@cabane/companion 0.6.121 → 0.6.122

package/dist/runtime.js

@@ -1,5 +1,5 @@
 // src/runtime.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/config.ts
 import {
@@ -352,8 +352,24 @@ var companionConfigSchema = z2.object({
   // half-installed platform package could not start.
   codex: z2.object({
     enabled: z2.boolean().optional()
+  }).strict().optional(),
+  // CT1679: run each turn in a child runner process instead of in this one.
+  // Absent, or `enabled: false`, is the in-process path, untouched. `sandbox`
+  // wraps the runner in an OS sandbox where the host supports one; `'none'`
+  // (the default) runs it as a plain child beside this process, a supported
+  // configuration in its own right rather than a degraded one.
+  runners: z2.object({
+    enabled: z2.boolean().optional(),
+    provider: z2.literal("local-process").optional(),
+    sandbox: z2.enum(["os", "none"]).optional()
   }).strict().optional()
 });
+function runnersEnabled(cfg) {
+  return cfg.runners?.enabled === true;
+}
+function runnerStateDir() {
+  return process.env.CABANE_RUNNER_STATE_DIR || cabaneDir();
+}
 function isCodexEnabled(cfg) {
   return !!cfg.codex && cfg.codex.enabled !== false;
 }
@@ -1462,8 +1478,8 @@ function registerRoutes(app, deps) {
     return c.json({ dispatches: hub.recentDispatches(limit).map(dispatchToWire) });
   });
   app.get("/api/logs", async (c) => {
-    const lines = clampLimit(c.req.query("lines"), 200, 1e3);
-    return c.json({ lines: tailFile(companionLogPath(), lines) });
+    const lines2 = clampLimit(c.req.query("lines"), 200, 1e3);
+    return c.json({ lines: tailFile(companionLogPath(), lines2) });
   });
   app.post("/api/settings", async (c) => {
     const body = await readJson(c);
@@ -1582,7 +1598,7 @@ function clampLimit(raw, fallback, max = 200) {
   if (!Number.isFinite(n) || n <= 0) return fallback;
   return Math.min(Math.floor(n), max);
 }
-function tailFile(path, lines) {
+function tailFile(path, lines2) {
   if (!existsSync2(path)) return [];
   const MAX_BYTES = 256 * 1024;
   let fd;
@@ -1597,7 +1613,7 @@ function tailFile(path, lines) {
     const text = buf.toString("utf8");
     const all = text.split("\n");
     if (start > 0 && all.length > 0) all.shift();
-    return all.filter((l) => l.length > 0).slice(-lines);
+    return all.filter((l) => l.length > 0).slice(-lines2);
   } catch {
     return [];
   } finally {
@@ -2278,7 +2294,7 @@ import { randomUUID } from "crypto";
 var bootId = randomUUID();
 
 // src/supervisor.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // src/api.ts
 var DEVICE_HEADER = "x-cabane-device";
@@ -7811,258 +7827,990 @@ var ConnectorHealthStore = class {
 };
 
 // src/dispatcher.ts
+import { randomUUID as randomUUID4 } from "crypto";
 import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
 import { join as join14 } from "path";
 
-// src/term.ts
+// src/runner/launch.ts
 import { createInterface } from "readline";
-import { homedir as homedir2 } from "os";
-import pc from "picocolors";
-function tildePath(path) {
-  const home = homedir2();
-  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
-  return path;
-}
-
-// src/turn-execution.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync9 } from "fs";
 
-// src/turn-control-tools.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { z as z13 } from "zod";
-var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
-var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
-var SKIP_TURN_TOOL = "skip_turn";
-var ASK_TOOL = "ask";
-var ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${ASK_TOOL}`;
-var WITHDRAW_ASK_TOOL = "withdraw_ask";
-var WITHDRAW_ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WITHDRAW_ASK_TOOL}`;
-var WAKE_ME_TOOL = "wake_me";
-var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
-var CANCEL_WAKE_TOOL = "cancel_wake";
-var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
-var TURN_ACT_TIMEOUT_MS = 45e3;
-function createSkipState() {
-  return { skipped: false, reason: null };
+// src/runner/opencode-lock.ts
+function opencodeLockKey(serverUrl) {
+  return `opencode:${serverUrl}`;
 }
-function toolError(text) {
-  return { isError: true, content: [{ type: "text", text }] };
-}
-async function performAct(acts, act) {
-  let result;
+async function stopRemoteOpencodeSession(serverUrl, sessionId, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const base = serverUrl.replace(/\/+$/, "");
+  const id = encodeURIComponent(sessionId);
   try {
-    result = await acts.api.turnAct(
-      acts.workspaceId,
-      acts.turnId,
-      act,
-      AbortSignal.timeout(TURN_ACT_TIMEOUT_MS)
-    );
-  } catch (err) {
-    if (err instanceof ApiError && err.status >= 500) {
-      return uncertainOutcome(`${err.status}: ${apiErrorMessage(err)}`);
-    }
-    if (err instanceof ApiError) {
-      if (err.status === 409 && apiErrorCode(err) === "no_active_turn") {
-        return toolError(
-          "No active turn: this turn has already settled, so the act was not performed."
-        );
+    await doFetch(`${base}/session/${id}/abort`, {
+      method: "POST",
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+  const attempts = opts.attempts ?? 20;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await doFetch(`${base}/session/status`, { signal: AbortSignal.timeout(5e3) });
+      if (res.ok) {
+        const status = await res.json();
+        const state = status[sessionId];
+        if (!state || state.type === "idle") return true;
       }
-      return toolError(`The act was refused (${err.status}): ${apiErrorMessage(err)}`);
+    } catch {
     }
-    return uncertainOutcome(err instanceof Error ? err.message : String(err));
+    await new Promise((resolve2) => setTimeout(resolve2, opts.pollMs ?? 500));
   }
-  if (!result.ok) return toolError(JSON.stringify(result));
-  return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  return false;
 }
-function uncertainOutcome(cause) {
-  return toolError(
-    `The outcome of this act could not be confirmed (${cause}). It may already have been performed, with only the response lost. Do NOT simply repeat the call: a repeat is a second, separate act, not a retry. Carry on, and say in your reply that you could not confirm it.`
-  );
+
+// src/turn-containment.ts
+import { execFile, execFileSync, spawn as spawn4 } from "child_process";
+import { readFileSync as readFileSync5 } from "fs";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var asContained = (child) => child;
+var CONTAINMENT_STOP_GRACE_SEC = 5;
+var FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
+var CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
+function turnScopeUnit(turnId, attempt) {
+  const safe3 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
+  return `cabane-turn-${safe3}-${attempt}`;
 }
-function createTurnControlMcpServer(acts, skipState) {
-  const ACT_TOOL = { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
-  const CANCEL_TOOL = { ...ACT_TOOL, idempotentHint: true };
-  const RECORDER_TOOL = { readOnlyHint: true, openWorldHint: false };
-  return createSdkMcpServer({
-    name: COMPANION_LOCAL_MCP_SERVER,
-    version: "0.0.0",
-    tools: [
-      ...skipState ? [
-        tool(
-          SKIP_TURN_TOOL,
-          TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
-          {
-            reason: z13.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
-          },
-          async (args) => {
-            skipState.skipped = true;
-            skipState.reason = args.reason;
-            return {
-              content: [{ type: "text", text: JSON.stringify({ skipped: true }) }]
-            };
-          },
-          { annotations: RECORDER_TOOL, alwaysLoad: true }
-        )
-      ] : [],
-      tool(
-        ASK_TOOL,
-        TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
-        {
-          targetUserId: z13.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z13.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z13.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z13.array(
-            z13.union([
-              z13.string().min(1).max(MAX_ASK_OPTION_BYTES),
-              z13.object({
-                label: z13.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
-                move: z13.object({
-                  task: z13.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
-                  status: z13.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
-                }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
-              })
-            ])
-          ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z13.array(
-            z13.object({
-              headline: z13.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z13.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z13.array(
-                z13.union([
-                  z13.string().min(1).max(MAX_ASK_OPTION_BYTES),
-                  z13.object({
-                    label: z13.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
-                    move: z13.object({
-                      task: z13.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
-                      status: z13.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
-                    }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
-                  })
-                ])
-              ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
-            })
-          ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z13.object({
-            askId: z13.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z13.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
-          }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
-        },
-        async (args) => {
-          const hasSingle = args.question !== void 0;
-          const hasArray = args.questions !== void 0 && args.questions.length > 0;
-          if (hasSingle && hasArray) {
-            return toolError(
-              "Provide either `question` (single) or `questions` (array), not both."
-            );
-          }
-          if (!hasSingle && !hasArray) {
-            return toolError("Provide `question` (single) or `questions` (array).");
-          }
-          return performAct(acts, {
-            kind: "ask",
-            callId: randomUUID2(),
-            // CT1350: the swap rides the ask, so the server commits both halves
-            // in one transaction — the person never sees neither or both.
-            ...args.replaces ? { replaces: args.replaces } : {},
-            ask: hasArray ? {
-              targetUserId: args.targetUserId,
-              questions: args.questions.map((q) => ({
-                headline: q.headline,
-                ...q.body ? { body: q.body } : {},
-                ...q.options && q.options.length > 0 ? { options: q.options } : {}
-              }))
-            } : {
-              targetUserId: args.targetUserId,
-              question: args.question,
-              ...args.headline ? { headline: args.headline } : {},
-              ...args.options && args.options.length > 0 ? { options: args.options } : {}
-            }
-          });
-        },
-        { annotations: ACT_TOOL, alwaysLoad: true }
-      ),
-      tool(
-        WAKE_ME_TOOL,
-        TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
-        {
-          afterSeconds: z13.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z13.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z13.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
-        },
-        async (args) => {
-          const hasAfter = args.afterSeconds !== void 0;
-          const hasAt = args.at !== void 0;
-          if (hasAfter && hasAt) {
-            return toolError(
-              "Provide either `afterSeconds` (relative) or `at` (absolute), not both."
-            );
-          }
-          if (!hasAfter && !hasAt) {
-            return toolError("Provide `afterSeconds` or `at`.");
-          }
-          return performAct(acts, {
-            kind: "wake",
-            callId: randomUUID2(),
-            wake: {
-              ...hasAfter ? { afterSeconds: args.afterSeconds } : {},
-              ...hasAt ? { at: args.at } : {},
-              note: args.note
-            }
-          });
-        },
-        { annotations: ACT_TOOL, alwaysLoad: true }
-      ),
-      // CT1350: the standalone withdrawal. Not annotated destructive — an ask
-      // is a question, not data, and a harness that gated this on a live
-      // operator would hang a turn nobody is watching (the `cancel_wake`
-      // reasoning). Not idempotent either: a second call with the same id is
-      // refused with `ask_not_open`, which is information, not a no-op.
-      tool(
-        WITHDRAW_ASK_TOOL,
-        TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
-        {
-          askId: z13.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z13.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
-        },
-        async (args) => performAct(acts, {
-          kind: "withdraw_ask",
-          callId: randomUUID2(),
-          withdraw: { askId: args.askId, reason: args.reason }
-        }),
-        { annotations: ACT_TOOL, alwaysLoad: true }
-      ),
-      // CT990: the inverse. No arguments — it can only ever stand down the
-      // caller's own wake in the conversation it's holding a turn in.
-      tool(
-        CANCEL_WAKE_TOOL,
-        TURN_CONTROL_TOOL_DESCRIPTIONS.cancel_wake,
-        {},
-        async () => performAct(acts, { kind: "cancel_wake", callId: randomUUID2() }),
-        { annotations: CANCEL_TOOL, alwaysLoad: true }
-      )
-    ]
-  });
+async function reapTurnScopes(turnId) {
+  if (process.platform !== "linux") return { failures: [] };
+  const pattern = `${turnScopeUnit(turnId, 0).replace(/-0$/, "")}-*.scope`;
+  try {
+    await execFileAsync("systemctl", ["--user", "stop", pattern], {
+      timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
+    });
+    return { failures: [] };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return classifyStopError(message) === "absent" ? { failures: [] } : { failures: [message.slice(0, 200)] };
+  }
 }
-
-// src/build-options.ts
-function cabaneMcpUrl(baseUrl) {
-  return `${trimSlash2(baseUrl)}/api/mcp`;
+function scopeCapabilityUsable(env, timeoutMs = CAPABILITY_PROBE_TIMEOUT_MS) {
+  if (process.platform !== "linux") return false;
+  try {
+    execFileSync("systemd-run", ["--user", "--scope", "--quiet", "--collect", "--", "/bin/true"], {
+      env,
+      timeout: timeoutMs,
+      stdio: "ignore"
+    });
+    return true;
+  } catch {
+    return false;
+  }
 }
-function turnControlMcpUrl(baseUrl) {
-  return `${trimSlash2(baseUrl)}/api/turn-control`;
+function classifyStopError(message) {
+  if (/failed to connect to bus|failed to get d-?bus connection|connection refused|refusing to operate|spawn systemctl|systemctl.*ENOENT|ENOENT.*systemctl/i.test(
+    message
+  )) {
+    return "failure";
+  }
+  if (/not loaded|could not be found|no such unit|unit .* not found/i.test(message))
+    return "absent";
+  return "failure";
 }
-function buildCompanionTurnRequest(params) {
-  const { turnContext: t } = params;
-  return {
-    systemPrompt: t.systemPrompt,
-    prompt: t.prompt,
-    content: t.content,
-    config: t.config,
-    policy: t.policy,
-    session: t.session,
-    cabane: {
-      mcpUrl: cabaneMcpUrl(params.baseUrl),
-      bearer: params.turnToken,
+function currentSystemdUnit(cgroupText) {
+  for (const line of cgroupText.split("\n")) {
+    const path = line.trim().split(":").pop();
+    if (!path?.startsWith("/")) continue;
+    const leaf = path.split("/").filter(Boolean).pop();
+    if (leaf && (leaf.endsWith(".service") || leaf.endsWith(".scope"))) return leaf;
+  }
+  return null;
+}
+function readCurrentSystemdUnit() {
+  try {
+    return currentSystemdUnit(readFileSync5("/proc/self/cgroup", "utf8"));
+  } catch {
+    return null;
+  }
+}
+function processGroupMembers(pgid) {
+  try {
+    const out = execFileSync("ps", ["-eo", "pid=,pgid="], { timeout: 5e3 }).toString();
+    return {
+      ok: true,
+      members: out.split("\n").map((line) => /^\s*(\d+)\s+(\d+)\s*$/.exec(line)).filter((m) => m !== null).filter((m) => Number(m[2]) === pgid && Number(m[1]) !== process.pid).map((m) => Number(m[1]))
+    };
+  } catch (err) {
+    return { ok: false, error: (err instanceof Error ? err.message : String(err)).slice(0, 150) };
+  }
+}
+var sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var MANAGER_ENV_KEYS = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR", "PATH"];
+var managerEnvKey = (env) => MANAGER_ENV_KEYS.map((k) => `${k}=${env[k] ?? ""}`).join("\0");
+function createTurnContainment(turnId, deps = {}) {
+  const probe = deps.capabilityProbe ?? scopeCapabilityUsable;
+  const fallbackGraceMs = deps.fallbackGraceMs ?? FALLBACK_GRACE_MS;
+  const ownUnit = (deps.ownSystemdUnit ?? readCurrentSystemdUnit)();
+  const scopeUnits = [];
+  const groups = [];
+  let kind = null;
+  let probedEnvKey = null;
+  let attempt = 0;
+  function scopeArgs(unit) {
+    return [
+      "--user",
+      "--scope",
+      "--quiet",
+      "--collect",
+      `--unit=${unit}`,
+      `--property=TimeoutStopSec=${CONTAINMENT_STOP_GRACE_SEC}s`,
+      // Bind the scope's life to the companion's own unit, so stopping or
+      // restarting the companion still takes its in-flight turns with it —
+      // which is what happens today, and what the scope would otherwise undo.
+      // Omitted outside a unit, where there is nothing to bind to.
+      ...ownUnit ? [`--property=PartOf=${ownUnit}`] : [],
+      "--"
+    ];
+  }
+  function resolveKind(env) {
+    const envKey = managerEnvKey(env);
+    if (kind === null || envKey !== probedEnvKey) {
+      kind = probe(env) ? "systemd-scope" : "process-group";
+      probedEnvKey = envKey;
+      deps.log?.("containment: resolved strategy for this turn", {
+        kind,
+        platform: process.platform
+      });
+    }
+    return kind;
+  }
+  function spawnInScope(options) {
+    const unit = turnScopeUnit(turnId, attempt++);
+    scopeUnits.push({ unit, env: options.env });
+    deps.log?.("containment: spawning the turn CLI into a systemd scope", {
+      unit,
+      partOf: ownUnit,
+      command: options.command
+    });
+    return asContained(
+      spawn4("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
+        ...options.cwd ? { cwd: options.cwd } : {},
+        env: options.env,
+        stdio: ["pipe", "pipe", "pipe"]
+      })
+    );
+  }
+  function spawnInGroup(options) {
+    const child = spawn4(options.command, options.args, {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      env: options.env,
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: process.platform !== "win32"
+    });
+    if (child.pid !== void 0) {
+      groups.push({ pgid: child.pid, child });
+      deps.onProcessGroup?.(child.pid);
+    }
+    deps.log?.("containment: no host-owned containment here \u2014 best effort only", {
+      platform: process.platform,
+      pid: child.pid
+    });
+    return asContained(child);
+  }
+  async function reapScopes(result) {
+    for (const { unit, env } of scopeUnits) {
+      try {
+        await execFileAsync("systemctl", ["--user", "stop", `${unit}.scope`], {
+          env,
+          timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (classifyStopError(message) === "failure") {
+          result.failures.push({ target: unit, error: message.slice(0, 200) });
+          continue;
+        }
+        result.reaped.push(unit);
+        continue;
+      }
+      try {
+        const { stdout } = await execFileAsync(
+          "systemctl",
+          ["--user", "show", `${unit}.scope`, "--property=ActiveState", "--value"],
+          { env, timeout: 1e4 }
+        );
+        const state = stdout.trim();
+        if (state === "" || state === "inactive" || state === "failed") result.reaped.push(unit);
+        else result.failures.push({ target: unit, error: `scope still ${state} after stop` });
+      } catch (err) {
+        result.failures.push({
+          target: unit,
+          error: `could not confirm the scope stopped: ${(err instanceof Error ? err.message : String(err)).slice(0, 150)}`
+        });
+      }
+    }
+  }
+  async function reapGroups(result) {
+    for (const { pgid, child } of groups) {
+      const target = String(pgid);
+      if (process.platform === "win32") {
+        try {
+          if (child.exitCode === null) child.kill();
+          result.unverified.push(target);
+        } catch (err) {
+          result.failures.push({
+            target,
+            error: (err instanceof Error ? err.message : String(err)).slice(0, 200)
+          });
+        }
+        continue;
+      }
+      const first = processGroupMembers(pgid);
+      if (!first.ok) {
+        result.failures.push({
+          target,
+          error: `could not enumerate the process group: ${first.error}`
+        });
+        continue;
+      }
+      if (first.members.length === 0) {
+        result.reaped.push(target);
+        continue;
+      }
+      for (const pid of first.members) {
+        try {
+          process.kill(pid, "SIGTERM");
+        } catch {
+        }
+      }
+      await sleep2(fallbackGraceMs);
+      const afterTerm = processGroupMembers(pgid);
+      if (!afterTerm.ok) {
+        result.failures.push({
+          target,
+          error: `could not re-enumerate the process group after SIGTERM: ${afterTerm.error}`
+        });
+        continue;
+      }
+      for (const pid of afterTerm.members) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+      }
+      const afterKill = processGroupMembers(pgid);
+      if (!afterKill.ok) {
+        result.failures.push({
+          target,
+          error: `could not confirm the process group is empty after SIGKILL: ${afterKill.error}`
+        });
+        continue;
+      }
+      if (afterKill.members.length)
+        result.failures.push({
+          target,
+          error: `${afterKill.members.length} process(es) still in the group after SIGKILL`
+        });
+      else result.reaped.push(target);
+    }
+  }
+  return {
+    get kind() {
+      return kind;
+    },
+    spawn(options) {
+      return resolveKind(options.env) === "systemd-scope" ? spawnInScope(options) : spawnInGroup(options);
+    },
+    scopePrefix(env) {
+      if (resolveKind(env) !== "systemd-scope") return null;
+      const unit = turnScopeUnit(turnId, attempt++);
+      scopeUnits.push({ unit, env });
+      deps.log?.("containment: a harness will start in a systemd scope", { unit });
+      return ["systemd-run", ...scopeArgs(unit)];
+    },
+    async reap() {
+      const result = {
+        kind: kind ?? "unused",
+        reaped: [],
+        failures: [],
+        unverified: []
+      };
+      await reapScopes(result);
+      await reapGroups(result);
+      deps.log?.("containment: reap complete", {
+        kind: result.kind,
+        reaped: result.reaped,
+        failures: result.failures
+      });
+      return result;
+    }
+  };
+}
+
+// src/runner/protocol.ts
+import { z as z14 } from "zod";
+
+// src/run-config.ts
+import { z as z13 } from "zod";
+var mcpStdioServerSchema = z13.object({
+  type: z13.literal("stdio").optional(),
+  command: z13.string().min(1),
+  args: z13.array(z13.string()).optional(),
+  env: z13.record(z13.string(), z13.string()).optional()
+});
+var mcpHttpServerSchema = z13.object({
+  type: z13.literal("http"),
+  url: z13.string().url(),
+  headers: z13.record(z13.string(), z13.string()).optional()
+});
+var mcpSseServerSchema = z13.object({
+  type: z13.literal("sse"),
+  url: z13.string().url(),
+  headers: z13.record(z13.string(), z13.string()).optional()
+});
+var mcpServerDefSchema = z13.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+var thinkingConfigSchema = z13.discriminatedUnion("type", [
+  z13.object({ type: z13.literal("adaptive") }),
+  z13.object({ type: z13.literal("enabled"), budgetTokens: z13.number().int().positive().optional() }),
+  z13.object({ type: z13.literal("disabled") })
+]);
+var effortSchema = z13.enum(["low", "medium", "high", "xhigh", "max"]);
+var runConfigSchema = z13.object({
+  // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
+  // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
+  // is the locked surface. Kept in lockstep with `@cabane/shared`'s
+  // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
+  // stripped, so an older companion riding a newer server never rejects the config).
+  hostAccess: z13.boolean().optional(),
+  mcpServers: z13.record(z13.string(), mcpServerDefSchema).optional(),
+  model: z13.string().min(1).optional(),
+  thinking: thinkingConfigSchema.optional(),
+  effort: effortSchema.optional()
+});
+var EMPTY_RUN_CONFIG = {};
+function parseRunConfig(raw, onWarn) {
+  const result = runConfigSchema.safeParse(raw ?? {});
+  if (result.success) return result.data;
+  onWarn?.(
+    `run-config from Cabane didn't parse (${result.error.issues.map((i) => i.path.join(".") || "(root)").join(", ")}) \u2014 falling back to the locked assistant default`
+  );
+  return EMPTY_RUN_CONFIG;
+}
+
+// src/runner/protocol.ts
+var RUNNER_ENV = {
+  // The wire the runner speaks.
+  url: "CABANE_URL",
+  // The dispatch as the device stream delivered it.
+  dispatch: "CABANE_DISPATCH",
+  // The turn id the launcher resolved, and whether this is a replay of a turn
+  // an earlier process started. The seq floor for a replay is derived inside
+  // the turn from the outbox and the server, as it always was.
+  turnId: "CABANE_TURN_ID",
+  resumed: "CABANE_RESUMED",
+  // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
+  spec: "CABANE_RUNNER_SPEC"
+};
+var runtimeHealthSchema = z14.object({
+  quotaState: z14.enum(["ok", "limited", "auth_expired", "unknown"]),
+  limitedUntil: z14.string().nullable(),
+  lastError: z14.string().nullable()
+});
+var runnerSpecSchema = z14.object({
+  deviceId: z14.string().optional(),
+  // The launcher's boot id: the one its heartbeat carries, so a runner's lease
+  // matches the device that holds it.
+  bootId: z14.string(),
+  workspaceId: z14.string(),
+  workspaceSlug: z14.string(),
+  agentId: z14.string(),
+  agentUsername: z14.string(),
+  agentName: z14.string(),
+  local: localAgentConfigSchema,
+  runConfig: runConfigSchema,
+  opencodeServerUrl: z14.string().optional(),
+  claudeCodeAvailable: z14.boolean(),
+  codexAvailable: z14.boolean(),
+  idleTimeoutMs: z14.number().int().positive().optional(),
+  totalTimeoutMs: z14.number().int().positive().optional(),
+  leaseRenewalMs: z14.number().int().positive().optional(),
+  preparingRowDelayMs: z14.number().int().nonnegative().optional(),
+  // Whether the turn writes a transcript. The directory is the runner's own
+  // (`transcriptsDir()`), so `CABANE_RUNNER_STATE_DIR` moves it with the outbox.
+  transcripts: z14.boolean(),
+  // Whether the harness starts under the OS sandbox. The launcher sends 'os'
+  // only when this host can make one.
+  sandbox: z14.enum(["os", "none"]),
+  logLevel: z14.string(),
+  // The launcher's connector-health observations, by runtime, as of the start.
+  connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
+  // True when this (conversation, agent) pair was already told its session
+  // could not be saved: the notice is once per pair, not once per process.
+  sessionWriteNoticeClaimed: z14.boolean()
+});
+var dispatchSchema = z14.object({
+  type: z14.literal("device:dispatch_requested"),
+  agentId: z14.string(),
+  deviceId: z14.string(),
+  conversationId: z14.string(),
+  messageId: z14.string(),
+  episode: z14.number().int().optional()
+});
+var credentialsSchema = z14.object({
+  agentToken: z14.string().min(1),
+  deviceToken: z14.string().min(1).optional()
+});
+function runnerEnv(input) {
+  return {
+    [RUNNER_ENV.url]: input.baseUrl,
+    [RUNNER_ENV.dispatch]: JSON.stringify(input.dispatch),
+    [RUNNER_ENV.turnId]: input.turnId,
+    ...input.resumed ? { [RUNNER_ENV.resumed]: "1" } : {},
+    [RUNNER_ENV.spec]: JSON.stringify(input.spec)
+  };
+}
+function runnerStdin(input) {
+  return `${JSON.stringify({
+    // Phase 1 (CT1680) replaces the agent PAT with a runner credential bound to
+    // this one dispatch; until then the child holds what the in-process turn
+    // held, on the same machine.
+    agentToken: input.agentToken,
+    ...input.deviceToken ? { deviceToken: input.deviceToken } : {}
+  })}
+`;
+}
+function encodeLauncherMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+function decodeRunnerEvent(line) {
+  if (!line.startsWith("{")) return null;
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || !("cabaneRunner" in value)) return null;
+  return value;
+}
+
+// src/runner/launch.ts
+function selfRunnerCommand() {
+  const script = process.argv[1];
+  if (!script) throw new Error("runners: cannot tell which script started this companion");
+  return [process.execPath, ...process.execArgv, script, "run-turn"];
+}
+function healthSnapshot(store) {
+  const out = {};
+  for (const r of store?.reports() ?? []) {
+    out[r.runtime] = {
+      quotaState: r.quotaState ?? "unknown",
+      limitedUntil: r.limitedUntil ?? null,
+      lastError: r.lastError ?? null
+    };
+  }
+  return out;
+}
+function runnerSpec(opts, launch, duties) {
+  return {
+    ...opts.deviceId ? { deviceId: opts.deviceId } : {},
+    bootId,
+    workspaceId: opts.workspaceId,
+    workspaceSlug: opts.workspaceSlug,
+    agentId: opts.agentId,
+    agentUsername: opts.agentUsername,
+    agentName: String(opts.log.bindings().agentName ?? opts.agentUsername),
+    local: opts.local,
+    runConfig: opts.runConfig,
+    ...opts.opencodeServerUrl ? { opencodeServerUrl: opts.opencodeServerUrl } : {},
+    // Read now, per turn, as the in-process path reads them at adapter selection.
+    claudeCodeAvailable: opts.claudeCodeAvailable?.() ?? true,
+    codexAvailable: opts.codexAvailable?.() ?? false,
+    ...opts.idleTimeoutMs !== void 0 ? { idleTimeoutMs: opts.idleTimeoutMs } : {},
+    ...opts.totalTimeoutMs !== void 0 ? { totalTimeoutMs: opts.totalTimeoutMs } : {},
+    ...opts.leaseRenewalMs !== void 0 ? { leaseRenewalMs: opts.leaseRenewalMs } : {},
+    ...opts.preparingRowDelayMs !== void 0 ? { preparingRowDelayMs: opts.preparingRowDelayMs } : {},
+    transcripts: opts.transcriptDir !== void 0,
+    sandbox: launch.sandbox ?? "none",
+    logLevel: opts.log.level,
+    connectorHealth: healthSnapshot(launch.connectorHealth),
+    sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
+  };
+}
+var PINO_LEVELS = {
+  10: "trace",
+  20: "debug",
+  30: "info",
+  40: "warn",
+  50: "error",
+  60: "fatal"
+};
+function relayRunnerLog(line, log) {
+  if (!line.trim()) return;
+  let record = null;
+  try {
+    const parsed = JSON.parse(line);
+    if (parsed && typeof parsed === "object") record = parsed;
+  } catch {
+    record = null;
+  }
+  if (!record || typeof record.level !== "number") {
+    log.debug({ runnerStderr: line }, "runner: output");
+    return;
+  }
+  const {
+    level,
+    msg,
+    time: _time,
+    pid: _pid,
+    hostname: _hostname,
+    agentName: _agentName,
+    ...fields
+  } = record;
+  const method = PINO_LEVELS[level] ?? "info";
+  log[method](fields, typeof msg === "string" ? msg : "");
+}
+function lines(stream, onLine) {
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  rl.on("line", onLine);
+  return new Promise((resolve2) => rl.once("close", resolve2));
+}
+function giveBackLocks(locks, prefix, remote, launch, log) {
+  locks.withdraw(prefix);
+  const stop = launch.stopRemoteSession ?? ((url, id) => stopRemoteOpencodeSession(url, id));
+  for (const { key, owner } of locks.heldBy(prefix)) {
+    const left = remote.filter((r) => opencodeLockKey(r.serverUrl) === key);
+    if (!left.length) {
+      locks.release(owner);
+      continue;
+    }
+    void (async () => {
+      for (let attempt = 1; ; attempt++) {
+        const stopped = await Promise.all(left.map((r) => stop(r.serverUrl, r.sessionId))).catch(
+          () => [false]
+        );
+        if (stopped.every(Boolean)) break;
+        if (attempt === 1)
+          log.warn(
+            { key, sessions: left.map((r) => r.sessionId) },
+            "runner: a dead runner left work on a shared server that could not be confirmed stopped; holding the server until it is"
+          );
+        await new Promise((resolve2) => setTimeout(resolve2, launch.reconcileRetryMs ?? 5e3));
+      }
+      locks.release(owner);
+    })();
+  }
+}
+async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
+  const startedAt = Date.now();
+  const { turnId } = handleOpts;
+  const log = opts.log.child({
+    workspaceId: opts.workspaceId,
+    conversationId: payload.conversationId,
+    agentId: payload.agentId,
+    messageId: payload.messageId
+  });
+  const controller = new AbortController();
+  duties.registerAbort(turnId, controller);
+  const stopRunner = new AbortController();
+  let ready = false;
+  const forwardStop = () => {
+    if (ready) stopRunner.abort();
+  };
+  controller.signal.addEventListener("abort", forwardStop, { once: true });
+  const attempt = {
+    workspaceId: opts.workspaceId,
+    conversationId: payload.conversationId,
+    agentId: payload.agentId,
+    turnId
+  };
+  let result;
+  let thrown;
+  let code;
+  let handle;
+  let child;
+  const groups = [];
+  const remote = [];
+  const lockOwner = (id) => `${turnId}#${id}`;
+  const locks = launch.locks;
+  try {
+    handle = await launch.provider.acquire(attempt);
+    const env = {};
+    for (const [k, v] of Object.entries(launch.env ?? process.env)) {
+      if (v !== void 0) env[k] = v;
+    }
+    const input = {
+      baseUrl: opts.baseUrl,
+      agentToken: opts.credential,
+      ...launch.deviceToken ? { deviceToken: launch.deviceToken } : {},
+      dispatch: payload,
+      turnId,
+      resumed: handleOpts.resumed,
+      spec: runnerSpec(opts, launch, duties)
+    };
+    Object.assign(env, runnerEnv(input));
+    const running = launch.provider.exec(handle, launch.command, env, {
+      signal: stopRunner.signal,
+      stdin: runnerStdin(input)
+    });
+    child = running;
+    log.debug(
+      { turnId, runnerPid: running.pid, provider: launch.provider.name },
+      "runner: started"
+    );
+    const stdoutDone = lines(running.stdout, (line) => {
+      const event = decodeRunnerEvent(line);
+      if (!event) {
+        log.debug({ runnerStdout: line }, "runner: output");
+        return;
+      }
+      switch (event.cabaneRunner) {
+        case "ready":
+          ready = true;
+          if (controller.signal.aborted) stopRunner.abort();
+          return;
+        case "start":
+          duties.notifyStart({
+            id: event.id,
+            conversationId: event.conversationId,
+            message: event.message
+          });
+          return;
+        case "end": {
+          const { cabaneRunner: _kind, ...info } = event;
+          duties.notifyEnd(info);
+          return;
+        }
+        case "session_write_notice":
+          duties.markSessionWriteNotice();
+          return;
+        case "connector_health":
+          launch.connectorHealth?.recordSettle(event.runtime, {
+            ok: event.ok,
+            errorReason: event.errorReason
+          });
+          return;
+        case "result":
+          result = event.result;
+          return;
+        case "error":
+          thrown = event.message;
+          return;
+        case "lock":
+          if (!locks) {
+            log.warn(
+              { key: event.key },
+              "runner: asked for a device lock this launcher has none of"
+            );
+            return;
+          }
+          locks.request(
+            event.key,
+            lockOwner(event.id),
+            () => running.stdin.write(encodeLauncherMessage({ cabaneLauncher: "granted", id: event.id }))
+          );
+          return;
+        case "unlock":
+          locks?.release(lockOwner(event.id));
+          return;
+        case "process_group":
+          groups.push(event.pgid);
+          return;
+        case "remote_session":
+          remote.push({ serverUrl: event.serverUrl, sessionId: event.sessionId });
+          return;
+      }
+    });
+    const stderrDone = lines(running.stderr, (line) => relayRunnerLog(line, opts.log));
+    code = await running.exit;
+    await Promise.all([stdoutDone, stderrDone]);
+  } finally {
+    if (locks) giveBackLocks(locks, `${turnId}#`, remote, launch, log);
+    child?.stdin.end();
+    controller.signal.removeEventListener("abort", forwardStop);
+    duties.releaseAbort(turnId, controller);
+    if (handle) await launch.provider.release(handle, { destroy: false });
+  }
+  if (result) return result;
+  const durationMs = Date.now() - startedAt;
+  const reason = thrown !== void 0 ? `runner_failed: ${thrown}` : `runner_exited: ${code}`;
+  await child?.reap(groups);
+  const reaped = await (launch.reapTurn ?? reapTurnScopes)(turnId).catch((err) => ({
+    failures: [err instanceof Error ? err.message : String(err)]
+  }));
+  if (reaped.failures.length) {
+    log.warn(
+      { turnId, failures: reaped.failures },
+      "runner: couldn't stop what the dead runner's turn left running"
+    );
+  }
+  try {
+    await opts.api.setActiveRun(opts.workspaceId, payload.conversationId, payload.agentId, {
+      activeRunStartedAt: null,
+      turnId,
+      outcome: "failed",
+      errorReason: reason.slice(0, 200),
+      readThrough: payload.messageId
+    });
+  } catch (err) {
+    log.warn(
+      { ...apiErrorLogFields(err), turnId },
+      "Couldn't update the turn's status in Cabane. Check the conversation before trying again."
+    );
+  }
+  if (thrown !== void 0) throw new Error(thrown);
+  log.warn({ turnId, code }, "runner: exited without reporting a result");
+  duties.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
+  return { ok: false, durationMs, reason };
+}
+
+// src/term.ts
+import { createInterface as createInterface2 } from "readline";
+import { homedir as homedir2 } from "os";
+import pc from "picocolors";
+function tildePath(path) {
+  const home = homedir2();
+  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
+  return path;
+}
+
+// src/turn-execution.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync9 } from "fs";
+
+// src/turn-control-tools.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { z as z15 } from "zod";
+var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
+var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
+var SKIP_TURN_TOOL = "skip_turn";
+var ASK_TOOL = "ask";
+var ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${ASK_TOOL}`;
+var WITHDRAW_ASK_TOOL = "withdraw_ask";
+var WITHDRAW_ASK_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WITHDRAW_ASK_TOOL}`;
+var WAKE_ME_TOOL = "wake_me";
+var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
+var CANCEL_WAKE_TOOL = "cancel_wake";
+var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
+var TURN_ACT_TIMEOUT_MS = 45e3;
+function createSkipState() {
+  return { skipped: false, reason: null };
+}
+function toolError(text) {
+  return { isError: true, content: [{ type: "text", text }] };
+}
+async function performAct(acts, act) {
+  let result;
+  try {
+    result = await acts.api.turnAct(
+      acts.workspaceId,
+      acts.turnId,
+      act,
+      AbortSignal.timeout(TURN_ACT_TIMEOUT_MS)
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status >= 500) {
+      return uncertainOutcome(`${err.status}: ${apiErrorMessage(err)}`);
+    }
+    if (err instanceof ApiError) {
+      if (err.status === 409 && apiErrorCode(err) === "no_active_turn") {
+        return toolError(
+          "No active turn: this turn has already settled, so the act was not performed."
+        );
+      }
+      return toolError(`The act was refused (${err.status}): ${apiErrorMessage(err)}`);
+    }
+    return uncertainOutcome(err instanceof Error ? err.message : String(err));
+  }
+  if (!result.ok) return toolError(JSON.stringify(result));
+  return { content: [{ type: "text", text: JSON.stringify(result) }] };
+}
+function uncertainOutcome(cause) {
+  return toolError(
+    `The outcome of this act could not be confirmed (${cause}). It may already have been performed, with only the response lost. Do NOT simply repeat the call: a repeat is a second, separate act, not a retry. Carry on, and say in your reply that you could not confirm it.`
+  );
+}
+function createTurnControlMcpServer(acts, skipState) {
+  const ACT_TOOL = { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
+  const CANCEL_TOOL = { ...ACT_TOOL, idempotentHint: true };
+  const RECORDER_TOOL = { readOnlyHint: true, openWorldHint: false };
+  return createSdkMcpServer({
+    name: COMPANION_LOCAL_MCP_SERVER,
+    version: "0.0.0",
+    tools: [
+      ...skipState ? [
+        tool(
+          SKIP_TURN_TOOL,
+          TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
+          {
+            reason: z15.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+          },
+          async (args) => {
+            skipState.skipped = true;
+            skipState.reason = args.reason;
+            return {
+              content: [{ type: "text", text: JSON.stringify({ skipped: true }) }]
+            };
+          },
+          { annotations: RECORDER_TOOL, alwaysLoad: true }
+        )
+      ] : [],
+      tool(
+        ASK_TOOL,
+        TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
+        {
+          targetUserId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z15.array(
+            z15.union([
+              z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
+              z15.object({
+                label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
+                move: z15.object({
+                  task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
+                  status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
+                }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
+              })
+            ])
+          ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
+          questions: z15.array(
+            z15.object({
+              headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z15.array(
+                z15.union([
+                  z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
+                  z15.object({
+                    label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
+                    move: z15.object({
+                      task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
+                      status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
+                    }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
+                  })
+                ])
+              ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
+            })
+          ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
+          replaces: z15.object({
+            askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
+        },
+        async (args) => {
+          const hasSingle = args.question !== void 0;
+          const hasArray = args.questions !== void 0 && args.questions.length > 0;
+          if (hasSingle && hasArray) {
+            return toolError(
+              "Provide either `question` (single) or `questions` (array), not both."
+            );
+          }
+          if (!hasSingle && !hasArray) {
+            return toolError("Provide `question` (single) or `questions` (array).");
+          }
+          return performAct(acts, {
+            kind: "ask",
+            callId: randomUUID2(),
+            // CT1350: the swap rides the ask, so the server commits both halves
+            // in one transaction — the person never sees neither or both.
+            ...args.replaces ? { replaces: args.replaces } : {},
+            ask: hasArray ? {
+              targetUserId: args.targetUserId,
+              questions: args.questions.map((q) => ({
+                headline: q.headline,
+                ...q.body ? { body: q.body } : {},
+                ...q.options && q.options.length > 0 ? { options: q.options } : {}
+              }))
+            } : {
+              targetUserId: args.targetUserId,
+              question: args.question,
+              ...args.headline ? { headline: args.headline } : {},
+              ...args.options && args.options.length > 0 ? { options: args.options } : {}
+            }
+          });
+        },
+        { annotations: ACT_TOOL, alwaysLoad: true }
+      ),
+      tool(
+        WAKE_ME_TOOL,
+        TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
+        {
+          afterSeconds: z15.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z15.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z15.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+        },
+        async (args) => {
+          const hasAfter = args.afterSeconds !== void 0;
+          const hasAt = args.at !== void 0;
+          if (hasAfter && hasAt) {
+            return toolError(
+              "Provide either `afterSeconds` (relative) or `at` (absolute), not both."
+            );
+          }
+          if (!hasAfter && !hasAt) {
+            return toolError("Provide `afterSeconds` or `at`.");
+          }
+          return performAct(acts, {
+            kind: "wake",
+            callId: randomUUID2(),
+            wake: {
+              ...hasAfter ? { afterSeconds: args.afterSeconds } : {},
+              ...hasAt ? { at: args.at } : {},
+              note: args.note
+            }
+          });
+        },
+        { annotations: ACT_TOOL, alwaysLoad: true }
+      ),
+      // CT1350: the standalone withdrawal. Not annotated destructive — an ask
+      // is a question, not data, and a harness that gated this on a live
+      // operator would hang a turn nobody is watching (the `cancel_wake`
+      // reasoning). Not idempotent either: a second call with the same id is
+      // refused with `ask_not_open`, which is information, not a no-op.
+      tool(
+        WITHDRAW_ASK_TOOL,
+        TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
+        {
+          askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+        },
+        async (args) => performAct(acts, {
+          kind: "withdraw_ask",
+          callId: randomUUID2(),
+          withdraw: { askId: args.askId, reason: args.reason }
+        }),
+        { annotations: ACT_TOOL, alwaysLoad: true }
+      ),
+      // CT990: the inverse. No arguments — it can only ever stand down the
+      // caller's own wake in the conversation it's holding a turn in.
+      tool(
+        CANCEL_WAKE_TOOL,
+        TURN_CONTROL_TOOL_DESCRIPTIONS.cancel_wake,
+        {},
+        async () => performAct(acts, { kind: "cancel_wake", callId: randomUUID2() }),
+        { annotations: CANCEL_TOOL, alwaysLoad: true }
+      )
+    ]
+  });
+}
+
+// src/build-options.ts
+function cabaneMcpUrl(baseUrl) {
+  return `${trimSlash2(baseUrl)}/api/mcp`;
+}
+function turnControlMcpUrl(baseUrl) {
+  return `${trimSlash2(baseUrl)}/api/turn-control`;
+}
+function buildCompanionTurnRequest(params) {
+  const { turnContext: t } = params;
+  return {
+    systemPrompt: t.systemPrompt,
+    prompt: t.prompt,
+    content: t.content,
+    config: t.config,
+    policy: t.policy,
+    session: t.session,
+    cabane: {
+      mcpUrl: cabaneMcpUrl(params.baseUrl),
+      bearer: params.turnToken,
       activeConversationId: params.activeConversationId,
       workspaceId: params.workspaceId,
       turnControlUrl: turnControlMcpUrl(params.baseUrl)
@@ -8137,7 +8885,7 @@ function readOutboxFloor(read, turnId, log) {
 }
 
 // src/prepare-failure.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { hostname } from "os";
 function prepareFailureCause(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -8175,7 +8923,7 @@ async function runPrepareWithReporting(runner, hook, input, context, reportError
 }
 function reportFailure(config, body) {
   return new Promise((resolve2, reject) => {
-    const child = spawn4(config.command, config.args ?? [], {
+    const child = spawn5(config.command, config.args ?? [], {
       stdio: ["pipe", "ignore", "ignore"],
       env: { ...process.env, ...config.env }
     });
@@ -8199,7 +8947,7 @@ function reportFailure(config, body) {
 }
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
 import { join as join11 } from "path";
 function dirFor(workspaceId) {
   return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
@@ -8214,7 +8962,7 @@ function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
   if (!existsSync7(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
       return {
         cwd: parsed.cwd,
@@ -8239,20 +8987,20 @@ function clearPrepared(workspaceId, conversationId, agentId) {
 }
 
 // src/secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
 import { join as join12 } from "path";
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
   return join12(cabaneDir(), "secrets.json");
 }
-var secretStoreSchema = z14.record(z14.string(), z14.string());
+var secretStoreSchema = z16.record(z16.string(), z16.string());
 function loadSecretStore() {
   const path = secretsPath();
   if (!existsSync8(path)) return makeStore({});
   let raw;
   try {
-    raw = readFileSync6(path, "utf8");
+    raw = readFileSync7(path, "utf8");
   } catch (err) {
     throw new ConfigError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -8333,7 +9081,7 @@ function resolveMcpSecrets(mcpServers, store) {
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
 import { basename, dirname as dirname6, join as join13 } from "path";
 function transcriptsDir() {
-  return join13(cabaneDir(), "transcripts");
+  return join13(runnerStateDir(), "transcripts");
 }
 var RETAIN = 200;
 var ANOMALY_RETAIN = 50;
@@ -8343,344 +9091,88 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join13(dir2, fileName(meta));
-    try {
-      mkdirSync8(dir2, { recursive: true });
-      try {
-        chmodSync4(dir2, 448);
-      } catch {
-      }
-      pruneOld(dir2, RETAIN);
-    } catch (err) {
-      this.fail(err);
-    }
-    this.line({ type: "_meta", ...meta });
-  }
-  // Append a raw SDK message verbatim.
-  write(msg) {
-    this.line(msg);
-  }
-  // Append the outcome footer.
-  close(outcome) {
-    this.line({ type: "_outcome", ...outcome });
-  }
-  // CT1145: keep an independent copy of an empty successful envelope after the
-  // footer has landed. The ordinary 200-file FIFO keeps rotating as before;
-  // this bucket retains the newest 50 anomalies regardless of ordinary traffic.
-  // Best-effort like every other transcript operation: observability can never
-  // fail the turn.
-  preserveAnomaly() {
-    if (this.broken) return;
-    try {
-      const dir2 = join13(dirname6(this.path), "anomalies");
-      mkdirSync8(dir2, { recursive: true, mode: 448 });
-      chmodSync4(dir2, 448);
-      const target = join13(dir2, basename(this.path));
-      copyFileSync(this.path, target);
-      chmodSync4(target, 384);
-      pruneOld(dir2, ANOMALY_RETAIN);
-    } catch (err) {
-      this.fail(err);
-    }
-  }
-  line(obj) {
-    if (this.broken) return;
-    try {
-      appendFileSync(this.path, JSON.stringify(obj) + "\n", { mode: 384 });
-    } catch (err) {
-      this.fail(err);
-    }
-  }
-  fail(err) {
-    if (this.broken) return;
-    this.broken = true;
-    this.onWarn?.(`transcript write failed (${err instanceof Error ? err.message : String(err)})`);
-  }
-};
-function fileName(meta) {
-  const d = new Date(meta.ts);
-  const stamp = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
-  const slug = safe2(meta.workspaceSlug) || "ws";
-  const short = meta.dispatchId.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8) || "turn";
-  return `${stamp}-${slug}-${short}.jsonl`;
-}
-function pad(n) {
-  return String(n).padStart(2, "0");
-}
-function safe2(s) {
-  return s.replace(/[^a-zA-Z0-9_-]/g, "-");
-}
-function pruneOld(dir2, retain) {
-  let files;
-  try {
-    files = readdirSync(dir2).filter((f) => f.endsWith(".jsonl"));
-  } catch {
-    return;
-  }
-  if (files.length <= retain) return;
-  const drop = files.sort().slice(0, files.length - retain);
-  for (const f of drop) {
-    try {
-      rmSync6(join13(dir2, f), { force: true });
-    } catch {
-    }
-  }
-}
-
-// src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn5 } from "child_process";
-import { readFileSync as readFileSync7 } from "fs";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var asContained = (child) => child;
-var CONTAINMENT_STOP_GRACE_SEC = 5;
-var FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
-var CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
-function turnScopeUnit(turnId, attempt) {
-  const safe3 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
-  return `cabane-turn-${safe3}-${attempt}`;
-}
-function scopeCapabilityUsable(env, timeoutMs = CAPABILITY_PROBE_TIMEOUT_MS) {
-  if (process.platform !== "linux") return false;
-  try {
-    execFileSync("systemd-run", ["--user", "--scope", "--quiet", "--collect", "--", "/bin/true"], {
-      env,
-      timeout: timeoutMs,
-      stdio: "ignore"
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function classifyStopError(message) {
-  if (/failed to connect to bus|failed to get d-?bus connection|connection refused|refusing to operate|spawn systemctl|systemctl.*ENOENT|ENOENT.*systemctl/i.test(
-    message
-  )) {
-    return "failure";
-  }
-  if (/not loaded|could not be found|no such unit|unit .* not found/i.test(message))
-    return "absent";
-  return "failure";
-}
-function currentSystemdUnit(cgroupText) {
-  for (const line of cgroupText.split("\n")) {
-    const path = line.trim().split(":").pop();
-    if (!path?.startsWith("/")) continue;
-    const leaf = path.split("/").filter(Boolean).pop();
-    if (leaf && (leaf.endsWith(".service") || leaf.endsWith(".scope"))) return leaf;
-  }
-  return null;
-}
-function readCurrentSystemdUnit() {
-  try {
-    return currentSystemdUnit(readFileSync7("/proc/self/cgroup", "utf8"));
-  } catch {
-    return null;
-  }
-}
-function processGroupMembers(pgid) {
-  try {
-    const out = execFileSync("ps", ["-eo", "pid=,pgid="], { timeout: 5e3 }).toString();
-    return {
-      ok: true,
-      members: out.split("\n").map((line) => /^\s*(\d+)\s+(\d+)\s*$/.exec(line)).filter((m) => m !== null).filter((m) => Number(m[2]) === pgid && Number(m[1]) !== process.pid).map((m) => Number(m[1]))
-    };
-  } catch (err) {
-    return { ok: false, error: (err instanceof Error ? err.message : String(err)).slice(0, 150) };
-  }
-}
-var sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
-var MANAGER_ENV_KEYS = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR", "PATH"];
-var managerEnvKey = (env) => MANAGER_ENV_KEYS.map((k) => `${k}=${env[k] ?? ""}`).join("\0");
-function createTurnContainment(turnId, deps = {}) {
-  const probe = deps.capabilityProbe ?? scopeCapabilityUsable;
-  const fallbackGraceMs = deps.fallbackGraceMs ?? FALLBACK_GRACE_MS;
-  const ownUnit = (deps.ownSystemdUnit ?? readCurrentSystemdUnit)();
-  const scopeUnits = [];
-  const groups = [];
-  let kind = null;
-  let probedEnvKey = null;
-  let attempt = 0;
-  function spawnInScope(options) {
-    const unit = turnScopeUnit(turnId, attempt++);
-    scopeUnits.push({ unit, env: options.env });
-    deps.log?.("containment: spawning the turn CLI into a systemd scope", {
-      unit,
-      partOf: ownUnit,
-      command: options.command
-    });
-    return asContained(
-      spawn5(
-        "systemd-run",
-        [
-          "--user",
-          "--scope",
-          "--quiet",
-          "--collect",
-          `--unit=${unit}`,
-          `--property=TimeoutStopSec=${CONTAINMENT_STOP_GRACE_SEC}s`,
-          // Bind the scope's life to the companion's own unit, so stopping or
-          // restarting the companion still takes its in-flight turns with it —
-          // which is what happens today, and what the scope would otherwise undo.
-          // Omitted outside a unit, where there is nothing to bind to.
-          ...ownUnit ? [`--property=PartOf=${ownUnit}`] : [],
-          "--",
-          options.command,
-          ...options.args
-        ],
-        {
-          ...options.cwd ? { cwd: options.cwd } : {},
-          env: options.env,
-          stdio: ["pipe", "pipe", "pipe"]
-        }
-      )
-    );
-  }
-  function spawnInGroup(options) {
-    const child = spawn5(options.command, options.args, {
-      ...options.cwd ? { cwd: options.cwd } : {},
-      env: options.env,
-      stdio: ["pipe", "pipe", "pipe"],
-      detached: process.platform !== "win32"
-    });
-    if (child.pid !== void 0) groups.push({ pgid: child.pid, child });
-    deps.log?.("containment: no host-owned containment here \u2014 best effort only", {
-      platform: process.platform,
-      pid: child.pid
-    });
-    return asContained(child);
-  }
-  async function reapScopes(result) {
-    for (const { unit, env } of scopeUnits) {
-      try {
-        await execFileAsync("systemctl", ["--user", "stop", `${unit}.scope`], {
-          env,
-          timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (classifyStopError(message) === "failure") {
-          result.failures.push({ target: unit, error: message.slice(0, 200) });
-          continue;
-        }
-        result.reaped.push(unit);
-        continue;
-      }
-      try {
-        const { stdout } = await execFileAsync(
-          "systemctl",
-          ["--user", "show", `${unit}.scope`, "--property=ActiveState", "--value"],
-          { env, timeout: 1e4 }
-        );
-        const state = stdout.trim();
-        if (state === "" || state === "inactive" || state === "failed") result.reaped.push(unit);
-        else result.failures.push({ target: unit, error: `scope still ${state} after stop` });
-      } catch (err) {
-        result.failures.push({
-          target: unit,
-          error: `could not confirm the scope stopped: ${(err instanceof Error ? err.message : String(err)).slice(0, 150)}`
-        });
+    this.path = join13(dir2, fileName(meta));
+    try {
+      mkdirSync8(dir2, { recursive: true });
+      try {
+        chmodSync4(dir2, 448);
+      } catch {
       }
+      pruneOld(dir2, RETAIN);
+    } catch (err) {
+      this.fail(err);
     }
+    this.line({ type: "_meta", ...meta });
   }
-  async function reapGroups(result) {
-    for (const { pgid, child } of groups) {
-      const target = String(pgid);
-      if (process.platform === "win32") {
-        try {
-          if (child.exitCode === null) child.kill();
-          result.unverified.push(target);
-        } catch (err) {
-          result.failures.push({
-            target,
-            error: (err instanceof Error ? err.message : String(err)).slice(0, 200)
-          });
-        }
-        continue;
-      }
-      const first = processGroupMembers(pgid);
-      if (!first.ok) {
-        result.failures.push({
-          target,
-          error: `could not enumerate the process group: ${first.error}`
-        });
-        continue;
-      }
-      if (first.members.length === 0) {
-        result.reaped.push(target);
-        continue;
-      }
-      for (const pid of first.members) {
-        try {
-          process.kill(pid, "SIGTERM");
-        } catch {
-        }
-      }
-      await sleep2(fallbackGraceMs);
-      const afterTerm = processGroupMembers(pgid);
-      if (!afterTerm.ok) {
-        result.failures.push({
-          target,
-          error: `could not re-enumerate the process group after SIGTERM: ${afterTerm.error}`
-        });
-        continue;
-      }
-      for (const pid of afterTerm.members) {
-        try {
-          process.kill(pid, "SIGKILL");
-        } catch {
-        }
-      }
-      const afterKill = processGroupMembers(pgid);
-      if (!afterKill.ok) {
-        result.failures.push({
-          target,
-          error: `could not confirm the process group is empty after SIGKILL: ${afterKill.error}`
-        });
-        continue;
-      }
-      if (afterKill.members.length)
-        result.failures.push({
-          target,
-          error: `${afterKill.members.length} process(es) still in the group after SIGKILL`
-        });
-      else result.reaped.push(target);
+  // Append a raw SDK message verbatim.
+  write(msg) {
+    this.line(msg);
+  }
+  // Append the outcome footer.
+  close(outcome) {
+    this.line({ type: "_outcome", ...outcome });
+  }
+  // CT1145: keep an independent copy of an empty successful envelope after the
+  // footer has landed. The ordinary 200-file FIFO keeps rotating as before;
+  // this bucket retains the newest 50 anomalies regardless of ordinary traffic.
+  // Best-effort like every other transcript operation: observability can never
+  // fail the turn.
+  preserveAnomaly() {
+    if (this.broken) return;
+    try {
+      const dir2 = join13(dirname6(this.path), "anomalies");
+      mkdirSync8(dir2, { recursive: true, mode: 448 });
+      chmodSync4(dir2, 448);
+      const target = join13(dir2, basename(this.path));
+      copyFileSync(this.path, target);
+      chmodSync4(target, 384);
+      pruneOld(dir2, ANOMALY_RETAIN);
+    } catch (err) {
+      this.fail(err);
     }
   }
-  return {
-    get kind() {
-      return kind;
-    },
-    spawn(options) {
-      const envKey = managerEnvKey(options.env);
-      if (kind === null || envKey !== probedEnvKey) {
-        kind = probe(options.env) ? "systemd-scope" : "process-group";
-        probedEnvKey = envKey;
-        deps.log?.("containment: resolved strategy for this turn", {
-          kind,
-          platform: process.platform
-        });
-      }
-      return kind === "systemd-scope" ? spawnInScope(options) : spawnInGroup(options);
-    },
-    async reap() {
-      const result = {
-        kind: kind ?? "unused",
-        reaped: [],
-        failures: [],
-        unverified: []
-      };
-      await reapScopes(result);
-      await reapGroups(result);
-      deps.log?.("containment: reap complete", {
-        kind: result.kind,
-        reaped: result.reaped,
-        failures: result.failures
-      });
-      return result;
+  line(obj) {
+    if (this.broken) return;
+    try {
+      appendFileSync(this.path, JSON.stringify(obj) + "\n", { mode: 384 });
+    } catch (err) {
+      this.fail(err);
     }
-  };
+  }
+  fail(err) {
+    if (this.broken) return;
+    this.broken = true;
+    this.onWarn?.(`transcript write failed (${err instanceof Error ? err.message : String(err)})`);
+  }
+};
+function fileName(meta) {
+  const d = new Date(meta.ts);
+  const stamp = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+  const slug = safe2(meta.workspaceSlug) || "ws";
+  const short = meta.dispatchId.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8) || "turn";
+  return `${stamp}-${slug}-${short}.jsonl`;
+}
+function pad(n) {
+  return String(n).padStart(2, "0");
+}
+function safe2(s) {
+  return s.replace(/[^a-zA-Z0-9_-]/g, "-");
+}
+function pruneOld(dir2, retain) {
+  let files;
+  try {
+    files = readdirSync(dir2).filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return;
+  }
+  if (files.length <= retain) return;
+  const drop = files.sort().slice(0, files.length - retain);
+  for (const f of drop) {
+    try {
+      rmSync6(join13(dir2, f), { force: true });
+    } catch {
+    }
+  }
 }
 
 // src/turn-committer.ts
@@ -9371,7 +9863,9 @@ var TurnExecution = class {
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        bootId,
+        // CT1679: a runner leases under its launcher's boot id — the one the
+        // device heartbeats — or the lost-run sweep reads it as a restart.
+        bootId: this.opts.inRunner?.bootId ?? bootId,
         // CT1380: the durable record that this turn resumed, and from where.
         ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT1454: the issuance the context THIS attempt runs on came from. Read
@@ -9468,10 +9962,14 @@ var TurnExecution = class {
     const { payload, workspaceId, turnId, turnLog } = this;
     await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
     const onWarn = (msg, meta) => turnLog.debug(meta ?? {}, msg);
+    const sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({ cwd: this.effectiveCwd, log: turnLog }) : null;
     const adapters = [];
     if (this.opts.claudeCodeAvailable?.() ?? true) {
       this.containment = createTurnContainment(this.turnId, {
-        log: (msg, meta) => turnLog.debug(meta ?? {}, msg)
+        log: (msg, meta) => turnLog.debug(meta ?? {}, msg),
+        // CT1679: a group outside the runner's own is reported, so a launcher
+        // can stop it if the runner dies without reaping it.
+        ...this.opts.inRunner?.onProcessGroup ? { onProcessGroup: this.opts.inRunner.onProcessGroup } : {}
       });
       const containment = this.containment;
       adapters.push(
@@ -9480,20 +9978,43 @@ var TurnExecution = class {
           onWarn,
           augmentOptions: (options) => ({
             ...options,
-            spawnClaudeCodeProcess: (spawnOptions) => containment.spawn(spawnOptions)
+            spawnClaudeCodeProcess: (spawnOptions) => containment.spawn(
+              sandbox ? { ...spawnOptions, ...sandbox.wrap(spawnOptions.command, spawnOptions.args) } : spawnOptions
+            )
           })
         })
       );
     }
     if (this.opts.opencodeServerUrl) {
-      adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
+      const serverUrl = this.opts.opencodeServerUrl;
+      adapters.push(
+        createOpencodeAdapter(
+          // CT1679: the transport's per-server turn mutex is per process; in a
+          // runner the turn also holds the device-wide lock every runner shares.
+          this.opts.inRunner ? {
+            transport: this.opts.inRunner.opencodeTransport(serverUrl),
+            onWarn
+          } : { serverUrl, onWarn }
+        )
+      );
     }
     if (this.opts.codexAvailable?.() ?? false) {
+      const inRunner = this.opts.inRunner;
+      const codexBinary = sandbox || inRunner ? (this.opts.resolveBundled ?? resolveBundledBinary)("codex").path : null;
+      let codexPath = codexBinary && sandbox ? sandbox.executableFor(codexBinary) : codexBinary;
+      if (codexPath && inRunner) {
+        this.containment ??= createTurnContainment(this.turnId, {
+          log: (msg, meta) => turnLog.debug(meta ?? {}, msg),
+          ...this.opts.inRunner?.onProcessGroup ? { onProcessGroup: this.opts.inRunner.onProcessGroup } : {}
+        });
+        codexPath = inRunner.codexExecutable(codexPath, this.containment);
+      }
       adapters.push(
         createCodexAdapter({
           enabled: true,
           onWarn,
-          writeInstructionsFile: writeCodexInstructionsFile
+          writeInstructionsFile: writeCodexInstructionsFile,
+          ...codexPath ? { transport: createSdkCodexTransport({ codexPathOverride: codexPath }) } : {}
         })
       );
     }
@@ -10030,6 +10551,24 @@ var Dispatcher = class {
       notifyStart: (info) => this.notifyStart(info),
       notifyEnd: (info) => this.notifyEnd(info)
     };
+    if (this.opts.runner) {
+      return runTurnInRunner(
+        this.opts,
+        this.opts.runner,
+        {
+          registerAbort: supervisor.registerAbort,
+          releaseAbort: supervisor.releaseAbort,
+          sessionWriteNoticeClaimed: () => this.sessionWriteNotified.has(key),
+          markSessionWriteNotice: () => {
+            this.sessionWriteNotified.add(key);
+          },
+          notifyStart: supervisor.notifyStart,
+          notifyEnd: supervisor.notifyEnd
+        },
+        payload,
+        { turnId: opts.turnId ?? randomUUID4(), resumed: opts.resumed === true }
+      );
+    }
     return new TurnExecution(this.opts, supervisor, payload, opts).run();
   }
   // SJ383: cancel a specific (conversation, agent) run if one is in flight in
@@ -10048,6 +10587,176 @@ var Dispatcher = class {
   }
 };
 
+// src/providers/local-process.ts
+import { spawn as spawn6 } from "child_process";
+import { constants } from "os";
+var DEFAULT_KILL_GRACE_MS = 3e4;
+var DEFAULT_REAP_GRACE_MS = 3e3;
+function exitCode(code, signal) {
+  if (code !== null) return code;
+  const signum = signal ? constants.signals[signal] : void 0;
+  return signum !== void 0 ? 128 + signum : 1;
+}
+function createLocalProcessProvider(opts = {}) {
+  const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+  const spawnFn = opts.spawnFn ?? spawn6;
+  const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
+  const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
+  const groupAlive = (pgid) => {
+    try {
+      killFn(-pgid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const signalGroup = (pgid, signal) => {
+    try {
+      killFn(-pgid, signal);
+    } catch {
+    }
+  };
+  return {
+    name: "local-process",
+    async acquire(attempt) {
+      return { provider: "local-process", id: attempt.turnId };
+    },
+    exec(_handle, argv, env, { signal, stdin }) {
+      const [command, ...args] = argv;
+      if (!command) throw new Error("local-process: exec needs a command");
+      const child = spawnFn(command, args, {
+        env: { ...env },
+        stdio: ["pipe", "pipe", "pipe"],
+        detached: process.platform !== "win32"
+      });
+      child.stdin?.on("error", () => {
+      });
+      if (stdin) child.stdin?.write(stdin);
+      const exit = new Promise((resolve2) => {
+        let settled = false;
+        const done = (code) => {
+          if (settled) return;
+          settled = true;
+          signal.removeEventListener("abort", stop);
+          if (forceTimer) clearTimeout(forceTimer);
+          resolve2(code);
+        };
+        let forceTimer;
+        const stop = () => {
+          child.kill("SIGTERM");
+          forceTimer = setTimeout(() => child.kill("SIGKILL"), killGraceMs);
+          forceTimer.unref?.();
+        };
+        child.once("error", () => done(1));
+        child.once("close", (code, sig) => done(exitCode(code, sig)));
+        if (signal.aborted) stop();
+        else signal.addEventListener("abort", stop, { once: true });
+      });
+      if (!child.stdout || !child.stderr || !child.stdin)
+        throw new Error("local-process: runner stdio missing");
+      const pid = child.pid;
+      return {
+        exit,
+        ...pid !== void 0 ? { pid } : {},
+        stdout: child.stdout,
+        stderr: child.stderr,
+        stdin: child.stdin,
+        async reap(groups) {
+          if (process.platform === "win32") return;
+          const targets = [.../* @__PURE__ */ new Set([...pid !== void 0 ? [pid] : [], ...groups])].filter(
+            groupAlive
+          );
+          if (!targets.length) return;
+          for (const pgid of targets) signalGroup(pgid, "SIGTERM");
+          await new Promise((resolve2) => setTimeout(resolve2, reapGraceMs));
+          for (const pgid of targets.filter(groupAlive)) signalGroup(pgid, "SIGKILL");
+        }
+      };
+    },
+    async release() {
+    }
+  };
+}
+
+// src/runner/device-locks.ts
+var DeviceLocks = class {
+  holders = /* @__PURE__ */ new Map();
+  queues = /* @__PURE__ */ new Map();
+  // `owner` is unique across the device; `grant` is called once, when it holds.
+  request(key, owner, grant) {
+    if (!this.holders.has(key)) {
+      this.holders.set(key, owner);
+      grant();
+      return;
+    }
+    const queue = this.queues.get(key) ?? [];
+    queue.push({ owner, grant });
+    this.queues.set(key, queue);
+  }
+  // Gives back what `owner` holds and withdraws what it is waiting for.
+  release(owner) {
+    for (const [key, queue] of this.queues) {
+      const rest = queue.filter((w) => w.owner !== owner);
+      if (rest.length) this.queues.set(key, rest);
+      else this.queues.delete(key);
+    }
+    for (const [key, holder] of [...this.holders]) {
+      if (holder !== owner) continue;
+      this.holders.delete(key);
+      this.handOn(key);
+    }
+  }
+  // What owners starting with `prefix` hold, by key — one runner's, when it
+  // exits, so the launcher can decide which it may give back at once.
+  heldBy(prefix) {
+    return [...this.holders].filter(([, owner]) => owner.startsWith(prefix)).map(([key, owner]) => ({ key, owner }));
+  }
+  // Withdraws every request still waiting from owners starting with `prefix`,
+  // leaving what they hold.
+  withdraw(prefix) {
+    for (const [key, queue] of this.queues) {
+      const rest = queue.filter((w) => !w.owner.startsWith(prefix));
+      if (rest.length) this.queues.set(key, rest);
+      else this.queues.delete(key);
+    }
+  }
+  holder(key) {
+    return this.holders.get(key);
+  }
+  handOn(key) {
+    const queue = this.queues.get(key);
+    const next = queue?.shift();
+    if (!queue?.length) this.queues.delete(key);
+    if (!next) return;
+    this.holders.set(key, next.owner);
+    next.grant();
+  }
+};
+
+// src/runner/harness-sandbox.ts
+import { chmodSync as chmodSync5, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir3, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
+import { join as join15 } from "path";
+import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+function osSandboxUsable(log) {
+  if (!SandboxManager.isSupportedPlatform()) {
+    log.warn(
+      { platform: process.platform },
+      'runners: sandbox "os" is not available on this platform; turns run unsandboxed'
+    );
+    return false;
+  }
+  const deps = SandboxManager.checkDependencies();
+  if (deps.errors.length) {
+    log.warn(
+      { errors: deps.errors },
+      'runners: sandbox "os" is missing what it needs on this host; turns run unsandboxed'
+    );
+    return false;
+  }
+  return true;
+}
+
 // src/opencode-models.ts
 var OPENCODE_RUNTIME = "opencode";
 function mapOpencodeProviders(json) {
@@ -10127,14 +10836,14 @@ var DispatchClaims = class {
 // src/outbox.ts
 import {
   existsSync as existsSync11,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
   renameSync as renameSync4,
-  rmSync as rmSync7,
-  writeFileSync as writeFileSync6
+  rmSync as rmSync8,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -10147,25 +10856,25 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join15(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join16(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join15(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
   // per-workspace bounds.
   persist(entry) {
     const dir2 = this.dir();
-    mkdirSync9(dir2, { recursive: true });
+    mkdirSync10(dir2, { recursive: true });
     const target = this.fileFor(entry.turnId, entry.seq);
     const tmp = `${target}.${process.pid}.tmp`;
     try {
-      writeFileSync6(tmp, JSON.stringify(entry) + "\n", "utf8");
+      writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
       renameSync4(tmp, target);
     } catch (err) {
       try {
-        rmSync7(tmp, { force: true });
+        rmSync8(tmp, { force: true });
       } catch {
       }
       this.log?.warn(
@@ -10192,7 +10901,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join15(dir2, name);
+      const full = join16(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -10242,7 +10951,7 @@ var Outbox = class {
   // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
   remove(turnId, seq) {
     try {
-      rmSync7(this.fileFor(turnId, seq), { force: true });
+      rmSync8(this.fileFor(turnId, seq), { force: true });
     } catch {
     }
   }
@@ -10261,7 +10970,7 @@ var Outbox = class {
       "A saved update is unreadable and couldn't be delivered. Check the conversation for missing replies."
     );
     try {
-      rmSync7(full, { force: true });
+      rmSync8(full, { force: true });
     } catch {
     }
   }
@@ -10295,53 +11004,6 @@ var Outbox = class {
   }
 };
 
-// src/run-config.ts
-import { z as z15 } from "zod";
-var mcpStdioServerSchema = z15.object({
-  type: z15.literal("stdio").optional(),
-  command: z15.string().min(1),
-  args: z15.array(z15.string()).optional(),
-  env: z15.record(z15.string(), z15.string()).optional()
-});
-var mcpHttpServerSchema = z15.object({
-  type: z15.literal("http"),
-  url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
-});
-var mcpSseServerSchema = z15.object({
-  type: z15.literal("sse"),
-  url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
-});
-var mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-var thinkingConfigSchema = z15.discriminatedUnion("type", [
-  z15.object({ type: z15.literal("adaptive") }),
-  z15.object({ type: z15.literal("enabled"), budgetTokens: z15.number().int().positive().optional() }),
-  z15.object({ type: z15.literal("disabled") })
-]);
-var effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
-var runConfigSchema = z15.object({
-  // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
-  // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
-  // is the locked surface. Kept in lockstep with `@cabane/shared`'s
-  // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
-  // stripped, so an older companion riding a newer server never rejects the config).
-  hostAccess: z15.boolean().optional(),
-  mcpServers: z15.record(z15.string(), mcpServerDefSchema).optional(),
-  model: z15.string().min(1).optional(),
-  thinking: thinkingConfigSchema.optional(),
-  effort: effortSchema.optional()
-});
-var EMPTY_RUN_CONFIG = {};
-function parseRunConfig(raw, onWarn) {
-  const result = runConfigSchema.safeParse(raw ?? {});
-  if (result.success) return result.data;
-  onWarn?.(
-    `run-config from Cabane didn't parse (${result.error.issues.map((i) => i.path.join(".") || "(root)").join(", ")}) \u2014 falling back to the locked assistant default`
-  );
-  return EMPTY_RUN_CONFIG;
-}
-
 // src/sse.ts
 import { createParser } from "eventsource-parser";
 var MAX_BACKOFF_MS = 3e4;
@@ -10506,6 +11168,8 @@ var CompanionSupervisor = class {
   exitFn;
   reexecFn;
   dispatcherFactory;
+  runnerCommand;
+  providerForRunners;
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
@@ -10550,6 +11214,8 @@ var CompanionSupervisor = class {
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
     this.dispatcherFactory = opts.dispatcherFactory;
+    if (opts.runnerCommand) this.runnerCommand = opts.runnerCommand;
+    if (opts.runnerProvider) this.providerForRunners = opts.runnerProvider;
     this.unrunnableRetryDelaysMs = opts.unrunnableRetryDelaysMs ?? DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS;
     this.latchBootBundledState();
   }
@@ -10995,6 +11661,21 @@ var CompanionSupervisor = class {
       );
     }
   }
+  // CT1679: the locks every runner on this device shares, held here.
+  runnerLocks = new DeviceLocks();
+  // CT1679: `runners.sandbox`, checked against this host once. A host that
+  // can't make the sandbox says so once and runs its turns unwrapped.
+  sandboxUsable;
+  runnerSandbox() {
+    if (this.config.runners?.sandbox !== "os") return "none";
+    this.sandboxUsable ??= osSandboxUsable(this.log);
+    return this.sandboxUsable ? "os" : "none";
+  }
+  // CT1679: one provider for the device, built on first use.
+  runnerProvider() {
+    this.providerForRunners ??= createLocalProcessProvider();
+    return this.providerForRunners;
+  }
   buildDispatcher(ctx) {
     const local = localAgentConfig(this.config, {
       agentId: ctx.agentId,
@@ -11045,7 +11726,17 @@ var CompanionSupervisor = class {
       observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
       transcriptDir: transcriptsDir(),
       // CT566: the shared connector-health memory the turn records into on settle.
-      connectorHealth: this.connectorHealth
+      connectorHealth: this.connectorHealth,
+      ...runnersEnabled(this.config) ? {
+        runner: {
+          provider: this.runnerProvider(),
+          command: this.runnerCommand ?? selfRunnerCommand(),
+          ...this.config.deviceToken ? { deviceToken: this.config.deviceToken } : {},
+          connectorHealth: this.connectorHealth,
+          locks: this.runnerLocks,
+          sandbox: this.runnerSandbox()
+        }
+      } : {}
     });
   }
   async removeWorkspace(workspaceId) {
@@ -11336,7 +12027,7 @@ var CompanionSupervisor = class {
       );
     }
     const resumedTurnId = recoveredTurnId ?? (dispatchId ? turnIdForEvent(workspaceId, dispatchId) : null);
-    const turnId = resumedTurnId ?? randomUUID4();
+    const turnId = resumedTurnId ?? randomUUID5();
     if (dispatchId) {
       const liveTurnIds = rememberTurnId(workspaceId, dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
@@ -11641,9 +12332,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn6 }) => {
+  void import("child_process").then(({ spawn: spawn7 }) => {
     try {
-      const child = spawn6(process.execPath, process.argv.slice(1), {
+      const child = spawn7(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -11713,22 +12404,22 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync9, rmSync as rmSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync9, writeFileSync as writeFileSync8 } from "fs";
+import { join as join17 } from "path";
 function crashMarkerPath() {
-  return join16(cabaneDir(), "last-error.json");
+  return join17(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
-    mkdirSync10(cabaneDir(), { recursive: true });
-    writeFileSync7(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
+    mkdirSync11(cabaneDir(), { recursive: true });
+    writeFileSync8(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
   } catch {
   }
 }
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync12(path)) rmSync8(path, { force: true });
+    if (existsSync12(path)) rmSync9(path, { force: true });
   } catch {
   }
 }
@@ -11771,7 +12462,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID5();
+  const instanceId = randomUUID6();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();