agentradar-cli 0.3.9 → 0.3.11

package/dist/runner.js

@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { shellValue, trustedMcpEndpoint, writePrivateFile } from "./setup.js";
+import { claimPendingJoin, removeAgentService, shellValue, trustedMcpEndpoint, writePrivateFile } from "./setup.js";
 import { callAwpTool, envValue } from "./tool-run.js";
 import { cliHeader, installedVersion, noteCliUpdate, revertCli, runningVersion, selfUpdate } from "./update.js";
 const RUNNER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
@@ -224,7 +224,16 @@ export async function startVendorRunner(runnerId, home = homedir(), deps = {}) {
     if (!RUNNER_ID.test(runnerId))
         throw new Error("Invalid runner ID");
     const log = deps.log ?? console.log;
+    // UAT-17: a join installed before its approval waits here for the key; a no-op once the env has one.
+    if (!await claimPendingJoin(runnerId, { home, fetch: deps.fetch, sleep: deps.sleep, log }))
+        return 1;
     const envPath = join(home, ".agentradar", "agents", `${runnerId}.env`);
+    // UAT-17-INPLACE: the user's own launcher runs an in-place session, so this service only claimed the key; it removes itself.
+    if (envValue(await readFile(envPath, "utf8").catch(() => ""), "AR_INPLACE") === "1") {
+        log("Key claimed for the in-place session; its own launcher runs it with the AgentRadar channel. This service is done and removes itself.");
+        await (deps.removeService ?? ((id) => removeAgentService(id, { home })))(runnerId);
+        return 0;
+    }
     const agentDir = dirname(envPath);
     const supervisor = join(dirname(fileURLToPath(import.meta.url)), "vendor-runner", "supervisor", "supervise-agent.sh");
     const spawnChild = deps.spawn ?? ((command, args) => spawn(command, args, { stdio: "inherit", env: process.env }));

package/dist/setup.js

@@ -427,12 +427,15 @@ async function codexHookHashes(codexHome, env) {
         child.kill();
     }
 }
-async function installRunner(home, projectPath, approved, service, feed) {
+const CODEX_BYPASS = "--dangerously-bypass-approvals-and-sandbox";
+const CLAUDE_BYPASS = "--permission-mode bypassPermissions";
+/** `pending`: a join not approved yet. The env carries no key, only where the service claims it (claimPendingJoin). */
+async function installRunner(home, projectPath, approved, service, feed, pending) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(approved.runnerId)) {
         throw new Error("AgentRadar returned an invalid runner ID");
     }
     const endpoint = trustedMcpEndpoint(approved.installation.mcpEndpoint);
-    if (!endpoint || !BEARER_SHAPE.test(approved.installation.bearer)) {
+    if (!endpoint || (!pending && !BEARER_SHAPE.test(approved.installation.bearer))) {
         throw new Error("AgentRadar returned an invalid setup payload");
     }
     const agentDir = join(home, ".agentradar", "agents");
@@ -455,7 +458,7 @@ async function installRunner(home, projectPath, approved, service, feed) {
             const { codexHome, keys } = await codexServiceHome(home, approved.runnerId, service.env);
             joined.push(`CODEX_HOME=${shellValue(codexHome)}`);
             if (service.bypass)
-                joined.push(`CODEX_EXTRA_FLAGS=${shellValue("--dangerously-bypass-approvals-and-sandbox")}`);
+                joined.push(`CODEX_EXTRA_FLAGS=${shellValue(CODEX_BYPASS)}`);
             toolKeys = keys;
         }
         else if (harness === "generic") {
@@ -493,7 +496,7 @@ async function installRunner(home, projectPath, approved, service, feed) {
             }, null, 2)}\n`);
             if (!service.inPlace) {
                 if (service.bypass)
-                    joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue("--permission-mode bypassPermissions")}`);
+                    joined.push(`CLAUDE_EXTRA_FLAGS=${shellValue(CLAUDE_BYPASS)}`);
                 joined.push(`CLAUDE_SETTINGS=${shellValue(settings)}`, `CLAUDE_CODE_PLUGIN_CACHE_DIR=${shellValue(join(configDir, "plugins"))}`);
                 // Vadym 13444: the agent keeps every MCP and channel it already has; AgentRadar's channel is added next to them.
                 joined.push("AR_MCP_STRICT=0");
@@ -523,7 +526,9 @@ async function installRunner(home, projectPath, approved, service, feed) {
         `AGENT_NAME=${shellValue(approved.runnerId)}`,
         `AR_BASE=${shellValue(projectPath)}`,
         `AWP_MCP_URL=${shellValue(endpoint.toString())}`,
-        `AWP_BEARER=${shellValue(approved.installation.bearer)}`,
+        ...(pending
+            ? [`AR_JOIN_STATE=${shellValue(pending.state)}`, `AR_JOIN_CLAIM_URL=${shellValue(pending.claimUrl)}`]
+            : [`AWP_BEARER=${shellValue(approved.installation.bearer)}`]),
         `MCP_CONFIG=${shellValue(mcpConfig)}`,
         // Every convention line in the brief and skills says `agentradar run $AR_CLI_RUNNER_ID <tool>`.
         `AR_CLI_RUNNER_ID=${shellValue(approved.runnerId)}`,
@@ -674,6 +679,106 @@ async function installAgentService(runnerId, home, env) {
         env: { ...env, HOME: home, NODE_BIN: process.execPath, AGENTRADAR_JS: join(dist, "index.js") },
     });
 }
+/** What a key claim's answer means: null = not decided yet, keep polling; else the refusal in plain words. */
+function claimRefusal(status, said) {
+    // A deploy's 502/503 or a rate limit is not the company's answer; refusing on one would remove the service.
+    if (status >= 500 || status === 429 || (status === 409 && said.includes("must be approved")))
+        return null;
+    if (status === 409 && said.includes("rejected"))
+        return "Your company declined this join request. Ask it for a new join link.";
+    if (status === 409 && said.includes("withdrawn"))
+        return "This join request was withdrawn (agentradar join cancel). Ask your company for a new join link.";
+    if (status === 409 && /already (?:used|claimed)/.test(said))
+        return "This join link's key was already claimed. A key is issued once and cannot be claimed again; ask your company for a new join link.";
+    return said;
+}
+/**
+ * UAT-17 (lead ruling B): an agent's shell tool kills a command that runs for minutes, so a join that
+ * waited for the approval in the foreground never saw it. The service is now installed with the request, and
+ * `runner start` calls this first: while the runner env holds no key it polls the claim every 10 s, writes the
+ * key, and records the approval in the join state the foreground command watches. Then the supervisor starts
+ * the session, whose first poll brings the welcome. A refusal is recorded there too, and the service removes
+ * itself. The service is the only claimant, so a key is never claimed twice. False = stopped without a key.
+ */
+export async function claimPendingJoin(runnerId, deps = {}) {
+    const home = deps.home ?? homedir();
+    const log = deps.log ?? console.log;
+    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const { envValue } = await import("./tool-run.js");
+    const envPath = join(home, ".agentradar", "agents", `${runnerId}.env`);
+    const saved = await readFile(envPath, "utf8").catch(() => "");
+    const statePath = envValue(saved, "AR_JOIN_STATE");
+    if (!statePath || envValue(saved, "AWP_BEARER"))
+        return true;
+    const leave = deps.leave ?? (() => leaveOrganisation(runnerId, { home, log }));
+    const state = await readFile(statePath, "utf8").then((text) => JSON.parse(text), () => null);
+    const refuse = async (said) => {
+        // Another claimant (the foreground fallback when the service install threw) already wrote the key: start on it, never remove it.
+        if (envValue(await readFile(envPath, "utf8").catch(() => ""), "AWP_BEARER"))
+            return true;
+        if (state)
+            await writePrivateFile(statePath, JSON.stringify({ ...state, refused: said }));
+        log(said);
+        await leave();
+        return false;
+    };
+    // The state file goes with `agentradar join cancel`; the claim secret goes only to the AgentRadar host that issued it.
+    if (!state)
+        return refuse("This join request was withdrawn (agentradar join cancel). Ask your company for a new join link.");
+    const claimUrl = trustedMcpEndpoint(envValue(saved, "AR_JOIN_CLAIM_URL") ?? "");
+    if (!claimUrl)
+        return refuse(`${envPath} names no AgentRadar address to claim the key from; run the join again.`);
+    for (let poll = 1; poll <= (deps.polls ?? Infinity); poll++) {
+        let response;
+        try {
+            response = await postJson(deps.fetch ?? fetch, claimUrl, { claimSecret: state.claimSecret, runnerId });
+        }
+        catch {
+            log(`Could not reach ${claimUrl.host}; retrying…`);
+            await sleep(10_000);
+            continue;
+        }
+        if (response.status === 201) {
+            const claimed = await response.json();
+            if (typeof claimed.token !== "string" || !BEARER_SHAPE.test(claimed.token) || typeof claimed.agentId !== "string") {
+                return refuse("AgentRadar returned an invalid key claim");
+            }
+            // Bypass-permissions only when the operator consented at approval, and never for a pane the caller runs.
+            const token = claimed.token;
+            const approvedBypass = claimed.bypassPermissions === true;
+            const bypass = approvedBypass && envValue(saved, "AR_ATTACH") !== "1" && envValue(saved, "AR_INPLACE") !== "1";
+            const harness = envValue(saved, "AR_AGENT_HARNESS") ?? "claude";
+            // The same file installRunner writes for an approved join, line for line.
+            const lines = saved.split("\n").filter((line) => !line.startsWith("AR_JOIN_CLAIM_URL="))
+                .map((line) => line.startsWith("AR_JOIN_STATE=") ? `AWP_BEARER=${shellValue(token)}` : line);
+            const insert = (flag, at) => lines.splice(at < 0 ? lines.length - 1 : at, 0, flag);
+            if (bypass && harness === "codex")
+                insert(`CODEX_EXTRA_FLAGS=${shellValue(CODEX_BYPASS)}`, lines.findIndex((line) => line.startsWith("CODEX_HOME=")) + 1 || -1);
+            if (bypass && harness === "claude") {
+                insert(`CLAUDE_EXTRA_FLAGS=${shellValue(CLAUDE_BYPASS)}`, lines.findIndex((line) => line.startsWith("CLAUDE_SETTINGS=")));
+                const settings = join(home, ".agentradar", "config", runnerId, "agentradar-settings.json");
+                const current = JSON.parse(await readFile(settings, "utf8"));
+                await writePrivateFile(settings, `${JSON.stringify({ ...current, skipDangerousModePermissionPrompt: true }, null, 2)}\n`);
+            }
+            // The key on disk first: a state that says approved always has its key.
+            await writePrivateFile(envPath, lines.join("\n"));
+            await writePrivateFile(statePath, JSON.stringify({ ...state, agentId: claimed.agentId, ...(approvedBypass ? { bypassPermissions: true } : {}) }));
+            log("Approved: key claimed, starting the agent.");
+            // Best effort: the feeder syncs them again.
+            await syncJoinedSkills(runnerId, { home, fetch: deps.fetch, log }).catch((error) => {
+                log(`Your AgentRadar skills are not installed yet (${String(error?.message ?? error).split("\n")[0]}); the runner installs them once it is running.`);
+            });
+            return true;
+        }
+        const refusal = claimRefusal(response.status, await failureMessage(response));
+        if (refusal === null) {
+            await sleep(10_000);
+            continue;
+        }
+        return refuse(refusal);
+    }
+    return false;
+}
 /**
  * The Claude conversation that ran `agentradar join`: `--session`, else the CLAUDE_CODE_SESSION_ID Claude Code
  * sets in its shell, else the newest transcript Claude Code keeps for this folder. Never a fresh one.
@@ -702,6 +807,26 @@ async function callerSession(deps, env, home, projectPath) {
  * restarts the service) instead of filing a second request. The key is written only into the 0600 runner
  * env file and is never printed.
  */
+/**
+ * UAT-30 (Vadym 13405): a join names the runtime it runs on. `--runtime claude|codex|other`, else what the shell
+ * itself proves (AGENTRADAR_AGENT_BIN, CLAUDECODE, CODEX_HOME). Nothing is assumed: an unknown or unsupported one is
+ * refused before any request, with the command to run next.
+ */
+export function joinRuntime(flag, env) {
+    const map = { claude: "claude", codex: "codex", other: "generic" };
+    if (flag !== undefined) {
+        const key = flag.trim().toLowerCase();
+        const harness = Object.hasOwn(map, key) ? map[key] : undefined;
+        return harness ? { harness } : { refusal: `Unsupported runtime ${JSON.stringify(flag)}: AgentRadar joins Claude Code (claude), Codex (codex) or another CLI you launch yourself (other). Nothing was requested. Now: run the same command again with --runtime other and AGENTRADAR_AGENT_BIN set to your CLI's command, or ask your company which runtime it expects.` };
+    }
+    if (env.AGENTRADAR_AGENT_BIN?.trim())
+        return { harness: "generic" };
+    if (env.CLAUDECODE)
+        return { harness: "claude" };
+    if (env.CODEX_HOME)
+        return { harness: "codex" };
+    return { refusal: "AgentRadar cannot tell which runtime you run on, so nothing was requested. Now: run the same command again with --runtime claude (Claude Code), --runtime codex (Codex) or --runtime other (any other CLI; set AGENTRADAR_AGENT_BIN to its command first). Use the one that is true for you; do not guess." };
+}
 export async function joinOrganisation(enrolmentUrl, deps = {}) {
     const fetchImpl = deps.fetch ?? fetch;
     const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -783,21 +908,29 @@ export async function joinOrganisation(enrolmentUrl, deps = {}) {
             log(`Your AgentRadar skills are not installed yet (${String(error?.message ?? error).split("\n")[0]}); the runner installs them once it is running.`);
         });
         if (inPlace) {
-            const config = join(home, ".agentradar", "config", runnerId);
             if (approvedBypass)
                 log("Your company allowed bypass-permissions mode; this session keeps the permission mode it already runs in.");
-            log(`Connected, nothing started: your session, its MCPs and its channels are untouched. To receive client messages, restart your agent ONCE with these flags added to its own launch command (keep what it already has, including --continue):
-  --mcp-config ${join(config, "awp-only.json")} --dangerously-load-development-channels server:agentradar --settings ${join(config, "agentradar-settings.json")}
-and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time development-channel prompt when it appears. To stop: agentradar leave ${runnerId}, then drop those flags.`);
+            log(`Connected, nothing started: your session, its MCPs and its channels are untouched. To receive client messages, ${restartInPlace(runnerId)}`);
             return 0;
         }
         try {
-            await (deps.installService ?? ((id) => installAgentService(id, home, env)))(runnerId);
+            await installService(runnerId);
         }
         catch (error) {
             log(`Could not start the service: ${error.message.split("\n")[0]}. Start it by hand with: agentradar runner start ${runnerId}`);
             return 1;
         }
+        return connected(runnerId, projectPath, approvedBypass, bypass);
+    };
+    const restartInPlace = (runnerId) => {
+        const config = join(home, ".agentradar", "config", runnerId);
+        return `restart your agent ONCE with these flags added to its own launch command (keep what it already has, including --continue):
+  --mcp-config ${join(config, "awp-only.json")} --dangerously-load-development-channels server:agentradar --settings ${join(config, "agentradar-settings.json")}
+and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time development-channel prompt when it appears. To stop: agentradar leave ${runnerId}, then drop those flags.`;
+    };
+    const installService = deps.installService ?? ((id) => installAgentService(id, home, env));
+    const connected = (runnerId, projectPath, approvedBypass, bypass) => {
+        const { attach } = where;
         if (attach) {
             log(`Connected. Your welcome and every client message are typed into this session (tmux ${attach}), and you answer here. Nothing else was started. To stop: agentradar leave ${runnerId}`);
             if (approvedBypass)
@@ -858,6 +991,12 @@ and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time develop
         return startJoined(state.requestId, state.agentId, { mcpEndpoint: envValue(saved, "AWP_MCP_URL") ?? mcpEndpoint, bearer }, approvedBypass, bypass);
     }
     if (!state) {
+        // index.ts skips the runtime gate for --revoke-bypass (it edits an earlier join); a NEW join still needs a proven runtime.
+        if (deps.revokeBypass && !deps.harness) {
+            const proven = joinRuntime(undefined, env);
+            if ("refusal" in proven)
+                throw new Error(proven.refusal);
+        }
         const agentName = (deps.agentName ?? process.env.AGENTRADAR_AGENT_NAME ?? basename(cwd)).trim();
         if (!agentName)
             throw new Error("Run join from the agent project folder");
@@ -887,6 +1026,59 @@ and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time develop
     const claimUrl = api(`join-requests/${encodeURIComponent(state.requestId)}/claim-api-key`);
     // Named off the join request, which exists before the key does, so the server can record it at claim.
     const runnerId = `join-${state.requestId}`;
+    {
+        // UAT-17: the service waits for the approval and claims the key (claimPendingJoin); this command only watches.
+        // In place (UAT-17-INPLACE) the service only claims: the user's own launcher runs the session the channel pushes into.
+        const { refused: _retried, ...pending } = state;
+        await writePrivateFile(statePath, JSON.stringify(pending));
+        const projectPath = harness === "claude"
+            ? await installProjectMcp(claudeConfigPath(home, env), cwd, null, deps.trust === true)
+            : await realpath(cwd);
+        // A re-run never rewrites an env the service already holds: it may be writing the claimed key into it right now.
+        const runnerEnv = join(home, ".agentradar", "agents", `${runnerId}.env`);
+        if (!/^(?:AR_JOIN_STATE|AWP_BEARER)=/m.test(await readFile(runnerEnv, "utf8").catch(() => ""))) {
+            await installRunner(home, projectPath, { status: "approved", agentId: "", runnerId, installation: { mcpEndpoint, bearer: "" }, harness }, { sessionId: where.sessionId ?? state.requestId, env, attach: where.attach, inPlace }, channel ? "push" : undefined, { state: statePath, claimUrl: claimUrl.toString() });
+        }
+        let serviced = true;
+        try {
+            await installService(runnerId);
+        }
+        catch (error) {
+            serviced = false;
+            log(`Could not start the service yet (${error.message.split("\n")[0]}); keep this command running until it says Connected.`);
+        }
+        if (serviced) {
+            log(inPlace
+                ? `The AgentRadar service is installed and waits for the approval by itself. Once your company approves, it claims your key, and your welcome arrives in this session through the AgentRadar channel. Your session, its MCPs and its channels are untouched. To receive the welcome and client messages, ${restartInPlace(runnerId)}
+You can restart now or after the approval: until then the channel waits. You do not need to run anything again, and stopping this command is safe.`
+                : `The AgentRadar service is installed and waits for the approval by itself. Once your company approves, it claims your key and delivers your welcome to your agent (${where.attach ? `typed into tmux ${where.attach}` : `tmux session ${runnerId}`}). You do not need to run anything again, and stopping this command is safe.`);
+            for (let poll = 1;; poll++) {
+                const now = await readFile(statePath, "utf8").then((text) => JSON.parse(text), () => ({}));
+                if (now.refused)
+                    throw new Error(now.refused);
+                if (now.agentId) {
+                    log("Approved.");
+                    log(`Runner installed → ${runnerEnv}`);
+                    if (inPlace) {
+                        log("Your key is claimed. Your welcome arrives through the AgentRadar channel once your agent runs with the flags above.");
+                        return 0;
+                    }
+                    const approvedBypass = now.bypassPermissions === true;
+                    const bypass = localBypass(approvedBypass, false);
+                    if (bypass)
+                        log(bypassOnNotice(enrolmentUrl));
+                    return connected(runnerId, projectPath, approvedBypass, bypass);
+                }
+                if (poll > 1 && (poll - 1) % 3 === 0)
+                    log(`Still waiting for your company to approve (${(poll - 1) * 10} s). The service connects you by itself once they do; stopping this command is safe.`);
+                if (poll > (deps.polls ?? Infinity)) {
+                    log("Still waiting for approval. The service connects you by itself once your company approves; you do not need to run anything again.");
+                    return 0;
+                }
+                await sleep(10_000);
+            }
+        }
+    }
     for (let poll = 1;; poll++) {
         if (poll > (deps.polls ?? Infinity)) {
             log(`Still waiting for approval. Run this same command again: agentradar run ${enrolmentUrl}`);
@@ -913,21 +1105,10 @@ and AR_CLI_RUNNER_ID=${runnerId} in its environment. Accept the one-time develop
             const joined = { ...state, agentId: claimed.agentId, ...(approvedBypass ? { bypassPermissions: true } : {}) };
             return startJoined(state.requestId, claimed.agentId, { mcpEndpoint, bearer: claimed.token }, approvedBypass, bypass, () => writePrivateFile(statePath, JSON.stringify(joined)));
         }
-        const said = await failureMessage(response);
-        if (response.status === 409 && said.includes("must be approved")) {
-            await sleep(10_000);
-            continue;
-        }
-        if (response.status === 409 && said.includes("rejected")) {
-            throw new Error("Your company declined this join request. Ask it for a new join link.");
-        }
-        if (response.status === 409 && said.includes("withdrawn")) {
-            throw new Error("This join request was withdrawn (agentradar join cancel). Ask your company for a new join link.");
-        }
-        if (response.status === 409 && /already (?:used|claimed)/.test(said)) {
-            throw new Error("This join link's key was already claimed. A key is issued once and cannot be claimed again; ask your company for a new join link.");
-        }
-        throw new Error(said);
+        const refusal = claimRefusal(response.status, await failureMessage(response));
+        if (refusal !== null)
+            throw new Error(refusal);
+        await sleep(10_000);
     }
 }
 /**
@@ -980,6 +1161,19 @@ export async function cancelJoin(target, deps = {}) {
  * `agentradar leave <runner-id>`: stop and remove the service, end the agent's session, and delete its env
  * file, bearer and config. The folder the agent worked in stays, with the work.
  */
+/** The runner's LaunchAgent / systemd unit, unit file first: stopping it last ends a service that removes itself. */
+export async function removeAgentService(runnerId, deps = {}) {
+    const home = deps.home ?? homedir();
+    const execute = deps.execute ?? ((command, args) => promisify(execFile)(command, args));
+    const label = `com.agentradar.agent.${runnerId}`;
+    if ((deps.platform ?? process.platform) === "darwin") {
+        for (const dir of [join(home, "Library", "LaunchAgents"), join(home, ".agentradar", "staged")])
+            await rm(join(dir, `${label}.plist`), { force: true });
+        await execute("launchctl", ["bootout", `gui/${process.getuid?.()}/${label}`]).catch(() => undefined);
+    }
+    else
+        await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
+}
 export async function leaveOrganisation(runnerId, deps = {}) {
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(runnerId))
         throw new Error("Invalid runner ID");
@@ -993,23 +1187,16 @@ export async function leaveOrganisation(runnerId, deps = {}) {
         return 1;
     }
     const { envValue } = await import("./tool-run.js");
-    if ((deps.platform ?? process.platform) === "darwin") {
-        const label = `com.agentradar.agent.${runnerId}`;
-        await execute("launchctl", ["bootout", `gui/${process.getuid?.()}/${label}`]).catch(() => undefined);
-        await rm(join(home, "Library", "LaunchAgents", `${label}.plist`), { force: true });
-        await rm(join(home, ".agentradar", "staged", `${label}.plist`), { force: true });
-    }
-    else {
-        await execute("systemctl", ["--user", "disable", "--now", `agentradar-agent@${runnerId}`]).catch(() => undefined);
-    }
-    // The service stopping leaves the session running; `=` matches the tmux session name exactly.
-    // An attached pane or an in-place join is the caller's own session: it stays.
-    if (envValue(saved, "AR_ATTACH") !== "1" && envValue(saved, "AR_INPLACE") !== "1")
-        await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
+    // Files first: a service that leaves by itself (a refused join, claimPendingJoin) ends when it is stopped.
     for (const path of [envPath, join(home, ".agentradar", "agents", `${runnerId}.delivered.json`)])
         await rm(path, { force: true });
     for (const dir of ["run", "config", "codex"])
         await rm(join(home, ".agentradar", dir, runnerId), { recursive: true, force: true });
+    await removeAgentService(runnerId, { ...deps, home, execute });
+    // The service stopping leaves the session running; `=` matches the tmux session name exactly.
+    // An attached pane or an in-place join is the caller's own session: it stays.
+    if (envValue(saved, "AR_ATTACH") !== "1" && envValue(saved, "AR_INPLACE") !== "1")
+        await execute(envValue(saved, "TMUX_BIN") ?? "tmux", ["kill-session", "-t", `=${envValue(saved, "TMUX_SESSION") ?? runnerId}`]).catch(() => undefined);
     log(`Left: the service is stopped and removed, and its key is deleted. The folder ${envValue(saved, "AR_BASE") ?? ""} stays, with the work.`);
     return 0;
 }

package/dist/skill-install.js

@@ -1,6 +1,6 @@
 import { chmod, lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { basename, dirname, join } from "node:path";
+import { basename, join } from "node:path";
 import { awpRequest, envValue } from "./tool-run.js";
 const MANAGED_MARK = ".agentradar-managed";
 async function ensureDirectory(path) {
@@ -45,8 +45,8 @@ export async function installVendorSkill(deps = {}) {
 }
 const runnerSkills = () => import(new URL(import.meta.url.endsWith(".ts")
     ? "../../../templates/vendor-runner/feeder.mjs" : "./vendor-runner/feeder.mjs", import.meta.url).href);
-export async function writeManagedSkills(skillsDir, skills) {
-    return (await runnerSkills()).writeManagedSkills(skillsDir, skills);
+export async function writeManagedSkills(skillsDir, skills, runner) {
+    return (await runnerSkills()).writeManagedSkills(skillsDir, skills, runner);
 }
 /**
  * R650 — a joined agent's AgentRadar skills (`my_skills`: the bundled set plus the ones linked to it), written
@@ -54,17 +54,6 @@ export async function writeManagedSkills(skillsDir, skills) {
  * Codex `$CODEX_HOME/skills`. Done here because a session that acts only through `agentradar run` has no
  * feeder; where the service runs, its feeder keeps them current.
  */
-const BRIEF_MARK = "<!-- Written by AgentRadar and replaced on every sync; edits here are lost. -->";
-/** Replaces the file itself, never a symlink's target, and never a file it did not write (a vendor's AGENTS.md). */
-async function writeBrief(file, text) {
-    const current = await lstat(file).catch(() => null);
-    if (current && (!current.isFile() || !(await readFile(file, "utf8")).startsWith(BRIEF_MARK)))
-        return;
-    await mkdir(dirname(file), { recursive: true });
-    const temporary = `${file}.${randomUUID()}.tmp`;
-    await writeFile(temporary, `${BRIEF_MARK}\n${text.trim()}\n`);
-    await rename(temporary, file);
-}
 /** Where each CLI reads skills. The same table as templates/vendor-runner/feeder.mjs; skill-install.test.ts pins them equal. */
 export const SKILL_DIRS = {
     claude: "$AR_BASE/.claude/skills",
@@ -89,23 +78,24 @@ export async function syncJoinedSkills(runnerId, deps) {
     const skillsDir = skillsDirFor(harness, (name) => name === "HOME" ? deps.home : value(name));
     if (!skillsDir)
         return;
-    const codex = harness === "codex";
-    const root = (codex ? value("CODEX_HOME") : value("AR_BASE")) ?? "";
+    const runner = value("AR_CLI_RUNNER_ID") ?? undefined;
     // Vadym 9988: the server's start instructions with this agent's brief, before its first session starts.
     // Same file and mark as the runner's feeder, which keeps it fresh from then on.
     const init = await awpRequest(runnerId, "initialize", {
         protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "agentradar-cli", version: "1.0.0" },
-    }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
-    const briefFile = codex ? join(root, "AGENTS.md") : join(root, ".claude", "rules", "agentradar-brief.md");
-    if (root && init?.result?.instructions)
-        await writeBrief(briefFile, init.result.instructions);
-    const have = (await runnerSkills()).heldSkillZips(skillsDir);
-    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: { have } }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync" });
+    }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync", signal: deps.signal });
+    // The feeder's own brief path and writer: one file per runner (MULTI-ORG-PUSH §0).
+    const skills = await runnerSkills();
+    const briefFile = skills.briefFileFor(harness ?? "claude", { AR_BASE: value("AR_BASE") ?? undefined, CODEX_HOME: value("CODEX_HOME") ?? undefined, AR_CLI_RUNNER_ID: runner });
+    if (briefFile && init?.result?.instructions)
+        skills.writeBrief(briefFile, init.result.instructions);
+    const have = skills.heldSkillZips(skillsDir);
+    const body = await awpRequest(runnerId, "tools/call", { name: "my_skills", arguments: { have } }, { home: deps.home, fetch: deps.fetch, logError: deps.log, surface: "skill-sync", signal: deps.signal });
     const text = body?.result?.content?.find((c) => c.type === "text")?.text;
     const answer = (text ? JSON.parse(text) : {});
     if (!answer.ok || !Array.isArray(answer.skills))
         throw new Error("AgentRadar did not return your skills");
-    const written = await writeManagedSkills(skillsDir, answer.skills);
+    const written = await writeManagedSkills(skillsDir, answer.skills, runner);
     deps.log(`Installed ${written.length} AgentRadar skill(s) in ${skillsDir}.`);
 }
 //# sourceMappingURL=skill-install.js.map