@cabane/companion 0.6.120 → 0.6.122

package/dist/runtime.js

@@ -1,5 +1,5 @@
 // src/runtime.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/config.ts
 import {
@@ -352,8 +352,24 @@ var companionConfigSchema = z2.object({
   // half-installed platform package could not start.
   codex: z2.object({
     enabled: z2.boolean().optional()
+  }).strict().optional(),
+  // CT1679: run each turn in a child runner process instead of in this one.
+  // Absent, or `enabled: false`, is the in-process path, untouched. `sandbox`
+  // wraps the runner in an OS sandbox where the host supports one; `'none'`
+  // (the default) runs it as a plain child beside this process, a supported
+  // configuration in its own right rather than a degraded one.
+  runners: z2.object({
+    enabled: z2.boolean().optional(),
+    provider: z2.literal("local-process").optional(),
+    sandbox: z2.enum(["os", "none"]).optional()
   }).strict().optional()
 });
+function runnersEnabled(cfg) {
+  return cfg.runners?.enabled === true;
+}
+function runnerStateDir() {
+  return process.env.CABANE_RUNNER_STATE_DIR || cabaneDir();
+}
 function isCodexEnabled(cfg) {
   return !!cfg.codex && cfg.codex.enabled !== false;
 }
@@ -1462,8 +1478,8 @@ function registerRoutes(app, deps) {
     return c.json({ dispatches: hub.recentDispatches(limit).map(dispatchToWire) });
   });
   app.get("/api/logs", async (c) => {
-    const lines = clampLimit(c.req.query("lines"), 200, 1e3);
-    return c.json({ lines: tailFile(companionLogPath(), lines) });
+    const lines2 = clampLimit(c.req.query("lines"), 200, 1e3);
+    return c.json({ lines: tailFile(companionLogPath(), lines2) });
   });
   app.post("/api/settings", async (c) => {
     const body = await readJson(c);
@@ -1582,7 +1598,7 @@ function clampLimit(raw, fallback, max = 200) {
   if (!Number.isFinite(n) || n <= 0) return fallback;
   return Math.min(Math.floor(n), max);
 }
-function tailFile(path, lines) {
+function tailFile(path, lines2) {
   if (!existsSync2(path)) return [];
   const MAX_BYTES = 256 * 1024;
   let fd;
@@ -1597,7 +1613,7 @@ function tailFile(path, lines) {
     const text = buf.toString("utf8");
     const all = text.split("\n");
     if (start > 0 && all.length > 0) all.shift();
-    return all.filter((l) => l.length > 0).slice(-lines);
+    return all.filter((l) => l.length > 0).slice(-lines2);
   } catch {
     return [];
   } finally {
@@ -2278,7 +2294,7 @@ import { randomUUID } from "crypto";
 var bootId = randomUUID();
 
 // src/supervisor.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // src/api.ts
 var DEVICE_HEADER = "x-cabane-device";
@@ -2446,27 +2462,6 @@ var CabaneApi = class {
   outboxSize() {
     return this.opts.outbox?.size() ?? 0;
   }
-  getConversation(workspaceId, conversationId) {
-    return this.request("GET", `/api/workspaces/${workspaceId}/conversations/${conversationId}`);
-  }
-  // SJ383: companion-only participant ops. All three authenticate with the
-  // workspace's agent-bound PAT (passed as `token` on this client) — never
-  // the user PAT.
-  // Recovery-path read: returns the companion's `agentSessionId` for this
-  // conversation so the dispatcher can pass it as `Options.resume`, plus
-  // the current `activeRunStartedAt` so a freshly-reconnected companion can
-  // see whether a prior run is still flagged in-flight.
-  // SJ383: recovery-path read for a participant row — the `agentSessionId` a
-  // freshly-reconnected companion resumes on. CT262: the per-turn piggybacks this
-  // fetch grew (the ABOUT charters / visionBlocks / channel / members / conversationContext)
-  // are gone — `getTurnContext` composes the whole turn now — so this is back to
-  // the plain recovery read, with no `messageId` param.
-  getParticipantAgent(workspaceId, conversationId, agentId) {
-    return this.request(
-      "GET",
-      `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}`
-    );
-  }
   // CT262: the ONE turn-context fetch. Collapses the companion's old four-fetch
   // choreography (getConversation + getMessage + getAgentSelf + getParticipantAgent)
   // into a single call: the server composes the whole server portion of the
@@ -2746,34 +2741,6 @@ var CabaneApi = class {
       signal
     );
   }
-  // SJ493: fetch the agent's self-view — identity + operating context. The
-  // companion calls this on each dispatch to get its `systemPrompt` (composed
-  // server-side from the bundled default + the agent's charter) rather than
-  // baking a copy of the prompt into the download. Cabane is the control plane
-  // for the prompt, so changing it (or the per-agent charter) takes effect
-  // without shipping a new companion. Agent-PAT authed; the workspace is implied
-  // by the PAT, so no workspace arg.
-  // CT245: pass the triggering turn's `conversationId` so the server returns the
-  // run-config RESOLVED for this conversation (agent default + that
-  // conversation-agent's per-conversation override), computed with the same
-  // shared resolver the in-app path uses. Omitting it (older call sites) returns
-  // the agent default — graceful degradation, no version coupling.
-  getAgentSelf(conversationId) {
-    const path = conversationId ? `/api/agent/me?conversationId=${encodeURIComponent(conversationId)}` : `/api/agent/me`;
-    return this.request("GET", path);
-  }
-  // The companion fetches the triggering message body by listing the
-  // conversation's messages and finding the one with `id === messageId`.
-  // Cabane has no single-message GET endpoint; for v0 this is fine because
-  // the companion only reaches for the specific row immediately after the
-  // event fires (the thread is small at that point).
-  async getMessage(workspaceId, conversationId, messageId2) {
-    const res = await this.request(
-      "GET",
-      `/api/workspaces/${workspaceId}/conversations/${conversationId}/messages`
-    );
-    return res.messages.find((m) => m.id === messageId2) ?? null;
-  }
 };
 function isRetryable(err) {
   if (err instanceof ApiError) return err.status >= 500;
@@ -2967,78 +2934,21 @@ function pruneCredentials(keepAgentIds) {
   return removed;
 }
 
-// src/cursor.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
-import { join as join9 } from "path";
-function pathFor(workspaceId) {
-  return join9(cabaneDir(), "cursors", encodeURIComponent(workspaceId));
-}
-function readCursor(workspaceId) {
-  const path = pathFor(workspaceId);
-  if (!existsSync6(path)) return null;
-  const raw = readFileSync4(path, "utf8").trim();
-  return raw.length > 0 ? raw : null;
-}
-function writeCursor(workspaceId, eventId) {
-  const path = pathFor(workspaceId);
-  mkdirSync6(join9(cabaneDir(), "cursors"), { recursive: true });
-  writeFileSync4(path, eventId + "\n", "utf8");
-}
-
-// src/cursor-tracker.ts
-var CursorTracker = class {
-  constructor(workspaceId) {
-    this.workspaceId = workspaceId;
-  }
-  workspaceId;
-  // Event ids in arrival order that haven't yet flushed to the persisted
-  // cursor. Holds the in-flight (un-settled) dispatch events plus any later
-  // events that have settled but are blocked behind an earlier in-flight one.
-  pending = [];
-  // Ids observed as settled. An entry is dropped the moment it flushes, so the
-  // set only ever holds settled-but-blocked ids — bounded by concurrent
-  // in-flight turns and the traffic that arrived during them.
-  settled = /* @__PURE__ */ new Set();
-  // Record an event id in arrival order. Must be called synchronously, in
-  // stream order, for every event the supervisor will later `settle` — so the
-  // cumulative prefix reflects the true stream sequence. Idempotent: an id
-  // already tracked (an in-flight event, or a settled-but-blocked one) is
-  // ignored, so a process-restart replay can re-observe the same ids without
-  // double-counting.
-  observe(eventId) {
-    if (this.pending.includes(eventId) || this.settled.has(eventId)) return;
-    this.pending.push(eventId);
-  }
-  // Mark an event settled — for a dispatch turn, only once it has completed;
-  // for everything else, immediately after it's handled. Flushes the persisted
-  // cursor forward through the now-longer contiguous settled prefix.
-  settle(eventId) {
-    this.settled.add(eventId);
-    let advanced = null;
-    while (this.pending.length > 0 && this.settled.has(this.pending[0])) {
-      const id = this.pending.shift();
-      this.settled.delete(id);
-      advanced = id;
-    }
-    if (advanced) writeCursor(this.workspaceId, advanced);
-  }
-};
-
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync6 } from "fs";
+import { join as join9 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
-  return join10(cabaneDir(), log);
+  return join9(cabaneDir(), log);
 }
-function pathFor2(log, workspaceId) {
-  return join10(dir(log), encodeURIComponent(workspaceId));
+function pathFor(log, workspaceId) {
+  return join9(dir(log), encodeURIComponent(workspaceId));
 }
 function readIds(log, workspaceId) {
-  const path = pathFor2(log, workspaceId);
-  if (!existsSync7(path)) return [];
+  const path = pathFor(log, workspaceId);
+  if (!existsSync6(path)) return [];
   try {
-    return readFileSync5(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+    return readFileSync4(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   } catch {
     return [];
   }
@@ -3051,8 +2961,8 @@ function mark(log, workspaceId, eventId) {
   if (ids.includes(eventId)) return;
   ids.push(eventId);
   const trimmed = ids.length > MAX_IDS ? ids.slice(-MAX_IDS) : ids;
-  mkdirSync7(dir(log), { recursive: true });
-  writeFileSync5(pathFor2(log, workspaceId), trimmed.join("\n") + "\n", "utf8");
+  mkdirSync6(dir(log), { recursive: true });
+  writeFileSync4(pathFor(log, workspaceId), trimmed.join("\n") + "\n", "utf8");
 }
 function hasDispatched(workspaceId, eventId) {
   return has("dispatched", workspaceId, eventId);
@@ -3069,17 +2979,17 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join10(cabaneDir(), "resume-attempts");
+  return join9(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join10(resumeDir(), encodeURIComponent(workspaceId));
+  return join9(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = resumePathFor(workspaceId);
-  if (!existsSync7(path)) return out;
+  if (!existsSync6(path)) return out;
   try {
-    for (const line of readFileSync5(path, "utf8").split("\n")) {
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       const tab = trimmed.lastIndexOf("	");
@@ -3099,8 +3009,8 @@ function bumpResumeAttempt(workspaceId, eventId) {
   counts.set(eventId, next);
   const entries = [...counts.entries()];
   const trimmed = entries.length > MAX_IDS ? entries.slice(-MAX_IDS) : entries;
-  mkdirSync7(resumeDir(), { recursive: true });
-  writeFileSync5(
+  mkdirSync6(resumeDir(), { recursive: true });
+  writeFileSync4(
     resumePathFor(workspaceId),
     trimmed.map(([id, c]) => `${id}	${c}`).join("\n") + "\n",
     "utf8"
@@ -3108,18 +3018,18 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join10(cabaneDir(), "turns");
+  return join9(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join10(turnDir(), encodeURIComponent(workspaceId));
+  return join9(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = turnPathFor(workspaceId);
-  if (!existsSync7(path)) return out;
+  if (!existsSync6(path)) return out;
   try {
-    for (const line of readFileSync5(path, "utf8").split("\n")) {
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       const tab = trimmed.lastIndexOf("	");
@@ -3139,10 +3049,10 @@ function turnIdForEvent(workspaceId, eventId) {
 var TURN_ID_OVERFLOW_WARN = 8192;
 function writeTurnIds(workspaceId, turns) {
   const entries = [...turns.entries()];
-  mkdirSync7(turnDir(), { recursive: true });
+  mkdirSync6(turnDir(), { recursive: true });
   const path = turnPathFor(workspaceId);
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync5(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
+  writeFileSync4(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
   renameSync3(tmp, path);
   return entries.length;
 }
@@ -7917,140 +7827,872 @@ var ConnectorHealthStore = class {
 };
 
 // src/dispatcher.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join15 } from "path";
+import { randomUUID as randomUUID4 } from "crypto";
+import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join14 } from "path";
 
-// src/term.ts
+// src/runner/launch.ts
 import { createInterface } from "readline";
-import { homedir as homedir2 } from "os";
-import pc from "picocolors";
-function tildePath(path) {
-  const home = homedir2();
-  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
-  return path;
-}
 
-// src/turn-execution.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync10 } from "fs";
+// src/runner/opencode-lock.ts
+function opencodeLockKey(serverUrl) {
+  return `opencode:${serverUrl}`;
+}
+async function stopRemoteOpencodeSession(serverUrl, sessionId, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const base = serverUrl.replace(/\/+$/, "");
+  const id = encodeURIComponent(sessionId);
+  try {
+    await doFetch(`${base}/session/${id}/abort`, {
+      method: "POST",
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+  const attempts = opts.attempts ?? 20;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await doFetch(`${base}/session/status`, { signal: AbortSignal.timeout(5e3) });
+      if (res.ok) {
+        const status = await res.json();
+        const state = status[sessionId];
+        if (!state || state.type === "idle") return true;
+      }
+    } catch {
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, opts.pollMs ?? 500));
+  }
+  return false;
+}
 
-// src/turn-control-tools.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { z as z13 } from "zod";
-var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
-var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
-var SKIP_TURN_TOOL = "skip_turn";
-var ASK_TOOL = "ask";
-var ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${ASK_TOOL}`;
-var WITHDRAW_ASK_TOOL = "withdraw_ask";
-var WITHDRAW_ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WITHDRAW_ASK_TOOL}`;
-var WAKE_ME_TOOL = "wake_me";
-var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
-var CANCEL_WAKE_TOOL = "cancel_wake";
-var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
-var TURN_ACT_TIMEOUT_MS = 45e3;
-function createSkipState() {
-  return { skipped: false, reason: null };
+// src/turn-containment.ts
+import { execFile, execFileSync, spawn as spawn4 } from "child_process";
+import { readFileSync as readFileSync5 } from "fs";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var asContained = (child) => child;
+var CONTAINMENT_STOP_GRACE_SEC = 5;
+var FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
+var CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
+function turnScopeUnit(turnId, attempt) {
+  const safe3 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
+  return `cabane-turn-${safe3}-${attempt}`;
 }
-function toolError(text) {
-  return { isError: true, content: [{ type: "text", text }] };
+async function reapTurnScopes(turnId) {
+  if (process.platform !== "linux") return { failures: [] };
+  const pattern = `${turnScopeUnit(turnId, 0).replace(/-0$/, "")}-*.scope`;
+  try {
+    await execFileAsync("systemctl", ["--user", "stop", pattern], {
+      timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
+    });
+    return { failures: [] };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return classifyStopError(message) === "absent" ? { failures: [] } : { failures: [message.slice(0, 200)] };
+  }
 }
-async function performAct(acts, act) {
-  let result;
+function scopeCapabilityUsable(env, timeoutMs = CAPABILITY_PROBE_TIMEOUT_MS) {
+  if (process.platform !== "linux") return false;
   try {
-    result = await acts.api.turnAct(
-      acts.workspaceId,
-      acts.turnId,
-      act,
-      AbortSignal.timeout(TURN_ACT_TIMEOUT_MS)
-    );
+    execFileSync("systemd-run", ["--user", "--scope", "--quiet", "--collect", "--", "/bin/true"], {
+      env,
+      timeout: timeoutMs,
+      stdio: "ignore"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function classifyStopError(message) {
+  if (/failed to connect to bus|failed to get d-?bus connection|connection refused|refusing to operate|spawn systemctl|systemctl.*ENOENT|ENOENT.*systemctl/i.test(
+    message
+  )) {
+    return "failure";
+  }
+  if (/not loaded|could not be found|no such unit|unit .* not found/i.test(message))
+    return "absent";
+  return "failure";
+}
+function currentSystemdUnit(cgroupText) {
+  for (const line of cgroupText.split("\n")) {
+    const path = line.trim().split(":").pop();
+    if (!path?.startsWith("/")) continue;
+    const leaf = path.split("/").filter(Boolean).pop();
+    if (leaf && (leaf.endsWith(".service") || leaf.endsWith(".scope"))) return leaf;
+  }
+  return null;
+}
+function readCurrentSystemdUnit() {
+  try {
+    return currentSystemdUnit(readFileSync5("/proc/self/cgroup", "utf8"));
+  } catch {
+    return null;
+  }
+}
+function processGroupMembers(pgid) {
+  try {
+    const out = execFileSync("ps", ["-eo", "pid=,pgid="], { timeout: 5e3 }).toString();
+    return {
+      ok: true,
+      members: out.split("\n").map((line) => /^\s*(\d+)\s+(\d+)\s*$/.exec(line)).filter((m) => m !== null).filter((m) => Number(m[2]) === pgid && Number(m[1]) !== process.pid).map((m) => Number(m[1]))
+    };
   } catch (err) {
-    if (err instanceof ApiError && err.status >= 500) {
-      return uncertainOutcome(`${err.status}: ${apiErrorMessage(err)}`);
+    return { ok: false, error: (err instanceof Error ? err.message : String(err)).slice(0, 150) };
+  }
+}
+var sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var MANAGER_ENV_KEYS = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR", "PATH"];
+var managerEnvKey = (env) => MANAGER_ENV_KEYS.map((k) => `${k}=${env[k] ?? ""}`).join("\0");
+function createTurnContainment(turnId, deps = {}) {
+  const probe = deps.capabilityProbe ?? scopeCapabilityUsable;
+  const fallbackGraceMs = deps.fallbackGraceMs ?? FALLBACK_GRACE_MS;
+  const ownUnit = (deps.ownSystemdUnit ?? readCurrentSystemdUnit)();
+  const scopeUnits = [];
+  const groups = [];
+  let kind = null;
+  let probedEnvKey = null;
+  let attempt = 0;
+  function scopeArgs(unit) {
+    return [
+      "--user",
+      "--scope",
+      "--quiet",
+      "--collect",
+      `--unit=${unit}`,
+      `--property=TimeoutStopSec=${CONTAINMENT_STOP_GRACE_SEC}s`,
+      // Bind the scope's life to the companion's own unit, so stopping or
+      // restarting the companion still takes its in-flight turns with it —
+      // which is what happens today, and what the scope would otherwise undo.
+      // Omitted outside a unit, where there is nothing to bind to.
+      ...ownUnit ? [`--property=PartOf=${ownUnit}`] : [],
+      "--"
+    ];
+  }
+  function resolveKind(env) {
+    const envKey = managerEnvKey(env);
+    if (kind === null || envKey !== probedEnvKey) {
+      kind = probe(env) ? "systemd-scope" : "process-group";
+      probedEnvKey = envKey;
+      deps.log?.("containment: resolved strategy for this turn", {
+        kind,
+        platform: process.platform
+      });
     }
-    if (err instanceof ApiError) {
-      if (err.status === 409 && apiErrorCode(err) === "no_active_turn") {
-        return toolError(
-          "No active turn: this turn has already settled, so the act was not performed."
+    return kind;
+  }
+  function spawnInScope(options) {
+    const unit = turnScopeUnit(turnId, attempt++);
+    scopeUnits.push({ unit, env: options.env });
+    deps.log?.("containment: spawning the turn CLI into a systemd scope", {
+      unit,
+      partOf: ownUnit,
+      command: options.command
+    });
+    return asContained(
+      spawn4("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
+        ...options.cwd ? { cwd: options.cwd } : {},
+        env: options.env,
+        stdio: ["pipe", "pipe", "pipe"]
+      })
+    );
+  }
+  function spawnInGroup(options) {
+    const child = spawn4(options.command, options.args, {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      env: options.env,
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: process.platform !== "win32"
+    });
+    if (child.pid !== void 0) {
+      groups.push({ pgid: child.pid, child });
+      deps.onProcessGroup?.(child.pid);
+    }
+    deps.log?.("containment: no host-owned containment here \u2014 best effort only", {
+      platform: process.platform,
+      pid: child.pid
+    });
+    return asContained(child);
+  }
+  async function reapScopes(result) {
+    for (const { unit, env } of scopeUnits) {
+      try {
+        await execFileAsync("systemctl", ["--user", "stop", `${unit}.scope`], {
+          env,
+          timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (classifyStopError(message) === "failure") {
+          result.failures.push({ target: unit, error: message.slice(0, 200) });
+          continue;
+        }
+        result.reaped.push(unit);
+        continue;
+      }
+      try {
+        const { stdout } = await execFileAsync(
+          "systemctl",
+          ["--user", "show", `${unit}.scope`, "--property=ActiveState", "--value"],
+          { env, timeout: 1e4 }
         );
+        const state = stdout.trim();
+        if (state === "" || state === "inactive" || state === "failed") result.reaped.push(unit);
+        else result.failures.push({ target: unit, error: `scope still ${state} after stop` });
+      } catch (err) {
+        result.failures.push({
+          target: unit,
+          error: `could not confirm the scope stopped: ${(err instanceof Error ? err.message : String(err)).slice(0, 150)}`
+        });
       }
-      return toolError(`The act was refused (${err.status}): ${apiErrorMessage(err)}`);
     }
-    return uncertainOutcome(err instanceof Error ? err.message : String(err));
   }
-  if (!result.ok) return toolError(JSON.stringify(result));
-  return { content: [{ type: "text", text: JSON.stringify(result) }] };
-}
-function uncertainOutcome(cause) {
-  return toolError(
-    `The outcome of this act could not be confirmed (${cause}). It may already have been performed, with only the response lost. Do NOT simply repeat the call: a repeat is a second, separate act, not a retry. Carry on, and say in your reply that you could not confirm it.`
-  );
-}
-function createTurnControlMcpServer(acts, skipState) {
-  const ACT_TOOL = { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
-  const CANCEL_TOOL = { ...ACT_TOOL, idempotentHint: true };
-  const RECORDER_TOOL = { readOnlyHint: true, openWorldHint: false };
-  return createSdkMcpServer({
-    name: COMPANION_LOCAL_MCP_SERVER,
-    version: "0.0.0",
-    tools: [
-      ...skipState ? [
-        tool(
-          SKIP_TURN_TOOL,
-          TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
-          {
-            reason: z13.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
-          },
-          async (args) => {
-            skipState.skipped = true;
-            skipState.reason = args.reason;
-            return {
-              content: [{ type: "text", text: JSON.stringify({ skipped: true }) }]
-            };
-          },
-          { annotations: RECORDER_TOOL, alwaysLoad: true }
-        )
-      ] : [],
-      tool(
-        ASK_TOOL,
-        TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
-        {
-          targetUserId: z13.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z13.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z13.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z13.array(
-            z13.union([
-              z13.string().min(1).max(MAX_ASK_OPTION_BYTES),
-              z13.object({
-                label: z13.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
-                move: z13.object({
-                  task: z13.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
-                  status: z13.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
+  async function reapGroups(result) {
+    for (const { pgid, child } of groups) {
+      const target = String(pgid);
+      if (process.platform === "win32") {
+        try {
+          if (child.exitCode === null) child.kill();
+          result.unverified.push(target);
+        } catch (err) {
+          result.failures.push({
+            target,
+            error: (err instanceof Error ? err.message : String(err)).slice(0, 200)
+          });
+        }
+        continue;
+      }
+      const first = processGroupMembers(pgid);
+      if (!first.ok) {
+        result.failures.push({
+          target,
+          error: `could not enumerate the process group: ${first.error}`
+        });
+        continue;
+      }
+      if (first.members.length === 0) {
+        result.reaped.push(target);
+        continue;
+      }
+      for (const pid of first.members) {
+        try {
+          process.kill(pid, "SIGTERM");
+        } catch {
+        }
+      }
+      await sleep2(fallbackGraceMs);
+      const afterTerm = processGroupMembers(pgid);
+      if (!afterTerm.ok) {
+        result.failures.push({
+          target,
+          error: `could not re-enumerate the process group after SIGTERM: ${afterTerm.error}`
+        });
+        continue;
+      }
+      for (const pid of afterTerm.members) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+      }
+      const afterKill = processGroupMembers(pgid);
+      if (!afterKill.ok) {
+        result.failures.push({
+          target,
+          error: `could not confirm the process group is empty after SIGKILL: ${afterKill.error}`
+        });
+        continue;
+      }
+      if (afterKill.members.length)
+        result.failures.push({
+          target,
+          error: `${afterKill.members.length} process(es) still in the group after SIGKILL`
+        });
+      else result.reaped.push(target);
+    }
+  }
+  return {
+    get kind() {
+      return kind;
+    },
+    spawn(options) {
+      return resolveKind(options.env) === "systemd-scope" ? spawnInScope(options) : spawnInGroup(options);
+    },
+    scopePrefix(env) {
+      if (resolveKind(env) !== "systemd-scope") return null;
+      const unit = turnScopeUnit(turnId, attempt++);
+      scopeUnits.push({ unit, env });
+      deps.log?.("containment: a harness will start in a systemd scope", { unit });
+      return ["systemd-run", ...scopeArgs(unit)];
+    },
+    async reap() {
+      const result = {
+        kind: kind ?? "unused",
+        reaped: [],
+        failures: [],
+        unverified: []
+      };
+      await reapScopes(result);
+      await reapGroups(result);
+      deps.log?.("containment: reap complete", {
+        kind: result.kind,
+        reaped: result.reaped,
+        failures: result.failures
+      });
+      return result;
+    }
+  };
+}
+
+// src/runner/protocol.ts
+import { z as z14 } from "zod";
+
+// src/run-config.ts
+import { z as z13 } from "zod";
+var mcpStdioServerSchema = z13.object({
+  type: z13.literal("stdio").optional(),
+  command: z13.string().min(1),
+  args: z13.array(z13.string()).optional(),
+  env: z13.record(z13.string(), z13.string()).optional()
+});
+var mcpHttpServerSchema = z13.object({
+  type: z13.literal("http"),
+  url: z13.string().url(),
+  headers: z13.record(z13.string(), z13.string()).optional()
+});
+var mcpSseServerSchema = z13.object({
+  type: z13.literal("sse"),
+  url: z13.string().url(),
+  headers: z13.record(z13.string(), z13.string()).optional()
+});
+var mcpServerDefSchema = z13.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+var thinkingConfigSchema = z13.discriminatedUnion("type", [
+  z13.object({ type: z13.literal("adaptive") }),
+  z13.object({ type: z13.literal("enabled"), budgetTokens: z13.number().int().positive().optional() }),
+  z13.object({ type: z13.literal("disabled") })
+]);
+var effortSchema = z13.enum(["low", "medium", "high", "xhigh", "max"]);
+var runConfigSchema = z13.object({
+  // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
+  // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
+  // is the locked surface. Kept in lockstep with `@cabane/shared`'s
+  // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
+  // stripped, so an older companion riding a newer server never rejects the config).
+  hostAccess: z13.boolean().optional(),
+  mcpServers: z13.record(z13.string(), mcpServerDefSchema).optional(),
+  model: z13.string().min(1).optional(),
+  thinking: thinkingConfigSchema.optional(),
+  effort: effortSchema.optional()
+});
+var EMPTY_RUN_CONFIG = {};
+function parseRunConfig(raw, onWarn) {
+  const result = runConfigSchema.safeParse(raw ?? {});
+  if (result.success) return result.data;
+  onWarn?.(
+    `run-config from Cabane didn't parse (${result.error.issues.map((i) => i.path.join(".") || "(root)").join(", ")}) \u2014 falling back to the locked assistant default`
+  );
+  return EMPTY_RUN_CONFIG;
+}
+
+// src/runner/protocol.ts
+var RUNNER_ENV = {
+  // The wire the runner speaks.
+  url: "CABANE_URL",
+  // The dispatch as the device stream delivered it.
+  dispatch: "CABANE_DISPATCH",
+  // The turn id the launcher resolved, and whether this is a replay of a turn
+  // an earlier process started. The seq floor for a replay is derived inside
+  // the turn from the outbox and the server, as it always was.
+  turnId: "CABANE_TURN_ID",
+  resumed: "CABANE_RESUMED",
+  // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
+  spec: "CABANE_RUNNER_SPEC"
+};
+var runtimeHealthSchema = z14.object({
+  quotaState: z14.enum(["ok", "limited", "auth_expired", "unknown"]),
+  limitedUntil: z14.string().nullable(),
+  lastError: z14.string().nullable()
+});
+var runnerSpecSchema = z14.object({
+  deviceId: z14.string().optional(),
+  // The launcher's boot id: the one its heartbeat carries, so a runner's lease
+  // matches the device that holds it.
+  bootId: z14.string(),
+  workspaceId: z14.string(),
+  workspaceSlug: z14.string(),
+  agentId: z14.string(),
+  agentUsername: z14.string(),
+  agentName: z14.string(),
+  local: localAgentConfigSchema,
+  runConfig: runConfigSchema,
+  opencodeServerUrl: z14.string().optional(),
+  claudeCodeAvailable: z14.boolean(),
+  codexAvailable: z14.boolean(),
+  idleTimeoutMs: z14.number().int().positive().optional(),
+  totalTimeoutMs: z14.number().int().positive().optional(),
+  leaseRenewalMs: z14.number().int().positive().optional(),
+  preparingRowDelayMs: z14.number().int().nonnegative().optional(),
+  // Whether the turn writes a transcript. The directory is the runner's own
+  // (`transcriptsDir()`), so `CABANE_RUNNER_STATE_DIR` moves it with the outbox.
+  transcripts: z14.boolean(),
+  // Whether the harness starts under the OS sandbox. The launcher sends 'os'
+  // only when this host can make one.
+  sandbox: z14.enum(["os", "none"]),
+  logLevel: z14.string(),
+  // The launcher's connector-health observations, by runtime, as of the start.
+  connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
+  // True when this (conversation, agent) pair was already told its session
+  // could not be saved: the notice is once per pair, not once per process.
+  sessionWriteNoticeClaimed: z14.boolean()
+});
+var dispatchSchema = z14.object({
+  type: z14.literal("device:dispatch_requested"),
+  agentId: z14.string(),
+  deviceId: z14.string(),
+  conversationId: z14.string(),
+  messageId: z14.string(),
+  episode: z14.number().int().optional()
+});
+var credentialsSchema = z14.object({
+  agentToken: z14.string().min(1),
+  deviceToken: z14.string().min(1).optional()
+});
+function runnerEnv(input) {
+  return {
+    [RUNNER_ENV.url]: input.baseUrl,
+    [RUNNER_ENV.dispatch]: JSON.stringify(input.dispatch),
+    [RUNNER_ENV.turnId]: input.turnId,
+    ...input.resumed ? { [RUNNER_ENV.resumed]: "1" } : {},
+    [RUNNER_ENV.spec]: JSON.stringify(input.spec)
+  };
+}
+function runnerStdin(input) {
+  return `${JSON.stringify({
+    // Phase 1 (CT1680) replaces the agent PAT with a runner credential bound to
+    // this one dispatch; until then the child holds what the in-process turn
+    // held, on the same machine.
+    agentToken: input.agentToken,
+    ...input.deviceToken ? { deviceToken: input.deviceToken } : {}
+  })}
+`;
+}
+function encodeLauncherMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+function decodeRunnerEvent(line) {
+  if (!line.startsWith("{")) return null;
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || !("cabaneRunner" in value)) return null;
+  return value;
+}
+
+// src/runner/launch.ts
+function selfRunnerCommand() {
+  const script = process.argv[1];
+  if (!script) throw new Error("runners: cannot tell which script started this companion");
+  return [process.execPath, ...process.execArgv, script, "run-turn"];
+}
+function healthSnapshot(store) {
+  const out = {};
+  for (const r of store?.reports() ?? []) {
+    out[r.runtime] = {
+      quotaState: r.quotaState ?? "unknown",
+      limitedUntil: r.limitedUntil ?? null,
+      lastError: r.lastError ?? null
+    };
+  }
+  return out;
+}
+function runnerSpec(opts, launch, duties) {
+  return {
+    ...opts.deviceId ? { deviceId: opts.deviceId } : {},
+    bootId,
+    workspaceId: opts.workspaceId,
+    workspaceSlug: opts.workspaceSlug,
+    agentId: opts.agentId,
+    agentUsername: opts.agentUsername,
+    agentName: String(opts.log.bindings().agentName ?? opts.agentUsername),
+    local: opts.local,
+    runConfig: opts.runConfig,
+    ...opts.opencodeServerUrl ? { opencodeServerUrl: opts.opencodeServerUrl } : {},
+    // Read now, per turn, as the in-process path reads them at adapter selection.
+    claudeCodeAvailable: opts.claudeCodeAvailable?.() ?? true,
+    codexAvailable: opts.codexAvailable?.() ?? false,
+    ...opts.idleTimeoutMs !== void 0 ? { idleTimeoutMs: opts.idleTimeoutMs } : {},
+    ...opts.totalTimeoutMs !== void 0 ? { totalTimeoutMs: opts.totalTimeoutMs } : {},
+    ...opts.leaseRenewalMs !== void 0 ? { leaseRenewalMs: opts.leaseRenewalMs } : {},
+    ...opts.preparingRowDelayMs !== void 0 ? { preparingRowDelayMs: opts.preparingRowDelayMs } : {},
+    transcripts: opts.transcriptDir !== void 0,
+    sandbox: launch.sandbox ?? "none",
+    logLevel: opts.log.level,
+    connectorHealth: healthSnapshot(launch.connectorHealth),
+    sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
+  };
+}
+var PINO_LEVELS = {
+  10: "trace",
+  20: "debug",
+  30: "info",
+  40: "warn",
+  50: "error",
+  60: "fatal"
+};
+function relayRunnerLog(line, log) {
+  if (!line.trim()) return;
+  let record = null;
+  try {
+    const parsed = JSON.parse(line);
+    if (parsed && typeof parsed === "object") record = parsed;
+  } catch {
+    record = null;
+  }
+  if (!record || typeof record.level !== "number") {
+    log.debug({ runnerStderr: line }, "runner: output");
+    return;
+  }
+  const {
+    level,
+    msg,
+    time: _time,
+    pid: _pid,
+    hostname: _hostname,
+    agentName: _agentName,
+    ...fields
+  } = record;
+  const method = PINO_LEVELS[level] ?? "info";
+  log[method](fields, typeof msg === "string" ? msg : "");
+}
+function lines(stream, onLine) {
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  rl.on("line", onLine);
+  return new Promise((resolve2) => rl.once("close", resolve2));
+}
+function giveBackLocks(locks, prefix, remote, launch, log) {
+  locks.withdraw(prefix);
+  const stop = launch.stopRemoteSession ?? ((url, id) => stopRemoteOpencodeSession(url, id));
+  for (const { key, owner } of locks.heldBy(prefix)) {
+    const left = remote.filter((r) => opencodeLockKey(r.serverUrl) === key);
+    if (!left.length) {
+      locks.release(owner);
+      continue;
+    }
+    void (async () => {
+      for (let attempt = 1; ; attempt++) {
+        const stopped = await Promise.all(left.map((r) => stop(r.serverUrl, r.sessionId))).catch(
+          () => [false]
+        );
+        if (stopped.every(Boolean)) break;
+        if (attempt === 1)
+          log.warn(
+            { key, sessions: left.map((r) => r.sessionId) },
+            "runner: a dead runner left work on a shared server that could not be confirmed stopped; holding the server until it is"
+          );
+        await new Promise((resolve2) => setTimeout(resolve2, launch.reconcileRetryMs ?? 5e3));
+      }
+      locks.release(owner);
+    })();
+  }
+}
+async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
+  const startedAt = Date.now();
+  const { turnId } = handleOpts;
+  const log = opts.log.child({
+    workspaceId: opts.workspaceId,
+    conversationId: payload.conversationId,
+    agentId: payload.agentId,
+    messageId: payload.messageId
+  });
+  const controller = new AbortController();
+  duties.registerAbort(turnId, controller);
+  const stopRunner = new AbortController();
+  let ready = false;
+  const forwardStop = () => {
+    if (ready) stopRunner.abort();
+  };
+  controller.signal.addEventListener("abort", forwardStop, { once: true });
+  const attempt = {
+    workspaceId: opts.workspaceId,
+    conversationId: payload.conversationId,
+    agentId: payload.agentId,
+    turnId
+  };
+  let result;
+  let thrown;
+  let code;
+  let handle;
+  let child;
+  const groups = [];
+  const remote = [];
+  const lockOwner = (id) => `${turnId}#${id}`;
+  const locks = launch.locks;
+  try {
+    handle = await launch.provider.acquire(attempt);
+    const env = {};
+    for (const [k, v] of Object.entries(launch.env ?? process.env)) {
+      if (v !== void 0) env[k] = v;
+    }
+    const input = {
+      baseUrl: opts.baseUrl,
+      agentToken: opts.credential,
+      ...launch.deviceToken ? { deviceToken: launch.deviceToken } : {},
+      dispatch: payload,
+      turnId,
+      resumed: handleOpts.resumed,
+      spec: runnerSpec(opts, launch, duties)
+    };
+    Object.assign(env, runnerEnv(input));
+    const running = launch.provider.exec(handle, launch.command, env, {
+      signal: stopRunner.signal,
+      stdin: runnerStdin(input)
+    });
+    child = running;
+    log.debug(
+      { turnId, runnerPid: running.pid, provider: launch.provider.name },
+      "runner: started"
+    );
+    const stdoutDone = lines(running.stdout, (line) => {
+      const event = decodeRunnerEvent(line);
+      if (!event) {
+        log.debug({ runnerStdout: line }, "runner: output");
+        return;
+      }
+      switch (event.cabaneRunner) {
+        case "ready":
+          ready = true;
+          if (controller.signal.aborted) stopRunner.abort();
+          return;
+        case "start":
+          duties.notifyStart({
+            id: event.id,
+            conversationId: event.conversationId,
+            message: event.message
+          });
+          return;
+        case "end": {
+          const { cabaneRunner: _kind, ...info } = event;
+          duties.notifyEnd(info);
+          return;
+        }
+        case "session_write_notice":
+          duties.markSessionWriteNotice();
+          return;
+        case "connector_health":
+          launch.connectorHealth?.recordSettle(event.runtime, {
+            ok: event.ok,
+            errorReason: event.errorReason
+          });
+          return;
+        case "result":
+          result = event.result;
+          return;
+        case "error":
+          thrown = event.message;
+          return;
+        case "lock":
+          if (!locks) {
+            log.warn(
+              { key: event.key },
+              "runner: asked for a device lock this launcher has none of"
+            );
+            return;
+          }
+          locks.request(
+            event.key,
+            lockOwner(event.id),
+            () => running.stdin.write(encodeLauncherMessage({ cabaneLauncher: "granted", id: event.id }))
+          );
+          return;
+        case "unlock":
+          locks?.release(lockOwner(event.id));
+          return;
+        case "process_group":
+          groups.push(event.pgid);
+          return;
+        case "remote_session":
+          remote.push({ serverUrl: event.serverUrl, sessionId: event.sessionId });
+          return;
+      }
+    });
+    const stderrDone = lines(running.stderr, (line) => relayRunnerLog(line, opts.log));
+    code = await running.exit;
+    await Promise.all([stdoutDone, stderrDone]);
+  } finally {
+    if (locks) giveBackLocks(locks, `${turnId}#`, remote, launch, log);
+    child?.stdin.end();
+    controller.signal.removeEventListener("abort", forwardStop);
+    duties.releaseAbort(turnId, controller);
+    if (handle) await launch.provider.release(handle, { destroy: false });
+  }
+  if (result) return result;
+  const durationMs = Date.now() - startedAt;
+  const reason = thrown !== void 0 ? `runner_failed: ${thrown}` : `runner_exited: ${code}`;
+  await child?.reap(groups);
+  const reaped = await (launch.reapTurn ?? reapTurnScopes)(turnId).catch((err) => ({
+    failures: [err instanceof Error ? err.message : String(err)]
+  }));
+  if (reaped.failures.length) {
+    log.warn(
+      { turnId, failures: reaped.failures },
+      "runner: couldn't stop what the dead runner's turn left running"
+    );
+  }
+  try {
+    await opts.api.setActiveRun(opts.workspaceId, payload.conversationId, payload.agentId, {
+      activeRunStartedAt: null,
+      turnId,
+      outcome: "failed",
+      errorReason: reason.slice(0, 200),
+      readThrough: payload.messageId
+    });
+  } catch (err) {
+    log.warn(
+      { ...apiErrorLogFields(err), turnId },
+      "Couldn't update the turn's status in Cabane. Check the conversation before trying again."
+    );
+  }
+  if (thrown !== void 0) throw new Error(thrown);
+  log.warn({ turnId, code }, "runner: exited without reporting a result");
+  duties.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
+  return { ok: false, durationMs, reason };
+}
+
+// src/term.ts
+import { createInterface as createInterface2 } from "readline";
+import { homedir as homedir2 } from "os";
+import pc from "picocolors";
+function tildePath(path) {
+  const home = homedir2();
+  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
+  return path;
+}
+
+// src/turn-execution.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync9 } from "fs";
+
+// src/turn-control-tools.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { z as z15 } from "zod";
+var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
+var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
+var SKIP_TURN_TOOL = "skip_turn";
+var ASK_TOOL = "ask";
+var ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${ASK_TOOL}`;
+var WITHDRAW_ASK_TOOL = "withdraw_ask";
+var WITHDRAW_ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WITHDRAW_ASK_TOOL}`;
+var WAKE_ME_TOOL = "wake_me";
+var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
+var CANCEL_WAKE_TOOL = "cancel_wake";
+var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
+var TURN_ACT_TIMEOUT_MS = 45e3;
+function createSkipState() {
+  return { skipped: false, reason: null };
+}
+function toolError(text) {
+  return { isError: true, content: [{ type: "text", text }] };
+}
+async function performAct(acts, act) {
+  let result;
+  try {
+    result = await acts.api.turnAct(
+      acts.workspaceId,
+      acts.turnId,
+      act,
+      AbortSignal.timeout(TURN_ACT_TIMEOUT_MS)
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status >= 500) {
+      return uncertainOutcome(`${err.status}: ${apiErrorMessage(err)}`);
+    }
+    if (err instanceof ApiError) {
+      if (err.status === 409 && apiErrorCode(err) === "no_active_turn") {
+        return toolError(
+          "No active turn: this turn has already settled, so the act was not performed."
+        );
+      }
+      return toolError(`The act was refused (${err.status}): ${apiErrorMessage(err)}`);
+    }
+    return uncertainOutcome(err instanceof Error ? err.message : String(err));
+  }
+  if (!result.ok) return toolError(JSON.stringify(result));
+  return { content: [{ type: "text", text: JSON.stringify(result) }] };
+}
+function uncertainOutcome(cause) {
+  return toolError(
+    `The outcome of this act could not be confirmed (${cause}). It may already have been performed, with only the response lost. Do NOT simply repeat the call: a repeat is a second, separate act, not a retry. Carry on, and say in your reply that you could not confirm it.`
+  );
+}
+function createTurnControlMcpServer(acts, skipState) {
+  const ACT_TOOL = { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
+  const CANCEL_TOOL = { ...ACT_TOOL, idempotentHint: true };
+  const RECORDER_TOOL = { readOnlyHint: true, openWorldHint: false };
+  return createSdkMcpServer({
+    name: COMPANION_LOCAL_MCP_SERVER,
+    version: "0.0.0",
+    tools: [
+      ...skipState ? [
+        tool(
+          SKIP_TURN_TOOL,
+          TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
+          {
+            reason: z15.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+          },
+          async (args) => {
+            skipState.skipped = true;
+            skipState.reason = args.reason;
+            return {
+              content: [{ type: "text", text: JSON.stringify({ skipped: true }) }]
+            };
+          },
+          { annotations: RECORDER_TOOL, alwaysLoad: true }
+        )
+      ] : [],
+      tool(
+        ASK_TOOL,
+        TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
+        {
+          targetUserId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z15.array(
+            z15.union([
+              z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
+              z15.object({
+                label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
+                move: z15.object({
+                  task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
+                  status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
                 }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
               })
             ])
           ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z13.array(
-            z13.object({
-              headline: z13.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z13.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z13.array(
-                z13.union([
-                  z13.string().min(1).max(MAX_ASK_OPTION_BYTES),
-                  z13.object({
-                    label: z13.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
-                    move: z13.object({
-                      task: z13.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
-                      status: z13.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
+          questions: z15.array(
+            z15.object({
+              headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z15.array(
+                z15.union([
+                  z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
+                  z15.object({
+                    label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
+                    move: z15.object({
+                      task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
+                      status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
                     }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
                   })
                 ])
               ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
             })
           ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z13.object({
-            askId: z13.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z13.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          replaces: z15.object({
+            askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
           }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
         },
         async (args) => {
@@ -8091,9 +8733,9 @@ function createTurnControlMcpServer(acts, skipState) {
         WAKE_ME_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
         {
-          afterSeconds: z13.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z13.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z13.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+          afterSeconds: z15.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z15.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z15.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
         },
         async (args) => {
           const hasAfter = args.afterSeconds !== void 0;
@@ -8127,8 +8769,8 @@ function createTurnControlMcpServer(acts, skipState) {
         WITHDRAW_ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
         {
-          askId: z13.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z13.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+          askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
@@ -8168,24 +8810,10 @@ function buildCompanionTurnRequest(params) {
     session: t.session,
     cabane: {
       mcpUrl: cabaneMcpUrl(params.baseUrl),
-      // CT306: prefer the per-turn OBO credential; fall back to the companion PAT
-      // when the API didn't mint one (older API / unresolvable delegation).
-      bearer: params.turnToken ?? params.agentPat,
+      bearer: params.turnToken,
       activeConversationId: params.activeConversationId,
       workspaceId: params.workspaceId,
-      // CT714: mount the turn-control surface ONLY when a real turn token backs
-      // this turn — the surface admits `turn_token` auth exclusively, so a
-      // PAT-fallback bearer would be rejected there. Absent it, external adapters
-      // simply don't mount it that turn.
-      //
-      // CT1074: that fallback is now an OLD-API case only. The server mints a token
-      // for every turn it dispatched, so "no token" no longer means "no human behind
-      // the turn" — it means the API predates this change. The condition is right as
-      // it stands and stays where the failure is honest (a rejected bearer is worse
-      // than an unmounted server); what was wrong was upstream, where an undelegated
-      // turn minted nothing and this silently dropped all five verbs on Codex and
-      // opencode with no refusal anyone could see.
-      ...params.turnToken ? { turnControlUrl: turnControlMcpUrl(params.baseUrl) } : {}
+      turnControlUrl: turnControlMcpUrl(params.baseUrl)
     },
     local: {
       ...params.cwd ? { cwd: params.cwd } : {},
@@ -8209,11 +8837,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
-  const path = join11(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join10(tmpdir(), PREFIX));
+  const path = join10(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -8257,7 +8885,7 @@ function readOutboxFloor(read, turnId, log) {
 }
 
 // src/prepare-failure.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { hostname } from "os";
 function prepareFailureCause(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -8295,7 +8923,7 @@ async function runPrepareWithReporting(runner, hook, input, context, reportError
 }
 function reportFailure(config, body) {
   return new Promise((resolve2, reject) => {
-    const child = spawn4(config.command, config.args ?? [], {
+    const child = spawn5(config.command, config.args ?? [], {
       stdio: ["pipe", "ignore", "ignore"],
       env: { ...process.env, ...config.env }
     });
@@ -8319,488 +8947,232 @@ function reportFailure(config, body) {
 }
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { join as join11 } from "path";
 function dirFor(workspaceId) {
-  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
-}
-function conversationDir(workspaceId, conversationId) {
-  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
-}
-function pathFor3(workspaceId, conversationId, agentId) {
-  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
-}
-function readPrepared(workspaceId, conversationId, agentId) {
-  const path = pathFor3(workspaceId, conversationId, agentId);
-  if (!existsSync8(path)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
-    if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
-      return {
-        cwd: parsed.cwd,
-        ...parsed.env && typeof parsed.env === "object" ? { env: parsed.env } : {}
-      };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function writePrepared(workspaceId, conversationId, agentId, result) {
-  mkdirSync8(conversationDir(workspaceId, conversationId), { recursive: true });
-  writeFileSync6(
-    pathFor3(workspaceId, conversationId, agentId),
-    JSON.stringify(result) + "\n",
-    "utf8"
-  );
-}
-function clearPrepared(workspaceId, conversationId, agentId) {
-  rmSync5(pathFor3(workspaceId, conversationId, agentId), { force: true });
-}
-
-// src/secrets.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join13 } from "path";
-import { z as z14 } from "zod";
-var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-function secretsPath() {
-  return join13(cabaneDir(), "secrets.json");
-}
-var secretStoreSchema = z14.record(z14.string(), z14.string());
-function loadSecretStore() {
-  const path = secretsPath();
-  if (!existsSync9(path)) return makeStore({});
-  let raw;
-  try {
-    raw = readFileSync7(path, "utf8");
-  } catch (err) {
-    throw new ConfigError(
-      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (raw.trim().length === 0) return makeStore({});
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new ConfigError(
-      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
-    );
-  }
-  const result = secretStoreSchema.safeParse(parsed);
-  if (!result.success) {
-    throw new ConfigError(
-      `${path} must be a flat object mapping secret names to string values (e.g. { "GITHUB_TOKEN": "ghp_\u2026" }).`
-    );
-  }
-  return makeStore(result.data);
-}
-function loadSecretStoreTolerant(onWarn) {
-  try {
-    return loadSecretStore();
-  } catch (err) {
-    onWarn?.(err instanceof Error ? err.message : String(err));
-    return makeStore({});
-  }
-}
-function makeStore(map) {
-  return {
-    get: (name) => map[name],
-    names: () => Object.keys(map).sort()
-  };
-}
-function requiredSecretNames(mcpServers) {
-  const names = /* @__PURE__ */ new Set();
-  for (const server of Object.values(mcpServers ?? {})) {
-    const bags = [
-      "env" in server ? server.env : void 0,
-      "headers" in server ? server.headers : void 0
-    ];
-    for (const bag of bags) {
-      for (const value of Object.values(bag ?? {})) {
-        for (const [, name] of value.matchAll(PLACEHOLDER_RE)) names.add(name);
-      }
-    }
-  }
-  return [...names].sort();
-}
-function resolveMcpSecrets(mcpServers, store) {
-  const missing = /* @__PURE__ */ new Set();
-  const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
-    const resolved = store.get(name);
-    if (resolved === void 0) {
-      missing.add(name);
-      return _match;
-    }
-    return resolved;
-  });
-  const mapBag = (bag) => {
-    const out = {};
-    for (const [k, v] of Object.entries(bag)) out[k] = interpolate(v);
-    return out;
-  };
-  const servers = {};
-  for (const [name, server] of Object.entries(mcpServers)) {
-    const next = { ...server };
-    if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
-    servers[name] = next;
-  }
-  return { servers, missing: [...missing].sort() };
-}
-
-// src/transcript-writer.ts
-import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname6, join as join14 } from "path";
-function transcriptsDir() {
-  return join14(cabaneDir(), "transcripts");
-}
-var RETAIN = 200;
-var ANOMALY_RETAIN = 50;
-var TranscriptWriter = class {
-  path;
-  broken = false;
-  onWarn;
-  constructor(dir2, meta, onWarn) {
-    this.onWarn = onWarn;
-    this.path = join14(dir2, fileName(meta));
-    try {
-      mkdirSync9(dir2, { recursive: true });
-      try {
-        chmodSync4(dir2, 448);
-      } catch {
-      }
-      pruneOld(dir2, RETAIN);
-    } catch (err) {
-      this.fail(err);
-    }
-    this.line({ type: "_meta", ...meta });
-  }
-  // Append a raw SDK message verbatim.
-  write(msg) {
-    this.line(msg);
-  }
-  // Append the outcome footer.
-  close(outcome) {
-    this.line({ type: "_outcome", ...outcome });
-  }
-  // CT1145: keep an independent copy of an empty successful envelope after the
-  // footer has landed. The ordinary 200-file FIFO keeps rotating as before;
-  // this bucket retains the newest 50 anomalies regardless of ordinary traffic.
-  // Best-effort like every other transcript operation: observability can never
-  // fail the turn.
-  preserveAnomaly() {
-    if (this.broken) return;
-    try {
-      const dir2 = join14(dirname6(this.path), "anomalies");
-      mkdirSync9(dir2, { recursive: true, mode: 448 });
-      chmodSync4(dir2, 448);
-      const target = join14(dir2, basename(this.path));
-      copyFileSync(this.path, target);
-      chmodSync4(target, 384);
-      pruneOld(dir2, ANOMALY_RETAIN);
-    } catch (err) {
-      this.fail(err);
-    }
-  }
-  line(obj) {
-    if (this.broken) return;
-    try {
-      appendFileSync(this.path, JSON.stringify(obj) + "\n", { mode: 384 });
-    } catch (err) {
-      this.fail(err);
-    }
-  }
-  fail(err) {
-    if (this.broken) return;
-    this.broken = true;
-    this.onWarn?.(`transcript write failed (${err instanceof Error ? err.message : String(err)})`);
-  }
-};
-function fileName(meta) {
-  const d = new Date(meta.ts);
-  const stamp = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
-  const slug = safe2(meta.workspaceSlug) || "ws";
-  const short = meta.dispatchId.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8) || "turn";
-  return `${stamp}-${slug}-${short}.jsonl`;
+  return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
-function pad(n) {
-  return String(n).padStart(2, "0");
+function conversationDir(workspaceId, conversationId) {
+  return join11(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
-function safe2(s) {
-  return s.replace(/[^a-zA-Z0-9_-]/g, "-");
+function pathFor2(workspaceId, conversationId, agentId) {
+  return join11(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
-function pruneOld(dir2, retain) {
-  let files;
+function readPrepared(workspaceId, conversationId, agentId) {
+  const path = pathFor2(workspaceId, conversationId, agentId);
+  if (!existsSync7(path)) return null;
   try {
-    files = readdirSync(dir2).filter((f) => f.endsWith(".jsonl"));
-  } catch {
-    return;
-  }
-  if (files.length <= retain) return;
-  const drop = files.sort().slice(0, files.length - retain);
-  for (const f of drop) {
-    try {
-      rmSync6(join14(dir2, f), { force: true });
-    } catch {
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
+      return {
+        cwd: parsed.cwd,
+        ...parsed.env && typeof parsed.env === "object" ? { env: parsed.env } : {}
+      };
     }
-  }
-}
-
-// src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn5 } from "child_process";
-import { readFileSync as readFileSync8 } from "fs";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var asContained = (child) => child;
-var CONTAINMENT_STOP_GRACE_SEC = 5;
-var FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
-var CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
-function turnScopeUnit(turnId, attempt) {
-  const safe3 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
-  return `cabane-turn-${safe3}-${attempt}`;
-}
-function scopeCapabilityUsable(env, timeoutMs = CAPABILITY_PROBE_TIMEOUT_MS) {
-  if (process.platform !== "linux") return false;
-  try {
-    execFileSync("systemd-run", ["--user", "--scope", "--quiet", "--collect", "--", "/bin/true"], {
-      env,
-      timeout: timeoutMs,
-      stdio: "ignore"
-    });
-    return true;
+    return null;
   } catch {
-    return false;
+    return null;
   }
 }
-function classifyStopError(message) {
-  if (/failed to connect to bus|failed to get d-?bus connection|connection refused|refusing to operate|spawn systemctl|systemctl.*ENOENT|ENOENT.*systemctl/i.test(
-    message
-  )) {
-    return "failure";
-  }
-  if (/not loaded|could not be found|no such unit|unit .* not found/i.test(message))
-    return "absent";
-  return "failure";
+function writePrepared(workspaceId, conversationId, agentId, result) {
+  mkdirSync7(conversationDir(workspaceId, conversationId), { recursive: true });
+  writeFileSync5(
+    pathFor2(workspaceId, conversationId, agentId),
+    JSON.stringify(result) + "\n",
+    "utf8"
+  );
 }
-function currentSystemdUnit(cgroupText) {
-  for (const line of cgroupText.split("\n")) {
-    const path = line.trim().split(":").pop();
-    if (!path?.startsWith("/")) continue;
-    const leaf = path.split("/").filter(Boolean).pop();
-    if (leaf && (leaf.endsWith(".service") || leaf.endsWith(".scope"))) return leaf;
-  }
-  return null;
+function clearPrepared(workspaceId, conversationId, agentId) {
+  rmSync5(pathFor2(workspaceId, conversationId, agentId), { force: true });
 }
-function readCurrentSystemdUnit() {
-  try {
-    return currentSystemdUnit(readFileSync8("/proc/self/cgroup", "utf8"));
-  } catch {
-    return null;
-  }
+
+// src/secrets.ts
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
+import { join as join12 } from "path";
+import { z as z16 } from "zod";
+var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function secretsPath() {
+  return join12(cabaneDir(), "secrets.json");
 }
-function processGroupMembers(pgid) {
+var secretStoreSchema = z16.record(z16.string(), z16.string());
+function loadSecretStore() {
+  const path = secretsPath();
+  if (!existsSync8(path)) return makeStore({});
+  let raw;
   try {
-    const out = execFileSync("ps", ["-eo", "pid=,pgid="], { timeout: 5e3 }).toString();
-    return {
-      ok: true,
-      members: out.split("\n").map((line) => /^\s*(\d+)\s+(\d+)\s*$/.exec(line)).filter((m) => m !== null).filter((m) => Number(m[2]) === pgid && Number(m[1]) !== process.pid).map((m) => Number(m[1]))
-    };
+    raw = readFileSync7(path, "utf8");
   } catch (err) {
-    return { ok: false, error: (err instanceof Error ? err.message : String(err)).slice(0, 150) };
+    throw new ConfigError(
+      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
-}
-var sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
-var MANAGER_ENV_KEYS = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR", "PATH"];
-var managerEnvKey = (env) => MANAGER_ENV_KEYS.map((k) => `${k}=${env[k] ?? ""}`).join("\0");
-function createTurnContainment(turnId, deps = {}) {
-  const probe = deps.capabilityProbe ?? scopeCapabilityUsable;
-  const fallbackGraceMs = deps.fallbackGraceMs ?? FALLBACK_GRACE_MS;
-  const ownUnit = (deps.ownSystemdUnit ?? readCurrentSystemdUnit)();
-  const scopeUnits = [];
-  const groups = [];
-  let kind = null;
-  let probedEnvKey = null;
-  let attempt = 0;
-  function spawnInScope(options) {
-    const unit = turnScopeUnit(turnId, attempt++);
-    scopeUnits.push({ unit, env: options.env });
-    deps.log?.("containment: spawning the turn CLI into a systemd scope", {
-      unit,
-      partOf: ownUnit,
-      command: options.command
-    });
-    return asContained(
-      spawn5(
-        "systemd-run",
-        [
-          "--user",
-          "--scope",
-          "--quiet",
-          "--collect",
-          `--unit=${unit}`,
-          `--property=TimeoutStopSec=${CONTAINMENT_STOP_GRACE_SEC}s`,
-          // Bind the scope's life to the companion's own unit, so stopping or
-          // restarting the companion still takes its in-flight turns with it —
-          // which is what happens today, and what the scope would otherwise undo.
-          // Omitted outside a unit, where there is nothing to bind to.
-          ...ownUnit ? [`--property=PartOf=${ownUnit}`] : [],
-          "--",
-          options.command,
-          ...options.args
-        ],
-        {
-          ...options.cwd ? { cwd: options.cwd } : {},
-          env: options.env,
-          stdio: ["pipe", "pipe", "pipe"]
-        }
-      )
+  if (raw.trim().length === 0) return makeStore({});
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ConfigError(
+      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
     );
   }
-  function spawnInGroup(options) {
-    const child = spawn5(options.command, options.args, {
-      ...options.cwd ? { cwd: options.cwd } : {},
-      env: options.env,
-      stdio: ["pipe", "pipe", "pipe"],
-      detached: process.platform !== "win32"
-    });
-    if (child.pid !== void 0) groups.push({ pgid: child.pid, child });
-    deps.log?.("containment: no host-owned containment here \u2014 best effort only", {
-      platform: process.platform,
-      pid: child.pid
-    });
-    return asContained(child);
+  const result = secretStoreSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new ConfigError(
+      `${path} must be a flat object mapping secret names to string values (e.g. { "GITHUB_TOKEN": "ghp_\u2026" }).`
+    );
   }
-  async function reapScopes(result) {
-    for (const { unit, env } of scopeUnits) {
-      try {
-        await execFileAsync("systemctl", ["--user", "stop", `${unit}.scope`], {
-          env,
-          timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (classifyStopError(message) === "failure") {
-          result.failures.push({ target: unit, error: message.slice(0, 200) });
-          continue;
-        }
-        result.reaped.push(unit);
-        continue;
-      }
-      try {
-        const { stdout } = await execFileAsync(
-          "systemctl",
-          ["--user", "show", `${unit}.scope`, "--property=ActiveState", "--value"],
-          { env, timeout: 1e4 }
-        );
-        const state = stdout.trim();
-        if (state === "" || state === "inactive" || state === "failed") result.reaped.push(unit);
-        else result.failures.push({ target: unit, error: `scope still ${state} after stop` });
-      } catch (err) {
-        result.failures.push({
-          target: unit,
-          error: `could not confirm the scope stopped: ${(err instanceof Error ? err.message : String(err)).slice(0, 150)}`
-        });
-      }
-    }
+  return makeStore(result.data);
+}
+function loadSecretStoreTolerant(onWarn) {
+  try {
+    return loadSecretStore();
+  } catch (err) {
+    onWarn?.(err instanceof Error ? err.message : String(err));
+    return makeStore({});
   }
-  async function reapGroups(result) {
-    for (const { pgid, child } of groups) {
-      const target = String(pgid);
-      if (process.platform === "win32") {
-        try {
-          if (child.exitCode === null) child.kill();
-          result.unverified.push(target);
-        } catch (err) {
-          result.failures.push({
-            target,
-            error: (err instanceof Error ? err.message : String(err)).slice(0, 200)
-          });
-        }
-        continue;
-      }
-      const first = processGroupMembers(pgid);
-      if (!first.ok) {
-        result.failures.push({
-          target,
-          error: `could not enumerate the process group: ${first.error}`
-        });
-        continue;
-      }
-      if (first.members.length === 0) {
-        result.reaped.push(target);
-        continue;
-      }
-      for (const pid of first.members) {
-        try {
-          process.kill(pid, "SIGTERM");
-        } catch {
-        }
-      }
-      await sleep2(fallbackGraceMs);
-      const afterTerm = processGroupMembers(pgid);
-      if (!afterTerm.ok) {
-        result.failures.push({
-          target,
-          error: `could not re-enumerate the process group after SIGTERM: ${afterTerm.error}`
-        });
-        continue;
-      }
-      for (const pid of afterTerm.members) {
-        try {
-          process.kill(pid, "SIGKILL");
-        } catch {
-        }
-      }
-      const afterKill = processGroupMembers(pgid);
-      if (!afterKill.ok) {
-        result.failures.push({
-          target,
-          error: `could not confirm the process group is empty after SIGKILL: ${afterKill.error}`
-        });
-        continue;
+}
+function makeStore(map) {
+  return {
+    get: (name) => map[name],
+    names: () => Object.keys(map).sort()
+  };
+}
+function requiredSecretNames(mcpServers) {
+  const names = /* @__PURE__ */ new Set();
+  for (const server of Object.values(mcpServers ?? {})) {
+    const bags = [
+      "env" in server ? server.env : void 0,
+      "headers" in server ? server.headers : void 0
+    ];
+    for (const bag of bags) {
+      for (const value of Object.values(bag ?? {})) {
+        for (const [, name] of value.matchAll(PLACEHOLDER_RE)) names.add(name);
       }
-      if (afterKill.members.length)
-        result.failures.push({
-          target,
-          error: `${afterKill.members.length} process(es) still in the group after SIGKILL`
-        });
-      else result.reaped.push(target);
     }
   }
-  return {
-    get kind() {
-      return kind;
-    },
-    spawn(options) {
-      const envKey = managerEnvKey(options.env);
-      if (kind === null || envKey !== probedEnvKey) {
-        kind = probe(options.env) ? "systemd-scope" : "process-group";
-        probedEnvKey = envKey;
-        deps.log?.("containment: resolved strategy for this turn", {
-          kind,
-          platform: process.platform
-        });
-      }
-      return kind === "systemd-scope" ? spawnInScope(options) : spawnInGroup(options);
-    },
-    async reap() {
-      const result = {
-        kind: kind ?? "unused",
-        reaped: [],
-        failures: [],
-        unverified: []
-      };
-      await reapScopes(result);
-      await reapGroups(result);
-      deps.log?.("containment: reap complete", {
-        kind: result.kind,
-        reaped: result.reaped,
-        failures: result.failures
-      });
-      return result;
+  return [...names].sort();
+}
+function resolveMcpSecrets(mcpServers, store) {
+  const missing = /* @__PURE__ */ new Set();
+  const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
+    const resolved = store.get(name);
+    if (resolved === void 0) {
+      missing.add(name);
+      return _match;
     }
+    return resolved;
+  });
+  const mapBag = (bag) => {
+    const out = {};
+    for (const [k, v] of Object.entries(bag)) out[k] = interpolate(v);
+    return out;
   };
+  const servers = {};
+  for (const [name, server] of Object.entries(mcpServers)) {
+    const next = { ...server };
+    if ("env" in next && next.env) next.env = mapBag(next.env);
+    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    servers[name] = next;
+  }
+  return { servers, missing: [...missing].sort() };
+}
+
+// src/transcript-writer.ts
+import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
+import { basename, dirname as dirname6, join as join13 } from "path";
+function transcriptsDir() {
+  return join13(runnerStateDir(), "transcripts");
+}
+var RETAIN = 200;
+var ANOMALY_RETAIN = 50;
+var TranscriptWriter = class {
+  path;
+  broken = false;
+  onWarn;
+  constructor(dir2, meta, onWarn) {
+    this.onWarn = onWarn;
+    this.path = join13(dir2, fileName(meta));
+    try {
+      mkdirSync8(dir2, { recursive: true });
+      try {
+        chmodSync4(dir2, 448);
+      } catch {
+      }
+      pruneOld(dir2, RETAIN);
+    } catch (err) {
+      this.fail(err);
+    }
+    this.line({ type: "_meta", ...meta });
+  }
+  // Append a raw SDK message verbatim.
+  write(msg) {
+    this.line(msg);
+  }
+  // Append the outcome footer.
+  close(outcome) {
+    this.line({ type: "_outcome", ...outcome });
+  }
+  // CT1145: keep an independent copy of an empty successful envelope after the
+  // footer has landed. The ordinary 200-file FIFO keeps rotating as before;
+  // this bucket retains the newest 50 anomalies regardless of ordinary traffic.
+  // Best-effort like every other transcript operation: observability can never
+  // fail the turn.
+  preserveAnomaly() {
+    if (this.broken) return;
+    try {
+      const dir2 = join13(dirname6(this.path), "anomalies");
+      mkdirSync8(dir2, { recursive: true, mode: 448 });
+      chmodSync4(dir2, 448);
+      const target = join13(dir2, basename(this.path));
+      copyFileSync(this.path, target);
+      chmodSync4(target, 384);
+      pruneOld(dir2, ANOMALY_RETAIN);
+    } catch (err) {
+      this.fail(err);
+    }
+  }
+  line(obj) {
+    if (this.broken) return;
+    try {
+      appendFileSync(this.path, JSON.stringify(obj) + "\n", { mode: 384 });
+    } catch (err) {
+      this.fail(err);
+    }
+  }
+  fail(err) {
+    if (this.broken) return;
+    this.broken = true;
+    this.onWarn?.(`transcript write failed (${err instanceof Error ? err.message : String(err)})`);
+  }
+};
+function fileName(meta) {
+  const d = new Date(meta.ts);
+  const stamp = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+  const slug = safe2(meta.workspaceSlug) || "ws";
+  const short = meta.dispatchId.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8) || "turn";
+  return `${stamp}-${slug}-${short}.jsonl`;
+}
+function pad(n) {
+  return String(n).padStart(2, "0");
+}
+function safe2(s) {
+  return s.replace(/[^a-zA-Z0-9_-]/g, "-");
+}
+function pruneOld(dir2, retain) {
+  let files;
+  try {
+    files = readdirSync(dir2).filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return;
+  }
+  if (files.length <= retain) return;
+  const drop = files.sort().slice(0, files.length - retain);
+  for (const f of drop) {
+    try {
+      rmSync6(join13(dir2, f), { force: true });
+    } catch {
+    }
+  }
 }
 
 // src/turn-committer.ts
@@ -9020,6 +9392,7 @@ function missingSecretReason(missing) {
   return `${prefix}+${missing.length}`;
 }
 var RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
+var NO_TURN_TOKEN_REASON = "no_turn_token: the server issued no turn credential for this turn";
 var UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
 var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 15 * 6e4;
@@ -9299,6 +9672,10 @@ var TurnExecution = class {
       const fetchReason = `fetch_failed: ${describeError(err)}`;
       throw this.concluded(fetchReason, fetchReason);
     }
+    if (!turnContext.turnToken) {
+      turnLog.warn({ turnId }, "dispatcher: turn context carried no turn token");
+      throw this.concluded(NO_TURN_TOKEN_REASON, NO_TURN_TOKEN_REASON);
+    }
     this.turnContext = turnContext;
     if (this.resumed) {
       const sources = { serverFloor: turnContext.turnSeqFloor, outboxFloor };
@@ -9346,7 +9723,7 @@ var TurnExecution = class {
     const prepareHook = this.opts.local.prepareHook;
     const cabaneCwd = this.turnContext.cwd;
     let effectiveCwd = localCwd ?? cabaneCwd;
-    if (effectiveCwd && !existsSync10(effectiveCwd)) {
+    if (effectiveCwd && !existsSync9(effectiveCwd)) {
       turnLog.warn(
         { cwd: effectiveCwd },
         "The working directory is missing; using the companion's directory instead. Check this agent's working directory setting."
@@ -9486,7 +9863,9 @@ var TurnExecution = class {
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        bootId,
+        // CT1679: a runner leases under its launcher's boot id — the one the
+        // device heartbeats — or the lost-run sweep reads it as a restart.
+        bootId: this.opts.inRunner?.bootId ?? bootId,
         // CT1380: the durable record that this turn resumed, and from where.
         ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT1454: the issuance the context THIS attempt runs on came from. Read
@@ -9550,10 +9929,8 @@ var TurnExecution = class {
     this.request = buildCompanionTurnRequest({
       turnContext: this.turnContext,
       baseUrl: this.opts.baseUrl,
-      agentPat: this.opts.credential,
-      // CT306: the per-turn OBO credential when the API minted one; falls back to
-      // the companion PAT (`agentPat`) inside `buildCompanionTurnRequest` otherwise.
-      ...this.turnContext.turnToken ? { turnToken: this.turnContext.turnToken } : {},
+      // ACC8: always present; `fetchTurnContext` refused a context without one.
+      turnToken: this.turnContext.turnToken,
       // SJ524: the hook-resolved cwd overrides the static local cwd.
       ...this.effectiveCwd ? { cwd: this.effectiveCwd } : {},
       // CT1103: the prepare-hook env plus the authoritative host-access token.
@@ -9585,10 +9962,14 @@ var TurnExecution = class {
     const { payload, workspaceId, turnId, turnLog } = this;
     await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
     const onWarn = (msg, meta) => turnLog.debug(meta ?? {}, msg);
+    const sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({ cwd: this.effectiveCwd, log: turnLog }) : null;
     const adapters = [];
     if (this.opts.claudeCodeAvailable?.() ?? true) {
       this.containment = createTurnContainment(this.turnId, {
-        log: (msg, meta) => turnLog.debug(meta ?? {}, msg)
+        log: (msg, meta) => turnLog.debug(meta ?? {}, msg),
+        // CT1679: a group outside the runner's own is reported, so a launcher
+        // can stop it if the runner dies without reaping it.
+        ...this.opts.inRunner?.onProcessGroup ? { onProcessGroup: this.opts.inRunner.onProcessGroup } : {}
       });
       const containment = this.containment;
       adapters.push(
@@ -9597,20 +9978,43 @@ var TurnExecution = class {
           onWarn,
           augmentOptions: (options) => ({
             ...options,
-            spawnClaudeCodeProcess: (spawnOptions) => containment.spawn(spawnOptions)
+            spawnClaudeCodeProcess: (spawnOptions) => containment.spawn(
+              sandbox ? { ...spawnOptions, ...sandbox.wrap(spawnOptions.command, spawnOptions.args) } : spawnOptions
+            )
           })
         })
       );
     }
     if (this.opts.opencodeServerUrl) {
-      adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
+      const serverUrl = this.opts.opencodeServerUrl;
+      adapters.push(
+        createOpencodeAdapter(
+          // CT1679: the transport's per-server turn mutex is per process; in a
+          // runner the turn also holds the device-wide lock every runner shares.
+          this.opts.inRunner ? {
+            transport: this.opts.inRunner.opencodeTransport(serverUrl),
+            onWarn
+          } : { serverUrl, onWarn }
+        )
+      );
     }
     if (this.opts.codexAvailable?.() ?? false) {
+      const inRunner = this.opts.inRunner;
+      const codexBinary = sandbox || inRunner ? (this.opts.resolveBundled ?? resolveBundledBinary)("codex").path : null;
+      let codexPath = codexBinary && sandbox ? sandbox.executableFor(codexBinary) : codexBinary;
+      if (codexPath && inRunner) {
+        this.containment ??= createTurnContainment(this.turnId, {
+          log: (msg, meta) => turnLog.debug(meta ?? {}, msg),
+          ...this.opts.inRunner?.onProcessGroup ? { onProcessGroup: this.opts.inRunner.onProcessGroup } : {}
+        });
+        codexPath = inRunner.codexExecutable(codexPath, this.containment);
+      }
       adapters.push(
         createCodexAdapter({
           enabled: true,
           onWarn,
-          writeInstructionsFile: writeCodexInstructionsFile
+          writeInstructionsFile: writeCodexInstructionsFile,
+          ...codexPath ? { transport: createSdkCodexTransport({ codexPathOverride: codexPath }) } : {}
         })
       );
     }
@@ -10065,7 +10469,7 @@ function fingerprintSessionState(state) {
 // src/dispatcher.ts
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
-  if (!existsSync11(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
+  if (!existsSync10(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
   let entries;
   try {
     entries = readdirSync2(cwd);
@@ -10075,15 +10479,15 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join15(cwd, ".git");
-  if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
+  const gitPath = join14(cwd, ".git");
+  if (!existsSync10(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
     stat = statSync2(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync11(join15(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync10(join14(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -10147,6 +10551,24 @@ var Dispatcher = class {
       notifyStart: (info) => this.notifyStart(info),
       notifyEnd: (info) => this.notifyEnd(info)
     };
+    if (this.opts.runner) {
+      return runTurnInRunner(
+        this.opts,
+        this.opts.runner,
+        {
+          registerAbort: supervisor.registerAbort,
+          releaseAbort: supervisor.releaseAbort,
+          sessionWriteNoticeClaimed: () => this.sessionWriteNotified.has(key),
+          markSessionWriteNotice: () => {
+            this.sessionWriteNotified.add(key);
+          },
+          notifyStart: supervisor.notifyStart,
+          notifyEnd: supervisor.notifyEnd
+        },
+        payload,
+        { turnId: opts.turnId ?? randomUUID4(), resumed: opts.resumed === true }
+      );
+    }
     return new TurnExecution(this.opts, supervisor, payload, opts).run();
   }
   // SJ383: cancel a specific (conversation, agent) run if one is in flight in
@@ -10165,6 +10587,176 @@ var Dispatcher = class {
   }
 };
 
+// src/providers/local-process.ts
+import { spawn as spawn6 } from "child_process";
+import { constants } from "os";
+var DEFAULT_KILL_GRACE_MS = 3e4;
+var DEFAULT_REAP_GRACE_MS = 3e3;
+function exitCode(code, signal) {
+  if (code !== null) return code;
+  const signum = signal ? constants.signals[signal] : void 0;
+  return signum !== void 0 ? 128 + signum : 1;
+}
+function createLocalProcessProvider(opts = {}) {
+  const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+  const spawnFn = opts.spawnFn ?? spawn6;
+  const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
+  const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
+  const groupAlive = (pgid) => {
+    try {
+      killFn(-pgid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const signalGroup = (pgid, signal) => {
+    try {
+      killFn(-pgid, signal);
+    } catch {
+    }
+  };
+  return {
+    name: "local-process",
+    async acquire(attempt) {
+      return { provider: "local-process", id: attempt.turnId };
+    },
+    exec(_handle, argv, env, { signal, stdin }) {
+      const [command, ...args] = argv;
+      if (!command) throw new Error("local-process: exec needs a command");
+      const child = spawnFn(command, args, {
+        env: { ...env },
+        stdio: ["pipe", "pipe", "pipe"],
+        detached: process.platform !== "win32"
+      });
+      child.stdin?.on("error", () => {
+      });
+      if (stdin) child.stdin?.write(stdin);
+      const exit = new Promise((resolve2) => {
+        let settled = false;
+        const done = (code) => {
+          if (settled) return;
+          settled = true;
+          signal.removeEventListener("abort", stop);
+          if (forceTimer) clearTimeout(forceTimer);
+          resolve2(code);
+        };
+        let forceTimer;
+        const stop = () => {
+          child.kill("SIGTERM");
+          forceTimer = setTimeout(() => child.kill("SIGKILL"), killGraceMs);
+          forceTimer.unref?.();
+        };
+        child.once("error", () => done(1));
+        child.once("close", (code, sig) => done(exitCode(code, sig)));
+        if (signal.aborted) stop();
+        else signal.addEventListener("abort", stop, { once: true });
+      });
+      if (!child.stdout || !child.stderr || !child.stdin)
+        throw new Error("local-process: runner stdio missing");
+      const pid = child.pid;
+      return {
+        exit,
+        ...pid !== void 0 ? { pid } : {},
+        stdout: child.stdout,
+        stderr: child.stderr,
+        stdin: child.stdin,
+        async reap(groups) {
+          if (process.platform === "win32") return;
+          const targets = [.../* @__PURE__ */ new Set([...pid !== void 0 ? [pid] : [], ...groups])].filter(
+            groupAlive
+          );
+          if (!targets.length) return;
+          for (const pgid of targets) signalGroup(pgid, "SIGTERM");
+          await new Promise((resolve2) => setTimeout(resolve2, reapGraceMs));
+          for (const pgid of targets.filter(groupAlive)) signalGroup(pgid, "SIGKILL");
+        }
+      };
+    },
+    async release() {
+    }
+  };
+}
+
+// src/runner/device-locks.ts
+var DeviceLocks = class {
+  holders = /* @__PURE__ */ new Map();
+  queues = /* @__PURE__ */ new Map();
+  // `owner` is unique across the device; `grant` is called once, when it holds.
+  request(key, owner, grant) {
+    if (!this.holders.has(key)) {
+      this.holders.set(key, owner);
+      grant();
+      return;
+    }
+    const queue = this.queues.get(key) ?? [];
+    queue.push({ owner, grant });
+    this.queues.set(key, queue);
+  }
+  // Gives back what `owner` holds and withdraws what it is waiting for.
+  release(owner) {
+    for (const [key, queue] of this.queues) {
+      const rest = queue.filter((w) => w.owner !== owner);
+      if (rest.length) this.queues.set(key, rest);
+      else this.queues.delete(key);
+    }
+    for (const [key, holder] of [...this.holders]) {
+      if (holder !== owner) continue;
+      this.holders.delete(key);
+      this.handOn(key);
+    }
+  }
+  // What owners starting with `prefix` hold, by key — one runner's, when it
+  // exits, so the launcher can decide which it may give back at once.
+  heldBy(prefix) {
+    return [...this.holders].filter(([, owner]) => owner.startsWith(prefix)).map(([key, owner]) => ({ key, owner }));
+  }
+  // Withdraws every request still waiting from owners starting with `prefix`,
+  // leaving what they hold.
+  withdraw(prefix) {
+    for (const [key, queue] of this.queues) {
+      const rest = queue.filter((w) => !w.owner.startsWith(prefix));
+      if (rest.length) this.queues.set(key, rest);
+      else this.queues.delete(key);
+    }
+  }
+  holder(key) {
+    return this.holders.get(key);
+  }
+  handOn(key) {
+    const queue = this.queues.get(key);
+    const next = queue?.shift();
+    if (!queue?.length) this.queues.delete(key);
+    if (!next) return;
+    this.holders.set(key, next.owner);
+    next.grant();
+  }
+};
+
+// src/runner/harness-sandbox.ts
+import { chmodSync as chmodSync5, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir3, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
+import { join as join15 } from "path";
+import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+function osSandboxUsable(log) {
+  if (!SandboxManager.isSupportedPlatform()) {
+    log.warn(
+      { platform: process.platform },
+      'runners: sandbox "os" is not available on this platform; turns run unsandboxed'
+    );
+    return false;
+  }
+  const deps = SandboxManager.checkDependencies();
+  if (deps.errors.length) {
+    log.warn(
+      { errors: deps.errors },
+      'runners: sandbox "os" is missing what it needs on this host; turns run unsandboxed'
+    );
+    return false;
+  }
+  return true;
+}
+
 // src/opencode-models.ts
 var OPENCODE_RUNTIME = "opencode";
 function mapOpencodeProviders(json) {
@@ -10243,12 +10835,12 @@ var DispatchClaims = class {
 
 // src/outbox.ts
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync8,
   renameSync as renameSync4,
-  rmSync as rmSync7,
+  rmSync as rmSync8,
   writeFileSync as writeFileSync7
 } from "fs";
 import { join as join16 } from "path";
@@ -10264,7 +10856,7 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join16(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join16(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
     return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
@@ -10282,7 +10874,7 @@ var Outbox = class {
       renameSync4(tmp, target);
     } catch (err) {
       try {
-        rmSync7(tmp, { force: true });
+        rmSync8(tmp, { force: true });
       } catch {
       }
       this.log?.warn(
@@ -10299,7 +10891,7 @@ var Outbox = class {
   // wedging the drain.
   list() {
     const dir2 = this.dir();
-    if (!existsSync12(dir2)) return [];
+    if (!existsSync11(dir2)) return [];
     let names;
     try {
       names = readdirSync3(dir2);
@@ -10311,7 +10903,7 @@ var Outbox = class {
       if (!name.endsWith(".json")) continue;
       const full = join16(dir2, name);
       try {
-        const parsed = JSON.parse(readFileSync9(full, "utf8"));
+        const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
           entries.push(parsed);
         } else {
@@ -10345,7 +10937,7 @@ var Outbox = class {
   // different: it is positive evidence that nothing was ever queued here.
   maxSeqForTurn(turnId) {
     const dir2 = this.dir();
-    if (!existsSync12(dir2)) return 0;
+    if (!existsSync11(dir2)) return 0;
     const names = readdirSync3(dir2);
     const prefix = `${encodeURIComponent(turnId)}__`;
     let max = 0;
@@ -10359,13 +10951,13 @@ var Outbox = class {
   // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
   remove(turnId, seq) {
     try {
-      rmSync7(this.fileFor(turnId, seq), { force: true });
+      rmSync8(this.fileFor(turnId, seq), { force: true });
     } catch {
     }
   }
   size() {
     const dir2 = this.dir();
-    if (!existsSync12(dir2)) return 0;
+    if (!existsSync11(dir2)) return 0;
     try {
       return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
@@ -10378,7 +10970,7 @@ var Outbox = class {
       "A saved update is unreadable and couldn't be delivered. Check the conversation for missing replies."
     );
     try {
-      rmSync7(full, { force: true });
+      rmSync8(full, { force: true });
     } catch {
     }
   }
@@ -10412,53 +11004,6 @@ var Outbox = class {
   }
 };
 
-// src/run-config.ts
-import { z as z15 } from "zod";
-var mcpStdioServerSchema = z15.object({
-  type: z15.literal("stdio").optional(),
-  command: z15.string().min(1),
-  args: z15.array(z15.string()).optional(),
-  env: z15.record(z15.string(), z15.string()).optional()
-});
-var mcpHttpServerSchema = z15.object({
-  type: z15.literal("http"),
-  url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
-});
-var mcpSseServerSchema = z15.object({
-  type: z15.literal("sse"),
-  url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
-});
-var mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-var thinkingConfigSchema = z15.discriminatedUnion("type", [
-  z15.object({ type: z15.literal("adaptive") }),
-  z15.object({ type: z15.literal("enabled"), budgetTokens: z15.number().int().positive().optional() }),
-  z15.object({ type: z15.literal("disabled") })
-]);
-var effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
-var runConfigSchema = z15.object({
-  // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
-  // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
-  // is the locked surface. Kept in lockstep with `@cabane/shared`'s
-  // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
-  // stripped, so an older companion riding a newer server never rejects the config).
-  hostAccess: z15.boolean().optional(),
-  mcpServers: z15.record(z15.string(), mcpServerDefSchema).optional(),
-  model: z15.string().min(1).optional(),
-  thinking: thinkingConfigSchema.optional(),
-  effort: effortSchema.optional()
-});
-var EMPTY_RUN_CONFIG = {};
-function parseRunConfig(raw, onWarn) {
-  const result = runConfigSchema.safeParse(raw ?? {});
-  if (result.success) return result.data;
-  onWarn?.(
-    `run-config from Cabane didn't parse (${result.error.issues.map((i) => i.path.join(".") || "(root)").join(", ")}) \u2014 falling back to the locked assistant default`
-  );
-  return EMPTY_RUN_CONFIG;
-}
-
 // src/sse.ts
 import { createParser } from "eventsource-parser";
 var MAX_BACKOFF_MS = 3e4;
@@ -10519,7 +11064,7 @@ var SseSubscriber = class {
   }
   async connect() {
     const base = this.opts.baseUrl.endsWith("/") ? this.opts.baseUrl.slice(0, -1) : this.opts.baseUrl;
-    const url = this.opts.path ? `${base}${this.opts.path}` : `${base}/api/workspaces/${this.opts.workspaceId}/events`;
+    const url = `${base}${this.opts.path}`;
     this.controller = new AbortController();
     const headers = {
       Authorization: `Bearer ${this.opts.token}`,
@@ -10623,9 +11168,14 @@ var CompanionSupervisor = class {
   exitFn;
   reexecFn;
   dispatcherFactory;
+  runnerCommand;
+  providerForRunners;
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
+  // ACC8: whether the device stream is open, which is what every workspace's
+  // link on the dashboard reports.
+  deviceConnected = false;
   recoveryChecked = false;
   recovering = false;
   heartbeated = false;
@@ -10664,6 +11214,8 @@ var CompanionSupervisor = class {
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
     this.dispatcherFactory = opts.dispatcherFactory;
+    if (opts.runnerCommand) this.runnerCommand = opts.runnerCommand;
+    if (opts.runnerProvider) this.providerForRunners = opts.runnerProvider;
     this.unrunnableRetryDelaysMs = opts.unrunnableRetryDelaysMs ?? DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS;
     this.latchBootBundledState();
   }
@@ -10692,7 +11244,18 @@ var CompanionSupervisor = class {
       token: this.config.deviceToken,
       log: this.log,
       lastEventId: null,
-      onOpen: () => this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`),
+      onOpen: () => {
+        this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`);
+        this.deviceConnected = true;
+        for (const wr of this.workspaces.values()) {
+          this.hub.setConnected(wr.workspaceId, true);
+          for (const a of wr.agents.values()) a.kickDrain();
+        }
+      },
+      onClose: () => {
+        this.deviceConnected = false;
+        for (const wr of this.workspaces.values()) this.hub.setConnected(wr.workspaceId, false);
+      },
       onMessage: async (ev) => {
         if (ev.event === "assignments_changed") {
           if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
@@ -10724,10 +11287,7 @@ var CompanionSupervisor = class {
   // at least the loops keeping the event loop alive; the SSE promises let a
   // clean teardown resolve.
   finishedPromises() {
-    return [
-      ...this.deviceSub ? [this.deviceSub.finished] : [],
-      ...[...this.workspaces.values()].flatMap((w) => w.sub ? [w.sub.finished] : [])
-    ];
+    return [...this.deviceSub ? [this.deviceSub.finished] : []];
   }
   // ---- device-level loops ----
   kickHeartbeat() {
@@ -10875,11 +11435,8 @@ var CompanionSupervisor = class {
         workspaceId,
         slug: first.workspaceSlug,
         name: first.workspaceName,
-        sub: null,
-        sseAgentId: null,
         agents: /* @__PURE__ */ new Map(),
-        chains: /* @__PURE__ */ new Map(),
-        cursor: new CursorTracker(workspaceId)
+        chains: /* @__PURE__ */ new Map()
       };
       this.workspaces.set(workspaceId, wr);
       this.hub.registerWorkspace({
@@ -10887,6 +11444,7 @@ var CompanionSupervisor = class {
         slug: first.workspaceSlug,
         name: first.workspaceName
       });
+      this.hub.setConnected(workspaceId, this.deviceConnected);
     }
     const store = loadSecretStoreTolerant();
     const exposed = new Set(store.names());
@@ -10946,7 +11504,7 @@ var CompanionSupervisor = class {
         );
       }
     }
-    this.ensureWorkspaceSse(wr);
+    if (wr.agents.size === 0) void this.removeWorkspace(wr.workspaceId);
   }
   addAgent(wr, it, credential, runConfig) {
     const agentLog = this.log.child({ agentName: it.agentDisplayName });
@@ -11103,6 +11661,21 @@ var CompanionSupervisor = class {
       );
     }
   }
+  // CT1679: the locks every runner on this device shares, held here.
+  runnerLocks = new DeviceLocks();
+  // CT1679: `runners.sandbox`, checked against this host once. A host that
+  // can't make the sandbox says so once and runs its turns unwrapped.
+  sandboxUsable;
+  runnerSandbox() {
+    if (this.config.runners?.sandbox !== "os") return "none";
+    this.sandboxUsable ??= osSandboxUsable(this.log);
+    return this.sandboxUsable ? "os" : "none";
+  }
+  // CT1679: one provider for the device, built on first use.
+  runnerProvider() {
+    this.providerForRunners ??= createLocalProcessProvider();
+    return this.providerForRunners;
+  }
   buildDispatcher(ctx) {
     const local = localAgentConfig(this.config, {
       agentId: ctx.agentId,
@@ -11153,74 +11726,31 @@ var CompanionSupervisor = class {
       observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
       transcriptDir: transcriptsDir(),
       // CT566: the shared connector-health memory the turn records into on settle.
-      connectorHealth: this.connectorHealth
-    });
-  }
-  // Stand up (or re-point) the workspace's single shared SSE subscription. It is
-  // authed with one assigned agent's PAT; if that agent is unassigned, re-pick
-  // another. With no agents left the workspace runner is torn down.
-  ensureWorkspaceSse(wr) {
-    if (wr.agents.size === 0) {
-      void this.removeWorkspace(wr.workspaceId);
-      return;
-    }
-    if (wr.sub && wr.sseAgentId && wr.agents.has(wr.sseAgentId)) return;
-    const sseAgent = wr.agents.get(wr.sseAgentId ?? "") ?? [...wr.agents.values()][0];
-    if (wr.sub) wr.sub.stop();
-    wr.sseAgentId = sseAgent.agentId;
-    wr.sub = new SseSubscriber({
-      baseUrl: this.config.baseUrl,
-      workspaceId: wr.workspaceId,
-      token: sseAgent.credential,
-      log: this.log,
-      lastEventId: readCursor(wr.workspaceId),
-      onOpen: () => {
-        this.hub.setConnected(wr.workspaceId, true);
-        for (const a of wr.agents.values()) a.kickDrain();
-      },
-      onClose: () => this.hub.setConnected(wr.workspaceId, false),
-      onMessage: (ev) => this.handleWorkspaceMessage(wr, ev),
-      onAuthFailure: (status) => {
-        this.hub.setAuthFailed(wr.workspaceId);
-        this.log.debug(
-          { workspaceId: wr.workspaceId, status, sseAgentId: wr.sseAgentId },
-          "companion: workspace stream auth failed \u2014 re-pulling assignments"
-        );
-        wr.sseAgentId = null;
-        void this.refreshAssignments();
-      }
+      connectorHealth: this.connectorHealth,
+      ...runnersEnabled(this.config) ? {
+        runner: {
+          provider: this.runnerProvider(),
+          command: this.runnerCommand ?? selfRunnerCommand(),
+          ...this.config.deviceToken ? { deviceToken: this.config.deviceToken } : {},
+          connectorHealth: this.connectorHealth,
+          locks: this.runnerLocks,
+          sandbox: this.runnerSandbox()
+        }
+      } : {}
     });
-    wr.sub.start();
-    this.log.debug({ workspaceId: wr.workspaceId }, "companion: subscribed");
   }
   async removeWorkspace(workspaceId) {
     const wr = this.workspaces.get(workspaceId);
     if (!wr) return;
     for (const agentId of [...wr.agents.keys()]) this.removeAgent(wr, agentId);
-    if (wr.sub) {
-      wr.sub.stop();
-      await wr.sub.finished;
-    }
     this.workspaces.delete(workspaceId);
     this.hub.removeWorkspace(workspaceId);
   }
   // ---- SSE event routing (per workspace, BY agentId) ----
-  // Fire-and-forget per event (the subscriber doesn't await us). Cancel events
-  // route to the matching agent immediately; dispatch events serialize per
-  // (conversation, agent); everything else just advances the cursor.
-  async handleWorkspaceMessage(wr, ev) {
-    if (ev.event !== "message") return;
-    this.hub.recordEvent(wr.workspaceId);
-    const wire = this.parseFrame(ev);
-    if (!wire) return;
-    if (ev.id) wr.cursor.observe(ev.id);
-    await this.deliverFrame(wr, ev.id, wire);
-  }
   // ACC10: the device stream's frames — dispatch and cancel, addressed to this
-  // device and authenticated as it. Same frames and the same routing as above;
-  // what differs is that this stream keeps no cursor (it replays what is still
-  // offered on every connect instead of resuming from a `Last-Event-ID`), so
-  // nothing here observes or settles one.
+  // device and authenticated as it. ACC8: the only stream this companion opens.
+  // It keeps no cursor: it replays what is still offered on every connect
+  // instead of resuming from a `Last-Event-ID`.
   async handleDeviceMessage(ev) {
     const wire = this.parseFrame(ev);
     if (!wire) return;
@@ -11243,7 +11773,7 @@ var CompanionSupervisor = class {
       }
     }
     this.hub.recordEvent(wr.workspaceId);
-    await this.deliverFrame(wr, "", wire);
+    await this.deliverFrame(wr, wire);
   }
   parseFrame(ev) {
     try {
@@ -11256,30 +11786,27 @@ var CompanionSupervisor = class {
       return null;
     }
   }
-  // ACC10: the dedupe gate, and the only place that exists because there are two
-  // streams. Both carry the same frame with the same dispatch id; the first copy
-  // to arrive runs the turn, and the second waits for it and then settles its own
-  // stream's cursor. Settling a duplicate earlier than that would advance the
-  // low-water mark past an in-flight turn, which is exactly the CT282 bug.
+  // ACC10: the dedupe gate. A reconnect replays every dispatch still offered,
+  // including one whose turn is already running here; the first copy runs the
+  // turn and a later one waits for it and then does nothing.
   //
   // A cancel needs no gate: `dispatcher.cancel` on an already-aborted run is a
   // no-op that reports `false`, so a second copy is inert.
-  async deliverFrame(wr, cursorId, wire) {
+  async deliverFrame(wr, wire) {
     const claim = wire.type === "device:dispatch_requested" && wire.id ? this.claims.claim(wire.id) : null;
     if (claim && !claim.first) {
       await claim.done;
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     try {
-      await this.routeFrame(wr, cursorId, wire);
+      await this.routeFrame(wr, wire);
     } finally {
       if (claim) this.claims.release(wire.id);
     }
   }
   // Everything below here is the routing as it was: it takes a frame and knows
   // nothing about which stream carried it.
-  async routeFrame(wr, cursorId, wire) {
+  async routeFrame(wr, wire) {
     if (wire.type === "device:cancel_requested") {
       const payload2 = {
         type: "device:cancel_requested",
@@ -11299,12 +11826,10 @@ var CompanionSupervisor = class {
           );
         }
       }
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     const payload = dispatchPayload(wire);
     if (!payload) {
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
@@ -11317,7 +11842,6 @@ var CompanionSupervisor = class {
         },
         "companion: dispatch addressed to another device; ignoring"
       );
-      if (cursorId) wr.cursor.settle(cursorId);
       return;
     }
     let agent = wr.agents.get(payload.agentId);
@@ -11325,16 +11849,14 @@ var CompanionSupervisor = class {
       agent = await this.recoverRacedAgent(wr, payload);
       if (!agent) {
         if (this.deviceId && payload.deviceId === this.deviceId) {
-          const reported = await this.reportUnrunnableDispatch(wr.workspaceId, payload);
-          if (!reported) return;
+          await this.reportUnrunnableDispatch(wr.workspaceId, payload);
         }
-        if (cursorId) wr.cursor.settle(cursorId);
         return;
       }
     }
     const chainKey = `${payload.conversationId}|${payload.agentId}`;
     const prev = wr.chains.get(chainKey) ?? Promise.resolve();
-    const tail = prev.then(() => this.runDispatch(wr, { dispatchId: wire.id, cursorId }, payload, agent)).catch((err) => {
+    const tail = prev.then(() => this.runDispatch(wr, wire.id, payload, agent)).catch((err) => {
       this.log.warn(
         {
           workspaceId: wr.workspaceId,
@@ -11351,8 +11873,7 @@ var CompanionSupervisor = class {
   }
   // CT1146: tell the server this device cannot run a dispatch it was addressed to.
   //
-  // Returns whether the report LANDED, because that answer decides whether the
-  // caller may settle the cursor. The server checks the recorded dispatch
+  // Returns whether the report LANDED. The server checks the recorded dispatch
   // destination even if the agent's assignment has moved. Reporting promptly
   // explains the roster miss; the thirty-minute unanswered-offer deadline is
   // only the backstop when no report lands.
@@ -11446,10 +11967,10 @@ var CompanionSupervisor = class {
         };
         const tail = this.runDispatch(
           wr,
-          // No frame delivered this one — it came off `/runs` — so there is
-          // neither a dispatch id to dedupe on nor a cursor to settle. The
-          // `recoveredTurns` set above is this path's own guard.
-          { dispatchId: "", cursorId: "" },
+          // No frame delivered this one — it came off `/runs` — so there is no
+          // dispatch id to dedupe on. The `recoveredTurns` set above is this
+          // path's own guard.
+          "",
           payload,
           agent,
           run.turnId
@@ -11471,61 +11992,55 @@ var CompanionSupervisor = class {
     }
   }
   // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
-  // cursor + console summary. Mirrors the old per-workspace `handleEvent`, now
+  // the console summary. Mirrors the old per-workspace `handleEvent`, now
   // scoped to one agent.
-  async runDispatch(wr, ids, payload, agent, recoveredTurnId) {
+  async runDispatch(wr, dispatchId, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
-    const settleCursor = () => {
-      if (ids.cursorId) wr.cursor.settle(ids.cursorId);
-    };
-    if (ids.dispatchId && hasDispatched(workspaceId, ids.dispatchId)) {
-      if (hasCompleted(workspaceId, ids.dispatchId)) {
+    if (dispatchId && hasDispatched(workspaceId, dispatchId)) {
+      if (hasCompleted(workspaceId, dispatchId)) {
         this.log.debug(
-          { workspaceId, eventId: ids.dispatchId },
+          { workspaceId, eventId: dispatchId },
           "companion: skipping already-completed event (resume after restart)"
         );
-        settleCursor();
         return;
       }
       if (noResume()) {
         this.log.debug(
-          { workspaceId, eventId: ids.dispatchId },
+          { workspaceId, eventId: dispatchId },
           "companion: skipping interrupted turn (CABANE_COMPANION_NO_RESUME=1) \u2014 resume disabled for this boot"
         );
-        markCompleted(workspaceId, ids.dispatchId);
-        settleCursor();
+        markCompleted(workspaceId, dispatchId);
         return;
       }
-      const attempt = bumpResumeAttempt(workspaceId, ids.dispatchId);
+      const attempt = bumpResumeAttempt(workspaceId, dispatchId);
       if (attempt > MAX_RESUME_ATTEMPTS) {
         this.log.error(
-          { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
+          { workspaceId, eventId: dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
           "An interrupted turn couldn't finish after several attempts. Reply in Cabane to try again."
         );
-        markCompleted(workspaceId, ids.dispatchId);
-        settleCursor();
+        markCompleted(workspaceId, dispatchId);
         return;
       }
       this.log.debug(
-        { workspaceId, eventId: ids.dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
+        { workspaceId, eventId: dispatchId, attempt, cap: MAX_RESUME_ATTEMPTS },
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    const resumedTurnId = recoveredTurnId ?? (ids.dispatchId ? turnIdForEvent(workspaceId, ids.dispatchId) : null);
-    const turnId = resumedTurnId ?? randomUUID4();
-    if (ids.dispatchId) {
-      const liveTurnIds = rememberTurnId(workspaceId, ids.dispatchId, turnId);
+    const resumedTurnId = recoveredTurnId ?? (dispatchId ? turnIdForEvent(workspaceId, dispatchId) : null);
+    const turnId = resumedTurnId ?? randomUUID5();
+    if (dispatchId) {
+      const liveTurnIds = rememberTurnId(workspaceId, dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
         this.log.debug(
           { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
           "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
         );
       }
-      markDispatched(workspaceId, ids.dispatchId);
+      markDispatched(workspaceId, dispatchId);
     }
     if (resumedTurnId) {
       this.log.debug(
-        { workspaceId, eventId: ids.dispatchId, turnId },
+        { workspaceId, eventId: dispatchId, turnId },
         "companion: resuming an interrupted turn under its original id"
       );
     }
@@ -11540,8 +12055,7 @@ var CompanionSupervisor = class {
       turnId,
       resumed: resumedTurnId !== null
     });
-    if (ids.dispatchId) markCompleted(workspaceId, ids.dispatchId);
-    settleCursor();
+    if (dispatchId) markCompleted(workspaceId, dispatchId);
     const durationS = (result.durationMs / 1e3).toFixed(1);
     const bindings = {
       ...turnBindings,
@@ -11790,12 +12304,10 @@ var CompanionSupervisor = class {
     this.deviceSub?.stop();
     for (const wr of this.workspaces.values()) {
       for (const a of wr.agents.values()) a.cancelDrain();
-      if (wr.sub) wr.sub.stop();
     }
     await Promise.all([
       ...heartbeat ? [waitForBoundedHeartbeat(heartbeat)] : [],
-      ...this.deviceSub ? [this.deviceSub.finished] : [],
-      ...[...this.workspaces.values()].flatMap((wr) => wr.sub ? [wr.sub.finished] : [])
+      ...this.deviceSub ? [this.deviceSub.finished] : []
     ]);
   }
   async requestStop() {
@@ -11820,9 +12332,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn6 }) => {
+  void import("child_process").then(({ spawn: spawn7 }) => {
     try {
-      const child = spawn6(process.execPath, process.argv.slice(1), {
+      const child = spawn7(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -11892,7 +12404,7 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync10, rmSync as rmSync8, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync9, writeFileSync as writeFileSync8 } from "fs";
 import { join as join17 } from "path";
 function crashMarkerPath() {
   return join17(cabaneDir(), "last-error.json");
@@ -11907,7 +12419,7 @@ function recordCrash(rec) {
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync13(path)) rmSync8(path, { force: true });
+    if (existsSync12(path)) rmSync9(path, { force: true });
   } catch {
   }
 }
@@ -11950,7 +12462,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID5();
+  const instanceId = randomUUID6();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();