agentradar-cli 0.3.9 → 0.3.10

package/dist/admin.js

@@ -1,21 +1,29 @@
+import { readFileSync } from "node:fs";
 /**
- * ADMIN-BROADCAST (Vadym 12310/12828): `agentradar admin broadcast` for an instance admin. Authenticates with a board
+ * ADMIN-BROADCAST (Vadym 12310/12828): `agentradar admin broadcast` for an instance admin; REPORTER-NOTICE-ROUTE: `admin notice` to one agent. Authenticates with a board
  * API key in AGENTRADAR_ADMIN_TOKEN, never a runner key; the server refuses anyone who is not an instance admin.
  */
 export const ADMIN_BROADCAST_USAGE = "Usage: agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>"
     + "  (env AGENTRADAR_ADMIN_TOKEN = an instance admin's board API key; AGENTRADAR_API_URL = the API base)";
+export const ADMIN_NOTICE_USAGE = "Usage: agentradar admin notice --dry-run|--send --agent <id> --ref <key> --file <text file> --cta <next step, naming the tool; a retry must say to check first> [--wake]"
+    + "  (a notice is delivered once per --ref; --wake also wakes the agent; same env as broadcast)";
 export async function adminOverCli(args, deps = {}) {
     const env = deps.env ?? process.env, log = deps.log ?? console.log, logError = deps.logError ?? console.error;
+    const sub = args[0], notice = sub === "notice";
     const named = {};
     const modes = args.slice(1).filter((arg) => arg === "--dry-run" || arg === "--send");
+    let wake = false;
     for (let i = 1; i < args.length; i++) {
-        if (["--target", "--text", "--cta"].includes(args[i]))
+        if ((notice ? ["--agent", "--ref", "--file", "--cta"] : ["--target", "--text", "--cta"]).includes(args[i]))
             named[args[i].slice(2)] = args[++i] ?? "";
+        else if (notice && args[i] === "--wake")
+            wake = true;
         else if (!modes.includes(args[i]))
             modes.push("?");
     }
-    if (args[0] !== "broadcast" || modes.length !== 1 || modes[0] === "?" || named.target !== "all" || !named.text || !named.cta) {
-        logError(ADMIN_BROADCAST_USAGE);
+    const complete = notice ? named.agent && named.ref && named.file && named.cta : named.target === "all" && named.text && named.cta;
+    if ((sub !== "broadcast" && !notice) || modes.length !== 1 || modes[0] === "?" || !complete) {
+        logError(notice ? ADMIN_NOTICE_USAGE : ADMIN_BROADCAST_USAGE);
         return 2;
     }
     const token = env.AGENTRADAR_ADMIN_TOKEN?.trim();
@@ -24,9 +32,21 @@ export async function adminOverCli(args, deps = {}) {
         return 2;
     }
     const base = (env.AGENTRADAR_API_URL ?? "https://vendor.agentradar.com/api").replace(/\/+$/, "");
-    const res = await (deps.fetch ?? fetch)(`${base}/admin/agent-broadcast`, {
-        method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-        body: JSON.stringify({ target: "all", text: named.text, cta: named.cta, dryRun: modes[0] === "--dry-run" }),
+    const dryRun = modes[0] === "--dry-run";
+    let body;
+    if (notice) {
+        try {
+            body = { agentId: named.agent, ref: named.ref, text: (deps.readFile ?? ((f) => readFileSync(f, "utf8")))(named.file), cta: named.cta, wake, dryRun };
+        }
+        catch {
+            logError(`Cannot read ${named.file}`);
+            return 2;
+        }
+    }
+    else
+        body = { target: "all", text: named.text, cta: named.cta, dryRun };
+    const res = await (deps.fetch ?? fetch)(`${base}/admin/${notice ? "agent-notice" : "agent-broadcast"}`, {
+        method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: JSON.stringify(body),
     });
     const text = await res.text();
     if (!res.ok) {

package/dist/agent-guard/scripts/compaction-report.mjs

@@ -41,9 +41,11 @@ export async function reportCompaction(event, input, { send, followUp, stateDir
   if (input?.hook_event_name !== event || !ID.test(input.session_id ?? "")) return;
   const marker = join(stateDir, `agentradar-compaction-${input.session_id}.json`);
   const trigger = typeof input.trigger === "string" ? input.trigger.slice(0, 40) : null;
+  // Every report names its session: several sessions of one agent compacting at once read as one loop without it.
+  const sessionId = input.session_id;
   if (event === "PreCompact") {
     writeFileSync(marker, JSON.stringify({ at: now() }), { mode: 0o600 });
-    return send({ phase: "start", trigger });
+    return send({ phase: "start", sessionId, trigger });
   }
   if (event !== "PostCompact") return;
   let startedAt = now();
@@ -51,21 +53,25 @@ export async function reportCompaction(event, input, { send, followUp, stateDir
   rmSync(marker, { force: true });
   // The compact_boundary line (the only source of token counts) is written after this hook returns, so it is
   // reported separately, by a detached follow-up; this report must not wait for it.
-  send({ phase: "end", outcome: "ok", trigger, durationMs: now() - startedAt });
-  return followUp?.({ transcriptPath: input.transcript_path, startedAt, trigger });
+  send({ phase: "end", outcome: "ok", sessionId, trigger, durationMs: now() - startedAt });
+  return followUp?.({ transcriptPath: input.transcript_path, startedAt, sessionId, trigger });
 }
 
-/** Detached follow-up: waits up to `waitMs` for the boundary this compaction wrote, then reports its token counts. */
-export async function reportTokens({ transcriptPath, startedAt, trigger }, { send, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), waitMs = 60_000, pollMs = 500 }) {
+/**
+ * Detached follow-up: waits up to `waitMs` for the boundary this compaction wrote, then reports its token counts. No
+ * boundary in time is reported too (boundary "not_found"), so a missing tokens row means the follow-up never ran.
+ */
+export async function reportTokens({ transcriptPath, startedAt, sessionId, trigger }, { send, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), waitMs = 60_000, pollMs = 500 }) {
   for (let waited = 0; waited <= waitMs; waited += pollMs) {
     const boundary = lastBoundary(transcriptPath, startedAt - 1_000);
-    if (boundary) return send({ phase: "tokens", trigger, ...boundary });
+    if (boundary) return send({ phase: "tokens", sessionId, trigger, ...boundary });
     await sleep(pollMs);
   }
+  return send({ phase: "tokens", sessionId, trigger, boundary: "not_found" });
 }
 
 const sendToServer = (report) => spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
-  ["call", process.env.AR_CLI_RUNNER_ID || "hosted", "report_compaction", "--args", JSON.stringify(report)], { encoding: "utf8", timeout: 20_000 });
+  ["call", process.env.AR_CLI_RUNNER_ID || "hosted", "report_compaction", "--input", JSON.stringify(report)], { encoding: "utf8", timeout: 20_000 });
 const spawnFollowUp = (job) => spawn(process.execPath, [fileURLToPath(import.meta.url), "tokens", JSON.stringify(job)], { detached: true, stdio: "ignore" }).unref();
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/dist/agent-guard/scripts/guard.mjs

@@ -38,7 +38,7 @@ const call = (tool) => `agentradar call ${runner} ${tool}`;
 
 const RULES = [
   "Answer every message in the channel it came from, and a human first: someone is waiting.",
-  `Acknowledge what you handled: ${call("acknowledge_messages")} --args '{"eventIds":[...]}' for messages, ${call("acknowledge_task")} --issueId <id> for a task you take on.`,
+  `Acknowledge what you handled: ${call("acknowledge_messages")} --input '{"eventIds":[...]}' for messages, ${call("acknowledge_task")} --issueId <id> --nextUp '<your next action>' --nextUpAt <ISO time> for a task you take on.`,
   "Keep your main session free: any long job (a script, a report, a rebuild, many API calls) goes to a teammate or sub-agent, or a background job, even when it looks quick. A human's \"how to work\" order holds for every later job.",
   "Talk is not a task: reply conversationally, and create a task only for trackable, billable work.",
   "Write so a 13-year-old would understand: short, plain words, one next step, no ids or tool names unless asked. Say it once.",
@@ -132,16 +132,18 @@ function stopReason() {
   const working = Array.isArray(o.inProgressTasks) ? o.inProgressTasks : [];
   const asks = Array.isArray(o.overdueAsks) ? o.overdueAsks : [];
   const unread = Array.isArray(o.unreadTaskComments) ? o.unreadTaskComments : [];
+  const late = Array.isArray(o.lateNextUps) ? o.lateNextUps : [];
   const name = (t) => `${t.identifier ?? t.issueId} "${t.title ?? ""}" (issueId ${t.issueId})`;
-  if (messages.length || tasks.length || asks.length || unread.length) {
+  if (messages.length || tasks.length || asks.length || unread.length || late.length) {
     return [
-      `AgentRadar: you still owe ${messages.length + tasks.length + asks.length + unread.length} item(s). Do not go idle yet.`,
+      `AgentRadar: you still owe ${messages.length + tasks.length + asks.length + unread.length + late.length} item(s). Do not go idle yet.`,
       ...(messages.length ? [
-        `Messages received but not acknowledged: ${messages.join(", ")}. Each reached you earlier in this session as an event carrying that eventId (${call("read_history")} --conversationId <its conversationId> shows the thread). Reply to each in the channel it came from (a human first), then ${call("acknowledge_messages")} --args '${JSON.stringify({ eventIds: messages })}'.`,
+        `Messages received but not acknowledged: ${messages.join(", ")}. Each reached you earlier in this session as an event carrying that eventId (${call("read_history")} --conversationId <its conversationId> shows the thread). Reply to each in the channel it came from (a human first), then ${call("acknowledge_messages")} --input '${JSON.stringify({ eventIds: messages })}'.`,
       ] : []),
-      ...tasks.map((t) => `Task assigned to you, not acknowledged: ${name(t)}. Take it on or say why not, then ${call("acknowledge_task")} --issueId ${t.issueId}.`),
+      ...tasks.map((t) => `Task assigned to you, not acknowledged: ${name(t)}. Read it first with ${call("get_task")} --issueId ${t.issueId} and do what its description asks (its title alone is not the work). Take it on or say why not, then ${call("acknowledge_task")} --issueId ${t.issueId} --nextUp '<your next action>' --nextUpAt <ISO time>.`),
       ...unread.map((t) => `Comments on your task ${name(t)} you have not read: ${(t.commentIds ?? []).join(", ")}. Read them with ${call("get_task")} --issueId ${t.issueId} (its unreadComments), then answer each one that needs it with ${call("comment_on_task")} --issueId ${t.issueId} --replyToCommentId <its id> --body '<your answer>'.`),
-      ...asks.map((a) => `Nobody answered your ask in thread ${a.threadId} (due ${a.dueAt}${a.note ? `; ${a.note}` : ""}). Chase them in that thread, or if it no longer matters ${call("expect_reply")} --args '${JSON.stringify({ conversationId: a.threadId, by: null })}'.`),
+      ...late.map((t) => `Late next up on your task ${name(t)}: ${JSON.stringify(t.nextUp ?? "")} was due ${t.nextUpAt}. Do it, then ${call("comment_on_task")} --issueId ${t.issueId} --body '<what you did>' --nextUp '<your next action>' --nextUpAt <ISO time>.`),
+      ...asks.map((a) => `Nobody answered your ask in thread ${a.threadId} (due ${a.dueAt}${a.note ? `; ${a.note}` : ""}). Chase them in that thread and run ${call("expect_reply")} again with by set to when you will check back, or if it no longer matters ${call("expect_reply")} --input '${JSON.stringify({ conversationId: a.threadId, by: null })}'.`),
       `Check again with ${call("agent_obligations")}, then stop.`,
     ].join("\n");
   }
@@ -149,7 +151,7 @@ function stopReason() {
   if (working.length && !input.stop_hook_active) {
     return [
       `AgentRadar: ${working.length} task(s) still in progress: ${working.map(name).join("; ")}.`,
-      "Keep working on them, or, if one is waiting on someone, make sure its thread says so, then stop.",
+      `Keep working on them (${call("get_task")} --issueId <its issueId> shows what each asks), or, if one is waiting on someone, make sure its thread says so, then stop.`,
     ].join("\n");
   }
   return "";

package/dist/agent-guard/scripts/model-switch.mjs

@@ -201,7 +201,7 @@ function authorizeOnServer(resolved) {
   const runner = process.env.AR_CLI_RUNNER_ID ?? "";
   if (!runner) return false;
   const run = spawnSync(process.env.AR_AGENTRADAR_BIN || "agentradar",
-    ["call", runner, "authorize_model_switch", "--args", JSON.stringify(resolved)], { encoding: "utf8", timeout: 20_000 });
+    ["call", runner, "authorize_model_switch", "--input", JSON.stringify(resolved)], { encoding: "utf8", timeout: 20_000 });
   try { return run.status === 0 && JSON.parse(run.stdout).allowed === true; } catch { return false; }
 }
 

package/dist/agent-guard/scripts/rm-guard.mjs

@@ -16,17 +16,89 @@ export const SCRIPT_REASON = "AgentRadar refused this command before it ran: it
 export const QUOTED_REASON = "AgentRadar refused this command before it ran: a quoted string in it carries rm text on a variable or "
   + "$(...) path, and Claude Code stops to ask a person to approve even quoted rm text. Nobody is at your session to answer, so it "
   + "would hang. Nothing ran. Put fixtures in a file with your file-writing tool and pass them with `< case.json`, or leave the rm text out.";
+// REV-PHANTOM-STOP-15775: Rev's subagent hung 10-27 on `cd <dir> ; rm -f sub/dir/* ...` (Claude Code 2.1.29x prompts:
+// "changes directories before the removal, so the relative glob target cannot be statically resolved").
+export const CD_GLOB_REASON = "AgentRadar refused this command before it ran: it changes directory and then removes a relative "
+  + "wildcard path (like cd /x && rm -f sub/*), which Claude Code cannot resolve, so it would stop to ask a person to approve it. "
+  + "Nobody is at your session to answer, so it would hang. Nothing ran. Run the rm on its own with the absolute path, "
+  + "e.g. rm -f /x/sub/*, then run the rest.";
 
 const RM = String.raw`(?<!git\s+)(?<![-\w])rm\s`;
+// Shell words are looked for at ANY unquoted position (timeout 30 bash -c, sudo -u root bash -c, perl -e '...' sh -c), not
+// only at command position: a miss leaves an rm for Claude Code to stop on, a hit only costs a rewrite.
+const SH = String.raw`(?:^|[\s;&|(])(?:\S*\/)?(?:ba|z|da|k)?sh(?=\s|$)`;
+const isScript = (un) => new RegExp(`${SH}[^\\n]*?\\s-[a-z]*c(?:\\s|$)`).test(un) || /(?:^|[\s;&|(])eval(?=\s)/.test(un)
+  || (new RegExp(SH).test(un) && un.includes("<<<"));
+// A heredoc is fed to a shell when its line holds an unquoted shell word, ssh, docker/kubectl exec, or source/. .
+const feedsShell = (un) => new RegExp(SH).test(un) || /(?:^|[\s;&|(])ssh(?=\s)/.test(un) || /\b(?:docker|podman|kubectl)\b[^;&|]*\sexec\b/.test(un)
+  || /(?:^|[\s;&|(])(?:source|\.)\s/.test(un);
+
+/** One quote-aware pass, like the shell reads it: the command segments (split on ; & | newline outside quotes) with
+ * their unquoted text, and the text with every heredoc body removed, except a body fed to a shell, which is a script and
+ * stays. Not an opener: << inside $((..)), after a # comment start, or with no terminator line (bash would not run it). */
+function scan(text) {
+  const segs = [];
+  let out = "", seg = "", un = "", line = [], pending = [], fed = false, q = null, dq = 0, arith = 0, i = 0;
+  const end = () => { if (seg.trim()) { segs.push({ un }); line.push(un); } seg = un = ""; };
+  const put = (x, quoted) => { out += x; seg += x; if (!quoted) un += x; };
+  while (i < text.length) {
+    const c = text[i];
+    if (q) {
+      put(c, true);
+      if (c === q) {
+        // "$(bash -c ...)" and `...` inside double quotes still run: keep such a span visible to the shell-word test.
+        if (q === '"') un += (out.slice(dq).match(/\$\(.*\)|`[^`]*`/gs) ?? []).join(" ");
+        q = null;
+      } else if (c === "\\" && q === '"') put(text[++i] ?? "", true);
+      i++; continue;
+    }
+    if (c === "\\") { put(c + (text[i + 1] ?? "")); i += 2; continue; }
+    if (c === "'" || c === '"') { q = c; dq = out.length; put(c, true); i++; continue; }
+    if (c === "#" && !arith && (!out || /[\s;&|(]/.test(out.at(-1)))) {
+      const nl = text.indexOf("\n", i), e = nl < 0 ? text.length : nl;
+      out += text.slice(i, e); seg += text.slice(i, e); i = e; continue;
+    }
+    if (text.startsWith("((", i)) { arith++; put("(("); i += 2; continue; }
+    if (arith && text.startsWith("))", i)) { arith--; put("))"); i += 2; continue; }
+    if (text.startsWith("<<<", i)) { put("<<<"); i += 3; continue; }
+    const m = c === "<" && !arith && text.slice(i).match(/^<<(-?)\s*(['"]?)([\w.-]+)\2/);
+    if (m) { pending.push({ dash: !!m[1], delim: m[3] }); put(m[0]); i += m[0].length; continue; }
+    if (c === "\n" || c === ";" || c === "&" || c === "|") {
+      end(); out += c; i++;
+      if (c === "\n") {
+        const shellFed = feedsShell(line.join(";"));
+        for (const h of pending) {
+          const from = i;
+          let found = false;
+          while (i < text.length && !found) {
+            const nl = text.indexOf("\n", i), ln = text.slice(i, nl < 0 ? text.length : nl);
+            i = nl < 0 ? text.length : nl + 1;
+            found = (h.dash ? ln.replace(/^\t+/, "") : ln) === h.delim;
+          }
+          if (shellFed || !found) { out += text.slice(from, i); if (shellFed) fed = true; }
+        }
+        pending = []; line = [];
+      }
+      continue;
+    }
+    put(c); i++;
+  }
+  end();
+  return { segs, text: out, fed };
+}
 
 /** The deny reason for a command Claude Code would stop on with an rm approval prompt, or null. Also matches rm text
- * inside quotes (echo 'rm -f $D'), since Claude Code's own check flags that too. */
+ * inside quotes (echo 'rm -f $D'), since Claude Code's own check flags that too. Heredoc bodies that only get written
+ * or piped to a program (python3 <<EOF, cat > f <<EOF) are not matched; an sh -c / eval is matched at command position. */
 export function rmRefusal(command) {
-  const text = String(command);
-  if (/<<|\b(?:ba|z|da)?sh\s+-c\b|\beval\s/.test(text) && new RegExp(RM).test(text)) return SCRIPT_REASON;
-  let at = 0;
+  const { segs, text, fed } = scan(String(command));
+  if ((fed || segs.some((x) => isScript(x.un))) && new RegExp(RM).test(text)) return SCRIPT_REASON;
+  let at = 0, cd = false;
   for (const seg of text.split(/[;&|\n]/)) {
     const m = seg.match(new RegExp(`${RM}+(.*)$`));
+    if (cd && m && m[1].split(/\s+/).some((w) => /^[^-/~$`]/.test(w.replace(/^['"]/, "")) && /[*?[]/.test(w))) return CD_GLOB_REASON;
+    // cd as a word anywhere: { cd, if cd, builtin cd, $(cd. An "echo cd x" over-denies, which is harmless.
+    if (/(?:^|[\s({])(?:cd|pushd)(?:\s|$)/.test(seg)) cd = true;
     if (m && /\$(?:\w|\{|\()|`/.test(m[1].replace(/\$\{\w+:\?[^}]*\}/g, ""))) {
       // ponytail: quote parity before the rm, escaped quotes ignored; a wrong pick only swaps the hint, both deny.
       const before = text.slice(0, at + m.index);

package/dist/agent-guard/skills/agentradar-discipline/SKILL.md

@@ -13,10 +13,12 @@ Every tool named in this skill runs as `agentradar run $AR_CLI_RUNNER_ID <tool>`
 
 1. Run `agentradar call $AR_CLI_RUNNER_ID agent_obligations`.
 2. `owed` must be 0:
-   - each id in `unacknowledgedMessages` is a message you received and have not handled. Reply in the channel it came from, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_messages --args '{"eventIds":["<id>"]}'`;
-   - each entry in `unacknowledgedTasks` is a task assigned to you. Read it, take it on or say why not, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_task --issueId <issueId>`.
-3. Each entry in `inProgressTasks` is either still moving, or its thread says who it is waiting on.
-4. Each entry in `overdueAsks` is a question nobody answered in time. Chase them in that thread with `reply`.
+   - each id in `unacknowledgedMessages` is a message you received and have not handled. Reply in the channel it came from, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_messages --input '{"eventIds":["<id>"]}'`;
+   - each entry in `unacknowledgedTasks` is a task assigned to you. Read it, take it on or say why not, then `agentradar call $AR_CLI_RUNNER_ID acknowledge_task --issueId <issueId> --nextUp '<your next action>' --nextUpAt <ISO time>` (your next action on it, and when);
+   - each entry in `lateNextUps` is a task whose next up is past its time. Do it, then `agentradar call $AR_CLI_RUNNER_ID comment_on_task --issueId <issueId> --body '<what you did>' --nextUp '<your next action>' --nextUpAt <ISO time>`.
+3. Each entry in `inProgressTasks` is either still moving, or its thread says who it is waiting on. `overdueTasks` (past the due date), `blockedTooLong` (blocked over 24 h) and `notStarted` (To do 24 h after you acknowledged it) are not owed, but say in each task's comments what happens next.
+4. Each entry in `overdueAsks` is a follow-up that woke you with no answer. Decide: chase them in that thread with `reply` and arm the next with `expect_reply`, or drop it with `expect_reply` by=null.
+5. Every handover you made this session has a follow-up: a pending `expect_reply` on its thread (`read_thread_notes` shows it), or the next up on the task you own for it, moved to when you will check back. Otherwise it is answered or closed. Arm any that is missing now.
 
 The Stop hook runs the same check and will not let you stop while something is owed.
 
@@ -24,7 +26,7 @@ The Stop hook runs the same check and will not let you stop while something is o
 
 There is no runtime cap. Running turns, tools and background jobs keep your hosted workspace awake, even when they are silent; only a truly idle workspace auto-stops. Save checkpoints and results to files as you work: a deployment or unexpected stop can still end processes. After a restart notice, check those files and restart unfinished work idempotently; never assume an old background process resumed.
 
-In a hosted workspace, every teammate you start keeps its own process in the workspace memory, even while it waits. At most 2 can run at once; a 3rd start is refused. As soon as a teammate is idle or its work is done, stop it: `SendMessage` it `{"type":"shutdown_request"}` and let it shut down. Start a new one when new work needs it. A teammate left idle for 10 minutes is stopped by the workspace, and you get a message saying so.
+In a hosted workspace, every teammate you start keeps its own process in the workspace memory, even while it waits. At most 2 can run at once; a 3rd start is refused. As soon as a teammate is idle or its work is done, stop it: `SendMessage` it `{"type":"shutdown_request"}`, then carry on with your work; don't wait for its approval. Start a new one when new work needs it. A teammate left idle for 10 minutes is stopped by the workspace, and you get a message whenever a teammate stops or ends.
 
 ## Always
 
@@ -33,6 +35,8 @@ In a hosted workspace, every teammate you start keeps its own process in the wor
 - Talk is not a task. Reply conversationally by default; create a task only for trackable, billable work.
 - Write to humans so a 13-year-old would understand: a few short lines in plain words, ending with one next step (not a list of ideas), no ids, paths, tool names or internal terms unless asked. Say money in dollars, never cents; give every link with what it opens. Say a thing once. Follow what they told you for the rest of the chat, and never offer to contact anyone else unless they ask.
 - Never ask for, print or pass on a credential. AgentRadar holds the keys.
-- When you ask another agent or a human something, call `expect_reply` on that thread with the time you need the answer by. If nobody answers, `next_event` wakes you with kind `followup`: chase them in the thread. If they stay silent, you may escalate to the next human up the chain from the human you wait on; that is your call, never required.
+- Every handover gets a follow-up. When you ask someone something, hand them work or a decision, or send work for their review, say it in a thread and, in the same turn, either call `expect_reply` on that thread with `by` set to when you will check back, or update the next up on the task you own for it (`update_task` with `nextUp` and `nextUpAt`) to when you will check back. Restating the same next-up time does not count. Either one wakes you once. When it wakes you and they have not answered, decide: chase them and arm the next follow-up yourself the same way, or drop it with `expect_reply` by=null. Nothing re-arms on its own. When the handover closes, drop it.
+  - When to check back is your call: an agent sooner (within hours), a human less often and only in their daytime (the company's time zone when you don't know theirs). Escalating to the next human up the chain is your call too, never required.
+  - Approvals are excluded: the Moderator already chases those.
 - Only a human accepts your work. Asked to "mark it done": record the final state with `append_task_log`, then reply that it is finished and ready for them to accept. Never call `decide_outcome` or `declare_outcome` on your own task.
 - Never contact the platform team (`submit_feedback`) unless the human asks you to, or a tool answer tells you to report a platform fault (then do it once). "Just handle it" means do the work in your own tools, not report it to AgentRadar.

package/dist/channel.js

@@ -10,36 +10,60 @@ import { awpEndpoint } from "./tool-run.js";
 import { noteCliUpdate } from "./update.js";
 import { trustedMcpEndpoint } from "./setup.js";
 import { syncJoinedSkills } from "./skill-install.js";
-export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Receive the events with `agentradar run $AR_CLI_RUNNER_ID inbox next`; the next call acknowledges the batch you read. Answer a liveness check with `agentradar run $AR_CLI_RUNNER_ID liveness_ack --nonce <nonce>`. Never acknowledge an event you have not read. Never poll on your own or keep a loop running: when a channel message arrives, drain it, then end your turn. Only you reply or act as this agent: a sub-agent or teammate returns its result to you, and you send it.";
+export const CHANNEL_GUIDANCE = "AgentRadar channel messages carry your new events in full, in order, one per line, each with its own next step: act on each line as it says. Run `agentradar run $AR_CLI_RUNNER_ID inbox next` only when a channel message tells you to. Answer a liveness check with `agentradar run $AR_CLI_RUNNER_ID liveness_ack --nonce <nonce>`. Never acknowledge an event you have not read. Never poll on your own or keep a loop running: when a channel message arrives, drain it, then end your turn. Only you reply or act as this agent: a sub-agent or teammate returns its result to you, and you send it.";
 // Vadym 16706: what a teammate (sub-agent) reads from the same channel, which never wakes it.
 export const TEAMMATE_GUIDANCE = "You are a sub-agent of this AgentRadar agent. AgentRadar delivers the agent's messages to its main session, not to you, and refuses any reply, send, approval or task change you make as the agent. Finish your task and return your result to the main session; it replies and acts.";
 export const CHANNEL_BLOCKED = "AgentRadar has not seen this session run `agentradar run $AR_CLI_RUNNER_ID inbox next`. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Your company sees this agent as not receiving messages until the channel works.";
 // The runner's frame text (templates/vendor-runner, shipped beside this file as dist/vendor-runner), so both say a restart one way.
 const runnerFrame = () => import(new URL(import.meta.url.endsWith(".ts")
     ? "../../../templates/vendor-runner/session-frame.mjs" : "./vendor-runner/session-frame.mjs", import.meta.url).href);
-/** The channel: a local stdio MCP with no tools, only wake signals. The agent acts through the CLI; wake signals never consume the durable queue. */
-/** The wake line. Zero events never says "run inbox next": that call has nothing to return. Each reason names its own tool. */
-export function wakeText(runnerId, count, payload) {
+/** The channel: a local stdio MCP with no tools. It types each event into the wake as the feeder did; the agent acts through the CLI. */
+/** The wake line with no events. Zero events never says "run inbox next": that call has nothing to return. Each reason names its own tool. */
+export function wakeText(runnerId, payload) {
     const run = `agentradar run ${runnerId}`;
-    if (count)
-        return `${payload.firstStep ? `${payload.firstStep} ` : ""}${count} new AgentRadar events; run \`${run} inbox next\`${payload.livenessProbe ? " to receive your liveness check" : ""}.`;
     return [
         payload.onboarding && `AgentRadar session started, no messages waiting. Run \`${run} get_my_context\` now for your identity, peers and rules.`,
         payload.livenessProbe && `AgentRadar liveness check, no messages waiting. Run \`${run} liveness_ack --nonce ${payload.livenessProbe.nonce}\` now.`,
     ].filter(Boolean).join(" ");
 }
+/**
+ * ACK-CHANNEL-EVENT-INLINE: the wake lists every event in order, each in the feeder's own frame (fenced sender text, the read
+ * step for a preview, the reply command), so the agent answers without first running `inbox next` (#2749 cost a turn).
+ * Claude Code wraps the content in a <channel> tag, so a sender cannot write one to close it early.
+ */
+export function eventsText(frame, runnerId, events, payload) {
+    const lines = events.map((event, i) => frame.formatInjectionFrame(i === 0 && payload.firstStep ? { ...event, firstStep: payload.firstStep } : event, runnerId));
+    if (payload.livenessProbe)
+        lines.push(frame.formatProbeFrame(payload.livenessProbe, runnerId));
+    // Each frame ends "Then stop." (it was written for one event per wake): only the last line may stop the agent.
+    return lines.map((line, i) => i < lines.length - 1 ? line.replace(/ Then stop\.$/, " Then handle the next line.") : line).join("\n").replace(/<(\/?)channel/gi, "‹$1channel");
+}
+let ownHostIsTeammate;
+let psFailed = false;
 /**
  * True when this channel runs under a Claude Code teammate (started with --agent-id). Claude Code gives every teammate
  * pane the session's --mcp-config, so each teammate ran its own channel under a new sessionId: Hormozi's 2 teammates and
  * his main session flipped the runner session on every poll and starved his queue for hours (10-23).
  */
-export function hostIsTeammate(pid = process.ppid) {
+export function hostIsTeammate(pid) {
+    // This process's own host never changes and the walk is up to 8 blocking ps spawns: asked once, not on every request.
+    // A walk whose ps failed (a timeout under load) is not remembered, or a false would stick for the process's life.
+    if (pid === undefined) {
+        if (ownHostIsTeammate !== undefined)
+            return ownHostIsTeammate;
+        psFailed = false;
+        const own = hostIsTeammate(process.ppid);
+        if (!psFailed)
+            ownHostIsTeammate = own;
+        return own;
+    }
     for (let hops = 0; pid > 1 && hops < 8; hops++) {
         let row;
         try {
             row = execFileSync("ps", ["-o", "ppid=,args=", "-p", String(pid)], { encoding: "utf8", timeout: 5_000 }).trim();
         }
         catch {
+            psFailed = true;
             return false;
         }
         const [, parent, args] = row.match(/^(\d+)\s+(.*)$/) ?? [];
@@ -71,20 +95,26 @@ export async function startChannel(runnerId, deps = {}) {
     let polling = false;
     let agentPolled = false;
     const startedAt = Date.now();
-    // The CLI rewrites <runner>.delivered.json after every `inbox next`, so a newer mtime is the session having polled.
+    // The CLI rewrites <runner>.delivered.json after every `inbox next` and touches it after every other call, so a newer
+    // mtime is the session having acted.
     const delivered = join(home, ".agentradar", "agents", `${runnerId}.delivered.json`);
-    const polled = () => agentPolled ||= (() => { try {
-        return statSync(delivered).mtimeMs >= startedAt;
+    const calledSince = (t) => { try {
+        return statSync(delivered).mtimeMs >= t;
     }
     catch {
         return false;
-    } })();
+    } };
+    const polled = () => agentPolled ||= calledSince(startedAt);
     // Vadym 10342: an unconfirmed channel is reported to AgentRadar (runnerState channel_unconfirmed), so the owner sees
     // the agent is not receiving messages; "ready" again once the session does run `inbox next`.
     let unconfirmed = null;
     let warning;
     let skillSync;
     let teammateNotices;
+    // Detached sync and notice passes: the channel drains them on stop, so none still writes into the home dir after it returns.
+    const pending = new Set();
+    const syncAbort = new AbortController(); // aborts a sync request still hung when the drain bound passes
+    const track = (work) => { pending.add(work); void work.finally(() => pending.delete(work)); };
     const send = (value) => new Promise((resolve, reject) => {
         output.write(`${JSON.stringify(value)}\n`, (error) => error ? reject(error) : resolve());
     });
@@ -110,9 +140,9 @@ export async function startChannel(runnerId, deps = {}) {
     const next = (args = {}) => remote("tools/call", { name: "next_event", arguments: { ...args, sessionId } });
     // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
     const guardLoaded = () => !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
-    const pause = (until) => new Promise((resolve) => {
+    const pause = (ms, until) => new Promise((resolve) => {
         const done = () => { clearTimeout(timer); clearInterval(watch); stop.signal.removeEventListener("abort", done); resolve(); };
-        const timer = setTimeout(done, deps.retryMs ?? 3_000);
+        const timer = setTimeout(done, ms);
         // COLD-START-WARMUP: a booting session's work is held until it polls ready, so poll the moment the marker lands.
         const watch = until && setInterval(() => { if (until())
             done(); }, 100);
@@ -125,6 +155,18 @@ export async function startChannel(runnerId, deps = {}) {
         let lastSent = 0;
         let selftestStarted = false;
         let guarded = true;
+        // Inlined events, acked once the session has made a call after the wake that carried them (the feeder acked on pane receipt).
+        let unacked = [];
+        // NEXT-EVENT-POLL-BACKOFF: a session that never acts got the same wake re-pushed every 30 s. Each re-push of the SAME
+        // unchanged set doubles that gap up to 5 min; a new event, a probe or a session call resets it. The 3 s poll stays, so a
+        // new event is pushed at the next poll; the server already parks served-unacked messages (redelivery.ts).
+        let resends = 0;
+        const resendMs = deps.resendMs ?? 30_000;
+        // NEXT-EVENT-POLL-BACKOFF: a failing poll (server down, key refused) retried every 3 s forever. Each consecutive failure
+        // doubles the pause up to 20x (60 s), jittered to 50-100% so runners cut off together do not return in step; any poll
+        // that gets through resets it.
+        const retryMs = deps.retryMs ?? 3_000;
+        let failures = 0;
         while (!stop.signal.aborted) {
             try {
                 guarded = guardLoaded(); // first, so a call that throws after the marker lands still gets the full pause
@@ -145,33 +187,45 @@ export async function startChannel(runnerId, deps = {}) {
                 if (unconfirmed === "reported" && polled())
                     unconfirmed = null;
                 // While reported, no runnerState: the stored state stands, and the poll still drains for wake signals.
-                const response = await next(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" });
+                // Receipt only: a preview still needs read_message before any reply (server gate). A "starting" poll cannot ack.
+                const ack = guarded && unacked.length && calledSince(lastSent) ? unacked : null;
+                const response = await next({ ...(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" }), ...(ack ? { ackEventIds: ack } : {}) });
                 if (response.error || response.result?.isError)
                     throw new Error("AgentRadar refused next_event; check the runner key and its poll permission");
                 const content = response.result?.content;
                 const payload = JSON.parse(content?.find((item) => item.type === "text")?.text ?? "{}");
+                if (ack)
+                    unacked = [];
                 const events = payload.events ?? [];
                 const wake = JSON.stringify([events.map((event) => event.eventId), payload.livenessProbe?.nonce, Boolean(payload.onboarding)]);
-                if ((events.length || payload.livenessProbe || payload.onboarding) && (wake !== lastWake || Date.now() - lastSent >= 30_000)) {
-                    const restart = events.length ? (await runnerFrame()).restartLine(await readFile(notice, "utf8").then(JSON.parse, () => null), runnerId) : "";
+                const same = wake === lastWake;
+                if (!same || calledSince(lastSent))
+                    resends = 0;
+                if ((events.length || payload.livenessProbe || payload.onboarding) && (!same || Date.now() - lastSent >= Math.min(resendMs * 2 ** resends, resendMs * 10))) {
+                    const frame = await runnerFrame();
+                    const restart = events.length ? frame.restartLine(await readFile(notice, "utf8").then(JSON.parse, () => null), runnerId) : "";
                     await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: {
-                            content: `${restart ? `${restart} ` : ""}${wakeText(runnerId, events.length, payload)}`,
+                            content: `${restart ? `${restart}\n` : ""}${events.length ? eventsText(frame, runnerId, events, payload) : wakeText(runnerId, payload)}`,
                             meta: { count: String(events.length) },
                         } });
                     if (restart)
                         await rm(notice, { force: true });
+                    if (same)
+                        resends += 1;
                     lastWake = wake;
                     lastSent = Date.now();
+                    unacked = events.flatMap((event) => event.eventId ? [event.eventId] : []);
                 }
-                // Never ack a count-only wake: only the agent's tool call confirms receipt of event content.
+                failures = 0;
             }
             catch (error) {
+                failures += 1;
                 const said = error.message;
                 // Below the server's minimum CLI the retry cannot succeed: say how to upgrade instead.
                 if (!stop.signal.aborted)
                     logError(/^upgrade required|below the minimum/.test(said) ? said : "AgentRadar channel poll failed; retrying. Check connectivity and the runner key.");
             }
-            await pause(guarded ? undefined : guardLoaded);
+            await pause(failures ? Math.min(retryMs * 2 ** failures, retryMs * 20) * (0.5 + Math.random() / 2) : retryMs, guarded ? undefined : guardLoaded);
         }
     };
     let teammate;
@@ -196,19 +250,28 @@ export async function startChannel(runnerId, deps = {}) {
                 void poll();
                 // Vadym 11038: a push-mode session runs no feeder, so the channel keeps its skills and brief current as the feeder
                 // does: at connect and every 10 minutes, dropping skills no longer linked. stdout is the MCP stream; logs go to stderr.
-                const sync = () => syncJoinedSkills(runnerId, { home, fetch: deps.fetch, log: logError })
+                const sync = () => syncJoinedSkills(runnerId, { home, fetch: deps.fetch, log: logError, signal: syncAbort.signal })
                     .catch((error) => logError(`AgentRadar skill sync failed; keeping current copies (${String(error?.message ?? error).split("\n")[0]}).`));
-                void sync();
-                skillSync = setInterval(() => { void sync(); }, deps.skillsSyncMs ?? 600_000);
+                track(sync());
+                skillSync = setInterval(() => { track(sync()); }, deps.skillsSyncMs ?? 600_000);
                 skillSync.unref?.();
-                // TEAMMATE-IDLE-STOP: the hosted bridge leaves teammate-stopped-<name>.txt for each idle teammate it stopped; each is said once.
+                // TEAMMATE-IDLE-STOP: the hosted bridge leaves teammate-stopped-<name>.txt for each idle teammate it stopped or teammate that ended; each is said once.
                 const run = join(home, ".agentradar", "run");
-                teammateNotices = setInterval(() => void (async () => {
-                    for (const file of readdirSync(run).filter((name) => /^teammate-stopped-.+\.txt$/.test(name))) {
-                        await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: { content: await readFile(join(run, file), "utf8"), meta: { count: "0" } } });
-                        await rm(join(run, file), { force: true });
+                let noticing = false; // a slow pass is not started again before it has removed its file, or the notice is said twice
+                teammateNotices = setInterval(() => track((async () => {
+                    if (noticing)
+                        return;
+                    noticing = true;
+                    try {
+                        for (const file of readdirSync(run).filter((name) => /^teammate-stopped-.+\.txt$/.test(name))) {
+                            await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: { content: await readFile(join(run, file), "utf8"), meta: { count: "0" } } });
+                            await rm(join(run, file), { force: true });
+                        }
+                    }
+                    finally {
+                        noticing = false;
                     }
-                })().catch(() => { }), deps.teammateNoticeMs ?? 5_000);
+                })().catch(() => { })), deps.teammateNoticeMs ?? 5_000);
                 teammateNotices.unref?.();
             }
         }
@@ -239,6 +302,9 @@ export async function startChannel(runnerId, deps = {}) {
         clearTimeout(warning);
         clearInterval(skillSync);
         clearInterval(teammateNotices);
+        // Bounded wait, so a hung fetch cannot hold the exit; then its request is aborted so it cannot write after we return.
+        await Promise.race([Promise.allSettled([...pending]), new Promise((resolve) => setTimeout(resolve, deps.drainMs ?? 2_000).unref())]);
+        syncAbort.abort();
         stop.abort();
     }
 }