ai-agent-detect 0.0.1 → 0.2.0

package/README.md

@@ -1,22 +1,83 @@
 # ai-agent-detect
 
-Detect which AI agent is running your code — structured identity and capabilities.
+Detect which AI agent is running your code — structured identity, not just a boolean.
 
-**Status: name claimed, v0 in development.** This package does not do anything useful yet.
+**Status: early but real.** 25 agents in the registry, every signal evidence-tiered and fixture-tested (82 tests); the API may still shift before `1.0`.
 
-## What it will be
+```js
+import { detect, isAgent } from 'ai-agent-detect';
 
-Runtime identification for the agentic era — `isatty()` had fifty years; agents are the third consumer class:
+isAgent();               // boolean — the new isatty()
+isAgent('claude-code');  // assert style: am I running under this one?
 
-- **Structured identity**: `{ name, version, mode, source, confidence }` — parsed, not a raw string. Reads the `AI_AGENT` environment variable standard, the `AGENT` convention (Goose, Amp), and vendor tells (`CLAUDECODE=1`, …).
-- **Signals beyond env vars**: parent-process-tree walking (detect the agent ancestor even with a stripped environment), TTY state (interactive vs headless).
-- **Capability detection**: not just *which* agent, but what it honors — which context files it reads, which skill directories it discovers.
-- **Adaptive-output helpers**: `isAgent()` as the new `isatty()` — emit agent-optimized output when your consumer is an agent.
+detect();
+// {
+//   name: 'claude-code', vendor: 'anthropic',
+//   version: '2.1.205', mode: 'agent',
+//   source: 'env:AI_AGENT', confidence: 'high', corroborated: true,
+//   raw: { AI_AGENT: 'claude-code_2-1-205_agent', CLAUDECODE: '1', ... },
+//   claims: [ ... ]      // every claim the env carries — see below
+// }
+```
 
-## Relationship to `detect-agent`
+## Why claims, not a single winner
 
-[`detect-agent`](https://www.npmjs.com/package/detect-agent) (Vercel) answers the boolean question — *is* this an agent environment, and its name — via declarative rules. This package aims one level up: structured identity, richer signals than env/file existence checks can express, and capabilities. It will consume the `agents.json` definitions as a compatibility tier.
+Agents run agents. A grok session spawned inside a Claude Code session passes the inherited `AI_AGENT` through to its children (live-probed) — environment variables cannot tell you which *layer* set them. So `detect()` reports **every claim** the env carries and never silently picks between conflicting ones. The env cannot order nesting layers, so `claims[]` doesn't pretend to; genuine stack ordering (via process-tree walk) is `detectDeep()`'s job — planned, `ai-agent-detect/node` subpath.
 
-## Alias
+Every claim carries its evidence: `source` (which signal matched), `raw` (the matched variables), `confidence`. Apply your own trust policy instead of inheriting ours.
+
+## What it reads
+
+1. **`AI_AGENT`** — both value dialects in the wild: `name@version` (Vercel's spec: `devin@1`) and `name_version_mode` (Anthropic ships `claude-code_2-1-205_agent`).
+2. **`AGENT`** — the older convention, value-split: `AGENT=goose` names the agent; `AGENT=1` (opencode) proves agenthood without naming it — `isAgent()` true, every assert form false.
+3. **Vendor tells** — per-agent detector functions. Code, not a condition engine: the claude-code detector recovers the version from `CLAUDE_CODE_EXECPATH` when `AI_AGENT` is stripped; no declarative rule format can express that.
+
+## Supported agents
+
+Evidence tiers: **probed** (live env snapshot recorded by us) > **source** (read in the agent's source code) > **doc** (vendor documentation) > **community** (reports) > **vercel-rules** (adopted from detect-agent's rules, not independently verified).
+
+| agent | signal | evidence |
+|---|---|---|
+| claude-code | `AI_AGENT` triple, `CLAUDECODE=1`, version via `CLAUDE_CODE_EXECPATH` | probed |
+| grok | **none** — no identity var; passes inherited `AI_AGENT` through | probed |
+| gemini-cli | `GEMINI_CLI=1` (deliberate, documented) | source+doc |
+| qwen-code | `QWEN_CODE=1` + session-id family (fork renamed Gemini's flag) | source |
+| opencode | `OPENCODE=1`, `AGENT=1`, `OPENCODE_PID` | source |
+| kilo | `KILO=1`, `KILO_CLIENT`, **version via `KILOCODE_VERSION`** (+ fork-parent `OPENCODE=1`, `AGENT=1`) | source |
+| codex | sandbox side effects only (`CODEX_SANDBOX*`); **nothing under `danger-full-access`** | source |
+| goose | `AGENT=goose` + `GOOSE_TERMINAL=1` — on two of three execution paths only | source |
+| cline | `CLINE_ACTIVE=true` — VS Code terminals only | source |
+| roo | `ROO_ACTIVE=true` (terminals), `ROO_CLI_RUNTIME=1` (headless) | source |
+| aider | `OR_APP_NAME=Aider` + `OR_SITE_URL` (accidental fingerprint) | source |
+| openhands | sandbox furniture: `OH_*` vars, `PS1` markers | source |
+| crush | **none** — sets no identity variable | source |
+| continue | **none** — sets no identity variable | source |
+| github-copilot | `COPILOT_CLI=1` (documented), `COPILOT_AGENT_SESSION_ID`; `AI_AGENT=github-copilot(-cli)` | doc |
+| amp | `AGENT=amp` (reported, unverified) | community |
+| cursor | `CURSOR_AGENT=1`, `CURSOR_TRACE_ID`, `CURSOR_EXTENSION_HOST_ROLE` | community |
+| antigravity | `ANTIGRAVITY_AGENT` | vercel-rules |
+| augment | `AUGMENT_AGENT` | vercel-rules |
+| cowork | `CLAUDE_CODE_IS_COWORK` atop claude-code vars | vercel-rules |
+| junie | `JUNIE_DATA` / `JUNIE_SHIM_PATH` | vercel-rules |
+| kiro | `TERM_PROGRAM~kiro` (low confidence — ambience, not identity) | vercel-rules |
+| pi | PATH contains `.pi/agent` (low confidence) | vercel-rules |
+| replit | `REPL_ID` (environment marker, not agent-specific) | vercel-rules |
+| devin | file tell only (`/opt/.devin`) — outside the env core, planned for `/node` | vercel-rules |
+
+The no-signal entries (grok, crush, continue; codex under `danger-full-access`) are deliberate: an agent that cannot be detected from env is recorded as such — honesty over reach. Any agent that sets `AI_AGENT` or a name-valued `AGENT` is detected without a registry entry. Coverage caveats (goose's per-path signals, cline's terminal-only marker) live as comments in each detector and in the fixtures.
+
+## Design
+
+- **Zero runtime dependencies**, ESM, Node ≥ 18.
+- **Edge-safe core**: no `node:` imports; env access is guarded (`globalThis.process?.env`), so Workers/Deno/Bun run it and env-less runtimes return `null`. Anything runtime-specific will live behind subpath exports.
+- **Sync and cheap**: no spawn, no disk, no network. `process.env` is copied once per process (it's a proxy — see `bench.js`); `detect()` ≈ 0.5µs, `isAgent(name)` short-circuits at ≈ 0.15µs.
+- **Fixtures are the ground truth**: every registry entry ships a recorded env snapshot with probe date and method (`fixtures/`). The test matrix runs every fixture against every detector — no false positives is as tested as no false negatives.
+
+## Contributing an agent
+
+One folder, one fixture, one PR:
+
+1. `agents/<name>/index.js` — `{ name, vendor, procNames, pidEnvVar, detect(env) }`, registered in `agents/index.js` (alphabetical).
+2. `fixtures/<name>.json` — a recorded env snapshot from a live session (probe date + method required; the matrix test fails any entry without one).
+3. `npm test`.
 
-`agent-detect` is held as an alias of this package.

package/agents/aider/index.js

@@ -0,0 +1,15 @@
+// aider — evidence, tiers, and probe TODOs: .kanbento/harnesses/aider.md
+// Accidental fingerprint (OpenRouter attribution vars) — confidence capped at medium.
+export default {
+  name: 'aider',
+  vendor: 'aider',
+  procNames: ['aider'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.OR_APP_NAME === 'Aider') raw.OR_APP_NAME = env.OR_APP_NAME;
+    if (env.OR_SITE_URL?.includes('aider.chat')) raw.OR_SITE_URL = env.OR_SITE_URL;
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/amp/index.js

@@ -0,0 +1,11 @@
+// amp — evidence, tiers, and probe TODOs: .kanbento/harnesses/amp.md
+// AGENT=amp is generic (core rung 2); no vendor var exists — this detector never fires.
+export default {
+  name: 'amp',
+  vendor: 'sourcegraph',
+  procNames: ['amp'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/antigravity/index.js

@@ -0,0 +1,11 @@
+// antigravity — evidence, tiers, and probe TODOs: .kanbento/harnesses/antigravity.md
+export default {
+  name: 'antigravity',
+  vendor: 'google',
+  procNames: ['antigravity'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.ANTIGRAVITY_AGENT) return null;
+    return { confidence: 'medium', raw: { ANTIGRAVITY_AGENT: env.ANTIGRAVITY_AGENT } };
+  },
+};

package/agents/augment/index.js

@@ -0,0 +1,11 @@
+// augment — evidence, tiers, and probe TODOs: .kanbento/harnesses/augment.md
+export default {
+  name: 'augment',
+  vendor: 'augment',
+  procNames: ['auggie'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.AUGMENT_AGENT) return null;
+    return { confidence: 'medium', raw: { AUGMENT_AGENT: env.AUGMENT_AGENT } };
+  },
+};

package/agents/claude-code/index.js

@@ -0,0 +1,24 @@
+// claude-code — evidence, tiers, and probe TODOs: .kanbento/harnesses/claude-code.md
+export default {
+  name: 'claude-code',
+  vendor: 'anthropic',
+  procNames: ['claude'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.CLAUDECODE !== '1' && !env.CLAUDE_CODE) return null;
+    // agents/cowork owns the marked case (specificity wins)
+    if (env.CLAUDE_CODE_IS_COWORK) return null;
+    const raw = {};
+    for (const key of [
+      'CLAUDECODE',
+      'CLAUDE_CODE_ENTRYPOINT',
+      'CLAUDE_CODE_EXECPATH',
+      'CLAUDE_CODE_CHILD_SESSION',
+    ]) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    // richer than a condition engine: the exec path carries the version
+    const version = env.CLAUDE_CODE_EXECPATH?.match(/\/versions\/(\d[\d.]*)/)?.[1] ?? null;
+    return { confidence: 'high', version, raw };
+  },
+};

package/agents/cline/index.js

@@ -0,0 +1,12 @@
+// cline — evidence, tiers, and probe TODOs: .kanbento/harnesses/cline.md
+// Marker exists on VS Code integrated terminals only — absence proves nothing.
+export default {
+  name: 'cline',
+  vendor: 'cline',
+  procNames: ['cline'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.CLINE_ACTIVE !== 'true') return null;
+    return { confidence: 'high', raw: { CLINE_ACTIVE: env.CLINE_ACTIVE } };
+  },
+};

package/agents/codex/index.js

@@ -0,0 +1,19 @@
+// codex — evidence, tiers, and probe TODOs: .kanbento/harnesses/codex.md
+// No marker under danger-full-access; CODEX_SANDBOX is macOS-only.
+export default {
+  name: 'codex',
+  vendor: 'openai',
+  procNames: ['codex'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.CODEX_SANDBOX_NETWORK_DISABLED === '1') raw.CODEX_SANDBOX_NETWORK_DISABLED = env.CODEX_SANDBOX_NETWORK_DISABLED;
+    if (env.CODEX_SANDBOX) raw.CODEX_SANDBOX = env.CODEX_SANDBOX;
+    // CODEX_CI / CODEX_THREAD_ID: vercel-rules tier, hence the medium below
+    if (env.CODEX_CI) raw.CODEX_CI = env.CODEX_CI;
+    if (env.CODEX_THREAD_ID) raw.CODEX_THREAD_ID = env.CODEX_THREAD_ID;
+    if (Object.keys(raw).length === 0) return null;
+    const sourceConfirmed = raw.CODEX_SANDBOX_NETWORK_DISABLED || raw.CODEX_SANDBOX;
+    return { confidence: sourceConfirmed ? 'high' : 'medium', raw };
+  },
+};

package/agents/continue/index.js

@@ -0,0 +1,11 @@
+// continue — evidence, tiers, and probe TODOs: .kanbento/harnesses/continue.md
+// No env signal exists — this detector never fires.
+export default {
+  name: 'continue',
+  vendor: 'continue',
+  procNames: ['cn'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/cowork/index.js

@@ -0,0 +1,16 @@
+// cowork — evidence, tiers, and probe TODOs: .kanbento/harnesses/cowork.md
+// Runs Claude Code underneath; the claude-code detector defers when the marker is set.
+export default {
+  name: 'cowork',
+  vendor: 'anthropic',
+  procNames: [],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.CLAUDE_CODE_IS_COWORK) return null;
+    if (env.CLAUDECODE !== '1' && !env.CLAUDE_CODE) return null;
+    const raw = { CLAUDE_CODE_IS_COWORK: env.CLAUDE_CODE_IS_COWORK };
+    if (env.CLAUDECODE !== undefined) raw.CLAUDECODE = env.CLAUDECODE;
+    if (env.CLAUDE_CODE !== undefined) raw.CLAUDE_CODE = env.CLAUDE_CODE;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/crush/index.js

@@ -0,0 +1,11 @@
+// crush — evidence, tiers, and probe TODOs: .kanbento/harnesses/crush.md
+// No env signal exists — this detector never fires.
+export default {
+  name: 'crush',
+  vendor: 'charm',
+  procNames: ['crush'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/cursor/index.js

@@ -0,0 +1,19 @@
+// cursor — evidence, tiers, and probe TODOs: .kanbento/harnesses/cursor.md
+// All tells are community-tier (none on an official reference page).
+export default {
+  name: 'cursor',
+  vendor: 'anysphere',
+  procNames: ['cursor-agent', 'agent'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    for (const key of ['CURSOR_AGENT', 'CURSOR_TRACE_ID', 'CURSOR_CLI', 'CURSOR_EXTENSION_HOST_ROLE']) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    if (env.CURSOR_AGENT === '1') return { confidence: 'high', raw };
+    // vercel-rules tier (detect-agent@1.0.1): the CLI in extension-host mode
+    if (env.CURSOR_EXTENSION_HOST_ROLE === 'agent-exec') return { confidence: 'high', raw };
+    if (env.CURSOR_TRACE_ID) return { confidence: 'medium', raw };
+    return null;
+  },
+};

package/agents/devin/index.js

@@ -0,0 +1,12 @@
+// devin — evidence, tiers, and probe TODOs: .kanbento/harnesses/devin.md
+// Only tell is a file check (/opt/.devin) — outside the env core; never fires here.
+export default {
+  name: 'devin',
+  vendor: 'cognition',
+  procNames: [],
+  pidEnvVar: null,
+  filesTells: ['/opt/.devin'],
+  detect() {
+    return null;
+  },
+};

package/agents/gemini-cli/index.js

@@ -0,0 +1,11 @@
+// gemini-cli — evidence, tiers, and probe TODOs: .kanbento/harnesses/gemini-cli.md
+export default {
+  name: 'gemini-cli',
+  vendor: 'google',
+  procNames: ['gemini'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.GEMINI_CLI !== '1') return null;
+    return { confidence: 'high', raw: { GEMINI_CLI: env.GEMINI_CLI } };
+  },
+};

package/agents/github-copilot/index.js

@@ -0,0 +1,20 @@
+// github-copilot — evidence, tiers, and probe TODOs: .kanbento/harnesses/github-copilot.md
+// COPILOT_CLI=1 is vendor-documented; the COPILOT_MODEL trio is an unverified fallback.
+export default {
+  name: 'github-copilot',
+  vendor: 'github',
+  procNames: ['copilot'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.COPILOT_CLI === '1') raw.COPILOT_CLI = env.COPILOT_CLI;
+    if (env.COPILOT_AGENT_SESSION_ID) raw.COPILOT_AGENT_SESSION_ID = env.COPILOT_AGENT_SESSION_ID;
+    if (Object.keys(raw).length > 0) return { confidence: 'high', raw };
+    // vercel-rules tier, unverified in vendor sources
+    for (const key of ['COPILOT_MODEL', 'COPILOT_ALLOW_ALL', 'COPILOT_GITHUB_TOKEN']) {
+      if (env[key]) raw[key] = env[key];
+    }
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/goose/index.js

@@ -0,0 +1,14 @@
+// goose — evidence, tiers, and probe TODOs: .kanbento/harnesses/goose.md
+// Vars set on two of three execution paths — absence proves nothing.
+export default {
+  name: 'goose',
+  vendor: 'block',
+  procNames: ['goose'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.GOOSE_TERMINAL !== '1') return null;
+    const raw = { GOOSE_TERMINAL: env.GOOSE_TERMINAL };
+    if (env.AGENT_SESSION_ID) raw.AGENT_SESSION_ID = env.AGENT_SESSION_ID;
+    return { confidence: 'high', raw };
+  },
+};

package/agents/grok/index.js

@@ -0,0 +1,13 @@
+// grok — evidence, tiers, and probe TODOs: .kanbento/harnesses/grok.md
+// No identity var (probed) — this detector never fires.
+export default {
+  name: 'grok',
+  vendor: 'xai',
+  // binary is literally `agent` (~/.grok/bin/agent) — generic name; the ppid
+  // rung must corroborate via the executable path, not the name alone
+  procNames: ['agent'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/index.js

@@ -0,0 +1,54 @@
+// One agent = one folder = one easy PR. Keep alphabetical.
+import aider from './aider/index.js';
+import amp from './amp/index.js';
+import antigravity from './antigravity/index.js';
+import augment from './augment/index.js';
+import claudeCode from './claude-code/index.js';
+import cline from './cline/index.js';
+import codex from './codex/index.js';
+import continueDev from './continue/index.js';
+import cowork from './cowork/index.js';
+import crush from './crush/index.js';
+import cursor from './cursor/index.js';
+import devin from './devin/index.js';
+import geminiCli from './gemini-cli/index.js';
+import githubCopilot from './github-copilot/index.js';
+import goose from './goose/index.js';
+import grok from './grok/index.js';
+import junie from './junie/index.js';
+import kilo from './kilo/index.js';
+import kiro from './kiro/index.js';
+import opencode from './opencode/index.js';
+import openhands from './openhands/index.js';
+import pi from './pi/index.js';
+import qwenCode from './qwen-code/index.js';
+import replit from './replit/index.js';
+import roo from './roo/index.js';
+
+export const agents = [
+  aider,
+  amp,
+  antigravity,
+  augment,
+  claudeCode,
+  cline,
+  codex,
+  continueDev,
+  cowork,
+  crush,
+  cursor,
+  devin,
+  geminiCli,
+  githubCopilot,
+  goose,
+  grok,
+  junie,
+  kilo,
+  kiro,
+  opencode,
+  openhands,
+  pi,
+  qwenCode,
+  replit,
+  roo,
+];

package/agents/junie/index.js

@@ -0,0 +1,14 @@
+// junie — evidence, tiers, and probe TODOs: .kanbento/harnesses/junie.md
+export default {
+  name: 'junie',
+  vendor: 'jetbrains',
+  procNames: ['junie'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.JUNIE_DATA) raw.JUNIE_DATA = env.JUNIE_DATA;
+    if (env.JUNIE_SHIM_PATH) raw.JUNIE_SHIM_PATH = env.JUNIE_SHIM_PATH;
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/kilo/index.js

@@ -0,0 +1,17 @@
+// kilo — evidence, tiers, and probe TODOs: .kanbento/harnesses/kilo.md
+// opencode fork: both detectors fire by design (claims[] represents it; kilo wins by order).
+export default {
+  name: 'kilo',
+  vendor: 'kilo-org',
+  procNames: ['kilo'],
+  pidEnvVar: 'KILO_PID',
+  detect(env) {
+    const raw = {};
+    for (const key of ['KILO', 'KILO_CLIENT', 'KILO_PLATFORM', 'KILOCODE_FEATURE', 'KILOCODE_VERSION', 'KILO_APP_VERSION', 'KILO_PID']) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    if (env.KILO !== '1' && !env.KILO_CLIENT && !env.KILOCODE_FEATURE) return null;
+    const version = env.KILOCODE_VERSION || env.KILO_APP_VERSION || null;
+    return { confidence: 'high', version, raw };
+  },
+};

package/agents/kiro/index.js

@@ -0,0 +1,12 @@
+// kiro — evidence, tiers, and probe TODOs: .kanbento/harnesses/kiro.md
+// TERM_PROGRAM is ambience, not identity (their TTY gate is impossible env-only) — low.
+export default {
+  name: 'kiro',
+  vendor: 'aws',
+  procNames: ['kiro'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.TERM_PROGRAM || !env.TERM_PROGRAM.includes('kiro')) return null;
+    return { confidence: 'low', raw: { TERM_PROGRAM: env.TERM_PROGRAM } };
+  },
+};

package/agents/opencode/index.js

@@ -0,0 +1,16 @@
+// opencode — evidence, tiers, and probe TODOs: .kanbento/harnesses/opencode.md
+export default {
+  name: 'opencode',
+  vendor: 'anomaly',
+  procNames: ['opencode'],
+  pidEnvVar: 'OPENCODE_PID',
+  detect(env) {
+    // OPENCODE_CLIENT is the vercel-rules-tier sibling (detect-agent@1.0.1)
+    if (env.OPENCODE !== '1' && !env.OPENCODE_CLIENT) return null;
+    const raw = {};
+    for (const key of ['OPENCODE', 'OPENCODE_CLIENT', 'OPENCODE_PID']) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    return { confidence: 'high', raw };
+  },
+};

package/agents/openhands/index.js

@@ -0,0 +1,17 @@
+// openhands — evidence, tiers, and probe TODOs: .kanbento/harnesses/openhands.md
+// Sandbox-furniture fingerprint, not a deliberate marker — medium.
+export default {
+  name: 'openhands',
+  vendor: 'all-hands',
+  procNames: [],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    for (const key of ['OH_CONVERSATIONS_PATH', 'OH_BASH_EVENTS_DIR', 'OPENVSCODE_SERVER_ROOT']) {
+      if (env[key]) raw[key] = env[key];
+    }
+    if (env.PS1?.includes('###PS1JSON###')) raw.PS1 = '<contains ###PS1JSON### marker>';
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/pi/index.js

@@ -0,0 +1,12 @@
+// pi — evidence, tiers, and probe TODOs: .kanbento/harnesses/pi.md
+// PATH fingerprint — weak-signal class, low.
+export default {
+  name: 'pi',
+  vendor: null,
+  procNames: ['pi'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.PATH || !/\.pi[\\/]agent/.test(env.PATH)) return null;
+    return { confidence: 'low', raw: { PATH: '<contains .pi/agent>' } };
+  },
+};

package/agents/qwen-code/index.js

@@ -0,0 +1,15 @@
+// qwen-code — evidence, tiers, and probe TODOs: .kanbento/harnesses/qwen-code.md
+export default {
+  name: 'qwen-code',
+  vendor: 'alibaba',
+  procNames: ['qwen'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.QWEN_CODE !== '1') return null;
+    const raw = { QWEN_CODE: env.QWEN_CODE };
+    for (const key of ['QWEN_CODE_SESSION_ID', 'QWEN_CODE_AGENT_ID', 'QWEN_CODE_PROMPT_ID']) {
+      if (env[key]) raw[key] = env[key];
+    }
+    return { confidence: 'high', raw };
+  },
+};

package/agents/replit/index.js

@@ -0,0 +1,12 @@
+// replit — evidence, tiers, and probe TODOs: .kanbento/harnesses/replit.md
+// REPL_ID marks the Replit platform, not agent operation — medium.
+export default {
+  name: 'replit',
+  vendor: 'replit',
+  procNames: [],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.REPL_ID) return null;
+    return { confidence: 'medium', raw: { REPL_ID: env.REPL_ID } };
+  },
+};

package/agents/roo/index.js

@@ -0,0 +1,16 @@
+// roo — evidence, tiers, and probe TODOs: .kanbento/harnesses/roo.md
+// The execa inline provider sets neither var — absence proves nothing.
+export default {
+  name: 'roo',
+  vendor: 'roo-code',
+  procNames: ['roo'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.ROO_ACTIVE === 'true') raw.ROO_ACTIVE = env.ROO_ACTIVE;
+    if (env.ROO_CLI_RUNTIME === '1') raw.ROO_CLI_RUNTIME = env.ROO_CLI_RUNTIME;
+    if (Object.keys(raw).length === 0) return null;
+    const mode = raw.ROO_CLI_RUNTIME ? 'agent' : null;
+    return { confidence: 'high', mode, raw };
+  },
+};

package/fixtures/aider.json

@@ -0,0 +1,21 @@
+{
+  "agent": "aider",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: aider/llm.py:9-13 \u2014 OpenRouter attribution vars set at import, inherited by every /run child; accidental fingerprint, not identity by intent",
+      "tier": "source",
+      "env": {
+        "OR_SITE_URL": "https://aider.chat",
+        "OR_APP_NAME": "Aider"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "aider",
+        "claimNames": [
+          "aider"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/amp.json

@@ -0,0 +1,14 @@
+{
+  "agent": "amp",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "community-derived: agents.md adoption table (issues/136) lists amp as setting AGENT=amp — not in the official manual, unverified in source; identity arrives via the generic AGENT rung, no vendor detector",
+      "tier": "community",
+      "env": {
+        "AGENT": "amp"
+      },
+      "expect": { "isAgent": true, "primary": "amp", "claimNames": ["amp"] }
+    }
+  ]
+}

package/fixtures/antigravity.json

@@ -0,0 +1,20 @@
+{
+  "agent": "antigravity",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified)",
+      "tier": "vercel-rules",
+      "env": {
+        "ANTIGRAVITY_AGENT": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "antigravity",
+        "claimNames": [
+          "antigravity"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/augment.json

@@ -0,0 +1,20 @@
+{
+  "agent": "augment",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified)",
+      "tier": "vercel-rules",
+      "env": {
+        "AUGMENT_AGENT": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "augment",
+        "claimNames": [
+          "augment"
+        ]
+      }
+    }
+  ]
+}