agentradar-cli 0.3.9 → 0.3.11

package/dist/channel.js

@@ -6,40 +6,65 @@ import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
-import { awpEndpoint } from "./tool-run.js";
+import { awpEndpoint, envValue } from "./tool-run.js";
 import { noteCliUpdate } from "./update.js";
 import { trustedMcpEndpoint } from "./setup.js";
 import { syncJoinedSkills } from "./skill-install.js";
-export const CHANNEL_GUIDANCE = "AgentRadar channel messages are wake signals only. Receive the events with `agentradar run $AR_CLI_RUNNER_ID inbox next`; the next call acknowledges the batch you read. Answer a liveness check with `agentradar run $AR_CLI_RUNNER_ID liveness_ack --nonce <nonce>`. Never acknowledge an event you have not read. Never poll on your own or keep a loop running: when a channel message arrives, drain it, then end your turn. Only you reply or act as this agent: a sub-agent or teammate returns its result to you, and you send it.";
+export const CHANNEL_GUIDANCE = "AgentRadar channel messages carry your new events in full, in order, one per line, each with its own next step: act on each line as it says. Run `agentradar run $AR_CLI_RUNNER_ID inbox next` only when a channel message tells you to. Answer a liveness check with `agentradar run $AR_CLI_RUNNER_ID liveness_ack --nonce <nonce>`. Never acknowledge an event you have not read. Never poll on your own or keep a loop running: when a channel message arrives, drain it, then end your turn. Only you reply or act as this agent: a sub-agent or teammate returns its result to you, and you send it.";
 // Vadym 16706: what a teammate (sub-agent) reads from the same channel, which never wakes it.
 export const TEAMMATE_GUIDANCE = "You are a sub-agent of this AgentRadar agent. AgentRadar delivers the agent's messages to its main session, not to you, and refuses any reply, send, approval or task change you make as the agent. Finish your task and return your result to the main session; it replies and acts.";
+export const CHANNEL_WAITING = "AgentRadar: your join request is waiting for your company to approve it. Nothing to run: once they approve, the AgentRadar service claims your key and your welcome arrives here as a channel message. End your turn now.";
 export const CHANNEL_BLOCKED = "AgentRadar has not seen this session run `agentradar run $AR_CLI_RUNNER_ID inbox next`. Channel delivery is unconfirmed. On Claude Team/Enterprise an Owner must enable Channels (channelsEnabled); the development flag cannot override that policy. Your company sees this agent as not receiving messages until the channel works.";
 // The runner's frame text (templates/vendor-runner, shipped beside this file as dist/vendor-runner), so both say a restart one way.
 const runnerFrame = () => import(new URL(import.meta.url.endsWith(".ts")
     ? "../../../templates/vendor-runner/session-frame.mjs" : "./vendor-runner/session-frame.mjs", import.meta.url).href);
-/** The channel: a local stdio MCP with no tools, only wake signals. The agent acts through the CLI; wake signals never consume the durable queue. */
-/** The wake line. Zero events never says "run inbox next": that call has nothing to return. Each reason names its own tool. */
-export function wakeText(runnerId, count, payload) {
+/** The channel: a local stdio MCP with no tools. It types each event into the wake as the feeder did; the agent acts through the CLI. */
+/** The wake line with no events. Zero events never says "run inbox next": that call has nothing to return. Each reason names its own tool. */
+export function wakeText(runnerId, payload) {
     const run = `agentradar run ${runnerId}`;
-    if (count)
-        return `${payload.firstStep ? `${payload.firstStep} ` : ""}${count} new AgentRadar events; run \`${run} inbox next\`${payload.livenessProbe ? " to receive your liveness check" : ""}.`;
     return [
         payload.onboarding && `AgentRadar session started, no messages waiting. Run \`${run} get_my_context\` now for your identity, peers and rules.`,
         payload.livenessProbe && `AgentRadar liveness check, no messages waiting. Run \`${run} liveness_ack --nonce ${payload.livenessProbe.nonce}\` now.`,
     ].filter(Boolean).join(" ");
 }
+/**
+ * ACK-CHANNEL-EVENT-INLINE: the wake lists every event in order, each in the feeder's own frame (fenced sender text, the read
+ * step for a preview, the reply command), so the agent answers without first running `inbox next` (#2749 cost a turn).
+ * Claude Code wraps the content in a <channel> tag, so a sender cannot write one to close it early.
+ */
+export function eventsText(frame, runnerId, events, payload) {
+    const lines = events.map((event, i) => frame.formatInjectionFrame(i === 0 && payload.firstStep ? { ...event, firstStep: payload.firstStep } : event, runnerId));
+    if (payload.livenessProbe)
+        lines.push(frame.formatProbeFrame(payload.livenessProbe, runnerId));
+    // Each frame ends "Then stop." (it was written for one event per wake): only the last line may stop the agent.
+    return lines.map((line, i) => i < lines.length - 1 ? line.replace(/ Then stop\.$/, " Then handle the next line.") : line).join("\n").replace(/<(\/?)channel/gi, "‹$1channel");
+}
+let ownHostIsTeammate;
+let psFailed = false;
 /**
  * True when this channel runs under a Claude Code teammate (started with --agent-id). Claude Code gives every teammate
  * pane the session's --mcp-config, so each teammate ran its own channel under a new sessionId: Hormozi's 2 teammates and
  * his main session flipped the runner session on every poll and starved his queue for hours (10-23).
  */
-export function hostIsTeammate(pid = process.ppid) {
+export function hostIsTeammate(pid) {
+    // This process's own host never changes and the walk is up to 8 blocking ps spawns: asked once, not on every request.
+    // A walk whose ps failed (a timeout under load) is not remembered, or a false would stick for the process's life.
+    if (pid === undefined) {
+        if (ownHostIsTeammate !== undefined)
+            return ownHostIsTeammate;
+        psFailed = false;
+        const own = hostIsTeammate(process.ppid);
+        if (!psFailed)
+            ownHostIsTeammate = own;
+        return own;
+    }
     for (let hops = 0; pid > 1 && hops < 8; hops++) {
         let row;
         try {
             row = execFileSync("ps", ["-o", "ppid=,args=", "-p", String(pid)], { encoding: "utf8", timeout: 5_000 }).trim();
         }
         catch {
+            psFailed = true;
             return false;
         }
         const [, parent, args] = row.match(/^(\d+)\s+(.*)$/) ?? [];
@@ -57,11 +82,24 @@ export async function startChannel(runnerId, deps = {}) {
     const home = deps.home ?? homedir();
     const output = deps.output ?? process.stdout;
     const logError = deps.logError ?? console.error;
-    // The runner file, else a hosted session's own PAPERCLIP_API_* (hosted-session-start.mjs puts them in this server's env).
-    const target = await awpEndpoint(runnerId, { home, logError });
-    const endpoint = trustedMcpEndpoint(target?.url ?? "");
-    const bearer = target?.bearer;
-    if (!endpoint || !bearer)
+    // UAT-17-INPLACE: an in-place session restarted before its company approved the join. The runner env has no key yet;
+    // the service writes it there on approval, so the channel connects, says so once, and starts polling when the key lands.
+    const envPath = join(home, ".agentradar", "agents", `${runnerId}.env`);
+    const joinState = async () => {
+        const saved = await readFile(envPath, "utf8").catch(() => "");
+        return envValue(saved, "AWP_BEARER") ? undefined : envValue(saved, "AR_JOIN_STATE") ?? undefined;
+    };
+    const awaited = await joinState();
+    let endpoint = null;
+    let bearer;
+    const resolveTarget = async () => {
+        // The runner file, else a hosted session's own PAPERCLIP_API_* (hosted-session-start.mjs puts them in this server's env).
+        const target = await awpEndpoint(runnerId, { home, logError, ...(awaited ? { env: {} } : {}) }); // a joining runner is never hosted
+        endpoint = target ? trustedMcpEndpoint(target.url) : null;
+        bearer = target?.bearer;
+        return Boolean(endpoint && bearer);
+    };
+    if (!awaited && !await resolveTarget())
         throw new Error("Runner configuration requires a trusted AWP_MCP_URL and AWP_BEARER");
     // TRC-RESTART-REASON: the hosted bridge leaves why the last workspace stopped; the first wake with work says it, once.
     const notice = join(home, ".agentradar", "run", "restart-notice.json");
@@ -71,20 +109,26 @@ export async function startChannel(runnerId, deps = {}) {
     let polling = false;
     let agentPolled = false;
     const startedAt = Date.now();
-    // The CLI rewrites <runner>.delivered.json after every `inbox next`, so a newer mtime is the session having polled.
+    // The CLI rewrites <runner>.delivered.json after every `inbox next` and touches it after every other call, so a newer
+    // mtime is the session having acted.
     const delivered = join(home, ".agentradar", "agents", `${runnerId}.delivered.json`);
-    const polled = () => agentPolled ||= (() => { try {
-        return statSync(delivered).mtimeMs >= startedAt;
+    const calledSince = (t) => { try {
+        return statSync(delivered).mtimeMs >= t;
     }
     catch {
         return false;
-    } })();
+    } };
+    const polled = () => agentPolled ||= calledSince(startedAt);
     // Vadym 10342: an unconfirmed channel is reported to AgentRadar (runnerState channel_unconfirmed), so the owner sees
     // the agent is not receiving messages; "ready" again once the session does run `inbox next`.
     let unconfirmed = null;
     let warning;
     let skillSync;
     let teammateNotices;
+    // Detached sync and notice passes: the channel drains them on stop, so none still writes into the home dir after it returns.
+    const pending = new Set();
+    const syncAbort = new AbortController(); // aborts a sync request still hung when the drain bound passes
+    const track = (work) => { pending.add(work); void work.finally(() => pending.delete(work)); };
     const send = (value) => new Promise((resolve, reject) => {
         output.write(`${JSON.stringify(value)}\n`, (error) => error ? reject(error) : resolve());
     });
@@ -110,9 +154,9 @@ export async function startChannel(runnerId, deps = {}) {
     const next = (args = {}) => remote("tools/call", { name: "next_event", arguments: { ...args, sessionId } });
     // AGENT-GUARD-ACTIVE: the supervisor's marker, written by agent-guard's SessionStart hook in this session.
     const guardLoaded = () => !process.env.AR_GUARD_MARKER || existsSync(process.env.AR_GUARD_MARKER);
-    const pause = (until) => new Promise((resolve) => {
+    const pause = (ms, until) => new Promise((resolve) => {
         const done = () => { clearTimeout(timer); clearInterval(watch); stop.signal.removeEventListener("abort", done); resolve(); };
-        const timer = setTimeout(done, deps.retryMs ?? 3_000);
+        const timer = setTimeout(done, ms);
         // COLD-START-WARMUP: a booting session's work is held until it polls ready, so poll the moment the marker lands.
         const watch = until && setInterval(() => { if (until())
             done(); }, 100);
@@ -125,6 +169,18 @@ export async function startChannel(runnerId, deps = {}) {
         let lastSent = 0;
         let selftestStarted = false;
         let guarded = true;
+        // Inlined events, acked once the session has made a call after the wake that carried them (the feeder acked on pane receipt).
+        let unacked = [];
+        // NEXT-EVENT-POLL-BACKOFF: a session that never acts got the same wake re-pushed every 30 s. Each re-push of the SAME
+        // unchanged set doubles that gap up to 5 min; a new event, a probe or a session call resets it. The 3 s poll stays, so a
+        // new event is pushed at the next poll; the server already parks served-unacked messages (redelivery.ts).
+        let resends = 0;
+        const resendMs = deps.resendMs ?? 30_000;
+        // NEXT-EVENT-POLL-BACKOFF: a failing poll (server down, key refused) retried every 3 s forever. Each consecutive failure
+        // doubles the pause up to 20x (60 s), jittered to 50-100% so runners cut off together do not return in step; any poll
+        // that gets through resets it.
+        const retryMs = deps.retryMs ?? 3_000;
+        let failures = 0;
         while (!stop.signal.aborted) {
             try {
                 guarded = guardLoaded(); // first, so a call that throws after the marker lands still gets the full pause
@@ -145,33 +201,45 @@ export async function startChannel(runnerId, deps = {}) {
                 if (unconfirmed === "reported" && polled())
                     unconfirmed = null;
                 // While reported, no runnerState: the stored state stands, and the poll still drains for wake signals.
-                const response = await next(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" });
+                // Receipt only: a preview still needs read_message before any reply (server gate). A "starting" poll cannot ack.
+                const ack = guarded && unacked.length && calledSince(lastSent) ? unacked : null;
+                const response = await next({ ...(unconfirmed ? {} : { runnerState: guarded ? "ready" : "starting" }), ...(ack ? { ackEventIds: ack } : {}) });
                 if (response.error || response.result?.isError)
                     throw new Error("AgentRadar refused next_event; check the runner key and its poll permission");
                 const content = response.result?.content;
                 const payload = JSON.parse(content?.find((item) => item.type === "text")?.text ?? "{}");
+                if (ack)
+                    unacked = [];
                 const events = payload.events ?? [];
                 const wake = JSON.stringify([events.map((event) => event.eventId), payload.livenessProbe?.nonce, Boolean(payload.onboarding)]);
-                if ((events.length || payload.livenessProbe || payload.onboarding) && (wake !== lastWake || Date.now() - lastSent >= 30_000)) {
-                    const restart = events.length ? (await runnerFrame()).restartLine(await readFile(notice, "utf8").then(JSON.parse, () => null), runnerId) : "";
+                const same = wake === lastWake;
+                if (!same || calledSince(lastSent))
+                    resends = 0;
+                if ((events.length || payload.livenessProbe || payload.onboarding) && (!same || Date.now() - lastSent >= Math.min(resendMs * 2 ** resends, resendMs * 10))) {
+                    const frame = await runnerFrame();
+                    const restart = events.length ? frame.restartLine(await readFile(notice, "utf8").then(JSON.parse, () => null), runnerId) : "";
                     await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: {
-                            content: `${restart ? `${restart} ` : ""}${wakeText(runnerId, events.length, payload)}`,
+                            content: `${restart ? `${restart}\n` : ""}${events.length ? eventsText(frame, runnerId, events, payload) : wakeText(runnerId, payload)}`,
                             meta: { count: String(events.length) },
                         } });
                     if (restart)
                         await rm(notice, { force: true });
+                    if (same)
+                        resends += 1;
                     lastWake = wake;
                     lastSent = Date.now();
+                    unacked = events.flatMap((event) => event.eventId ? [event.eventId] : []);
                 }
-                // Never ack a count-only wake: only the agent's tool call confirms receipt of event content.
+                failures = 0;
             }
             catch (error) {
+                failures += 1;
                 const said = error.message;
                 // Below the server's minimum CLI the retry cannot succeed: say how to upgrade instead.
                 if (!stop.signal.aborted)
                     logError(/^upgrade required|below the minimum/.test(said) ? said : "AgentRadar channel poll failed; retrying. Check connectivity and the runner key.");
             }
-            await pause(guarded ? undefined : guardLoaded);
+            await pause(failures ? Math.min(retryMs * 2 ** failures, retryMs * 20) * (0.5 + Math.random() / 2) : retryMs, guarded ? undefined : guardLoaded);
         }
     };
     let teammate;
@@ -189,6 +257,20 @@ export async function startChannel(runnerId, deps = {}) {
             // Only the main session polls, so one agent keeps one runner session; a teammate's channel stays connected and silent.
             if (!polling && !isTeammate()) {
                 polling = true;
+                if (awaited) {
+                    await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: { content: CHANNEL_WAITING, meta: { count: "0" } } });
+                    while (!stop.signal.aborted && await joinState())
+                        await pause(deps.keyWaitMs ?? 10_000);
+                    if (stop.signal.aborted)
+                        return;
+                    if (!await resolveTarget()) {
+                        // The service removed the join (declined, withdrawn, already claimed) and recorded why in the join state.
+                        const refused = await readFile(awaited, "utf8").then((text) => JSON.parse(text).refused, () => undefined);
+                        await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: { meta: { count: "0" },
+                                content: `AgentRadar: this join did not complete. ${refused ?? "Its key is not on this machine."} This session receives no AgentRadar messages. Tell your human exactly this, then end your turn.` } });
+                        return;
+                    }
+                }
                 warning = setTimeout(() => { if (!polled()) {
                     logError(CHANNEL_BLOCKED);
                     unconfirmed = "pending";
@@ -196,19 +278,28 @@ export async function startChannel(runnerId, deps = {}) {
                 void poll();
                 // Vadym 11038: a push-mode session runs no feeder, so the channel keeps its skills and brief current as the feeder
                 // does: at connect and every 10 minutes, dropping skills no longer linked. stdout is the MCP stream; logs go to stderr.
-                const sync = () => syncJoinedSkills(runnerId, { home, fetch: deps.fetch, log: logError })
+                const sync = () => syncJoinedSkills(runnerId, { home, fetch: deps.fetch, log: logError, signal: syncAbort.signal })
                     .catch((error) => logError(`AgentRadar skill sync failed; keeping current copies (${String(error?.message ?? error).split("\n")[0]}).`));
-                void sync();
-                skillSync = setInterval(() => { void sync(); }, deps.skillsSyncMs ?? 600_000);
+                track(sync());
+                skillSync = setInterval(() => { track(sync()); }, deps.skillsSyncMs ?? 600_000);
                 skillSync.unref?.();
-                // TEAMMATE-IDLE-STOP: the hosted bridge leaves teammate-stopped-<name>.txt for each idle teammate it stopped; each is said once.
+                // TEAMMATE-IDLE-STOP: the hosted bridge leaves teammate-stopped-<name>.txt for each idle teammate it stopped or teammate that ended; each is said once.
                 const run = join(home, ".agentradar", "run");
-                teammateNotices = setInterval(() => void (async () => {
-                    for (const file of readdirSync(run).filter((name) => /^teammate-stopped-.+\.txt$/.test(name))) {
-                        await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: { content: await readFile(join(run, file), "utf8"), meta: { count: "0" } } });
-                        await rm(join(run, file), { force: true });
+                let noticing = false; // a slow pass is not started again before it has removed its file, or the notice is said twice
+                teammateNotices = setInterval(() => track((async () => {
+                    if (noticing)
+                        return;
+                    noticing = true;
+                    try {
+                        for (const file of readdirSync(run).filter((name) => /^teammate-stopped-.+\.txt$/.test(name))) {
+                            await send({ jsonrpc: "2.0", method: "notifications/claude/channel", params: { content: await readFile(join(run, file), "utf8"), meta: { count: "0" } } });
+                            await rm(join(run, file), { force: true });
+                        }
+                    }
+                    finally {
+                        noticing = false;
                     }
-                })().catch(() => { }), deps.teammateNoticeMs ?? 5_000);
+                })().catch(() => { })), deps.teammateNoticeMs ?? 5_000);
                 teammateNotices.unref?.();
             }
         }
@@ -239,6 +330,9 @@ export async function startChannel(runnerId, deps = {}) {
         clearTimeout(warning);
         clearInterval(skillSync);
         clearInterval(teammateNotices);
+        // Bounded wait, so a hung fetch cannot hold the exit; then its request is aborted so it cannot write after we return.
+        await Promise.race([Promise.allSettled([...pending]), new Promise((resolve) => setTimeout(resolve, deps.drainMs ?? 2_000).unref())]);
+        syncAbort.abort();
         stop.abort();
     }
 }

package/dist/github.js

@@ -0,0 +1,209 @@
+/**
+ * Vadym 18123: an agent someone gave GitHub access uses plain `gh` and `git` as itself, with nothing to set up.
+ *
+ * setup       writes the runner's `gh` shim and a git config naming this CLI as git's credential helper for the agent's
+ *             GitHub host: the AgentRadar proxy host for a linked account (remotes of the client's orgs are rewritten to it;
+ *             any other github.com remote stays plain git), else
+ *             github.com for a GitHub App token. The supervisor runs it at launch and puts both on the agent's PATH and
+ *             GIT_CONFIG; `gh` and `git` then sign in as the agent.
+ * credential  git's credential helper: mints a fresh `github_token` for each request and hands it to git on its pipe.
+ * gh          the shim's target: mints a token and runs the real `gh` with it in the environment. A command whose repositories
+ *             all belong to someone else (a public repo, an open-source checkout, the agent's own account) is refused, with why,
+ *             except `gh api`: the proxy serves GET on public repositories of any owner (GH-PROXY-PUBLIC-READS).
+ * A token is never written to disk or put on a command line. Without one, gh runs as it would have (the machine's login).
+ */
+import { execFile, spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { access, chmod, mkdir, realpath, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { delimiter, join } from "node:path";
+import { awpRequest, RUNNER_ID } from "./tool-run.js";
+export const GITHUB_USAGE = "Usage: agentradar github setup <runner-id> | agentradar github gh <runner-id> -- <gh args> | agentradar github credential <runner-id> get";
+const HOST = /^[A-Za-z0-9.-]+(:\d+)?$/;
+const OWNER = /^[A-Za-z0-9-]+$/;
+export const githubDir = (runnerId, deps) => join(deps.home ?? homedir(), ".agentradar", "run", "github", runnerId);
+const sq = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+/** One `github_token` call with the runner's own key. */
+export async function mintGithub(runnerId, deps) {
+    const said = await awpRequest(runnerId, "tools/call", { name: "github_token", arguments: {} }, deps);
+    const text = said?.result?.content?.[0]?.text ?? "";
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return { error: text || "AgentRadar did not answer" };
+    }
+    if (said?.result?.isError || !body.ok || !body.token)
+        return { error: body.error ?? text };
+    if (body.host !== undefined && !HOST.test(body.host))
+        return { error: "AgentRadar returned an invalid GitHub host" };
+    const owners = Array.isArray(body.owners) ? body.owners.filter((o) => typeof o === "string" && OWNER.test(o)) : undefined;
+    return { token: body.token, host: body.host, owners, ...(typeof body.login === "string" && OWNER.test(body.login) ? { login: body.login } : {}) };
+}
+/** The include file the supervisor points GIT_CONFIG at; written whole and renamed, so git never reads half of it. */
+async function writeGitconfig(runnerId, { host, owners }, bin, deps) {
+    const dir = githubDir(runnerId, deps);
+    const helper = `!${sq(bin)} github credential ${runnerId}`.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    // The empty helper drops the machine's own helpers (a keychain login) for this host, so git signs in as the agent.
+    const lines = [`[credential "https://${host ?? "github.com"}"]`, "\thelper =", `\thelper = "${helper}"`];
+    // Only the client's orgs go through the proxy; a public repo or the vendor's own stays plain git. An older AgentRadar
+    // that names no owners gets the old whole-github.com rewrite.
+    // ponytail: insteadOf is a case-sensitive prefix; a remote spelling the org in other capitals than GitHub's stays plain git.
+    if (host)
+        for (const owner of owners ? [...new Set(owners.flatMap((o) => [o, o.toLowerCase()]))].map((o) => `${o}/`) : [""]) {
+            lines.push(`[url "https://${host}/${owner}"]`, `\tinsteadOf = https://github.com/${owner}`, `\tinsteadOf = git@github.com:${owner}`, `\tinsteadOf = ssh://git@github.com/${owner}`);
+        }
+    await mkdir(dir, { recursive: true });
+    const tmp = join(dir, `gitconfig.${process.pid}`);
+    await writeFile(tmp, lines.join("\n") + "\n", { mode: 0o600 });
+    await rename(tmp, join(dir, "gitconfig"));
+}
+export async function githubSetup(runnerId, deps) {
+    const logError = deps.logError ?? console.error;
+    const bin = (deps.env ?? process.env).AR_AGENTRADAR_BIN;
+    if (!bin) {
+        logError("AR_AGENTRADAR_BIN is not set.");
+        return 1;
+    }
+    const shim = join(githubDir(runnerId, deps), "bin", "gh");
+    await mkdir(join(githubDir(runnerId, deps), "bin"), { recursive: true });
+    await writeFile(shim, `#!/bin/sh\nexec ${sq(bin)} github gh ${runnerId} -- "$@"\n`);
+    await chmod(shim, 0o755);
+    const minted = await mintGithub(runnerId, deps);
+    // A failed mint keeps the last config: no GitHub access yet, or a passing outage, is not a reason to drop it.
+    if ("error" in minted) {
+        logError(`No GitHub token for this agent: ${minted.error}`);
+        return 1;
+    }
+    await writeGitconfig(runnerId, minted, bin, deps);
+    return 0;
+}
+/** git's `credential.helper` protocol: answer `get` for the agent's own host, stay silent for any other. */
+export async function githubCredential(runnerId, op, deps) {
+    if (op !== "get")
+        return 0;
+    const input = await (deps.stdin ?? (async () => { const chunks = []; for await (const chunk of process.stdin)
+        chunks.push(chunk); return Buffer.concat(chunks).toString("utf8"); }))();
+    const asked = Object.fromEntries(input.split("\n").filter((l) => l.includes("=")).map((l) => [l.slice(0, l.indexOf("=")), l.slice(l.indexOf("=") + 1)]));
+    const minted = await mintGithub(runnerId, deps);
+    if ("error" in minted) {
+        (deps.logError ?? console.error)(`agentradar: no GitHub token for this agent (${minted.error}).`);
+        return 0;
+    }
+    // A link or unlink since launch moves the host: rewrite the config so the next git call goes to the right one.
+    const bin = (deps.env ?? process.env).AR_AGENTRADAR_BIN;
+    if (bin)
+        await writeGitconfig(runnerId, minted, bin, deps).catch(() => { });
+    if (asked.protocol === "https" && asked.host === (minted.host ?? "github.com")) {
+        (deps.log ?? console.log)(`username=x-access-token\npassword=${minted.token}`);
+    }
+    return 0;
+}
+/** The real `gh` on PATH, skipping this runner's own shim however PATH spells it (a HOME ending in "/", a symlink). */
+async function realGh(shim, env) {
+    const self = await realpath(shim).catch(() => shim);
+    for (const dir of (env.PATH ?? "").split(delimiter)) {
+        if (!dir || !(await access(join(dir, "gh"), constants.X_OK).then(() => true, () => false)))
+            continue;
+        if (await realpath(join(dir, "gh")).catch(() => "") !== self)
+            return join(dir, "gh");
+    }
+    return null;
+}
+const IN_URL = /(?:^|[/@])github\.com[/:]([A-Za-z0-9-]+)(?=\/|$)/gim;
+const ownerOf = (value = "") => value.match(new RegExp(IN_URL.source, "i"))?.[1] ?? value.match(/^([A-Za-z0-9-]+)\/[A-Za-z0-9._-]+$/)?.[1];
+/** The repository owners a gh command names: -R/--repo, `gh repo <verb> OWNER/REPO`, github.com URLs, `gh api` repos|orgs|users paths. */
+export function ghTargets(args) {
+    return args.flatMap((arg, i) => {
+        const named = arg === "-R" || arg === "--repo" ? ownerOf(args[i + 1]) : arg.startsWith("--repo=") ? ownerOf(arg.slice(7))
+            : /^-R./.test(arg) ? ownerOf(arg.slice(2)) : new RegExp(IN_URL.source, "i").test(arg) ? ownerOf(arg)
+                : args[0] === "api" ? arg.match(/^\/?(?:repos|orgs|users)\/([A-Za-z0-9-]+)/)?.[1]
+                    : args[0] === "repo" && i === 2 && !arg.startsWith("-") ? ownerOf(arg) : undefined;
+        return named ? [named] : [];
+    });
+}
+/**
+ * The owner gh must not run for, or null for the proxy. Named owners decide; without any, the checkout's remotes do
+ * (a client's remote is rewritten to the proxy host). Nothing to go on (no repo, `gh api user`) stays on the proxy.
+ */
+async function outsideOwner(args, host, owners, env, cwd) {
+    let targets = ghTargets(args);
+    if (!targets.length) {
+        const remotes = await new Promise((resolve) => execFile("git", ["remote", "-v"], { env, cwd, timeout: 5000 }, (_e, out) => resolve(String(out ?? ""))));
+        if (remotes.includes(`://${host}/`))
+            return null;
+        targets = [...remotes.matchAll(IN_URL)].map((m) => m[1]);
+    }
+    const client = new Set(owners.map((o) => o.toLowerCase()));
+    return targets.length && !targets.some((t) => client.has(t.toLowerCase())) ? targets[0] : null;
+}
+export async function githubGh(runnerId, args, deps) {
+    const logError = deps.logError ?? console.error;
+    const env = deps.env ?? process.env;
+    const gh = await realGh(join(githubDir(runnerId, deps), "bin", "gh"), env);
+    if (!gh) {
+        logError("agentradar: gh is not installed on this machine.");
+        return 127;
+    }
+    // Already inside the shim (gh running gh, or a PATH the check above still missed): the token is in the environment,
+    // so run gh as is and mint nothing. Without this a loop mints a token at every level.
+    if (env.AR_GH_SHIMMED === "1")
+        return await run(gh, args, env, deps.cwd);
+    const minted = await mintGithub(runnerId, deps);
+    const childEnv = { ...env, AR_GH_SHIMMED: "1" };
+    if ("error" in minted) {
+        logError(`agentradar: no GitHub token for this agent (${minted.error}); running gh with this machine's own login.`);
+    }
+    else {
+        if (env.AR_AGENTRADAR_BIN)
+            await writeGitconfig(runnerId, minted, env.AR_AGENTRADAR_BIN, deps).catch(() => { });
+        const outside = minted.host && minted.owners && args[0] !== "api" ? await outsideOwner(args, minted.host, minted.owners, env, deps.cwd) : null;
+        if (outside) {
+            // Not run at all: gh signed out refuses every command ("gh auth login", exit 4), and the agent's token reaches only
+            // the client's orgs. Anonymous git still clones public repositories.
+            const clients = minted.owners.join(", ");
+            const reply = "run `agentradar run $AR_CLI_RUNNER_ID reply` in Slack, or `agentradar run $AR_CLI_RUNNER_ID telegram_reply`, `agentradar run $AR_CLI_RUNNER_ID email_reply`, " +
+                "`agentradar run $AR_CLI_RUNNER_ID whatsapp_reply` or `agentradar run $AR_CLI_RUNNER_ID discord_reply` for the conversation you work in";
+            logError(outside.toLowerCase() === minted.login?.toLowerCase()
+                ? `agentradar: ${outside} is your own GitHub account, so gh did not run: repositories under your own account are read-only by design. ` +
+                    `Read public ones with \`gh api repos/${outside}/<repo>\` or git clone; private ones there are not reachable. Your work belongs in your client's GitHub orgs (${clients}). ` +
+                    `If you need a repository there, ask your client to create it: ${reply}.`
+                : `agentradar: gh works only on your client's GitHub orgs (${clients}), so it did not run for ${outside}. To read a public repository there, ` +
+                    `use \`gh api repos/${outside}/<repo>\` (reads only) or git clone https://github.com/${outside}/<repo>. If ${outside} is your client's, ask your client to add it: ${reply}.`);
+            return 1;
+        }
+        if (minted.host)
+            Object.assign(childEnv, { GH_HOST: minted.host, GH_ENTERPRISE_TOKEN: minted.token });
+        else
+            childEnv.GH_TOKEN = minted.token;
+    }
+    return await run(gh, args, childEnv, deps.cwd);
+}
+const run = (bin, args, env, cwd) => new Promise((resolve) => {
+    const child = spawn(bin, args, { stdio: "inherit", env, cwd });
+    child.on("error", () => resolve(127));
+    child.on("exit", (code) => resolve(code ?? 1));
+});
+export async function githubOverCli(args, deps = {}) {
+    const [verb, runnerId, ...rest] = args;
+    if (!runnerId || !RUNNER_ID.test(runnerId)) {
+        (deps.logError ?? console.error)(GITHUB_USAGE);
+        return 2;
+    }
+    try {
+        if (verb === "setup" && !rest.length)
+            return await githubSetup(runnerId, deps);
+        if (verb === "credential" && rest.length === 1)
+            return await githubCredential(runnerId, rest[0], deps);
+        if (verb === "gh" && rest[0] === "--")
+            return await githubGh(runnerId, rest.slice(1), deps);
+    }
+    catch (error) {
+        (deps.logError ?? console.error)(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    (deps.logError ?? console.error)(GITHUB_USAGE);
+    return 2;
+}
+//# sourceMappingURL=github.js.map

package/dist/index.js

@@ -4,14 +4,15 @@ import { homedir } from "node:os";
 import { installVendorSkill } from "./skill-install.js";
 import { startChannel } from "./channel.js";
 import { runRestartSelftest, startVendorRunner } from "./runner.js";
-import { cancelJoin, CODEX_GUARD_REFUSAL, dropStaleMcp, ensureCodexGuard, joinOrganisation, leaveOrganisation, setupVendorAgent } from "./setup.js";
-import { callAwpTool, callToolOverCli, EXIT, parseCallArgs } from "./tool-run.js";
+import { cancelJoin, CODEX_GUARD_REFUSAL, dropStaleMcp, ensureCodexGuard, joinOrganisation, joinRuntime, leaveOrganisation, setupVendorAgent } from "./setup.js";
+import { callAwpTool, callToolOverCli, EXIT, parseCallArgs, schemaOverCli } from "./tool-run.js";
 import { installSyncTimer, syncAgentDir } from "./sync.js";
 import { importVaultOverCli } from "./vault-import.js";
 import { cloneVaultOverCli } from "./vault-clone.js";
 import { ASSET_USAGE, getAssetOverCli } from "./asset-get.js";
 import { secretsOverCli } from "./secrets.js";
 import { adminOverCli } from "./admin.js";
+import { githubOverCli } from "./github.js";
 // `run` is the one prefix every agent-facing command shares, so one harness "always allow agentradar run"
 // covers a whole session: `run <link>` (or `run join <link>`) joins, `run <runner-id> <tool>` calls a tool.
 export const runArgs = (raw) => raw[0] !== "run" ? raw
@@ -29,22 +30,24 @@ const USAGE = [
     "  The runner is $AR_CLI_RUNNER_ID, or --runner <id>. --dry-run prints the exact call and sends nothing.",
     "  Exit codes: 0 done; 1 refused or unreachable (the reason is on stderr); 2 the command was wrong.",
     "Local commands:",
-    "  agentradar join <join-link> [--name <n>] [--model <m>] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--no-service | --service]",
+    "  agentradar join <join-link> [--name <n>] [--model <m>] [--runtime claude|codex|other] [--trust] [--attach-tmux <pane> | --attach-current] [--session <id>] [--no-service | --service]",
     "  agentradar join cancel <join-link|request-id>",
     "  agentradar setup [--trust] [--harness claude|codex]",
     "  agentradar leave <runner-id>",
     "  agentradar channel <runner-id>",
     "  agentradar selftest <runner-id> [--status|--restart]",
     "  agentradar runner start <runner-id>",
-    "  agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--args '<json>']",
+    "  agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--input <json|file|->]",
     "  agentradar vault import <runner-id> <dir> [--vault <vault-id>] [--source <name>] [--write]",
     "  agentradar vault clone <runner-id> <vault-id> [dir]",
     "  agentradar asset get <runner-id> <asset-id> [file]",
     "  agentradar secrets pull|renew|env <runner-id> | agentradar secrets exec <runner-id> -- <command>",
     "  agentradar secrets upload|rotate <runner-id> --env-file <path> | --from-env <NAME,...> | --prompt <NAME> [--replace]",
+    "  agentradar github setup <runner-id> | agentradar github gh <runner-id> -- <gh args> | agentradar github credential <runner-id> get",
     "  agentradar skill install | agentradar sync [dir] | agentradar sync install [dir] [--interval <s>]",
     "  agentradar admin broadcast --dry-run|--send --target all --text <text> --cta <next step>",
-    "  agentradar upgrade | agentradar --version",
+    "  agentradar admin notice --dry-run|--send --agent <id> --ref <key> --file <text file> --cta <next step> [--wake]",
+    "  agentradar schema <command> | agentradar upgrade | agentradar version [--json]",
 ].join("\n");
 async function main() {
     const args = runArgs(process.argv.slice(2));
@@ -80,8 +83,9 @@ async function main() {
         process.exitCode = await leaveOrganisation(args[1]);
         return;
     }
-    if (args.length === 1 && (args[0] === "--version" || args[0] === "-v")) {
-        console.log(createRequire(import.meta.url)("../package.json").version);
+    if ((args.length === 1 && (args[0] === "--version" || args[0] === "-v")) || (args[0] === "version" && (args.length === 1 || (args.length === 2 && args[1] === "--json")))) {
+        const version = createRequire(import.meta.url)("../package.json").version;
+        console.log(args[1] === "--json" ? JSON.stringify({ version }) : version);
         return;
     }
     if (args[0] === "channel" && args.length === 2) {
@@ -126,18 +130,25 @@ async function main() {
         const named = {};
         const urls = [];
         for (let i = 1; i < args.length; i++) {
-            if (["--name", "--model", "--attach-tmux", "--session"].includes(args[i]))
+            if (["--name", "--model", "--attach-tmux", "--session", "--runtime"].includes(args[i]))
                 named[args[i].slice(2)] = args[++i] ?? "-";
             else if (!["--trust", "--attach-current", "--allow-bypass", "--revoke-bypass", "--feeder", "--service", "--no-service"].includes(args[i]))
                 urls.push(args[i]);
         }
         if (urls.length !== 1 || [urls[0], ...Object.values(named)].some((value) => value.startsWith("-")) || (named["attach-tmux"] && args.includes("--attach-current")) || (args.includes("--service") && args.includes("--no-service"))) {
-            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current (Codex and other CLIs)] [--session <claude session id>] [--revoke-bypass] [--no-service | --service]");
+            console.error("Usage: agentradar join <join-link> [--name <your name>] [--model <your model id>] [--runtime <claude|codex|other>] [--trust] [--attach-tmux <session[:window.pane]> | --attach-current (Codex and other CLIs)] [--session <claude session id>] [--revoke-bypass] [--no-service | --service]");
+            process.exitCode = 1;
+            return;
+        }
+        // --revoke-bypass only edits what an earlier join wrote, so it needs no runtime.
+        const runtime = args.includes("--revoke-bypass") ? { harness: undefined } : joinRuntime(named.runtime, process.env);
+        if ("refusal" in runtime) {
+            console.error(runtime.refusal);
             process.exitCode = 1;
             return;
         }
         process.exitCode = await joinOrganisation(urls[0], {
-            trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
+            harness: runtime.harness, trust: args.includes("--trust"), agentName: named.name, model: named.model, session: named.session,
             attach: args.includes("--attach-current") ? "current" : named["attach-tmux"],
             revokeBypass: args.includes("--revoke-bypass"), feeder: args.includes("--feeder"), service: args.includes("--service"),
         });
@@ -157,7 +168,7 @@ async function main() {
         const parsed = parseCallArgs(args.slice(1));
         const [runnerId, ...words] = parsed?.words ?? [];
         if (!parsed || !runnerId || words.length > 3 || (!words.length && !parsed.flags.some(([flag]) => flag === "help"))) {
-            console.error("Usage: agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--args '<json>'] | agentradar call <runner-id> [<command>] --help");
+            console.error("Usage: agentradar call <runner-id> <tool | command> [--<flag> <value> ...] [--input <json|file|->] | agentradar call <runner-id> [<command>] --help");
             process.exitCode = EXIT.usage;
             return;
         }
@@ -198,6 +209,11 @@ async function main() {
         process.exitCode = await secretsOverCli(args.slice(1));
         return;
     }
+    // Vadym 18123: the supervisor's launch-time setup, the `gh` shim and git's credential helper; `github <server command>` stays the server's.
+    if (args[0] === "github" && ["setup", "credential", "gh"].includes(args[1] ?? "") && args[2] && !args[2].startsWith("-")) {
+        process.exitCode = await githubOverCli(args.slice(1));
+        return;
+    }
     if (args[0] === "admin") {
         process.exitCode = await adminOverCli(args.slice(1));
         return;
@@ -227,6 +243,10 @@ async function main() {
     // #1871: every other command is the server's, `<noun> [<sub-noun>] <verb>`, run as this shell's runner.
     const parsed = parseCallArgs(args);
     const runner = parsed?.flags.find(([flag]) => flag === "runner")?.[1] ?? process.env.AR_CLI_RUNNER_ID;
+    if (parsed && runner && parsed.words[0] === "schema" && parsed.words.length > 1 && parsed.words.length <= 4) {
+        process.exitCode = await schemaOverCli(runner, parsed.words.slice(1).join(" "));
+        return;
+    }
     if (!parsed || !runner || parsed.words.length > 3 || (!parsed.words.length && !parsed.flags.some(([flag]) => flag === "help"))) {
         console.error(USAGE);
         if (parsed && !runner)