@cabane/cli 0.1.4 → 0.1.6

package/dist/cli.js

@@ -3,38 +3,13 @@
 // src/cli.ts
 import { Command } from "commander";
 
-// src/commands/bridge.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
-import { join as join2 } from "path";
+// src/commands/doctor.ts
+import { writeSync } from "fs";
+import { homedir as homedir2 } from "os";
 
-// src/log.ts
-var BOLD = "\x1B[1m";
-var RED = "\x1B[31m";
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var RESET = "\x1B[0m";
-var useColor = () => process.stderr.isTTY === true && !process.env.NO_COLOR;
-var paint = (code, s) => useColor() ? `${code}${s}${RESET}` : s;
-function step(msg) {
-  process.stderr.write(`${paint(BOLD, "\u203A")} ${msg}
-`);
-}
-function info(msg) {
-  process.stderr.write(`  ${msg}
-`);
-}
-function ok(msg) {
-  process.stderr.write(`${paint(GREEN, "\u2713")} ${msg}
-`);
-}
-function warn(msg) {
-  process.stderr.write(`${paint(YELLOW, "\u26A0")} ${msg}
-`);
-}
-function error(msg) {
-  process.stderr.write(`${paint(RED, "\u2717")} ${msg}
-`);
-}
+// src/config.ts
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname } from "path";
 
 // src/paths.ts
 import { existsSync, readFileSync } from "fs";
@@ -52,7 +27,7 @@ function classifyHome(dir) {
   }
   if (cfg) {
     if (typeof cfg.distBase === "string" || typeof cfg.pgPort === "number") return "selfhost";
-    if (typeof cfg.baseUrl === "string" || typeof cfg.deviceToken === "string") return "bridge";
+    if (typeof cfg.baseUrl === "string" || typeof cfg.deviceToken === "string") return "companion";
   }
   return "empty";
 }
@@ -75,19 +50,17 @@ function resolvePaths(root = cabaneHome(), dataDir) {
     dataDir: data,
     pgDataDir: join(data, "pg"),
     storageRoot: join(data, "storage"),
-    bridgeHome: join(root, "bridge"),
     logsDir: join(root, "logs"),
     serverLog: join(root, "logs", "server.log"),
-    bridgeLog: join(root, "logs", "bridge.log"),
     runDir: join(root, "run"),
     supervisorPidFile: join(root, "run", "supervisor.pid"),
     stateFile: join(root, "run", "state.json")
   };
 }
-function assertNotForeignBridge(root = cabaneHome()) {
-  if (classifyHome(root) !== "bridge") return;
+function assertNotForeignCompanion(root = cabaneHome()) {
+  if (classifyHome(root) !== "companion") return;
   throw new Error(
-    `${root} holds a standalone @cabane/bridge config (a device pairing), not a Cabane self-host install \u2014 refusing to write here and overwrite it.
+    `${root} holds a standalone @cabane/companion config (a device pairing), not a Cabane self-host install \u2014 refusing to write here and overwrite it.
 Self-host defaults to ~/.cabane-selfhost; unset CABANE_HOME, or point it at a different directory.`
   );
 }
@@ -95,6 +68,49 @@ function appDirFor(paths, version) {
   return join(paths.appsDir, version);
 }
 
+// src/config.ts
+var DEFAULT_DIST_BASE = "https://dist.cabane.ai";
+var DEFAULT_PORT = 3e3;
+var DEFAULT_PG_PORT = 55432;
+function defaultConfig() {
+  return {
+    distBase: DEFAULT_DIST_BASE,
+    port: DEFAULT_PORT,
+    pgPort: DEFAULT_PG_PORT
+  };
+}
+function loadConfig(root) {
+  const file = resolvePaths(root).configFile;
+  try {
+    const parsed = JSON.parse(readFileSync2(file, "utf8"));
+    return { ...defaultConfig(), ...parsed };
+  } catch {
+    return defaultConfig();
+  }
+}
+function saveConfig(config, root) {
+  const file = resolvePaths(root).configFile;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+}
+function updateConfig(mutate, root) {
+  const config = loadConfig(root);
+  mutate(config);
+  saveConfig(config, root);
+  return config;
+}
+function pathsFor(config, root) {
+  return resolvePaths(root, config.dataDir);
+}
+
+// src/doctor/checks.ts
+import { createRequire } from "module";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { statfs } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+import { pathToFileURL } from "url";
+
 // src/proc.ts
 import { spawn } from "child_process";
 function run(cmd, args, opts = {}) {
@@ -145,92 +161,6 @@ async function portInUse(port) {
   });
 }
 
-// src/commands/bridge.ts
-var STATE_DIRS = ["cursors", "dispatched", "completed", "resume-attempts"];
-async function bridgeReset(opts = {}) {
-  const paths = resolvePaths();
-  const bridgeCabane = join2(paths.bridgeHome, ".cabane");
-  const running = bridgeRunning(paths.stateFile);
-  if (running && !opts.force) {
-    warn("the bridge is running \u2014 a reset only takes effect on the next boot.");
-    info("stop it first (`cabane down`), or re-run with `--force` to clear anyway.");
-    return;
-  }
-  let cleared = 0;
-  for (const dir of STATE_DIRS) {
-    const target = join2(bridgeCabane, dir);
-    if (existsSync2(target)) {
-      rmSync(target, { recursive: true, force: true });
-      cleared += 1;
-    }
-  }
-  if (cleared === 0) {
-    ok("bridge resume state already clean \u2014 nothing to reset.");
-  } else {
-    ok(`cleared bridge resume state (${cleared} of ${STATE_DIRS.length} stores).`);
-    info(
-      "the bridge will start fresh (no interrupted turn to replay) on the next `cabane up`."
-    );
-  }
-}
-function bridgeRunning(stateFile) {
-  try {
-    const state = JSON.parse(readFileSync2(stateFile, "utf8"));
-    return state.bridgePid ? pidAlive(state.bridgePid) : false;
-  } catch {
-    return false;
-  }
-}
-
-// src/commands/doctor.ts
-import { writeSync } from "fs";
-import { homedir as homedir2 } from "os";
-
-// src/config.ts
-import { mkdirSync, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { dirname } from "path";
-var DEFAULT_DIST_BASE = "https://dist.cabane.ai";
-var DEFAULT_PORT = 3e3;
-var DEFAULT_PG_PORT = 55432;
-function defaultConfig() {
-  return {
-    distBase: DEFAULT_DIST_BASE,
-    port: DEFAULT_PORT,
-    pgPort: DEFAULT_PG_PORT
-  };
-}
-function loadConfig(root) {
-  const file = resolvePaths(root).configFile;
-  try {
-    const parsed = JSON.parse(readFileSync3(file, "utf8"));
-    return { ...defaultConfig(), ...parsed };
-  } catch {
-    return defaultConfig();
-  }
-}
-function saveConfig(config, root) {
-  const file = resolvePaths(root).configFile;
-  mkdirSync(dirname(file), { recursive: true });
-  writeFileSync(file, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
-}
-function updateConfig(mutate, root) {
-  const config = loadConfig(root);
-  mutate(config);
-  saveConfig(config, root);
-  return config;
-}
-function pathsFor(config, root) {
-  return resolvePaths(root, config.dataDir);
-}
-
-// src/doctor/checks.ts
-import { createRequire } from "module";
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { statfs } from "fs/promises";
-import { dirname as dirname2, join as join3 } from "path";
-import { pathToFileURL } from "url";
-
 // src/doctor/types.ts
 var pass = (id, name, detail) => ({
   id,
@@ -238,7 +168,7 @@ var pass = (id, name, detail) => ({
   status: "pass",
   detail
 });
-var warn2 = (id, name, detail, fix) => ({
+var warn = (id, name, detail, fix) => ({
   id,
   name,
   status: "warn",
@@ -269,7 +199,7 @@ function evaluateNode(current, floor) {
   const cur = parseMajor(current);
   const min = parseMajor(floor);
   if (Number.isNaN(cur) || Number.isNaN(min)) {
-    return warn2("node", "Node", `could not compare v${current} against floor "${floor}"`);
+    return warn("node", "Node", `could not compare v${current} against floor "${floor}"`);
   }
   if (cur >= min) return pass("node", "Node", `v${current} (\u2265 ${min} required)`);
   return fail(
@@ -299,7 +229,7 @@ async function checkPort(ctx) {
 }
 function ownSupervisorPid(paths) {
   try {
-    const pid = Number(readFileSync4(paths.supervisorPidFile, "utf8").trim());
+    const pid = Number(readFileSync3(paths.supervisorPidFile, "utf8").trim());
     return pid > 0 && pidAlive(pid) ? pid : null;
   } catch {
     return null;
@@ -319,7 +249,7 @@ function evaluateDisk(freeBytes, where) {
     );
   }
   if (freeBytes < DISK_WARN_BYTES) {
-    return warn2(
+    return warn(
       "disk",
       "Disk",
       `${gb} GB free on ${where} \u2014 low`,
@@ -336,7 +266,7 @@ async function checkDisk(ctx) {
 }
 function checkStorage(ctx) {
   const root = ctx.paths.storageRoot;
-  const target = existsSync3(root) ? root : nearestExisting(root);
+  const target = existsSync2(root) ? root : nearestExisting(root);
   if (!isWritableDir(target)) {
     return fail(
       "storage",
@@ -345,7 +275,7 @@ function checkStorage(ctx) {
       `Make ${target} writable, or point Cabane elsewhere with \`CABANE_HOME=<dir>\`.`
     );
   }
-  const note = existsSync3(root) ? "" : " (will be created on first `cabane up`)";
+  const note = existsSync2(root) ? "" : " (will be created on first `cabane up`)";
   return pass("storage", "Storage root", `${root} \u2014 writable${note}`);
 }
 async function resolvePgBinaries(platform, arch) {
@@ -394,7 +324,7 @@ async function checkPostgres(ctx) {
     );
   }
   const dataDir = ctx.paths.pgDataDir;
-  if (!existsSync3(join3(dataDir, "PG_VERSION"))) {
+  if (!existsSync2(join2(dataDir, "PG_VERSION"))) {
     return pass(
       "postgres",
       "Embedded Postgres",
@@ -403,7 +333,7 @@ async function checkPostgres(ctx) {
   }
   const stale = stalePostmaster(dataDir);
   if (stale) {
-    return warn2(
+    return warn(
       "postgres",
       "Embedded Postgres",
       `data dir initialised but holds a stale postmaster.pid (pid ${stale}, not running) \u2014 ${dataDir}`,
@@ -415,7 +345,7 @@ async function checkPostgres(ctx) {
 function stalePostmaster(dataDir) {
   try {
     const pid = Number(
-      readFileSync4(join3(dataDir, "postmaster.pid"), "utf8").split("\n")[0]?.trim()
+      readFileSync3(join2(dataDir, "postmaster.pid"), "utf8").split("\n")[0]?.trim()
     );
     return pid > 0 && !pidAlive(pid) ? pid : null;
   } catch {
@@ -445,154 +375,12 @@ async function hasQuarantine(file) {
     return false;
   }
 }
-var CREDENTIAL_SOURCE = {
-  subscription: "Claude subscription login (~/.claude)",
-  "env-api-key": "ANTHROPIC_API_KEY (env or `cabane set-env`)",
-  "env-auth-token": "ANTHROPIC_AUTH_TOKEN (env or `cabane set-env`)",
-  "settings-api-key": "ANTHROPIC_API_KEY in Claude settings.json"
-};
-function evaluateExecutor(p) {
-  const name = "Executor (Claude Code)";
-  if (!p.binaryFound) {
-    return fail(
-      "executor",
-      name,
-      `\`${p.binaryName}\` is not on PATH \u2014 the house bridge has no executor to run`,
-      "Install Claude Code (or your chosen executor) and make sure it is on PATH."
-    );
-  }
-  const apiKeyOnly = p.credential === "env-api-key" || p.credential === "env-auth-token" || p.credential === "settings-api-key";
-  if (p.forceLoginMethod === "claudeai" && apiKeyOnly) {
-    return fail(
-      "executor",
-      name,
-      "a Claude Code managed policy forces subscription login (`forceLoginMethod: claudeai`), which refuses your API key",
-      "Log in with the required method (`claude` \u2192 /login), or remove the managed-settings force-login policy."
-    );
-  }
-  if (!p.credential) {
-    return fail(
-      "executor",
-      name,
-      "no executor credential is reachable by the house bridge",
-      "Log in to Claude Code, or persist a key with `cabane set-env ANTHROPIC_API_KEY=\u2026`, or export it before `cabane up`."
-    );
-  }
-  return pass(
-    "executor",
-    name,
-    `\`${p.binaryName}\` present; credential reachable via ${CREDENTIAL_SOURCE[p.credential]} (reachability only \u2014 not verified against the provider)`
-  );
-}
-function checkExecutor(ctx) {
-  return evaluateExecutor(probeExecutor(ctx));
-}
-function probeExecutor(ctx) {
-  const { env, homeDir } = ctx.sys;
-  const cred = (key) => {
-    const v = env[key] ?? ctx.config.bridgeEnv?.[key];
-    return typeof v === "string" && v.length > 0;
-  };
-  const configDir = env.CLAUDE_CONFIG_DIR ?? join3(homeDir, ".claude");
-  let credential = null;
-  if (cred("ANTHROPIC_API_KEY")) credential = "env-api-key";
-  else if (cred("ANTHROPIC_AUTH_TOKEN")) credential = "env-auth-token";
-  else if (existsSync3(join3(configDir, ".credentials.json"))) credential = "subscription";
-  else if (settingsHasApiKey(join3(configDir, "settings.json"))) credential = "settings-api-key";
-  return {
-    binaryName: "claude",
-    binaryFound: onPath("claude", env),
-    forceLoginMethod: readForceLoginMethod(ctx.sys),
-    credential
-  };
-}
-function settingsHasApiKey(file) {
-  try {
-    const s = JSON.parse(readFileSync4(file, "utf8"));
-    return Boolean(s.env?.ANTHROPIC_API_KEY || s.apiKeyHelper);
-  } catch {
-    return false;
-  }
-}
-function managedSettingsPath(sys) {
-  switch (sys.platform) {
-    case "darwin":
-      return "/Library/Application Support/ClaudeCode/managed-settings.json";
-    case "linux":
-      return "/etc/claude-code/managed-settings.json";
-    case "win32":
-      return join3(sys.env.PROGRAMDATA ?? "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
-    default:
-      return null;
-  }
-}
-function readForceLoginMethod(sys) {
-  const path = managedSettingsPath(sys);
-  if (!path) return null;
-  try {
-    const s = JSON.parse(readFileSync4(path, "utf8"));
-    return s.forceLoginMethod ?? null;
-  } catch {
-    return null;
-  }
-}
-function onPath(bin, env) {
-  const dirs = (env.PATH ?? "").split(process.platform === "win32" ? ";" : ":");
-  const names = process.platform === "win32" ? [bin, `${bin}.exe`, `${bin}.cmd`] : [bin];
-  for (const dir of dirs) {
-    if (!dir) continue;
-    for (const name of names) if (existsSync3(join3(dir, name))) return true;
-  }
-  return false;
-}
-function evaluateVersions(input) {
-  const name = "Bridge/server version";
-  const { serverVersion, bridgeVersion } = input;
-  if (!serverVersion) {
-    return skip("versions", name, "no server artifact installed yet \u2014 run `cabane install`");
-  }
-  if (!bridgeVersion) {
-    return warn2(
-      "versions",
-      name,
-      `the installed artifact ships no bundled bridge to check against (server ${serverVersion})`,
-      "Reinstall the server artifact \u2014 a current build bundles its own bridge (`cabane install`)."
-    );
-  }
-  if (bridgeVersion === serverVersion) {
-    return pass("versions", name, `bundled bridge and server both ${serverVersion} (lockstep)`);
-  }
-  return fail(
-    "versions",
-    name,
-    `bundled bridge ${bridgeVersion} \u2260 server ${serverVersion} \u2014 a version skew (they must ship from one build)`,
-    "Reinstall a single matching artifact with `cabane install` so the bundled bridge and server are the same version."
-  );
-}
-function checkVersions(ctx) {
-  return evaluateVersions({
-    serverVersion: ctx.config.currentVersion ?? null,
-    bridgeVersion: readBundledBridgeVersion(ctx)
-  });
-}
-function readBundledBridgeVersion(ctx) {
-  const version = ctx.config.currentVersion;
-  if (!version) return null;
-  try {
-    const pkg = JSON.parse(
-      readFileSync4(join3(appDirFor(ctx.paths, version), "bridge", "package.json"), "utf8")
-    );
-    return pkg.version ?? null;
-  } catch {
-    return null;
-  }
-}
 function installedNodeFloor(ctx) {
   const version = ctx.config.currentVersion;
   if (!version) return null;
   try {
     const manifest = JSON.parse(
-      readFileSync4(join3(appDirFor(ctx.paths, version), "manifest.json"), "utf8")
+      readFileSync3(join2(appDirFor(ctx.paths, version), "manifest.json"), "utf8")
     );
     return manifest.nodeFloor ?? null;
   } catch {
@@ -601,7 +389,7 @@ function installedNodeFloor(ctx) {
 }
 function nearestExisting(path) {
   let cur = path;
-  while (!existsSync3(cur)) {
+  while (!existsSync2(cur)) {
     const parent = dirname2(cur);
     if (parent === cur) break;
     cur = parent;
@@ -610,9 +398,9 @@ function nearestExisting(path) {
 }
 function isWritableDir(dir) {
   try {
-    const probe = mkdtempSync(join3(dir, ".cabane-doctor-"));
-    writeFileSync2(join3(probe, "w"), "");
-    rmSync2(probe, { recursive: true, force: true });
+    const probe = mkdtempSync(join2(dir, ".cabane-doctor-"));
+    writeFileSync2(join2(probe, "w"), "");
+    rmSync(probe, { recursive: true, force: true });
     return true;
   } catch {
     return false;
@@ -661,11 +449,9 @@ function rollup(s) {
 // src/commands/doctor.ts
 var CHECKS = [
   { run: checkNode },
-  { run: checkExecutor },
   { run: checkPort },
   { run: checkPostgres },
   { run: checkStorage },
-  { run: checkVersions },
   { run: checkDisk },
   { run: checkGatekeeper }
 ];
@@ -711,17 +497,48 @@ var COLOR = {
   [STATUS_GLYPH.skip]: "[2m"
   // dim
 };
-var RESET2 = "[0m";
+var RESET = "[0m";
 function colorize(line) {
   if (process.stdout.isTTY !== true || process.env.NO_COLOR) return line;
   const glyph = line[0];
   const code = glyph ? COLOR[glyph] : void 0;
-  return code ? `${code}${glyph}${RESET2}${line.slice(1)}` : line;
+  return code ? `${code}${glyph}${RESET}${line.slice(1)}` : line;
+}
+
+// src/commands/down.ts
+import { readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/log.ts
+var BOLD = "\x1B[1m";
+var RED = "\x1B[31m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RESET2 = "\x1B[0m";
+var useColor = () => process.stderr.isTTY === true && !process.env.NO_COLOR;
+var paint = (code, s) => useColor() ? `${code}${s}${RESET2}` : s;
+function step(msg) {
+  process.stderr.write(`${paint(BOLD, "\u203A")} ${msg}
+`);
+}
+function info(msg) {
+  process.stderr.write(`  ${msg}
+`);
+}
+function ok(msg) {
+  process.stderr.write(`${paint(GREEN, "\u2713")} ${msg}
+`);
+}
+function warn2(msg) {
+  process.stderr.write(`${paint(YELLOW, "\u26A0")} ${msg}
+`);
+}
+function error(msg) {
+  process.stderr.write(`${paint(RED, "\u2717")} ${msg}
+`);
 }
 
 // src/commands/down.ts
-import { readFileSync as readFileSync5, rmSync as rmSync3 } from "fs";
-import { join as join4 } from "path";
 async function down() {
   const config = loadConfig();
   const paths = pathsFor(config);
@@ -735,9 +552,9 @@ async function down() {
     info("no live supervisor \u2014 reaping any orphaned children.");
   }
   for (const pid of [
-    state.bridgePid,
+    state.companionPid,
     state.serverPid,
-    readPid(join4(paths.pgDataDir, "postmaster.pid"))
+    readPid(join3(paths.pgDataDir, "postmaster.pid"))
   ]) {
     if (pid && pidAlive(pid)) await killPid(pid);
   }
@@ -745,10 +562,10 @@ async function down() {
     timeoutMs: 15e3,
     intervalMs: 300
   });
-  rmSync3(paths.supervisorPidFile, { force: true });
-  rmSync3(paths.stateFile, { force: true });
+  rmSync2(paths.supervisorPidFile, { force: true });
+  rmSync2(paths.stateFile, { force: true });
   if (free) ok("stopped");
-  else warn(`stopped, but port ${port} still looks busy \u2014 check \`cabane status\`.`);
+  else warn2(`stopped, but port ${port} still looks busy \u2014 check \`cabane status\`.`);
 }
 async function killPid(pid) {
   try {
@@ -766,14 +583,14 @@ async function killPid(pid) {
 }
 function readState(file) {
   try {
-    return JSON.parse(readFileSync5(file, "utf8"));
+    return JSON.parse(readFileSync4(file, "utf8"));
   } catch {
     return {};
   }
 }
 function readPid(file) {
   try {
-    const pid = Number(readFileSync5(file, "utf8").trim());
+    const pid = Number(readFileSync4(file, "utf8").trim());
     return pid > 0 ? pid : null;
   } catch {
     return null;
@@ -781,13 +598,13 @@ function readPid(file) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { isAbsolute, join as join5, resolve } from "path";
+import { isAbsolute, join as join4, resolve } from "path";
 
 // src/artifact.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 function readTarballManifest(tarball) {
   const raw = execFileSync("tar", ["-xzOf", tarball, "./manifest.json"], {
     maxBuffer: 16 * 1024 * 1024
@@ -805,7 +622,7 @@ async function npmInstall(appDir) {
   });
 }
 function isInstalled(appDir) {
-  return existsSync4(appDir) && existsSync4(`${appDir}/node_modules`) && existsSync4(`${appDir}/server.js`);
+  return existsSync3(appDir) && existsSync3(`${appDir}/node_modules`) && existsSync3(`${appDir}/server.js`);
 }
 
 // src/prompt.ts
@@ -846,14 +663,13 @@ async function promptSecret(question) {
 }
 
 // src/commands/init.ts
-var EXECUTOR_KEY = "ANTHROPIC_API_KEY";
 async function init() {
   if (!isInteractive()) {
     throw new Error(
       "`cabane init` is an interactive wizard \u2014 run it in a terminal, or configure non-interactively with `cabane install --port \u2026` + `cabane set-env KEY=VALUE`."
     );
   }
-  assertNotForeignBridge();
+  assertNotForeignCompanion();
   const root = cabaneHome();
   const config = loadConfig();
   step("Configure your self-hosted Cabane");
@@ -869,9 +685,9 @@ async function init() {
   const defaultDataDir = resolvePaths(root).dataDir;
   config.dataDir = dataDir === defaultDataDir ? void 0 : dataDir;
   const oldPg = pathsFor(loadConfig(), root).pgDataDir;
-  const newPg = join5(dataDir, "pg");
-  if (oldPg !== newPg && existsSync5(join5(oldPg, "PG_VERSION"))) {
-    warn(`existing database at ${oldPg} will NOT move \u2014 a fresh one initializes at ${newPg}.`);
+  const newPg = join4(dataDir, "pg");
+  if (oldPg !== newPg && existsSync4(join4(oldPg, "PG_VERSION"))) {
+    warn2(`existing database at ${oldPg} will NOT move \u2014 a fresh one initializes at ${newPg}.`);
     info(
       "to keep your current data, copy that directory over, or leave the location unchanged."
     );
@@ -888,15 +704,6 @@ async function init() {
     }
     config.publicUrl = urlAnswer.replace(/\/$/, "");
   }
-  info("");
-  info(
-    `Executor API key \u2014 for API-key billing (stored as ${EXECUTOR_KEY}). Leave blank if your`
-  );
-  info("executor is already logged in (e.g. a Claude subscription under ~/.claude).");
-  const key = await promptSecret(`${EXECUTOR_KEY} (hidden, blank to skip): `);
-  if (key) {
-    config.bridgeEnv = { ...config.bridgeEnv ?? {}, [EXECUTOR_KEY]: key };
-  }
   saveConfig(config, root);
   const paths = pathsFor(config, root);
   info("");
@@ -906,9 +713,6 @@ async function init() {
   info(`  database  ${paths.pgDataDir}`);
   info(`  port      ${config.port}`);
   info(`  url       ${config.publicUrl ?? `http://localhost:${config.port}`}`);
-  info(
-    `  ${EXECUTOR_KEY}  ${config.bridgeEnv?.[EXECUTOR_KEY] ? mask(config.bridgeEnv[EXECUTOR_KEY]) : "(not set \u2014 using on-disk executor auth)"}`
-  );
   info("");
   const installed = config.currentVersion && isInstalled(appDirFor(paths, config.currentVersion));
   if (installed) {
@@ -920,7 +724,7 @@ async function init() {
 function expandPath(input, root) {
   let p = input;
   if (p === "~") p = homedir3();
-  else if (p.startsWith("~/")) p = join5(homedir3(), p.slice(2));
+  else if (p.startsWith("~/")) p = join4(homedir3(), p.slice(2));
   return isAbsolute(p) ? p : resolve(root, p);
 }
 async function promptPort(current) {
@@ -930,20 +734,16 @@ async function promptPort(current) {
     if (!answer) return current;
     const n = Number(answer);
     if (Number.isInteger(n) && n > 0 && n <= 65535) return n;
-    warn(`invalid port: ${answer} \u2014 enter a number between 1 and 65535.`);
+    warn2(`invalid port: ${answer} \u2014 enter a number between 1 and 65535.`);
   }
   throw new Error("no valid port after several tries \u2014 re-run `cabane init`.");
 }
-function mask(value) {
-  if (value.length <= 8) return "\u2022\u2022\u2022\u2022";
-  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
-}
 
 // src/commands/install.ts
 import { randomBytes } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, rmSync as rmSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join6 } from "path";
+import { join as join5 } from "path";
 
 // src/dist.ts
 import { createHash } from "crypto";
@@ -994,10 +794,10 @@ async function downloadArtifact(distBase, token, manifest, destPath) {
 
 // src/commands/install.ts
 async function install(opts) {
-  assertNotForeignBridge();
+  assertNotForeignCompanion();
   const config = loadConfig();
   const paths = pathsFor(config);
-  const dataExisted = existsSync6(paths.dataDir);
+  const dataExisted = existsSync5(paths.dataDir);
   if (opts.distBase) config.distBase = opts.distBase.replace(/\/$/, "");
   if (opts.port) config.port = opts.port;
   mkdirSync3(paths.appsDir, { recursive: true });
@@ -1005,7 +805,7 @@ async function install(opts) {
   let version;
   let cleanup = null;
   if (opts.from) {
-    if (!existsSync6(opts.from)) throw new Error(`--from tarball not found: ${opts.from}`);
+    if (!existsSync5(opts.from)) throw new Error(`--from tarball not found: ${opts.from}`);
     tarball = opts.from;
     version = readTarballManifest(tarball).version;
     step(`installing from local tarball \u2192 version ${version}`);
@@ -1021,18 +821,18 @@ async function install(opts) {
     }
     version = manifest.version;
     info(`resolved ${version} (${(manifest.bytes / 1024 / 1024).toFixed(1)} MB)`);
-    const tmp = join6(tmpdir(), `cabane-artifact-${Date.now().toString(36)}.tgz`);
+    const tmp = join5(tmpdir(), `cabane-artifact-${Date.now().toString(36)}.tgz`);
     await downloadArtifact(config.distBase, token, manifest, tmp);
     ok("downloaded + sha256 verified");
     tarball = tmp;
-    cleanup = () => rmSync4(tmp, { force: true });
+    cleanup = () => rmSync3(tmp, { force: true });
   }
   try {
     const appDir = appDirFor(paths, version);
     if (isInstalled(appDir) && !opts.force) {
       info(`version ${version} already installed \u2014 reusing (pass --force to reinstall)`);
     } else {
-      rmSync4(appDir, { recursive: true, force: true });
+      rmSync3(appDir, { recursive: true, force: true });
       step(`unpacking \u2192 ${appDir}`);
       unpackArtifact(tarball, appDir);
       step("npm install --omit=dev (runtime deps)\u2026");
@@ -1055,11 +855,11 @@ async function resolveToken(opts, config) {
   if (opts.token) return opts.token.trim();
   if (config.distToken) return config.distToken;
   if (isInteractive()) {
-    const t = await promptSecret("Paste your Cabane access token (cabdist_\u2026): ");
+    const t = await promptSecret("Paste your Cabane install token (cabdist_\u2026): ");
     if (t) return t;
   }
   throw new Error(
-    "no distribution token. Pass --token <cabdist_\u2026>, or --from <tarball> to install a local build."
+    "no install token. Pass --token <cabdist_\u2026>, or --from <tarball> to install a local build."
   );
 }
 function persistInstall(config, version) {
@@ -1072,49 +872,45 @@ function persistInstall(config, version) {
 }
 
 // src/commands/logs.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 async function logs(opts) {
   const paths = resolvePaths();
   const n = String(opts.lines ?? 80);
-  const targets = [];
-  if (opts.server || !opts.bridge) targets.push(paths.serverLog);
-  if (opts.bridge || !opts.server) targets.push(paths.bridgeLog);
-  const present = targets.filter((t) => existsSync7(t));
-  if (present.length === 0) {
+  if (!existsSync6(paths.serverLog)) {
     info("no logs yet \u2014 start the stack with `cabane up`.");
     return;
   }
-  const args = opts.follow ? ["-n", n, "-F", ...present] : ["-n", n, ...present];
+  const args = opts.follow ? ["-n", n, "-F", paths.serverLog] : ["-n", n, paths.serverLog];
   await run("tail", args, { stdio: ["ignore", "inherit", "inherit"] });
 }
 
 // src/commands/set-env.ts
 var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function mask2(value) {
+function mask(value) {
   if (value.length <= 8) return "\u2022\u2022\u2022\u2022";
   return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
 }
 function printList() {
-  const env = loadConfig().bridgeEnv ?? {};
+  const env = loadConfig().companionEnv ?? {};
   const keys = Object.keys(env);
   if (keys.length === 0) {
-    info("no persisted bridge env. Add one: `cabane set-env ANTHROPIC_API_KEY=\u2026`");
+    info("no persisted server env. Add one: `cabane set-env KEY=VALUE`");
     return;
   }
-  step("persisted bridge env:");
-  for (const key of keys) info(`${key}=${mask2(env[key])}`);
+  step("persisted server env:");
+  for (const key of keys) info(`${key}=${mask(env[key])}`);
 }
 async function setEnv(pairs, opts) {
   if (opts.list || pairs.length === 0 && !opts.unset?.length) {
     printList();
     return;
   }
-  assertNotForeignBridge();
+  assertNotForeignCompanion();
   if (opts.unset?.length) {
     updateConfig((config) => {
-      if (!config.bridgeEnv) return;
-      for (const key of opts.unset) delete config.bridgeEnv[key];
-      if (Object.keys(config.bridgeEnv).length === 0) delete config.bridgeEnv;
+      if (!config.companionEnv) return;
+      for (const key of opts.unset) delete config.companionEnv[key];
+      if (Object.keys(config.companionEnv).length === 0) delete config.companionEnv;
     });
     ok(`unset ${opts.unset.join(", ")}`);
   }
@@ -1141,16 +937,13 @@ async function setEnv(pairs, opts) {
   }
   if (Object.keys(parsed).length > 0) {
     updateConfig((config) => {
-      config.bridgeEnv = { ...config.bridgeEnv ?? {}, ...parsed };
+      config.companionEnv = { ...config.companionEnv ?? {}, ...parsed };
     });
-    for (const key of Object.keys(parsed)) ok(`set ${key}=${mask2(parsed[key])}`);
+    for (const key of Object.keys(parsed)) ok(`set ${key}=${mask(parsed[key])}`);
     info("restart to apply: `cabane down && cabane up --daemon`");
   }
 }
 
-// src/commands/setup-agent.ts
-import { existsSync as existsSync10 } from "fs";
-
 // src/api.ts
 var ApiError = class extends Error {
   constructor(message, status2, body) {
@@ -1196,10 +989,13 @@ function makeClient(base, token) {
 }
 
 // src/env-compose.ts
-import { join as join7 } from "path";
+import { join as join6 } from "path";
 function composeServerEnv(opts) {
-  const dataDir = join7(opts.appDir, "data");
+  const dataDir = join6(opts.appDir, "data");
   return {
+    // Persisted operator creds FIRST so the composed infra vars below always win —
+    // an operator can't shadow DATABASE_URL / NODE_ENV.
+    ...opts.persistedEnv ?? {},
     NODE_ENV: "production",
     PORT: String(opts.port),
     DATABASE_URL: opts.databaseUrl,
@@ -1209,24 +1005,11 @@ function composeServerEnv(opts) {
     PUBLIC_BASE_URL: opts.publicBaseUrl?.replace(/\/$/, "") || `http://localhost:${opts.port}`,
     VISION_URL_SIGNING_SECRET: opts.visionSecret,
     // Runtime file-read overrides → the artifact's own data/ tree.
-    CABANE_API_ROOT: join7(dataDir, "api"),
-    CABANE_SKILLS_DIR: join7(dataDir, "skills"),
-    CABANE_DOCS_CONTENT_DIR: join7(dataDir, "docs-content"),
-    CABANE_WELCOME_DIR: join7(dataDir, "welcome"),
-    ...opts.houseOwnerUserId ? { CABANE_HOUSE_OWNER_USER_ID: opts.houseOwnerUserId } : {},
+    CABANE_API_ROOT: join6(dataDir, "api"),
+    CABANE_SKILLS_DIR: join6(dataDir, "skills"),
     ...opts.appVersion ? { CABANE_APP_VERSION: opts.appVersion } : {}
   };
 }
-function composeBridgeEnv(opts) {
-  return {
-    ...opts.persistedEnv,
-    ...opts.parentEnv,
-    CABANE_BRIDGE_HOME: opts.bridgeHome,
-    ...opts.claudeConfigDir ? { CLAUDE_CONFIG_DIR: opts.claudeConfigDir } : {},
-    BRIDGE_NO_OPEN: "1",
-    CABANE_BRIDGE_CLASS: "house"
-  };
-}
 function localBaseUrl(port) {
   return `http://localhost:${port}`;
 }
@@ -1234,123 +1017,123 @@ function embeddedDatabaseUrl(port) {
   return `postgres://cabane:cabane@127.0.0.1:${port}/cabane`;
 }
 
-// src/supervisor/house-bridge.ts
-import { spawn as spawn2 } from "child_process";
-import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, join as join8 } from "path";
-var PAIRING_VERSION = 1;
-function resolveBridgeBin(appDir) {
-  const pkgPath = join8(appDir, "bridge", "package.json");
-  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
-  const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["cabane-bridge"];
-  if (!rel) {
-    throw new Error(
-      `the installed artifact's bridge (${pkgPath}) exposes no cabane-bridge bin \u2014 reinstall.`
+// src/commands/setup-agent.ts
+async function setupAgent(opts) {
+  const config = loadConfig();
+  const base = localBaseUrl(config.port);
+  const instanceUrl = config.publicUrl ?? base;
+  if (!await healthy(config.port)) {
+    throw new Error(`server is not up on ${base} \u2014 run \`cabane up\` and sign up first.`);
+  }
+  const token = await resolvePat(opts, base);
+  const client = makeClient(base, token);
+  const me = await client.get("/api/auth/me");
+  ok(`owner resolved (${me.user.id})`);
+  const assignment = await defaultAgentAssignment(client);
+  info("");
+  if (assignment.kind === "unavailable") {
+    info("Agent assignment could not be checked. Open Cabane to verify it.");
+    return;
+  }
+  const { username, executor } = assignment.agent;
+  if (executor.deviceId) {
+    info(`Agent @${username} is assigned to ${executor.deviceLabel}.`);
+    return;
+  }
+  info(`Agent @${username} has no device assigned.`);
+  info("  1. Install the Companion \u2014 the desktop app, or the headless `@cabane/companion`.");
+  info(`  2. Sign in against this instance (${instanceUrl}) and pair the device.`);
+  info(
+    `  3. Assign @${username} to the device, then choose a connector on it and message the agent in the app.`
+  );
+}
+async function healthy(port) {
+  try {
+    return (await fetch(`http://127.0.0.1:${port}/healthz`)).ok;
+  } catch {
+    return false;
+  }
+}
+async function resolvePat(opts, base) {
+  if (opts.token) return opts.token.trim();
+  if (isInteractive()) {
+    info(`mint a token in the app: ${base} \u2192 Settings \u2192 Developer \u2192 tokens`);
+    const t = await promptSecret("Paste a Cabane access token (cab_\u2026): ");
+    if (t) return t;
+  }
+  throw new Error("no access token. Pass --token <cab_\u2026> (mint it in Settings \u2192 Developer).");
+}
+async function defaultAgentAssignment(client) {
+  try {
+    const { workspaces } = await client.get("/api/workspaces");
+    const workspace = workspaces.find((w) => w.role === "owner") ?? workspaces[0];
+    if (!workspace) return { kind: "unavailable" };
+    const { agents } = await client.get(
+      `/api/workspaces/${workspace.id}/agents`
     );
+    const agent = workspace.defaultAgentId && agents.find((a) => a.id === workspace.defaultAgentId) || agents.find((a) => a.username === "cabane") || agents[0];
+    if (!agent?.username || !agent.executor) return { kind: "unavailable" };
+    if (agent.executor.deviceId && !agent.executor.deviceLabel) return { kind: "unavailable" };
+    return { kind: "resolved", agent };
+  } catch {
+    return { kind: "unavailable" };
   }
-  return join8(dirname3(pkgPath), rel);
 }
-function encodePairingString(input) {
-  const payload = {
-    v: PAIRING_VERSION,
-    baseUrl: input.baseUrl,
-    deviceToken: input.deviceToken,
-    ...input.deviceId ? { deviceId: input.deviceId } : {},
-    ...input.deviceLabel ? { deviceLabel: input.deviceLabel } : {}
+
+// src/commands/status.ts
+import { readFileSync as readFileSync5 } from "fs";
+async function status() {
+  const config = loadConfig();
+  const paths = pathsFor(config);
+  const state = readState2(paths.stateFile);
+  const supervisorPid = readSupervisorPid(paths.supervisorPidFile) ?? state.supervisorPid;
+  const supervisorUp = supervisorPid ? pidAlive(supervisorPid) : false;
+  const serverUp = await healthy2(config.port);
+  const line = (label, value) => {
+    process.stdout.write(`  ${label.padEnd(12)}${value}
+`);
   };
-  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  process.stdout.write("cabane\n");
+  line("version", config.currentVersion ?? "(not installed)");
+  if (config.previousVersion) line("previous", config.previousVersion);
+  line("port", String(config.port));
+  line("home", paths.root);
+  line("data", `${paths.dataDir} (pg + storage \xB7 kept across upgrades)`);
+  line("supervisor", supervisorUp ? `up (pid ${supervisorPid})` : "down");
+  line("server", serverUp ? `up \xB7 http://localhost:${config.port}` : "down");
+  if (!supervisorUp) info("start it: cabane up");
 }
-async function pairBridge(opts) {
-  mkdirSync4(opts.bridgeHome, { recursive: true });
-  const pairingString = encodePairingString(opts);
-  const tmp = join8(opts.bridgeHome, `.pairing-${process.pid}.txt`);
-  writeFileSync3(tmp, pairingString, { mode: 384 });
+function readState2(file) {
   try {
-    await run("node", [resolveBridgeBin(opts.appDir), "pair", "--file", tmp], {
-      env: {
-        PATH: process.env.PATH ?? "",
-        ...process.env.HOME ? { HOME: process.env.HOME } : {},
-        CABANE_BRIDGE_HOME: opts.bridgeHome
-      }
-    });
-  } finally {
-    rmSync5(tmp, { force: true });
+    return JSON.parse(readFileSync5(file, "utf8"));
+  } catch {
+    return {};
   }
-  ok("bridge paired");
 }
-function bridgeConfigPath(bridgeHome) {
-  return join8(bridgeHome, ".cabane", "config.json");
-}
-function readBridgeConfig(bridgeHome) {
+function readSupervisorPid(file) {
   try {
-    return JSON.parse(readFileSync6(bridgeConfigPath(bridgeHome), "utf8"));
+    const pid = Number(readFileSync5(file, "utf8").trim());
+    return pid > 0 ? pid : null;
   } catch {
     return null;
   }
 }
-var BridgeChild = class {
-  constructor(appDir, bridgeHome, claudeConfigDir, logFile, persistedEnv) {
-    this.appDir = appDir;
-    this.bridgeHome = bridgeHome;
-    this.claudeConfigDir = claudeConfigDir;
-    this.logFile = logFile;
-    this.persistedEnv = persistedEnv;
-  }
-  appDir;
-  bridgeHome;
-  claudeConfigDir;
-  logFile;
-  persistedEnv;
-  child = null;
-  /** Spawn `cabane-bridge start --no-open` with the forwarded shell env under the
-   * house-class overrides (CT480). */
-  start() {
-    const out = openSync(this.logFile, "a");
-    this.child = spawn2("node", [resolveBridgeBin(this.appDir), "start", "--no-open"], {
-      env: composeBridgeEnv({
-        parentEnv: process.env,
-        bridgeHome: this.bridgeHome,
-        claudeConfigDir: this.claudeConfigDir,
-        persistedEnv: this.persistedEnv
-      }),
-      stdio: ["ignore", out, out]
-    });
-    this.child.on("exit", (code, signal) => {
-      if (code && code !== 0)
-        warn(`bridge exited (code ${code}${signal ? `, ${signal}` : ""})`);
-      this.child = null;
-    });
-    ok("house bridge started");
-  }
-  get running() {
-    return this.child !== null;
-  }
-  get pid() {
-    return this.child?.pid;
-  }
-  async stop() {
-    const child = this.child;
-    if (!child) return;
-    this.child = null;
-    await new Promise((resolve2) => {
-      const kill9 = setTimeout(() => child.kill("SIGKILL"), 5e3);
-      child.once("exit", () => {
-        clearTimeout(kill9);
-        resolve2();
-      });
-      child.kill("SIGTERM");
-    });
+async function healthy2(port) {
+  try {
+    return (await fetch(`http://127.0.0.1:${port}/healthz`)).ok;
+  } catch {
+    return false;
   }
-};
+}
 
 // src/commands/up.ts
-import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync7, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync6, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 
 // src/supervisor/postgres.ts
-import { existsSync as existsSync8 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { join as join7 } from "path";
 import EmbeddedPostgres from "embedded-postgres";
 var EmbeddedPg = class {
   constructor(dataDir, port) {
@@ -1373,11 +1156,11 @@ var EmbeddedPg = class {
       onLog: () => {
       },
       // quiet — pg writes its own logs under the data dir
-      onError: (err) => warn(`[pg] ${err instanceof Error ? err.message : String(err)}`)
+      onError: (err) => warn2(`[pg] ${err instanceof Error ? err.message : String(err)}`)
     });
   }
   initialised() {
-    return existsSync8(join9(this.dataDir, "PG_VERSION"));
+    return existsSync7(join7(this.dataDir, "PG_VERSION"));
   }
   /** Init (first run) + start the postmaster + ensure the app database exists. */
   async start() {
@@ -1405,8 +1188,8 @@ var EmbeddedPg = class {
 };
 
 // src/supervisor/server.ts
-import { openSync as openSync2 } from "fs";
-import { spawn as spawn3 } from "child_process";
+import { openSync } from "fs";
+import { spawn as spawn2 } from "child_process";
 var ServerChild = class {
   constructor(appDir, env, port, logFile) {
     this.appDir = appDir;
@@ -1439,15 +1222,15 @@ var ServerChild = class {
   }
   /** Spawn `node server.js` and wait for /healthz. */
   async start() {
-    const out = openSync2(this.logFile, "a");
-    this.child = spawn3("node", ["server.js"], {
+    const out = openSync(this.logFile, "a");
+    this.child = spawn2("node", ["server.js"], {
       cwd: this.appDir,
       env: this.childEnv(),
       stdio: ["ignore", out, out]
     });
     this.child.on("exit", (code, signal) => {
       if (code && code !== 0)
-        warn(`server exited (code ${code}${signal ? `, ${signal}` : ""})`);
+        warn2(`server exited (code ${code}${signal ? `, ${signal}` : ""})`);
       this.child = null;
     });
     const healthy3 = await waitUntil(() => this.healthy(), { timeoutMs: 45e3, intervalMs: 500 });
@@ -1512,18 +1295,18 @@ async function up(opts) {
   await new Supervisor(paths, appDir, config.port).run();
 }
 async function launchDaemon(paths, config) {
-  if (existsSync9(paths.supervisorPidFile)) {
-    const pid = Number(readFileSync7(paths.supervisorPidFile, "utf8").trim());
+  if (existsSync8(paths.supervisorPidFile)) {
+    const pid = Number(readFileSync6(paths.supervisorPidFile, "utf8").trim());
     if (pid && pidAlive(pid)) {
-      warn(`already running (supervisor pid ${pid}). Use \`cabane down\` to stop it.`);
+      warn2(`already running (supervisor pid ${pid}). Use \`cabane down\` to stop it.`);
       return;
     }
   }
-  mkdirSync5(paths.logsDir, { recursive: true });
+  mkdirSync4(paths.logsDir, { recursive: true });
   const entry = process.argv[1];
   if (!entry) throw new Error("cannot locate the cabane CLI entry to run in the background.");
-  const out = openSync3(paths.serverLog, "a");
-  const child = spawn4(process.execPath, [entry, "up", "--port", String(config.port)], {
+  const out = openSync2(paths.serverLog, "a");
+  const child = spawn3(process.execPath, [entry, "up", "--port", String(config.port)], {
     detached: true,
     stdio: ["ignore", out, out]
   });
@@ -1544,18 +1327,13 @@ async function launchDaemon(paths, config) {
     throw new Error(`background start did not come healthy within 60s \u2014 see ${paths.serverLog}`);
   }
   ok(`running in the background on http://localhost:${config.port}`);
-  for (const line of daemonFooter(config)) info(line);
-}
-function daemonFooter(config) {
-  const lines = [];
-  if (!config.houseOwnerUserId) {
-    lines.push("next: open the URL, sign up, then `cabane setup-agent`");
-  }
-  lines.push("logs: cabane logs \xB7 stop: cabane down");
-  return lines;
+  for (const line of daemonFooter()) info(line);
 }
-function resolveClaudeConfigDir(env = process.env) {
-  return env.CLAUDE_CONFIG_DIR;
+function daemonFooter() {
+  return [
+    "next: open the URL, sign up, then pair a companion so your agents can answer \u2014 `cabane setup-agent` explains how",
+    "logs: cabane logs \xB7 stop: cabane down"
+  ];
 }
 var Supervisor = class {
   constructor(paths, appDir, port) {
@@ -1569,7 +1347,6 @@ var Supervisor = class {
   port;
   pg;
   server = null;
-  bridge = null;
   shuttingDown = false;
   buildServer() {
     const config = loadConfig();
@@ -1580,9 +1357,11 @@ var Supervisor = class {
       storageRoot: this.paths.storageRoot,
       visionSecret: config.visionSecret,
       ...config.publicUrl ? { publicBaseUrl: config.publicUrl } : {},
-      ...config.houseOwnerUserId ? { houseOwnerUserId: config.houseOwnerUserId } : {},
-      // CT484: the artifact's build version → the server reports it on the bridge
-      // heartbeat so a bridge/server skew is detectable. Read from the installed
+      // Persisted `cabane set-env` creds (generic server env) are layered beneath
+      // the composed infra vars.
+      ...config.companionEnv ? { persistedEnv: config.companionEnv } : {},
+      // CT484: the artifact's build version → the server reports it on the companion
+      // heartbeat so a companion/server skew is detectable. Read from the installed
       // tree's package.json (stamped at build); best-effort.
       ...(() => {
         const v = readAppVersion(this.appDir);
@@ -1591,51 +1370,25 @@ var Supervisor = class {
     });
     return new ServerChild(this.appDir, env, this.port, this.paths.serverLog);
   }
-  /** Start the bridge child iff it is configured (registered + paired) and not
-   * already running. */
-  ensureBridge() {
-    if (this.bridge?.running) return;
-    const config = loadConfig();
-    const paired = readBridgeConfig(this.paths.bridgeHome)?.deviceId;
-    if (!config.houseDeviceId || !paired) return;
-    const claudeConfigDir = resolveClaudeConfigDir();
-    this.bridge = new BridgeChild(
-      this.appDir,
-      this.paths.bridgeHome,
-      claudeConfigDir,
-      this.paths.bridgeLog,
-      config.bridgeEnv
-    );
-    try {
-      this.bridge.start();
-    } catch (err) {
-      this.bridge = null;
-      warn(`house bridge could not start: ${err instanceof Error ? err.message : String(err)}`);
-      info(
-        "the server is up; agents will not answer until this is resolved (try `cabane update`)."
-      );
-    }
-  }
   /** Publish the supervisor pid as early as possible so `status` / `down` /
    * `setup-agent` can find us the instant `up --daemon` returns (the daemon
    * launcher only waits on /healthz, which comes up before the children are all
    * wired). */
   writePid() {
-    mkdirSync5(this.paths.runDir, { recursive: true });
-    writeFileSync4(this.paths.supervisorPidFile, `${process.pid}
+    mkdirSync4(this.paths.runDir, { recursive: true });
+    writeFileSync3(this.paths.supervisorPidFile, `${process.pid}
 `);
   }
   writeState() {
-    mkdirSync5(this.paths.runDir, { recursive: true });
-    writeFileSync4(this.paths.supervisorPidFile, `${process.pid}
+    mkdirSync4(this.paths.runDir, { recursive: true });
+    writeFileSync3(this.paths.supervisorPidFile, `${process.pid}
 `);
-    writeFileSync4(
+    writeFileSync3(
       this.paths.stateFile,
       JSON.stringify(
         {
           supervisorPid: process.pid,
           serverPid: this.server?.pid ?? null,
-          bridgePid: this.bridge?.pid ?? null,
           port: this.port,
           // Bumped on every (re)write — a completed reload advances it, which is
           // how `setup-agent` knows a restart it requested actually finished
@@ -1648,8 +1401,8 @@ var Supervisor = class {
     );
   }
   async run() {
-    mkdirSync5(this.paths.logsDir, { recursive: true });
-    mkdirSync5(this.paths.storageRoot, { recursive: true });
+    mkdirSync4(this.paths.logsDir, { recursive: true });
+    mkdirSync4(this.paths.storageRoot, { recursive: true });
     this.writePid();
     step("starting embedded Postgres\u2026");
     await this.pg.start();
@@ -1657,27 +1410,25 @@ var Supervisor = class {
     step("starting server\u2026");
     await this.server.migrate();
     await this.server.start();
-    this.ensureBridge();
     this.writeState();
     process.on("SIGINT", () => void this.teardown("SIGINT"));
     process.on("SIGTERM", () => void this.teardown("SIGTERM"));
     process.on("exit", () => {
-      for (const pid of [this.bridge?.pid, this.server?.pid]) {
-        if (pid) {
-          try {
-            process.kill(pid, "SIGKILL");
-          } catch {
-          }
+      const pid = this.server?.pid;
+      if (pid) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
         }
       }
     });
     process.on(
       "uncaughtException",
-      (err) => warn(`ignoring uncaught error: ${err instanceof Error ? err.message : String(err)}`)
+      (err) => warn2(`ignoring uncaught error: ${err instanceof Error ? err.message : String(err)}`)
     );
     process.on(
       "unhandledRejection",
-      (err) => warn(`ignoring unhandled rejection: ${err instanceof Error ? err.message : String(err)}`)
+      (err) => warn2(`ignoring unhandled rejection: ${err instanceof Error ? err.message : String(err)}`)
     );
     ok("cabane is up \u2014 Ctrl-C to stop");
     await new Promise(() => {
@@ -1687,207 +1438,23 @@ var Supervisor = class {
     if (this.shuttingDown) return;
     this.shuttingDown = true;
     step(`${signal} \u2014 stopping children\u2026`);
-    await this.bridge?.stop();
     await this.server?.stop();
     await this.pg.stop();
-    rmSync6(this.paths.supervisorPidFile, { force: true });
-    rmSync6(this.paths.stateFile, { force: true });
+    rmSync4(this.paths.supervisorPidFile, { force: true });
+    rmSync4(this.paths.stateFile, { force: true });
     ok("stopped cleanly");
     process.exit(0);
   }
 };
 function readAppVersion(appDir) {
   try {
-    const pkg = JSON.parse(readFileSync7(join10(appDir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync6(join8(appDir, "package.json"), "utf8"));
     return pkg.version ?? null;
   } catch {
     return null;
   }
 }
 
-// src/commands/setup-agent.ts
-var DEFAULT_AGENT_MODEL = "anthropic/claude-opus-4-8";
-var DEVICE_LABEL = "cabane-house-bridge";
-async function setupAgent(opts) {
-  const paths = resolvePaths();
-  const config = loadConfig();
-  const base = localBaseUrl(config.port);
-  const model = opts.model ?? DEFAULT_AGENT_MODEL;
-  if (!await healthy(config.port)) {
-    throw new Error(`server is not up on ${base} \u2014 run \`cabane up\` and sign up first.`);
-  }
-  if (!existsSync10(paths.supervisorPidFile)) {
-    throw new Error("no running supervisor found \u2014 start the stack with `cabane up` first.");
-  }
-  const restart = async () => {
-    await down();
-    await up({ daemon: true, port: config.port });
-  };
-  const token = await resolvePat(opts, base);
-  const client = makeClient(base, token);
-  const me = await client.get("/api/auth/me");
-  const ownerId = me.user.id;
-  ok(`owner resolved (${ownerId})`);
-  if (config.houseOwnerUserId !== ownerId) {
-    config.houseOwnerUserId = ownerId;
-    saveConfig(config);
-    step("applying ops identity to the server (restart)\u2026");
-    await restart();
-  }
-  const appDir = appDirFor(paths, config.currentVersion ?? "");
-  const deviceId = await ensureHouseDevice(client, config, appDir, paths.bridgeHome, base);
-  await assignDefaultAgent(client, deviceId, model);
-  step("starting the house bridge + assigning agents (restart)\u2026");
-  await restart();
-  const beating = await waitForHeartbeat(client, deviceId);
-  if (beating) ok("house bridge heartbeating \u2014 agents are live");
-  else warn("no bridge heartbeat yet \u2014 check `cabane logs`; it may need a minute");
-  ok("setup complete");
-  info("message your agent in the app \u2014 it should answer.");
-}
-async function healthy(port) {
-  try {
-    return (await fetch(`http://127.0.0.1:${port}/healthz`)).ok;
-  } catch {
-    return false;
-  }
-}
-async function resolvePat(opts, base) {
-  if (opts.token) return opts.token.trim();
-  if (isInteractive()) {
-    info(`mint a token in the app: ${base} \u2192 Settings \u2192 Developer \u2192 tokens`);
-    const t = await promptSecret("Paste a Cabane access token (cab_\u2026): ");
-    if (t) return t;
-  }
-  throw new Error("no access token. Pass --token <cab_\u2026> (mint it in Settings \u2192 Developer).");
-}
-async function ensureHouseDevice(client, config, appDir, bridgeHome, base) {
-  step("registering the house device\u2026");
-  let deviceId;
-  let deviceToken;
-  try {
-    const res = await client.post(
-      "/api/bridge-devices",
-      { label: DEVICE_LABEL, class: "house" }
-    );
-    deviceId = res.device.id;
-    deviceToken = res.deviceToken;
-  } catch (err) {
-    if (err instanceof ApiError && err.status === 409 && config.houseDeviceId) {
-      info(`reusing already-registered house device ${config.houseDeviceId}`);
-      return config.houseDeviceId;
-    }
-    throw err;
-  }
-  config.houseDeviceId = deviceId;
-  saveConfig(config);
-  await pairBridge({
-    appDir,
-    bridgeHome,
-    baseUrl: base,
-    deviceToken,
-    deviceId,
-    deviceLabel: DEVICE_LABEL
-  });
-  return deviceId;
-}
-async function assignDefaultAgent(client, deviceId, model) {
-  const { workspaces } = await client.get("/api/workspaces");
-  const workspace = workspaces.find((w) => w.role === "owner") ?? workspaces[0];
-  if (!workspace) throw new Error("the account owns no workspace \u2014 create one in the app first.");
-  const wsPath = `/api/workspaces/${workspace.id}`;
-  const { agents } = await client.get(
-    `${wsPath}/agents`
-  );
-  const agent = workspace.defaultAgentId && agents.find((a) => a.id === workspace.defaultAgentId) || agents.find((a) => a.username === "cabane") || agents[0];
-  if (!agent) throw new Error("the workspace has no agent to assign.");
-  const { runConfig } = await client.get(
-    `${wsPath}/agents/${agent.id}/run-config`
-  );
-  if (!runConfig?.model) {
-    info(`setting @${agent.username} model \u2192 ${model}`);
-    await client.put(`${wsPath}/agents/${agent.id}/run-config`, { ...runConfig ?? {}, model });
-  }
-  info(`assigning @${agent.username} \u2192 the house bridge`);
-  await client.put(`${wsPath}/agents/${agent.id}/executor`, { executor: "bridge", deviceId });
-}
-async function waitForHeartbeat(client, deviceId) {
-  return waitUntil(
-    async () => {
-      const { devices } = await client.get(
-        "/api/bridge-devices"
-      );
-      return Boolean(devices.find((d) => d.id === deviceId)?.lastSeenAt);
-    },
-    { timeoutMs: 9e4, intervalMs: 3e3 }
-  );
-}
-
-// src/commands/status.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
-function readBridgeCrash(bridgeHome) {
-  try {
-    const path = join11(bridgeHome, ".cabane", "last-error.json");
-    if (!existsSync11(path)) return null;
-    return JSON.parse(readFileSync8(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-async function status() {
-  const config = loadConfig();
-  const paths = pathsFor(config);
-  const state = readState2(paths.stateFile);
-  const supervisorPid = readSupervisorPid(paths.supervisorPidFile) ?? state.supervisorPid;
-  const supervisorUp = supervisorPid ? pidAlive(supervisorPid) : false;
-  const serverUp = await healthy2(config.port);
-  const bridgeUp = state.bridgePid ? pidAlive(state.bridgePid) : false;
-  const line = (label, value) => {
-    process.stdout.write(`  ${label.padEnd(12)}${value}
-`);
-  };
-  process.stdout.write("cabane\n");
-  line("version", config.currentVersion ?? "(not installed)");
-  if (config.previousVersion) line("previous", config.previousVersion);
-  line("port", String(config.port));
-  line("home", paths.root);
-  line("data", `${paths.dataDir} (pg + storage \xB7 kept across upgrades)`);
-  line("supervisor", supervisorUp ? `up (pid ${supervisorPid})` : "down");
-  line("server", serverUp ? `up \xB7 http://localhost:${config.port}` : "down");
-  const crash = bridgeUp ? null : readBridgeCrash(paths.bridgeHome);
-  line(
-    "bridge",
-    config.houseDeviceId ? bridgeUp ? "up" : crash ? `crashed \u2014 ${crash.reason}` : "configured \xB7 down" : "not set up (cabane setup-agent)"
-  );
-  if (!bridgeUp && crash) {
-    info("see why: cabane logs --bridge");
-  }
-  if (!supervisorUp) info("start it: cabane up");
-}
-function readState2(file) {
-  try {
-    return JSON.parse(readFileSync8(file, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function readSupervisorPid(file) {
-  try {
-    const pid = Number(readFileSync8(file, "utf8").trim());
-    return pid > 0 ? pid : null;
-  } catch {
-    return null;
-  }
-}
-async function healthy2(port) {
-  try {
-    return (await fetch(`http://127.0.0.1:${port}/healthz`)).ok;
-  } catch {
-    return false;
-  }
-}
-
 // src/commands/update.ts
 async function update(opts) {
   const config = loadConfig();
@@ -1922,20 +1489,18 @@ var parsePort = (raw) => {
   if (!Number.isInteger(n) || n <= 0 || n > 65535) throw new Error(`invalid port: ${raw}`);
   return n;
 };
-program.command("init").description("interactive first-run wizard: data location, port, and the executor credential").action(init);
+program.command("init").description("interactive first-run wizard: data location, port, and public URL").action(init);
 program.command("install").description("install the server artifact (token \u2192 gated download, or --from a local tarball)").option("--token <token>", "distribution token (cabdist_\u2026) \u2014 prompted if omitted").option("--from <tarball>", "install from a local artifact tarball instead of downloading").option("--dist-base <url>", "distribution origin to fetch from (default https://dist.cabane.ai)").option("--version <version>", "install a specific published version (default: latest)").option("--port <port>", "local port the server will listen on (default 3000)", parsePort).option("--force", "reinstall even if this version is already present").action(install);
-program.command("up").description("start + supervise the stack (Postgres, server, house bridge)").option("--daemon", "run in the background (terminal returns; stop with `cabane down`)").option("--port <port>", "override the configured port", parsePort).action(up);
-program.command("setup-agent").description("after browser signup: register the house bridge + put your agent on it").option("--token <token>", "a Cabane access token (cab_\u2026) \u2014 prompted if omitted").option("--model <model>", "model the agent runs (default anthropic/claude-opus-4-8)").action(setupAgent);
+program.command("up").description("start + supervise the stack (Postgres + server)").option("--daemon", "run in the background (terminal returns; stop with `cabane down`)").option("--port <port>", "override the configured port", parsePort).action(up);
+program.command("setup-agent").description("after browser signup: confirm your account and print companion-pairing guidance").option("--token <token>", "a Cabane access token (cab_\u2026) \u2014 prompted if omitted").action(setupAgent);
 program.command("update").description("install a newer published artifact (keeps the previous for rollback)").option("--token <token>", "distribution token (cabdist_\u2026) \u2014 defaults to the stored one").option("--dist-base <url>", "distribution origin to fetch from").option("--version <version>", "install a specific version instead of latest").action(update);
 program.command("set-env [pairs...]").description(
-  "persist credentials forwarded to the house bridge \u2014 `KEY=VALUE`, or a bare `KEY` to be prompted for the value (kept off shell history)"
+  "persist generic credentials forwarded to the server \u2014 `KEY=VALUE`, or a bare `KEY` to be prompted for the value (kept off shell history)"
 ).option("--unset <keys...>", "remove one or more persisted keys").option("--list", "list persisted keys (values masked)").action(setEnv);
 program.command("down").description("stop a running stack").action(down);
-var bridge = program.command("bridge").description("house-bridge maintenance");
-bridge.command("reset").description("clear the house bridge\u2019s resume state (cursors + dispatched/completed dedupe)").option("--force", "clear even while the bridge is running (takes effect next boot)").action(bridgeReset);
 program.command("status").description("show what is installed + running").action(status);
 program.command("doctor").description("preflight: diagnose common self-host failure classes (runs with the stack down)").action(doctor);
-program.command("logs").description("tail the server + bridge logs").option("-n, --lines <n>", "how many lines to show (default 80)", (v) => Number(v)).option("-f, --follow", "follow the logs (Ctrl-C to stop)").option("--server", "only the server log").option("--bridge", "only the bridge log").action(logs);
+program.command("logs").description("tail the server log").option("-n, --lines <n>", "how many lines to show (default 80)", (v) => Number(v)).option("-f, --follow", "follow the logs (Ctrl-C to stop)").action(logs);
 program.parseAsync(process.argv).catch((err) => {
   error(err instanceof Error ? err.message : String(err));
   process.exitCode = 1;