@cabane/companion 0.6.0 → 0.6.1

package/dist/runtime.js

@@ -13,7 +13,7 @@ import {
 } from "fs";
 import { homedir, userInfo } from "os";
 import { dirname, join } from "path";
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 
 // src/errors.ts
 var CompanionError = class extends Error {
@@ -46,9 +46,6 @@ var PrepareHookError = class extends CompanionError {
 };
 
 // src/pairing.ts
-import { z } from "zod";
-var PAIRING_VERSION = 1;
-var DEVICE_TOKEN_PREFIX = "cabdev_";
 function isAllowedBaseUrl(raw) {
   let url;
   try {
@@ -63,45 +60,24 @@ function isAllowedBaseUrl(raw) {
   }
   return false;
 }
-var pairingSchema = z.object({
-  // Bumped if the wire shape changes incompatibly. We only accept v1.
-  v: z.literal(PAIRING_VERSION),
-  baseUrl: z.string().url().refine(isAllowedBaseUrl, {
-    message: "baseUrl must be https (loopback http is allowed for local dev only)"
-  }),
-  // The `cabdev_` device token plaintext — the companion's one durable credential.
-  deviceToken: z.string().min(1).startsWith(DEVICE_TOKEN_PREFIX, {
-    message: 'deviceToken must be a cabane device token (starts with "cabdev_")'
-  }),
-  // Optional identity hints the app may include for nicer local display. The
-  // companion also learns these from the first assignments pull, so they're not
-  // required.
-  deviceId: z.string().min(1).optional(),
-  deviceLabel: z.string().min(1).optional()
-});
 
 // src/prepare-hook.ts
 import { spawn } from "child_process";
-import { z as z2 } from "zod";
-var prepareHookSchema = z2.object({
-  command: z2.string().min(1),
-  args: z2.array(z2.string()).optional(),
+import { z } from "zod";
+var prepareHookSchema = z.object({
+  command: z.string().min(1),
+  args: z.array(z.string()).optional(),
   // Extra env handed to the hook process itself (merged over process.env).
-  env: z2.record(z2.string(), z2.string()).optional(),
+  env: z.record(z.string(), z.string()).optional(),
   // Wall-clock cap for the hook. Provisioning is slow (minutes), so the
   // default is generous; a hook that hangs past this is killed and the turn
   // fails with a clear timeout message rather than pinning the companion.
-  timeoutMs: z2.number().int().positive().optional()
+  timeoutMs: z.number().int().positive().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
-var prepareResultSchema = z2.object({
-  cwd: z2.string().min(1),
-  env: z2.record(z2.string(), z2.string()).optional(),
-  nativeWorkAssignment: z2.object({
-    itemId: z2.string(),
-    executionId: z2.string(),
-    activationEpoch: z2.number().int().nonnegative()
-  }).strict().optional()
+var prepareResultSchema = z.object({
+  cwd: z.string().min(1),
+  env: z.record(z.string(), z.string()).optional()
 });
 function parsePrepareOutput(stdout) {
   const last = stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).at(-1);
@@ -120,13 +96,12 @@ function parsePrepareOutput(stdout) {
     const r = prepareResultSchema.safeParse(parsed);
     if (!r.success) {
       throw new PrepareHookError(
-        'prepare hook JSON must carry a non-empty string "cwd" (plus optional "env" or "nativeWorkAssignment")'
+        'prepare hook JSON must carry a non-empty string "cwd" (plus optional "env")'
       );
     }
     return {
       cwd: r.data.cwd,
-      ...r.data.env ? { env: r.data.env } : {},
-      ...r.data.nativeWorkAssignment ? { nativeWorkAssignment: r.data.nativeWorkAssignment } : {}
+      ...r.data.env ? { env: r.data.env } : {}
     };
   }
   return { cwd: last };
@@ -164,10 +139,10 @@ var runPrepareHook = (hook, input) => {
           CABANE_CONVERSATION_TITLE: input.title ?? ""
         }
       });
-    } catch (err2) {
+    } catch (err) {
       reject(
         new PrepareHookError(
-          `prepare hook failed to start: ${err2 instanceof Error ? err2.message : String(err2)}`
+          `prepare hook failed to start: ${err instanceof Error ? err.message : String(err)}`
         )
       );
       return;
@@ -187,8 +162,8 @@ var runPrepareHook = (hook, input) => {
     child.stderr?.on("data", (d) => {
       stderr += d.toString();
     });
-    child.on("error", (err2) => {
-      finish(() => reject(new PrepareHookError(`prepare hook failed to start: ${err2.message}`)));
+    child.on("error", (err) => {
+      finish(() => reject(new PrepareHookError(`prepare hook failed to start: ${err.message}`)));
     });
     child.on("close", (code) => {
       finish(() => {
@@ -201,8 +176,8 @@ var runPrepareHook = (hook, input) => {
         }
         try {
           resolve(parsePrepareOutput(stdout));
-        } catch (err2) {
-          reject(err2 instanceof PrepareHookError ? err2 : new PrepareHookError(String(err2)));
+        } catch (err) {
+          reject(err instanceof PrepareHookError ? err : new PrepareHookError(String(err)));
         }
       });
     });
@@ -241,8 +216,8 @@ function cabaneDir() {
 function configPath() {
   return join(cabaneDir(), "config.json");
 }
-var localAgentConfigSchema = z3.object({
-  cwd: z3.string().optional(),
+var localAgentConfigSchema = z2.object({
+  cwd: z2.string().optional(),
   prepareHook: prepareHookSchema.optional(),
   // CT289: the Claude Code auto-memory escape hatch. Auto-memory is forced OFF
   // by default on every companion (memory belongs in the Cabane workspace, and a
@@ -251,13 +226,13 @@ var localAgentConfigSchema = z3.object({
   // auto-memory back to your own `~/.claude/settings.json` — Cabane then stops
   // injecting the off switch and your normal Claude Code memory workflow applies
   // (in coding mode, where the checkout's project settings are read).
-  claudeCode: z3.object({ autoMemory: z3.boolean().optional() }).strict().optional()
+  claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional()
 }).strict();
-var companionConfigSchema = z3.object({
+var companionConfigSchema = z2.object({
   // The cabane instance this device is paired with. SJ515: https-enforced
   // (loopback exempt) so a hand-edited config can't smuggle a plaintext-http
   // base URL onto the MITM-able channel the device token + prompt ride.
-  baseUrl: z3.string().url().refine(isAllowedBaseUrl, {
+  baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
     message: "baseUrl must be https (loopback http is allowed for local dev only)"
   }),
   // The `cabdev_` device token plaintext — the companion's one durable credential,
@@ -265,22 +240,22 @@ var companionConfigSchema = z3.object({
   // heartbeat endpoints. Optional so `cabane-companion logout` can strip it (a
   // "paired but logged out" state the supervisor refuses to run) while keeping
   // the rest of the config; `pair` always writes one.
-  deviceToken: z3.string().optional(),
-  // Identity hints, learned from the pairing string and refreshed on the first
+  deviceToken: z2.string().optional(),
+  // Identity hints, learned from the device flow and refreshed on the first
   // assignments pull. Cosmetic — used for `status`/dashboard display only.
-  deviceId: z3.string().optional(),
-  deviceLabel: z3.string().optional(),
+  deviceId: z2.string().optional(),
+  deviceLabel: z2.string().optional(),
   // Optional per-agent machine-local overrides (cwd / prepareHook), keyed by
   // agentId / username / `slug/username`. Hand-added by the operator; the companion
   // never writes this (it only persists credentials + the device, elsewhere).
-  agents: z3.record(z3.string(), localAgentConfigSchema).optional(),
+  agents: z2.record(z2.string(), localAgentConfigSchema).optional(),
   // Dashboard settings (all optional). dashboardPort: preferred bind port (next
   // free one if taken); autoOpen: whether `start` opens the browser (the
   // `--no-open` flag / `COMPANION_NO_OPEN=1` override per-run); logLevel: pino
   // level, live-editable from the dashboard settings panel.
-  dashboardPort: z3.number().int().min(1).max(65535).optional(),
-  autoOpen: z3.boolean().optional(),
-  logLevel: z3.enum(["warn", "info", "debug"]).optional(),
+  dashboardPort: z2.number().int().min(1).max(65535).optional(),
+  autoOpen: z2.boolean().optional(),
+  logLevel: z2.enum(["warn", "info", "debug"]).optional(),
   // CT270: the opencode runtime, when the operator runs one on this machine. The
   // operator installs opencode, starts `opencode serve` (auth via opencode's own
   // `/connect` — Cabane never sees provider keys), and points the companion at it
@@ -288,8 +263,8 @@ var companionConfigSchema = z3.object({
   // heartbeat manifest (so the server offers DeepSeek/opencode models here and
   // routes those turns to this device) AND registers the opencode adapter in the
   // dispatcher. Absent → the device is claude-code-only, exactly as before.
-  opencode: z3.object({
-    serverUrl: z3.string().url()
+  opencode: z2.object({
+    serverUrl: z2.string().url()
   }).strict().optional(),
   // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
   // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
@@ -300,20 +275,13 @@ var companionConfigSchema = z3.object({
   // keeps the block but turns it off). Enabling makes the device advertise the
   // `codex` runtime on its heartbeat manifest AND registers the codex adapter in
   // the dispatcher. Absent → the device doesn't offer codex, exactly as before.
-  codex: z3.object({
-    enabled: z3.boolean().optional()
+  codex: z2.object({
+    enabled: z2.boolean().optional()
   }).strict().optional()
 });
 function isCodexEnabled(cfg) {
   return !!cfg.codex && cfg.codex.enabled !== false;
 }
-function cabaneNativeApiKey() {
-  const key = process.env.OPENROUTER_API_KEY?.trim();
-  return key ? key : void 0;
-}
-function isCabaneNativeEnabled() {
-  return cabaneNativeApiKey() !== void 0;
-}
 function localAgentConfig(cfg, agent) {
   const map = cfg.agents ?? {};
   return map[agent.agentId] ?? map[agent.agentUsername] ?? map[`${agent.workspaceSlug}/${agent.agentUsername}`] ?? {};
@@ -324,18 +292,18 @@ function loadConfig() {
   let raw;
   try {
     raw = readFileSync(path3, "utf8");
-  } catch (err2) {
+  } catch (err) {
     throw new ConfigError(
-      `couldn't read ${path3}: ${err2 instanceof Error ? err2.message : String(err2)}`
+      `couldn't read ${path3}: ${err instanceof Error ? err.message : String(err)}`
     );
   }
   if (raw.trim().length === 0) return null;
   let parsed;
   try {
     parsed = JSON.parse(raw);
-  } catch (err2) {
+  } catch (err) {
     throw new ConfigError(
-      `${path3} is not valid JSON: ${err2 instanceof Error ? err2.message : String(err2)}`
+      `${path3} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
     );
   }
   const result = companionConfigSchema.safeParse(parsed);
@@ -367,12 +335,12 @@ function saveConfig(cfg) {
     } catch {
     }
     renameSync(tmp, path3);
-  } catch (err2) {
+  } catch (err) {
     try {
       rmSync(tmp, { force: true });
     } catch {
     }
-    throw err2;
+    throw err;
   }
 }
 function requireConfig() {
@@ -845,15 +813,15 @@ var DEFAULT_PORT = 7474;
 var PORT_FALLBACK_SPAN = 10;
 function buildDashboardApp(deps) {
   const app = new Hono();
-  app.onError((err2, c) => {
-    if (err2 instanceof ApiError) {
-      const status = err2.status >= 400 && err2.status < 600 ? err2.status : 502;
-      return c.json({ error: err2.message }, status);
+  app.onError((err, c) => {
+    if (err instanceof ApiError) {
+      const status = err.status >= 400 && err.status < 600 ? err.status : 502;
+      return c.json({ error: err.message }, status);
     }
-    if (err2 instanceof CompanionError) {
-      return c.json({ error: err2.message }, 400);
+    if (err instanceof CompanionError) {
+      return c.json({ error: err.message }, 400);
     }
-    return c.json({ error: err2 instanceof Error ? err2.message : "internal error" }, 500);
+    return c.json({ error: err instanceof Error ? err.message : "internal error" }, 500);
   });
   registerRoutes(app, { ...deps, staticDir: resolveStaticDir() });
   return app;
@@ -874,12 +842,12 @@ async function startDashboard(opts) {
           server.closeAllConnections?.();
         })
       };
-    } catch (err2) {
-      if (isAddrInUse(err2)) {
-        lastErr = err2;
+    } catch (err) {
+      if (isAddrInUse(err)) {
+        lastErr = err;
         continue;
       }
-      throw err2;
+      throw err;
     }
   }
   throw new CompanionError(
@@ -895,16 +863,16 @@ function listen(app, port) {
         resolve(server);
       }
     });
-    server.on("error", (err2) => {
+    server.on("error", (err) => {
       if (!settled) {
         settled = true;
-        reject(err2);
+        reject(err);
       }
     });
   });
 }
-function isAddrInUse(err2) {
-  return Boolean(err2 && typeof err2 === "object" && "code" in err2 && err2.code === "EADDRINUSE");
+function isAddrInUse(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
 }
 function resolveStaticDir() {
   return join4(dirname3(fileURLToPath(import.meta.url)), "static");
@@ -1101,8 +1069,8 @@ async function verifyRuntime(state, fetchImpl = fetch) {
   let res;
   try {
     res = await fetchImpl(url, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
-  } catch (err2) {
-    return isConnRefused(err2) ? "stale" : "unknown";
+  } catch (err) {
+    return isConnRefused(err) ? "stale" : "unknown";
   }
   if (!res.ok) return "unknown";
   let body;
@@ -1114,9 +1082,9 @@ async function verifyRuntime(state, fetchImpl = fetch) {
   if (typeof body.instance_id !== "string") return "unknown";
   return body.instance_id === state.instanceId ? "ours" : "stale";
 }
-function isConnRefused(err2) {
-  if (!err2 || typeof err2 !== "object") return false;
-  const cause = err2.cause;
+function isConnRefused(err) {
+  if (!err || typeof err !== "object") return false;
+  const cause = err.cause;
   return !!cause && typeof cause === "object" && cause.code === "ECONNREFUSED";
 }
 function trimSlash(s) {
@@ -1179,10 +1147,10 @@ var CabaneApi = class {
     for (let attempt = 1; ; attempt++) {
       try {
         return await this.attempt(method, path3, body, signal);
-      } catch (err2) {
-        if (attempt >= maxAttempts || signal?.aborted || !isRetryable(err2)) throw err2;
+      } catch (err) {
+        if (attempt >= maxAttempts || signal?.aborted || !isRetryable(err)) throw err;
         await sleep(RETRY_BACKOFF_MS[attempt - 1], signal);
-        if (signal?.aborted) throw err2;
+        if (signal?.aborted) throw err;
       }
     }
   }
@@ -1210,14 +1178,14 @@ var CabaneApi = class {
         retry: true,
         ...signal ? { signal } : {}
       });
-    } catch (err2) {
+    } catch (err) {
       const outbox = this.opts.outbox;
-      if (!outbox) throw err2;
-      if (signal?.aborted || isAbortError(err2)) throw err2;
-      if (!isRetryable(err2)) throw err2;
+      if (!outbox) throw err;
+      if (signal?.aborted || isAbortError(err)) throw err;
+      if (!isRetryable(err)) throw err;
       outbox.persist({ enqueuedAt: Date.now(), turnId, seq, method: "POST", path: path3, body, kind });
       this.opts.log?.warn(
-        { kind, turnId, seq, err: err2 instanceof Error ? err2.message : String(err2) },
+        { kind, turnId, seq, err: err instanceof Error ? err.message : String(err) },
         "companion: commit queued to outbox after transient failure (will drain when the API returns)"
       );
     }
@@ -1241,10 +1209,10 @@ var CabaneApi = class {
           await this.request(entry.method, entry.path, entry.body, { retry: true });
           outbox.remove(entry.turnId, entry.seq);
           progressed = true;
-        } catch (err2) {
-          if (err2 instanceof ApiError && err2.status >= 400 && err2.status < 500) {
+        } catch (err) {
+          if (err instanceof ApiError && err.status >= 400 && err.status < 500) {
             this.opts.log?.warn(
-              { kind: entry.kind, turnId: entry.turnId, seq: entry.seq, status: err2.status },
+              { kind: entry.kind, turnId: entry.turnId, seq: entry.seq, status: err.status },
               "companion outbox: discarding entry on terminal 4xx (will never land)"
             );
             outbox.remove(entry.turnId, entry.seq);
@@ -1392,11 +1360,11 @@ var CabaneApi = class {
     try {
       await this.request("PATCH", path3, body, { retry: true });
       outbox?.remove(key, ACTIVE_RUN_OUTBOX_SEQ);
-    } catch (err2) {
-      if (!outbox) throw err2;
-      if (!isRetryable(err2)) {
+    } catch (err) {
+      if (!outbox) throw err;
+      if (!isRetryable(err)) {
         outbox.remove(key, ACTIVE_RUN_OUTBOX_SEQ);
-        throw err2;
+        throw err;
       }
       outbox.persist({
         enqueuedAt: Date.now(),
@@ -1408,7 +1376,7 @@ var CabaneApi = class {
         kind: "active-run"
       });
       this.opts.log?.warn(
-        { conversationId, agentId, err: err2 instanceof Error ? err2.message : String(err2) },
+        { conversationId, agentId, err: err instanceof Error ? err.message : String(err) },
         "companion: active-run write queued to outbox after transient failure (will drain when the API returns)"
       );
     }
@@ -1507,13 +1475,13 @@ var CabaneApi = class {
     return res.messages.find((m) => m.id === messageId2) ?? null;
   }
 };
-function isRetryable(err2) {
-  if (err2 instanceof ApiError) return err2.status >= 500;
-  if (isAbortError(err2)) return false;
+function isRetryable(err) {
+  if (err instanceof ApiError) return err.status >= 500;
+  if (isAbortError(err)) return false;
   return true;
 }
-function isAbortError(err2) {
-  return err2 instanceof Error && err2.name === "AbortError";
+function isAbortError(err) {
+  return err instanceof Error && err.name === "AbortError";
 }
 function sleep(ms, signal) {
   return new Promise((resolve) => {
@@ -1531,8 +1499,8 @@ function sleep(ms, signal) {
 }
 function errorMessage(status, body) {
   if (body && typeof body === "object" && "error" in body) {
-    const err2 = body.error;
-    if (typeof err2 === "string") return `${status} ${err2}`;
+    const err = body.error;
+    if (typeof err === "string") return `${status} ${err}`;
   }
   if (typeof body === "string" && body.length > 0) return `${status} ${body.slice(0, 200)}`;
   return `${status} error`;
@@ -1588,8 +1556,8 @@ var DeviceApi = class {
 };
 function errorMessage2(status, body) {
   if (body && typeof body === "object" && "error" in body) {
-    const err2 = body.error;
-    if (typeof err2 === "string") return `${status} ${err2}`;
+    const err = body.error;
+    if (typeof err === "string") return `${status} ${err}`;
   }
   if (typeof body === "string" && body.length > 0) return `${status} ${body.slice(0, 200)}`;
   return `${status} error`;
@@ -1606,11 +1574,11 @@ import {
   writeFileSync as writeFileSync3
 } from "fs";
 import { dirname as dirname4, join as join6 } from "path";
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 function credentialsPath() {
   return join6(cabaneDir(), "credentials.json");
 }
-var credentialStoreSchema = z4.record(z4.string(), z4.string());
+var credentialStoreSchema = z3.record(z3.string(), z3.string());
 function load() {
   const path3 = credentialsPath();
   if (!existsSync4(path3)) return {};
@@ -1643,12 +1611,12 @@ function save(map) {
     } catch {
     }
     renameSync2(tmp, path3);
-  } catch (err2) {
+  } catch (err) {
     try {
       rmSync3(tmp, { force: true });
     } catch {
     }
-    throw err2;
+    throw err;
   }
 }
 function getCredential(agentId) {
@@ -1821,44 +1789,44 @@ function noResume() {
 var TURN_PROTOCOL_VERSION = 1;
 
 // packages/agent-runtime/src/host-policy.ts
-import { z as z5 } from "zod";
-var hostPolicySchema = z5.object({
+import { z as z4 } from "zod";
+var hostPolicySchema = z4.object({
   // Host filesystem + shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the
   // notebook read/write pair, git-worktree tools, and the `REPL` host code-exec
   // tool. Off under the locked assistant surface (today's `DISALLOWED_TOOLS`);
   // on under `coding` mode.
-  hostFs: z5.boolean(),
+  hostFs: z4.boolean(),
   // Public web (today's `WebSearch` / `WebFetch`, the `DEFAULT_WEB_TOOLS`). Public
   // web, not host reach — granted by default today, but expressible as a grant.
-  web: z5.boolean(),
+  web: z4.boolean(),
   // Browser automation (the Playwright MCP surface). Varies by host: a companion has
   // it, the house executor does not (CT230).
-  browser: z5.boolean(),
+  browser: z4.boolean(),
   // User-configured MCP servers permitted. False for the house executor
   // (CT227: Cabane agents run no user MCP servers), true for a personal companion.
-  userMcp: z5.boolean(),
+  userMcp: z4.boolean(),
   // Subagent / sub-dispatch (`Task` / `Agent`). A per-host GRANT (see the CT261
   // amendment above): `false` on the locked assistant/house surface (banned via
   // `DISALLOWED_TOOLS`), `true` under coding / custom where the fan-out is left to
   // the coding allow-hook (which reaches sub-agent tool calls, CT680) or the user
   // allowlist. The subagent completes within the turn, so
   // it's not the turn-model invariant `scheduling` is.
-  subagents: z5.boolean(),
+  subagents: z4.boolean(),
   // ── Hard platform invariants — always denied, never granted ────────────────
   // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*`
   // families, `Monitor`, `Workflow`, …). A turn is one query that resolves when
   // `result` fires; a scheduled callback fires after the reply window has closed
   // and strands the agent (the CT155/CT156 rule).
-  scheduling: z5.literal("never"),
+  scheduling: z4.literal("never"),
   // Human-facing UI prompts (`AskUserQuestion`). A Cabane conversation has no
   // handler to answer a structured prompt, so the call hangs the turn
   // (`UNSUPPORTED_TOOLS`). The agent asks in its reply instead.
-  uiPrompts: z5.literal("never")
+  uiPrompts: z4.literal("never")
 });
 
 // packages/agent-runtime/src/turn-event.ts
-import { z as z6 } from "zod";
-var turnEventSchema = z6.discriminatedUnion("type", [
+import { z as z5 } from "zod";
+var turnEventSchema = z5.discriminatedUnion("type", [
   // The runtime's opaque session state, emitted when the adapter learns it (e.g.
   // the SDK `system/init` frame). The platform stores `state` verbatim per
   // (conversation, agent) and hands it back on the next turn; only the adapter
@@ -1878,19 +1846,19 @@ var turnEventSchema = z6.discriminatedUnion("type", [
   // on the companion, after the server committed the manifest). Runtime-neutral: a
   // plain boolean, not a runtime-specific reason string (that stays in the
   // adapter's `onWarn` log). Additive + optional — an old receiver ignores it.
-  z6.object({
-    type: z6.literal("session"),
-    state: z6.string(),
-    degraded: z6.boolean().optional()
+  z5.object({
+    type: z5.literal("session"),
+    state: z5.string(),
+    degraded: z5.boolean().optional()
   }),
   // One readable thinking summary. Maps `onThinking({ text })`. Transient —
   // surfaced live, never persisted as durable content.
-  z6.object({ type: z6.literal("thinking"), text: z6.string() }),
+  z5.object({ type: z5.literal("thinking"), text: z5.string() }),
   // Assistant text. Maps `onAssistantText({ text, final })` — `text`→`body`,
   // `final`→`terminal`. `terminal: false` is interim narration (commits as a
   // `progress` row); `terminal: true` is the turn's closing reply (commits as
   // the `final` row).
-  z6.object({ type: z6.literal("text"), body: z6.string(), terminal: z6.boolean() }),
+  z5.object({ type: z5.literal("text"), body: z5.string(), terminal: z5.boolean() }),
   // A tool-activity transition. Maps `onToolActivity` — `toolUseId`→`id`,
   // `toolName`→`name` (already prefix-stripped: `cabane_read`, not
   // `mcp__cabane__cabane_read`), `summary` is the short card label. `phase`
@@ -1905,15 +1873,15 @@ var turnEventSchema = z6.discriminatedUnion("type", [
   // dropped the prefix; null for a host / built-in tool. The client tags Cabane
   // MCP calls (`=== 'cabane'`) with a subtle glyph. Nullable + optional so a
   // pre-CT496 producer that never sets it is unaffected (treated as null).
-  z6.object({
-    type: z6.literal("tool"),
-    id: z6.string(),
-    name: z6.string(),
-    phase: z6.enum(["start", "done", "error"]),
-    summary: z6.string(),
-    input: z6.unknown().optional(),
-    result: z6.unknown().optional(),
-    mcpServer: z6.string().nullable().optional()
+  z5.object({
+    type: z5.literal("tool"),
+    id: z5.string(),
+    name: z5.string(),
+    phase: z5.enum(["start", "done", "error"]),
+    summary: z5.string(),
+    input: z5.unknown().optional(),
+    result: z5.unknown().optional(),
+    mcpServer: z5.string().nullable().optional()
   }),
   // The turn's terminal outcome. Maps the `{ ok, reason }` both loops return
   // inline. `ok:false` carries a machine reason (`no_session`, an error code);
@@ -1957,34 +1925,34 @@ var turnEventSchema = z6.discriminatedUnion("type", [
   // `message_turn_metadata.resolved_model` / `resolved_config`. Optional ⇒
   // backward-compatible: an old adapter/companion omits them, a cancel has no result
   // event at all, and the columns stay null → the UI shows `—`.
-  z6.object({
-    type: z6.literal("result"),
-    ok: z6.boolean(),
-    reason: z6.string().optional(),
-    usage: z6.object({
-      inputTokens: z6.number(),
-      outputTokens: z6.number(),
-      cacheReadTokens: z6.number().optional(),
-      cacheCreationTokens: z6.number().optional(),
-      contextTokens: z6.number().optional(),
-      contextWindow: z6.number().optional()
+  z5.object({
+    type: z5.literal("result"),
+    ok: z5.boolean(),
+    reason: z5.string().optional(),
+    usage: z5.object({
+      inputTokens: z5.number(),
+      outputTokens: z5.number(),
+      cacheReadTokens: z5.number().optional(),
+      cacheCreationTokens: z5.number().optional(),
+      contextTokens: z5.number().optional(),
+      contextWindow: z5.number().optional()
     }).optional(),
-    resolvedModel: z6.string().optional(),
-    resolvedConfig: z6.object({
-      effort: z6.string().optional(),
-      thinking: z6.string().optional(),
-      reasoningEffort: z6.string().optional()
+    resolvedModel: z5.string().optional(),
+    resolvedConfig: z5.object({
+      effort: z5.string().optional(),
+      thinking: z5.string().optional(),
+      reasoningEffort: z5.string().optional()
     }).optional()
   })
 ]);
 
 // packages/agent-runtime/src/failure.ts
-import { z as z7 } from "zod";
-var turnFailureSchema = z7.discriminatedUnion("kind", [
-  z7.object({ kind: z7.literal("usage_capped"), resetsAt: z7.string().optional() }),
-  z7.object({ kind: z7.literal("rate_limited") }),
-  z7.object({ kind: z7.literal("server_error") }),
-  z7.object({ kind: z7.literal("auth_expired") })
+import { z as z6 } from "zod";
+var turnFailureSchema = z6.discriminatedUnion("kind", [
+  z6.object({ kind: z6.literal("usage_capped"), resetsAt: z6.string().optional() }),
+  z6.object({ kind: z6.literal("rate_limited") }),
+  z6.object({ kind: z6.literal("server_error") }),
+  z6.object({ kind: z6.literal("auth_expired") })
 ]);
 var USAGE_CAPPED = "usage_capped";
 var RATE_LIMITED = "rate_limited";
@@ -2090,63 +2058,63 @@ var RATE_PATTERNS = [/rate[_ ]?limit/, /\b429\b/, /too many requests/];
 var BARE_LIMIT = /\blimit (reached|exceeded)\b/;
 
 // packages/agent-runtime/src/turn-request.ts
-import { z as z8 } from "zod";
-var contentBlockSchema = z8.discriminatedUnion("type", [
-  z8.object({ type: z8.literal("text"), text: z8.string() }),
-  z8.object({
-    type: z8.literal("image"),
-    source: z8.object({ type: z8.literal("url"), url: z8.string() })
+import { z as z7 } from "zod";
+var contentBlockSchema = z7.discriminatedUnion("type", [
+  z7.object({ type: z7.literal("text"), text: z7.string() }),
+  z7.object({
+    type: z7.literal("image"),
+    source: z7.object({ type: z7.literal("url"), url: z7.string() })
   }),
-  z8.object({
-    type: z8.literal("document"),
-    source: z8.object({ type: z8.literal("url"), url: z8.string() })
+  z7.object({
+    type: z7.literal("document"),
+    source: z7.object({ type: z7.literal("url"), url: z7.string() })
   })
 ]);
-var effortLevelSchema = z8.enum(["low", "medium", "high", "xhigh", "max"]);
-var resolvedRunConfigSchema = z8.object({
-  model: z8.string().nullable(),
+var effortLevelSchema = z7.enum(["low", "medium", "high", "xhigh", "max"]);
+var resolvedRunConfigSchema = z7.object({
+  model: z7.string().nullable(),
   effort: effortLevelSchema.optional(),
-  runtimeOptions: z8.record(z8.string(), z8.unknown()).optional()
+  runtimeOptions: z7.record(z7.string(), z7.unknown()).optional()
 });
-var resolvedMcpServerSchema = z8.union([
-  z8.object({
-    type: z8.literal("stdio").optional(),
-    command: z8.string(),
-    args: z8.array(z8.string()).optional(),
-    env: z8.record(z8.string(), z8.string()).optional()
+var resolvedMcpServerSchema = z7.union([
+  z7.object({
+    type: z7.literal("stdio").optional(),
+    command: z7.string(),
+    args: z7.array(z7.string()).optional(),
+    env: z7.record(z7.string(), z7.string()).optional()
   }),
-  z8.object({
-    type: z8.literal("http"),
-    url: z8.string(),
-    headers: z8.record(z8.string(), z8.string()).optional()
+  z7.object({
+    type: z7.literal("http"),
+    url: z7.string(),
+    headers: z7.record(z7.string(), z7.string()).optional()
   }),
-  z8.object({
-    type: z8.literal("sse"),
-    url: z8.string(),
-    headers: z8.record(z8.string(), z8.string()).optional()
+  z7.object({
+    type: z7.literal("sse"),
+    url: z7.string(),
+    headers: z7.record(z7.string(), z7.string()).optional()
   })
 ]);
-var resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
-var hostInjectedServersSchema = z8.record(z8.string(), z8.unknown());
-var turnRequestSchema = z8.object({
+var resolvedMcpServersSchema = z7.record(z7.string(), resolvedMcpServerSchema);
+var hostInjectedServersSchema = z7.record(z7.string(), z7.unknown());
+var turnRequestSchema = z7.object({
   // Server-composed system prompt (core + capability prose + adapter addendum +
   // charter). One string to the adapter.
-  systemPrompt: z8.string(),
+  systemPrompt: z7.string(),
   // Server-composed per-turn user text (anchor reminder + the triggering message).
-  prompt: z8.string(),
+  prompt: z7.string(),
   // The multi-block user-message body (text + vision).
-  content: z8.array(contentBlockSchema),
+  content: z7.array(contentBlockSchema),
   // Portable-or-dialect run-config (above).
   config: resolvedRunConfigSchema,
   // Abstract capability grants; the adapter maps them to tool names.
   policy: hostPolicySchema,
   // Prior opaque session state, or null for a fresh session.
-  session: z8.string().nullable(),
+  session: z7.string().nullable(),
   // The cabane control-plane coordinates for this turn's MCP + post-back.
-  cabane: z8.object({
-    mcpUrl: z8.string(),
-    bearer: z8.string(),
-    activeConversationId: z8.string(),
+  cabane: z7.object({
+    mcpUrl: z7.string(),
+    bearer: z7.string(),
+    activeConversationId: z7.string(),
     // CT714: the scoped TURN-CONTROL MCP endpoint (`/api/turn-control`). The
     // EXTERNAL adapters (Codex / opencode) mount it by URL under the key
     // `cabane_companion` — using the same `bearer` (the turn token) and the same
@@ -2156,7 +2124,7 @@ var turnRequestSchema = z8.object({
     // claude-code ignores it (it mounts the in-process instance instead), and
     // every existing `cabane`-block fixture keeps parsing unchanged; the
     // companion always populates it (`build-options.ts`).
-    turnControlUrl: z8.string().optional(),
+    turnControlUrl: z7.string().optional(),
     // CT598: the workspace this turn runs in. The claude-code/opencode/codex
     // adapters never need it (they reach Cabane through the `cabane` MCP server,
     // which takes `workspaceId` as a per-tool arg the model supplies); the
@@ -2166,53 +2134,39 @@ var turnRequestSchema = z8.object({
     // adapters' conformance fixtures, tests) keeps parsing unchanged — the companion
     // always populates it (`build-options.ts`), and the native adapter fails the
     // turn loudly when it is somehow absent rather than guessing.
-    workspaceId: z8.string().optional(),
+    workspaceId: z7.string().optional(),
     // CT752: the server-resolved workspace surface this credential exposes.
     // Readiness uses this explicit fact to require `sdk` for code mode and the
     // granular floor for classic mode; inventory contents alone cannot infer it
     // because `sdk` is intentionally also available on the classic surface.
-    workspaceToolSurface: z8.enum(["code", "classic"]).optional()
+    workspaceToolSurface: z7.enum(["code", "classic"]).optional()
   }),
   // Machine-local resolution (host-filled): the checkout cwd, extra env from a
   // prepare hook, and the resolved user MCP servers.
-  local: z8.object({
-    cwd: z8.string().optional(),
-    env: z8.record(z8.string(), z8.string()).optional(),
-    nativeWorkAssignment: z8.object({
-      itemId: z8.string(),
-      executionId: z8.string(),
-      activationEpoch: z8.number().int().nonnegative()
-    }).strict().optional(),
+  local: z7.object({
+    cwd: z7.string().optional(),
+    env: z7.record(z7.string(), z7.string()).optional(),
     mcpServers: resolvedMcpServersSchema.optional(),
     // CT289: machine-local claude-code adapter knobs the operator sets on a
     // companion they run themselves — the auto-memory escape hatch. `autoMemory:
     // true` opts back into Claude Code's auto-memory (governed by the operator's
     // own `.claude/settings.json`); absent/false leaves the adapter's force-off
-    // default in place (see `buildClaudeCodeOptions`). The In-Cabane executor never
-    // sets it, so house stays force-off unconditionally.
-    claudeCode: z8.object({ autoMemory: z8.boolean().optional() }).optional()
+    // default in place (see `buildClaudeCodeOptions`).
+    claudeCode: z7.object({ autoMemory: z7.boolean().optional() }).optional()
   }),
   // Host-owned injected servers (host-filled) — e.g. the summon server.
-  extra: z8.object({
-    mcpServers: hostInjectedServersSchema,
-    // CT666: the per-turn turn-control HANDLER for the in-process cabane-native
-    // runtime — the seam that gives it ask/wake_me/summon_agent/sub_agent/skip_turn
-    // without a subprocess `cabane_companion` MCP server. Typed `unknown` for the same
-    // reason as `mcpServers`: it's a live host object (a `NativeTurnControl` whose
-    // methods close over the dispatcher's per-turn state), passed to the native
-    // adapter WITHOUT the contract package inspecting it. The subprocess adapters
-    // ignore it (they get the same verbs from the injected SDK server instead).
-    turnControl: z8.unknown().optional()
+  extra: z7.object({
+    mcpServers: hostInjectedServersSchema
   })
 });
 
 // packages/agent-runtime/src/conformance.ts
-import { z as z9 } from "zod";
-var conformanceFixtureSchema = z9.object({
-  name: z9.string(),
+import { z as z8 } from "zod";
+var conformanceFixtureSchema = z8.object({
+  name: z8.string(),
   request: turnRequestSchema,
-  nativeStream: z9.array(z9.unknown()),
-  expected: z9.array(turnEventSchema)
+  nativeStream: z8.array(z8.unknown()),
+  expected: z8.array(turnEventSchema)
 });
 
 // packages/agent-runtime/src/transcript.ts
@@ -2222,8 +2176,8 @@ function createTerminalTextBuffer() {
 async function safeEmit(emit, event, onError) {
   try {
     await emit(event);
-  } catch (err2) {
-    onError?.(err2, event.type);
+  } catch (err) {
+    onError?.(err, event.type);
   }
 }
 async function processAssistantMessage(msg, emit, pending, buffer, onError) {
@@ -2484,16 +2438,16 @@ var TurnPump = class {
   // minimal note. Skipped when cancelled or already final. The held-text flush
   // that precedes it is a classification concern, driven by the caller before
   // this runs.
-  async finalize(ok2) {
-    if (!ok2 || this.opts.signal.aborted || this.emittedFinal) return;
+  async finalize(ok) {
+    if (!ok || this.opts.signal.aborted || this.emittedFinal) return;
     const body = this.lastProgressBody ?? this.opts.emptyFinalBody;
     const seq = this.opts.nextSeq();
     try {
       await this.opts.commit.commitMessage({ body, kind: "final", seq });
       this.emittedFinal = true;
       this.finalReplyBody = body;
-    } catch (err2) {
-      this.opts.onError?.(err2, "empty-final");
+    } catch (err) {
+      this.opts.onError?.(err, "empty-final");
     }
   }
   // Whether the turn has committed its `final` row — read by the host to decide
@@ -2517,7 +2471,7 @@ import {
 var CLAUDE_CODE_ADDENDUM = "";
 
 // packages/agent-runtime/src/claude-code/policy.ts
-import { z as z10 } from "zod";
+import { z as z9 } from "zod";
 var HOST_FS_TOOLS = [
   // shell + local filesystem
   "Bash",
@@ -2567,30 +2521,20 @@ function withThinkingSummaries(thinking) {
   if (thinking.type === "disabled") return thinking;
   return { display: "summarized", ...thinking };
 }
-var claudeCodeDialectSchema = z10.object({
-  thinking: z10.discriminatedUnion("type", [
-    z10.object({
-      type: z10.literal("adaptive"),
-      display: z10.enum(["summarized", "omitted"]).optional()
+var claudeCodeDialectSchema = z9.object({
+  thinking: z9.discriminatedUnion("type", [
+    z9.object({
+      type: z9.literal("adaptive"),
+      display: z9.enum(["summarized", "omitted"]).optional()
     }),
-    z10.object({
-      type: z10.literal("enabled"),
-      budgetTokens: z10.number().int().positive().optional(),
-      display: z10.enum(["summarized", "omitted"]).optional()
+    z9.object({
+      type: z9.literal("enabled"),
+      budgetTokens: z9.number().int().positive().optional(),
+      display: z9.enum(["summarized", "omitted"]).optional()
     }),
-    z10.object({ type: z10.literal("disabled") })
+    z9.object({ type: z9.literal("disabled") })
   ]).optional(),
-  allowedTools: z10.array(z10.string()).optional(),
-  disallowedTools: z10.array(z10.string()).optional(),
-  // Which claude-code harness shape to run. `coding` switches to the
-  // `claude_code` preset + project settings + always-allow `PreToolUse` hook;
-  // `custom`/`assistant` (or absent) use a plain-string prompt + bypass. This
-  // is the claude-code-specific PRESET selector — kept distinct from
-  // `policy.hostFs` (the host-fs BLOCK), because companion `custom` mode wants host
-  // fs available (via its own allowlist) WITHOUT the coding harness, and in-app
-  // `custom` wants host fs blocked — neither of which a single `hostFs` boolean
-  // can express alongside the preset choice.
-  mode: z10.enum(["assistant", "coding", "custom"]).optional()
+  hostAccess: z9.boolean().optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2669,18 +2613,15 @@ function buildClaudeCodeOptions(req, augment) {
     };
   }
   const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const customAllowed = dialect.success ? dialect.data.allowedTools ?? [] : [];
-  const customDisallowed = dialect.success ? dialect.data.disallowedTools ?? [] : [];
-  const useCodingPreset = (dialect.success ? dialect.data.mode : void 0) === "coding";
+  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
     cabaneGlob,
     ...extraServerGlobs,
-    ...policy.web ? DEFAULT_WEB_TOOLS : [],
-    ...customAllowed
+    ...policy.web ? DEFAULT_WEB_TOOLS : []
   ]);
-  const disallowedTools = dedupe([...disallowedToolsFor(policy), ...customDisallowed]);
+  const disallowedTools = dedupe([...disallowedToolsFor(policy)]);
   const resumeDecision = decideResume(req.session, cwd);
   const resume = "resume" in resumeDecision ? resumeDecision.resume : null;
   const freshReason = "fresh" in resumeDecision ? resumeDecision.reason : void 0;
@@ -2746,7 +2687,7 @@ async function* decodeSdkStream(iter, ctx) {
     out.push(event);
   };
   let sessionEmitted = false;
-  let ok2 = false;
+  let ok = false;
   let resultReason;
   let sawResult = false;
   let usage;
@@ -2792,8 +2733,8 @@ async function* decodeSdkStream(iter, ctx) {
           if (typeof info.rateLimitType === "string") rateLimitType = info.rateLimitType;
         }
       } else if (msg.type === "auth_status") {
-        const err2 = msg.error;
-        if (typeof err2 === "string" && err2.length > 0) authError = err2;
+        const err = msg.error;
+        if (typeof err === "string" && err.length > 0) authError = err;
       } else if (msg.type === "result") {
         sawResult = true;
         usage = readSdkUsage(msg);
@@ -2805,7 +2746,7 @@ async function* decodeSdkStream(iter, ctx) {
         }
         const isError = msg.is_error === true;
         if (msg.subtype === "success" && !isError) {
-          ok2 = true;
+          ok = true;
         } else {
           const resultText = msg.result ?? "";
           const terminalReason = msg.terminal_reason;
@@ -2819,26 +2760,26 @@ async function* decodeSdkStream(iter, ctx) {
             ...rateLimitResetIso ? { resetsAt: rateLimitResetIso } : {}
           } : classifyAssistantError(lastAssistantError) ?? classifyErrorText([authError, errorText].filter(Boolean).join(" "));
           resultReason = failure ? encodeFailureReason(failure) : isError ? `error:${resultText.slice(0, 200) || "unknown"}` : `result_error:${msg.subtype}`;
-          ok2 = false;
+          ok = false;
         }
         break;
       }
     }
-  } catch (err2) {
-    if (ctx.signal.aborted) throw err2;
-    const failure = classifyErrorText(err2 instanceof Error ? err2.message : String(err2));
-    if (!failure) throw err2;
-    ok2 = false;
+  } catch (err) {
+    if (ctx.signal.aborted) throw err;
+    const failure = classifyErrorText(err instanceof Error ? err.message : String(err));
+    if (!failure) throw err;
+    ok = false;
     resultReason = encodeFailureReason(failure);
     sawResult = true;
   }
   if (ctx.signal.aborted) return;
-  await flushHeldText(buffer, emit, ok2);
+  await flushHeldText(buffer, emit, ok);
   yield* drain(out);
-  if (!ok2 && !resultReason && !sawResult) resultReason = "no_result";
+  if (!ok && !resultReason && !sawResult) resultReason = "no_result";
   yield {
     type: "result",
-    ok: ok2,
+    ok,
     ...resultReason ? { reason: resultReason } : {},
     ...usage ? { usage } : {},
     ...resolvedModel ? { resolvedModel } : {}
@@ -3401,9 +3342,9 @@ function readSessionId(properties) {
 }
 function readSessionError(properties) {
   const props = asRecord(properties);
-  const err2 = props?.error;
-  if (typeof err2 === "string") return err2;
-  const rec = asRecord(err2);
+  const err = props?.error;
+  if (typeof err === "string") return err;
+  const rec = asRecord(err);
   if (!rec) return "unknown";
   const { name, message } = deepestError(rec);
   if (message && name && !isGenericErrorName(name)) return `${name}: ${message}`;
@@ -3439,7 +3380,7 @@ async function* decodeOpencodeStream(events, ctx) {
   const pending = /* @__PURE__ */ new Map();
   const startedTools = /* @__PURE__ */ new Set();
   const finishedTools = /* @__PURE__ */ new Set();
-  let ok2 = false;
+  let ok = false;
   let reason;
   let settled = false;
   const userMessageIds = /* @__PURE__ */ new Set();
@@ -3502,7 +3443,7 @@ async function* decodeOpencodeStream(events, ctx) {
       const sealed = sealHeld(held, true);
       held = null;
       if (sealed) yield sealed;
-      ok2 = true;
+      ok = true;
       settled = true;
       break;
     } else if (ev.type === "session.error") {
@@ -3511,7 +3452,7 @@ async function* decodeOpencodeStream(events, ctx) {
       const sealed = sealHeld(held, false);
       held = null;
       if (sealed) yield sealed;
-      ok2 = false;
+      ok = false;
       const errorText = readSessionError(ev.properties);
       const failure = classifyErrorText(errorText);
       reason = failure ? encodeFailureReason(failure) : `error:${errorText.slice(0, 200)}`;
@@ -3526,7 +3467,7 @@ async function* decodeOpencodeStream(events, ctx) {
     if (sealed) yield sealed;
     reason = "no_terminal";
   }
-  yield { type: "result", ok: ok2, ...reason ? { reason } : {} };
+  yield { type: "result", ok, ...reason ? { reason } : {} };
 }
 function hasToolInput(input) {
   return !!input && typeof input === "object" && Object.keys(input).length > 0;
@@ -3540,7 +3481,7 @@ function sealHeld(held, terminal) {
 }
 
 // packages/agent-runtime/src/opencode/policy.ts
-import { z as z11 } from "zod";
+import { z as z10 } from "zod";
 var OPENCODE_HOST_TOOLS = [
   "bash",
   "edit",
@@ -3567,8 +3508,8 @@ function opencodeToolPolicy(policy) {
   deny(OPENCODE_UI_PROMPT_TOOLS);
   return { tools, allowAllHostTools: policy.hostFs };
 }
-var opencodeDialectSchema = z11.object({
-  agent: z11.string().min(1).optional()
+var opencodeDialectSchema = z10.object({
+  agent: z10.string().min(1).optional()
 }).loose();
 function readOpencodeDialect(runtimeOptions) {
   const parsed = opencodeDialectSchema.safeParse(runtimeOptions?.["opencode"] ?? {});
@@ -3789,9 +3730,9 @@ function createHttpOpencodeTransport(opts) {
           // The lock is released when this stream finishes draining.
           events: releaseAfter(parseSseStream(eventRes.body, sessionId, signal), release)
         };
-      } catch (err2) {
+      } catch (err) {
         release();
-        throw err2;
+        throw err;
       }
     }
   };
@@ -4384,9 +4325,9 @@ function readItemType(item) {
 function readErrorMessage(ev) {
   const direct = str(ev.message);
   if (direct) return direct;
-  const err2 = asRecord2(ev.error);
-  if (err2) {
-    const m = str(err2.message);
+  const err = asRecord2(ev.error);
+  if (err) {
+    const m = str(err.message);
     if (m) return m;
   }
   return "unknown";
@@ -4442,7 +4383,7 @@ async function* decodeCodexStream(events, ctx) {
   const startedTools = /* @__PURE__ */ new Set();
   const finishedTools = /* @__PURE__ */ new Set();
   let sessionEmitted = false;
-  let ok2 = false;
+  let ok = false;
   let reason;
   let usage;
   let settled = false;
@@ -4473,7 +4414,7 @@ async function* decodeCodexStream(events, ctx) {
         const message = readItemMessage(item);
         if (isModelMetadataError(message)) {
           yield* flushInterim();
-          ok2 = false;
+          ok = false;
           reason = `model_unavailable:${message.slice(0, 200)}`;
           settled = true;
           break;
@@ -4528,13 +4469,13 @@ async function* decodeCodexStream(events, ctx) {
       held = null;
       if (sealed) yield sealed;
       usage = readUsage(ev);
-      ok2 = true;
+      ok = true;
       settled = true;
       break;
     }
     if (ev.type === "turn.failed" || ev.type === "error") {
       yield* flushInterim();
-      ok2 = false;
+      ok = false;
       const text = readErrorMessage(ev);
       const failure = classifyErrorText(text);
       reason = failure ? encodeFailureReason(failure) : `error:${text.slice(0, 200)}`;
@@ -4552,7 +4493,7 @@ async function* decodeCodexStream(events, ctx) {
   const resolvedConfig = ctx.resolvedReasoningEffort ? { reasoningEffort: ctx.resolvedReasoningEffort } : void 0;
   yield {
     type: "result",
-    ok: ok2,
+    ok,
     ...reason ? { reason } : {},
     ...usage ? { usage } : {},
     ...ctx.resolvedModel ? { resolvedModel: ctx.resolvedModel } : {},
@@ -4570,7 +4511,7 @@ function sealHeld2(held, terminal) {
 }
 
 // packages/agent-runtime/src/codex/policy.ts
-import { z as z12 } from "zod";
+import { z as z11 } from "zod";
 function codexToolPolicy(policy) {
   return policy.hostFs ? {
     permissionProfile: "cabane-coding",
@@ -4585,8 +4526,8 @@ function codexToolPolicy(policy) {
   };
 }
 var CODEX_REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
-var codexDialectSchema = z12.object({
-  modelReasoningEffort: z12.enum(CODEX_REASONING_EFFORTS).optional()
+var codexDialectSchema = z11.object({
+  modelReasoningEffort: z11.enum(CODEX_REASONING_EFFORTS).optional()
 }).loose();
 function readCodexDialect(runtimeOptions) {
   const parsed = codexDialectSchema.safeParse(runtimeOptions?.["codex"] ?? {});
@@ -4594,7 +4535,7 @@ function readCodexDialect(runtimeOptions) {
 }
 
 // packages/agent-runtime/src/codex/model.ts
-var CODEX_DEFAULT_MODEL_BARES = /* @__PURE__ */ new Set(["default", "codex"]);
+var CODEX_DEFAULT_MODEL_BARES = /* @__PURE__ */ new Set(["default"]);
 function parseCodexModel(model) {
   const sep = model.indexOf("/");
   const bare = sep === -1 || model.slice(0, sep) !== "openai" ? model : model.slice(sep + 1);
@@ -4681,9 +4622,11 @@ function buildConfig(req) {
     };
   }
   const policy = codexToolPolicy(req.policy);
+  const tmpDir = req.local.env?.TMPDIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
       // `:root = read` preserves coding-mode host reads; the one explicit
@@ -4961,7 +4904,7 @@ var CodexExec = class {
       signal: args.signal
     });
     let spawnError = null;
-    child.once("error", (err2) => spawnError = err2);
+    child.once("error", (err) => spawnError = err);
     if (!child.stdin) {
       child.kill();
       throw new Error("Child process has no stdin");
@@ -5865,1027 +5808,6 @@ var CODEX_CONFORMANCE_FIXTURES = [
   }
 ];
 
-// packages/agent-runtime/src/cabane-native/addendum.ts
-var CABANE_NATIVE_ADDENDUM = `## Your tools (native runtime)
-
-You are running on Cabane's own agent runtime. You have a small, curated set of workspace tools, all prefixed \`cabane_\`:
-
-- \`cabane_list\` \u2014 list a folder's files and subfolders.
-- \`cabane_read\` \u2014 read one file's contents by path.
-- \`cabane_search\` \u2014 substring search across file/folder names, file contents, and conversations.
-- \`cabane_write\` \u2014 create or overwrite a file (pass \`overwrite: true\` to replace).
-- \`cabane_edit\` \u2014 find/replace inside an existing file.
-- \`cabane_mkdir\` \u2014 create a folder (pass \`recursive: true\` to also make missing parents).
-- \`cabane_move\` \u2014 move or rename a file or folder.
-- \`cabane_delete\` \u2014 delete a file or folder (folders need \`recursive: true\`; soft-delete, recoverable).
-- \`cabane_context\` \u2014 gather an object plus its related context (files, conversations, people) in one call \u2014 your first move to understand what surrounds something.
-- \`cabane_messages\` \u2014 read a conversation's messages by id (from \`cabane_search\` / \`cabane_context\`).
-
-Paths are workspace-relative with a leading slash (\`/notes/todo.md\`). This is a deliberately curated tool set \u2014 if a job needs an operation that isn't here, say so plainly in your reply rather than inventing a tool. Your reply text is streamed straight into the conversation; there is no separate send step.`;
-var CABANE_NATIVE_ADDENDUM_CODE_MODE = `## Your tools (native runtime \u2014 code mode)
-
-You are running on Cabane's own agent runtime, in **code mode**. Your one workspace tool is \`sdk\`: you act on the workspace by writing a short TypeScript program against the ambient \`cabane\` object and submitting it as the \`code\` argument. Only what your program \`return\`s (plus \`console.log\`) comes back \u2014 so gather, filter, and summarize *inside* the program and return the small answer, not the raw material.
-
-There is **no** \`cabane_read\` / \`cabane_write\` / \`cabane_search\` / \`cabane_edit\` tool \u2014 those are \`cabane\` SDK calls *inside* your program (\`cabane.files.read(path)\`, \`cabane.find.search(q)\`, \u2026), not tools you call directly. The full SDK surface \u2014 every method and its options \u2014 is documented below this note in your prompt.
-
-Beside \`sdk\` you also have a few **plain-named** tools that act on the TURN itself, not the workspace (they can't be a program's \`return\` value):
-- \`ask\` \u2014 put a structured question to a human and END your turn (they may answer in days).
-- \`wake_me\` \u2014 end this turn now and be re-dispatched later to check a condition (a PR merging, a reply landing).
-- \`summon_agent\` \u2014 pull a peer agent into THIS conversation to reply on your turn.
-- \`sub_agent\` \u2014 spawn a private worker with a fresh context window; its result comes back here later (don't wait \u2014 end your turn).
-- \`skip_turn\` \u2014 end your turn with NO reply, when the message doesn't need one from you.
-- \`mint_render_token\` \u2014 mint a short-lived credential to load a workspace HTML page in a browser.
-
-Your reply text is streamed straight into the conversation; there is no separate send step.`;
-
-// packages/agent-runtime/src/cabane-native/context.ts
-var DEFAULT_HISTORY_LIMIT = 20;
-var DEFAULT_MAX_HISTORY_CHARS = 24e3;
-async function assembleMessages(systemPrompt, content, fallbackPrompt, opts) {
-  const messages = [{ role: "system", content: systemPrompt }];
-  const history = await fetchRecentHistory(opts);
-  for (const m of history) messages.push(m);
-  messages.push({ role: "user", content: currentUserText(content, fallbackPrompt) });
-  return messages;
-}
-function currentUserText(content, fallbackPrompt) {
-  const text = content.filter((b) => b.type === "text").map((b) => b.text).join("\n").trim();
-  return text.length > 0 ? text : fallbackPrompt;
-}
-async function fetchRecentHistory(opts) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const limit = opts.historyLimit ?? DEFAULT_HISTORY_LIMIT;
-  const url = new URL(
-    `${opts.apiRoot}/workspaces/${opts.workspaceId}/conversations/${opts.conversationId}/messages`
-  );
-  url.searchParams.set("limit", String(limit));
-  url.searchParams.set("order", "desc");
-  let rows;
-  try {
-    const res = await doFetch(url.toString(), {
-      headers: { Authorization: `Bearer ${opts.bearer}` }
-    });
-    if (!res.ok) return [];
-    const body = await res.json();
-    rows = body.messages ?? [];
-  } catch {
-    return [];
-  }
-  const chronological = [...rows].reverse();
-  while (chronological.length > 0 && chronological[chronological.length - 1].role === "user") {
-    chronological.pop();
-  }
-  const mapped = [];
-  for (const r of chronological) {
-    const role = r.role === "agent" ? "assistant" : r.role === "user" ? "user" : null;
-    if (!role) continue;
-    const body = (r.body ?? "").trim();
-    if (body.length === 0) continue;
-    mapped.push({ role, content: body });
-  }
-  return capHistory(mapped, opts.maxHistoryChars ?? DEFAULT_MAX_HISTORY_CHARS);
-}
-function capHistory(messages, maxChars) {
-  let total = messages.reduce((n, m) => n + m.content.length, 0);
-  let start = 0;
-  while (total > maxChars && start < messages.length) {
-    total -= messages[start].content.length;
-    start += 1;
-  }
-  return messages.slice(start);
-}
-
-// packages/agent-runtime/src/cabane-native/model.ts
-var CABANE_NATIVE_MODEL_PREFIX = "cabane-native/";
-function parseCabaneNativeModel(model) {
-  return model.startsWith(CABANE_NATIVE_MODEL_PREFIX) ? model.slice(CABANE_NATIVE_MODEL_PREFIX.length) : model;
-}
-
-// packages/agent-runtime/src/cabane-native/policy.ts
-import { z as z13 } from "zod";
-var NATIVE_SURFACES = ["code", "classic"];
-var cabaneNativeDialectSchema = z13.object({ surface: z13.enum(NATIVE_SURFACES).optional() }).loose();
-function readCabaneNativeDialect(runtimeOptions) {
-  const parsed = cabaneNativeDialectSchema.safeParse(runtimeOptions?.["cabane-native"] ?? {});
-  return parsed.success ? parsed.data : {};
-}
-function cabaneNativeSurface(runtimeOptions) {
-  return readCabaneNativeDialect(runtimeOptions).surface ?? "code";
-}
-
-// packages/agent-runtime/src/cabane-native/tools.ts
-var TOOL_RESULT_MAX_CHARS = 8e3;
-var CABANE_NATIVE_TOOLS = [
-  {
-    type: "function",
-    function: {
-      name: "cabane_list",
-      description: "List the files and subfolders at a workspace folder path. Omit `path` for the root.",
-      parameters: {
-        type: "object",
-        properties: {
-          path: {
-            type: "string",
-            description: "Workspace folder path, e.g. /notes. Defaults to /."
-          }
-        }
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_read",
-      description: "Read the contents of one file at a workspace path.",
-      parameters: {
-        type: "object",
-        properties: {
-          path: { type: "string", description: "Workspace file path, e.g. /notes/todo.md." }
-        },
-        required: ["path"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_search",
-      description: "Case-insensitive substring search across file names and file contents. Optionally scope to a subtree with `path`.",
-      parameters: {
-        type: "object",
-        properties: {
-          q: { type: "string", description: "The search string." },
-          path: {
-            type: "string",
-            description: "Optional workspace subtree to scope the search to."
-          }
-        },
-        required: ["q"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_write",
-      description: "Create a file at a workspace path (missing parent folders are created). Pass `overwrite: true` to replace an existing file instead of failing on a name conflict.",
-      parameters: {
-        type: "object",
-        properties: {
-          path: { type: "string", description: "Workspace file path, e.g. /notes/new.md." },
-          content: { type: "string", description: "The file contents." },
-          overwrite: { type: "boolean", description: "Replace an existing file (default false)." }
-        },
-        required: ["path", "content"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_edit",
-      description: "Modify an existing file with a single find/replace. By default `find` must occur exactly once; set `replaceAll: true` to replace every occurrence.",
-      parameters: {
-        type: "object",
-        properties: {
-          path: { type: "string", description: "Workspace file path to edit." },
-          find: { type: "string", description: "The substring to find." },
-          replace: { type: "string", description: "The replacement." },
-          replaceAll: { type: "boolean", description: "Replace every occurrence (default false)." }
-        },
-        required: ["path", "find", "replace"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_mkdir",
-      description: "Create a folder at a workspace path. Pass `recursive: true` to also create any missing parent folders (like `mkdir -p`); otherwise the parent must already exist.",
-      parameters: {
-        type: "object",
-        properties: {
-          path: { type: "string", description: "Workspace folder path, e.g. /notes/archive." },
-          recursive: {
-            type: "boolean",
-            description: "Create missing parent folders too (default false)."
-          }
-        },
-        required: ["path"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_move",
-      description: "Move and/or rename a file or folder. `fromPath` is the current path; `toPath` is the new full path (its parent must already exist). Same parent + new name renames in place; a different parent moves it.",
-      parameters: {
-        type: "object",
-        properties: {
-          fromPath: { type: "string", description: "The current file/folder path." },
-          toPath: { type: "string", description: "The new full path (parent + name)." }
-        },
-        required: ["fromPath", "toPath"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_delete",
-      description: "Delete the file or folder at a workspace path. Folders require `recursive: true` (deletes everything inside). Soft delete \u2014 the entry is recoverable from the trash, not erased.",
-      parameters: {
-        type: "object",
-        properties: {
-          path: { type: "string", description: "Workspace file/folder path to delete." },
-          recursive: {
-            type: "boolean",
-            description: "Required to delete a non-empty folder (default false)."
-          }
-        },
-        required: ["path"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_context",
-      description: "Gather a workspace object plus its most relevant connected context \u2014 related files, conversations, people \u2014 in one call. Your first move to understand what surrounds something before acting. `ref` is the object id, or its workspace path when `kind` is `file` or `folder`.",
-      parameters: {
-        type: "object",
-        properties: {
-          kind: {
-            type: "string",
-            enum: ["conversation", "file", "folder", "user", "agent", "channel"],
-            description: "The kind of object to orient around."
-          },
-          ref: {
-            type: "string",
-            description: "The object id (or the workspace path for a file/folder)."
-          }
-        },
-        required: ["kind", "ref"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "cabane_messages",
-      description: 'Read a page of messages from a conversation by id (get ids from `cabane_search` or `cabane_context`). `order: "desc"` (default) returns newest-first \u2014 where a thread is now; `order: "asc"` returns oldest-first \u2014 how it began. Your own current thread is already in context; use this to catch up on other conversations or to page further back.',
-      parameters: {
-        type: "object",
-        properties: {
-          conversationId: { type: "string", description: "The conversation id to read." },
-          order: {
-            type: "string",
-            enum: ["asc", "desc"],
-            description: "newest-first (desc, default) or oldest-first (asc)."
-          },
-          limit: {
-            type: "number",
-            description: "Max messages to return (default 50, max 100)."
-          }
-        },
-        required: ["conversationId"]
-      }
-    }
-  }
-];
-var CABANE_NATIVE_CODE_TOOL = {
-  type: "function",
-  function: {
-    name: "sdk",
-    description: "Run a TypeScript program against the workspace. `code` is the program \u2014 the body of an async function, so top-level `await` works and `return <value>` produces the result. Write against the ambient `cabane` object (no imports); only what you `return` plus `console.log` comes back, so gather/filter/summarize inside the program and return the small answer. The full `cabane` SDK surface \u2014 every method and its options \u2014 is documented in your system prompt above.",
-    parameters: {
-      type: "object",
-      properties: {
-        code: {
-          type: "string",
-          description: "The TypeScript program to run (an async function body)."
-        }
-      },
-      required: ["code"]
-    }
-  }
-};
-var CABANE_NATIVE_RENDER_TOKEN_TOOL = {
-  type: "function",
-  function: {
-    name: "mint_render_token",
-    description: "Mint a short-lived, scoped credential that lets a browser load a workspace HTML page at the content-isolation origin. Returns `{ url, cookieName, cookieValue, expiresAt, pathPrefix }`. `pathPrefix` (default `/`) narrows the grant to a folder or single file; `ttlSeconds` (default 30 min, max 86400) overrides the TTL.",
-    parameters: {
-      type: "object",
-      properties: {
-        pathPrefix: {
-          type: "string",
-          description: "Workspace-rooted path-prefix the token authorizes; `/` for whole-workspace."
-        },
-        ttlSeconds: {
-          type: "number",
-          description: "Override the default 30-minute TTL; capped at 24h (86400s)."
-        }
-      }
-    }
-  }
-};
-function summarizeCabaneToolArgs(name, args) {
-  if (name === "mint_render_token") return str2(args.pathPrefix) ?? "/";
-  if (name === "sdk") {
-    const code = str2(args.code) ?? "";
-    const firstLine = code.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "";
-    return firstLine.length > 80 ? `${firstLine.slice(0, 80)}\u2026` : firstLine;
-  }
-  if (name === "cabane_search") return str2(args.q) ?? "";
-  if (name === "cabane_move") {
-    const from = str2(args.fromPath) ?? "";
-    const to = str2(args.toPath) ?? "";
-    return from && to ? `${from} \u2192 ${to}` : from || to;
-  }
-  if (name === "cabane_context") return str2(args.ref) ?? "";
-  if (name === "cabane_messages") return str2(args.conversationId) ?? "";
-  return str2(args.path) ?? "";
-}
-async function executeCabaneNativeTool(name, args, ctx, signal) {
-  const doFetch = ctx.fetchImpl ?? fetch;
-  const wsBase = `${ctx.apiRoot}/workspaces/${ctx.workspaceId}`;
-  const headers = { Authorization: `Bearer ${ctx.bearer}`, "Content-Type": "application/json" };
-  const call = async (method, path3, init2) => {
-    const url = new URL(`${wsBase}${path3}`);
-    for (const [k, v] of Object.entries(init2?.query ?? {})) {
-      if (v !== void 0) url.searchParams.set(k, v);
-    }
-    let res;
-    try {
-      res = await doFetch(url.toString(), {
-        method,
-        headers,
-        ...init2?.body !== void 0 ? { body: JSON.stringify(init2.body) } : {},
-        signal
-      });
-    } catch (err2) {
-      return {
-        ok: false,
-        result: `error: request failed: ${err2 instanceof Error ? err2.message : String(err2)}`
-      };
-    }
-    const contentType = res.headers.get("content-type") ?? "";
-    const text = contentType.includes("application/json") ? JSON.stringify(await res.json().catch(() => ({}))) : await res.text().catch(() => "");
-    if (!res.ok) return { ok: false, result: truncate2(`error ${res.status}: ${text}`) };
-    return { ok: true, result: truncate2(text) };
-  };
-  switch (name) {
-    case "sdk":
-      return call("POST", "/sdk", {
-        body: {
-          program: str2(args.code) ?? "",
-          ...ctx.conversationId ? { activeConversationId: ctx.conversationId } : {}
-        }
-      });
-    case "mint_render_token":
-      return call("POST", "/render-tokens", {
-        body: {
-          pathPrefix: str2(args.pathPrefix) ?? "/",
-          ...typeof args.ttlSeconds === "number" ? { ttlSeconds: args.ttlSeconds } : {}
-        }
-      });
-    case "cabane_list":
-      return call("GET", "/files/tree", { query: { path: str2(args.path) ?? "/" } });
-    case "cabane_read":
-      return call("GET", "/files/content", { query: { path: str2(args.path) } });
-    case "cabane_search":
-      return call("GET", "/search", { query: { q: str2(args.q), path: str2(args.path) } });
-    case "cabane_write": {
-      const overwrite = args.overwrite === true;
-      return overwrite ? call("PUT", "/files/content", {
-        body: { path: str2(args.path), content: str2(args.content) }
-      }) : call("POST", "/files", {
-        body: { path: str2(args.path), content: str2(args.content), mkdirs: true }
-      });
-    }
-    case "cabane_edit":
-      return call("PATCH", "/files", {
-        body: {
-          path: str2(args.path),
-          find: str2(args.find),
-          replace: str2(args.replace) ?? "",
-          ...args.replaceAll === true ? { replaceAll: true } : {}
-        }
-      });
-    case "cabane_mkdir":
-      return call("POST", "/folders", {
-        body: {
-          path: str2(args.path),
-          ...args.recursive === true ? { recursive: true } : {}
-        }
-      });
-    case "cabane_move":
-      return call("POST", "/entries/move", {
-        body: { fromPath: str2(args.fromPath), toPath: str2(args.toPath) }
-      });
-    case "cabane_delete":
-      return call("DELETE", "/entries", {
-        query: {
-          path: str2(args.path),
-          recursive: args.recursive === true ? "true" : void 0
-        }
-      });
-    case "cabane_context":
-      return call("POST", "/graph/query", {
-        body: { preset: "orient", args: { kind: str2(args.kind), ref: str2(args.ref) } }
-      });
-    case "cabane_messages":
-      return call(
-        "GET",
-        `/conversations/${encodeURIComponent(str2(args.conversationId) ?? "")}/messages`,
-        {
-          query: {
-            order: str2(args.order),
-            limit: typeof args.limit === "number" ? String(args.limit) : void 0
-          }
-        }
-      );
-    default:
-      return { ok: false, result: `error: unknown tool "${name}"` };
-  }
-}
-function str2(v) {
-  return typeof v === "string" ? v : void 0;
-}
-function truncate2(s) {
-  return s.length > TOOL_RESULT_MAX_CHARS ? `${s.slice(0, TOOL_RESULT_MAX_CHARS)}
-\u2026 [truncated]` : s;
-}
-
-// packages/agent-runtime/src/cabane-native/turn-control.ts
-function describeSubAgentError(status, body) {
-  const code = body && typeof body === "object" && "error" in body ? String(body.error) : void 0;
-  switch (code) {
-    case "callout_cap_exceeded":
-      return "sub_agent: you already have the maximum open sub-agents for this thread. Wait for some to return \u2014 you're woken once they're all back \u2014 before spawning more.";
-    case "callout_depth_exceeded":
-      return "sub_agent: this would nest sub-agents too deep (max 3 levels). Have the current worker report back rather than spawning another layer.";
-    case "dispatch_agent_not_found":
-      return "sub_agent: no live agent in this workspace matches that `agentId`. Check `list_agents`, or omit `agentId` to spawn yourself.";
-    case "dispatch_return_requires_turn":
-    case "dispatch_return_requires_agent":
-    case "dispatch_return_requires_dispatch":
-      return `sub_agent: the spawn was rejected (${code}). This is a turn-context problem, not something to retry blindly \u2014 report it rather than looping.`;
-    default:
-      return `sub_agent: the spawn failed (${code ?? `HTTP ${status}`}).`;
-  }
-}
-var CABANE_NATIVE_TURN_CONTROL_TOOLS = [
-  {
-    type: "function",
-    function: {
-      name: "ask",
-      description: "Ask a HUMAN a structured question you need answered to continue, then END your turn (do not wait \u2014 a reply may take days). Pass `targetUserId` (a workspace member id). Single form: a one-sentence `headline` (the question, capitalized, ending in `?`) + a short `question` body of framing, with 2\u20134 `options` when the answer is a bounded/yes-no choice. Or `questions`: 1\u20135 items each `{ headline, body?, options? }` when several decisions land at once. Provide EITHER `question` or `questions`, never both. Your surrounding context goes in your reply; the ask carries the question.",
-      parameters: {
-        type: "object",
-        properties: {
-          targetUserId: {
-            type: "string",
-            description: "The workspace member (human) to ask \u2014 a user id from the roster."
-          },
-          question: {
-            type: "string",
-            description: "Single-question form: a short body of framing (one or two sentences)."
-          },
-          headline: {
-            type: "string",
-            description: "Single-question form: the question itself as one clear capitalized sentence ending in `?`."
-          },
-          options: {
-            type: "array",
-            items: { type: "string" },
-            description: "Single-question form: 2\u20134 suggested one-click answers."
-          },
-          questions: {
-            type: "array",
-            items: {
-              type: "object",
-              properties: {
-                headline: { type: "string" },
-                body: { type: "string" },
-                options: { type: "array", items: { type: "string" } }
-              },
-              required: ["headline"]
-            },
-            description: "Multi-question form: 1\u20135 questions to ask at once."
-          }
-        },
-        required: ["targetUserId"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "wake_me",
-      description: 'Wake yourself later \u2014 end this turn now and be re-dispatched at a time you pick, to CHECK a condition that has not happened yet (a PR merging, a reply landing, "check back in five minutes"). Pass EXACTLY ONE of `afterSeconds` (a relative delay, \u226560) or `at` (an absolute ISO-8601 timestamp WITH a zone you compute yourself). `note` is the message to your future self \u2014 write the condition to re-check. It arms when the turn ends; one wake per turn.',
-      parameters: {
-        type: "object",
-        properties: {
-          afterSeconds: {
-            type: "number",
-            description: "Relative delay in seconds from when this turn ends (floor 60)."
-          },
-          at: {
-            type: "string",
-            description: "Absolute ISO-8601 timestamp with a zone (e.g. 2026-07-16T09:00:00-07:00)."
-          },
-          note: {
-            type: "string",
-            description: "A note to your future self \u2014 becomes the wake body (the condition to re-check)."
-          }
-        },
-        required: ["note"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "summon_agent",
-      description: "Summon another agent into THIS conversation \u2014 dispatch a peer to reply here on your turn. Pass the peer `agentId` (from the agent roster). The peer is dispatched on your final reply and picks up this conversation as context, so write the context/ask into your reply first. Writing `@handle` in prose summons no one \u2014 this tool is the only in-thread lever. Single target, last call wins; summoning yourself is a no-op.",
-      parameters: {
-        type: "object",
-        properties: {
-          agentId: {
-            type: "string",
-            description: "The peer agent to summon \u2014 a workspace agent id from the roster."
-          }
-        },
-        required: ["agentId"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "sub_agent",
-      description: "Spawn a sub-agent \u2014 hand a piece of work to a private worker with a fresh context window whose result comes back to you automatically. It does NOT return inline: this returns the child's id immediately and the outcome lands LATER as a message in this conversation (you're woken once every sub-agent you have out here has returned). So don't wait \u2014 finish what else this turn can do and end your turn. `prompt` is the child's self-contained opening instruction; `agentId` (optional) dispatches a peer instead of yourself; `title` (optional) names the child thread. Reach for it to isolate a big read or fan out N independent pieces in parallel.",
-      parameters: {
-        type: "object",
-        properties: {
-          prompt: {
-            type: "string",
-            description: "The sub-agent's self-contained opening instruction."
-          },
-          agentId: {
-            type: "string",
-            description: "Optional peer to run the sub-agent as; omit to spawn yourself."
-          },
-          title: { type: "string", description: "Optional title for the child thread." }
-        },
-        required: ["prompt"]
-      }
-    }
-  },
-  {
-    type: "function",
-    function: {
-      name: "skip_turn",
-      description: "End your current turn WITHOUT posting a reply. Call this when you've been dispatched but the message genuinely doesn't need a response from you \u2014 an aside, a question already answered, a pile-on someone else has. Your turn ends silently (no message bubble). `reason` is a short free-text note for telemetry. Prefer this over posting a low-value \"ok!\"; skipping IS the whole turn.",
-      parameters: {
-        type: "object",
-        properties: {
-          reason: {
-            type: "string",
-            description: "Short reason you are declining \u2014 used for telemetry."
-          }
-        },
-        required: ["reason"]
-      }
-    }
-  }
-];
-var CABANE_NATIVE_TURN_CONTROL_NAMES = new Set(
-  CABANE_NATIVE_TURN_CONTROL_TOOLS.map((t) => t.function.name)
-);
-function summarizeTurnControlArgs(name, args) {
-  if (name === "ask") return str3(args.headline) ?? str3(args.question) ?? "";
-  if (name === "wake_me") return str3(args.note) ?? "";
-  if (name === "summon_agent") return str3(args.agentId) ?? "";
-  if (name === "sub_agent") return str3(args.title) ?? truncateHead(str3(args.prompt) ?? "", 60);
-  if (name === "skip_turn") return str3(args.reason) ?? "";
-  return "";
-}
-async function executeNativeTurnControl(name, args, tc) {
-  switch (name) {
-    case "summon_agent": {
-      const agentId = str3(args.agentId);
-      if (!agentId) return err("summon_agent: `agentId` is required.");
-      tc.summon(agentId);
-      return ok({ summoned: agentId });
-    }
-    case "skip_turn": {
-      const reason = str3(args.reason);
-      if (!reason) return err("skip_turn: `reason` is required.");
-      tc.skip(reason);
-      return ok({ skipped: true });
-    }
-    case "ask": {
-      const targetUserId = str3(args.targetUserId);
-      if (!targetUserId) return err("ask: `targetUserId` is required.");
-      const hasSingle = args.question !== void 0;
-      const hasArray = Array.isArray(args.questions) && args.questions.length > 0;
-      if (hasSingle && hasArray)
-        return err("ask: provide either `question` or `questions`, not both.");
-      if (!hasSingle && !hasArray) return err("ask: provide `question` or `questions`.");
-      const payload = hasArray ? { targetUserId, questions: args.questions } : {
-        targetUserId,
-        question: str3(args.question),
-        ...str3(args.headline) ? { headline: str3(args.headline) } : {},
-        ...Array.isArray(args.options) ? { options: args.options } : {}
-      };
-      tc.ask(payload);
-      return ok({ asked: targetUserId });
-    }
-    case "wake_me": {
-      const note = str3(args.note);
-      if (!note) return err("wake_me: `note` is required.");
-      const hasAfter = typeof args.afterSeconds === "number";
-      const hasAt = typeof args.at === "string";
-      if (hasAfter && hasAt)
-        return err("wake_me: provide either `afterSeconds` or `at`, not both.");
-      if (!hasAfter && !hasAt) return err("wake_me: provide `afterSeconds` or `at`.");
-      tc.wake({
-        ...hasAfter ? { afterSeconds: args.afterSeconds } : {},
-        ...hasAt ? { at: args.at } : {},
-        note
-      });
-      return ok({ armed: hasAt ? { at: args.at } : { afterSeconds: args.afterSeconds } });
-    }
-    case "sub_agent": {
-      const prompt = str3(args.prompt);
-      if (!prompt) return err("sub_agent: `prompt` is required.");
-      const result = await tc.subAgent({
-        prompt,
-        ...str3(args.agentId) ? { agentId: str3(args.agentId) } : {},
-        ...str3(args.title) ? { title: str3(args.title) } : {}
-      });
-      if (!result.ok) return err(result.error);
-      return ok({
-        conversationId: result.conversationId,
-        note: "Spawned. Don't wait \u2014 finish what else this turn can do, then end your turn; the result posts back here."
-      });
-    }
-    default:
-      return err(`unknown turn-control tool "${name}"`);
-  }
-}
-function ok(payload) {
-  return { ok: true, result: JSON.stringify(payload) };
-}
-function err(message) {
-  return { ok: false, result: `error: ${message}` };
-}
-function str3(v) {
-  return typeof v === "string" ? v : void 0;
-}
-function truncateHead(s, n) {
-  return s.length > n ? `${s.slice(0, n)}\u2026` : s;
-}
-
-// packages/agent-runtime/src/cabane-native/loop.ts
-var DEFAULT_MAX_ITERATIONS = 12;
-async function* runCabaneNativeTurn(req, signal, deps) {
-  if (!req.config.model) {
-    yield { type: "result", ok: false, reason: "no_model" };
-    return;
-  }
-  const model = parseCabaneNativeModel(req.config.model);
-  const surface = cabaneNativeSurface(req.config.runtimeOptions);
-  const turnControl = req.extra.turnControl;
-  const tools = surface === "code" ? [
-    CABANE_NATIVE_CODE_TOOL,
-    CABANE_NATIVE_RENDER_TOKEN_TOOL,
-    ...turnControl ? CABANE_NATIVE_TURN_CONTROL_TOOLS : []
-  ] : CABANE_NATIVE_TOOLS;
-  const toolCtx = {
-    apiRoot: deps.apiRoot,
-    workspaceId: deps.workspaceId,
-    bearer: deps.bearer,
-    // CT666: the origin conversation, forwarded by the `sdk` tool to the `/sdk`
-    // endpoint so a code-mode program's returning callout binds to this turn.
-    ...deps.conversationId ? { conversationId: deps.conversationId } : {},
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-  };
-  const messages = await assembleMessages(req.systemPrompt, req.content, req.prompt, {
-    apiRoot: deps.apiRoot,
-    workspaceId: deps.workspaceId,
-    bearer: deps.bearer,
-    conversationId: deps.conversationId,
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
-    ...deps.historyLimit !== void 0 ? { historyLimit: deps.historyLimit } : {}
-  });
-  if (signal.aborted) return;
-  const maxIterations = deps.maxIterations ?? DEFAULT_MAX_ITERATIONS;
-  let usage;
-  let resolvedModel = model;
-  for (let iteration = 0; iteration < maxIterations; iteration++) {
-    let text = "";
-    const toolAcc = /* @__PURE__ */ new Map();
-    let finishReason;
-    let errored2;
-    for await (const ev of deps.provider.stream({ model, messages, tools }, signal)) {
-      if (signal.aborted) return;
-      switch (ev.type) {
-        case "text":
-          text += ev.delta;
-          break;
-        case "tool_call": {
-          const cur = toolAcc.get(ev.index) ?? { id: `call_${ev.index}`, name: "", args: "" };
-          if (ev.id) cur.id = ev.id;
-          if (ev.name) cur.name = ev.name;
-          if (ev.argumentsDelta) cur.args += ev.argumentsDelta;
-          toolAcc.set(ev.index, cur);
-          break;
-        }
-        case "usage":
-          usage = {
-            inputTokens: ev.inputTokens,
-            outputTokens: ev.outputTokens,
-            contextTokens: ev.inputTokens
-          };
-          break;
-        case "model":
-          resolvedModel = ev.model;
-          break;
-        case "error":
-          errored2 = ev.message;
-          break;
-        case "done":
-          finishReason = ev.finishReason;
-          break;
-      }
-    }
-    if (signal.aborted) return;
-    if (errored2 !== void 0) {
-      const sealed = sealText(text, false);
-      if (sealed) yield sealed;
-      const failure = classifyErrorText(errored2);
-      yield {
-        type: "result",
-        ok: false,
-        reason: failure ? encodeFailureReason(failure) : `error:${errored2.slice(0, 200)}`,
-        ...usage ? { usage } : {},
-        ...resolvedModel ? { resolvedModel } : {}
-      };
-      return;
-    }
-    const toolCalls = [...toolAcc.entries()].sort((a, b) => a[0] - b[0]).map(([, v]) => v);
-    if (toolCalls.length === 0) {
-      const sealed = sealText(text, true);
-      if (sealed) yield sealed;
-      yield {
-        type: "result",
-        ok: true,
-        ...usage ? { usage } : {},
-        ...resolvedModel ? { resolvedModel } : {}
-      };
-      return;
-    }
-    const sealedInterim = sealText(text, false);
-    if (sealedInterim) yield sealedInterim;
-    const assistantToolCalls = toolCalls.map((t) => ({
-      id: t.id,
-      type: "function",
-      function: { name: t.name, arguments: t.args || "{}" }
-    }));
-    messages.push({ role: "assistant", content: text, tool_calls: assistantToolCalls });
-    for (const t of toolCalls) {
-      if (signal.aborted) return;
-      const args = parseArgs(t.args);
-      const displayName = prettyToolName(t.name);
-      const isTurnControl = CABANE_NATIVE_TURN_CONTROL_NAMES.has(t.name);
-      const summary = isTurnControl ? summarizeTurnControlArgs(t.name, args) : summarizeCabaneToolArgs(t.name, args);
-      yield { type: "tool", id: t.id, name: displayName, phase: "start", summary, input: args };
-      const result = isTurnControl && turnControl ? await executeNativeTurnControl(t.name, args, turnControl) : await executeCabaneNativeTool(t.name, args, toolCtx, signal);
-      if (signal.aborted) return;
-      yield {
-        type: "tool",
-        id: t.id,
-        name: displayName,
-        phase: result.ok ? "done" : "error",
-        summary,
-        input: args,
-        result: result.result
-      };
-      messages.push({ role: "tool", tool_call_id: t.id, content: result.result });
-    }
-  }
-  deps.onWarn?.("cabane-native: turn hit the tool-iteration cap; force-settling", {
-    maxIterations
-  });
-  yield {
-    type: "text",
-    body: `(Stopped after ${maxIterations} tool steps without a final answer.)`,
-    terminal: true
-  };
-  yield {
-    type: "result",
-    ok: true,
-    ...usage ? { usage } : {},
-    ...resolvedModel ? { resolvedModel } : {}
-  };
-}
-function sealText(text, terminal) {
-  const body = text.trim();
-  if (body.length === 0) return null;
-  return { type: "text", body, terminal };
-}
-function parseArgs(raw) {
-  if (!raw.trim()) return {};
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-
-// packages/agent-runtime/src/cabane-native/provider.ts
-var DEFAULT_OPENROUTER_BASE = "https://openrouter.ai/api/v1";
-function createOpenRouterProvider(opts) {
-  const base = (opts.baseUrl ?? DEFAULT_OPENROUTER_BASE).replace(/\/$/, "");
-  const doFetch = opts.fetchImpl ?? fetch;
-  return {
-    async *stream(req, signal) {
-      let res;
-      try {
-        res = await doFetch(`${base}/chat/completions`, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${opts.apiKey}`,
-            "Content-Type": "application/json",
-            // OpenRouter attribution headers (optional, but polite + used for
-            // routing/analytics on their side).
-            "HTTP-Referer": "https://cabane.ai",
-            "X-Title": "Cabane"
-          },
-          body: JSON.stringify({
-            model: req.model,
-            messages: req.messages,
-            ...req.tools.length > 0 ? { tools: req.tools } : {},
-            stream: true,
-            // Ask OpenRouter to append a trailing usage chunk to the stream.
-            stream_options: { include_usage: true }
-          }),
-          signal
-        });
-      } catch (err2) {
-        if (signal.aborted) return;
-        yield { type: "error", message: `request failed: ${errText(err2)}` };
-        return;
-      }
-      if (!res.ok || !res.body) {
-        const bodyText = await res.text().catch(() => "");
-        yield { type: "error", message: providerErrorMessage(res.status, bodyText) };
-        return;
-      }
-      const decoder = new TextDecoder();
-      const reader = res.body.getReader();
-      let buffer = "";
-      let finishReason;
-      let modelEmitted = false;
-      try {
-        for (; ; ) {
-          if (signal.aborted) return;
-          const { value, done } = await reader.read();
-          if (done) break;
-          buffer += decoder.decode(value, { stream: true });
-          let nl;
-          while ((nl = buffer.indexOf("\n")) !== -1) {
-            const line = buffer.slice(0, nl).trim();
-            buffer = buffer.slice(nl + 1);
-            if (!line || line.startsWith(":")) continue;
-            if (!line.startsWith("data:")) continue;
-            const data = line.slice("data:".length).trim();
-            if (data === "[DONE]") {
-              yield { type: "done", ...finishReason ? { finishReason } : {} };
-              return;
-            }
-            let chunk;
-            try {
-              chunk = JSON.parse(data);
-            } catch {
-              continue;
-            }
-            if (chunk.error) {
-              yield { type: "error", message: chunk.error.message ?? "provider error" };
-              return;
-            }
-            if (!modelEmitted && chunk.model) {
-              modelEmitted = true;
-              yield { type: "model", model: chunk.model };
-            }
-            const choice = chunk.choices?.[0];
-            if (choice) {
-              const delta = choice.delta;
-              if (delta?.content) yield { type: "text", delta: delta.content };
-              if (delta?.tool_calls) {
-                for (const tc of delta.tool_calls) {
-                  yield {
-                    type: "tool_call",
-                    index: tc.index,
-                    ...tc.id ? { id: tc.id } : {},
-                    ...tc.function?.name ? { name: tc.function.name } : {},
-                    ...tc.function?.arguments !== void 0 ? { argumentsDelta: tc.function.arguments } : {}
-                  };
-                }
-              }
-              if (choice.finish_reason) finishReason = choice.finish_reason;
-            }
-            if (chunk.usage) {
-              yield {
-                type: "usage",
-                inputTokens: chunk.usage.prompt_tokens ?? 0,
-                outputTokens: chunk.usage.completion_tokens ?? 0
-              };
-            }
-          }
-        }
-      } catch (err2) {
-        if (signal.aborted) return;
-        yield { type: "error", message: `stream read failed: ${errText(err2)}` };
-        return;
-      }
-      yield { type: "done", ...finishReason ? { finishReason } : {} };
-    }
-  };
-}
-function providerErrorMessage(status, body) {
-  let detail = body.slice(0, 300);
-  try {
-    const parsed = JSON.parse(body);
-    if (parsed.error?.message) detail = parsed.error.message;
-  } catch {
-  }
-  return `HTTP ${status}: ${detail}`;
-}
-function errText(err2) {
-  return err2 instanceof Error ? err2.message : String(err2);
-}
-
-// packages/agent-runtime/src/cabane-native/index.ts
-var CABANE_NATIVE_RUNTIME_NAME = "cabane-native";
-function createCabaneNativeAdapter(deps = {}) {
-  const provider = deps.provider ?? (deps.apiKey ? createOpenRouterProvider({
-    apiKey: deps.apiKey,
-    ...deps.baseUrl ? { baseUrl: deps.baseUrl } : {},
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-  }) : null);
-  return {
-    name: CABANE_NATIVE_RUNTIME_NAME,
-    // CT666: the native runtime's addendum is now SURFACE-aware. Code mode (the
-    // default In-Cabane surface) mounts the single `sdk` tool, so it's taught the
-    // code-mode addendum (act by writing a `cabane` SDK program; the `cabane_*`
-    // names don't exist here); classic (the retained CT663 10-tool fallback) is
-    // taught the granular `cabane_*` listing. The caller (turn-context) passes
-    // `codeMode` off the SAME lifted surface value the loop mounts tools from, so
-    // the prompt and the mounted surface can't drift. (Supersedes CT614's
-    // flag-independent addendum: native no longer ignores this arg.)
-    promptAddendum: (codeMode) => codeMode ? CABANE_NATIVE_ADDENDUM_CODE_MODE : CABANE_NATIVE_ADDENDUM,
-    dialectSchema: cabaneNativeDialectSchema,
-    async *runTurn(req, signal) {
-      if (!provider) {
-        yield {
-          type: "result",
-          ok: false,
-          reason: "cabane_native_unavailable:no OPENROUTER_API_KEY configured on this device"
-        };
-        return;
-      }
-      const workspaceId = req.cabane.workspaceId;
-      if (!workspaceId) {
-        yield {
-          type: "result",
-          ok: false,
-          reason: "cabane_native_unavailable:turn carried no workspaceId"
-        };
-        return;
-      }
-      const apiRoot = req.cabane.mcpUrl.replace(/\/mcp\/?$/, "");
-      yield* runCabaneNativeTurn(req, signal, {
-        provider,
-        apiRoot,
-        workspaceId,
-        bearer: req.cabane.bearer,
-        conversationId: req.cabane.activeConversationId,
-        ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
-        ...deps.onWarn ? { onWarn: deps.onWarn } : {},
-        ...deps.maxIterations !== void 0 ? { maxIterations: deps.maxIterations } : {}
-      });
-    }
-  };
-}
-var cabaneNativeAdapter = createCabaneNativeAdapter();
-
 // packages/agent-runtime/src/claude-code/sdk.ts
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 
@@ -6943,7 +5865,7 @@ import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync
 import { join as join12 } from "path";
 
 // src/summon.ts
-import { z as z14 } from "zod";
+import { z as z12 } from "zod";
 var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
 var SUMMON_AGENT_TOOL = "summon_agent";
 var SUMMON_AGENT_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${SUMMON_AGENT_TOOL}`;
@@ -6977,7 +5899,7 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
         SUMMON_AGENT_TOOL,
         "Summon another agent into THIS conversation \u2014 dispatch a peer to reply here on your turn. Use it to hand part of the work to a teammate, or pull in an expert, without leaving the conversation. Pass the peer's `agentId` (discover handles + ids via `list_agents`). The peer is dispatched on your turn's final reply, so write the context/ask into that reply first \u2014 it receives your message + this conversation to work from. Writing `@handle` in your prose does NOT summon anyone (agent prose never dispatches); this tool is the only in-thread lever. Single target \u2014 the last call wins. Summoning yourself is a no-op. Reach for it when the human wants the peer's answer right HERE, in front of them \u2014 the reply lands in this thread, so there's no return to wire (a return is for work YOU consume, never a courtesy notification). A handoff to a DIFFERENT conversation is `create_conversation` / `post_message` with their `dispatch` field instead.",
         {
-          agentId: z14.string().uuid().describe("The peer agent to summon \u2014 a workspace agent id from `list_agents`.")
+          agentId: z12.string().uuid().describe("The peer agent to summon \u2014 a workspace agent id from `list_agents`.")
         },
         async (args) => {
           summonState.agentId = args.agentId;
@@ -6992,7 +5914,7 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
           SKIP_TURN_TOOL,
           `End your current turn WITHOUT posting a reply. Call this when you've been dispatched but the message genuinely doesn't need a response from you \u2014 a thanks/aside, a question already answered, chatter outside your lane, or a pile-on where someone else has it. Your turn ends silently: no message bubble is posted. The \`reason\` is a short free-text note for telemetry (e.g. "already answered by cabane", "thanks, nothing to add"). Prefer this over posting a low-value "ok!"/"got it" reply. Don't also write a reply when you skip \u2014 skipping IS the whole turn.`,
           {
-            reason: z14.string().min(1).max(500).describe("Short reason you are declining \u2014 used for telemetry/debugging.")
+            reason: z12.string().min(1).max(500).describe("Short reason you are declining \u2014 used for telemetry/debugging.")
           },
           async (args) => {
             skipState.skipped = true;
@@ -7009,21 +5931,21 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
           ASK_TOOL,
           "Ask a HUMAN a structured question (or a short LIST of them) you need answered to continue, then END your turn \u2014 don't wait for the reply. Use it when you genuinely can't proceed without a person's input (a decision only they can make, a missing fact, a go/no-go). Pass `targetUserId` (a workspace member's user id \u2014 get it from `mcp__cabane__list_members`). Two forms: a SINGLE question \u2014 a `headline` (the actual question as one clear, capitalized sentence ending in `?`, \"Do we go to prod?\") plus a short `question` body for the framing the headline can't hold \u2014 OR, when a plan ends with SEVERAL bounded decisions at once (\"three calls before I build: A? B? C?\"), a `questions` array of 1\u20135 items, each `{ headline, body?, options? }`. **Prefer the list over cramming the extra decisions into prose or dropping them** \u2014 end the turn with one ask carrying every question, never pick one and bury the rest. Each question keeps the same form rules: a one-sentence `headline`, a short `body` frame (NOT a report \u2014 your status, links, and detail go in your REPLY, and the body renders inline markdown only: links/emphasis/inline code, no bulleted lists or headings), and 2\u20134 `options` when the answer is a bounded choice \u2014 for a yes/no go-ahead always pass them, so it's one click, not a typed reply. An option can be a short button label OR a sentence that carries its own context; short/binary sets render as inline buttons, long ones stack full-width. Provide EITHER `question` (single) or `questions` (array), never both. The ask is recorded as a first-class attention item aimed at that person; your final reply carries the surrounding CONTEXT (what you found, why you're stuck), the ask carries the QUESTION(S). An open ask marks you as blocked until EVERY question is answered, so raise one only when you truly can't proceed \u2014 never ceremonially. One ask per turn (last call wins). After asking, stop \u2014 when the person replies addressed to you, the ask resolves and you resume; other people's or agents' messages may wake you but leave it open. Targets a human only; to hand work to another AGENT use summon/dispatch instead.",
           {
-            targetUserId: z14.string().uuid().describe("The workspace member (human) to ask \u2014 a user id from `list_members`."),
-            question: z14.string().min(1).max(400).optional().describe(
+            targetUserId: z12.string().uuid().describe("The workspace member (human) to ask \u2014 a user id from `list_members`."),
+            question: z12.string().min(1).max(400).optional().describe(
               "SINGLE-question form: a short body \u2014 one or two sentences of framing the headline can't hold. NOT a report (capped, inline markdown only). Provide EITHER this or `questions`, not both. Put the crisp one-sentence question in `headline`."
             ),
-            headline: z14.string().min(1).max(120).optional().describe(
+            headline: z12.string().min(1).max(120).optional().describe(
               'SINGLE-question form: the question itself as ONE clear, capitalized sentence ending in `?` ("Do we go to prod?"). What the human reads first in the inbox and the chip \u2014 one scannable question, no elaboration (that goes in `question`). Strongly encouraged.'
             ),
-            options: z14.array(z14.string().min(1).max(200)).min(2).max(4).optional().describe("SINGLE-question form: optional 2\u20134 suggested one-click answers."),
-            questions: z14.array(
-              z14.object({
-                headline: z14.string().min(1).max(120).describe(
+            options: z12.array(z12.string().min(1).max(200)).min(2).max(4).optional().describe("SINGLE-question form: optional 2\u20134 suggested one-click answers."),
+            questions: z12.array(
+              z12.object({
+                headline: z12.string().min(1).max(120).describe(
                   'The one-sentence question ("Do we go to prod?") \u2014 required for each item.'
                 ),
-                body: z14.string().min(1).max(400).optional().describe("Optional short framing beneath the headline. NOT a report."),
-                options: z14.array(z14.string().min(1).max(200)).min(2).max(4).optional().describe("Optional 2\u20134 one-click answers for this question.")
+                body: z12.string().min(1).max(400).optional().describe("Optional short framing beneath the headline. NOT a report."),
+                options: z12.array(z12.string().min(1).max(200)).min(2).max(4).optional().describe("Optional 2\u20134 one-click answers for this question.")
               })
             ).min(1).max(5).optional().describe(
               "MULTI-question form: 1\u20135 questions to ask at once, when a plan ends with several bounded decisions. Provide EITHER this or `question`/`headline`/`options`, not both."
@@ -7080,13 +6002,13 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
           SUB_AGENT_TOOL,
           "Spawn a sub-agent \u2014 hand a piece of work to a private worker with a fresh context window, whose result comes back to you automatically. Modeled on the Task tool, with ONE deliberate difference: it does NOT return the result inline. A callee's turn can run for minutes and no turn may hold an unbounded wait, so the shape is spawn-now, results-on-wake \u2014 this returns immediately with the child's `conversationId`, and the outcome lands LATER as a message in THIS conversation; you're woken once every sub-agent you have out in this conversation has returned. So DON'T wait for it: after spawning, finish whatever else this turn can do and end your turn (never poll the child with reads in a loop \u2014 the wake is automatic). Parallel fan-out = call this N times in one turn (they run concurrently; ONE wake when all are in); series = one call per turn. `prompt` is the child's opening instruction \u2014 make it self-contained (the sub-agent starts fresh, with only this prompt + the thread it lands in). `agentId` (optional) dispatches a PEER instead of yourself \u2014 same mechanics, a different mind (use for capability/context you lack); default (self) is the pure sub-worker with a clean context window. `title` (optional) names the child thread (results link it, so a legible title helps). A single sub-agent has no wall-clock advantage (you idle either way) \u2014 it pays when the callee has capability/context you lack, or to isolate a big read from your own session; the real win is fan-out. Don't spawn one for a lookup you can do in-turn with your own tools. The result returns to YOU to act on \u2014 reach for it when you're the consumer of the output, not as a way to notify a human: if a person just wants to read the result, dispatch a plain (no-return) conversation and link it instead of spawning a sub-agent.",
           {
-            prompt: z14.string().min(1).max(65536).describe(
+            prompt: z12.string().min(1).max(65536).describe(
               "The sub-agent's opening instruction \u2014 self-contained (it starts with a fresh context window; only this prompt + the thread it lands in)."
             ),
-            agentId: z14.string().uuid().optional().describe(
+            agentId: z12.string().uuid().optional().describe(
               "Optional peer to run the sub-agent as (a workspace agent id from `list_agents`); omit to spawn yourself with a fresh context window."
             ),
-            title: z14.string().max(200).optional().describe("Optional title for the child thread (result chips link it).")
+            title: z12.string().max(200).optional().describe("Optional title for the child thread (result chips link it).")
           },
           async (args) => {
             const result = await subAgentCreate(args);
@@ -7116,13 +6038,13 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
           WAKE_ME_TOOL,
           'Wake yourself later \u2014 end this turn now and be re-dispatched at a time you pick, with a note you write to yourself. Use it for "wait until X": when the thing you need hasn\'t happened yet (a conversation isn\'t done, a PR isn\'t merged, a human hasn\'t answered), arm a wake, end your turn, and you\'re woken later to CHECK \u2014 read the workspace, and either act or re-arm. This is the loop behind "check back in five minutes", "keep checking until {condition}", and a scheduled re-try ("re-send once that agent\'s limit resets"). Ground the delay before you arm it. Almost every wake is short \u2014 seconds to a couple of hours \u2014 waiting on a condition you can name: a session limit resetting, a PR merging, a deploy landing, a throttled dispatch to re-send. Reach past a few hours only when (a) a human asked for that timing, or (b) the wait is pinned to a real external event you can name \u2014 a report that only runs Mondays, a scheduled appointment, a known reset time. A speculative far-future check-in you invented yourself \u2014 "in two weeks I\'ll see whether this feature is used" \u2014 is the one thing not to arm: if no one asked and you can\'t name both what clears the wait and why it takes that long, don\'t arm it \u2014 finish now, or raise an `ask`. Pass EXACTLY ONE of `afterSeconds` (a relative delay \u2014 `300` for five minutes) or `at` (an absolute ISO-8601 timestamp WITH a zone, e.g. `2026-07-16T09:00:00-07:00` \u2014 YOU compute it from a phrase like "tomorrow morning"; the system never parses natural-language time). `note` is a message to your future self \u2014 it becomes the body of the wake message that re-dispatches you, so write the condition to re-check ("check whether CT441 merged yet"). The wake is armed when your turn SETTLES, not now, so the delay counts from the turn ending; one wake per turn (last call wins). This is the sanctioned way to schedule your own continuation \u2014 the ONLY one; never reach for a host cron/scheduler. Guardrails: at least 60s out, at most 14 days; widen the interval as a loop ages (5m \u2192 15m \u2192 1h\u2026) rather than hammering; after many consecutive re-arms with no other activity you\'ll be steered to raise an `ask` to the human instead. If a wake can\'t be armed you\'re re-dispatched with a note explaining why \u2014 never a silent drop.',
           {
-            afterSeconds: z14.number().int().positive().optional().describe(
+            afterSeconds: z12.number().int().positive().optional().describe(
               "Relative delay in seconds from when this turn ends (e.g. 300 = five minutes). Provide EITHER this or `at`, not both. Floor 60s, horizon 14 days \u2014 enforced server-side."
             ),
-            at: z14.string().datetime({ offset: true }).optional().describe(
+            at: z12.string().datetime({ offset: true }).optional().describe(
               "Absolute ISO-8601 timestamp WITH a zone (`Z` or `\xB1HH:MM`), e.g. `2026-07-16T09:00:00-07:00`. YOU compute it from a natural-language phrase using the current datetime in your turn context. Provide EITHER this or `afterSeconds`, not both."
             ),
-            note: z14.string().min(1).max(2e3).describe(
+            note: z12.string().min(1).max(2e3).describe(
               'A note to your future self \u2014 becomes the body of the wake message that re-dispatches you. Write the condition to re-check ("check whether the PR merged").'
             )
           },
@@ -7202,7 +6124,6 @@ function buildCompanionTurnRequest(params) {
     local: {
       ...params.cwd ? { cwd: params.cwd } : {},
       ...params.env ? { env: params.env } : {},
-      ...params.nativeWorkAssignment ? { nativeWorkAssignment: params.nativeWorkAssignment } : {},
       // User MCP servers (already `${PLACEHOLDER}`-resolved). Structurally the
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
@@ -7210,10 +6131,9 @@ function buildCompanionTurnRequest(params) {
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
     // Host-injected: the companion-local summon server (for the subprocess adapters,
-    // under its own namespace) + the cabane-native turn-control handler (CT666).
+    // under its own namespace).
     extra: {
-      mcpServers: { [COMPANION_LOCAL_MCP_SERVER]: params.summonServer },
-      turnControl: params.turnControl
+      mcpServers: { [COMPANION_LOCAL_MCP_SERVER]: params.summonServer }
     }
   };
 }
@@ -7230,23 +6150,18 @@ function dirFor(workspaceId) {
 function conversationDir(workspaceId, conversationId) {
   return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
-function pathFor3(workspaceId, conversationId, agentId, assignmentKey) {
-  const suffix = assignmentKey ? `--${encodeURIComponent(assignmentKey)}` : "";
-  return join9(
-    conversationDir(workspaceId, conversationId),
-    `${encodeURIComponent(agentId)}${suffix}.json`
-  );
+function pathFor3(workspaceId, conversationId, agentId) {
+  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
-function readPrepared(workspaceId, conversationId, agentId, assignmentKey) {
-  const path3 = pathFor3(workspaceId, conversationId, agentId, assignmentKey);
+function readPrepared(workspaceId, conversationId, agentId) {
+  const path3 = pathFor3(workspaceId, conversationId, agentId);
   if (!existsSync7(path3)) return null;
   try {
     const parsed = JSON.parse(readFileSync6(path3, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
       return {
         cwd: parsed.cwd,
-        ...parsed.env && typeof parsed.env === "object" ? { env: parsed.env } : {},
-        ...parsed.nativeWorkAssignment && typeof parsed.nativeWorkAssignment === "object" ? { nativeWorkAssignment: parsed.nativeWorkAssignment } : {}
+        ...parsed.env && typeof parsed.env === "object" ? { env: parsed.env } : {}
       };
     }
     return null;
@@ -7254,10 +6169,10 @@ function readPrepared(workspaceId, conversationId, agentId, assignmentKey) {
     return null;
   }
 }
-function writePrepared(workspaceId, conversationId, agentId, result, assignmentKey) {
+function writePrepared(workspaceId, conversationId, agentId, result) {
   mkdirSync7(conversationDir(workspaceId, conversationId), { recursive: true });
   writeFileSync6(
-    pathFor3(workspaceId, conversationId, agentId, assignmentKey),
+    pathFor3(workspaceId, conversationId, agentId),
     JSON.stringify(result) + "\n",
     "utf8"
   );
@@ -7266,30 +6181,30 @@ function writePrepared(workspaceId, conversationId, agentId, result, assignmentK
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
 import { join as join10 } from "path";
-import { z as z15 } from "zod";
+import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
   return join10(cabaneDir(), "secrets.json");
 }
-var secretStoreSchema = z15.record(z15.string(), z15.string());
+var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
   const path3 = secretsPath();
   if (!existsSync8(path3)) return makeStore({});
   let raw;
   try {
     raw = readFileSync7(path3, "utf8");
-  } catch (err2) {
+  } catch (err) {
     throw new ConfigError(
-      `couldn't read ${path3}: ${err2 instanceof Error ? err2.message : String(err2)}`
+      `couldn't read ${path3}: ${err instanceof Error ? err.message : String(err)}`
     );
   }
   if (raw.trim().length === 0) return makeStore({});
   let parsed;
   try {
     parsed = JSON.parse(raw);
-  } catch (err2) {
+  } catch (err) {
     throw new ConfigError(
-      `${path3} is not valid JSON: ${err2 instanceof Error ? err2.message : String(err2)}. It must be a flat object of "NAME": "value" secret pairs.`
+      `${path3} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
     );
   }
   const result = secretStoreSchema.safeParse(parsed);
@@ -7303,8 +6218,8 @@ function loadSecretStore() {
 function loadSecretStoreTolerant(onWarn) {
   try {
     return loadSecretStore();
-  } catch (err2) {
-    onWarn?.(err2 instanceof Error ? err2.message : String(err2));
+  } catch (err) {
+    onWarn?.(err instanceof Error ? err.message : String(err));
     return makeStore({});
   }
 }
@@ -7375,8 +6290,8 @@ var TranscriptWriter = class {
       } catch {
       }
       pruneOld(dir2, RETAIN);
-    } catch (err2) {
-      this.fail(err2);
+    } catch (err) {
+      this.fail(err);
     }
     this.line({ type: "_meta", ...meta });
   }
@@ -7392,14 +6307,14 @@ var TranscriptWriter = class {
     if (this.broken) return;
     try {
       appendFileSync(this.path, JSON.stringify(obj) + "\n", { mode: 384 });
-    } catch (err2) {
-      this.fail(err2);
+    } catch (err) {
+      this.fail(err);
     }
   }
-  fail(err2) {
+  fail(err) {
     if (this.broken) return;
     this.broken = true;
-    this.onWarn?.(`transcript write failed (${err2 instanceof Error ? err2.message : String(err2)})`);
+    this.onWarn?.(`transcript write failed (${err instanceof Error ? err.message : String(err)})`);
   }
 };
 function fileName(meta) {
@@ -7437,9 +6352,9 @@ var EMPTY_FINAL_BODY = "Done \u2014 see the changes above.";
 var TurnCommitter = class {
   constructor(deps) {
     this.deps = deps;
-    this.onError = (err2, hook) => {
+    this.onError = (err, hook) => {
       deps.log.warn(
-        { err: err2 instanceof Error ? err2.message : String(err2), hook },
+        { err: err instanceof Error ? err.message : String(err), hook },
         "dispatcher: transcript callback failed"
       );
     };
@@ -7504,9 +6419,9 @@ var TurnCommitter = class {
       signal: deps.signal,
       nextSeq: deps.nextSeq,
       emptyFinalBody: EMPTY_FINAL_BODY,
-      onError: (err2) => {
+      onError: (err) => {
         deps.log.warn(
-          { err: err2 instanceof Error ? err2.message : String(err2) },
+          { err: err instanceof Error ? err.message : String(err) },
           "dispatcher: empty-final commit failed"
         );
       }
@@ -7529,8 +6444,8 @@ var TurnCommitter = class {
     if (event.type === "session" || event.type === "result") return;
     try {
       await this.emit(event);
-    } catch (err2) {
-      this.onError(err2, event.type);
+    } catch (err) {
+      this.onError(err, event.type);
     }
   }
   // End-of-turn empty-final promotion. The held-text flush is now the adapter's
@@ -7726,10 +6641,27 @@ var UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't disp
 var SKIPPED_MARKER_BODY = "(skipped)";
 var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 10 * 6e4;
-var DEFAULT_AGENT_TOTAL_TIMEOUT_MS = 45 * 6e4;
+var DEFAULT_AGENT_TOTAL_TIMEOUT_MS = 6 * 60 * 6e4;
 function runKey(conversationId, agentId) {
   return `${conversationId}|${agentId}`;
 }
+function describeSubAgentError(status, body) {
+  const code = body && typeof body === "object" && "error" in body ? String(body.error) : void 0;
+  switch (code) {
+    case "callout_cap_exceeded":
+      return "sub_agent: you already have the maximum open sub-agents for this thread. Wait for some to return \u2014 you're woken once they're all back \u2014 before spawning more.";
+    case "callout_depth_exceeded":
+      return "sub_agent: this would nest sub-agents too deep (max 3 levels). Have the current worker report back rather than spawning another layer.";
+    case "dispatch_agent_not_found":
+      return "sub_agent: no live agent in this workspace matches that `agentId`. Check `list_agents`, or omit `agentId` to spawn yourself.";
+    case "dispatch_return_requires_turn":
+    case "dispatch_return_requires_agent":
+    case "dispatch_return_requires_dispatch":
+      return `sub_agent: the spawn was rejected (${code}). This is a turn-context problem, not something to retry blindly \u2014 report it rather than looping.`;
+    default:
+      return `sub_agent: the spawn failed (${code ?? `HTTP ${status}`}).`;
+  }
+}
 var Dispatcher = class {
   constructor(opts) {
     this.opts = opts;
@@ -7756,7 +6688,7 @@ var Dispatcher = class {
   // clear it — the SJ383 `finally` after the SDK loop is the one clear, and
   // every pre-run exit returns before reaching it. So each pre-run failure has
   // to clear `active_run_started_at` itself, mirroring that `finally`, or the
-  // indicator strands until the 90-min age sweep.
+  // indicator strands until the 12h age sweep.
   //
   // `errorReason` controls the server's duplicate-notice rule (the active-run
   // PATCH handler in conversations.ts): a clear carrying `errorReason` makes the
@@ -7776,9 +6708,9 @@ var Dispatcher = class {
         payload.agentId,
         body
       );
-    } catch (err2) {
+    } catch (err) {
       turnLog.warn(
-        { err: err2 instanceof Error ? err2.message : String(err2) },
+        { err: err instanceof Error ? err.message : String(err) },
         "dispatcher: pre-run active-run clear failed terminally; server age-sweep is the backstop"
       );
     }
@@ -7804,16 +6736,16 @@ var Dispatcher = class {
         payload.messageId,
         turnId
       );
-    } catch (err2) {
-      const status = err2 instanceof ApiError ? err2.status : 0;
+    } catch (err) {
+      const status = err instanceof ApiError ? err.status : 0;
       if (status === 404) {
         turnLog.warn(
-          { err: err2 instanceof Error ? err2.message : String(err2) },
+          { err: err instanceof Error ? err.message : String(err) },
           "dispatcher: turn-context 404 (stale event \u2014 conversation/message/participant gone); skipping"
         );
         return this.concludeBeforeRun(payload, turnLog, startedAt, "turn_context_not_found");
       }
-      const reason = err2 instanceof Error ? err2.message : String(err2);
+      const reason = err instanceof Error ? err.message : String(err);
       turnLog.error({ err: reason }, "dispatcher: failed to fetch turn context");
       const fetchReason = `fetch_failed: ${reason}`;
       return this.concludeBeforeRun(payload, turnLog, startedAt, fetchReason, fetchReason);
@@ -7876,20 +6808,11 @@ var Dispatcher = class {
       effectiveCwd = void 0;
     }
     let hookEnv;
-    let preparedNativeAssignment;
     if (prepareHook) {
-      const assignment = turnContext.conversation.nativeWorkAssignment;
-      const assignmentKey = assignment ? `${assignment.executionId}:${assignment.activationEpoch}` : void 0;
-      const cached2 = readPrepared(
-        workspaceId,
-        payload.conversationId,
-        payload.agentId,
-        assignmentKey
-      );
+      const cached2 = readPrepared(workspaceId, payload.conversationId, payload.agentId);
       if (cached2) {
         effectiveCwd = cached2.cwd;
         hookEnv = cached2.env;
-        preparedNativeAssignment = cached2.nativeWorkAssignment;
       } else {
         const delayMs = this.opts.preparingRowDelayMs ?? DEFAULT_PREPARING_ROW_DELAY_MS;
         let preparingStarted = false;
@@ -7904,9 +6827,9 @@ var Dispatcher = class {
             summary: "",
             phase,
             seq
-          }).catch((err2) => {
+          }).catch((err) => {
             turnLog.warn(
-              { err: err2 instanceof Error ? err2.message : String(err2), phase },
+              { err: err instanceof Error ? err.message : String(err), phase },
               "dispatcher: preparing-activity report failed (continuing with the hook)"
             );
           });
@@ -7928,25 +6851,17 @@ var Dispatcher = class {
             // tasker prepare hook keys its per-task env off. Defaults to `[]` for
             // an older API. The conversation anchor is gone (CT319).
             triggerEntryPaths: turnContext.conversation.triggerEntryPaths ?? [],
-            ...turnContext.conversation.nativeWorkAssignment ? { nativeWorkAssignment: turnContext.conversation.nativeWorkAssignment } : {},
             title: turnContext.conversation.title
           });
           clearTimeout(preparingTimer);
           if (preparingStarted) reportPreparing("done");
-          writePrepared(
-            workspaceId,
-            payload.conversationId,
-            payload.agentId,
-            result,
-            assignmentKey
-          );
+          writePrepared(workspaceId, payload.conversationId, payload.agentId, result);
           effectiveCwd = result.cwd;
           hookEnv = result.env;
-          preparedNativeAssignment = result.nativeWorkAssignment;
-        } catch (err2) {
+        } catch (err) {
           clearTimeout(preparingTimer);
           if (preparingStarted) reportPreparing("error");
-          const reason = err2 instanceof Error ? err2.message : String(err2);
+          const reason = err instanceof Error ? err.message : String(err);
           turnLog.error({ err: reason }, "dispatcher: prepare hook failed");
           try {
             await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
@@ -7969,6 +6884,19 @@ ${reason}`,
         }
       }
     }
+    let turnEnv = hookEnv;
+    if (effectiveCwd && turnContext.runtime === "codex") {
+      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      try {
+        mkdirSync9(tmpDir, { recursive: true });
+        turnEnv = { ...hookEnv, TMPDIR: tmpDir };
+      } catch (err) {
+        turnLog.warn(
+          { err: err instanceof Error ? err.message : String(err), tmpDir },
+          "dispatcher: failed to create per-turn TMPDIR \u2014 proceeding with the inherited temp dir"
+        );
+      }
+    }
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);
@@ -7983,9 +6911,9 @@ ${reason}`,
         // this live turn for an abandoned one and close it with a `stopped`.
         turnId
       });
-    } catch (err2) {
+    } catch (err) {
       turnLog.warn(
-        { err: err2 instanceof Error ? err2.message : String(err2) },
+        { err: err instanceof Error ? err.message : String(err) },
         "dispatcher: active-run flag set failed terminally; proceeding"
       );
     }
@@ -8022,35 +6950,6 @@ ${reason}`,
       subAgentCreate,
       wakeState
     );
-    const nativeTurnControl = {
-      summon: (agentId) => {
-        summonState.agentId = agentId;
-      },
-      skip: (reason) => {
-        skipState.skipped = true;
-        skipState.reason = reason;
-      },
-      ask: (p) => {
-        askState.targetUserId = p.targetUserId;
-        if (p.questions && p.questions.length > 0) {
-          askState.questions = p.questions;
-          askState.question = null;
-          askState.headline = null;
-          askState.options = null;
-        } else {
-          askState.question = p.question ?? null;
-          askState.headline = p.headline ?? null;
-          askState.options = p.options ?? null;
-          askState.questions = null;
-        }
-      },
-      wake: (p) => {
-        wakeState.afterSeconds = p.afterSeconds ?? null;
-        wakeState.at = p.at ?? null;
-        wakeState.note = p.note;
-      },
-      subAgent: subAgentCreate
-    };
     const request = buildCompanionTurnRequest({
       turnContext,
       baseUrl: this.opts.baseUrl,
@@ -8060,11 +6959,11 @@ ${reason}`,
       ...turnContext.turnToken ? { turnToken: turnContext.turnToken } : {},
       // SJ524: the hook-resolved cwd overrides the static local cwd.
       ...effectiveCwd ? { cwd: effectiveCwd } : {},
-      ...hookEnv ? { env: hookEnv } : {},
-      ...preparedNativeAssignment ? { nativeWorkAssignment: preparedNativeAssignment } : {},
+      // CT804: `turnEnv` = the prepare-hook env plus the per-turn checkout-local
+      // TMPDIR (falls back to `hookEnv` when no cwd was resolved).
+      ...turnEnv ? { env: turnEnv } : {},
       mcpServers: resolvedMcpServers,
       summonServer,
-      turnControl: nativeTurnControl,
       // CT238: this turn's conversation, forwarded as the active-conversation
       // header so a cross-thread post/spawn stamps its origin.
       activeConversationId: payload.conversationId,
@@ -8082,22 +6981,19 @@ ${reason}`,
     if (this.opts.codexEnabled) {
       adapters.push(createCodexAdapter({ enabled: true, onWarn }));
     }
-    if (this.opts.cabaneNativeApiKey) {
-      adapters.push(createCabaneNativeAdapter({ apiKey: this.opts.cabaneNativeApiKey, onWarn }));
-    }
     const registry = createAdapterRegistry(adapters);
     let adapter;
     try {
       adapter = selectAdapter(registry, turnContext.runtime);
-    } catch (err2) {
-      if (!(err2 instanceof RuntimeUnavailableError)) throw err2;
+    } catch (err) {
+      if (!(err instanceof RuntimeUnavailableError)) throw err;
       turnLog.error(
-        { runtime: err2.runtime, available: err2.available },
+        { runtime: err.runtime, available: err.available },
         "dispatcher: turn runtime not available on this device"
       );
       try {
         await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
-          body: `${RUNTIME_UNAVAILABLE_PREFIX} ${err2.message}`,
+          body: `${RUNTIME_UNAVAILABLE_PREFIX} ${err.message}`,
           kind: "final",
           turnId,
           parentMessageId: payload.messageId
@@ -8112,7 +7008,7 @@ ${reason}`,
         payload,
         turnLog,
         startedAt,
-        `runtime_unavailable:${err2.runtime}`
+        `runtime_unavailable:${err.runtime}`
       );
     }
     if (prepareHook && hookEnv?.CABANE_TASK_ID) {
@@ -8246,9 +7142,9 @@ ${reason}`,
           skipState.skipped = true;
           skipState.reason = intent.skipReason;
         }
-      } catch (err2) {
+      } catch (err) {
         turnLog.warn(
-          { err: err2 instanceof Error ? err2.message : String(err2) },
+          { err: err instanceof Error ? err.message : String(err) },
           "dispatcher: turn-control intent fetch failed; turn-control effects for this turn are dropped"
         );
       }
@@ -8294,9 +7190,9 @@ ${reason}`,
                 payload.agentId,
                 { agentSessionId: event.state }
               );
-            } catch (err2) {
+            } catch (err) {
               turnLog.warn(
-                { err: err2 instanceof Error ? err2.message : String(err2) },
+                { err: err instanceof Error ? err.message : String(err) },
                 "dispatcher: session-id write failed (will retry next turn)"
               );
             }
@@ -8345,18 +7241,18 @@ ${reason}`,
             parentMessageId: payload.messageId,
             ...skipWake ? { wake: skipWake } : {}
           });
-        } catch (err2) {
+        } catch (err) {
           turnLog.warn(
-            { err: err2 instanceof Error ? err2.message : String(err2) },
+            { err: err instanceof Error ? err.message : String(err) },
             "dispatcher: skipped-marker commit failed"
           );
         }
       } else {
         await committer.finalize(okResult);
       }
-    } catch (err2) {
+    } catch (err) {
       okResult = false;
-      resultReason = err2 instanceof Error ? err2.message : String(err2);
+      resultReason = err instanceof Error ? err.message : String(err);
       turnLog.error({ err: resultReason }, "dispatcher: SDK query threw");
     } finally {
       if (idleTimer) clearTimeout(idleTimer);
@@ -8392,9 +7288,9 @@ ${reason}`,
             // CT113: the stopped marker is still "about" the triggering message.
             parentMessageId: payload.messageId
           });
-        } catch (err2) {
+        } catch (err) {
           turnLog.warn(
-            { err: err2 instanceof Error ? err2.message : String(err2) },
+            { err: err instanceof Error ? err.message : String(err) },
             "dispatcher: stopped-marker commit failed"
           );
         }
@@ -8435,9 +7331,9 @@ ${reason}`,
           payload.agentId,
           body
         );
-      } catch (err2) {
+      } catch (err) {
         turnLog.warn(
-          { err: err2 instanceof Error ? err2.message : String(err2) },
+          { err: err instanceof Error ? err.message : String(err) },
           "dispatcher: active-run clear failed terminally; server age-sweep is the backstop"
         );
       }
@@ -8505,7 +7401,6 @@ function buildCompanionManifest(opts) {
   if (opts.claudeCode) runtimes.push({ name: "claude-code", version: v.claudeCode ?? null });
   if (opts.opencode) runtimes.push({ name: "opencode", version: v.opencode ?? null });
   if (opts.codex) runtimes.push({ name: "codex", version: v.codex ?? null });
-  if (opts.cabaneNative) runtimes.push({ name: "cabane-native", version: null });
   return { runtimes, capabilities: { ...DEVICE_MANIFEST.capabilities } };
 }
 
@@ -8743,13 +7638,13 @@ var Outbox = class {
     try {
       writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
       renameSync3(tmp, target);
-    } catch (err2) {
+    } catch (err) {
       try {
         rmSync5(tmp, { force: true });
       } catch {
       }
       this.log?.warn(
-        { workspaceId: this.workspaceId, err: err2 instanceof Error ? err2.message : String(err2) },
+        { workspaceId: this.workspaceId, err: err instanceof Error ? err.message : String(err) },
         "companion outbox: failed to persist entry"
       );
       return;
@@ -8846,40 +7741,43 @@ var Outbox = class {
 };
 
 // src/run-config.ts
-import { z as z16 } from "zod";
-var mcpStdioServerSchema = z16.object({
-  type: z16.literal("stdio").optional(),
-  command: z16.string().min(1),
-  args: z16.array(z16.string()).optional(),
-  env: z16.record(z16.string(), z16.string()).optional()
+import { z as z14 } from "zod";
+var mcpStdioServerSchema = z14.object({
+  type: z14.literal("stdio").optional(),
+  command: z14.string().min(1),
+  args: z14.array(z14.string()).optional(),
+  env: z14.record(z14.string(), z14.string()).optional()
 });
-var mcpHttpServerSchema = z16.object({
-  type: z16.literal("http"),
-  url: z16.string().url(),
-  headers: z16.record(z16.string(), z16.string()).optional()
+var mcpHttpServerSchema = z14.object({
+  type: z14.literal("http"),
+  url: z14.string().url(),
+  headers: z14.record(z14.string(), z14.string()).optional()
 });
-var mcpSseServerSchema = z16.object({
-  type: z16.literal("sse"),
-  url: z16.string().url(),
-  headers: z16.record(z16.string(), z16.string()).optional()
+var mcpSseServerSchema = z14.object({
+  type: z14.literal("sse"),
+  url: z14.string().url(),
+  headers: z14.record(z14.string(), z14.string()).optional()
 });
-var mcpServerDefSchema = z16.union([
+var mcpServerDefSchema = z14.union([
   mcpHttpServerSchema,
   mcpSseServerSchema,
   mcpStdioServerSchema
 ]);
-var thinkingConfigSchema = z16.discriminatedUnion("type", [
-  z16.object({ type: z16.literal("adaptive") }),
-  z16.object({ type: z16.literal("enabled"), budgetTokens: z16.number().int().positive().optional() }),
-  z16.object({ type: z16.literal("disabled") })
+var thinkingConfigSchema = z14.discriminatedUnion("type", [
+  z14.object({ type: z14.literal("adaptive") }),
+  z14.object({ type: z14.literal("enabled"), budgetTokens: z14.number().int().positive().optional() }),
+  z14.object({ type: z14.literal("disabled") })
 ]);
-var effortSchema = z16.enum(["low", "medium", "high", "xhigh", "max"]);
-var runConfigSchema = z16.object({
-  mode: z16.enum(["assistant", "coding", "custom"]).optional(),
-  allowedTools: z16.array(z16.string()).optional(),
-  disallowedTools: z16.array(z16.string()).optional(),
-  mcpServers: z16.record(z16.string(), mcpServerDefSchema).optional(),
-  model: z16.string().min(1).optional(),
+var effortSchema = z14.enum(["low", "medium", "high", "xhigh", "max"]);
+var runConfigSchema = z14.object({
+  // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
+  // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
+  // is the locked surface. Kept in lockstep with `@cabane/shared`'s
+  // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
+  // stripped, so an older companion riding a newer server never rejects the config).
+  hostAccess: z14.boolean().optional(),
+  mcpServers: z14.record(z14.string(), mcpServerDefSchema).optional(),
+  model: z14.string().min(1).optional(),
   thinking: thinkingConfigSchema.optional(),
   effort: effortSchema.optional()
 });
@@ -8924,20 +7822,20 @@ var SseSubscriber = class {
       try {
         await this.connect();
         backoff = 500;
-      } catch (err2) {
+      } catch (err) {
         if (this.aborted) return;
-        if (err2 instanceof ApiError && (err2.status === 401 || err2.status === 403)) {
+        if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
           this.opts.log.error(
-            { workspaceId: this.opts.workspaceId, status: err2.status },
+            { workspaceId: this.opts.workspaceId, status: err.status },
             "SSE auth failed \u2014 tearing down this workspace subscriber"
           );
-          this.opts.onAuthFailure(err2.status);
+          this.opts.onAuthFailure(err.status);
           return;
         }
         this.opts.log.warn(
           {
             workspaceId: this.opts.workspaceId,
-            err: err2 instanceof Error ? err2.message : String(err2),
+            err: err instanceof Error ? err.message : String(err),
             backoff
           },
           "SSE disconnected; reconnecting"
@@ -9080,7 +7978,7 @@ var CompanionSupervisor = class {
     if (!this.config.deviceToken) {
       this.log.warn("companion: not paired (no device token) \u2014 run `cabane-companion pair`");
       process.stdout.write(
-        "companion: this device is not paired \u2014 run `cabane-companion pair` and paste the string from the cabane app.\n"
+        "companion: this device is not paired \u2014 run `cabane-companion pair`, then confirm the short code in Settings \u2192 Connectors.\n"
       );
       return;
     }
@@ -9135,9 +8033,6 @@ var CompanionSupervisor = class {
           // like opencode — the CLI's presence is the operator's responsibility;
           // a misconfigured device fails the turn loudly, never silently).
           codex: isCodexEnabled(this.config),
-          // CT598: advertise the native runtime when an OpenRouter key is set. Key
-          // absent → not advertised, so a native turn never routes here.
-          cabaneNative: isCabaneNativeEnabled(),
           // CT571/CT586: each runtime's `version` from the latest harness probe
           // (fail-soft to null). Informational only — the server matches on name.
           versions: this.harnessVersions
@@ -9155,9 +8050,9 @@ var CompanionSupervisor = class {
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
       this.checkVersionSkew(res.serverVersion);
-    } catch (err2) {
+    } catch (err) {
       this.log.warn(
-        { err: err2 instanceof Error ? err2.message : String(err2) },
+        { err: err instanceof Error ? err.message : String(err) },
         "companion: device heartbeat failed (will retry on next tick)"
       );
     }
@@ -9193,12 +8088,12 @@ var CompanionSupervisor = class {
           const resp = await this.deviceApi.getAssignments();
           items = resp.assignments;
           device = resp.device;
-        } catch (err2) {
+        } catch (err) {
           this.log.error(
-            { err: err2 instanceof Error ? err2.message : String(err2) },
+            { err: err instanceof Error ? err.message : String(err) },
             "companion: assignments pull failed \u2014 check the device is still active in the cabane app"
           );
-          this.hub.setDeviceError(err2 instanceof Error ? err2.message : String(err2));
+          this.hub.setDeviceError(err instanceof Error ? err.message : String(err));
           return;
         }
         this.hub.setDevice({ deviceId: device.id, deviceLabel: device.label });
@@ -9275,7 +8170,7 @@ var CompanionSupervisor = class {
           agentId: it.agentId,
           username: it.agentUsername,
           displayName: it.agentDisplayName,
-          mode: runConfig.mode ?? "assistant",
+          mode: runConfig.hostAccess ? "full" : "none",
           hasCredential: false,
           missingSecrets: missing
         });
@@ -9295,7 +8190,7 @@ var CompanionSupervisor = class {
         agentId: it.agentId,
         username: it.agentUsername,
         displayName: it.agentDisplayName,
-        mode: runConfig.mode ?? "assistant",
+        mode: runConfig.hostAccess ? "full" : "none",
         hasCredential: true,
         missingSecrets: missing
       });
@@ -9379,12 +8274,9 @@ var CompanionSupervisor = class {
       // CT481: register the codex adapter when this device offers codex; unset
       // leaves an `openai/…` turn to fail loudly (no silent claude-code fallback).
       ...isCodexEnabled(this.config) ? { codexEnabled: true } : {},
-      // CT598: register the cabane-native adapter when an OpenRouter key is set;
-      // unset leaves a `cabane-native/…` turn to fail loudly (no silent fallback).
-      ...cabaneNativeApiKey() ? { cabaneNativeApiKey: cabaneNativeApiKey() } : {},
       // CT556: per-turn timeout watchdog windows, from the companion's own env
       // (`AGENT_IDLE_TIMEOUT_MS` / `AGENT_TOTAL_TIMEOUT_MS`). Unset → the
-      // dispatcher's baked-in defaults (10 min idle / 45 min total).
+      // dispatcher's baked-in defaults (10 min idle / 6h total).
       ...positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") !== void 0 ? { idleTimeoutMs: positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") } : {},
       ...positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") !== void 0 ? { totalTimeoutMs: positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") } : {},
       observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
@@ -9451,9 +8343,9 @@ var CompanionSupervisor = class {
     let wire;
     try {
       wire = JSON.parse(ev.data);
-    } catch (err2) {
+    } catch (err) {
       this.log.warn(
-        { err: err2 instanceof Error ? err2.message : String(err2) },
+        { err: err instanceof Error ? err.message : String(err) },
         "malformed SSE payload"
       );
       return;
@@ -9500,13 +8392,13 @@ var CompanionSupervisor = class {
     }
     const chainKey = `${payload.conversationId}|${payload.agentId}`;
     const prev = wr.chains.get(chainKey) ?? Promise.resolve();
-    const tail = prev.then(() => this.runDispatch(wr, ev, payload, agent)).catch((err2) => {
+    const tail = prev.then(() => this.runDispatch(wr, ev, payload, agent)).catch((err) => {
       this.log.warn(
         {
           workspaceId: wr.workspaceId,
           conversationId: payload.conversationId,
           agentId: payload.agentId,
-          err: err2 instanceof Error ? err2.message : String(err2)
+          err: err instanceof Error ? err.message : String(err)
         },
         "companion: conversation turn handler threw"
       );
@@ -9598,10 +8490,10 @@ var CompanionSupervisor = class {
         } else {
           drainDelay = DRAIN_BASE_MS;
         }
-      } catch (err2) {
+      } catch (err) {
         drainDelay = Math.min(drainDelay * 2, DRAIN_MAX_MS);
         this.log.warn(
-          { agentId, err: err2 instanceof Error ? err2.message : String(err2) },
+          { agentId, err: err instanceof Error ? err.message : String(err) },
           "companion: outbox drain pass threw (will retry with backoff)"
         );
       } finally {
@@ -9668,9 +8560,9 @@ var CompanionSupervisor = class {
         codex: signals.codexVersion
       };
       this.hub.setHarnesses(deriveHarnessSnapshot(signals).harnesses);
-    } catch (err2) {
+    } catch (err) {
       this.log.warn(
-        { err: err2 instanceof Error ? err2.message : String(err2) },
+        { err: err instanceof Error ? err.message : String(err) },
         "companion: harness probe failed (will retry on next beat)"
       );
     }
@@ -9768,10 +8660,13 @@ var CompanionSupervisor = class {
       await Promise.race([
         Promise.allSettled(turns),
         new Promise((resolve) => {
-          timer = setTimeout(() => {
-            timedOut = true;
-            resolve();
-          }, Math.max(0, graceMs));
+          timer = setTimeout(
+            () => {
+              timedOut = true;
+              resolve();
+            },
+            Math.max(0, graceMs)
+          );
           timer.unref?.();
         })
       ]);
@@ -9825,17 +8720,17 @@ var RECOVERABLE_CODES = /* @__PURE__ */ new Set([
   "ERR_STREAM_DESTROYED",
   "ERR_STREAM_WRITE_AFTER_END"
 ]);
-function errorCode(err2) {
-  if (err2 && typeof err2 === "object" && "code" in err2) {
-    const code = err2.code;
+function errorCode(err) {
+  if (err && typeof err === "object" && "code" in err) {
+    const code = err.code;
     if (typeof code === "string") return code;
   }
   return void 0;
 }
-function isRecoverableSocketError(err2) {
-  const code = errorCode(err2);
+function isRecoverableSocketError(err) {
+  const code = errorCode(err);
   if (code && RECOVERABLE_CODES.has(code)) return true;
-  const message = err2 instanceof Error ? err2.message : String(err2);
+  const message = err instanceof Error ? err.message : String(err);
   return /\bEPIPE\b|\bECONNRESET\b/.test(message);
 }
 function installProcessSafetyNet(log, opts = {}) {
@@ -9844,16 +8739,16 @@ function installProcessSafetyNet(log, opts = {}) {
     stream.on("error", () => {
     });
   }
-  proc.on("uncaughtException", (err2) => handleUncaught(log, err2, "uncaughtException"));
+  proc.on("uncaughtException", (err) => handleUncaught(log, err, "uncaughtException"));
   proc.on(
     "unhandledRejection",
     (reason) => handleUncaught(log, reason, "unhandledRejection")
   );
 }
-function handleUncaught(log, err2, origin) {
-  const message = err2 instanceof Error ? err2.message : String(err2);
-  const code = errorCode(err2);
-  if (isRecoverableSocketError(err2)) {
+function handleUncaught(log, err, origin) {
+  const message = err instanceof Error ? err.message : String(err);
+  const code = errorCode(err);
+  if (isRecoverableSocketError(err)) {
     log.warn(
       { origin, code, err: message },
       "companion: recovered from a socket error (kept running \u2014 a broken pipe never kills the companion)"
@@ -9861,7 +8756,7 @@ function handleUncaught(log, err2, origin) {
     return;
   }
   log.error(
-    { origin, code, err: message, stack: err2 instanceof Error ? err2.stack : void 0 },
+    { origin, code, err: message, stack: err instanceof Error ? err.stack : void 0 },
     "companion: uncaught error (kept running \u2014 see the stack above)"
   );
 }
@@ -9898,14 +8793,14 @@ async function createCompanionRuntime(opts = {}) {
     cfg = requireConfig();
     claudeCode = await probeClaude();
     await ensureRuntimeAvailable(cfg, { probeClaude: async () => claudeCode });
-  } catch (err2) {
+  } catch (err) {
     recordCrash({
-      reason: err2 instanceof Error ? err2.message : String(err2),
-      ...errorCode(err2) ? { code: errorCode(err2) } : {},
+      reason: err instanceof Error ? err.message : String(err),
+      ...errorCode(err) ? { code: errorCode(err) } : {},
       origin: "startup",
       at: (/* @__PURE__ */ new Date()).toISOString()
     });
-    throw err2;
+    throw err;
   }
   if (cfg.logLevel) log.level = cfg.logLevel;
   const harnessVersions = await probeHarnessVersions({