@cabane/companion 0.6.119 → 0.6.121

package/dist/runtime.js

@@ -2281,6 +2281,7 @@ var bootId = randomUUID();
 import { randomUUID as randomUUID4 } from "crypto";
 
 // src/api.ts
+var DEVICE_HEADER = "x-cabane-device";
 var RETRY_BACKOFF_MS = [250, 750];
 var TURN_CONTEXT_BACKOFF_MS = [250, 750, 2e3, 5e3];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
@@ -2310,6 +2311,7 @@ var CabaneApi = class {
       method,
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
+        ...this.opts.deviceToken ? { [DEVICE_HEADER]: this.opts.deviceToken } : {},
         ...body !== void 0 ? { "content-type": "application/json" } : {},
         accept: "application/json"
       },
@@ -2444,27 +2446,6 @@ var CabaneApi = class {
   outboxSize() {
     return this.opts.outbox?.size() ?? 0;
   }
-  getConversation(workspaceId, conversationId) {
-    return this.request("GET", `/api/workspaces/${workspaceId}/conversations/${conversationId}`);
-  }
-  // SJ383: companion-only participant ops. All three authenticate with the
-  // workspace's agent-bound PAT (passed as `token` on this client) — never
-  // the user PAT.
-  // Recovery-path read: returns the companion's `agentSessionId` for this
-  // conversation so the dispatcher can pass it as `Options.resume`, plus
-  // the current `activeRunStartedAt` so a freshly-reconnected companion can
-  // see whether a prior run is still flagged in-flight.
-  // SJ383: recovery-path read for a participant row — the `agentSessionId` a
-  // freshly-reconnected companion resumes on. CT262: the per-turn piggybacks this
-  // fetch grew (the ABOUT charters / visionBlocks / channel / members / conversationContext)
-  // are gone — `getTurnContext` composes the whole turn now — so this is back to
-  // the plain recovery read, with no `messageId` param.
-  getParticipantAgent(workspaceId, conversationId, agentId) {
-    return this.request(
-      "GET",
-      `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}`
-    );
-  }
   // CT262: the ONE turn-context fetch. Collapses the companion's old four-fetch
   // choreography (getConversation + getMessage + getAgentSelf + getParticipantAgent)
   // into a single call: the server composes the whole server portion of the
@@ -2744,34 +2725,6 @@ var CabaneApi = class {
       signal
     );
   }
-  // SJ493: fetch the agent's self-view — identity + operating context. The
-  // companion calls this on each dispatch to get its `systemPrompt` (composed
-  // server-side from the bundled default + the agent's charter) rather than
-  // baking a copy of the prompt into the download. Cabane is the control plane
-  // for the prompt, so changing it (or the per-agent charter) takes effect
-  // without shipping a new companion. Agent-PAT authed; the workspace is implied
-  // by the PAT, so no workspace arg.
-  // CT245: pass the triggering turn's `conversationId` so the server returns the
-  // run-config RESOLVED for this conversation (agent default + that
-  // conversation-agent's per-conversation override), computed with the same
-  // shared resolver the in-app path uses. Omitting it (older call sites) returns
-  // the agent default — graceful degradation, no version coupling.
-  getAgentSelf(conversationId) {
-    const path = conversationId ? `/api/agent/me?conversationId=${encodeURIComponent(conversationId)}` : `/api/agent/me`;
-    return this.request("GET", path);
-  }
-  // The companion fetches the triggering message body by listing the
-  // conversation's messages and finding the one with `id === messageId`.
-  // Cabane has no single-message GET endpoint; for v0 this is fine because
-  // the companion only reaches for the specific row immediately after the
-  // event fires (the thread is small at that point).
-  async getMessage(workspaceId, conversationId, messageId2) {
-    const res = await this.request(
-      "GET",
-      `/api/workspaces/${workspaceId}/conversations/${conversationId}/messages`
-    );
-    return res.messages.find((m) => m.id === messageId2) ?? null;
-  }
 };
 function isRetryable(err) {
   if (err instanceof ApiError) return err.status >= 500;
@@ -2965,78 +2918,21 @@ function pruneCredentials(keepAgentIds) {
   return removed;
 }
 
-// src/cursor.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
-import { join as join9 } from "path";
-function pathFor(workspaceId) {
-  return join9(cabaneDir(), "cursors", encodeURIComponent(workspaceId));
-}
-function readCursor(workspaceId) {
-  const path = pathFor(workspaceId);
-  if (!existsSync6(path)) return null;
-  const raw = readFileSync4(path, "utf8").trim();
-  return raw.length > 0 ? raw : null;
-}
-function writeCursor(workspaceId, eventId) {
-  const path = pathFor(workspaceId);
-  mkdirSync6(join9(cabaneDir(), "cursors"), { recursive: true });
-  writeFileSync4(path, eventId + "\n", "utf8");
-}
-
-// src/cursor-tracker.ts
-var CursorTracker = class {
-  constructor(workspaceId) {
-    this.workspaceId = workspaceId;
-  }
-  workspaceId;
-  // Event ids in arrival order that haven't yet flushed to the persisted
-  // cursor. Holds the in-flight (un-settled) dispatch events plus any later
-  // events that have settled but are blocked behind an earlier in-flight one.
-  pending = [];
-  // Ids observed as settled. An entry is dropped the moment it flushes, so the
-  // set only ever holds settled-but-blocked ids — bounded by concurrent
-  // in-flight turns and the traffic that arrived during them.
-  settled = /* @__PURE__ */ new Set();
-  // Record an event id in arrival order. Must be called synchronously, in
-  // stream order, for every event the supervisor will later `settle` — so the
-  // cumulative prefix reflects the true stream sequence. Idempotent: an id
-  // already tracked (an in-flight event, or a settled-but-blocked one) is
-  // ignored, so a process-restart replay can re-observe the same ids without
-  // double-counting.
-  observe(eventId) {
-    if (this.pending.includes(eventId) || this.settled.has(eventId)) return;
-    this.pending.push(eventId);
-  }
-  // Mark an event settled — for a dispatch turn, only once it has completed;
-  // for everything else, immediately after it's handled. Flushes the persisted
-  // cursor forward through the now-longer contiguous settled prefix.
-  settle(eventId) {
-    this.settled.add(eventId);
-    let advanced = null;
-    while (this.pending.length > 0 && this.settled.has(this.pending[0])) {
-      const id = this.pending.shift();
-      this.settled.delete(id);
-      advanced = id;
-    }
-    if (advanced) writeCursor(this.workspaceId, advanced);
-  }
-};
-
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync6 } from "fs";
+import { join as join9 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
-  return join10(cabaneDir(), log);
+  return join9(cabaneDir(), log);
 }
-function pathFor2(log, workspaceId) {
-  return join10(dir(log), encodeURIComponent(workspaceId));
+function pathFor(log, workspaceId) {
+  return join9(dir(log), encodeURIComponent(workspaceId));
 }
 function readIds(log, workspaceId) {
-  const path = pathFor2(log, workspaceId);
-  if (!existsSync7(path)) return [];
+  const path = pathFor(log, workspaceId);
+  if (!existsSync6(path)) return [];
   try {
-    return readFileSync5(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+    return readFileSync4(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   } catch {
     return [];
   }
@@ -3049,8 +2945,8 @@ function mark(log, workspaceId, eventId) {
   if (ids.includes(eventId)) return;
   ids.push(eventId);
   const trimmed = ids.length > MAX_IDS ? ids.slice(-MAX_IDS) : ids;
-  mkdirSync7(dir(log), { recursive: true });
-  writeFileSync5(pathFor2(log, workspaceId), trimmed.join("\n") + "\n", "utf8");
+  mkdirSync6(dir(log), { recursive: true });
+  writeFileSync4(pathFor(log, workspaceId), trimmed.join("\n") + "\n", "utf8");
 }
 function hasDispatched(workspaceId, eventId) {
   return has("dispatched", workspaceId, eventId);
@@ -3067,17 +2963,17 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join10(cabaneDir(), "resume-attempts");
+  return join9(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join10(resumeDir(), encodeURIComponent(workspaceId));
+  return join9(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = resumePathFor(workspaceId);
-  if (!existsSync7(path)) return out;
+  if (!existsSync6(path)) return out;
   try {
-    for (const line of readFileSync5(path, "utf8").split("\n")) {
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       const tab = trimmed.lastIndexOf("	");
@@ -3097,8 +2993,8 @@ function bumpResumeAttempt(workspaceId, eventId) {
   counts.set(eventId, next);
   const entries = [...counts.entries()];
   const trimmed = entries.length > MAX_IDS ? entries.slice(-MAX_IDS) : entries;
-  mkdirSync7(resumeDir(), { recursive: true });
-  writeFileSync5(
+  mkdirSync6(resumeDir(), { recursive: true });
+  writeFileSync4(
     resumePathFor(workspaceId),
     trimmed.map(([id, c]) => `${id}	${c}`).join("\n") + "\n",
     "utf8"
@@ -3106,18 +3002,18 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join10(cabaneDir(), "turns");
+  return join9(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join10(turnDir(), encodeURIComponent(workspaceId));
+  return join9(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = turnPathFor(workspaceId);
-  if (!existsSync7(path)) return out;
+  if (!existsSync6(path)) return out;
   try {
-    for (const line of readFileSync5(path, "utf8").split("\n")) {
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       const tab = trimmed.lastIndexOf("	");
@@ -3137,10 +3033,10 @@ function turnIdForEvent(workspaceId, eventId) {
 var TURN_ID_OVERFLOW_WARN = 8192;
 function writeTurnIds(workspaceId, turns) {
   const entries = [...turns.entries()];
-  mkdirSync7(turnDir(), { recursive: true });
+  mkdirSync6(turnDir(), { recursive: true });
   const path = turnPathFor(workspaceId);
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync5(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
+  writeFileSync4(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
   renameSync3(tmp, path);
   return entries.length;
 }
@@ -7915,8 +7811,8 @@ var ConnectorHealthStore = class {
 };
 
 // src/dispatcher.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join14 } from "path";
 
 // src/term.ts
 import { createInterface } from "readline";
@@ -7930,7 +7826,7 @@ function tildePath(path) {
 
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -8166,24 +8062,10 @@ function buildCompanionTurnRequest(params) {
     session: t.session,
     cabane: {
       mcpUrl: cabaneMcpUrl(params.baseUrl),
-      // CT306: prefer the per-turn OBO credential; fall back to the companion PAT
-      // when the API didn't mint one (older API / unresolvable delegation).
-      bearer: params.turnToken ?? params.agentPat,
+      bearer: params.turnToken,
       activeConversationId: params.activeConversationId,
       workspaceId: params.workspaceId,
-      // CT714: mount the turn-control surface ONLY when a real turn token backs
-      // this turn — the surface admits `turn_token` auth exclusively, so a
-      // PAT-fallback bearer would be rejected there. Absent it, external adapters
-      // simply don't mount it that turn.
-      //
-      // CT1074: that fallback is now an OLD-API case only. The server mints a token
-      // for every turn it dispatched, so "no token" no longer means "no human behind
-      // the turn" — it means the API predates this change. The condition is right as
-      // it stands and stays where the failure is honest (a rejected bearer is worse
-      // than an unmounted server); what was wrong was upstream, where an undelegated
-      // turn minted nothing and this silently dropped all five verbs on Codex and
-      // opencode with no refusal anyone could see.
-      ...params.turnToken ? { turnControlUrl: turnControlMcpUrl(params.baseUrl) } : {}
+      turnControlUrl: turnControlMcpUrl(params.baseUrl)
     },
     local: {
       ...params.cwd ? { cwd: params.cwd } : {},
@@ -8207,11 +8089,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
-  const path = join11(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join10(tmpdir(), PREFIX));
+  const path = join10(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -8317,22 +8199,22 @@ function reportFailure(config, body) {
 }
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { join as join11 } from "path";
 function dirFor(workspaceId) {
-  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join11(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
-function pathFor3(workspaceId, conversationId, agentId) {
-  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+function pathFor2(workspaceId, conversationId, agentId) {
+  return join11(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
-  const path = pathFor3(workspaceId, conversationId, agentId);
-  if (!existsSync8(path)) return null;
+  const path = pathFor2(workspaceId, conversationId, agentId);
+  if (!existsSync7(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
       return {
         cwd: parsed.cwd,
@@ -8345,32 +8227,32 @@ function readPrepared(workspaceId, conversationId, agentId) {
   }
 }
 function writePrepared(workspaceId, conversationId, agentId, result) {
-  mkdirSync8(conversationDir(workspaceId, conversationId), { recursive: true });
-  writeFileSync6(
-    pathFor3(workspaceId, conversationId, agentId),
+  mkdirSync7(conversationDir(workspaceId, conversationId), { recursive: true });
+  writeFileSync5(
+    pathFor2(workspaceId, conversationId, agentId),
     JSON.stringify(result) + "\n",
     "utf8"
   );
 }
 function clearPrepared(workspaceId, conversationId, agentId) {
-  rmSync5(pathFor3(workspaceId, conversationId, agentId), { force: true });
+  rmSync5(pathFor2(workspaceId, conversationId, agentId), { force: true });
 }
 
 // src/secrets.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join12 } from "path";
 import { z as z14 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join13(cabaneDir(), "secrets.json");
+  return join12(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z14.record(z14.string(), z14.string());
 function loadSecretStore() {
   const path = secretsPath();
-  if (!existsSync9(path)) return makeStore({});
+  if (!existsSync8(path)) return makeStore({});
   let raw;
   try {
-    raw = readFileSync7(path, "utf8");
+    raw = readFileSync6(path, "utf8");
   } catch (err) {
     throw new ConfigError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -8448,10 +8330,10 @@ function resolveMcpSecrets(mcpServers, store) {
 }
 
 // src/transcript-writer.ts
-import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname6, join as join14 } from "path";
+import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
+import { basename, dirname as dirname6, join as join13 } from "path";
 function transcriptsDir() {
-  return join14(cabaneDir(), "transcripts");
+  return join13(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var ANOMALY_RETAIN = 50;
@@ -8461,9 +8343,9 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join14(dir2, fileName(meta));
+    this.path = join13(dir2, fileName(meta));
     try {
-      mkdirSync9(dir2, { recursive: true });
+      mkdirSync8(dir2, { recursive: true });
       try {
         chmodSync4(dir2, 448);
       } catch {
@@ -8490,10 +8372,10 @@ var TranscriptWriter = class {
   preserveAnomaly() {
     if (this.broken) return;
     try {
-      const dir2 = join14(dirname6(this.path), "anomalies");
-      mkdirSync9(dir2, { recursive: true, mode: 448 });
+      const dir2 = join13(dirname6(this.path), "anomalies");
+      mkdirSync8(dir2, { recursive: true, mode: 448 });
       chmodSync4(dir2, 448);
-      const target = join14(dir2, basename(this.path));
+      const target = join13(dir2, basename(this.path));
       copyFileSync(this.path, target);
       chmodSync4(target, 384);
       pruneOld(dir2, ANOMALY_RETAIN);
@@ -8539,7 +8421,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync6(join14(dir2, f), { force: true });
+      rmSync6(join13(dir2, f), { force: true });
     } catch {
     }
   }
@@ -8547,7 +8429,7 @@ function pruneOld(dir2, retain) {
 
 // src/turn-containment.ts
 import { execFile, execFileSync, spawn as spawn5 } from "child_process";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var asContained = (child) => child;
@@ -8592,7 +8474,7 @@ function currentSystemdUnit(cgroupText) {
 }
 function readCurrentSystemdUnit() {
   try {
-    return currentSystemdUnit(readFileSync8("/proc/self/cgroup", "utf8"));
+    return currentSystemdUnit(readFileSync7("/proc/self/cgroup", "utf8"));
   } catch {
     return null;
   }
@@ -9018,6 +8900,7 @@ function missingSecretReason(missing) {
   return `${prefix}+${missing.length}`;
 }
 var RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
+var NO_TURN_TOKEN_REASON = "no_turn_token: the server issued no turn credential for this turn";
 var UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
 var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 15 * 6e4;
@@ -9297,6 +9180,10 @@ var TurnExecution = class {
       const fetchReason = `fetch_failed: ${describeError(err)}`;
       throw this.concluded(fetchReason, fetchReason);
     }
+    if (!turnContext.turnToken) {
+      turnLog.warn({ turnId }, "dispatcher: turn context carried no turn token");
+      throw this.concluded(NO_TURN_TOKEN_REASON, NO_TURN_TOKEN_REASON);
+    }
     this.turnContext = turnContext;
     if (this.resumed) {
       const sources = { serverFloor: turnContext.turnSeqFloor, outboxFloor };
@@ -9344,7 +9231,7 @@ var TurnExecution = class {
     const prepareHook = this.opts.local.prepareHook;
     const cabaneCwd = this.turnContext.cwd;
     let effectiveCwd = localCwd ?? cabaneCwd;
-    if (effectiveCwd && !existsSync10(effectiveCwd)) {
+    if (effectiveCwd && !existsSync9(effectiveCwd)) {
       turnLog.warn(
         { cwd: effectiveCwd },
         "The working directory is missing; using the companion's directory instead. Check this agent's working directory setting."
@@ -9548,10 +9435,8 @@ var TurnExecution = class {
     this.request = buildCompanionTurnRequest({
       turnContext: this.turnContext,
       baseUrl: this.opts.baseUrl,
-      agentPat: this.opts.credential,
-      // CT306: the per-turn OBO credential when the API minted one; falls back to
-      // the companion PAT (`agentPat`) inside `buildCompanionTurnRequest` otherwise.
-      ...this.turnContext.turnToken ? { turnToken: this.turnContext.turnToken } : {},
+      // ACC8: always present; `fetchTurnContext` refused a context without one.
+      turnToken: this.turnContext.turnToken,
       // SJ524: the hook-resolved cwd overrides the static local cwd.
       ...this.effectiveCwd ? { cwd: this.effectiveCwd } : {},
       // CT1103: the prepare-hook env plus the authoritative host-access token.
@@ -10063,7 +9948,7 @@ function fingerprintSessionState(state) {
 // src/dispatcher.ts
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
-  if (!existsSync11(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
+  if (!existsSync10(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
   let entries;
   try {
     entries = readdirSync2(cwd);
@@ -10073,15 +9958,15 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join15(cwd, ".git");
-  if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
+  const gitPath = join14(cwd, ".git");
+  if (!existsSync10(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
     stat = statSync2(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync11(join15(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync10(join14(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -10241,15 +10126,15 @@ var DispatchClaims = class {
 
 // src/outbox.ts
 import {
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync10,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync8,
   renameSync as renameSync4,
   rmSync as rmSync7,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -10262,21 +10147,21 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join16(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join15(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join15(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
   // per-workspace bounds.
   persist(entry) {
     const dir2 = this.dir();
-    mkdirSync10(dir2, { recursive: true });
+    mkdirSync9(dir2, { recursive: true });
     const target = this.fileFor(entry.turnId, entry.seq);
     const tmp = `${target}.${process.pid}.tmp`;
     try {
-      writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
+      writeFileSync6(tmp, JSON.stringify(entry) + "\n", "utf8");
       renameSync4(tmp, target);
     } catch (err) {
       try {
@@ -10297,7 +10182,7 @@ var Outbox = class {
   // wedging the drain.
   list() {
     const dir2 = this.dir();
-    if (!existsSync12(dir2)) return [];
+    if (!existsSync11(dir2)) return [];
     let names;
     try {
       names = readdirSync3(dir2);
@@ -10307,9 +10192,9 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join16(dir2, name);
+      const full = join15(dir2, name);
       try {
-        const parsed = JSON.parse(readFileSync9(full, "utf8"));
+        const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
           entries.push(parsed);
         } else {
@@ -10343,7 +10228,7 @@ var Outbox = class {
   // different: it is positive evidence that nothing was ever queued here.
   maxSeqForTurn(turnId) {
     const dir2 = this.dir();
-    if (!existsSync12(dir2)) return 0;
+    if (!existsSync11(dir2)) return 0;
     const names = readdirSync3(dir2);
     const prefix = `${encodeURIComponent(turnId)}__`;
     let max = 0;
@@ -10363,7 +10248,7 @@ var Outbox = class {
   }
   size() {
     const dir2 = this.dir();
-    if (!existsSync12(dir2)) return 0;
+    if (!existsSync11(dir2)) return 0;
     try {
       return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
@@ -10517,7 +10402,7 @@ var SseSubscriber = class {
   }
   async connect() {
     const base = this.opts.baseUrl.endsWith("/") ? this.opts.baseUrl.slice(0, -1) : this.opts.baseUrl;
-    const url = this.opts.path ? `${base}${this.opts.path}` : `${base}/api/workspaces/${this.opts.workspaceId}/events`;
+    const url = `${base}${this.opts.path}`;
     this.controller = new AbortController();
     const headers = {
       Authorization: `Bearer ${this.opts.token}`,
@@ -10624,6 +10509,9 @@ var CompanionSupervisor = class {
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
+  // ACC8: whether the device stream is open, which is what every workspace's
+  // link on the dashboard reports.
+  deviceConnected = false;
   recoveryChecked = false;
   recovering = false;
   heartbeated = false;
@@ -10690,7 +10578,18 @@ var CompanionSupervisor = class {
       token: this.config.deviceToken,
       log: this.log,
       lastEventId: null,
-      onOpen: () => this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`),
+      onOpen: () => {
+        this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`);
+        this.deviceConnected = true;
+        for (const wr of this.workspaces.values()) {
+          this.hub.setConnected(wr.workspaceId, true);
+          for (const a of wr.agents.values()) a.kickDrain();
+        }
+      },
+      onClose: () => {
+        this.deviceConnected = false;
+        for (const wr of this.workspaces.values()) this.hub.setConnected(wr.workspaceId, false);
+      },
       onMessage: async (ev) => {
         if (ev.event === "assignments_changed") {
           if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
@@ -10722,10 +10621,7 @@ var CompanionSupervisor = class {
   // at least the loops keeping the event loop alive; the SSE promises let a
   // clean teardown resolve.
   finishedPromises() {
-    return [
-      ...this.deviceSub ? [this.deviceSub.finished] : [],
-      ...[...this.workspaces.values()].flatMap((w) => w.sub ? [w.sub.finished] : [])
-    ];
+    return [...this.deviceSub ? [this.deviceSub.finished] : []];
   }
   // ---- device-level loops ----
   kickHeartbeat() {
@@ -10873,11 +10769,8 @@ var CompanionSupervisor = class {
         workspaceId,
         slug: first.workspaceSlug,
         name: first.workspaceName,
-        sub: null,
-        sseAgentId: null,
         agents: /* @__PURE__ */ new Map(),
-        chains: /* @__PURE__ */ new Map(),
-        cursor: new CursorTracker(workspaceId)
+        chains: /* @__PURE__ */ new Map()
       };
       this.workspaces.set(workspaceId, wr);
       this.hub.registerWorkspace({
@@ -10885,6 +10778,7 @@ var CompanionSupervisor = class {
         slug: first.workspaceSlug,
         name: first.workspaceName
       });
+      this.hub.setConnected(workspaceId, this.deviceConnected);
     }
     const store = loadSecretStoreTolerant();
     const exposed = new Set(store.names());
@@ -10944,7 +10838,7 @@ var CompanionSupervisor = class {
         );
       }
     }
-    this.ensureWorkspaceSse(wr);
+    if (wr.agents.size === 0) void this.removeWorkspace(wr.workspaceId);
   }
   addAgent(wr, it, credential, runConfig) {
     const agentLog = this.log.child({ agentName: it.agentDisplayName });
@@ -10952,6 +10846,7 @@ var CompanionSupervisor = class {
     const api = new CabaneApi({
       baseUrl: this.config.baseUrl,
       token: credential,
+      ...this.config.deviceToken ? { deviceToken: this.config.deviceToken } : {},
       outbox,
       log: agentLog
     });
@@ -11153,71 +11048,18 @@ var CompanionSupervisor = class {
       connectorHealth: this.connectorHealth
     });
   }
-  // Stand up (or re-point) the workspace's single shared SSE subscription. It is
-  // authed with one assigned agent's PAT; if that agent is unassigned, re-pick
-  // another. With no agents left the workspace runner is torn down.
-  ensureWorkspaceSse(wr) {
-    if (wr.agents.size === 0) {
-      void this.removeWorkspace(wr.workspaceId);
-      return;
-    }
-    if (wr.sub && wr.sseAgentId && wr.agents.has(wr.sseAgentId)) return;
-    const sseAgent = wr.agents.get(wr.sseAgentId ?? "") ?? [...wr.agents.values()][0];
-    if (wr.sub) wr.sub.stop();
-    wr.sseAgentId = sseAgent.agentId;
-    wr.sub = new SseSubscriber({
-      baseUrl: this.config.baseUrl,
-      workspaceId: wr.workspaceId,
-      token: sseAgent.credential,
-      log: this.log,
-      lastEventId: readCursor(wr.workspaceId),
-      onOpen: () => {
-        this.hub.setConnected(wr.workspaceId, true);
-        for (const a of wr.agents.values()) a.kickDrain();
-      },
-      onClose: () => this.hub.setConnected(wr.workspaceId, false),
-      onMessage: (ev) => this.handleWorkspaceMessage(wr, ev),
-      onAuthFailure: (status) => {
-        this.hub.setAuthFailed(wr.workspaceId);
-        this.log.debug(
-          { workspaceId: wr.workspaceId, status, sseAgentId: wr.sseAgentId },
-          "companion: workspace stream auth failed \u2014 re-pulling assignments"
-        );
-        wr.sseAgentId = null;
-        void this.refreshAssignments();
-      }
-    });
-    wr.sub.start();
-    this.log.debug({ workspaceId: wr.workspaceId }, "companion: subscribed");
-  }
   async removeWorkspace(workspaceId) {
     const wr = this.workspaces.get(workspaceId);
     if (!wr) return;
     for (const agentId of [...wr.agents.keys()]) this.removeAgent(wr, agentId);
-    if (wr.sub) {
-      wr.sub.stop();
-      await wr.sub.finished;
-    }
     this.workspaces.delete(workspaceId);
     this.hub.removeWorkspace(workspaceId);
   }
   // ---- SSE event routing (per workspace, BY agentId) ----
-  // Fire-and-forget per event (the subscriber doesn't await us). Cancel events
-  // route to the matching agent immediately; dispatch events serialize per
-  // (conversation, agent); everything else just advances the cursor.
-  async handleWorkspaceMessage(wr, ev) {
-    if (ev.event !== "message") return;
-    this.hub.recordEvent(wr.workspaceId);
-    const wire = this.parseFrame(ev);
-    if (!wire) return;
-    if (ev.id) wr.cursor.observe(ev.id);
-    await this.deliverFrame(wr, ev.id, wire);
-  }
   // ACC10: the device stream's frames — dispatch and cancel, addressed to this
-  // device and authenticated as it. Same frames and the same routing as above;
-  // what differs is that this stream keeps no cursor (it replays what is still
-  // offered on every connect instead of resuming from a `Last-Event-ID`), so
-  // nothing here observes or settles one.
+  // device and authenticated as it. ACC8: the only stream this companion opens.
+  // It keeps no cursor: it replays what is still offered on every connect
+  // instead of resuming from a `Last-Event-ID`.
   async handleDeviceMessage(ev) {
     const wire = this.parseFrame(ev);
     if (!wire) return;
@@ -11240,7 +11082,7 @@ var CompanionSupervisor = class {
       }
     }
     this.hub.recordEvent(wr.workspaceId);
-    await this.deliverFrame(wr, "", wire);
+    await this.deliverFrame(wr, wire);
   }
   parseFrame(ev) {
     try {
@@ -11253,30 +11095,27 @@ var CompanionSupervisor = class {
       return null;
     }
   }
-  // ACC10: the dedupe gate, and the only place that exists because there are two
-  // streams. Both carry the same frame with the same dispatch id; the first copy
-  // to arrive runs the turn, and the second waits for it and then settles its own
-  // stream's cursor. Settling a duplicate earlier than that would advance the
-  // low-water mark past an in-flight turn, which is exactly the CT282 bug.
+  // ACC10: the dedupe gate. A reconnect replays every dispatch still offered,
+  // including one whose turn is already running here; the first copy runs the
+  // turn and a later one waits for it and then does nothing.
   //
   // A cancel needs no gate: `dispatcher.cancel` on an already-aborted run is a
   // no-op that reports `false`, so a second copy is inert.
-  async deliverFrame(wr, cursorId, wire) {
+  async deliverFrame(wr, wire) {
     const claim = wire.type === "device:dispatch_requested" && wire.id ? this.claims.claim(wire.id) : null;
     if (claim && !claim.first) {
       await claim.done;
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     try {
-      await this.routeFrame(wr, cursorId, wire);
+      await this.routeFrame(wr, wire);
     } finally {
       if (claim) this.claims.release(wire.id);
     }
   }
   // Everything below here is the routing as it was: it takes a frame and knows
   // nothing about which stream carried it.
-  async routeFrame(wr, cursorId, wire) {
+  async routeFrame(wr, wire) {
     if (wire.type === "device:cancel_requested") {
       const payload2 = {
         type: "device:cancel_requested",
@@ -11296,12 +11135,10 @@ var CompanionSupervisor = class {
           );
         }
       }
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     const payload = dispatchPayload(wire);
     if (!payload) {
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
@@ -11314,7 +11151,6 @@ var CompanionSupervisor = class {
         },
         "companion: dispatch addressed to another device; ignoring"
       );
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     let agent = wr.agents.get(payload.agentId);
@@ -11322,16 +11158,14 @@ var CompanionSupervisor = class {
       agent = await this.recoverRacedAgent(wr, payload);
       if (!agent) {
         if (this.deviceId && payload.deviceId === this.deviceId) {
-          const reported = await this.reportUnrunnableDispatch(wr.workspaceId, payload);
-          if (!reported) return;
+          await this.reportUnrunnableDispatch(wr.workspaceId, payload);
         }
-        if (cursorId) wr.cursor.settle(cursorId);
         return;
       }
     }
     const chainKey = `${payload.conversationId}|${payload.agentId}`;
     const prev = wr.chains.get(chainKey) ?? Promise.resolve();
-    const tail = prev.then(() => this.runDispatch(wr, { dispatchId: wire.id, cursorId }, payload, agent)).catch((err) => {
+    const tail = prev.then(() => this.runDispatch(wr, wire.id, payload, agent)).catch((err) => {
       this.log.warn(
         {
           workspaceId: wr.workspaceId,
@@ -11348,8 +11182,7 @@ var CompanionSupervisor = class {
   }
   // CT1146: tell the server this device cannot run a dispatch it was addressed to.
   //
-  // Returns whether the report LANDED, because that answer decides whether the
-  // caller may settle the cursor. The server checks the recorded dispatch
+  // Returns whether the report LANDED. The server checks the recorded dispatch
   // destination even if the agent's assignment has moved. Reporting promptly
   // explains the roster miss; the thirty-minute unanswered-offer deadline is
   // only the backstop when no report lands.
@@ -11443,10 +11276,10 @@ var CompanionSupervisor = class {
         };
         const tail = this.runDispatch(
           wr,
-          // No frame delivered this one — it came off `/runs` — so there is
-          // neither a dispatch id to dedupe on nor a cursor to settle. The
-          // `recoveredTurns` set above is this path's own guard.
-          { dispatchId: "", cursorId: "" },
+          // No frame delivered this one — it came off `/runs` — so there is no
+          // dispatch id to dedupe on. The `recoveredTurns` set above is this
+          // path's own guard.
+          "",
           payload,
           agent,
           run.turnId
@@ -11468,61 +11301,55 @@ var CompanionSupervisor = class {
     }
   }
   // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
-  // cursor + console summary. Mirrors the old per-workspace `handleEvent`, now
+  // the console summary. Mirrors the old per-workspace `handleEvent`, now
   // scoped to one agent.
-  async runDispatch(wr, ids, payload, agent, recoveredTurnId) {
+  async runDispatch(wr, dispatchId, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
-    const settleCursor = () => {
-      if (ids.cursorId) wr.cursor.settle(ids.cursorId);
-    };
-    if (ids.dispatchId && hasDispatched(workspaceId, ids.dispatchId)) {
-      if (hasCompleted(workspaceId, ids.dispatchId)) {
+    if (dispatchId && hasDispatched(workspaceId, dispatchId)) {
+      if (hasCompleted(workspaceId, dispatchId)) {
         this.log.debug(
-          { workspaceId, eventId: ids.dispatchId },
+          { workspaceId, eventId: dispatchId },
           "companion: skipping already-completed event (resume after restart)"
         );
-        settleCursor();
         return;
       }
       if (noResume()) {
         this.log.debug(
-          { workspaceId, eventId: ids.dispatchId },
+          { workspaceId, eventId: dispatchId },
           "companion: skipping interrupted turn (CABANE_COMPANION_NO_RESUME=1) \u2014 resume disabled for this boot"
         );
-        markCompleted(workspaceId, ids.dispatchId);
-        settleCursor();
+        markCompleted(workspaceId, dispatchId);
         return;
       }
-      const attempt = bumpResumeAttempt(workspaceId, ids.dispatchId);
+      const attempt = bumpResumeAttempt(workspaceId, dispatchId);
       if (attempt > MAX_RESUME_ATTEMPTS) {
         this.log.error(
-          { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
+          { workspaceId, eventId: dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
           "An interrupted turn couldn't finish after several attempts. Reply in Cabane to try again."
         );
-        markCompleted(workspaceId, ids.dispatchId);
-        settleCursor();
+        markCompleted(workspaceId, dispatchId);
         return;
       }
       this.log.debug(
-        { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
+        { workspaceId, eventId: dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    const resumedTurnId = recoveredTurnId ?? (ids.dispatchId ? turnIdForEvent(workspaceId, ids.dispatchId) : null);
+    const resumedTurnId = recoveredTurnId ?? (dispatchId ? turnIdForEvent(workspaceId, dispatchId) : null);
     const turnId = resumedTurnId ?? randomUUID4();
-    if (ids.dispatchId) {
-      const liveTurnIds = rememberTurnId(workspaceId, ids.dispatchId, turnId);
+    if (dispatchId) {
+      const liveTurnIds = rememberTurnId(workspaceId, dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
         this.log.debug(
           { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
           "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
         );
       }
-      markDispatched(workspaceId, ids.dispatchId);
+      markDispatched(workspaceId, dispatchId);
     }
     if (resumedTurnId) {
       this.log.debug(
-        { workspaceId, eventId: ids.dispatchId, turnId },
+        { workspaceId, eventId: dispatchId, turnId },
         "companion: resuming an interrupted turn under its original id"
       );
     }
@@ -11537,8 +11364,7 @@ var CompanionSupervisor = class {
       turnId,
       resumed: resumedTurnId !== null
     });
-    if (ids.dispatchId) markCompleted(workspaceId, ids.dispatchId);
-    settleCursor();
+    if (dispatchId) markCompleted(workspaceId, dispatchId);
     const durationS = (result.durationMs / 1e3).toFixed(1);
     const bindings = {
       ...turnBindings,
@@ -11787,12 +11613,10 @@ var CompanionSupervisor = class {
     this.deviceSub?.stop();
     for (const wr of this.workspaces.values()) {
       for (const a of wr.agents.values()) a.cancelDrain();
-      if (wr.sub) wr.sub.stop();
     }
     await Promise.all([
       ...heartbeat ? [waitForBoundedHeartbeat(heartbeat)] : [],
-      ...this.deviceSub ? [this.deviceSub.finished] : [],
-      ...[...this.workspaces.values()].flatMap((wr) => wr.sub ? [wr.sub.finished] : [])
+      ...this.deviceSub ? [this.deviceSub.finished] : []
     ]);
   }
   async requestStop() {
@@ -11889,22 +11713,22 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync10, rmSync as rmSync8, writeFileSync as writeFileSync8 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync9, rmSync as rmSync8, writeFileSync as writeFileSync7 } from "fs";
+import { join as join16 } from "path";
 function crashMarkerPath() {
-  return join17(cabaneDir(), "last-error.json");
+  return join16(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
-    mkdirSync11(cabaneDir(), { recursive: true });
-    writeFileSync8(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
+    mkdirSync10(cabaneDir(), { recursive: true });
+    writeFileSync7(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
   } catch {
   }
 }
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync13(path)) rmSync8(path, { force: true });
+    if (existsSync12(path)) rmSync8(path, { force: true });
   } catch {
   }
 }