ai-agent-detect 0.1.0 → 0.2.0

package/README.md

@@ -2,7 +2,7 @@
 
 Detect which AI agent is running your code — structured identity, not just a boolean.
 
-**Status: working prototype.** The code runs (19 tests, 2 live-probed agents); the API may still shift before `0.1.0`.
+**Status: early but real.** 25 agents in the registry, every signal evidence-tiered and fixture-tested (82 tests); the API may still shift before `1.0`.
 
 ```js
 import { detect, isAgent } from 'ai-agent-detect';
@@ -34,12 +34,37 @@ Every claim carries its evidence: `source` (which signal matched), `raw` (the ma
 
 ## Supported agents
 
-| agent | signals | evidence |
-|---|---|---|
-| claude-code | `AI_AGENT` triple, `CLAUDECODE=1`, version via `CLAUDE_CODE_EXECPATH` | live-probed 2026-07-12 |
-| grok | **none** — sets no identity variable (and passes inherited `AI_AGENT` through) | live-probed 2026-07-12 |
+Evidence tiers: **probed** (live env snapshot recorded by us) > **source** (read in the agent's source code) > **doc** (vendor documentation) > **community** (reports) > **vercel-rules** (adopted from detect-agent's rules, not independently verified).
 
-grok's entry is deliberate: an agent that cannot be detected from env is recorded as such — honesty over reach. Any agent that sets `AI_AGENT` or a name-valued `AGENT` is detected without a registry entry.
+| agent | signal | evidence |
+|---|---|---|
+| claude-code | `AI_AGENT` triple, `CLAUDECODE=1`, version via `CLAUDE_CODE_EXECPATH` | probed |
+| grok | **none** — no identity var; passes inherited `AI_AGENT` through | probed |
+| gemini-cli | `GEMINI_CLI=1` (deliberate, documented) | source+doc |
+| qwen-code | `QWEN_CODE=1` + session-id family (fork renamed Gemini's flag) | source |
+| opencode | `OPENCODE=1`, `AGENT=1`, `OPENCODE_PID` | source |
+| kilo | `KILO=1`, `KILO_CLIENT`, **version via `KILOCODE_VERSION`** (+ fork-parent `OPENCODE=1`, `AGENT=1`) | source |
+| codex | sandbox side effects only (`CODEX_SANDBOX*`); **nothing under `danger-full-access`** | source |
+| goose | `AGENT=goose` + `GOOSE_TERMINAL=1` — on two of three execution paths only | source |
+| cline | `CLINE_ACTIVE=true` — VS Code terminals only | source |
+| roo | `ROO_ACTIVE=true` (terminals), `ROO_CLI_RUNTIME=1` (headless) | source |
+| aider | `OR_APP_NAME=Aider` + `OR_SITE_URL` (accidental fingerprint) | source |
+| openhands | sandbox furniture: `OH_*` vars, `PS1` markers | source |
+| crush | **none** — sets no identity variable | source |
+| continue | **none** — sets no identity variable | source |
+| github-copilot | `COPILOT_CLI=1` (documented), `COPILOT_AGENT_SESSION_ID`; `AI_AGENT=github-copilot(-cli)` | doc |
+| amp | `AGENT=amp` (reported, unverified) | community |
+| cursor | `CURSOR_AGENT=1`, `CURSOR_TRACE_ID`, `CURSOR_EXTENSION_HOST_ROLE` | community |
+| antigravity | `ANTIGRAVITY_AGENT` | vercel-rules |
+| augment | `AUGMENT_AGENT` | vercel-rules |
+| cowork | `CLAUDE_CODE_IS_COWORK` atop claude-code vars | vercel-rules |
+| junie | `JUNIE_DATA` / `JUNIE_SHIM_PATH` | vercel-rules |
+| kiro | `TERM_PROGRAM~kiro` (low confidence — ambience, not identity) | vercel-rules |
+| pi | PATH contains `.pi/agent` (low confidence) | vercel-rules |
+| replit | `REPL_ID` (environment marker, not agent-specific) | vercel-rules |
+| devin | file tell only (`/opt/.devin`) — outside the env core, planned for `/node` | vercel-rules |
+
+The no-signal entries (grok, crush, continue; codex under `danger-full-access`) are deliberate: an agent that cannot be detected from env is recorded as such — honesty over reach. Any agent that sets `AI_AGENT` or a name-valued `AGENT` is detected without a registry entry. Coverage caveats (goose's per-path signals, cline's terminal-only marker) live as comments in each detector and in the fixtures.
 
 ## Design
 

package/agents/aider/index.js

@@ -0,0 +1,15 @@
+// aider — evidence, tiers, and probe TODOs: .kanbento/harnesses/aider.md
+// Accidental fingerprint (OpenRouter attribution vars) — confidence capped at medium.
+export default {
+  name: 'aider',
+  vendor: 'aider',
+  procNames: ['aider'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.OR_APP_NAME === 'Aider') raw.OR_APP_NAME = env.OR_APP_NAME;
+    if (env.OR_SITE_URL?.includes('aider.chat')) raw.OR_SITE_URL = env.OR_SITE_URL;
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/amp/index.js

@@ -0,0 +1,11 @@
+// amp — evidence, tiers, and probe TODOs: .kanbento/harnesses/amp.md
+// AGENT=amp is generic (core rung 2); no vendor var exists — this detector never fires.
+export default {
+  name: 'amp',
+  vendor: 'sourcegraph',
+  procNames: ['amp'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/antigravity/index.js

@@ -0,0 +1,11 @@
+// antigravity — evidence, tiers, and probe TODOs: .kanbento/harnesses/antigravity.md
+export default {
+  name: 'antigravity',
+  vendor: 'google',
+  procNames: ['antigravity'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.ANTIGRAVITY_AGENT) return null;
+    return { confidence: 'medium', raw: { ANTIGRAVITY_AGENT: env.ANTIGRAVITY_AGENT } };
+  },
+};

package/agents/augment/index.js

@@ -0,0 +1,11 @@
+// augment — evidence, tiers, and probe TODOs: .kanbento/harnesses/augment.md
+export default {
+  name: 'augment',
+  vendor: 'augment',
+  procNames: ['auggie'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.AUGMENT_AGENT) return null;
+    return { confidence: 'medium', raw: { AUGMENT_AGENT: env.AUGMENT_AGENT } };
+  },
+};

package/agents/claude-code/index.js

@@ -1,13 +1,13 @@
-// claude-code (Anthropic) — probed 2026-07-12 (see .kanbento/harnesses/claude-code.md).
-// Sets the full AI_AGENT triple (handled by core rung 1); this detector owns
-// the vendor tells, which also work when AI_AGENT is stripped or inherited-over.
+// claude-code — evidence, tiers, and probe TODOs: .kanbento/harnesses/claude-code.md
 export default {
   name: 'claude-code',
   vendor: 'anthropic',
   procNames: ['claude'],
   pidEnvVar: null,
   detect(env) {
-    if (env.CLAUDECODE !== '1') return null;
+    if (env.CLAUDECODE !== '1' && !env.CLAUDE_CODE) return null;
+    // agents/cowork owns the marked case (specificity wins)
+    if (env.CLAUDE_CODE_IS_COWORK) return null;
     const raw = {};
     for (const key of [
       'CLAUDECODE',

package/agents/cline/index.js

@@ -0,0 +1,12 @@
+// cline — evidence, tiers, and probe TODOs: .kanbento/harnesses/cline.md
+// Marker exists on VS Code integrated terminals only — absence proves nothing.
+export default {
+  name: 'cline',
+  vendor: 'cline',
+  procNames: ['cline'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.CLINE_ACTIVE !== 'true') return null;
+    return { confidence: 'high', raw: { CLINE_ACTIVE: env.CLINE_ACTIVE } };
+  },
+};

package/agents/codex/index.js

@@ -0,0 +1,19 @@
+// codex — evidence, tiers, and probe TODOs: .kanbento/harnesses/codex.md
+// No marker under danger-full-access; CODEX_SANDBOX is macOS-only.
+export default {
+  name: 'codex',
+  vendor: 'openai',
+  procNames: ['codex'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.CODEX_SANDBOX_NETWORK_DISABLED === '1') raw.CODEX_SANDBOX_NETWORK_DISABLED = env.CODEX_SANDBOX_NETWORK_DISABLED;
+    if (env.CODEX_SANDBOX) raw.CODEX_SANDBOX = env.CODEX_SANDBOX;
+    // CODEX_CI / CODEX_THREAD_ID: vercel-rules tier, hence the medium below
+    if (env.CODEX_CI) raw.CODEX_CI = env.CODEX_CI;
+    if (env.CODEX_THREAD_ID) raw.CODEX_THREAD_ID = env.CODEX_THREAD_ID;
+    if (Object.keys(raw).length === 0) return null;
+    const sourceConfirmed = raw.CODEX_SANDBOX_NETWORK_DISABLED || raw.CODEX_SANDBOX;
+    return { confidence: sourceConfirmed ? 'high' : 'medium', raw };
+  },
+};

package/agents/continue/index.js

@@ -0,0 +1,11 @@
+// continue — evidence, tiers, and probe TODOs: .kanbento/harnesses/continue.md
+// No env signal exists — this detector never fires.
+export default {
+  name: 'continue',
+  vendor: 'continue',
+  procNames: ['cn'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/cowork/index.js

@@ -0,0 +1,16 @@
+// cowork — evidence, tiers, and probe TODOs: .kanbento/harnesses/cowork.md
+// Runs Claude Code underneath; the claude-code detector defers when the marker is set.
+export default {
+  name: 'cowork',
+  vendor: 'anthropic',
+  procNames: [],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.CLAUDE_CODE_IS_COWORK) return null;
+    if (env.CLAUDECODE !== '1' && !env.CLAUDE_CODE) return null;
+    const raw = { CLAUDE_CODE_IS_COWORK: env.CLAUDE_CODE_IS_COWORK };
+    if (env.CLAUDECODE !== undefined) raw.CLAUDECODE = env.CLAUDECODE;
+    if (env.CLAUDE_CODE !== undefined) raw.CLAUDE_CODE = env.CLAUDE_CODE;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/crush/index.js

@@ -0,0 +1,11 @@
+// crush — evidence, tiers, and probe TODOs: .kanbento/harnesses/crush.md
+// No env signal exists — this detector never fires.
+export default {
+  name: 'crush',
+  vendor: 'charm',
+  procNames: ['crush'],
+  pidEnvVar: null,
+  detect() {
+    return null;
+  },
+};

package/agents/cursor/index.js

@@ -0,0 +1,19 @@
+// cursor — evidence, tiers, and probe TODOs: .kanbento/harnesses/cursor.md
+// All tells are community-tier (none on an official reference page).
+export default {
+  name: 'cursor',
+  vendor: 'anysphere',
+  procNames: ['cursor-agent', 'agent'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    for (const key of ['CURSOR_AGENT', 'CURSOR_TRACE_ID', 'CURSOR_CLI', 'CURSOR_EXTENSION_HOST_ROLE']) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    if (env.CURSOR_AGENT === '1') return { confidence: 'high', raw };
+    // vercel-rules tier (detect-agent@1.0.1): the CLI in extension-host mode
+    if (env.CURSOR_EXTENSION_HOST_ROLE === 'agent-exec') return { confidence: 'high', raw };
+    if (env.CURSOR_TRACE_ID) return { confidence: 'medium', raw };
+    return null;
+  },
+};

package/agents/devin/index.js

@@ -0,0 +1,12 @@
+// devin — evidence, tiers, and probe TODOs: .kanbento/harnesses/devin.md
+// Only tell is a file check (/opt/.devin) — outside the env core; never fires here.
+export default {
+  name: 'devin',
+  vendor: 'cognition',
+  procNames: [],
+  pidEnvVar: null,
+  filesTells: ['/opt/.devin'],
+  detect() {
+    return null;
+  },
+};

package/agents/gemini-cli/index.js

@@ -0,0 +1,11 @@
+// gemini-cli — evidence, tiers, and probe TODOs: .kanbento/harnesses/gemini-cli.md
+export default {
+  name: 'gemini-cli',
+  vendor: 'google',
+  procNames: ['gemini'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.GEMINI_CLI !== '1') return null;
+    return { confidence: 'high', raw: { GEMINI_CLI: env.GEMINI_CLI } };
+  },
+};

package/agents/github-copilot/index.js

@@ -0,0 +1,20 @@
+// github-copilot — evidence, tiers, and probe TODOs: .kanbento/harnesses/github-copilot.md
+// COPILOT_CLI=1 is vendor-documented; the COPILOT_MODEL trio is an unverified fallback.
+export default {
+  name: 'github-copilot',
+  vendor: 'github',
+  procNames: ['copilot'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.COPILOT_CLI === '1') raw.COPILOT_CLI = env.COPILOT_CLI;
+    if (env.COPILOT_AGENT_SESSION_ID) raw.COPILOT_AGENT_SESSION_ID = env.COPILOT_AGENT_SESSION_ID;
+    if (Object.keys(raw).length > 0) return { confidence: 'high', raw };
+    // vercel-rules tier, unverified in vendor sources
+    for (const key of ['COPILOT_MODEL', 'COPILOT_ALLOW_ALL', 'COPILOT_GITHUB_TOKEN']) {
+      if (env[key]) raw[key] = env[key];
+    }
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/goose/index.js

@@ -0,0 +1,14 @@
+// goose — evidence, tiers, and probe TODOs: .kanbento/harnesses/goose.md
+// Vars set on two of three execution paths — absence proves nothing.
+export default {
+  name: 'goose',
+  vendor: 'block',
+  procNames: ['goose'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.GOOSE_TERMINAL !== '1') return null;
+    const raw = { GOOSE_TERMINAL: env.GOOSE_TERMINAL };
+    if (env.AGENT_SESSION_ID) raw.AGENT_SESSION_ID = env.AGENT_SESSION_ID;
+    return { confidence: 'high', raw };
+  },
+};

package/agents/grok/index.js

@@ -1,9 +1,5 @@
-// grok (xAI) — probed 2026-07-12 (see .kanbento/harnesses/grok.md).
-// Sets NO identity variable (grok 0.2.45, scrubbed-env probe). Its children
-// carry only a non-interactive hygiene bundle (CI=true, pagers off, progress
-// off) — too weak to name an agent; weak-signal use is parked (note:design).
-// It also passes inherited AI_AGENT through — the live proof of nested-harness
-// contamination. Env-undetectable, honestly: this detector never fires.
+// grok — evidence, tiers, and probe TODOs: .kanbento/harnesses/grok.md
+// No identity var (probed) — this detector never fires.
 export default {
   name: 'grok',
   vendor: 'xai',

package/agents/index.js

@@ -1,5 +1,54 @@
 // One agent = one folder = one easy PR. Keep alphabetical.
+import aider from './aider/index.js';
+import amp from './amp/index.js';
+import antigravity from './antigravity/index.js';
+import augment from './augment/index.js';
 import claudeCode from './claude-code/index.js';
+import cline from './cline/index.js';
+import codex from './codex/index.js';
+import continueDev from './continue/index.js';
+import cowork from './cowork/index.js';
+import crush from './crush/index.js';
+import cursor from './cursor/index.js';
+import devin from './devin/index.js';
+import geminiCli from './gemini-cli/index.js';
+import githubCopilot from './github-copilot/index.js';
+import goose from './goose/index.js';
 import grok from './grok/index.js';
+import junie from './junie/index.js';
+import kilo from './kilo/index.js';
+import kiro from './kiro/index.js';
+import opencode from './opencode/index.js';
+import openhands from './openhands/index.js';
+import pi from './pi/index.js';
+import qwenCode from './qwen-code/index.js';
+import replit from './replit/index.js';
+import roo from './roo/index.js';
 
-export const agents = [claudeCode, grok];
+export const agents = [
+  aider,
+  amp,
+  antigravity,
+  augment,
+  claudeCode,
+  cline,
+  codex,
+  continueDev,
+  cowork,
+  crush,
+  cursor,
+  devin,
+  geminiCli,
+  githubCopilot,
+  goose,
+  grok,
+  junie,
+  kilo,
+  kiro,
+  opencode,
+  openhands,
+  pi,
+  qwenCode,
+  replit,
+  roo,
+];

package/agents/junie/index.js

@@ -0,0 +1,14 @@
+// junie — evidence, tiers, and probe TODOs: .kanbento/harnesses/junie.md
+export default {
+  name: 'junie',
+  vendor: 'jetbrains',
+  procNames: ['junie'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.JUNIE_DATA) raw.JUNIE_DATA = env.JUNIE_DATA;
+    if (env.JUNIE_SHIM_PATH) raw.JUNIE_SHIM_PATH = env.JUNIE_SHIM_PATH;
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/kilo/index.js

@@ -0,0 +1,17 @@
+// kilo — evidence, tiers, and probe TODOs: .kanbento/harnesses/kilo.md
+// opencode fork: both detectors fire by design (claims[] represents it; kilo wins by order).
+export default {
+  name: 'kilo',
+  vendor: 'kilo-org',
+  procNames: ['kilo'],
+  pidEnvVar: 'KILO_PID',
+  detect(env) {
+    const raw = {};
+    for (const key of ['KILO', 'KILO_CLIENT', 'KILO_PLATFORM', 'KILOCODE_FEATURE', 'KILOCODE_VERSION', 'KILO_APP_VERSION', 'KILO_PID']) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    if (env.KILO !== '1' && !env.KILO_CLIENT && !env.KILOCODE_FEATURE) return null;
+    const version = env.KILOCODE_VERSION || env.KILO_APP_VERSION || null;
+    return { confidence: 'high', version, raw };
+  },
+};

package/agents/kiro/index.js

@@ -0,0 +1,12 @@
+// kiro — evidence, tiers, and probe TODOs: .kanbento/harnesses/kiro.md
+// TERM_PROGRAM is ambience, not identity (their TTY gate is impossible env-only) — low.
+export default {
+  name: 'kiro',
+  vendor: 'aws',
+  procNames: ['kiro'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.TERM_PROGRAM || !env.TERM_PROGRAM.includes('kiro')) return null;
+    return { confidence: 'low', raw: { TERM_PROGRAM: env.TERM_PROGRAM } };
+  },
+};

package/agents/opencode/index.js

@@ -0,0 +1,16 @@
+// opencode — evidence, tiers, and probe TODOs: .kanbento/harnesses/opencode.md
+export default {
+  name: 'opencode',
+  vendor: 'anomaly',
+  procNames: ['opencode'],
+  pidEnvVar: 'OPENCODE_PID',
+  detect(env) {
+    // OPENCODE_CLIENT is the vercel-rules-tier sibling (detect-agent@1.0.1)
+    if (env.OPENCODE !== '1' && !env.OPENCODE_CLIENT) return null;
+    const raw = {};
+    for (const key of ['OPENCODE', 'OPENCODE_CLIENT', 'OPENCODE_PID']) {
+      if (env[key] !== undefined) raw[key] = env[key];
+    }
+    return { confidence: 'high', raw };
+  },
+};

package/agents/openhands/index.js

@@ -0,0 +1,17 @@
+// openhands — evidence, tiers, and probe TODOs: .kanbento/harnesses/openhands.md
+// Sandbox-furniture fingerprint, not a deliberate marker — medium.
+export default {
+  name: 'openhands',
+  vendor: 'all-hands',
+  procNames: [],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    for (const key of ['OH_CONVERSATIONS_PATH', 'OH_BASH_EVENTS_DIR', 'OPENVSCODE_SERVER_ROOT']) {
+      if (env[key]) raw[key] = env[key];
+    }
+    if (env.PS1?.includes('###PS1JSON###')) raw.PS1 = '<contains ###PS1JSON### marker>';
+    if (Object.keys(raw).length === 0) return null;
+    return { confidence: 'medium', raw };
+  },
+};

package/agents/pi/index.js

@@ -0,0 +1,12 @@
+// pi — evidence, tiers, and probe TODOs: .kanbento/harnesses/pi.md
+// PATH fingerprint — weak-signal class, low.
+export default {
+  name: 'pi',
+  vendor: null,
+  procNames: ['pi'],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.PATH || !/\.pi[\\/]agent/.test(env.PATH)) return null;
+    return { confidence: 'low', raw: { PATH: '<contains .pi/agent>' } };
+  },
+};

package/agents/qwen-code/index.js

@@ -0,0 +1,15 @@
+// qwen-code — evidence, tiers, and probe TODOs: .kanbento/harnesses/qwen-code.md
+export default {
+  name: 'qwen-code',
+  vendor: 'alibaba',
+  procNames: ['qwen'],
+  pidEnvVar: null,
+  detect(env) {
+    if (env.QWEN_CODE !== '1') return null;
+    const raw = { QWEN_CODE: env.QWEN_CODE };
+    for (const key of ['QWEN_CODE_SESSION_ID', 'QWEN_CODE_AGENT_ID', 'QWEN_CODE_PROMPT_ID']) {
+      if (env[key]) raw[key] = env[key];
+    }
+    return { confidence: 'high', raw };
+  },
+};

package/agents/replit/index.js

@@ -0,0 +1,12 @@
+// replit — evidence, tiers, and probe TODOs: .kanbento/harnesses/replit.md
+// REPL_ID marks the Replit platform, not agent operation — medium.
+export default {
+  name: 'replit',
+  vendor: 'replit',
+  procNames: [],
+  pidEnvVar: null,
+  detect(env) {
+    if (!env.REPL_ID) return null;
+    return { confidence: 'medium', raw: { REPL_ID: env.REPL_ID } };
+  },
+};

package/agents/roo/index.js

@@ -0,0 +1,16 @@
+// roo — evidence, tiers, and probe TODOs: .kanbento/harnesses/roo.md
+// The execa inline provider sets neither var — absence proves nothing.
+export default {
+  name: 'roo',
+  vendor: 'roo-code',
+  procNames: ['roo'],
+  pidEnvVar: null,
+  detect(env) {
+    const raw = {};
+    if (env.ROO_ACTIVE === 'true') raw.ROO_ACTIVE = env.ROO_ACTIVE;
+    if (env.ROO_CLI_RUNTIME === '1') raw.ROO_CLI_RUNTIME = env.ROO_CLI_RUNTIME;
+    if (Object.keys(raw).length === 0) return null;
+    const mode = raw.ROO_CLI_RUNTIME ? 'agent' : null;
+    return { confidence: 'high', mode, raw };
+  },
+};

package/fixtures/aider.json

@@ -0,0 +1,21 @@
+{
+  "agent": "aider",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: aider/llm.py:9-13 \u2014 OpenRouter attribution vars set at import, inherited by every /run child; accidental fingerprint, not identity by intent",
+      "tier": "source",
+      "env": {
+        "OR_SITE_URL": "https://aider.chat",
+        "OR_APP_NAME": "Aider"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "aider",
+        "claimNames": [
+          "aider"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/amp.json

@@ -0,0 +1,14 @@
+{
+  "agent": "amp",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "community-derived: agents.md adoption table (issues/136) lists amp as setting AGENT=amp — not in the official manual, unverified in source; identity arrives via the generic AGENT rung, no vendor detector",
+      "tier": "community",
+      "env": {
+        "AGENT": "amp"
+      },
+      "expect": { "isAgent": true, "primary": "amp", "claimNames": ["amp"] }
+    }
+  ]
+}

package/fixtures/antigravity.json

@@ -0,0 +1,20 @@
+{
+  "agent": "antigravity",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified)",
+      "tier": "vercel-rules",
+      "env": {
+        "ANTIGRAVITY_AGENT": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "antigravity",
+        "claimNames": [
+          "antigravity"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/augment.json

@@ -0,0 +1,20 @@
+{
+  "agent": "augment",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified)",
+      "tier": "vercel-rules",
+      "env": {
+        "AUGMENT_AGENT": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "augment",
+        "claimNames": [
+          "augment"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/cline.json

@@ -0,0 +1,36 @@
+{
+  "agent": "cline",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: VscodeTerminalRegistry.ts:29 \u2014 CLINE_ACTIVE=true injected on VS Code integrated terminals",
+      "tier": "source",
+      "env": {
+        "CLINE_ACTIVE": "true"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "cline",
+        "claimNames": [
+          "cline"
+        ]
+      }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: standalone/CLI path (StandaloneTerminalProcess.ts:104-116) sets only anti-interactivity overrides, NOT the marker \u2014 the coverage gap",
+      "tier": "source",
+      "env": {
+        "TERM": "xterm-256color",
+        "PAGER": "cat",
+        "GIT_PAGER": "cat",
+        "MANPAGER": "cat"
+      },
+      "expect": {
+        "isAgent": false,
+        "primary": null,
+        "claimNames": []
+      }
+    }
+  ]
+}

package/fixtures/codex.json

@@ -0,0 +1,31 @@
+{
+  "agent": "codex",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: codex-rs/core/src/spawn.rs — network sandbox on (any OS)",
+      "tier": "source",
+      "env": {
+        "CODEX_SANDBOX_NETWORK_DISABLED": "1"
+      },
+      "expect": { "isAgent": true, "primary": "codex", "claimNames": ["codex"] }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: macOS Seatbelt — both sandbox vars present",
+      "tier": "source",
+      "env": {
+        "CODEX_SANDBOX": "seatbelt",
+        "CODEX_SANDBOX_NETWORK_DISABLED": "1"
+      },
+      "expect": { "isAgent": true, "primary": "codex", "claimNames": ["codex"] }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: --sandbox danger-full-access — NO env signal exists (the documented hole; ppid walk is the only rung that catches codex here)",
+      "tier": "source",
+      "env": {},
+      "expect": { "isAgent": false, "primary": null, "claimNames": [] }
+    }
+  ]
+}

package/fixtures/continue.json

@@ -0,0 +1,20 @@
+{
+  "agent": "continue",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: cn CLI spawns with no env option (runTerminalCommand.ts:192); VS Code path adds only generic color vars. Env-undetectable; upstream ticket candidate (CONTINUE=1)",
+      "tier": "source",
+      "env": {
+        "FORCE_COLOR": "1",
+        "COLORTERM": "truecolor",
+        "CLICOLOR": "1"
+      },
+      "expect": {
+        "isAgent": false,
+        "primary": null,
+        "claimNames": []
+      }
+    }
+  ]
+}

package/fixtures/cowork.json

@@ -0,0 +1,21 @@
+{
+  "agent": "cowork",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified) \u2014 cowork marker atop claude-code vars; claude-code detector defers (specificity wins)",
+      "tier": "vercel-rules",
+      "env": {
+        "CLAUDE_CODE_IS_COWORK": "1",
+        "CLAUDECODE": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "cowork",
+        "claimNames": [
+          "cowork"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/crush.json

@@ -0,0 +1,20 @@
+{
+  "agent": "crush",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: full Setenv/cmd.Env sweep of internal/ \u2014 NO self-identity var on shell children; only generic color-forcing on the PTY path. Env-undetectable; upstream ticket candidate (CRUSH=1)",
+      "tier": "source",
+      "env": {
+        "COLORTERM": "truecolor",
+        "CLICOLOR_FORCE": "1",
+        "FORCE_COLOR": "1"
+      },
+      "expect": {
+        "isAgent": false,
+        "primary": null,
+        "claimNames": []
+      }
+    }
+  ]
+}

package/fixtures/cursor.json

@@ -0,0 +1,24 @@
+{
+  "agent": "cursor",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "community/staff-derived: agent shell command env (forum.cursor.com/t/132427, t/37734) — both tells present",
+      "tier": "community",
+      "env": {
+        "CURSOR_AGENT": "1",
+        "CURSOR_TRACE_ID": "0000-fixture-trace-id"
+      },
+      "expect": { "isAgent": true, "primary": "cursor", "claimNames": ["cursor"] }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "community-derived: trace id only (CURSOR_AGENT=1 was once accidentally dropped by a CLI release — the degraded state)",
+      "tier": "community",
+      "env": {
+        "CURSOR_TRACE_ID": "0000-fixture-trace-id"
+      },
+      "expect": { "isAgent": true, "primary": "cursor", "claimNames": ["cursor"] }
+    }
+  ]
+}

package/fixtures/devin.json

@@ -0,0 +1,16 @@
+{
+  "agent": "devin",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified) \u2014 only tell is file_exists /opt/.devin, a disk check outside the edge-safe env core; devin detection belongs to the /node rung",
+      "tier": "vercel-rules",
+      "env": {},
+      "expect": {
+        "isAgent": false,
+        "primary": null,
+        "claimNames": []
+      }
+    }
+  ]
+}

package/fixtures/gemini-cli.json

@@ -0,0 +1,14 @@
+{
+  "agent": "gemini-cli",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source+doc-derived: shellExecutionService.ts sets GEMINI_CLI=1 on every shell-tool child; documented in docs/tools/shell.md",
+      "tier": "source",
+      "env": {
+        "GEMINI_CLI": "1"
+      },
+      "expect": { "isAgent": true, "primary": "gemini-cli", "claimNames": ["gemini-cli"] }
+    }
+  ]
+}

package/fixtures/github-copilot.json

@@ -0,0 +1,52 @@
+{
+  "agent": "github-copilot",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "doc-derived: vendor changelog:1674 \u2014 COPILOT_CLI=1 is the documented subprocess-detection hook, plus session id (changelog:1128)",
+      "tier": "doc",
+      "env": {
+        "COPILOT_CLI": "1",
+        "COPILOT_AGENT_SESSION_ID": "fixture-session"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "github-copilot",
+        "claimNames": [
+          "github-copilot"
+        ]
+      }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified) \u2014 COPILOT_MODEL trio, unverified in vendor changelog; weaker fallback",
+      "tier": "vercel-rules",
+      "env": {
+        "COPILOT_MODEL": "gpt-5"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "github-copilot",
+        "claimNames": [
+          "github-copilot"
+        ]
+      }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "doc-derived: AI_AGENT self-identification (github-copilot-cli dialect via core rung 1)",
+      "tier": "doc",
+      "env": {
+        "AI_AGENT": "github-copilot-cli"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "github-copilot-cli",
+        "claimNames": [
+          "github-copilot-cli"
+        ],
+        "note": "verbatim rung-1 name; Vercel's scoped pkg normalizes -cli away, we preserve evidence as-is"
+      }
+    }
+  ]
+}

package/fixtures/goose.json

@@ -0,0 +1,22 @@
+{
+  "agent": "goose",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: computer-controller / retry path (goose-mcp computercontroller/mod.rs:855-873) — AGENT=goose + GOOSE_TERMINAL=1, corroborating",
+      "tier": "source",
+      "env": {
+        "AGENT": "goose",
+        "GOOSE_TERMINAL": "1"
+      },
+      "expect": { "isAgent": true, "primary": "goose", "claimNames": ["goose"] }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: main developer shell tool sets NEITHER var (shell.rs sets only PATH — source contradicts the docs' blanket claim); goose is env-invisible on its most common path",
+      "tier": "source",
+      "env": {},
+      "expect": { "isAgent": false, "primary": null, "claimNames": [] }
+    }
+  ]
+}

package/fixtures/junie.json

@@ -0,0 +1,20 @@
+{
+  "agent": "junie",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified)",
+      "tier": "vercel-rules",
+      "env": {
+        "JUNIE_DATA": "/tmp/junie"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "junie",
+        "claimNames": [
+          "junie"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/kilo.json

@@ -0,0 +1,28 @@
+{
+  "agent": "kilo",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: cli/setup.ts:56 + server-manager.ts:113-152 + fork-parent index.ts:111-113 \u2014 the richest emitter surveyed; opencode detector legitimately fires too (kilo IS opencode underneath): the claims model represents it",
+      "tier": "source",
+      "env": {
+        "KILO": "1",
+        "KILO_CLIENT": "vscode",
+        "KILOCODE_FEATURE": "vscode-extension",
+        "KILOCODE_VERSION": "4.99.0",
+        "KILO_PID": "4242",
+        "AGENT": "1",
+        "OPENCODE": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "kilo",
+        "version": "4.99.0",
+        "claimNames": [
+          "kilo",
+          "opencode"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/kiro.json

@@ -0,0 +1,20 @@
+{
+  "agent": "kiro",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified) \u2014 their rule gates on no_tty which env-only cannot see; low confidence, ambience not identity",
+      "tier": "vercel-rules",
+      "env": {
+        "TERM_PROGRAM": "kiro"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "kiro",
+        "claimNames": [
+          "kiro"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/opencode.json

@@ -0,0 +1,16 @@
+{
+  "agent": "opencode",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: startup middleware (packages/opencode/src/index.ts:75-77) — OPENCODE=1, AGENT=1 (boolean: anonymous claim), OPENCODE_PID",
+      "tier": "source",
+      "env": {
+        "OPENCODE": "1",
+        "AGENT": "1",
+        "OPENCODE_PID": "12345"
+      },
+      "expect": { "isAgent": true, "primary": "opencode", "claimNames": ["opencode"] }
+    }
+  ]
+}

package/fixtures/openhands.json

@@ -0,0 +1,23 @@
+{
+  "agent": "openhands",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: docker_sandbox_spec_service.py:38-52 + subprocess_terminal.py:150 \u2014 sandbox container furniture + PS1 markers; environment fingerprint, not identity by intent",
+      "tier": "source",
+      "env": {
+        "OH_CONVERSATIONS_PATH": "/workspace/conversations",
+        "OH_BASH_EVENTS_DIR": "/workspace/bash_events",
+        "OPENVSCODE_SERVER_ROOT": "/openhands/.openvscode-server",
+        "PS1": "###PS1JSON###{}###PS1END###"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "openhands",
+        "claimNames": [
+          "openhands"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/pi.json

@@ -0,0 +1,20 @@
+{
+  "agent": "pi",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified) \u2014 PATH fingerprint, weak-signal class",
+      "tier": "vercel-rules",
+      "env": {
+        "PATH": "/usr/bin:/home/u/.pi/agent/bin"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "pi",
+        "claimNames": [
+          "pi"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/qwen-code.json

@@ -0,0 +1,23 @@
+{
+  "agent": "qwen-code",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: shellExecutionService.ts:723 + shellContextEnv.ts:41-55 \u2014 QWEN_CODE=1 with session-id family on every shell child; renamed from Gemini's GEMINI_CLI (fork, zero GEMINI_CLI hits)",
+      "tier": "source",
+      "env": {
+        "QWEN_CODE": "1",
+        "QWEN_CODE_SESSION_ID": "fixture-uuid",
+        "QWEN_CODE_AGENT_ID": "",
+        "QWEN_CODE_PROMPT_ID": ""
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "qwen-code",
+        "claimNames": [
+          "qwen-code"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/replit.json

@@ -0,0 +1,20 @@
+{
+  "agent": "replit",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "vercel-rules-derived: detect-agent@1.0.1 agents.json (adopted, not independently verified) \u2014 REPL_ID marks the Replit environment, not specifically its agent",
+      "tier": "vercel-rules",
+      "env": {
+        "REPL_ID": "fixture-repl"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "replit",
+        "claimNames": [
+          "replit"
+        ]
+      }
+    }
+  ]
+}

package/fixtures/roo.json

@@ -0,0 +1,38 @@
+{
+  "agent": "roo",
+  "probes": [
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: Terminal.ts:153-161 \u2014 ROO_ACTIVE=true on VS Code terminals",
+      "tier": "source",
+      "env": {
+        "ROO_ACTIVE": "true",
+        "PAGER": "cat",
+        "VTE_VERSION": "0"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "roo",
+        "claimNames": [
+          "roo"
+        ]
+      }
+    },
+    {
+      "date": "2026-07-12",
+      "method": "source-derived: extension-host.ts:182 \u2014 ROO_CLI_RUNTIME=1 process-wide in the headless CLI",
+      "tier": "source",
+      "env": {
+        "ROO_CLI_RUNTIME": "1"
+      },
+      "expect": {
+        "isAgent": true,
+        "primary": "roo",
+        "mode": "agent",
+        "claimNames": [
+          "roo"
+        ]
+      }
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agent-detect",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Detect which AI agent is running your code — structured identity (name, version, mode) with evidence, not just a boolean. Reads the AI_AGENT standard (both dialects) and the signals it misses.",
   "license": "MIT",
   "author": "George Mihailov",