keep waiting and some customers may leave.","decisionDetail":"Hire one support agent to answer customer emails."}'`,
+    request_permission: `--area projects --op write --approval-details '{"context":"I was asked to create a project for the spring launch.","reason":"My role can read projects but not create them.","ifDeclined":"Someone else has to create the project.","decisionDetail":"Let my role create and edit projects."}'`,
+};
+/** `  context (required, 1-600 characters): What happened: ...` for each field of a JSON argument. */
+const fieldLines = (name, schema, root) => [`--${kebab(name)} is JSON with these fields:`,
+    ...Object.entries(schema.properties ?? {}).map(([field, own]) => {
+        // A field reusing another's rule arrives as {"$ref": "#/properties/approvalDetails/properties/context"} plus its own description.
+        const f = { ...own.$ref?.split("/").slice(1).reduce((at, key) => at?.[key], root), ...own };
+        const size = f.minLength !== undefined && f.maxLength !== undefined ? `, ${f.minLength}-${f.maxLength} characters` : "";
+        return `  ${field} (${schema.required?.includes(field) ? "required" : "optional"}${size})${f.description ? `: ${f.description}` : ""}`;
+    })];
 async function listedTools(runnerId, deps) {
     const listed = await awpRequest(runnerId, "tools/list", {}, deps);
     return listed ? listed.result?.tools ?? [] : null;
@@ -179,6 +196,8 @@ function leafHelp(tool) {
         "USAGE", `  agentradar ${path}${required.map((name) => ` --${kebab(name)} ${typeOf(properties[name] ?? {})}`).join("")}${optional.length ? " [flags]" : ""}`,
         ...(required.length ? ["REQUIRED", ...required.filter((name) => name in properties).map(flag)] : []),
         "FLAGS", ...optional.map(flag), "  --dry-run  print the exact call and send nothing   --json  raw JSON   --runner <id>  the runner (default $AR_CLI_RUNNER_ID)",
+        ...Object.entries(properties).flatMap(([name, schema]) => schema.properties ? fieldLines(name, schema, tool.inputSchema) : []),
+        ...(tool.name && APPROVAL_EXAMPLES[tool.name] ? [`Example: agentradar ${path} ${APPROVAL_EXAMPLES[tool.name]}`] : []),
         EXIT_CODES,
     ].join("\n");
 }
@@ -194,8 +213,10 @@ async function flagArguments(entry, flags, deps) {
     for (let [flag, value] of flags) {
         // --body-file page.md: the argument read from a file, so a multi-line page never sits in a quoted
         // shell argument (Claude Code prompts on a newline followed by # inside one).
+        // --content-base64-file page.html: a *Base64 argument gets the file's bytes as base64, any type (ANY-FILE-SEND).
         if (flag.endsWith("-file") && !(flag in schema) && !(camel(flag) in schema)) {
-            const text = await readArgumentFile(value, deps.cwd ?? process.cwd(), deps.home ?? homedir()).catch((error) => error);
+            const binary = camel(flag.slice(0, -"-file".length)).endsWith("Base64");
+            const text = await readArgumentFile(value, deps.cwd ?? process.cwd(), deps.home ?? homedir(), binary).catch((error) => error);
             if (text instanceof Error) {
                 logError(`--${flag}: ${text.message}`);
                 return null;
@@ -222,7 +243,9 @@ async function flagArguments(entry, flags, deps) {
         }
         const typed = coerce(type, value);
         if (typed === undefined) {
-            logError(`--${flag} must be a ${type}`);
+            logError(schema[key].properties
+                ? `--${flag} must be JSON with the fields ${(schema[key].required ?? Object.keys(schema[key].properties)).join(", ")}; \`agentradar ${pathOf(entry) ?? `call <runner-id> ${entry.name}`} --help\` shows each one.`
+                : `--${flag} must be a ${type}`);
             return null;
         }
         out[key] = typed;
@@ -255,21 +278,21 @@ function listFlagError(flag, itemType, schema) {
 }
 /**
  * `agentradar run` is always-allowed, so a file flag must not read and upload any file the agent names:
- * only a regular file inside the working folder (after symlinks), and at most 256 KB — and never one in
+ * only a regular file inside the working folder (after symlinks), and at most 256 KB (7 MB as base64) — and never one in
  * ~/.agentradar, which holds the runner's own key even when the working folder is $HOME.
  * ponytail: a hard link to the key is not caught (same inode, different path); making one is the agent's own act.
  */
-async function readArgumentFile(path, cwd, home) {
+async function readArgumentFile(path, cwd, home, binary = false) {
     const real = await realpath(resolve(cwd, path)).catch(() => { throw new Error(`cannot read ${path}`); });
     const within = (dir) => { const inside = relative(dir, real); return inside !== ".." && !inside.startsWith(`..${sep}`) && !isAbsolute(inside); };
     const own = await realpath(join(home, ".agentradar")).catch(() => null);
     if (own && within(own))
         throw new Error(`${path} is refused: a file flag never reads AgentRadar's own folder (~/.agentradar), which holds this agent's key`);
     const info = await stat(real);
-    if (!info.isFile() || !within(await realpath(cwd)) || info.size > 256 * 1024) {
-        throw new Error(`${path} is refused: a file flag reads only a regular file inside the current folder, up to 256 KB`);
+    if (!info.isFile() || !within(await realpath(cwd)) || info.size > (binary ? 7 * 1024 * 1024 : 256 * 1024)) {
+        throw new Error(`${path} is refused: a file flag reads only a regular file inside the current folder, up to ${binary ? "7 MB" : "256 KB"}`);
     }
-    return await readFile(real, "utf8");
+    return binary ? (await readFile(real)).toString("base64") : await readFile(real, "utf8");
 }
 function coerce(type, value) {
     if (type === "string")
@@ -339,7 +362,8 @@ export async function callAwpTool(runnerId, name, toolArguments, deps) {
     // A refusal is the server's sentence and belongs on stderr with a non-zero exit, or a script that
     // pipes stdout reads "the tool ran" from a body that says it was refused.
     if (body.result?.isError) {
-        logError(said);
+        // The server's JSON, then its plain "AgentRadar refused <tool>: ... Now: ..." line when it sends one.
+        logError([said, ...(body.result.content ?? []).slice(1).map((c) => c.text).filter((t) => typeof t === "string")].join("\n"));
         return 1;
     }
     log(withCliUpdate(said));
@@ -415,15 +439,14 @@ async function postAwp(url, bearer, method, params, deps) {
     });
     await noteCliUpdate(response.headers, logError);
     if (!response.ok) {
-        // 426: this CLI is below the server's minimum; its sentence says how to upgrade.
-        const said = response.status === 426 ? await response.json().then((body) => body.error?.message).catch(() => null) : null;
-        // 401: the server says only "unauthorized" for every cause, so a revoked key and an ended hire read the same here.
+        // 426 says how to upgrade; 401 says why the key was refused and how to re-join.
+        const said = await response.json().then((body) => body.error?.message).catch(() => null);
         logError(said ?? (response.status === 401 ? UNAUTHORIZED : `AgentRadar refused the tool call (${response.status}).`));
         return null;
     }
     const body = await response.json();
     if (body.error) {
-        logError(typeof body.error.message === "string" ? body.error.message : "AgentRadar returned an error");
+        logError(typeof body.error.message === "string" ? body.error.message : `AgentRadar returned an error to ${method === "tools/call" ? String(params.name) : method}. Now: run \`agentradar upgrade\`, then try again.`);
         return null;
     }
     return body;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentradar-cli",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "engines": {
     "node": ">=20"
   },