Add explicit AI agent execution profiles

[nadaverell]

Summary

• replace the overloaded local isolated switch with explicit safeguarded and full-local execution profiles
• default Claude CLI and Codex to Radar safeguards while allowing users to opt out into their normal agent setup; Cursor exposes only its full local setup because Radar cannot reliably isolate it
• centralize profile capabilities, defaults, validation, persistence, and agent/profile-scoped consent in internal/ai
• apply profile-specific driver behavior: strict Radar-only MCP/tool constraints in safeguarded mode, normal user configuration in full-local mode, and explicit rejection of unsupported combinations
• explain the selected behavior in AI settings and require just-in-time consent in the diagnose drawer for each exact agent/profile surface
• deep-link the diagnose drawer’s settings action to the AI settings section and size the dialog to show the full profile configuration without routine scrolling
• probe the installed Cursor Agent for the anchored --trust flag rather than assuming version-specific support
• reconcile agents found on PATH with the drivers Radar actually initialized, including RADAR_AI_CLI_BIN overrides in both the server API and standalone pre-boot consent
• preserve Radar Hub hosted-agent consent while keeping local execution profiles separate

Product and security model

Radar safeguards is the default wherever the installed agent can enforce Radar’s restrictions. Your <agent> setup is an explicit opt-out that uses the agent’s normal configuration, tools, and MCP servers.

The disclosure is agent-specific:

• Claude CLI full-local uses the permissions from the user’s setup; Radar does not override them
• Codex full-local retains the CLI’s own sandbox, but Radar cannot constrain external MCP servers
• Cursor is full-local only and always loads global MCP servers, so Radar cannot exclude them

Consent is versioned per exact agent/profile surface. Supported agents must advertise at least one profile, every advertised surface must have a configured disclosure version, and unsupported combinations are rejected centrally and by each driver.

There is intentionally no compatibility translation for the removed isolated field, and profileless persisted local runs are not resumed under an implied security posture.

Verification

• make tsc
• make test
• make build
• focused AI, diagnose CLI, server, and frontend tests
• git diff --check
• manual live UI verification of profile switching, agent-specific warnings, consent, settings deep-linking, and dialog sizing
• live real-cluster diagnosis of the same crash-looping pod with:
  • Claude CLI safeguarded
  • Codex safeguarded
  • Codex full-local
  • Cursor full-local
• every live run completed and called Radar MCP tools; no cluster writes were performed
• driver tests cover both Claude CLI profiles, including the full-local command, environment, and MCP behavior
• standalone regression coverage verifies that pre-boot consent honors a RADAR_AI_CLI_BIN override
• installed versions exercised: Claude CLI 2.1.220, Codex 0.145.0, Cursor 2026.07.23-e383d2b

Release note

This intentionally changes the public diagnose customization context from isolated / setIsolated to profile / setProfile. The next @skyhook-io/radar-app publication containing this PR must use a major tag (radar-app-v2.0.0), rather than changing the source package placeholder version.

Follow-up

The additional CLIs in #1265 can rebase on this framework and declare their supported profiles, defaults, driver enforcement, and disclosure copy individually.

Fixes #1272

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3bad7cc. Configure here.}