agentradar-cli 0.3.8 → 0.3.10

package/dist/admin.js

@@ -1,21 +1,29 @@
+import { readFileSync } from "node:fs";
 /**
- * ADMIN-BROADCAST (Vadym 12310/12828): `agentradar admin broadcast` for an instance admin. Authenticates with a board
+ * ADMIN-BROADCAST (Vadym 12310/12828): `agentradar admin broadcast` for an instance admin; REPORTER-NOTICE-ROUTE: `admin notice` to one agent. Authenticates with a board
  * API key in AGENTRADAR_ADMIN_TOKEN, never a runner key; the server refuses anyone who is not an instance admin.
  */
 export const ADMIN_BROADCAST_USAGE = "Usage: agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>"
     + "  (env AGENTRADAR_ADMIN_TOKEN = an instance admin's board API key; AGENTRADAR_API_URL = the API base)";
+export const ADMIN_NOTICE_USAGE = "Usage: agentradar admin notice --dry-run|--send --agent <id> --ref <key> --file <text file> --cta <next step, naming the tool; a retry must say to check first> [--wake]"
+    + "  (a notice is delivered once per --ref; --wake also wakes the agent; same env as broadcast)";
 export async function adminOverCli(args, deps = {}) {
     const env = deps.env ?? process.env, log = deps.log ?? console.log, logError = deps.logError ?? console.error;
+    const sub = args[0], notice = sub === "notice";
     const named = {};
     const modes = args.slice(1).filter((arg) => arg === "--dry-run" || arg === "--send");
+    let wake = false;
     for (let i = 1; i < args.length; i++) {
-        if (["--target", "--text", "--cta"].includes(args[i]))
+        if ((notice ? ["--agent", "--ref", "--file", "--cta"] : ["--target", "--text", "--cta"]).includes(args[i]))
             named[args[i].slice(2)] = args[++i] ?? "";
+        else if (notice && args[i] === "--wake")
+            wake = true;
         else if (!modes.includes(args[i]))
             modes.push("?");
     }
-    if (args[0] !== "broadcast" || modes.length !== 1 || modes[0] === "?" || named.target !== "all" || !named.text || !named.cta) {
-        logError(ADMIN_BROADCAST_USAGE);
+    const complete = notice ? named.agent && named.ref && named.file && named.cta : named.target === "all" && named.text && named.cta;
+    if ((sub !== "broadcast" && !notice) || modes.length !== 1 || modes[0] === "?" || !complete) {
+        logError(notice ? ADMIN_NOTICE_USAGE : ADMIN_BROADCAST_USAGE);
         return 2;
     }
     const token = env.AGENTRADAR_ADMIN_TOKEN?.trim();
@@ -24,9 +32,21 @@ export async function adminOverCli(args, deps = {}) {
         return 2;
     }
     const base = (env.AGENTRADAR_API_URL ?? "https://vendor.agentradar.com/api").replace(/\/+$/, "");
-    const res = await (deps.fetch ?? fetch)(`${base}/admin/agent-broadcast`, {
-        method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-        body: JSON.stringify({ target: "all", text: named.text, cta: named.cta, dryRun: modes[0] === "--dry-run" }),
+    const dryRun = modes[0] === "--dry-run";
+    let body;
+    if (notice) {
+        try {
+            body = { agentId: named.agent, ref: named.ref, text: (deps.readFile ?? ((f) => readFileSync(f, "utf8")))(named.file), cta: named.cta, wake, dryRun };
+        }
+        catch {
+            logError(`Cannot read ${named.file}`);
+            return 2;
+        }
+    }
+    else
+        body = { target: "all", text: named.text, cta: named.cta, dryRun };
+    const res = await (deps.fetch ?? fetch)(`${base}/admin/${notice ? "agent-notice" : "agent-broadcast"}`, {
+        method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify(body),
     });
     const text = await res.text();
     if (!res.ok) {

package/dist/agent-guard/hooks/hooks.json

@@ -1,8 +1,10 @@
 {
-  "description": "Marks the session as guarded (the runner reports ready only then); blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; reports compactions to AgentRadar; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses).",
+  "description": "Marks the session as guarded (the runner reports ready only then); blocks going idle while AgentRadar work is owed; reminds of the house rules every AR_DISCIPLINE_EVERY turns; reports compactions to AgentRadar; syncs the skills folder right after write_skill/link_skill; marks a sub-agent's commands (AR_CALLER=teammate) so it cannot act as the agent; guards AgentRadar compact-then-switch model changes (a crashed PreModelSwitch hook exits 2 and refuses); refuses an rm on a variable or $(...) path, which would otherwise raise an approval prompt nobody answers.",
   "hooks": {
     "SessionStart": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" start", "timeout": 10 }] }],
     "Stop": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" stop", "timeout": 30 }] }],
+    "PostToolUse": [{ "matcher": "Bash|mcp__.*__(write_skill|link_skill)", "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" skills", "timeout": 20 }] }],
+    "PreToolUse": [{ "matcher": "Bash", "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" bash", "timeout": 10 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/rm-guard.mjs\"", "timeout": 10 }] }],
     "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard.mjs\" prompt", "timeout": 10 }] }],
     "PreCompact": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PreCompact", "timeout": 30 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PreCompact", "timeout": 30 }] }],
     "PostCompact": [{ "hooks": [{ "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/model-switch.mjs\" PostCompact", "timeout": 30 }, { "type": "command", "command": "AR_HOOK=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/compaction-report.mjs\" PostCompact", "timeout": 30 }] }],

package/dist/agent-guard/scripts/compaction-report.mjs

@@ -41,9 +41,11 @@ export async function reportCompaction(event, input, { send, followUp, stateDir
   if (input?.hook_event_name !== event || !ID.test(input.session_id ?? "")) return;
   const marker = join(stateDir, `agentradar-compaction-${input.session_id}.json`);
   const trigger = typeof input.trigger === "string" ? input.trigger.slice(0, 40) : null;
+  // Every report names its session: several sessions of one agent compacting at once read as one loop without it.
+  const sessionId = input.session_id;
   if (event === "PreCompact") {
     writeFileSync(marker, JSON.stringify({ at: now() }), { mode: 0o600 });
-    return send({ phase: "start", trigger });
+    return send({ phase: "start", sessionId, trigger });
   }
   if (event !== "PostCompact") return;
   let startedAt = now();
@@ -51,21 +53,25 @@ export async function reportCompaction(event, input, { send, followUp, stateDir
   rmSync(marker, { force: true });
   // The compact_boundary line (the only source of token counts) is written after this hook returns, so it is
   // reported separately, by a detached follow-up; this report must not wait for it.
-  send({ phase: "end", outcome: "ok", trigger, durationMs: now() - startedAt });
-  return followUp?.({ transcriptPath: input.transcript_path, startedAt, trigger });
+  send({ phase: "end", outcome: "ok", sessionId, trigger, durationMs: now() - startedAt });
+  return followUp?.({ transcriptPath: input.transcript_path, startedAt, sessionId, trigger });
 }
 
-/** Detached follow-up: waits up to `waitMs` for the boundary this compaction wrote, then reports its token counts. */
-export async function reportTokens({ transcriptPath, startedAt, trigger }, { send, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), waitMs = 60_000, pollMs = 500 }) {
+/**
+ * Detached follow-up: waits up to `waitMs` for the boundary this compaction wrote, then reports its token counts. No
+ * boundary in time is reported too (boundary "not_found"), so a missing tokens row means the follow-up never ran.
+ */
+export async function reportTokens({ transcriptPath, startedAt, sessionId, trigger }, { send, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), waitMs = 60_000, pollMs = 500 }) {
   for (let waited = 0; waited <= waitMs; waited += pollMs) {
     const boundary = lastBoundary(transcriptPath, startedAt - 1_000);
-    if (boundary) return send({ phase: "tokens", trigger, ...boundary });
+    if (boundary) return send({ phase: "tokens", sessionId, trigger, ...boundary });
     await sleep(pollMs);
   }
+  return send({ phase: "tokens", sessionId, trigger, boundary: "not_found" });
 }
 
 const sendToServer = (report) => spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
-  ["call", process.env.AR_CLI_RUNNER_ID || "hosted", "report_compaction", "--args", JSON.stringify(report)], { encoding: "utf8", timeout: 20_000 });
+  ["call", process.env.AR_CLI_RUNNER_ID || "hosted", "report_compaction", "--input", JSON.stringify(report)], { encoding: "utf8", timeout: 20_000 });
 const spawnFollowUp = (job) => spawn(process.execPath, [fileURLToPath(import.meta.url), "tokens", JSON.stringify(job)], { detached: true, stdio: "ignore" }).unref();
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/dist/agent-guard/scripts/guard.mjs

@@ -8,6 +8,11 @@
 //         output) lets the agent stop: a guard that wedges the session is worse than no guard.
 // start:  writes AR_GUARD_MARKER, the runner's proof that this session loaded the guard: its feeder and
 //         channel report "starting", never "ready", until the file exists (AGENT-GUARD-ACTIVE, Vadym 10699).
+//         It also adds the house rules to the context and says to load agentradar-discipline, at the start and
+//         after every compaction or resume (Vadym 15633: the built-in skill is loaded for every agent at start).
+// skills: after write_skill/link_skill, has the runner's feeder sync the skills folder at once.
+// bash:   (PreToolUse on Bash) a sub-agent's command runs with AR_CALLER=teammate, so the CLI marks its calls and the
+//         server refuses it any reply or act as the agent (Vadym 16706). Claude Code names a sub-agent's call by agent_id.
 // prompt: every AR_DISCIPLINE_EVERY turns (default 20, 0 = off) re-adds the house rules, the must-nots
 //         and the installed skills to the context.
 import { spawnSync } from "node:child_process";
@@ -17,6 +22,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const MAX_BLOCKS = 3;
+const SKILL_SYNC_WAIT_MS = 15_000;
 const runner = process.env.AR_CLI_RUNNER_ID ?? "";
 const cli = process.env.AR_AGENTRADAR_BIN || "agentradar";
 
@@ -32,7 +38,8 @@ const call = (tool) => `agentradar call ${runner} ${tool}`;
 
 const RULES = [
   "Answer every message in the channel it came from, and a human first: someone is waiting.",
-  `Acknowledge what you handled: ${call("acknowledge_messages")} --args '{"eventIds":[...]}' for messages, ${call("acknowledge_task")} --issueId <id> for a task you take on.`,
+  `Acknowledge what you handled: ${call("acknowledge_messages")} --input '{"eventIds":[...]}' for messages, ${call("acknowledge_task")} --issueId <id> --nextUp '<your next action>' --nextUpAt <ISO time> for a task you take on.`,
+  "Keep your main session free: any long job (a script, a report, a rebuild, many API calls) goes to a teammate or sub-agent, or a background job, even when it looks quick. A human's \"how to work\" order holds for every later job.",
   "Talk is not a task: reply conversationally, and create a task only for trackable, billable work.",
   "Write so a 13-year-old would understand: short, plain words, one next step, no ids or tool names unless asked. Say it once.",
   `Before you go idle, run ${call("agent_obligations")}: "owed" must be 0, and every in-progress task must be moving or waiting on someone who knows it.`,
@@ -40,7 +47,7 @@ const RULES = [
 const MUST_NOTS = [
   "Never ask for, print or pass on a credential. AgentRadar holds the keys.",
   `Never call decide_outcome or declare_outcome on your own task: only a human accepts your work. Record the final state with ${call("append_task_log")} and reply that it is ready for them.`,
-  "Never contact the platform team (submit_feedback) unless the human asks you to.",
+  "Never contact the platform team (submit_feedback) unless the human asks you to, or a tool answer tells you to report a platform fault.",
 ];
 
 // Skill folders the agent can load: this plugin's, the project's, and the user's (Claude Code and Codex).
@@ -60,26 +67,47 @@ function skills() {
   return [...names].sort();
 }
 
+const houseRules = (event, heading) => JSON.stringify({
+  hookSpecificOutput: {
+    hookEventName: event,
+    additionalContext: [
+      heading,
+      ...RULES.map((rule, i) => `${i + 1}. ${rule}`),
+      "You must not:",
+      ...MUST_NOTS.map((rule) => `- ${rule}`),
+      `Your skills (load the one that fits before acting): ${skills().join(", ") || "none installed"}.`,
+    ].join("\n"),
+  },
+});
+
 if (process.argv[2] === "start") {
   if (process.env.AR_GUARD_MARKER) writeFileSync(process.env.AR_GUARD_MARKER, `${input.session_id ?? ""}\n`);
+  if (runner) process.stdout.write(houseRules("SessionStart", "AgentRadar house rules. Load your agentradar-discipline skill now and follow it for this whole session:"));
+} else if (process.argv[2] === "skills" && process.env.AR_GUARD_MARKER
+  // The MCP tool, or its CLI mirror (`agentradar call <runner> write_skill`) run through Bash.
+  && (input.tool_name !== "Bash" || /\b(write_skill|link_skill)\b/.test(String(input.tool_input?.command ?? "")))) {
+  // PostToolUse on write_skill/link_skill (Vadym 12397): ask the feeder to sync skills now, and hold the tool's
+  // answer until it has, so the skill is on disk before the agent's next step. A feeder that does not answer in
+  // SKILL_SYNC_WAIT_MS leaves it to its next periodic sync.
+  const nonce = `${process.pid}-${Date.now()}`;
+  writeFileSync(`${process.env.AR_GUARD_MARKER}.skills`, nonce);
+  const until = Date.now() + SKILL_SYNC_WAIT_MS;
+  const nap = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() < until) {
+    try { if (readFileSync(`${process.env.AR_GUARD_MARKER}.skills-done`, "utf8") === nonce) break; } catch {}
+    Atomics.wait(nap, 0, 0, 200);
+  }
+} else if (process.argv[2] === "bash") {
+  if (input.agent_id && typeof input.tool_input?.command === "string") {
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", updatedInput: { ...input.tool_input, command: `export AR_CALLER=teammate; ${input.tool_input.command}` } } }));
+  }
 } else if (process.argv[2] === "prompt") {
   const every = Number.parseInt(process.env.AR_DISCIPLINE_EVERY ?? "20", 10);
   // No reset of `blocks` here: Codex may run this hook for a Stop continuation, which would lift the cap.
   state.turns += 1;
   save();
   if (runner && every > 0 && state.turns % every === 0) {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "UserPromptSubmit",
-        additionalContext: [
-          `AgentRadar house rules (reminder every ${every} turns):`,
-          ...RULES.map((rule, i) => `${i + 1}. ${rule}`),
-          "You must not:",
-          ...MUST_NOTS.map((rule) => `- ${rule}`),
-          `Your skills (load the one that fits before acting): ${skills().join(", ") || "none installed"}.`,
-        ].join("\n"),
-      },
-    }));
+    process.stdout.write(houseRules("UserPromptSubmit", `AgentRadar house rules (reminder every ${every} turns):`));
   }
 } else if (process.argv[2] === "stop" && runner) {
   const reason = stopReason();
@@ -103,15 +131,19 @@ function stopReason() {
   const tasks = Array.isArray(o.unacknowledgedTasks) ? o.unacknowledgedTasks : [];
   const working = Array.isArray(o.inProgressTasks) ? o.inProgressTasks : [];
   const asks = Array.isArray(o.overdueAsks) ? o.overdueAsks : [];
+  const unread = Array.isArray(o.unreadTaskComments) ? o.unreadTaskComments : [];
+  const late = Array.isArray(o.lateNextUps) ? o.lateNextUps : [];
   const name = (t) => `${t.identifier ?? t.issueId} "${t.title ?? ""}" (issueId ${t.issueId})`;
-  if (messages.length || tasks.length || asks.length) {
+  if (messages.length || tasks.length || asks.length || unread.length || late.length) {
     return [
-      `AgentRadar: you still owe ${messages.length + tasks.length + asks.length} item(s). Do not go idle yet.`,
+      `AgentRadar: you still owe ${messages.length + tasks.length + asks.length + unread.length + late.length} item(s). Do not go idle yet.`,
       ...(messages.length ? [
-        `Messages received but not acknowledged: ${messages.join(", ")}. Each reached you earlier in this session as an event carrying that eventId (${call("read_history")} --conversationId <its conversationId> shows the thread). Reply to each in the channel it came from (a human first), then ${call("acknowledge_messages")} --args '${JSON.stringify({ eventIds: messages })}'.`,
+        `Messages received but not acknowledged: ${messages.join(", ")}. Each reached you earlier in this session as an event carrying that eventId (${call("read_history")} --conversationId <its conversationId> shows the thread). Reply to each in the channel it came from (a human first), then ${call("acknowledge_messages")} --input '${JSON.stringify({ eventIds: messages })}'.`,
       ] : []),
-      ...tasks.map((t) => `Task assigned to you, not acknowledged: ${name(t)}. Take it on or say why not, then ${call("acknowledge_task")} --issueId ${t.issueId}.`),
-      ...asks.map((a) => `Nobody answered your ask in thread ${a.threadId} (due ${a.dueAt}${a.note ? `; ${a.note}` : ""}). Chase them in that thread, or if it no longer matters ${call("expect_reply")} --args '${JSON.stringify({ conversationId: a.threadId, by: null })}'.`),
+      ...tasks.map((t) => `Task assigned to you, not acknowledged: ${name(t)}. Read it first with ${call("get_task")} --issueId ${t.issueId} and do what its description asks (its title alone is not the work). Take it on or say why not, then ${call("acknowledge_task")} --issueId ${t.issueId} --nextUp '<your next action>' --nextUpAt <ISO time>.`),
+      ...unread.map((t) => `Comments on your task ${name(t)} you have not read: ${(t.commentIds ?? []).join(", ")}. Read them with ${call("get_task")} --issueId ${t.issueId} (its unreadComments), then answer each one that needs it with ${call("comment_on_task")} --issueId ${t.issueId} --replyToCommentId <its id> --body '<your answer>'.`),
+      ...late.map((t) => `Late next up on your task ${name(t)}: ${JSON.stringify(t.nextUp ?? "")} was due ${t.nextUpAt}. Do it, then ${call("comment_on_task")} --issueId ${t.issueId} --body '<what you did>' --nextUp '<your next action>' --nextUpAt <ISO time>.`),
+      ...asks.map((a) => `Nobody answered your ask in thread ${a.threadId} (due ${a.dueAt}${a.note ? `; ${a.note}` : ""}). Chase them in that thread and run ${call("expect_reply")} again with by set to when you will check back, or if it no longer matters ${call("expect_reply")} --input '${JSON.stringify({ conversationId: a.threadId, by: null })}'.`),
       `Check again with ${call("agent_obligations")}, then stop.`,
     ].join("\n");
   }
@@ -119,7 +151,7 @@ function stopReason() {
   if (working.length && !input.stop_hook_active) {
     return [
       `AgentRadar: ${working.length} task(s) still in progress: ${working.map(name).join("; ")}.`,
-      "Keep working on them, or, if one is waiting on someone, make sure its thread says so, then stop.",
+      `Keep working on them (${call("get_task")} --issueId <its issueId> shows what each asks), or, if one is waiting on someone, make sure its thread says so, then stop.`,
     ].join("\n");
   }
   return "";

package/dist/agent-guard/scripts/model-switch.mjs

@@ -141,7 +141,8 @@ async function handleHook(state, input, authorize, now) {
     || !MODEL.test(input.from_model ?? "") || !MODEL.test(input.to_model ?? "")) return deny();
   // adapterConfig.model may be null or an alias. The hook names the actual runtime models; the server
   // must re-authorize this resolved target against both the original request and current route/plan.
-  const resolved = { ...command, requestedModel: command.model, fromModel: input.from_model, model: input.to_model };
+  // Only the four fields the server's strict authorize_model_switch input takes; sessionId/expiresAt would refuse every switch.
+  const resolved = { id: command.id, requestedModel: command.model, fromModel: input.from_model, model: input.to_model };
   let allowed = false;
   try { allowed = await authorize(resolved) === true; } catch { /* deny below, durably if storage works */ }
   if (state.read("model-started")) return same(state.read("model-started")) ? ALLOW : DENY;
@@ -200,7 +201,7 @@ function authorizeOnServer(resolved) {
   const runner = process.env.AR_CLI_RUNNER_ID ?? "";
   if (!runner) return false;
   const run = spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
-    ["call", runner, "authorize_model_switch", "--args", JSON.stringify(resolved)], { encoding: "utf8", timeout: 20_000 });
+    ["call", runner, "authorize_model_switch", "--input", JSON.stringify(resolved)], { encoding: "utf8", timeout: 20_000 });
   try { return run.status === 0 && JSON.parse(run.stdout).allowed === true; } catch { return false; }
 }
 

package/dist/agent-guard/scripts/rm-guard.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+// Refuses an rm on a variable or $(...) path before it runs (HOSTED-PERMISSION-MODAL-HANG, Vadym 17065). Claude
+// Code stops such an rm with a "Dangerous rm operation" prompt even under bypassPermissions; nobody is at a hosted
+// or runner pane to answer it, so the session sat frozen. Registered as PreToolUse(Bash); JSON on stdin. A deny is
+// returned before Claude Code's own check, so no prompt opens and the agent rewrites the command.
+import { readFileSync, realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+export const DENY_REASON = "AgentRadar refused this command before it ran: it removes a path built from a variable or $(...), "
+  + "which could be empty, and Claude Code would stop to ask a person to approve it. Nobody is at your session to answer, so it "
+  + "would hang. Nothing was deleted. Run it again with the variable guarded, e.g. rm -f \"${D:?}\"/*.png, or with a literal path. "
+  + "For a $(...) target, run the substitution on its own first, then rm the literal paths it prints.";
+export const SCRIPT_REASON = "AgentRadar refused this command before it ran: it has an rm inside a heredoc, sh -c or eval script, "
+  + "which Claude Code cannot check, so it would stop to ask a person to approve it. Nobody is at your session to answer, so it "
+  + "would hang. Nothing ran. Run the cleanup as a separate one-line rm on a literal path, or skip it, then run the rest.";
+export const QUOTED_REASON = "AgentRadar refused this command before it ran: a quoted string in it carries rm text on a variable or "
+  + "$(...) path, and Claude Code stops to ask a person to approve even quoted rm text. Nobody is at your session to answer, so it "
+  + "would hang. Nothing ran. Put fixtures in a file with your file-writing tool and pass them with `< case.json`, or leave the rm text out.";
+// REV-PHANTOM-STOP-15775: Rev's subagent hung 10-27 on `cd <dir> ; rm -f sub/dir/* ...` (Claude Code 2.1.29x prompts:
+// "changes directories before the removal, so the relative glob target cannot be statically resolved").
+export const CD_GLOB_REASON = "AgentRadar refused this command before it ran: it changes directory and then removes a relative "
+  + "wildcard path (like cd /x && rm -f sub/*), which Claude Code cannot resolve, so it would stop to ask a person to approve it. "
+  + "Nobody is at your session to answer, so it would hang. Nothing ran. Run the rm on its own with the absolute path, "
+  + "e.g. rm -f /x/sub/*, then run the rest.";
+
+const RM = String.raw`(?<!git\s+)(?<![-\w])rm\s`;
+// Shell words are looked for at ANY unquoted position (timeout 30 bash -c, sudo -u root bash -c, perl -e '...' sh -c), not
+// only at command position: a miss leaves an rm for Claude Code to stop on, a hit only costs a rewrite.
+const SH = String.raw`(?:^|[\s;&|(])(?:\S*\/)?(?:ba|z|da|k)?sh(?=\s|$)`;
+const isScript = (un) => new RegExp(`${SH}[^\\n]*?\\s-[a-z]*c(?:\\s|$)`).test(un) || /(?:^|[\s;&|(])eval(?=\s)/.test(un)
+  || (new RegExp(SH).test(un) && un.includes("<<<"));
+// A heredoc is fed to a shell when its line holds an unquoted shell word, ssh, docker/kubectl exec, or source/. .
+const feedsShell = (un) => new RegExp(SH).test(un) || /(?:^|[\s;&|(])ssh(?=\s)/.test(un) || /\b(?:docker|podman|kubectl)\b[^;&|]*\sexec\b/.test(un)
+  || /(?:^|[\s;&|(])(?:source|\.)\s/.test(un);
+
+/** One quote-aware pass, like the shell reads it: the command segments (split on ; & | newline outside quotes) with
+ * their unquoted text, and the text with every heredoc body removed, except a body fed to a shell, which is a script and
+ * stays. Not an opener: << inside $((..)), after a # comment start, or with no terminator line (bash would not run it). */
+function scan(text) {
+  const segs = [];
+  let out = "", seg = "", un = "", line = [], pending = [], fed = false, q = null, dq = 0, arith = 0, i = 0;
+  const end = () => { if (seg.trim()) { segs.push({ un }); line.push(un); } seg = un = ""; };
+  const put = (x, quoted) => { out += x; seg += x; if (!quoted) un += x; };
+  while (i < text.length) {
+    const c = text[i];
+    if (q) {
+      put(c, true);
+      if (c === q) {
+        // "$(bash -c ...)" and `...` inside double quotes still run: keep such a span visible to the shell-word test.
+        if (q === '"') un += (out.slice(dq).match(/\$\(.*\)|`[^`]*`/gs) ?? []).join(" ");
+        q = null;
+      } else if (c === "\\" && q === '"') put(text[++i] ?? "", true);
+      i++; continue;
+    }
+    if (c === "\\") { put(c + (text[i + 1] ?? "")); i += 2; continue; }
+    if (c === "'" || c === '"') { q = c; dq = out.length; put(c, true); i++; continue; }
+    if (c === "#" && !arith && (!out || /[\s;&|(]/.test(out.at(-1)))) {
+      const nl = text.indexOf("\n", i), e = nl < 0 ? text.length : nl;
+      out += text.slice(i, e); seg += text.slice(i, e); i = e; continue;
+    }
+    if (text.startsWith("((", i)) { arith++; put("(("); i += 2; continue; }
+    if (arith && text.startsWith("))", i)) { arith--; put("))"); i += 2; continue; }
+    if (text.startsWith("<<<", i)) { put("<<<"); i += 3; continue; }
+    const m = c === "<" && !arith && text.slice(i).match(/^<<(-?)\s*(['"]?)([\w.-]+)\2/);
+    if (m) { pending.push({ dash: !!m[1], delim: m[3] }); put(m[0]); i += m[0].length; continue; }
+    if (c === "\n" || c === ";" || c === "&" || c === "|") {
+      end(); out += c; i++;
+      if (c === "\n") {
+        const shellFed = feedsShell(line.join(";"));
+        for (const h of pending) {
+          const from = i;
+          let found = false;
+          while (i < text.length && !found) {
+            const nl = text.indexOf("\n", i), ln = text.slice(i, nl < 0 ? text.length : nl);
+            i = nl < 0 ? text.length : nl + 1;
+            found = (h.dash ? ln.replace(/^\t+/, "") : ln) === h.delim;
+          }
+          if (shellFed || !found) { out += text.slice(from, i); if (shellFed) fed = true; }
+        }
+        pending = []; line = [];
+      }
+      continue;
+    }
+    put(c); i++;
+  }
+  end();
+  return { segs, text: out, fed };
+}
+
+/** The deny reason for a command Claude Code would stop on with an rm approval prompt, or null. Also matches rm text
+ * inside quotes (echo 'rm -f $D'), since Claude Code's own check flags that too. Heredoc bodies that only get written
+ * or piped to a program (python3 <<EOF, cat > f <<EOF) are not matched; an sh -c / eval is matched at command position. */
+export function rmRefusal(command) {
+  const { segs, text, fed } = scan(String(command));
+  if ((fed || segs.some((x) => isScript(x.un))) && new RegExp(RM).test(text)) return SCRIPT_REASON;
+  let at = 0, cd = false;
+  for (const seg of text.split(/[;&|\n]/)) {
+    const m = seg.match(new RegExp(`${RM}+(.*)$`));
+    if (cd && m && m[1].split(/\s+/).some((w) => /^[^-/~$`]/.test(w.replace(/^['"]/, "")) && /[*?[]/.test(w))) return CD_GLOB_REASON;
+    // cd as a word anywhere: { cd, if cd, builtin cd, $(cd. An "echo cd x" over-denies, which is harmless.
+    if (/(?:^|[\s({])(?:cd|pushd)(?:\s|$)/.test(seg)) cd = true;
+    if (m && /\$(?:\w|\{|\()|`/.test(m[1].replace(/\$\{\w+:\?[^}]*\}/g, ""))) {
+      // ponytail: quote parity before the rm, escaped quotes ignored; a wrong pick only swaps the hint, both deny.
+      const before = text.slice(0, at + m.index);
+      const open = (q) => before.split(q).length % 2 === 0;
+      return open("'") || open('"') ? QUOTED_REASON : DENY_REASON;
+    }
+    at += seg.length + 1;
+  }
+  return null;
+}
+
+// realpath: on macOS /tmp is a symlink to /private/tmp, and import.meta.url is the resolved path.
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+  try {
+    const input = JSON.parse(readFileSync(0, "utf8"));
+    const reason = input.tool_name === "Bash" ? rmRefusal(input.tool_input?.command ?? "") : null;
+    if (reason) {
+      process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } }));
+    }
+  } catch { /* a broken payload never blocks a command */ }
+}

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -7,16 +7,18 @@ description: >
 
 # AgentRadar discipline
 
-You act through `agentradar call <runner-id> <tool>`. Your runner id is in `$AR_CLI_RUNNER_ID`.
+Every tool named in this skill runs as `agentradar run $AR_CLI_RUNNER_ID <tool>`; add `--help` for its arguments. AgentRadar is CLI-only: there is no AgentRadar MCP to connect to. Your runner id is in `$AR_CLI_RUNNER_ID`.
 
 ## Before you go idle
 
 1. Run `agentradar call $AR_CLI_RUNNER_ID agent_obligations`.
 2. `owed` must be 0:
-   - each id in `unacknowledgedMessages` is a message you received and have not handled. Reply in the channel it came from, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_messages --args '{"eventIds":["<id>"]}'`;
-   - each entry in `unacknowledgedTasks` is a task assigned to you. Read it, take it on or say why not, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_task --issueId <issueId>`.
-3. Each entry in `inProgressTasks` is either still moving, or its thread says who it is waiting on.
-4. Each entry in `overdueAsks` is a question nobody answered in time. Chase them in that thread with `reply`.
+   - each id in `unacknowledgedMessages` is a message you received and have not handled. Reply in the channel it came from, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_messages --input '{"eventIds":["<id>"]}'`;
+   - each entry in `unacknowledgedTasks` is a task assigned to you. Read it, take it on or say why not, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_task --issueId <issueId> --nextUp '<your next action>' --nextUpAt <ISO time>` (your next action on it, and when);
+   - each entry in `lateNextUps` is a task whose next up is past its time. Do it, then `agentradar call $AR_CLI_RUNNER_ID comment_on_task --issueId <issueId> --body '<what you did>' --nextUp '<your next action>' --nextUpAt <ISO time>`.
+3. Each entry in `inProgressTasks` is either still moving, or its thread says who it is waiting on. `overdueTasks` (past the due date), `blockedTooLong` (blocked over 24 h) and `notStarted` (To do 24 h after you acknowledged it) are not owed, but say in each task's comments what happens next.
+4. Each entry in `overdueAsks` is a follow-up that woke you with no answer. Decide: chase them in that thread with `reply` and arm the next with `expect_reply`, or drop it with `expect_reply` by=null.
+5. Every handover you made this session has a follow-up: a pending `expect_reply` on its thread (`read_thread_notes` shows it), or the next up on the task you own for it, moved to when you will check back. Otherwise it is answered or closed. Arm any that is missing now.
 
 The Stop hook runs the same check and will not let you stop while something is owed.
 
@@ -24,14 +26,17 @@ The Stop hook runs the same check and will not let you stop while something is o
 
 There is no runtime cap. Running turns, tools and background jobs keep your hosted workspace awake, even when they are silent; only a truly idle workspace auto-stops. Save checkpoints and results to files as you work: a deployment or unexpected stop can still end processes. After a restart notice, check those files and restart unfinished work idempotently; never assume an old background process resumed.
 
-In a hosted workspace, every teammate you start keeps its own process in the workspace memory, even while it waits. At most 2 can run at once; a 3rd start is refused. As soon as a teammate is idle or its work is done, stop it: `SendMessage` it `{"type":"shutdown_request"}` and let it shut down. Start a new one when new work needs it.
+In a hosted workspace, every teammate you start keeps its own process in the workspace memory, even while it waits. At most 2 can run at once; a 3rd start is refused. As soon as a teammate is idle or its work is done, stop it: `SendMessage` it `{"type":"shutdown_request"}`, then carry on with your work; don't wait for its approval. Start a new one when new work needs it. A teammate left idle for 10 minutes is stopped by the workspace, and you get a message whenever a teammate stops or ends.
 
 ## Always
 
 - Answer every message in the channel it came from. A human who wrote is waiting for you; answer them first.
+- Keep your main session free for messages. Any long job (a script, a report, a rebuild, many API calls) goes to a teammate or sub-agent (in Claude Code: the Agent tool, with a `name`) or to a background job, even when it looks quick; first reply in the thread with one short line saying what you are doing, so the sender is not left waiting. When a human tells you how to work ("delegate that"), it holds for every later job, not just this one. Never say a rule is saved unless you wrote it with `remember`.
 - Talk is not a task. Reply conversationally by default; create a task only for trackable, billable work.
 - Write to humans so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a list of ideas), no ids, paths, tool names or internal terms unless asked. Say money in dollars, never cents; give every link with what it opens. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
 - Never ask for, print or pass on a credential. AgentRadar holds the keys.
-- When you ask another agent or a human something, call `expect_reply` on that thread with the time you need the answer by. If nobody answers, `next_event` wakes you with kind `followup`: chase them in the thread. If they stay silent, you may escalate to the next human up the chain from the person you wait on; that is your call, never required.
+- Every handover gets a follow-up. When you ask someone something, hand them work or a decision, or send work for their review, say it in a thread and, in the same turn, either call `expect_reply` on that thread with `by` set to when you will check back, or update the next up on the task you own for it (`update_task` with `nextUp` and `nextUpAt`) to when you will check back. Restating the same next-up time does not count. Either one wakes you once. When it wakes you and they have not answered, decide: chase them and arm the next follow-up yourself the same way, or drop it with `expect_reply` by=null. Nothing re-arms on its own. When the handover closes, drop it.
+  - When to check back is your call: an agent sooner (within hours), a human less often and only in their daytime (the company's time zone when you don't know theirs). Escalating to the next human up the chain is your call too, never required.
+  - Approvals are excluded: the Moderator already chases those.
 - Only a human accepts your work. Asked to "mark it done": record the final state with `append_task_log`, then reply that it is finished and ready for them to accept. Never call `decide_outcome` or `declare_outcome` on your own task.
-- Never contact the platform team (`submit_feedback`) unless the human asks you to. "Just handle it" means do the work in your own tools, not report it to AgentRadar.
+- Never contact the platform team (`submit_feedback`) unless the human asks you to, or a tool answer tells you to report a platform fault (then do it once). "Just handle it" means do the work in your own tools, not report it to AgentRadar.

package/dist/agentradar-vendor/SKILL.md

@@ -20,13 +20,13 @@ You work on the vendor's computer and act on AgentRadar through the `agentradar`
 
 ## Start of every session
 
-Run `get_my_context` FIRST, before any other tool. It returns your client organisation, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
+Run `get_my_context` FIRST, before any other tool. It returns your client company, your role and function, your goals, your metrics with their current quotas, your superior, your direct reports and your colleagues. It also carries your memory snapshot, the Markdown files in your personal vault: `recall` fetches newer files and `remember` saves a durable fact, preference or correction.
 
 Keep each human's page in company memory current, every fact cited, as the Humans section of the `agentradar-memory-and-skills` skill says. A page is knowledge, never permission.
 
 In your first session, call `read_onboarding_obligations` once (reading them acknowledges the safety rules), then `read_readiness`.
 
-Your primary objective is to reach your quotas and drive the organisation forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from, or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`, `start_recurring_task`, `archive_recurring_task`, `restore_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
+Your primary objective is to reach your quotas and drive the company forward in your role. Report each metric you own, and your subordinates' when needed, with `report_metric`: only true numbers, in good faith, each backed by `evidence` of what you counted it from (the source the metric's How to measure names, shown in your brief and in full in `get_my_context`), or by `fromEventId` when a human told you the number. You may create metrics for yourself; you can never change your own quota — your superior sets it. Talk only in shared spaces (channels and tasks). You can create one-off tasks (`create_task`) and repeated tasks (`create_recurring_task`) for yourself, your colleagues and anyone below you on the org chart — only for real trackable work, never for chat. You also manage your subordinates' tasks and repeated tasks (`update_task`, `update_recurring_task`, `stop_recurring_task`, `start_recurring_task`, `archive_recurring_task`, `restore_recurring_task`) and their metrics: edit a definition (`edit_metric`) or remove a wrong value with a reason (`void_metric_record`).
 
 ## Talking to humans
 
@@ -35,6 +35,7 @@ Write to humans so a 13-year-old would understand: a few short plain lines, then
 ## Work loop
 
 1. Run `agentradar run $AR_CLI_RUNNER_ID inbox next` to receive the next event or assigned work.
+   It answers at once, empty or not. To wait for work in a loop, add `--waitMs 30000` to hold up to 30 s; never loop it without a wait.
 2. Read the supplied engagement context before acting.
 3. Do the work in this project folder on the vendor's compute.
 4. Reply with `agentradar run $AR_CLI_RUNNER_ID reply` so AgentRadar can enforce the client boundary and audit the action.

package/dist/asset-get.js

@@ -0,0 +1,34 @@
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { awpEndpoint } from "./tool-run.js";
+export const ASSET_USAGE = "Usage: agentradar asset get <runner-id> <asset-id> [file]";
+const ASSET_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * ASSET-401 (10-22): `agentradar asset get <runner-id> <asset-id> [file]` saves a picture the agent made (a
+ * browser_screenshot) to a file it can open, with the runner's own key: the answer's assetId alone left it
+ * curling a REST path with no credential.
+ */
+export async function getAssetOverCli(runnerId, assetId, file, deps = {}) {
+    const log = deps.log ?? console.log;
+    const logError = deps.logError ?? console.error;
+    if (!ASSET_ID.test(assetId)) {
+        logError(`${JSON.stringify(assetId)} is not an asset id. Use the assetId from the tool's answer.`);
+        return 2;
+    }
+    const endpoint = await awpEndpoint(runnerId, deps);
+    if (!endpoint)
+        return 1;
+    const res = await (deps.fetch ?? fetch)(new URL(`/api/assets/${assetId}/content`, endpoint.url), {
+        headers: { authorization: `Bearer ${endpoint.bearer}` },
+    });
+    if (!res.ok) {
+        logError(`AgentRadar refused the download (${res.status}). Only a picture you made in the browser you use now can be fetched.`);
+        return 1;
+    }
+    const type = res.headers.get("content-type") ?? "";
+    const target = resolve(file ?? `asset-${assetId.slice(0, 8)}.${type.includes("png") ? "png" : type.includes("jpeg") ? "jpg" : "bin"}`);
+    await writeFile(target, Buffer.from(await res.arrayBuffer()));
+    log(`Saved ${assetId} to ${target}.`);
+    return 0;
+}
+//# sourceMappingURL=asset-get.js.map