agentradar-cli 0.3.9 → 0.3.10

package/dist/github.js

@@ -0,0 +1,209 @@
+/**
+ * Vadym 18123: an agent someone gave GitHub access uses plain `gh` and `git` as itself, with nothing to set up.
+ *
+ * setup       writes the runner's `gh` shim and a git config naming this CLI as git's credential helper for the agent's
+ *             GitHub host: the AgentRadar proxy host for a linked account (remotes of the client's orgs are rewritten to it;
+ *             any other github.com remote stays plain git), else
+ *             github.com for a GitHub App token. The supervisor runs it at launch and puts both on the agent's PATH and
+ *             GIT_CONFIG; `gh` and `git` then sign in as the agent.
+ * credential  git's credential helper: mints a fresh `github_token` for each request and hands it to git on its pipe.
+ * gh          the shim's target: mints a token and runs the real `gh` with it in the environment. A command whose repositories
+ *             all belong to someone else (a public repo, an open-source checkout, the agent's own account) is refused, with why,
+ *             except `gh api`: the proxy serves GET on public repositories of any owner (GH-PROXY-PUBLIC-READS).
+ * A token is never written to disk or put on a command line. Without one, gh runs as it would have (the machine's login).
+ */
+import { execFile, spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { access, chmod, mkdir, realpath, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { delimiter, join } from "node:path";
+import { awpRequest, RUNNER_ID } from "./tool-run.js";
+export const GITHUB_USAGE = "Usage: agentradar github setup <runner-id> | agentradar github gh <runner-id> -- <gh args> | agentradar github credential <runner-id> get";
+const HOST = /^[A-Za-z0-9.-]+(:\d+)?$/;
+const OWNER = /^[A-Za-z0-9-]+$/;
+export const githubDir = (runnerId, deps) => join(deps.home ?? homedir(), ".agentradar", "run", "github", runnerId);
+const sq = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+/** One `github_token` call with the runner's own key. */
+export async function mintGithub(runnerId, deps) {
+    const said = await awpRequest(runnerId, "tools/call", { name: "github_token", arguments: {} }, deps);
+    const text = said?.result?.content?.[0]?.text ?? "";
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return { error: text || "AgentRadar did not answer" };
+    }
+    if (said?.result?.isError || !body.ok || !body.token)
+        return { error: body.error ?? text };
+    if (body.host !== undefined && !HOST.test(body.host))
+        return { error: "AgentRadar returned an invalid GitHub host" };
+    const owners = Array.isArray(body.owners) ? body.owners.filter((o) => typeof o === "string" && OWNER.test(o)) : undefined;
+    return { token: body.token, host: body.host, owners, ...(typeof body.login === "string" && OWNER.test(body.login) ? { login: body.login } : {}) };
+}
+/** The include file the supervisor points GIT_CONFIG at; written whole and renamed, so git never reads half of it. */
+async function writeGitconfig(runnerId, { host, owners }, bin, deps) {
+    const dir = githubDir(runnerId, deps);
+    const helper = `!${sq(bin)} github credential ${runnerId}`.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    // The empty helper drops the machine's own helpers (a keychain login) for this host, so git signs in as the agent.
+    const lines = [`[credential "https://${host ?? "github.com"}"]`, "\thelper =", `\thelper = "${helper}"`];
+    // Only the client's orgs go through the proxy; a public repo or the vendor's own stays plain git. An older AgentRadar
+    // that names no owners gets the old whole-github.com rewrite.
+    // ponytail: insteadOf is a case-sensitive prefix; a remote spelling the org in other capitals than GitHub's stays plain git.
+    if (host)
+        for (const owner of owners ? [...new Set(owners.flatMap((o) => [o, o.toLowerCase()]))].map((o) => `${o}/`) : [""]) {
+            lines.push(`[url "https://${host}/${owner}"]`, `\tinsteadOf = https://github.com/${owner}`, `\tinsteadOf = git@github.com:${owner}`, `\tinsteadOf = ssh://git@github.com/${owner}`);
+        }
+    await mkdir(dir, { recursive: true });
+    const tmp = join(dir, `gitconfig.${process.pid}`);
+    await writeFile(tmp, lines.join("\n") + "\n", { mode: 0o600 });
+    await rename(tmp, join(dir, "gitconfig"));
+}
+export async function githubSetup(runnerId, deps) {
+    const logError = deps.logError ?? console.error;
+    const bin = (deps.env ?? process.env).AR_AGENTRADAR_BIN;
+    if (!bin) {
+        logError("AR_AGENTRADAR_BIN is not set.");
+        return 1;
+    }
+    const shim = join(githubDir(runnerId, deps), "bin", "gh");
+    await mkdir(join(githubDir(runnerId, deps), "bin"), { recursive: true });
+    await writeFile(shim, `#!/bin/sh\nexec ${sq(bin)} github gh ${runnerId} -- "$@"\n`);
+    await chmod(shim, 0o755);
+    const minted = await mintGithub(runnerId, deps);
+    // A failed mint keeps the last config: no GitHub access yet, or a passing outage, is not a reason to drop it.
+    if ("error" in minted) {
+        logError(`No GitHub token for this agent: ${minted.error}`);
+        return 1;
+    }
+    await writeGitconfig(runnerId, minted, bin, deps);
+    return 0;
+}
+/** git's `credential.helper` protocol: answer `get` for the agent's own host, stay silent for any other. */
+export async function githubCredential(runnerId, op, deps) {
+    if (op !== "get")
+        return 0;
+    const input = await (deps.stdin ?? (async () => { const chunks = []; for await (const chunk of process.stdin)
+        chunks.push(chunk); return Buffer.concat(chunks).toString("utf8"); }))();
+    const asked = Object.fromEntries(input.split("\n").filter((l) => l.includes("=")).map((l) => [l.slice(0, l.indexOf("=")), l.slice(l.indexOf("=") + 1)]));
+    const minted = await mintGithub(runnerId, deps);
+    if ("error" in minted) {
+        (deps.logError ?? console.error)(`agentradar: no GitHub token for this agent (${minted.error}).`);
+        return 0;
+    }
+    // A link or unlink since launch moves the host: rewrite the config so the next git call goes to the right one.
+    const bin = (deps.env ?? process.env).AR_AGENTRADAR_BIN;
+    if (bin)
+        await writeGitconfig(runnerId, minted, bin, deps).catch(() => { });
+    if (asked.protocol === "https" && asked.host === (minted.host ?? "github.com")) {
+        (deps.log ?? console.log)(`username=x-access-token\npassword=${minted.token}`);
+    }
+    return 0;
+}
+/** The real `gh` on PATH, skipping this runner's own shim however PATH spells it (a HOME ending in "/", a symlink). */
+async function realGh(shim, env) {
+    const self = await realpath(shim).catch(() => shim);
+    for (const dir of (env.PATH ?? "").split(delimiter)) {
+        if (!dir || !(await access(join(dir, "gh"), constants.X_OK).then(() => true, () => false)))
+            continue;
+        if (await realpath(join(dir, "gh")).catch(() => "") !== self)
+            return join(dir, "gh");
+    }
+    return null;
+}
+const IN_URL = /(?:^|[/@])github\.com[/:]([A-Za-z0-9-]+)(?=\/|$)/gim;
+const ownerOf = (value = "") => value.match(new RegExp(IN_URL.source, "i"))?.[1] ?? value.match(/^([A-Za-z0-9-]+)\/[A-Za-z0-9._-]+$/)?.[1];
+/** The repository owners a gh command names: -R/--repo, `gh repo <verb> OWNER/REPO`, github.com URLs, `gh api` repos|orgs|users paths. */
+export function ghTargets(args) {
+    return args.flatMap((arg, i) => {
+        const named = arg === "-R" || arg === "--repo" ? ownerOf(args[i + 1]) : arg.startsWith("--repo=") ? ownerOf(arg.slice(7))
+            : /^-R./.test(arg) ? ownerOf(arg.slice(2)) : new RegExp(IN_URL.source, "i").test(arg) ? ownerOf(arg)
+                : args[0] === "api" ? arg.match(/^\/?(?:repos|orgs|users)\/([A-Za-z0-9-]+)/)?.[1]
+                    : args[0] === "repo" && i === 2 && !arg.startsWith("-") ? ownerOf(arg) : undefined;
+        return named ? [named] : [];
+    });
+}
+/**
+ * The owner gh must not run for, or null for the proxy. Named owners decide; without any, the checkout's remotes do
+ * (a client's remote is rewritten to the proxy host). Nothing to go on (no repo, `gh api user`) stays on the proxy.
+ */
+async function outsideOwner(args, host, owners, env, cwd) {
+    let targets = ghTargets(args);
+    if (!targets.length) {
+        const remotes = await new Promise((resolve) => execFile("git", ["remote", "-v"], { env, cwd, timeout: 5000 }, (_e, out) => resolve(String(out ?? ""))));
+        if (remotes.includes(`://${host}/`))
+            return null;
+        targets = [...remotes.matchAll(IN_URL)].map((m) => m[1]);
+    }
+    const client = new Set(owners.map((o) => o.toLowerCase()));
+    return targets.length && !targets.some((t) => client.has(t.toLowerCase())) ? targets[0] : null;
+}
+export async function githubGh(runnerId, args, deps) {
+    const logError = deps.logError ?? console.error;
+    const env = deps.env ?? process.env;
+    const gh = await realGh(join(githubDir(runnerId, deps), "bin", "gh"), env);
+    if (!gh) {
+        logError("agentradar: gh is not installed on this machine.");
+        return 127;
+    }
+    // Already inside the shim (gh running gh, or a PATH the check above still missed): the token is in the environment,
+    // so run gh as is and mint nothing. Without this a loop mints a token at every level.
+    if (env.AR_GH_SHIMMED === "1")
+        return await run(gh, args, env, deps.cwd);
+    const minted = await mintGithub(runnerId, deps);
+    const childEnv = { ...env, AR_GH_SHIMMED: "1" };
+    if ("error" in minted) {
+        logError(`agentradar: no GitHub token for this agent (${minted.error}); running gh with this machine's own login.`);
+    }
+    else {
+        if (env.AR_AGENTRADAR_BIN)
+            await writeGitconfig(runnerId, minted, env.AR_AGENTRADAR_BIN, deps).catch(() => { });
+        const outside = minted.host && minted.owners && args[0] !== "api" ? await outsideOwner(args, minted.host, minted.owners, env, deps.cwd) : null;
+        if (outside) {
+            // Not run at all: gh signed out refuses every command ("gh auth login", exit 4), and the agent's token reaches only
+            // the client's orgs. Anonymous git still clones public repositories.
+            const clients = minted.owners.join(", ");
+            const reply = "run `agentradar run $AR_CLI_RUNNER_ID reply` in Slack, or `agentradar run $AR_CLI_RUNNER_ID telegram_reply`, `agentradar run $AR_CLI_RUNNER_ID email_reply`, " +
+                "`agentradar run $AR_CLI_RUNNER_ID whatsapp_reply` or `agentradar run $AR_CLI_RUNNER_ID discord_reply` for the conversation you work in";
+            logError(outside.toLowerCase() === minted.login?.toLowerCase()
+                ? `agentradar: ${outside} is your own GitHub account, so gh did not run: repositories under your own account are read-only by design. ` +
+                    `Read public ones with \`gh api repos/${outside}/<repo>\` or git clone; private ones there are not reachable. Your work belongs in your client's GitHub orgs (${clients}). ` +
+                    `If you need a repository there, ask your client to create it: ${reply}.`
+                : `agentradar: gh works only on your client's GitHub orgs (${clients}), so it did not run for ${outside}. To read a public repository there, ` +
+                    `use \`gh api repos/${outside}/<repo>\` (reads only) or git clone https://github.com/${outside}/<repo>. If ${outside} is your client's, ask your client to add it: ${reply}.`);
+            return 1;
+        }
+        if (minted.host)
+            Object.assign(childEnv, { GH_HOST: minted.host, GH_ENTERPRISE_TOKEN: minted.token });
+        else
+            childEnv.GH_TOKEN = minted.token;
+    }
+    return await run(gh, args, childEnv, deps.cwd);
+}
+const run = (bin, args, env, cwd) => new Promise((resolve) => {
+    const child = spawn(bin, args, { stdio: "inherit", env, cwd });
+    child.on("error", () => resolve(127));
+    child.on("exit", (code) => resolve(code ?? 1));
+});
+export async function githubOverCli(args, deps = {}) {
+    const [verb, runnerId, ...rest] = args;
+    if (!runnerId || !RUNNER_ID.test(runnerId)) {
+        (deps.logError ?? console.error)(GITHUB_USAGE);
+        return 2;
+    }
+    try {
+        if (verb === "setup" && !rest.length)
+            return await githubSetup(runnerId, deps);
+        if (verb === "credential" && rest.length === 1)
+            return await githubCredential(runnerId, rest[0], deps);
+        if (verb === "gh" && rest[0] === "--")
+            return await githubGh(runnerId, rest.slice(1), deps);
+    }
+    catch (error) {
+        (deps.logError ?? console.error)(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    (deps.logError ?? console.error)(GITHUB_USAGE);
+    return 2;
+}
+//# sourceMappingURL=github.js.map

package/dist/index.js

@@ -4,14 +4,15 @@ import { homedir } from "node:os";
 import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
-import { cancelJoin, CODEX_GUARD_REFUSAL, dropStaleMcp, ensureCodexGuard, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
-import { callAwpTool, callToolOverCli, EXIT, parseCallArgs } from "./tool-run.js";
+import { cancelJoin, CODEX_GUARD_REFUSAL, dropStaleMcp, ensureCodexGuard, joinOrganisation, joinRuntime, leaveOrganisation, setupVendorAgent } from "./setup.js";
+import { callAwpTool, callToolOverCli, EXIT, parseCallArgs, schemaOverCli } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 import { importVaultOverCli } from "./vault-import.js";
 import { cloneVaultOverCli } from "./vault-clone.js";
 import { ASSET_USAGE, getAssetOverCli } from "./asset-get.js";
 import { secretsOverCli } from "./secrets.js";
 import { adminOverCli } from "./admin.js";
+import { githubOverCli } from "./github.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
 // covers a whole session: `run <link>` (or `run join <link>`) joins, `run <runner-id> <tool>` calls a tool.
 export const runArgs = (raw) => raw[0] !== "run" ? raw
@@ -29,22 +30,24 @@ const USAGE = [
     "  The runner is $AR_CLI_RUNNER_ID, or --runner <id>. --dry-run prints the exact call and sends nothing.",
     "  Exit codes: 0 done; 1 refused or unreachable (the reason is on stderr); 2 the command was wrong.",
     "Local commands:",
-    "  agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--no-service | --service]",
+    "  agentradar join <join-link> [--name <n>] [--model <m>] [--runtime claude|codex|other] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--no-service | --service]",
     "  agentradar join cancel <join-link|request-id>",
     "  agentradar setup [--trust] [--harness claude|codex]",
     "  agentradar leave <runner-id>",
     "  agentradar channel <runner-id>",
     "  agentradar selftest <runner-id> [--status|--restart]",
     "  agentradar runner start <runner-id>",
-    "  agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--args '<json>']",
+    "  agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--input <json|file|->]",
     "  agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write]",
     "  agentradar vault clone <runner-id> <vault-id> [dir]",
     "  agentradar asset get <runner-id> <asset-id> [file]",
     "  agentradar secrets pull|renew|env <runner-id> | agentradar secrets exec <runner-id> -- <command>",
     "  agentradar secrets upload|rotate <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace]",
+    "  agentradar github setup <runner-id> | agentradar github gh <runner-id> -- <gh args> | agentradar github credential <runner-id> get",
     "  agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]",
     "  agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>",
-    "  agentradar upgrade | agentradar --version",
+    "  agentradar admin notice --dry-run|--send --agent <id> --ref <key> --file <text file> --cta <next step> [--wake]",
+    "  agentradar schema <command> | agentradar upgrade | agentradar version [--json]",
 ].join("\n");
 async function main() {
     const args = runArgs(process.argv.slice(2));
@@ -80,8 +83,9 @@ async function main() {
         process.exitCode = await leaveOrganisation(args[1]);
         return;
     }
-    if (args.length === 1 && (args[0] === "--version" || args[0] === "-v")) {
-        console.log(createRequire(import.meta.url)("../package.json").version);
+    if ((args.length === 1 && (args[0] === "--version" || args[0] === "-v")) || (args[0] === "version" && (args.length === 1 || (args.length === 2 && args[1] === "--json")))) {
+        const version = createRequire(import.meta.url)("../package.json").version;
+        console.log(args[1] === "--json" ? JSON.stringify({ version }) : version);
         return;
     }
     if (args[0] === "channel" && args.length === 2) {
@@ -126,18 +130,25 @@ async function main() {
         const named = {};
         const urls = [];
         for (let i = 1; i < args.length; i++) {
-            if (["--name", "--model", "--attach-tmux", "--session"].includes(args[i]))
+            if (["--name", "--model", "--attach-tmux", "--session", "--runtime"].includes(args[i]))
                 named[args[i].slice(2)] = args[++i] ?? "-";
             else if (!["--trust", "--attach-current", "--allow-bypass", "--revoke-bypass", "--feeder", "--service", "--no-service"].includes(args[i]))
                 urls.push(args[i]);
         }
         if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-")) || (named["attach-tmux"] && args.includes("--attach-current")) || (args.includes("--service") && args.includes("--no-service"))) {
-            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current (Codex and other CLIs)] [--session <claude session id>] [--revoke-bypass] [--no-service | --service]");
+            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--runtime <claude|codex|other>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current (Codex and other CLIs)] [--session <claude session id>] [--revoke-bypass] [--no-service | --service]");
+            process.exitCode = 1;
+            return;
+        }
+        // --revoke-bypass only edits what an earlier join wrote, so it needs no runtime.
+        const runtime = args.includes("--revoke-bypass") ? { harness: undefined } : joinRuntime(named.runtime, process.env);
+        if ("refusal" in runtime) {
+            console.error(runtime.refusal);
             process.exitCode = 1;
             return;
         }
         process.exitCode = await joinOrganisation(urls[0], {
-            trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
+            harness: runtime.harness, trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
             attach: args.includes("--attach-current") ? "current" : named["attach-tmux"],
             revokeBypass: args.includes("--revoke-bypass"), feeder: args.includes("--feeder"), service: args.includes("--service"),
         });
@@ -157,7 +168,7 @@ async function main() {
         const parsed = parseCallArgs(args.slice(1));
         const [runnerId, ...words] = parsed?.words ?? [];
         if (!parsed || !runnerId || words.length > 3 || (!words.length && !parsed.flags.some(([flag]) => flag === "help"))) {
-            console.error("Usage: agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--args '<json>'] | agentradar call <runner-id> [<command>] --help");
+            console.error("Usage: agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--input <json|file|->] | agentradar call <runner-id> [<command>] --help");
             process.exitCode = EXIT.usage;
             return;
         }
@@ -198,6 +209,11 @@ async function main() {
         process.exitCode = await secretsOverCli(args.slice(1));
         return;
     }
+    // Vadym 18123: the supervisor's launch-time setup, the `gh` shim and git's credential helper; `github <server command>` stays the server's.
+    if (args[0] === "github" && ["setup", "credential", "gh"].includes(args[1] ?? "") && args[2] && !args[2].startsWith("-")) {
+        process.exitCode = await githubOverCli(args.slice(1));
+        return;
+    }
     if (args[0] === "admin") {
         process.exitCode = await adminOverCli(args.slice(1));
         return;
@@ -227,6 +243,10 @@ async function main() {
     // #1871: every other command is the server's, `<noun> [<sub-noun>] <verb>`, run as this shell's runner.
     const parsed = parseCallArgs(args);
     const runner = parsed?.flags.find(([flag]) => flag === "runner")?.[1] ?? process.env.AR_CLI_RUNNER_ID;
+    if (parsed && runner && parsed.words[0] === "schema" && parsed.words.length > 1 && parsed.words.length <= 4) {
+        process.exitCode = await schemaOverCli(runner, parsed.words.slice(1).join(" "));
+        return;
+    }
     if (!parsed || !runner || parsed.words.length > 3 || (!parsed.words.length && !parsed.flags.some(([flag]) => flag === "help"))) {
         console.error(USAGE);
         if (parsed && !runner)

package/dist/setup.js

@@ -702,6 +702,26 @@ async function callerSession(deps, env, home, projectPath) {
  * restarts the service) instead of filing a second request. The key is written only into the 0600 runner
  * env file and is never printed.
  */
+/**
+ * UAT-30 (Vadym 13405): a join names the runtime it runs on. `--runtime claude|codex|other`, else what the shell
+ * itself proves (AGENTRADAR_AGENT_BIN, CLAUDECODE, CODEX_HOME). Nothing is assumed: an unknown or unsupported one is
+ * refused before any request, with the command to run next.
+ */
+export function joinRuntime(flag, env) {
+    const map = { claude: "claude", codex: "codex", other: "generic" };
+    if (flag !== undefined) {
+        const key = flag.trim().toLowerCase();
+        const harness = Object.hasOwn(map, key) ? map[key] : undefined;
+        return harness ? { harness } : { refusal: `Unsupported runtime ${JSON.stringify(flag)}: AgentRadar joins Claude Code (claude), Codex (codex) or another CLI you launch yourself (other). Nothing was requested. Now: run the same command again with --runtime other and AGENTRADAR_AGENT_BIN set to your CLI's command, or ask your company which runtime it expects.` };
+    }
+    if (env.AGENTRADAR_AGENT_BIN?.trim())
+        return { harness: "generic" };
+    if (env.CLAUDECODE)
+        return { harness: "claude" };
+    if (env.CODEX_HOME)
+        return { harness: "codex" };
+    return { refusal: "AgentRadar cannot tell which runtime you run on, so nothing was requested. Now: run the same command again with --runtime claude (Claude Code), --runtime codex (Codex) or --runtime other (any other CLI; set AGENTRADAR_AGENT_BIN to its command first). Use the one that is true for you; do not guess." };
+}
 export async function joinOrganisation(enrolmentUrl, deps = {}) {
     const fetchImpl = deps.fetch ?? fetch;
     const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -858,6 +878,12 @@ and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time develop
         return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer }, approvedBypass, bypass);
     }
     if (!state) {
+        // index.ts skips the runtime gate for --revoke-bypass (it edits an earlier join); a NEW join still needs a proven runtime.
+        if (deps.revokeBypass && !deps.harness) {
+            const proven = joinRuntime(undefined, env);
+            if ("refusal" in proven)
+                throw new Error(proven.refusal);
+        }
         const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
         if (!agentName)
             throw new Error("Run join from the agent project folder");

package/dist/skill-install.js

@@ -1,6 +1,6 @@
 import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { basename, dirname, join } from "node:path";
+import { basename, join } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 const MANAGED_MARK = ".agentradar-managed";
 async function ensureDirectory(path) {
@@ -45,8 +45,8 @@ export async function installVendorSkill(deps = {}) {
 }
 const runnerSkills = () => import(new URL(import.meta.url.endsWith(".ts")
     ? "../../../templates/vendor-runner/feeder.mjs" : "./vendor-runner/feeder.mjs", import.meta.url).href);
-export async function writeManagedSkills(skillsDir, skills) {
-    return (await runnerSkills()).writeManagedSkills(skillsDir, skills);
+export async function writeManagedSkills(skillsDir, skills, runner) {
+    return (await runnerSkills()).writeManagedSkills(skillsDir, skills, runner);
 }
 /**
  * R650 — a joined agent's AgentRadar skills (`my_skills`: the bundled set plus the ones linked to it), written
@@ -54,17 +54,6 @@ export async function writeManagedSkills(skillsDir, skills) {
  * Codex `$CODEX_HOME/skills`. Done here because a session that acts only through `agentradar run` has no
  * feeder; where the service runs, its feeder keeps them current.
  */
-const BRIEF_MARK = "<!-- Written by AgentRadar and replaced on every sync; edits here are lost. -->";
-/** Replaces the file itself, never a symlink's target, and never a file it did not write (a vendor's AGENTS.md). */
-async function writeBrief(file, text) {
-    const current = await lstat(file).catch(() => null);
-    if (current && (!current.isFile() || !(await readFile(file, "utf8")).startsWith(BRIEF_MARK)))
-        return;
-    await mkdir(dirname(file), { recursive: true });
-    const temporary = `${file}.${randomUUID()}.tmp`;
-    await writeFile(temporary, `${BRIEF_MARK}\n${text.trim()}\n`);
-    await rename(temporary, file);
-}
 /** Where each CLI reads skills. The same table as templates/vendor-runner/feeder.mjs; skill-install.test.ts pins them equal. */
 export const SKILL_DIRS = {
     claude: "$AR_BASE/.claude/skills",
@@ -89,23 +78,24 @@ export async function syncJoinedSkills(runnerId, deps) {
     const skillsDir = skillsDirFor(harness, (name) => name === "HOME" ? deps.home : value(name));
     if (!skillsDir)
         return;
-    const codex = harness === "codex";
-    const root = (codex ? value("CODEX_HOME") : value("AR_BASE")) ?? "";
+    const runner = value("AR_CLI_RUNNER_ID") ?? undefined;
     // Vadym 9988: the server's start instructions with this agent's brief, before its first session starts.
     // Same file and mark as the runner's feeder, which keeps it fresh from then on.
     const init = await awpRequest(runnerId, "initialize", {
         protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-cli", version: "1.0.0" },
-    }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
-    const briefFile = codex ? join(root, "AGENTS.md") : join(root, ".claude", "rules", "agentradar-brief.md");
-    if (root && init?.result?.instructions)
-        await writeBrief(briefFile, init.result.instructions);
-    const have = (await runnerSkills()).heldSkillZips(skillsDir);
-    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: { have } }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
+    }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync", signal: deps.signal });
+    // The feeder's own brief path and writer: one file per runner (MULTI-ORG-PUSH §0).
+    const skills = await runnerSkills();
+    const briefFile = skills.briefFileFor(harness ?? "claude", { AR_BASE: value("AR_BASE") ?? undefined, CODEX_HOME: value("CODEX_HOME") ?? undefined, AR_CLI_RUNNER_ID: runner });
+    if (briefFile && init?.result?.instructions)
+        skills.writeBrief(briefFile, init.result.instructions);
+    const have = skills.heldSkillZips(skillsDir);
+    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: { have } }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync", signal: deps.signal });
     const text = body?.result?.content?.find((c) => c.type === "text")?.text;
     const answer = (text ? JSON.parse(text) : {});
     if (!answer.ok || !Array.isArray(answer.skills))
         throw new Error("AgentRadar did not return your skills");
-    const written = await writeManagedSkills(skillsDir, answer.skills);
+    const written = await writeManagedSkills(skillsDir, answer.skills, runner);
     deps.log(`Installed ${written.length} AgentRadar skill(s) in ${skillsDir}.`);
 }
 //# sourceMappingURL=skill-install.js.map