@cabane/companion 0.6.111 → 0.6.113

package/dist/cli.js

@@ -2901,9 +2901,27 @@ function describeErrorBody(body) {
   if (text.length === 0) return void 0;
   return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
 }
+var CAUSE_TEXT_CAP = 200;
+function describeError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const cause = describeCause(err);
+  return cause === void 0 ? message : `${message}: ${cause}`;
+}
+function describeCause(err) {
+  if (!(err instanceof Error)) return void 0;
+  const cause = err.cause;
+  if (cause === void 0 || cause === null) return void 0;
+  if (typeof cause === "object") {
+    const code = cause.code;
+    if (typeof code === "string" && code.length > 0) return code;
+  }
+  const text = cause instanceof Error ? cause.message : typeof cause === "string" ? cause : void 0;
+  if (text === void 0 || text.length === 0) return void 0;
+  return text.length > CAUSE_TEXT_CAP ? `${text.slice(0, CAUSE_TEXT_CAP)}\u2026` : text;
+}
 function apiErrorLogFields(err) {
   const fields = {
-    err: err instanceof Error ? err.message : String(err)
+    err: describeError(err)
   };
   if (err instanceof ApiError) {
     fields.status = err.status;
@@ -2922,6 +2940,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
+var TURN_CONTEXT_BACKOFF_MS = [250, 750, 2e3, 5e3];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
 var LEASE_CHECK_TIMEOUT_MS = 1e4;
 function activeRunOutboxKey(conversationId, agentId) {
@@ -2972,14 +2991,26 @@ var CabaneApi = class {
     return parsed;
   }
   async request(method, path, body, opts = {}) {
-    const { signal, retry = false } = opts;
-    const maxAttempts = retry ? RETRY_BACKOFF_MS.length + 1 : 1;
+    const { signal, retry = method === "GET", backoffMs = RETRY_BACKOFF_MS } = opts;
+    const maxAttempts = retry ? backoffMs.length + 1 : 1;
     for (let attempt = 1; ; attempt++) {
       try {
         return await this.attempt(method, path, body, signal);
       } catch (err) {
         if (attempt >= maxAttempts || signal?.aborted || !isRetryable(err)) throw err;
-        await sleep2(RETRY_BACKOFF_MS[attempt - 1], signal);
+        const delayMs = backoffMs[attempt - 1];
+        this.opts.log?.info(
+          {
+            method,
+            path: pathForLog(path),
+            attempt,
+            maxAttempts,
+            delayMs,
+            err: describeError(err)
+          },
+          "companion: API call failed transiently; retrying"
+        );
+        await sleep2(delayMs, signal);
         if (signal?.aborted) throw err;
       }
     }
@@ -3117,9 +3148,16 @@ var CabaneApi = class {
   // CT1543: `episode` is the dispatch event's own, echoed back so the server can
   // tell this frame from a later wake on the same message. Omitted when the
   // event didn't carry one, which is the only thing an older event can mean.
-  getTurnContext(conversationId, messageId2, turnId, resumed, fresh, episode) {
+  // CT1657: `signal` is the turn's own abort. It matters here more than on any
+  // other read, because this call now waits up to ~8s across five attempts: a
+  // Stop landing in that window used to leave the whole schedule running, and
+  // the person watched a turn they had already stopped keep trying.
+  getTurnContext(conversationId, messageId2, turnId, resumed, fresh, episode, signal) {
     const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "") + (fresh ? "&fresh=1" : "") + (episode !== void 0 ? `&episode=${encodeURIComponent(String(episode))}` : "");
-    return this.request("GET", `/api/agent/turn-context?${q}`);
+    return this.request("GET", `/api/agent/turn-context?${q}`, void 0, {
+      backoffMs: this.opts.turnContextBackoffMs ?? TURN_CONTEXT_BACKOFF_MS,
+      ...signal ? { signal } : {}
+    });
   }
   // CT1380: the local half of a resumed turn's seq floor (see
   // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
@@ -3204,6 +3242,12 @@ var CabaneApi = class {
         `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/turn-lease?${q}`,
         void 0,
         {
+          // CT1657: the one GET that opts OUT of the default retry. The reasoning
+          // is right above — a failed probe has no answer worth replaying and the
+          // next tick asks again in seconds, so retrying inside this one would
+          // stretch a tick over its successor's slot, which is what the deadline
+          // exists to prevent.
+          retry: false,
           signal: AbortSignal.timeout(this.opts.leaseCheckTimeoutMs ?? LEASE_CHECK_TIMEOUT_MS)
         }
       );
@@ -3395,6 +3439,10 @@ function isRetryable(err) {
 function isAbortError(err) {
   return err instanceof Error && err.name === "AbortError";
 }
+function pathForLog(path) {
+  const q = path.indexOf("?");
+  return q === -1 ? path : path.slice(0, q);
+}
 function sleep2(ms, signal) {
   return new Promise((resolve2) => {
     if (signal?.aborted) return resolve2();
@@ -9569,6 +9617,7 @@ var TurnExecution = class {
   // identity-checked at the supervisor — then clear the active-run flag);
   // everything past the lease settles in `execute()`'s one `finally`.
   async run() {
+    this.supervisor.registerAbort(this.turnId, this.abortController);
     try {
       await this.fetchContext();
       this.gateTrigger();
@@ -9590,6 +9639,8 @@ var TurnExecution = class {
         this.supervisor.releaseAbort(this.turnId, this.abortController);
         const msg = err instanceof Error ? err.message : String(err);
         await this.concludeAdmittedRun("setup_failed", `setup_failed: ${msg}`);
+      } else {
+        this.supervisor.releaseAbort(this.turnId, this.abortController);
       }
       throw err;
     }
@@ -9671,9 +9722,14 @@ var TurnExecution = class {
         turnId,
         this.resumed,
         void 0,
-        payload.episode
+        payload.episode,
+        this.abortController.signal
       );
     } catch (err) {
+      if (this.abortController.signal.aborted) {
+        turnLog.debug("dispatcher: stopped while loading the turn context");
+        throw this.concluded("cancelled");
+      }
       const status2 = err instanceof ApiError ? err.status : 0;
       if (status2 === 404) {
         turnLog.debug(
@@ -9688,9 +9744,8 @@ var TurnExecution = class {
         );
         throw this.concluded("turn_context_not_admitted");
       }
-      const reason = err instanceof Error ? err.message : String(err);
-      turnLog.debug({ err: reason }, "dispatcher: failed to fetch turn context");
-      const fetchReason = `fetch_failed: ${reason}`;
+      turnLog.warn(apiErrorLogFields(err), "dispatcher: failed to fetch turn context");
+      const fetchReason = `fetch_failed: ${describeError(err)}`;
       throw this.concluded(fetchReason, fetchReason);
     }
     this.turnContext = turnContext;
@@ -10053,7 +10108,12 @@ var TurnExecution = class {
         payload.messageId,
         turnId,
         false,
-        true
+        true,
+        void 0,
+        // CT1657: the turn's abort. This recompose happens mid-run with the
+        // adapter waiting on it, so a Stop here must end the wait rather than
+        // hold the turn open for the rest of the retry schedule.
+        this.abortController.signal
       );
       turnLog.debug(
         { reason },
@@ -10065,6 +10125,10 @@ var TurnExecution = class {
         content: context.content
       };
     } catch (err) {
+      if (this.abortController.signal.aborted) {
+        turnLog.debug({ reason }, "dispatcher: stopped while recomposing the turn context");
+        return null;
+      }
       turnLog.error(
         { reason, ...apiErrorLogFields(err) },
         "Couldn't load the full conversation; continuing with the recent messages."
@@ -10590,6 +10654,41 @@ async function enumerateOpencodeModels(serverUrl, fetchImpl = fetch) {
   }
 }
 
+// src/dispatch-claims.ts
+var DispatchClaims = class {
+  inFlight = /* @__PURE__ */ new Map();
+  releases = /* @__PURE__ */ new Map();
+  // Claim a dispatch id for this process. Synchronous by design: two copies can
+  // arrive in the same tick, and a claim taken after an `await` would let both
+  // through.
+  claim(dispatchId) {
+    const running = this.inFlight.get(dispatchId);
+    if (running) return { first: false, done: running };
+    let release;
+    this.inFlight.set(
+      dispatchId,
+      new Promise((resolve2) => {
+        release = resolve2;
+      })
+    );
+    this.releases.set(dispatchId, release);
+    return { first: true };
+  }
+  // Hand the claim back once the run has finished — whatever its outcome.
+  // Releasing an id that isn't claimed is a no-op.
+  release(dispatchId) {
+    const resolve2 = this.releases.get(dispatchId);
+    if (!resolve2) return;
+    this.releases.delete(dispatchId);
+    this.inFlight.delete(dispatchId);
+    resolve2();
+  }
+  // The live set's size — the concurrent-turn count.
+  get size() {
+    return this.inFlight.size;
+  }
+};
+
 // src/outbox.ts
 import {
   existsSync as existsSync12,
@@ -10936,6 +11035,13 @@ var DRAIN_BASE_MS = 1e3;
 var DRAIN_MAX_MS = 3e4;
 var DRAIN_IDLE_MS = 15e3;
 var DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS = [0, 1e3, 3e3];
+function dispatchPayload(wire) {
+  if (wire.type !== "device:dispatch_requested") return null;
+  return {
+    type: "device:dispatch_requested",
+    ...wire.payload
+  };
+}
 var CompanionSupervisor = class {
   workspaces = /* @__PURE__ */ new Map();
   config;
@@ -10994,6 +11100,9 @@ var CompanionSupervisor = class {
   // turn's classified outcome here (per runtime); the heartbeat echoes it so the
   // server's per-connector quota state survives a restart/race.
   connectorHealth = new ConnectorHealthStore();
+  // ACC10: which dispatches this process is running, so the copy of a frame that
+  // arrives on the other stream doesn't run the turn a second time.
+  claims = new DispatchClaims();
   constructor(opts) {
     this.config = opts.config;
     this.log = opts.log;
@@ -11037,7 +11146,9 @@ var CompanionSupervisor = class {
         if (ev.event === "assignments_changed") {
           if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
           await this.refreshAssignments();
+          return;
         }
+        if (ev.event === "message") await this.handleDeviceMessage(ev);
       },
       onAuthFailure: () => {
         this.log.error(
@@ -11548,17 +11659,75 @@ var CompanionSupervisor = class {
   async handleWorkspaceMessage(wr, ev) {
     if (ev.event !== "message") return;
     this.hub.recordEvent(wr.workspaceId);
-    let wire;
+    const wire = this.parseFrame(ev);
+    if (!wire) return;
+    if (ev.id) wr.cursor.observe(ev.id);
+    await this.deliverFrame(wr, ev.id, wire);
+  }
+  // ACC10: the device stream's frames — dispatch and cancel, addressed to this
+  // device and authenticated as it. Same frames and the same routing as above;
+  // what differs is that this stream keeps no cursor (it replays what is still
+  // offered on every connect instead of resuming from a `Last-Event-ID`), so
+  // nothing here observes or settles one.
+  async handleDeviceMessage(ev) {
+    const wire = this.parseFrame(ev);
+    if (!wire) return;
+    let wr = this.workspaces.get(wire.workspaceId);
+    if (!wr) {
+      if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
+      await this.refreshAssignments();
+      wr = this.workspaces.get(wire.workspaceId);
+      if (!wr) {
+        const payload = dispatchPayload(wire);
+        if (payload && payload.deviceId === this.deviceId) {
+          await this.reportUnrunnableDispatch(wire.workspaceId, payload);
+        } else {
+          this.log.debug(
+            { workspaceId: wire.workspaceId, type: wire.type },
+            "companion: device frame for a workspace this device does not run; ignoring"
+          );
+        }
+        return;
+      }
+    }
+    this.hub.recordEvent(wr.workspaceId);
+    await this.deliverFrame(wr, "", wire);
+  }
+  parseFrame(ev) {
     try {
-      wire = JSON.parse(ev.data);
+      return JSON.parse(ev.data);
     } catch (err) {
       this.log.debug(
         { err: err instanceof Error ? err.message : String(err) },
         "malformed SSE payload"
       );
+      return null;
+    }
+  }
+  // ACC10: the dedupe gate, and the only place that exists because there are two
+  // streams. Both carry the same frame with the same dispatch id; the first copy
+  // to arrive runs the turn, and the second waits for it and then settles its own
+  // stream's cursor. Settling a duplicate earlier than that would advance the
+  // low-water mark past an in-flight turn, which is exactly the CT282 bug.
+  //
+  // A cancel needs no gate: `dispatcher.cancel` on an already-aborted run is a
+  // no-op that reports `false`, so a second copy is inert.
+  async deliverFrame(wr, cursorId, wire) {
+    const claim = wire.type === "device:dispatch_requested" && wire.id ? this.claims.claim(wire.id) : null;
+    if (claim && !claim.first) {
+      await claim.done;
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
-    if (ev.id) wr.cursor.observe(ev.id);
+    try {
+      await this.routeFrame(wr, cursorId, wire);
+    } finally {
+      if (claim) this.claims.release(wire.id);
+    }
+  }
+  // Everything below here is the routing as it was: it takes a frame and knows
+  // nothing about which stream carried it.
+  async routeFrame(wr, cursorId, wire) {
     if (wire.type === "device:cancel_requested") {
       const payload2 = {
         type: "device:cancel_requested",
@@ -11578,17 +11747,14 @@ var CompanionSupervisor = class {
           );
         }
       }
-      if (ev.id) wr.cursor.settle(ev.id);
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
-    if (wire.type !== "device:dispatch_requested") {
-      if (ev.id) wr.cursor.settle(ev.id);
+    const payload = dispatchPayload(wire);
+    if (!payload) {
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
-    const payload = {
-      type: "device:dispatch_requested",
-      ...wire.payload
-    };
     if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
       this.log.debug(
         {
@@ -11599,7 +11765,7 @@ var CompanionSupervisor = class {
         },
         "companion: dispatch addressed to another device; ignoring"
       );
-      if (ev.id) wr.cursor.settle(ev.id);
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     let agent = wr.agents.get(payload.agentId);
@@ -11607,16 +11773,16 @@ var CompanionSupervisor = class {
       agent = await this.recoverRacedAgent(wr, payload);
       if (!agent) {
         if (this.deviceId && payload.deviceId === this.deviceId) {
-          const reported = await this.reportUnrunnableDispatch(wr, payload);
+          const reported = await this.reportUnrunnableDispatch(wr.workspaceId, payload);
           if (!reported) return;
         }
-        if (ev.id) wr.cursor.settle(ev.id);
+        if (cursorId) wr.cursor.settle(cursorId);
         return;
       }
     }
     const chainKey = `${payload.conversationId}|${payload.agentId}`;
     const prev = wr.chains.get(chainKey) ?? Promise.resolve();
-    const tail = prev.then(() => this.runDispatch(wr, ev, payload, agent)).catch((err) => {
+    const tail = prev.then(() => this.runDispatch(wr, { dispatchId: wire.id, cursorId }, payload, agent)).catch((err) => {
       this.log.warn(
         {
           workspaceId: wr.workspaceId,
@@ -11643,7 +11809,7 @@ var CompanionSupervisor = class {
   // dropped socket) and one more attempt a second later usually lands. Bounded
   // hard — this runs inline on the event loop, and an unbounded wait here would
   // wedge the workspace's whole stream.
-  async reportUnrunnableDispatch(wr, payload) {
+  async reportUnrunnableDispatch(workspaceId, payload) {
     if (!this.deviceApi) return false;
     let lastErr;
     for (const wait of this.unrunnableRetryDelaysMs) {
@@ -11651,7 +11817,7 @@ var CompanionSupervisor = class {
       if (wait > 0) await new Promise((r) => setTimeout(r, wait));
       try {
         const { cleared } = await this.deviceApi.reportDispatchDrop({
-          workspaceId: wr.workspaceId,
+          workspaceId,
           conversationId: payload.conversationId,
           agentId: payload.agentId,
           messageId: payload.messageId,
@@ -11659,7 +11825,7 @@ var CompanionSupervisor = class {
         });
         this.log.debug(
           {
-            workspaceId: wr.workspaceId,
+            workspaceId,
             conversationId: payload.conversationId,
             agentId: payload.agentId,
             cleared
@@ -11673,7 +11839,7 @@ var CompanionSupervisor = class {
     }
     this.log.error(
       {
-        workspaceId: wr.workspaceId,
+        workspaceId,
         conversationId: payload.conversationId,
         agentId: payload.agentId,
         err: lastErr instanceof Error ? lastErr.message : String(lastErr)
@@ -11728,7 +11894,10 @@ var CompanionSupervisor = class {
         };
         const tail = this.runDispatch(
           wr,
-          { id: "", event: "recovery", data: "" },
+          // No frame delivered this one — it came off `/runs` — so there is
+          // neither a dispatch id to dedupe on nor a cursor to settle. The
+          // `recoveredTurns` set above is this path's own guard.
+          { dispatchId: "", cursorId: "" },
           payload,
           agent,
           run.turnId
@@ -11752,56 +11921,59 @@ var CompanionSupervisor = class {
   // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
   // cursor + console summary. Mirrors the old per-workspace `handleEvent`, now
   // scoped to one agent.
-  async runDispatch(wr, ev, payload, agent, recoveredTurnId) {
+  async runDispatch(wr, ids, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
-    if (ev.id && hasDispatched(workspaceId, ev.id)) {
-      if (hasCompleted(workspaceId, ev.id)) {
+    const settleCursor = () => {
+      if (ids.cursorId) wr.cursor.settle(ids.cursorId);
+    };
+    if (ids.dispatchId && hasDispatched(workspaceId, ids.dispatchId)) {
+      if (hasCompleted(workspaceId, ids.dispatchId)) {
         this.log.debug(
-          { workspaceId, eventId: ev.id },
+          { workspaceId, eventId: ids.dispatchId },
           "companion: skipping already-completed event (resume after restart)"
         );
-        wr.cursor.settle(ev.id);
+        settleCursor();
         return;
       }
       if (noResume()) {
         this.log.debug(
-          { workspaceId, eventId: ev.id },
+          { workspaceId, eventId: ids.dispatchId },
           "companion: skipping interrupted turn (CABANE_COMPANION_NO_RESUME=1) \u2014 resume disabled for this boot"
         );
-        markCompleted(workspaceId, ev.id);
-        wr.cursor.settle(ev.id);
+        markCompleted(workspaceId, ids.dispatchId);
+        settleCursor();
         return;
       }
-      const attempt = bumpResumeAttempt(workspaceId, ev.id);
+      const attempt = bumpResumeAttempt(workspaceId, ids.dispatchId);
       if (attempt > MAX_RESUME_ATTEMPTS) {
         this.log.error(
-          { workspaceId, eventId: ev.id, attempt, cap: MAX_RESUME_ATTEMPTS },
+          { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
           "An interrupted turn couldn't finish after several attempts. Reply in Cabane to try again."
         );
-        markCompleted(workspaceId, ev.id);
-        wr.cursor.settle(ev.id);
+        markCompleted(workspaceId, ids.dispatchId);
+        settleCursor();
         return;
       }
       this.log.debug(
-        { workspaceId, eventId: ev.id, attempt, cap: MAX_RESUME_ATTEMPTS },
+        { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    const resumedTurnId = recoveredTurnId ?? (ev.id ? turnIdForEvent(workspaceId, ev.id) : null);
+    const resumedTurnId = recoveredTurnId ?? (ids.dispatchId ? turnIdForEvent(workspaceId, ids.dispatchId) : null);
     const turnId = resumedTurnId ?? randomUUID4();
-    if (ev.id) {
-      const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
+    if (ids.dispatchId) {
+      const liveTurnIds = rememberTurnId(workspaceId, ids.dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
         this.log.debug(
           { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
           "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
         );
       }
-      markDispatched(workspaceId, ev.id);
+      markDispatched(workspaceId, ids.dispatchId);
     }
     if (resumedTurnId) {
       this.log.debug(
-        { workspaceId, eventId: ev.id, turnId },
+        { workspaceId, eventId: ids.dispatchId, turnId },
         "companion: resuming an interrupted turn under its original id"
       );
     }
@@ -11816,8 +11988,8 @@ var CompanionSupervisor = class {
       turnId,
       resumed: resumedTurnId !== null
     });
-    if (ev.id) markCompleted(workspaceId, ev.id);
-    if (ev.id) wr.cursor.settle(ev.id);
+    if (ids.dispatchId) markCompleted(workspaceId, ids.dispatchId);
+    settleCursor();
     const durationS = (result.durationMs / 1e3).toFixed(1);
     const bindings = {
       ...turnBindings,

package/dist/runtime.js

@@ -2235,9 +2235,27 @@ function describeErrorBody(body) {
   if (text.length === 0) return void 0;
   return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
 }
+var CAUSE_TEXT_CAP = 200;
+function describeError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const cause = describeCause(err);
+  return cause === void 0 ? message : `${message}: ${cause}`;
+}
+function describeCause(err) {
+  if (!(err instanceof Error)) return void 0;
+  const cause = err.cause;
+  if (cause === void 0 || cause === null) return void 0;
+  if (typeof cause === "object") {
+    const code = cause.code;
+    if (typeof code === "string" && code.length > 0) return code;
+  }
+  const text = cause instanceof Error ? cause.message : typeof cause === "string" ? cause : void 0;
+  if (text === void 0 || text.length === 0) return void 0;
+  return text.length > CAUSE_TEXT_CAP ? `${text.slice(0, CAUSE_TEXT_CAP)}\u2026` : text;
+}
 function apiErrorLogFields(err) {
   const fields = {
-    err: err instanceof Error ? err.message : String(err)
+    err: describeError(err)
   };
   if (err instanceof ApiError) {
     fields.status = err.status;
@@ -2256,6 +2274,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
+var TURN_CONTEXT_BACKOFF_MS = [250, 750, 2e3, 5e3];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
 var LEASE_CHECK_TIMEOUT_MS = 1e4;
 function activeRunOutboxKey(conversationId, agentId) {
@@ -2306,14 +2325,26 @@ var CabaneApi = class {
     return parsed;
   }
   async request(method, path, body, opts = {}) {
-    const { signal, retry = false } = opts;
-    const maxAttempts = retry ? RETRY_BACKOFF_MS.length + 1 : 1;
+    const { signal, retry = method === "GET", backoffMs = RETRY_BACKOFF_MS } = opts;
+    const maxAttempts = retry ? backoffMs.length + 1 : 1;
     for (let attempt = 1; ; attempt++) {
       try {
         return await this.attempt(method, path, body, signal);
       } catch (err) {
         if (attempt >= maxAttempts || signal?.aborted || !isRetryable(err)) throw err;
-        await sleep(RETRY_BACKOFF_MS[attempt - 1], signal);
+        const delayMs = backoffMs[attempt - 1];
+        this.opts.log?.info(
+          {
+            method,
+            path: pathForLog(path),
+            attempt,
+            maxAttempts,
+            delayMs,
+            err: describeError(err)
+          },
+          "companion: API call failed transiently; retrying"
+        );
+        await sleep(delayMs, signal);
         if (signal?.aborted) throw err;
       }
     }
@@ -2451,9 +2482,16 @@ var CabaneApi = class {
   // CT1543: `episode` is the dispatch event's own, echoed back so the server can
   // tell this frame from a later wake on the same message. Omitted when the
   // event didn't carry one, which is the only thing an older event can mean.
-  getTurnContext(conversationId, messageId2, turnId, resumed, fresh, episode) {
+  // CT1657: `signal` is the turn's own abort. It matters here more than on any
+  // other read, because this call now waits up to ~8s across five attempts: a
+  // Stop landing in that window used to leave the whole schedule running, and
+  // the person watched a turn they had already stopped keep trying.
+  getTurnContext(conversationId, messageId2, turnId, resumed, fresh, episode, signal) {
     const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "") + (fresh ? "&fresh=1" : "") + (episode !== void 0 ? `&episode=${encodeURIComponent(String(episode))}` : "");
-    return this.request("GET", `/api/agent/turn-context?${q}`);
+    return this.request("GET", `/api/agent/turn-context?${q}`, void 0, {
+      backoffMs: this.opts.turnContextBackoffMs ?? TURN_CONTEXT_BACKOFF_MS,
+      ...signal ? { signal } : {}
+    });
   }
   // CT1380: the local half of a resumed turn's seq floor (see
   // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
@@ -2538,6 +2576,12 @@ var CabaneApi = class {
         `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/turn-lease?${q}`,
         void 0,
         {
+          // CT1657: the one GET that opts OUT of the default retry. The reasoning
+          // is right above — a failed probe has no answer worth replaying and the
+          // next tick asks again in seconds, so retrying inside this one would
+          // stretch a tick over its successor's slot, which is what the deadline
+          // exists to prevent.
+          retry: false,
           signal: AbortSignal.timeout(this.opts.leaseCheckTimeoutMs ?? LEASE_CHECK_TIMEOUT_MS)
         }
       );
@@ -2729,6 +2773,10 @@ function isRetryable(err) {
 function isAbortError(err) {
   return err instanceof Error && err.name === "AbortError";
 }
+function pathForLog(path) {
+  const q = path.indexOf("?");
+  return q === -1 ? path : path.slice(0, q);
+}
 function sleep(ms, signal) {
   return new Promise((resolve2) => {
     if (signal?.aborted) return resolve2();
@@ -8992,6 +9040,7 @@ var TurnExecution = class {
   // identity-checked at the supervisor — then clear the active-run flag);
   // everything past the lease settles in `execute()`'s one `finally`.
   async run() {
+    this.supervisor.registerAbort(this.turnId, this.abortController);
     try {
       await this.fetchContext();
       this.gateTrigger();
@@ -9013,6 +9062,8 @@ var TurnExecution = class {
         this.supervisor.releaseAbort(this.turnId, this.abortController);
         const msg = err instanceof Error ? err.message : String(err);
         await this.concludeAdmittedRun("setup_failed", `setup_failed: ${msg}`);
+      } else {
+        this.supervisor.releaseAbort(this.turnId, this.abortController);
       }
       throw err;
     }
@@ -9094,9 +9145,14 @@ var TurnExecution = class {
         turnId,
         this.resumed,
         void 0,
-        payload.episode
+        payload.episode,
+        this.abortController.signal
       );
     } catch (err) {
+      if (this.abortController.signal.aborted) {
+        turnLog.debug("dispatcher: stopped while loading the turn context");
+        throw this.concluded("cancelled");
+      }
       const status = err instanceof ApiError ? err.status : 0;
       if (status === 404) {
         turnLog.debug(
@@ -9111,9 +9167,8 @@ var TurnExecution = class {
         );
         throw this.concluded("turn_context_not_admitted");
       }
-      const reason = err instanceof Error ? err.message : String(err);
-      turnLog.debug({ err: reason }, "dispatcher: failed to fetch turn context");
-      const fetchReason = `fetch_failed: ${reason}`;
+      turnLog.warn(apiErrorLogFields(err), "dispatcher: failed to fetch turn context");
+      const fetchReason = `fetch_failed: ${describeError(err)}`;
       throw this.concluded(fetchReason, fetchReason);
     }
     this.turnContext = turnContext;
@@ -9476,7 +9531,12 @@ var TurnExecution = class {
         payload.messageId,
         turnId,
         false,
-        true
+        true,
+        void 0,
+        // CT1657: the turn's abort. This recompose happens mid-run with the
+        // adapter waiting on it, so a Stop here must end the wait rather than
+        // hold the turn open for the rest of the retry schedule.
+        this.abortController.signal
       );
       turnLog.debug(
         { reason },
@@ -9488,6 +9548,10 @@ var TurnExecution = class {
         content: context.content
       };
     } catch (err) {
+      if (this.abortController.signal.aborted) {
+        turnLog.debug({ reason }, "dispatcher: stopped while recomposing the turn context");
+        return null;
+      }
       turnLog.error(
         { reason, ...apiErrorLogFields(err) },
         "Couldn't load the full conversation; continuing with the recent messages."
@@ -10013,6 +10077,41 @@ async function enumerateOpencodeModels(serverUrl, fetchImpl = fetch) {
   }
 }
 
+// src/dispatch-claims.ts
+var DispatchClaims = class {
+  inFlight = /* @__PURE__ */ new Map();
+  releases = /* @__PURE__ */ new Map();
+  // Claim a dispatch id for this process. Synchronous by design: two copies can
+  // arrive in the same tick, and a claim taken after an `await` would let both
+  // through.
+  claim(dispatchId) {
+    const running = this.inFlight.get(dispatchId);
+    if (running) return { first: false, done: running };
+    let release;
+    this.inFlight.set(
+      dispatchId,
+      new Promise((resolve2) => {
+        release = resolve2;
+      })
+    );
+    this.releases.set(dispatchId, release);
+    return { first: true };
+  }
+  // Hand the claim back once the run has finished — whatever its outcome.
+  // Releasing an id that isn't claimed is a no-op.
+  release(dispatchId) {
+    const resolve2 = this.releases.get(dispatchId);
+    if (!resolve2) return;
+    this.releases.delete(dispatchId);
+    this.inFlight.delete(dispatchId);
+    resolve2();
+  }
+  // The live set's size — the concurrent-turn count.
+  get size() {
+    return this.inFlight.size;
+  }
+};
+
 // src/outbox.ts
 import {
   existsSync as existsSync12,
@@ -10359,6 +10458,13 @@ var DRAIN_BASE_MS = 1e3;
 var DRAIN_MAX_MS = 3e4;
 var DRAIN_IDLE_MS = 15e3;
 var DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS = [0, 1e3, 3e3];
+function dispatchPayload(wire) {
+  if (wire.type !== "device:dispatch_requested") return null;
+  return {
+    type: "device:dispatch_requested",
+    ...wire.payload
+  };
+}
 var CompanionSupervisor = class {
   workspaces = /* @__PURE__ */ new Map();
   config;
@@ -10417,6 +10523,9 @@ var CompanionSupervisor = class {
   // turn's classified outcome here (per runtime); the heartbeat echoes it so the
   // server's per-connector quota state survives a restart/race.
   connectorHealth = new ConnectorHealthStore();
+  // ACC10: which dispatches this process is running, so the copy of a frame that
+  // arrives on the other stream doesn't run the turn a second time.
+  claims = new DispatchClaims();
   constructor(opts) {
     this.config = opts.config;
     this.log = opts.log;
@@ -10460,7 +10569,9 @@ var CompanionSupervisor = class {
         if (ev.event === "assignments_changed") {
           if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
           await this.refreshAssignments();
+          return;
         }
+        if (ev.event === "message") await this.handleDeviceMessage(ev);
       },
       onAuthFailure: () => {
         this.log.error(
@@ -10971,17 +11082,75 @@ var CompanionSupervisor = class {
   async handleWorkspaceMessage(wr, ev) {
     if (ev.event !== "message") return;
     this.hub.recordEvent(wr.workspaceId);
-    let wire;
+    const wire = this.parseFrame(ev);
+    if (!wire) return;
+    if (ev.id) wr.cursor.observe(ev.id);
+    await this.deliverFrame(wr, ev.id, wire);
+  }
+  // ACC10: the device stream's frames — dispatch and cancel, addressed to this
+  // device and authenticated as it. Same frames and the same routing as above;
+  // what differs is that this stream keeps no cursor (it replays what is still
+  // offered on every connect instead of resuming from a `Last-Event-ID`), so
+  // nothing here observes or settles one.
+  async handleDeviceMessage(ev) {
+    const wire = this.parseFrame(ev);
+    if (!wire) return;
+    let wr = this.workspaces.get(wire.workspaceId);
+    if (!wr) {
+      if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
+      await this.refreshAssignments();
+      wr = this.workspaces.get(wire.workspaceId);
+      if (!wr) {
+        const payload = dispatchPayload(wire);
+        if (payload && payload.deviceId === this.deviceId) {
+          await this.reportUnrunnableDispatch(wire.workspaceId, payload);
+        } else {
+          this.log.debug(
+            { workspaceId: wire.workspaceId, type: wire.type },
+            "companion: device frame for a workspace this device does not run; ignoring"
+          );
+        }
+        return;
+      }
+    }
+    this.hub.recordEvent(wr.workspaceId);
+    await this.deliverFrame(wr, "", wire);
+  }
+  parseFrame(ev) {
     try {
-      wire = JSON.parse(ev.data);
+      return JSON.parse(ev.data);
     } catch (err) {
       this.log.debug(
         { err: err instanceof Error ? err.message : String(err) },
         "malformed SSE payload"
       );
+      return null;
+    }
+  }
+  // ACC10: the dedupe gate, and the only place that exists because there are two
+  // streams. Both carry the same frame with the same dispatch id; the first copy
+  // to arrive runs the turn, and the second waits for it and then settles its own
+  // stream's cursor. Settling a duplicate earlier than that would advance the
+  // low-water mark past an in-flight turn, which is exactly the CT282 bug.
+  //
+  // A cancel needs no gate: `dispatcher.cancel` on an already-aborted run is a
+  // no-op that reports `false`, so a second copy is inert.
+  async deliverFrame(wr, cursorId, wire) {
+    const claim = wire.type === "device:dispatch_requested" && wire.id ? this.claims.claim(wire.id) : null;
+    if (claim && !claim.first) {
+      await claim.done;
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
-    if (ev.id) wr.cursor.observe(ev.id);
+    try {
+      await this.routeFrame(wr, cursorId, wire);
+    } finally {
+      if (claim) this.claims.release(wire.id);
+    }
+  }
+  // Everything below here is the routing as it was: it takes a frame and knows
+  // nothing about which stream carried it.
+  async routeFrame(wr, cursorId, wire) {
     if (wire.type === "device:cancel_requested") {
       const payload2 = {
         type: "device:cancel_requested",
@@ -11001,17 +11170,14 @@ var CompanionSupervisor = class {
           );
         }
       }
-      if (ev.id) wr.cursor.settle(ev.id);
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
-    if (wire.type !== "device:dispatch_requested") {
-      if (ev.id) wr.cursor.settle(ev.id);
+    const payload = dispatchPayload(wire);
+    if (!payload) {
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
-    const payload = {
-      type: "device:dispatch_requested",
-      ...wire.payload
-    };
     if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
       this.log.debug(
         {
@@ -11022,7 +11188,7 @@ var CompanionSupervisor = class {
         },
         "companion: dispatch addressed to another device; ignoring"
       );
-      if (ev.id) wr.cursor.settle(ev.id);
+      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     let agent = wr.agents.get(payload.agentId);
@@ -11030,16 +11196,16 @@ var CompanionSupervisor = class {
       agent = await this.recoverRacedAgent(wr, payload);
       if (!agent) {
         if (this.deviceId && payload.deviceId === this.deviceId) {
-          const reported = await this.reportUnrunnableDispatch(wr, payload);
+          const reported = await this.reportUnrunnableDispatch(wr.workspaceId, payload);
           if (!reported) return;
         }
-        if (ev.id) wr.cursor.settle(ev.id);
+        if (cursorId) wr.cursor.settle(cursorId);
         return;
       }
     }
     const chainKey = `${payload.conversationId}|${payload.agentId}`;
     const prev = wr.chains.get(chainKey) ?? Promise.resolve();
-    const tail = prev.then(() => this.runDispatch(wr, ev, payload, agent)).catch((err) => {
+    const tail = prev.then(() => this.runDispatch(wr, { dispatchId: wire.id, cursorId }, payload, agent)).catch((err) => {
       this.log.warn(
         {
           workspaceId: wr.workspaceId,
@@ -11066,7 +11232,7 @@ var CompanionSupervisor = class {
   // dropped socket) and one more attempt a second later usually lands. Bounded
   // hard — this runs inline on the event loop, and an unbounded wait here would
   // wedge the workspace's whole stream.
-  async reportUnrunnableDispatch(wr, payload) {
+  async reportUnrunnableDispatch(workspaceId, payload) {
     if (!this.deviceApi) return false;
     let lastErr;
     for (const wait of this.unrunnableRetryDelaysMs) {
@@ -11074,7 +11240,7 @@ var CompanionSupervisor = class {
       if (wait > 0) await new Promise((r) => setTimeout(r, wait));
       try {
         const { cleared } = await this.deviceApi.reportDispatchDrop({
-          workspaceId: wr.workspaceId,
+          workspaceId,
           conversationId: payload.conversationId,
           agentId: payload.agentId,
           messageId: payload.messageId,
@@ -11082,7 +11248,7 @@ var CompanionSupervisor = class {
         });
         this.log.debug(
           {
-            workspaceId: wr.workspaceId,
+            workspaceId,
             conversationId: payload.conversationId,
             agentId: payload.agentId,
             cleared
@@ -11096,7 +11262,7 @@ var CompanionSupervisor = class {
     }
     this.log.error(
       {
-        workspaceId: wr.workspaceId,
+        workspaceId,
         conversationId: payload.conversationId,
         agentId: payload.agentId,
         err: lastErr instanceof Error ? lastErr.message : String(lastErr)
@@ -11151,7 +11317,10 @@ var CompanionSupervisor = class {
         };
         const tail = this.runDispatch(
           wr,
-          { id: "", event: "recovery", data: "" },
+          // No frame delivered this one — it came off `/runs` — so there is
+          // neither a dispatch id to dedupe on nor a cursor to settle. The
+          // `recoveredTurns` set above is this path's own guard.
+          { dispatchId: "", cursorId: "" },
           payload,
           agent,
           run.turnId
@@ -11175,56 +11344,59 @@ var CompanionSupervisor = class {
   // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
   // cursor + console summary. Mirrors the old per-workspace `handleEvent`, now
   // scoped to one agent.
-  async runDispatch(wr, ev, payload, agent, recoveredTurnId) {
+  async runDispatch(wr, ids, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
-    if (ev.id && hasDispatched(workspaceId, ev.id)) {
-      if (hasCompleted(workspaceId, ev.id)) {
+    const settleCursor = () => {
+      if (ids.cursorId) wr.cursor.settle(ids.cursorId);
+    };
+    if (ids.dispatchId && hasDispatched(workspaceId, ids.dispatchId)) {
+      if (hasCompleted(workspaceId, ids.dispatchId)) {
         this.log.debug(
-          { workspaceId, eventId: ev.id },
+          { workspaceId, eventId: ids.dispatchId },
           "companion: skipping already-completed event (resume after restart)"
         );
-        wr.cursor.settle(ev.id);
+        settleCursor();
         return;
       }
       if (noResume()) {
         this.log.debug(
-          { workspaceId, eventId: ev.id },
+          { workspaceId, eventId: ids.dispatchId },
           "companion: skipping interrupted turn (CABANE_COMPANION_NO_RESUME=1) \u2014 resume disabled for this boot"
         );
-        markCompleted(workspaceId, ev.id);
-        wr.cursor.settle(ev.id);
+        markCompleted(workspaceId, ids.dispatchId);
+        settleCursor();
         return;
       }
-      const attempt = bumpResumeAttempt(workspaceId, ev.id);
+      const attempt = bumpResumeAttempt(workspaceId, ids.dispatchId);
       if (attempt > MAX_RESUME_ATTEMPTS) {
         this.log.error(
-          { workspaceId, eventId: ev.id, attempt, cap: MAX_RESUME_ATTEMPTS },
+          { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
           "An interrupted turn couldn't finish after several attempts. Reply in Cabane to try again."
         );
-        markCompleted(workspaceId, ev.id);
-        wr.cursor.settle(ev.id);
+        markCompleted(workspaceId, ids.dispatchId);
+        settleCursor();
         return;
       }
       this.log.debug(
-        { workspaceId, eventId: ev.id, attempt, cap: MAX_RESUME_ATTEMPTS },
+        { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    const resumedTurnId = recoveredTurnId ?? (ev.id ? turnIdForEvent(workspaceId, ev.id) : null);
+    const resumedTurnId = recoveredTurnId ?? (ids.dispatchId ? turnIdForEvent(workspaceId, ids.dispatchId) : null);
     const turnId = resumedTurnId ?? randomUUID4();
-    if (ev.id) {
-      const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
+    if (ids.dispatchId) {
+      const liveTurnIds = rememberTurnId(workspaceId, ids.dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
         this.log.debug(
           { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
           "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
         );
       }
-      markDispatched(workspaceId, ev.id);
+      markDispatched(workspaceId, ids.dispatchId);
     }
     if (resumedTurnId) {
       this.log.debug(
-        { workspaceId, eventId: ev.id, turnId },
+        { workspaceId, eventId: ids.dispatchId, turnId },
         "companion: resuming an interrupted turn under its original id"
       );
     }
@@ -11239,8 +11411,8 @@ var CompanionSupervisor = class {
       turnId,
       resumed: resumedTurnId !== null
     });
-    if (ev.id) markCompleted(workspaceId, ev.id);
-    if (ev.id) wr.cursor.settle(ev.id);
+    if (ids.dispatchId) markCompleted(workspaceId, ids.dispatchId);
+    settleCursor();
     const durationS = (result.durationMs / 1e3).toFixed(1);
     const bindings = {
       ...turnBindings,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.111",
+  "version": "0.6.113",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",