@cabane/companion 0.6.122 → 0.6.123

package/dist/cli.js

@@ -1334,6 +1334,13 @@ var init_api = __esm({
           (e) => e.turnId === turnId && e.kind === "message" && e.body?.kind !== "runtime_notice"
         );
       }
+      // CT1680: the launcher mints the runner credential for one dispatch, on its
+      // PAT and from its device, and hands it to the runner in place of both. A
+      // retry is safe: the server returns the same runner id and retires the
+      // credential the lost response carried.
+      mintRunnerCredential(body) {
+        return this.request("POST", "/api/agent/runner-credentials", body, { retry: true });
+      }
       // Read the skip intent recorded by the URL turn-control MCP surface.
       // Codex/opencode use this server-side state; settle imports skipped/skipReason
       // into the same local skip state used by claude-code's in-process tools.
@@ -7049,8 +7056,7 @@ function parseRunnerInput(env, stdin) {
   const credentials = credentialsSchema.parse(JSON.parse(stdin || "{}"));
   return {
     baseUrl: required(env, RUNNER_ENV.url),
-    agentToken: credentials.agentToken,
-    ...credentials.deviceToken ? { deviceToken: credentials.deviceToken } : {},
+    credential: credentials.credential,
     dispatch,
     turnId: required(env, RUNNER_ENV.turnId),
     resumed: env[RUNNER_ENV.resumed] === "1",
@@ -7067,13 +7073,7 @@ function runnerEnv(input) {
   };
 }
 function runnerStdin(input) {
-  return `${JSON.stringify({
-    // Phase 1 (CT1680) replaces the agent PAT with a runner credential bound to
-    // this one dispatch; until then the child holds what the in-process turn
-    // held, on the same machine.
-    agentToken: input.agentToken,
-    ...input.deviceToken ? { deviceToken: input.deviceToken } : {}
-  })}
+  return `${JSON.stringify({ credential: input.credential })}
 `;
 }
 function encodeLauncherMessage(message) {
@@ -7157,7 +7157,10 @@ var init_protocol = __esm({
       connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
       // True when this (conversation, agent) pair was already told its session
       // could not be saved: the notice is once per pair, not once per process.
-      sessionWriteNoticeClaimed: z14.boolean()
+      sessionWriteNoticeClaimed: z14.boolean(),
+      // CT1680: the runner's identity, minted with its credential. The start
+      // PATCH carries it so the lease knows which runner holds the span.
+      runnerId: z14.string()
     });
     dispatchSchema = z14.object({
       type: z14.literal("device:dispatch_requested"),
@@ -7168,8 +7171,7 @@ var init_protocol = __esm({
       episode: z14.number().int().optional()
     });
     credentialsSchema = z14.object({
-      agentToken: z14.string().min(1),
-      deviceToken: z14.string().min(1).optional()
+      credential: z14.string().startsWith("cabrn_")
     });
   }
 });
@@ -7192,8 +7194,9 @@ function healthSnapshot(store) {
   }
   return out;
 }
-function runnerSpec(opts, launch, duties) {
+function runnerSpec(opts, launch, duties, runnerId) {
   return {
+    runnerId,
     ...opts.deviceId ? { deviceId: opts.deviceId } : {},
     bootId,
     workspaceId: opts.workspaceId,
@@ -7274,6 +7277,43 @@ function giveBackLocks(locks, prefix, remote, launch, log) {
     })();
   }
 }
+async function mintForRunner(opts, payload, handleOpts, signal, log) {
+  try {
+    const minted = await opts.api.mintRunnerCredential({
+      conversationId: payload.conversationId,
+      messageId: payload.messageId,
+      ...payload.episode !== void 0 ? { episode: payload.episode } : {},
+      // The one turn the credential will operate: this run's.
+      turnId: handleOpts.turnId
+    });
+    return { ok: true, credential: minted.credential, runnerId: minted.runnerId };
+  } catch (err) {
+    if (signal.aborted) return { ok: false, reason: "cancelled" };
+    const status2 = err instanceof ApiError ? err.status : 0;
+    if (status2 === 404) return { ok: false, reason: "runner_credential_not_found" };
+    if (status2 === 409 && apiErrorCode(err) === "dispatch_not_admitted")
+      return { ok: false, reason: "runner_credential_not_admitted" };
+    log.warn(apiErrorLogFields(err), "runner: couldn't get a credential for the turn's runner");
+    const reason = `fetch_failed: ${describeError(err)}`;
+    return { ok: false, reason, errorReason: reason };
+  }
+}
+async function settleUnstarted(opts, payload, turnId, errorReason, log) {
+  try {
+    await opts.api.setActiveRun(opts.workspaceId, payload.conversationId, payload.agentId, {
+      activeRunStartedAt: null,
+      turnId,
+      outcome: "failed",
+      ...errorReason ? { errorReason: errorReason.slice(0, 200) } : {},
+      readThrough: payload.messageId
+    });
+  } catch (err) {
+    log.warn(
+      { ...apiErrorLogFields(err), turnId },
+      "Couldn't update the turn's status in Cabane. Check the conversation before trying again."
+    );
+  }
+}
 async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const startedAt = Date.now();
   const { turnId } = handleOpts;
@@ -7297,6 +7337,15 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     agentId: payload.agentId,
     turnId
   };
+  const minted = await mintForRunner(opts, payload, handleOpts, controller.signal, log);
+  if (!minted.ok) {
+    controller.signal.removeEventListener("abort", forwardStop);
+    duties.releaseAbort(turnId, controller);
+    const durationMs2 = Date.now() - startedAt;
+    await settleUnstarted(opts, payload, turnId, minted.errorReason, log);
+    duties.notifyEnd({ id: payload.messageId, ok: false, durationMs: durationMs2, reason: minted.reason });
+    return { ok: false, durationMs: durationMs2, reason: minted.reason };
+  }
   let result;
   let thrown;
   let code;
@@ -7314,12 +7363,11 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     }
     const input = {
       baseUrl: opts.baseUrl,
-      agentToken: opts.credential,
-      ...launch.deviceToken ? { deviceToken: launch.deviceToken } : {},
+      credential: minted.credential,
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
-      spec: runnerSpec(opts, launch, duties)
+      spec: runnerSpec(opts, launch, duties, minted.runnerId)
     };
     Object.assign(env, runnerEnv(input));
     const running = launch.provider.exec(handle, launch.command, env, {
@@ -7431,6 +7479,14 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
       "Couldn't update the turn's status in Cabane. Check the conversation before trying again."
     );
   }
+  await launch.reportRunnerGone?.({
+    workspaceId: opts.workspaceId,
+    conversationId: payload.conversationId,
+    agentId: payload.agentId,
+    messageId: payload.messageId,
+    runnerId: minted.runnerId,
+    reason: "exited"
+  });
   if (thrown !== void 0) throw new Error(thrown);
   log.warn({ turnId, code }, "runner: exited without reporting a result");
   duties.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
@@ -7442,6 +7498,7 @@ var init_launch = __esm({
     "use strict";
     init_opencode_lock();
     init_api_error_shape();
+    init_errors();
     init_boot_id();
     init_turn_containment();
     init_protocol();
@@ -8769,14 +8826,15 @@ var init_turn_execution = __esm({
             const reportPreparing = (phase) => {
               preparing ??= { id: `prepare:${randomUUID3()}`, seq: this.nextSeq() };
               const { id, seq } = preparing;
-              void this.opts.api.reportActivity(workspaceId, payload.conversationId, payload.agentId, {
+              const body = {
                 turnId,
                 toolUseId: id,
                 toolName: PREPARING_TOOL_NAME,
                 summary: "",
                 phase,
                 seq
-              }).catch((err) => {
+              };
+              void this.opts.api.reportActivity(workspaceId, payload.conversationId, payload.agentId, body).catch((err) => {
                 turnLog.debug(
                   { err: err instanceof Error ? err.message : String(err), phase },
                   "dispatcher: preparing-activity report failed (continuing with the hook)"
@@ -8852,6 +8910,8 @@ var init_turn_execution = __esm({
             // CT1679: a runner leases under its launcher's boot id — the one the
             // device heartbeats — or the lost-run sweep reads it as a restart.
             bootId: this.opts.inRunner?.bootId ?? bootId,
+            // CT1680: the runner holding the span, beside the device's boot id.
+            ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
             // CT1380: the durable record that this turn resumed, and from where.
             ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
             // CT1454: the issuance the context THIS attempt runs on came from. Read
@@ -9219,7 +9279,10 @@ var init_turn_execution = __esm({
                     workspaceId,
                     payload.conversationId,
                     payload.agentId,
-                    { agentSessionId: event.state }
+                    // CT1680: named for its turn, which a runner credential
+                    // requires once its start is admitted; the server then binds
+                    // the capture to that turn's attempt rather than the pair's.
+                    { agentSessionId: event.state, turnId }
                   );
                 } catch (err) {
                   const status2 = err instanceof ApiError ? err.status : void 0;
@@ -10028,8 +10091,7 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
   const outbox = new Outbox(spec.agentId, log);
   const api = new CabaneApi({
     baseUrl: input.baseUrl,
-    token: input.agentToken,
-    ...input.deviceToken ? { deviceToken: input.deviceToken } : {},
+    token: input.credential,
     outbox,
     log
   });
@@ -10051,7 +10113,7 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
     workspaceSlug: spec.workspaceSlug,
     agentId: spec.agentId,
     agentUsername: spec.agentUsername,
-    credential: input.agentToken,
+    credential: input.credential,
     local: spec.local,
     runConfig: spec.runConfig,
     log,
@@ -10067,6 +10129,7 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
     connectorHealth,
     inRunner: {
       bootId: spec.bootId,
+      runnerId: spec.runnerId,
       opencodeTransport: (serverUrl) => runnerOpencodeTransport(
         serverUrl,
         acquireLock,
@@ -13433,7 +13496,7 @@ var CompanionSupervisor = class {
         runner: {
           provider: this.runnerProvider(),
           command: this.runnerCommand ?? selfRunnerCommand(),
-          ...this.config.deviceToken ? { deviceToken: this.config.deviceToken } : {},
+          reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
           sandbox: this.runnerSandbox()
@@ -13623,6 +13686,33 @@ var CompanionSupervisor = class {
     );
     return false;
   }
+  // CT1680: a runner is gone without having settled its turn. Same bounded
+  // retry as the unrunnable report above, on the device credential, which is
+  // the one the launcher still holds whatever became of the runner.
+  async reportRunnerGone(report) {
+    if (!this.deviceApi) return;
+    let lastErr;
+    for (const wait of this.unrunnableRetryDelaysMs) {
+      if (this.stopped) return;
+      if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+      try {
+        await this.deviceApi.reportDispatchDrop(report);
+        return;
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    this.log.error(
+      {
+        workspaceId: report.workspaceId,
+        conversationId: report.conversationId,
+        agentId: report.agentId,
+        runnerId: report.runnerId,
+        err: lastErr instanceof Error ? lastErr.message : String(lastErr)
+      },
+      "Couldn't tell Cabane a turn's runner stopped; its credential expires on its own."
+    );
+  }
   // Pull-on-miss for the assignment-change race: a dispatch arrived for an agent
   // we don't yet run. If it's addressed to THIS device, the assignment just
   // changed under us (the poll hasn't caught it) — force a fresh assignments pull

package/dist/runtime.js

@@ -2516,6 +2516,13 @@ var CabaneApi = class {
       (e) => e.turnId === turnId && e.kind === "message" && e.body?.kind !== "runtime_notice"
     );
   }
+  // CT1680: the launcher mints the runner credential for one dispatch, on its
+  // PAT and from its device, and hands it to the runner in place of both. A
+  // retry is safe: the server returns the same runner id and retires the
+  // credential the lost response carried.
+  mintRunnerCredential(body) {
+    return this.request("POST", "/api/agent/runner-credentials", body, { retry: true });
+  }
   // Read the skip intent recorded by the URL turn-control MCP surface.
   // Codex/opencode use this server-side state; settle imports skipped/skipReason
   // into the same local skip state used by claude-code's in-process tools.
@@ -8243,7 +8250,10 @@ var runnerSpecSchema = z14.object({
   connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
   // True when this (conversation, agent) pair was already told its session
   // could not be saved: the notice is once per pair, not once per process.
-  sessionWriteNoticeClaimed: z14.boolean()
+  sessionWriteNoticeClaimed: z14.boolean(),
+  // CT1680: the runner's identity, minted with its credential. The start
+  // PATCH carries it so the lease knows which runner holds the span.
+  runnerId: z14.string()
 });
 var dispatchSchema = z14.object({
   type: z14.literal("device:dispatch_requested"),
@@ -8254,8 +8264,7 @@ var dispatchSchema = z14.object({
   episode: z14.number().int().optional()
 });
 var credentialsSchema = z14.object({
-  agentToken: z14.string().min(1),
-  deviceToken: z14.string().min(1).optional()
+  credential: z14.string().startsWith("cabrn_")
 });
 function runnerEnv(input) {
   return {
@@ -8267,13 +8276,7 @@ function runnerEnv(input) {
   };
 }
 function runnerStdin(input) {
-  return `${JSON.stringify({
-    // Phase 1 (CT1680) replaces the agent PAT with a runner credential bound to
-    // this one dispatch; until then the child holds what the in-process turn
-    // held, on the same machine.
-    agentToken: input.agentToken,
-    ...input.deviceToken ? { deviceToken: input.deviceToken } : {}
-  })}
+  return `${JSON.stringify({ credential: input.credential })}
 `;
 }
 function encodeLauncherMessage(message) {
@@ -8309,8 +8312,9 @@ function healthSnapshot(store) {
   }
   return out;
 }
-function runnerSpec(opts, launch, duties) {
+function runnerSpec(opts, launch, duties, runnerId) {
   return {
+    runnerId,
     ...opts.deviceId ? { deviceId: opts.deviceId } : {},
     bootId,
     workspaceId: opts.workspaceId,
@@ -8399,6 +8403,43 @@ function giveBackLocks(locks, prefix, remote, launch, log) {
     })();
   }
 }
+async function mintForRunner(opts, payload, handleOpts, signal, log) {
+  try {
+    const minted = await opts.api.mintRunnerCredential({
+      conversationId: payload.conversationId,
+      messageId: payload.messageId,
+      ...payload.episode !== void 0 ? { episode: payload.episode } : {},
+      // The one turn the credential will operate: this run's.
+      turnId: handleOpts.turnId
+    });
+    return { ok: true, credential: minted.credential, runnerId: minted.runnerId };
+  } catch (err) {
+    if (signal.aborted) return { ok: false, reason: "cancelled" };
+    const status = err instanceof ApiError ? err.status : 0;
+    if (status === 404) return { ok: false, reason: "runner_credential_not_found" };
+    if (status === 409 && apiErrorCode(err) === "dispatch_not_admitted")
+      return { ok: false, reason: "runner_credential_not_admitted" };
+    log.warn(apiErrorLogFields(err), "runner: couldn't get a credential for the turn's runner");
+    const reason = `fetch_failed: ${describeError(err)}`;
+    return { ok: false, reason, errorReason: reason };
+  }
+}
+async function settleUnstarted(opts, payload, turnId, errorReason, log) {
+  try {
+    await opts.api.setActiveRun(opts.workspaceId, payload.conversationId, payload.agentId, {
+      activeRunStartedAt: null,
+      turnId,
+      outcome: "failed",
+      ...errorReason ? { errorReason: errorReason.slice(0, 200) } : {},
+      readThrough: payload.messageId
+    });
+  } catch (err) {
+    log.warn(
+      { ...apiErrorLogFields(err), turnId },
+      "Couldn't update the turn's status in Cabane. Check the conversation before trying again."
+    );
+  }
+}
 async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const startedAt = Date.now();
   const { turnId } = handleOpts;
@@ -8422,6 +8463,15 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     agentId: payload.agentId,
     turnId
   };
+  const minted = await mintForRunner(opts, payload, handleOpts, controller.signal, log);
+  if (!minted.ok) {
+    controller.signal.removeEventListener("abort", forwardStop);
+    duties.releaseAbort(turnId, controller);
+    const durationMs2 = Date.now() - startedAt;
+    await settleUnstarted(opts, payload, turnId, minted.errorReason, log);
+    duties.notifyEnd({ id: payload.messageId, ok: false, durationMs: durationMs2, reason: minted.reason });
+    return { ok: false, durationMs: durationMs2, reason: minted.reason };
+  }
   let result;
   let thrown;
   let code;
@@ -8439,12 +8489,11 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     }
     const input = {
       baseUrl: opts.baseUrl,
-      agentToken: opts.credential,
-      ...launch.deviceToken ? { deviceToken: launch.deviceToken } : {},
+      credential: minted.credential,
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
-      spec: runnerSpec(opts, launch, duties)
+      spec: runnerSpec(opts, launch, duties, minted.runnerId)
     };
     Object.assign(env, runnerEnv(input));
     const running = launch.provider.exec(handle, launch.command, env, {
@@ -8556,6 +8605,14 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
       "Couldn't update the turn's status in Cabane. Check the conversation before trying again."
     );
   }
+  await launch.reportRunnerGone?.({
+    workspaceId: opts.workspaceId,
+    conversationId: payload.conversationId,
+    agentId: payload.agentId,
+    messageId: payload.messageId,
+    runnerId: minted.runnerId,
+    reason: "exited"
+  });
   if (thrown !== void 0) throw new Error(thrown);
   log.warn({ turnId, code }, "runner: exited without reporting a result");
   duties.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
@@ -9783,14 +9840,15 @@ var TurnExecution = class {
         const reportPreparing = (phase) => {
           preparing ??= { id: `prepare:${randomUUID3()}`, seq: this.nextSeq() };
           const { id, seq } = preparing;
-          void this.opts.api.reportActivity(workspaceId, payload.conversationId, payload.agentId, {
+          const body = {
             turnId,
             toolUseId: id,
             toolName: PREPARING_TOOL_NAME,
             summary: "",
             phase,
             seq
-          }).catch((err) => {
+          };
+          void this.opts.api.reportActivity(workspaceId, payload.conversationId, payload.agentId, body).catch((err) => {
             turnLog.debug(
               { err: err instanceof Error ? err.message : String(err), phase },
               "dispatcher: preparing-activity report failed (continuing with the hook)"
@@ -9866,6 +9924,8 @@ var TurnExecution = class {
         // CT1679: a runner leases under its launcher's boot id — the one the
         // device heartbeats — or the lost-run sweep reads it as a restart.
         bootId: this.opts.inRunner?.bootId ?? bootId,
+        // CT1680: the runner holding the span, beside the device's boot id.
+        ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
         // CT1380: the durable record that this turn resumed, and from where.
         ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT1454: the issuance the context THIS attempt runs on came from. Read
@@ -10233,7 +10293,10 @@ var TurnExecution = class {
                 workspaceId,
                 payload.conversationId,
                 payload.agentId,
-                { agentSessionId: event.state }
+                // CT1680: named for its turn, which a runner credential
+                // requires once its start is admitted; the server then binds
+                // the capture to that turn's attempt rather than the pair's.
+                { agentSessionId: event.state, turnId }
               );
             } catch (err) {
               const status = err instanceof ApiError ? err.status : void 0;
@@ -11731,7 +11794,7 @@ var CompanionSupervisor = class {
         runner: {
           provider: this.runnerProvider(),
           command: this.runnerCommand ?? selfRunnerCommand(),
-          ...this.config.deviceToken ? { deviceToken: this.config.deviceToken } : {},
+          reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
           sandbox: this.runnerSandbox()
@@ -11921,6 +11984,33 @@ var CompanionSupervisor = class {
     );
     return false;
   }
+  // CT1680: a runner is gone without having settled its turn. Same bounded
+  // retry as the unrunnable report above, on the device credential, which is
+  // the one the launcher still holds whatever became of the runner.
+  async reportRunnerGone(report) {
+    if (!this.deviceApi) return;
+    let lastErr;
+    for (const wait of this.unrunnableRetryDelaysMs) {
+      if (this.stopped) return;
+      if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+      try {
+        await this.deviceApi.reportDispatchDrop(report);
+        return;
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    this.log.error(
+      {
+        workspaceId: report.workspaceId,
+        conversationId: report.conversationId,
+        agentId: report.agentId,
+        runnerId: report.runnerId,
+        err: lastErr instanceof Error ? lastErr.message : String(lastErr)
+      },
+      "Couldn't tell Cabane a turn's runner stopped; its credential expires on its own."
+    );
+  }
   // Pull-on-miss for the assignment-change race: a dispatch arrived for an agent
   // we don't yet run. If it's addressed to THIS device, the assignment just
   // changed under us (the poll hasn't caught it) — force a fresh assignments pull

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.122",
+  "version": "0.6.123",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",