@cabane/companion 0.6.124 → 0.6.125

package/dist/runtime.js

@@ -1,5 +1,5 @@
 // src/runtime.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // src/config.ts
 import {
@@ -360,8 +360,38 @@ var companionConfigSchema = z2.object({
   // configuration in its own right rather than a degraded one.
   runners: z2.object({
     enabled: z2.boolean().optional(),
-    provider: z2.literal("local-process").optional(),
-    sandbox: z2.enum(["os", "none"]).optional()
+    provider: z2.enum(["local-process", "docker"]).optional(),
+    sandbox: z2.enum(["os", "none"]).optional(),
+    // CT1681: the `docker` provider — a container per conversation and agent,
+    // from one image, on a network whose only way out is an allow-listed proxy.
+    docker: z2.object({
+      // The base image a container runs. Default: the one this companion
+      // builds from its own Dockerfile on first use. One named here must
+      // have that one's layout (the `runner` user, `cabane-companion` on
+      // PATH reading `CABANE_COMPANION_ROOT`).
+      image: z2.string().min(1).optional(),
+      // The companion install mounted into every container. Default, on
+      // Linux: this companion's own. Needed for one run from a checkout
+      // (a `pnpm --filter @cabane/companion deploy --prod <dir>`).
+      companionDir: z2.string().min(1).optional(),
+      // Hosts a turn may reach besides the Cabane API, the model providers
+      // and the git host. `*.example.com` matches any subdomain.
+      egressAllow: z2.array(z2.string().min(1)).optional(),
+      // Keep a turn's container between turns and start it again for the
+      // next one. Off by default: the container goes after every turn and
+      // the runtime's session files are restored into the next.
+      keepContainers: z2.boolean().optional(),
+      // The Cabane URL as a container reaches it, for a device whose own
+      // `baseUrl` is a loopback address the container can't see.
+      apiUrl: z2.string().url().refine(isAllowedBaseUrl).optional(),
+      // Env set on each turn's runner, `${NAME}` resolved from secrets.json
+      // at exec: the runtime's own auth, which the image never carries.
+      env: z2.record(z2.string(), z2.string()).optional(),
+      // A git credential helper run on this device to answer the
+      // container's git for an allowed host, e.g. `!gh auth git-credential`.
+      // Absent: git's own configured helpers on this device.
+      gitCredentialHelper: z2.string().min(1).optional()
+    }).strict().optional()
   }).strict().optional()
 });
 function runnersEnabled(cfg) {
@@ -778,7 +808,8 @@ function buildCompanionManifest(opts) {
   return {
     runtimes,
     capabilities: { ...DEVICE_MANIFEST.capabilities },
-    runtimeIssues: opts.runtimeIssues ?? []
+    runtimeIssues: opts.runtimeIssues ?? [],
+    ...opts.runnerProvider ? { runner: { provider: opts.runnerProvider } } : {}
   };
 }
 function runtimeIssuesFor(gates) {
@@ -2294,7 +2325,7 @@ import { randomUUID } from "crypto";
 var bootId = randomUUID();
 
 // src/supervisor.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/api.ts
 var DEVICE_HEADER = "x-cabane-device";
@@ -3961,8 +3992,8 @@ function readThinking(runtimeOptions) {
 var CLAUDE_CODE_DEFAULT_MODEL_BARE = "default";
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep = model.indexOf("/");
-  const bare = sep === -1 || model.slice(0, sep) !== "anthropic" ? model : model.slice(sep + 1);
+  const sep2 = model.indexOf("/");
+  const bare = sep2 === -1 || model.slice(0, sep2) !== "anthropic" ? model : model.slice(sep2 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 
@@ -5313,9 +5344,9 @@ function readOpencodeDialect(runtimeOptions) {
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep = model.indexOf("/");
-  if (sep === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep), modelID: model.slice(sep + 1) };
+  const sep2 = model.indexOf("/");
+  if (sep2 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep2), modelID: model.slice(sep2 + 1) };
 }
 
 // packages/agent-runtime/src/opencode/run-spec.ts
@@ -5567,10 +5598,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep;
-      while ((sep = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep);
-        buf = buf.slice(sep + 2);
+      let sep2;
+      while ((sep2 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep2);
+        buf = buf.slice(sep2 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -6530,8 +6561,8 @@ function readCodexDialect(runtimeOptions) {
 // packages/agent-runtime/src/codex/model.ts
 var CODEX_DEFAULT_MODEL_BARES = /* @__PURE__ */ new Set(["default"]);
 function parseCodexModel(model) {
-  const sep = model.indexOf("/");
-  const bare = sep === -1 || model.slice(0, sep) !== "openai" ? model : model.slice(sep + 1);
+  const sep2 = model.indexOf("/");
+  const bare = sep2 === -1 || model.slice(0, sep2) !== "openai" ? model : model.slice(sep2 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 
@@ -8151,43 +8182,134 @@ function createTurnContainment(turnId, deps = {}) {
   };
 }
 
+// src/secrets.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { join as join10 } from "path";
+import { z as z13 } from "zod";
+var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function secretsPath() {
+  return join10(cabaneDir(), "secrets.json");
+}
+var secretStoreSchema = z13.record(z13.string(), z13.string());
+function loadSecretStore() {
+  const path = secretsPath();
+  if (!existsSync7(path)) return makeStore({});
+  let raw;
+  try {
+    raw = readFileSync6(path, "utf8");
+  } catch (err) {
+    throw new ConfigError(
+      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (raw.trim().length === 0) return makeStore({});
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ConfigError(
+      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
+    );
+  }
+  const result = secretStoreSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new ConfigError(
+      `${path} must be a flat object mapping secret names to string values (e.g. { "GITHUB_TOKEN": "ghp_\u2026" }).`
+    );
+  }
+  return makeStore(result.data);
+}
+function loadSecretStoreTolerant(onWarn) {
+  try {
+    return loadSecretStore();
+  } catch (err) {
+    onWarn?.(err instanceof Error ? err.message : String(err));
+    return makeStore({});
+  }
+}
+function makeStore(map) {
+  return {
+    get: (name) => map[name],
+    names: () => Object.keys(map).sort()
+  };
+}
+function requiredSecretNames(mcpServers) {
+  const names = /* @__PURE__ */ new Set();
+  for (const server of Object.values(mcpServers ?? {})) {
+    const bags = [
+      "env" in server ? server.env : void 0,
+      "headers" in server ? server.headers : void 0
+    ];
+    for (const bag of bags) {
+      for (const value of Object.values(bag ?? {})) {
+        for (const [, name] of value.matchAll(PLACEHOLDER_RE)) names.add(name);
+      }
+    }
+  }
+  return [...names].sort();
+}
+function resolveMcpSecrets(mcpServers, store) {
+  const missing = /* @__PURE__ */ new Set();
+  const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
+    const resolved = store.get(name);
+    if (resolved === void 0) {
+      missing.add(name);
+      return _match;
+    }
+    return resolved;
+  });
+  const mapBag = (bag) => {
+    const out = {};
+    for (const [k, v] of Object.entries(bag)) out[k] = interpolate(v);
+    return out;
+  };
+  const servers = {};
+  for (const [name, server] of Object.entries(mcpServers)) {
+    const next = { ...server };
+    if ("env" in next && next.env) next.env = mapBag(next.env);
+    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    servers[name] = next;
+  }
+  return { servers, missing: [...missing].sort() };
+}
+
 // src/runner/protocol.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/run-config.ts
-import { z as z13 } from "zod";
-var mcpStdioServerSchema = z13.object({
-  type: z13.literal("stdio").optional(),
-  command: z13.string().min(1),
-  args: z13.array(z13.string()).optional(),
-  env: z13.record(z13.string(), z13.string()).optional()
+import { z as z14 } from "zod";
+var mcpStdioServerSchema = z14.object({
+  type: z14.literal("stdio").optional(),
+  command: z14.string().min(1),
+  args: z14.array(z14.string()).optional(),
+  env: z14.record(z14.string(), z14.string()).optional()
 });
-var mcpHttpServerSchema = z13.object({
-  type: z13.literal("http"),
-  url: z13.string().url(),
-  headers: z13.record(z13.string(), z13.string()).optional()
+var mcpHttpServerSchema = z14.object({
+  type: z14.literal("http"),
+  url: z14.string().url(),
+  headers: z14.record(z14.string(), z14.string()).optional()
 });
-var mcpSseServerSchema = z13.object({
-  type: z13.literal("sse"),
-  url: z13.string().url(),
-  headers: z13.record(z13.string(), z13.string()).optional()
+var mcpSseServerSchema = z14.object({
+  type: z14.literal("sse"),
+  url: z14.string().url(),
+  headers: z14.record(z14.string(), z14.string()).optional()
 });
-var mcpServerDefSchema = z13.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-var thinkingConfigSchema = z13.discriminatedUnion("type", [
-  z13.object({ type: z13.literal("adaptive") }),
-  z13.object({ type: z13.literal("enabled"), budgetTokens: z13.number().int().positive().optional() }),
-  z13.object({ type: z13.literal("disabled") })
+var mcpServerDefSchema = z14.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+var thinkingConfigSchema = z14.discriminatedUnion("type", [
+  z14.object({ type: z14.literal("adaptive") }),
+  z14.object({ type: z14.literal("enabled"), budgetTokens: z14.number().int().positive().optional() }),
+  z14.object({ type: z14.literal("disabled") })
 ]);
-var effortSchema = z13.enum(["low", "medium", "high", "xhigh", "max"]);
-var runConfigSchema = z13.object({
+var effortSchema = z14.enum(["low", "medium", "high", "xhigh", "max"]);
+var runConfigSchema = z14.object({
   // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
   // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
   // is the locked surface. Kept in lockstep with `@cabane/shared`'s
   // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
   // stripped, so an older companion riding a newer server never rejects the config).
-  hostAccess: z13.boolean().optional(),
-  mcpServers: z13.record(z13.string(), mcpServerDefSchema).optional(),
-  model: z13.string().min(1).optional(),
+  hostAccess: z14.boolean().optional(),
+  mcpServers: z14.record(z14.string(), mcpServerDefSchema).optional(),
+  model: z14.string().min(1).optional(),
   thinking: thinkingConfigSchema.optional(),
   effort: effortSchema.optional()
 });
@@ -8215,56 +8337,64 @@ var RUNNER_ENV = {
   // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
   spec: "CABANE_RUNNER_SPEC"
 };
-var runtimeHealthSchema = z14.object({
-  quotaState: z14.enum(["ok", "limited", "auth_expired", "unknown"]),
-  limitedUntil: z14.string().nullable(),
-  lastError: z14.string().nullable()
+var runtimeHealthSchema = z15.object({
+  quotaState: z15.enum(["ok", "limited", "auth_expired", "unknown"]),
+  limitedUntil: z15.string().nullable(),
+  lastError: z15.string().nullable()
 });
-var runnerSpecSchema = z14.object({
-  deviceId: z14.string().optional(),
+var runnerSpecSchema = z15.object({
+  deviceId: z15.string().optional(),
   // The launcher's boot id: the one its heartbeat carries, so a runner's lease
   // matches the device that holds it.
-  bootId: z14.string(),
-  workspaceId: z14.string(),
-  workspaceSlug: z14.string(),
-  agentId: z14.string(),
-  agentUsername: z14.string(),
-  agentName: z14.string(),
+  bootId: z15.string(),
+  workspaceId: z15.string(),
+  workspaceSlug: z15.string(),
+  agentId: z15.string(),
+  agentUsername: z15.string(),
+  agentName: z15.string(),
   local: localAgentConfigSchema,
   runConfig: runConfigSchema,
-  opencodeServerUrl: z14.string().optional(),
-  claudeCodeAvailable: z14.boolean(),
-  codexAvailable: z14.boolean(),
-  idleTimeoutMs: z14.number().int().positive().optional(),
-  totalTimeoutMs: z14.number().int().positive().optional(),
-  leaseRenewalMs: z14.number().int().positive().optional(),
-  preparingRowDelayMs: z14.number().int().nonnegative().optional(),
+  opencodeServerUrl: z15.string().optional(),
+  claudeCodeAvailable: z15.boolean(),
+  codexAvailable: z15.boolean(),
+  idleTimeoutMs: z15.number().int().positive().optional(),
+  totalTimeoutMs: z15.number().int().positive().optional(),
+  leaseRenewalMs: z15.number().int().positive().optional(),
+  preparingRowDelayMs: z15.number().int().nonnegative().optional(),
   // Whether the turn writes a transcript. The directory is the runner's own
   // (`transcriptsDir()`), so `CABANE_RUNNER_STATE_DIR` moves it with the outbox.
-  transcripts: z14.boolean(),
+  transcripts: z15.boolean(),
   // Whether the harness starts under the OS sandbox. The launcher sends 'os'
   // only when this host can make one.
-  sandbox: z14.enum(["os", "none"]),
-  logLevel: z14.string(),
+  sandbox: z15.enum(["os", "none"]),
+  logLevel: z15.string(),
   // The launcher's connector-health observations, by runtime, as of the start.
-  connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
+  connectorHealth: z15.record(z15.string(), runtimeHealthSchema),
   // True when this (conversation, agent) pair was already told its session
   // could not be saved: the notice is once per pair, not once per process.
-  sessionWriteNoticeClaimed: z14.boolean(),
+  sessionWriteNoticeClaimed: z15.boolean(),
   // CT1680: the runner's identity, minted with its credential. The start
   // PATCH carries it so the lease knows which runner holds the span.
-  runnerId: z14.string()
+  runnerId: z15.string(),
+  // CT1681: the launcher keeps the runtime's session files beside the attempt
+  // and restores them into this runner's home, so the runner names the attempt
+  // each context was composed for and waits for the launcher to say it's in
+  // place. Absent: nothing to wait for (a runner on the launcher's own disk).
+  attemptState: z15.boolean().optional(),
+  // CT1681: MCP `${NAME}` secrets come from the launcher, by name, instead of
+  // this machine's secrets.json. Absent: the runner reads the device's file.
+  secretsFromLauncher: z15.boolean().optional()
 });
-var dispatchSchema = z14.object({
-  type: z14.literal("device:dispatch_requested"),
-  agentId: z14.string(),
-  deviceId: z14.string(),
-  conversationId: z14.string(),
-  messageId: z14.string(),
-  episode: z14.number().int().optional()
+var dispatchSchema = z15.object({
+  type: z15.literal("device:dispatch_requested"),
+  agentId: z15.string(),
+  deviceId: z15.string(),
+  conversationId: z15.string(),
+  messageId: z15.string(),
+  episode: z15.number().int().optional()
 });
-var credentialsSchema = z14.object({
-  credential: z14.string().startsWith("cabrn_")
+var credentialsSchema = z15.object({
+  credential: z15.string().startsWith("cabrn_")
 });
 function runnerEnv(input) {
   return {
@@ -8301,6 +8431,11 @@ function selfRunnerCommand() {
   if (!script) throw new Error("runners: cannot tell which script started this companion");
   return [process.execPath, ...process.execArgv, script, "run-turn"];
 }
+function defaultSecretStore(log) {
+  return loadSecretStoreTolerant(
+    (m) => log.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
+  );
+}
 function healthSnapshot(store) {
   const out = {};
   for (const r of store?.reports() ?? []) {
@@ -8334,6 +8469,8 @@ function runnerSpec(opts, launch, duties, runnerId) {
     ...opts.preparingRowDelayMs !== void 0 ? { preparingRowDelayMs: opts.preparingRowDelayMs } : {},
     transcripts: opts.transcriptDir !== void 0,
     sandbox: launch.sandbox ?? "none",
+    ...launch.provider.bindAttempt ? { attemptState: true } : {},
+    ...launch.provider.inheritsEnvironment === false ? { secretsFromLauncher: true } : {},
     logLevel: opts.log.level,
     connectorHealth: healthSnapshot(launch.connectorHealth),
     sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
@@ -8481,14 +8618,40 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const remote = [];
   const lockOwner = (id) => `${turnId}#${id}`;
   const locks = launch.locks;
+  let leasedAttemptId = null;
   try {
     handle = await launch.provider.acquire(attempt);
+  } catch (err) {
+    const reason2 = `runner_unavailable: ${describeError(err)}`;
+    log.warn(
+      { turnId, provider: launch.provider.name, err: describeError(err) },
+      "runner: no place to run the turn"
+    );
+    controller.signal.removeEventListener("abort", forwardStop);
+    duties.releaseAbort(turnId, controller);
+    await settleUnstarted(opts, payload, turnId, reason2, log);
+    await launch.reportRunnerGone?.({
+      workspaceId: opts.workspaceId,
+      conversationId: payload.conversationId,
+      agentId: payload.agentId,
+      messageId: payload.messageId,
+      runnerId: minted.runnerId,
+      reason: "provider_failed"
+    });
+    const durationMs2 = Date.now() - startedAt;
+    duties.notifyEnd({ id: payload.messageId, ok: false, durationMs: durationMs2, reason: reason2 });
+    return { ok: false, durationMs: durationMs2, reason: reason2 };
+  }
+  try {
+    const place = handle;
     const env = {};
-    for (const [k, v] of Object.entries(launch.env ?? process.env)) {
-      if (v !== void 0) env[k] = v;
+    if (launch.provider.inheritsEnvironment !== false) {
+      for (const [k, v] of Object.entries(launch.env ?? process.env)) {
+        if (v !== void 0) env[k] = v;
+      }
     }
     const input = {
-      baseUrl: opts.baseUrl,
+      baseUrl: launch.runnerBaseUrl ?? opts.baseUrl,
       credential: minted.credential,
       dispatch: payload,
       turnId,
@@ -8566,6 +8729,38 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
         case "remote_session":
           remote.push({ serverUrl: event.serverUrl, sessionId: event.sessionId });
           return;
+        case "attempt": {
+          const bind = launch.provider.bindAttempt?.(place, event.attemptId) ?? Promise.resolve();
+          void bind.then(
+            () => running.stdin.write(encodeLauncherMessage({ cabaneLauncher: "bound", id: event.id })),
+            (err) => {
+              const refused = describeError(err);
+              log.warn(
+                { attemptId: event.attemptId, err: refused },
+                "runner: couldn't make the place ready for the turn's attempt; not running it there"
+              );
+              running.stdin.write(
+                encodeLauncherMessage({ cabaneLauncher: "bound", id: event.id, refused })
+              );
+            }
+          );
+          return;
+        }
+        case "leased":
+          leasedAttemptId = event.attemptId;
+          return;
+        case "secrets": {
+          const store = (launch.secretStore ?? defaultSecretStore)(log);
+          const values = {};
+          for (const name of event.names) {
+            const value = store.get(name);
+            if (value !== void 0) values[name] = value;
+          }
+          running.stdin.write(
+            encodeLauncherMessage({ cabaneLauncher: "secrets", id: event.id, values })
+          );
+          return;
+        }
       }
     });
     const stderrDone = lines(running.stderr, (line) => relayRunnerLog(line, opts.log));
@@ -8576,7 +8771,14 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     child?.stdin.end();
     controller.signal.removeEventListener("abort", forwardStop);
     duties.releaseAbort(turnId, controller);
-    if (handle) await launch.provider.release(handle, { destroy: false });
+    if (handle) {
+      await launch.provider.collect?.(handle, { attemptId: leasedAttemptId }).catch(
+        (err) => log.warn({ err: describeError(err) }, "runner: couldn't collect what the runner left")
+      );
+      await launch.provider.release(handle, { destroy: false }).catch(
+        (err) => log.warn({ err: describeError(err) }, "runner: couldn't give its place back")
+      );
+    }
   }
   if (result) return result;
   const durationMs = Date.now() - startedAt;
@@ -8635,7 +8837,7 @@ import { existsSync as existsSync9 } from "fs";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
 var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
 var SKIP_TURN_TOOL = "skip_turn";
@@ -8698,7 +8900,7 @@ function createTurnControlMcpServer(acts, skipState) {
           SKIP_TURN_TOOL,
           TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
           {
-            reason: z15.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+            reason: z16.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
           },
           async (args) => {
             skipState.skipped = true;
@@ -8714,42 +8916,42 @@ function createTurnControlMcpServer(acts, skipState) {
         ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
         {
-          targetUserId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z15.array(
-            z15.union([
-              z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
-              z15.object({
-                label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
-                move: z15.object({
-                  task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
-                  status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
+          targetUserId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z16.array(
+            z16.union([
+              z16.string().min(1).max(MAX_ASK_OPTION_BYTES),
+              z16.object({
+                label: z16.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
+                move: z16.object({
+                  task: z16.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
+                  status: z16.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
                 }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
               })
             ])
           ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z15.array(
-            z15.object({
-              headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z15.array(
-                z15.union([
-                  z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
-                  z15.object({
-                    label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
-                    move: z15.object({
-                      task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
-                      status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
+          questions: z16.array(
+            z16.object({
+              headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z16.array(
+                z16.union([
+                  z16.string().min(1).max(MAX_ASK_OPTION_BYTES),
+                  z16.object({
+                    label: z16.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
+                    move: z16.object({
+                      task: z16.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
+                      status: z16.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
                     }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
                   })
                 ])
               ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
             })
           ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z15.object({
-            askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          replaces: z16.object({
+            askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
           }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
         },
         async (args) => {
@@ -8790,9 +8992,9 @@ function createTurnControlMcpServer(acts, skipState) {
         WAKE_ME_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
         {
-          afterSeconds: z15.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z15.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z15.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+          afterSeconds: z16.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z16.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z16.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
         },
         async (args) => {
           const hasAfter = args.afterSeconds !== void 0;
@@ -8826,8 +9028,8 @@ function createTurnControlMcpServer(acts, skipState) {
         WITHDRAW_ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
         {
-          askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+          askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
@@ -8894,11 +9096,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join10(tmpdir(), PREFIX));
-  const path = join10(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
+  const path = join11(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -9004,22 +9206,22 @@ function reportFailure(config, body) {
 }
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
+import { join as join12 } from "path";
 function dirFor(workspaceId) {
-  return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join11(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor2(workspaceId, conversationId, agentId) {
-  return join11(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
       return {
         cwd: parsed.cwd,
@@ -9043,97 +9245,6 @@ function clearPrepared(workspaceId, conversationId, agentId) {
   rmSync5(pathFor2(workspaceId, conversationId, agentId), { force: true });
 }
 
-// src/secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join12 } from "path";
-import { z as z16 } from "zod";
-var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-function secretsPath() {
-  return join12(cabaneDir(), "secrets.json");
-}
-var secretStoreSchema = z16.record(z16.string(), z16.string());
-function loadSecretStore() {
-  const path = secretsPath();
-  if (!existsSync8(path)) return makeStore({});
-  let raw;
-  try {
-    raw = readFileSync7(path, "utf8");
-  } catch (err) {
-    throw new ConfigError(
-      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (raw.trim().length === 0) return makeStore({});
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new ConfigError(
-      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
-    );
-  }
-  const result = secretStoreSchema.safeParse(parsed);
-  if (!result.success) {
-    throw new ConfigError(
-      `${path} must be a flat object mapping secret names to string values (e.g. { "GITHUB_TOKEN": "ghp_\u2026" }).`
-    );
-  }
-  return makeStore(result.data);
-}
-function loadSecretStoreTolerant(onWarn) {
-  try {
-    return loadSecretStore();
-  } catch (err) {
-    onWarn?.(err instanceof Error ? err.message : String(err));
-    return makeStore({});
-  }
-}
-function makeStore(map) {
-  return {
-    get: (name) => map[name],
-    names: () => Object.keys(map).sort()
-  };
-}
-function requiredSecretNames(mcpServers) {
-  const names = /* @__PURE__ */ new Set();
-  for (const server of Object.values(mcpServers ?? {})) {
-    const bags = [
-      "env" in server ? server.env : void 0,
-      "headers" in server ? server.headers : void 0
-    ];
-    for (const bag of bags) {
-      for (const value of Object.values(bag ?? {})) {
-        for (const [, name] of value.matchAll(PLACEHOLDER_RE)) names.add(name);
-      }
-    }
-  }
-  return [...names].sort();
-}
-function resolveMcpSecrets(mcpServers, store) {
-  const missing = /* @__PURE__ */ new Set();
-  const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
-    const resolved = store.get(name);
-    if (resolved === void 0) {
-      missing.add(name);
-      return _match;
-    }
-    return resolved;
-  });
-  const mapBag = (bag) => {
-    const out = {};
-    for (const [k, v] of Object.entries(bag)) out[k] = interpolate(v);
-    return out;
-  };
-  const servers = {};
-  for (const [name, server] of Object.entries(mcpServers)) {
-    const next = { ...server };
-    if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
-    servers[name] = next;
-  }
-  return { servers, missing: [...missing].sort() };
-}
-
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
 import { basename, dirname as dirname6, join as join13 } from "path";
@@ -9741,6 +9852,12 @@ var TurnExecution = class {
       this.resumedSpoke = turnContext.turnSpoke === true || outboxSpoke;
       if (this.resumedSpoke) turnLog.debug({ turnId }, "dispatcher: resumed span already spoke");
     }
+    try {
+      await this.opts.inRunner?.onContext?.(turnContext.attemptId ?? null);
+    } catch (err) {
+      const reason = `runner_unavailable: ${err instanceof Error ? err.message : String(err)}`;
+      throw this.concluded(reason, reason);
+    }
   }
   gateTrigger() {
     const { payload, turnLog } = this;
@@ -9758,7 +9875,8 @@ var TurnExecution = class {
   }
   async resolveSecrets() {
     const { payload, workspaceId, turnLog } = this;
-    const secretStore = this.opts.secretStore ?? loadSecretStoreTolerant(
+    const fromLauncher = this.opts.inRunner?.secrets;
+    const secretStore = this.opts.secretStore ?? (fromLauncher ? await fromLauncher(requiredSecretNames(this.turnContext.mcpServers)) : null) ?? loadSecretStoreTolerant(
       (m) => turnLog.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
     );
     const { servers: resolvedMcpServers, missing } = resolveMcpSecrets(
@@ -9918,42 +10036,48 @@ var TurnExecution = class {
     const { payload, workspaceId, turnId, turnLog } = this;
     const abortController = this.abortController;
     this.supervisor.registerAbort(turnId, abortController);
+    let started;
     try {
-      await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
-        activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        // CT1679: a runner leases under its launcher's boot id — the one the
-        // device heartbeats — or the lost-run sweep reads it as a restart.
-        bootId: this.opts.inRunner?.bootId ?? bootId,
-        // CT1680: the runner holding the span, beside the device's boot id.
-        ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
-        // CT1380: the durable record that this turn resumed, and from where.
-        ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
-        // CT1454: the issuance the context THIS attempt runs on came from. Read
-        // off `this.turnContext`, which is the fetch that composed this request —
-        // so a retransmitted start echoes the same id and reuses the same record,
-        // and a resumed attempt echoes its own, newer one. The post-admission
-        // fresh-session recompose (`freshRequest`) deliberately does not touch it:
-        // it adopts only the prompt, never the run-config, so its issuance must
-        // not become this attempt's evidence.
-        ...this.turnContext.issuanceId ? { issuanceId: this.turnContext.issuanceId } : {},
-        // CT33: hand the server this turn's id so the new-run chokepoint's
-        // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
-        // already emitted a "preparing" activity row for this turn above (it
-        // runs before this flip), which would otherwise make the sweep mistake
-        // this live turn for an abandoned one and close it with a `stopped`.
-        turnId,
-        // The newest message this turn's read covered: the lease records it,
-        // and settle moves the cursor to it. Omitted when the server sent
-        // none (an older API), so the cursor stays where it was.
-        ...this.turnContext.readThrough !== void 0 ? { readThrough: this.turnContext.readThrough } : {},
-        ...this.turnContext.readRevision !== void 0 ? { readRevision: this.turnContext.readRevision } : {},
-        // Rooms: the attempt this request's session belongs to (null = fresh).
-        ...this.turnContext.attemptId !== void 0 ? { attemptId: this.turnContext.attemptId } : {},
-        // CT1543: the frame this start acts on. The turn-context fetch already
-        // checked it, but that was before an assembly this turn awaited — the
-        // lease checks it again where the stamp is actually taken.
-        ...payload.episode !== void 0 ? { dispatchMessageId: payload.messageId, dispatchEpisode: payload.episode } : {}
-      });
+      started = await this.opts.api.setActiveRun(
+        workspaceId,
+        payload.conversationId,
+        payload.agentId,
+        {
+          activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          // CT1679: a runner leases under its launcher's boot id — the one the
+          // device heartbeats — or the lost-run sweep reads it as a restart.
+          bootId: this.opts.inRunner?.bootId ?? bootId,
+          // CT1680: the runner holding the span, beside the device's boot id.
+          ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
+          // CT1380: the durable record that this turn resumed, and from where.
+          ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
+          // CT1454: the issuance the context THIS attempt runs on came from. Read
+          // off `this.turnContext`, which is the fetch that composed this request —
+          // so a retransmitted start echoes the same id and reuses the same record,
+          // and a resumed attempt echoes its own, newer one. The post-admission
+          // fresh-session recompose (`freshRequest`) deliberately does not touch it:
+          // it adopts only the prompt, never the run-config, so its issuance must
+          // not become this attempt's evidence.
+          ...this.turnContext.issuanceId ? { issuanceId: this.turnContext.issuanceId } : {},
+          // CT33: hand the server this turn's id so the new-run chokepoint's
+          // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
+          // already emitted a "preparing" activity row for this turn above (it
+          // runs before this flip), which would otherwise make the sweep mistake
+          // this live turn for an abandoned one and close it with a `stopped`.
+          turnId,
+          // The newest message this turn's read covered: the lease records it,
+          // and settle moves the cursor to it. Omitted when the server sent
+          // none (an older API), so the cursor stays where it was.
+          ...this.turnContext.readThrough !== void 0 ? { readThrough: this.turnContext.readThrough } : {},
+          ...this.turnContext.readRevision !== void 0 ? { readRevision: this.turnContext.readRevision } : {},
+          // Rooms: the attempt this request's session belongs to (null = fresh).
+          ...this.turnContext.attemptId !== void 0 ? { attemptId: this.turnContext.attemptId } : {},
+          // CT1543: the frame this start acts on. The turn-context fetch already
+          // checked it, but that was before an assembly this turn awaited — the
+          // lease checks it again where the stamp is actually taken.
+          ...payload.episode !== void 0 ? { dispatchMessageId: payload.messageId, dispatchEpisode: payload.episode } : {}
+        }
+      );
     } catch (err) {
       if (leaseRefusal(err) === "dispatch_context_stale" && !this.recomposedForLease) {
         this.recomposedForLease = true;
@@ -9978,6 +10102,7 @@ var TurnExecution = class {
       throw this.concluded(reason, reason);
     }
     this.admitted = true;
+    if (started?.attemptId) this.opts.inRunner?.onLeased?.(started.attemptId);
   }
   buildRequest() {
     const { payload, workspaceId } = this;
@@ -10741,18 +10866,1266 @@ function createLocalProcessProvider(opts = {}) {
   };
 }
 
-// src/runner/device-locks.ts
-var DeviceLocks = class {
-  holders = /* @__PURE__ */ new Map();
-  queues = /* @__PURE__ */ new Map();
-  // `owner` is unique across the device; `grant` is called once, when it holds.
-  request(key, owner, grant) {
-    if (!this.holders.has(key)) {
-      this.holders.set(key, owner);
-      grant();
-      return;
+// src/providers/docker.ts
+import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
+import { constants as constants2, tmpdir as tmpdir2 } from "os";
+import {
+  createReadStream,
+  createWriteStream as createWriteStream2,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync10,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync9,
+  renameSync as renameSync5,
+  rmSync as rmSync9,
+  statSync as statSync3,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { join as join17 } from "path";
+import { Writable } from "stream";
+
+// src/providers/docker-cli.ts
+import { spawn as spawn7 } from "child_process";
+function cliEnv(extra) {
+  const keep = [
+    "PATH",
+    "HOME",
+    "DOCKER_HOST",
+    "DOCKER_CONFIG",
+    "DOCKER_CONTEXT",
+    "DOCKER_CERT_PATH"
+  ];
+  const env = {};
+  for (const k of keep) if (process.env[k] !== void 0) env[k] = process.env[k];
+  return { ...env, ...extra };
+}
+function dockerCli(bin = "docker") {
+  return {
+    run(args, opts = {}) {
+      return new Promise((resolve2) => {
+        let child;
+        try {
+          child = spawn7(bin, [...args], {
+            env: cliEnv(opts.env),
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+        } catch (err) {
+          resolve2({ code: 127, stdout: "", stderr: String(err) });
+          return;
+        }
+        let stdout = "";
+        let stderr = "";
+        const timer = opts.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs) : void 0;
+        if (opts.stdout) child.stdout?.pipe(opts.stdout);
+        else child.stdout?.on("data", (chunk) => stdout += String(chunk));
+        child.stderr?.on("data", (chunk) => stderr += String(chunk));
+        child.stdin?.on("error", () => {
+        });
+        child.once("error", (err) => {
+          if (timer) clearTimeout(timer);
+          resolve2({ code: 127, stdout, stderr: stderr || err.message });
+        });
+        child.once("close", (code, signal) => {
+          if (timer) clearTimeout(timer);
+          resolve2({ code: code ?? (signal ? 137 : 1), stdout, stderr });
+        });
+        const input = opts.input;
+        if (input === void 0) child.stdin?.end();
+        else if (typeof input === "string" || Buffer.isBuffer(input)) child.stdin?.end(input);
+        else input.pipe(child.stdin);
+      });
+    },
+    spawn(args, env) {
+      return spawn7(bin, [...args], { env: cliEnv(env), stdio: ["pipe", "pipe", "pipe"] });
     }
-    const queue = this.queues.get(key) ?? [];
+  };
+}
+
+// src/runner/git-credential.ts
+import { spawn as spawn8 } from "child_process";
+import { chmodSync as chmodSync5, rmSync as rmSync7 } from "fs";
+import { connect as connect3, createServer as createServer3 } from "net";
+
+// src/runner/egress-proxy.ts
+import { createServer as createServer2, request as httpRequest } from "http";
+import { connect as connect2 } from "net";
+function egressAllowed(host, allow, port, defaultPort = 443) {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  if (!h) return false;
+  const p = port ?? defaultPort;
+  return allow.some((entry) => {
+    const raw = entry.toLowerCase().trim();
+    const m = /^(.*):(\d{1,5})$/.exec(raw);
+    const name = m ? m[1] : raw;
+    const wanted = m ? Number(m[2]) : defaultPort;
+    if (p !== wanted) return false;
+    if (name.startsWith("*.")) return h.endsWith(name.slice(1));
+    return h === name;
+  });
+}
+
+// src/runner/git-credential.ts
+function parseCredential(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
+function formatCredential(fields) {
+  return Object.entries(fields).map(([k, v]) => `${k}=${v}`).join("\n") + "\n\n";
+}
+function deviceGitFill(helper, timeoutMs = 15e3) {
+  return (request) => new Promise((resolve2) => {
+    const args = [
+      ...helper ? ["-c", "credential.helper=", "-c", `credential.helper=${helper}`] : [],
+      "credential",
+      "fill"
+    ];
+    const child = spawn8("git", args, {
+      stdio: ["pipe", "pipe", "ignore"],
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "", SSH_ASKPASS: "" }
+    });
+    let out = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+    child.stdout.on("data", (chunk) => out += String(chunk));
+    child.once("error", () => resolve2(null));
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      resolve2(code === 0 ? out : null);
+    });
+    child.stdin.end(formatCredential(request));
+  });
+}
+async function serveGitCredentials(opts) {
+  const { socketPath, hosts, fill, log } = opts;
+  rmSync7(socketPath, { force: true });
+  const server = createServer3({ allowHalfOpen: true }, (socket) => {
+    let input = "";
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => input += chunk);
+    socket.on("error", () => socket.destroy());
+    socket.on("end", () => {
+      void (async () => {
+        const [op = "", ...rest] = input.split("\n");
+        const request = parseCredential(rest.join("\n"));
+        if (op !== "get" || request.protocol !== "https" || !request.host) {
+          socket.end();
+          return;
+        }
+        if (!egressAllowed(request.host.replace(/:\d+$/, ""), hosts)) {
+          log?.warn(
+            { host: request.host },
+            "runner: git asked for a credential for a host it may not use"
+          );
+          socket.end();
+          return;
+        }
+        const answer = await fill({
+          protocol: "https",
+          host: request.host,
+          ...request.path ? { path: request.path } : {},
+          ...request.username ? { username: request.username } : {}
+        });
+        if (!answer) {
+          log?.warn(
+            { host: request.host },
+            "runner: this device's git has no credential for the host"
+          );
+          socket.end();
+          return;
+        }
+        const filled = parseCredential(answer);
+        socket.end(
+          formatCredential({
+            protocol: "https",
+            host: request.host,
+            ...filled.username ? { username: filled.username } : {},
+            ...filled.password ? { password: filled.password } : {}
+          })
+        );
+      })();
+    });
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.off("error", reject);
+      resolve2();
+    });
+  });
+  chmodSync5(socketPath, 438);
+  return {
+    close: () => new Promise((resolve2) => {
+      server.close(() => resolve2());
+      rmSync7(socketPath, { force: true });
+    })
+  };
+}
+
+// src/runner/collected-outbox.ts
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync8,
+  renameSync as renameSync4,
+  rmSync as rmSync8
+} from "fs";
+import { join as join15 } from "path";
+function routes(t) {
+  const conv = `/api/workspaces/${t.workspaceId}/conversations/${t.conversationId}`;
+  const agent = `${conv}/participants/agents/${t.agentId}`;
+  return {
+    message: { method: "POST", path: `${conv}/messages` },
+    activity: { method: "POST", path: `${agent}/activity` },
+    thinking: { method: "POST", path: `${agent}/thinking` },
+    text: { method: "POST", path: `${agent}/text` },
+    "active-run": { method: "PATCH", path: `${agent}/active-run` }
+  };
+}
+function admitCollectedEntry(raw, turn) {
+  if (!raw || typeof raw !== "object") return null;
+  const entry = raw;
+  const kind = entry.kind;
+  if (!kind || !(kind in routes(turn))) return null;
+  const route = routes(turn)[kind];
+  if (entry.method !== route.method || entry.path !== route.path) return null;
+  if (typeof entry.seq !== "number" || typeof entry.enqueuedAt !== "number") return null;
+  const body = entry.body;
+  if (!body || typeof body !== "object" || typeof body.turnId !== "string") return null;
+  if (!turn.turnIds.includes(body.turnId)) return null;
+  if (kind === "active-run") {
+    if (body.activeRunStartedAt !== null) return null;
+    if (entry.turnId !== `activerun:${turn.conversationId}:${turn.agentId}`) return null;
+  } else if (entry.turnId !== body.turnId) {
+    return null;
+  }
+  return entry;
+}
+var atomicMove = (from, to) => {
+  try {
+    renameSync4(from, to);
+  } catch {
+    const partial = `${to}.partial`;
+    copyFileSync2(from, partial);
+    renameSync4(partial, to);
+    rmSync8(from, { force: true });
+  }
+};
+function publishStaged(from, to, move = atomicMove) {
+  if (!existsSync11(from)) return { published: 0, complete: true };
+  const staged = readdirSync3(from).filter((n) => n.endsWith(".json")).map((name) => {
+    let entry = {};
+    try {
+      entry = JSON.parse(readFileSync8(join15(from, name), "utf8"));
+    } catch {
+    }
+    return { name, entry };
+  });
+  const settle = (e) => e.kind === "active-run" ? 1 : 0;
+  staged.sort(
+    (a, b) => settle(a.entry) - settle(b.entry) || (a.entry.enqueuedAt ?? 0) - (b.entry.enqueuedAt ?? 0) || String(a.entry.turnId).localeCompare(String(b.entry.turnId)) || (a.entry.seq ?? 0) - (b.entry.seq ?? 0)
+  );
+  if (staged.length) mkdirSync9(to, { recursive: true });
+  let published = 0;
+  for (const { name } of staged) {
+    try {
+      move(join15(from, name), join15(to, name));
+    } catch {
+      return { published, complete: false };
+    }
+    published++;
+  }
+  rmSync8(from, { recursive: true, force: true });
+  return { published, complete: true };
+}
+
+// src/providers/runner-base.ts
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync12, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname7, join as join16, sep } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+var COMPANION_MOUNT = "/opt/cabane/companion";
+var BASE_DOCKERFILE = `FROM node:22-slim
+RUN apt-get update \\
+  && apt-get install -y --no-install-recommends git curl ca-certificates procps \\
+  && rm -rf /var/lib/apt/lists/* \\
+  && corepack enable
+RUN usermod -l runner -d /home/runner -m node \\
+  && groupmod -n runner node \\
+  && mkdir -p /work /var/lib/cabane-runner /run/cabane ${COMPANION_MOUNT} \\
+  && chown runner:runner /work /var/lib/cabane-runner
+RUN mkdir -p /home/runner/.codex /opt/cabane \\
+  && printf '[features]\\nuse_legacy_landlock = true\\n' > /opt/cabane/codex-config.toml \\
+  && cp /opt/cabane/codex-config.toml /home/runner/.codex/config.toml \\
+  && chown -R runner:runner /home/runner/.codex
+RUN printf '#!/bin/sh\\nexec node "\${CABANE_COMPANION_ROOT:-${COMPANION_MOUNT}}/dist/cli.js" "$@"\\n' > /usr/local/bin/cabane-companion \\
+  && chmod 755 /usr/local/bin/cabane-companion
+USER runner
+WORKDIR /home/runner
+CMD ["sleep", "infinity"]
+`;
+function baseImageTag(dockerfile = BASE_DOCKERFILE) {
+  return `cabane-runner-base:${createHash3("sha256").update(dockerfile).digest("hex").slice(0, 12)}`;
+}
+async function ensureBaseImage(docker, image, log) {
+  if ((await docker.run(["image", "inspect", image])).code === 0) return true;
+  if (image !== baseImageTag()) {
+    log.error({ image }, "runners: the configured runner image isn't on this engine");
+    return false;
+  }
+  log.info({ image }, "runners: building the runner base image (once per base)");
+  const built = await docker.run(["build", "-t", image, "-"], {
+    input: BASE_DOCKERFILE,
+    timeoutMs: 20 * 6e4
+  });
+  if (built.code !== 0) {
+    log.error(
+      { image, err: built.stderr.trim().slice(-2e3) },
+      "runners: couldn't build the runner base image; no turn can run until it is"
+    );
+    return false;
+  }
+  return true;
+}
+function ownInstall(moduleFile = fileURLToPath3(import.meta.url)) {
+  let dir2 = dirname7(moduleFile);
+  for (let i = 0; i < 4; i++) {
+    if (existsSync12(join16(dir2, "dist", "cli.js")) && existsSync12(join16(dir2, "package.json"))) break;
+    dir2 = dirname7(dir2);
+  }
+  if (!existsSync12(join16(dir2, "dist", "cli.js"))) return null;
+  const sdk = join16(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
+  if (!existsSync12(sdk)) return null;
+  const root = realpathSync2(dir2);
+  return realpathSync2(sdk).startsWith(root + sep) ? root : null;
+}
+function companionSource(input) {
+  if (input.configured) {
+    return { kind: "dir", path: input.configured, key: `dir:${input.configured}` };
+  }
+  if (input.platform === "linux") {
+    if (input.own)
+      return { kind: "dir", path: input.own, key: `dir:${input.own}:${input.version}` };
+    return {
+      error: "this companion runs from a checkout, which a container can't mount on its own; build one with `pnpm --filter @cabane/companion deploy --prod <dir>` and set runners.docker.companionDir"
+    };
+  }
+  if (input.version === "0.0.0") {
+    return {
+      error: "an unreleased companion can't be installed into a container from npm; set runners.docker.companionDir to a Linux install of it"
+    };
+  }
+  return {
+    kind: "volume",
+    volume: `cabane-companion-${input.version}`,
+    version: input.version,
+    key: `volume:${input.version}`
+  };
+}
+function companionRoot(source) {
+  return source.kind === "dir" ? COMPANION_MOUNT : `${COMPANION_MOUNT}/lib/node_modules/@cabane/companion`;
+}
+function companionMountArgs(source) {
+  const mount = source.kind === "dir" ? `type=bind,src=${source.path},dst=${COMPANION_MOUNT},readonly` : `type=volume,src=${source.volume},dst=${COMPANION_MOUNT},readonly`;
+  return ["--mount", mount, "-e", `CABANE_COMPANION_ROOT=${companionRoot(source)}`];
+}
+var INSTALL_MARKER = `${COMPANION_MOUNT}/.cabane-install-complete`;
+function volumeInstallScript(version, install = `npm install -g --prefix ${COMPANION_MOUNT} @cabane/companion@${version}`) {
+  const root = `${COMPANION_MOUNT}/lib/node_modules/@cabane/companion`;
+  return [
+    `find ${COMPANION_MOUNT} -mindepth 1 -delete`,
+    install,
+    // Installed is not the same as runnable: the package must start and say
+    // what it runs before the volume counts as done.
+    `node ${root}/dist/cli.js run-turn --manifest > /dev/null`,
+    `printf %s ${version} > ${INSTALL_MARKER}`
+  ].join(" && ");
+}
+var volumeMount = (source) => `type=volume,src=${source.volume},dst=${COMPANION_MOUNT}`;
+async function ensureCompanionVolume(docker, image, source, log, script = volumeInstallScript) {
+  if (source.kind !== "volume") return true;
+  const done = await docker.run([
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--mount",
+    volumeMount(source),
+    image,
+    "sh",
+    "-c",
+    `[ "$(cat ${INSTALL_MARKER} 2>/dev/null)" = "$1" ]`,
+    "sh",
+    source.version
+  ]);
+  if (done.code === 0) return true;
+  log.info(
+    { version: source.version },
+    "runners: installing this companion version for its containers"
+  );
+  const installed = await docker.run(
+    [
+      "run",
+      "--rm",
+      "-u",
+      "root",
+      "--mount",
+      volumeMount(source),
+      image,
+      "sh",
+      "-c",
+      script(source.version)
+    ],
+    { timeoutMs: 20 * 6e4 }
+  );
+  if (installed.code !== 0) {
+    log.error(
+      { version: source.version, err: installed.stderr.trim().slice(-2e3) },
+      "runners: couldn't install the companion for its containers; the next start tries again"
+    );
+    return false;
+  }
+  return true;
+}
+async function invalidateCompanionVolume(docker, image, source) {
+  if (source.kind !== "volume") return;
+  await docker.run([
+    "run",
+    "--rm",
+    "-u",
+    "root",
+    "--network",
+    "none",
+    "--mount",
+    volumeMount(source),
+    image,
+    "rm",
+    "-f",
+    INSTALL_MARKER
+  ]);
+}
+
+// src/providers/docker.ts
+var CONTAINER_HOME = "/home/runner";
+var CONTAINER_WORK = "/work";
+var CONTAINER_STATE = "/var/lib/cabane-runner";
+var CONTAINER_SOCKETS = "/run/cabane";
+var PROXY_ALIAS = "cabane-egress";
+var PROXY_PORT = 3128;
+var DEFAULT_KILL_GRACE_MS2 = 3e4;
+var REAP_GRACE_S = 3;
+var DEFAULT_SESSION_CAP_BYTES = 512 * 1024 * 1024;
+var COLLECT_CAP_BYTES = 128 * 1024 * 1024;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function containerName(attempt) {
+  return `cabane-runner-${attempt.conversationId}-${attempt.agentId}`;
+}
+function sessionArchivePath(deviceDir, attemptId) {
+  if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
+  return join17(deviceDir, "attempts", attemptId, "session.tar");
+}
+function pruneOtherAttempts(deviceDir, pair, keep) {
+  const root = join17(deviceDir, "attempts");
+  if (!existsSync13(root)) return;
+  for (const id of readdirSync4(root)) {
+    if (id === keep || !UUID_RE.test(id)) continue;
+    let pairOf = "";
+    try {
+      pairOf = readFileSync9(join17(root, id, "pair"), "utf8");
+    } catch {
+      continue;
+    }
+    if (pairOf === `${pair.conversationId}/${pair.agentId}`) {
+      rmSync9(join17(root, id), { recursive: true, force: true });
+    }
+  }
+}
+var CappedFile = class extends Writable {
+  constructor(path, cap) {
+    super();
+    this.path = path;
+    this.cap = cap;
+    this.out = createWriteStream2(path);
+  }
+  path;
+  cap;
+  bytes = 0;
+  over = false;
+  out;
+  _write(chunk, _enc, done) {
+    this.bytes += chunk.length;
+    if (this.bytes > this.cap) {
+      this.over = true;
+      done();
+      return;
+    }
+    this.out.write(chunk, done);
+  }
+  _final(done) {
+    this.out.end(done);
+  }
+};
+var DUMP_SCRIPT = `
+const fs = require('fs'), path = require('path');
+const dir = process.argv[1], cap = Number(process.argv[2]);
+let names;
+try { names = fs.readdirSync(dir); }
+catch (e) {
+  if (e.code === 'ENOENT') { process.stdout.write(JSON.stringify({ complete: true, files: [] })); process.exit(0); }
+  process.stderr.write(String(e.message)); process.exit(2);
+}
+let total = 0, complete = true; const files = [];
+for (const name of names) {
+  const p = path.join(dir, name);
+  let st;
+  try { st = fs.lstatSync(p); } catch (e) { process.stderr.write(String(e.message)); process.exit(2); }
+  if (!st.isFile()) continue;
+  // Always at least one file per read, so one over the cap is still collected.
+  if (files.length && total + st.size > cap) { complete = false; continue; }
+  let data;
+  try { data = fs.readFileSync(p); } catch (e) { process.stderr.write(String(e.message)); process.exit(2); }
+  total += st.size;
+  files.push({ name, data: data.toString('base64') });
+}
+process.stdout.write(JSON.stringify({ complete, files }));
+`;
+var SAFE_NAME_RE = /^[\w.%@+-]+$/;
+function createDockerProvider(opts) {
+  const docker = opts.docker ?? dockerCli();
+  const log = opts.log;
+  const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS2;
+  const sessionCap = opts.sessionCapBytes ?? DEFAULT_SESSION_CAP_BYTES;
+  const collectCap = opts.collectCapBytes ?? COLLECT_CAP_BYTES;
+  const network = `cabane-runners-${opts.deviceKey}`;
+  const companionLabel = createHash4("sha256").update(opts.companion.key).digest("hex").slice(0, 16);
+  const proxy = `cabane-egress-${opts.deviceKey}`;
+  const held = /* @__PURE__ */ new Map();
+  const queues = /* @__PURE__ */ new Map();
+  const must = async (args, what) => {
+    const r = await docker.run(args);
+    if (r.code !== 0)
+      throw new Error(`docker: ${what} failed: ${r.stderr.trim() || `exit ${r.code}`}`);
+    return r.stdout;
+  };
+  const execIn = (name, args, extra = {}) => docker.run(
+    ["exec", ...extra.input !== void 0 ? ["-i"] : [], "-u", "runner", name, ...args],
+    extra
+  );
+  const proxyListening = async () => {
+    for (let i = 0; i < 40; i++) {
+      const r = await docker.run([
+        "exec",
+        proxy,
+        "curl",
+        "-s",
+        "-o",
+        "/dev/null",
+        "--max-time",
+        "1",
+        `http://127.0.0.1:${PROXY_PORT}/`
+      ]);
+      if (r.code === 0) return;
+      await new Promise((resolve2) => setTimeout(resolve2, 250));
+    }
+    throw new Error("docker: the egress proxy never started listening");
+  };
+  let networkReady = null;
+  const proxyKey = async () => {
+    const id = (await docker.run(["image", "inspect", "-f", "{{.Id}}", opts.image])).stdout.trim();
+    return createHash4("sha256").update(JSON.stringify([id || opts.image, opts.companion.key, [...opts.egressAllow].sort()])).digest("hex").slice(0, 16);
+  };
+  const ensureNetwork = () => {
+    networkReady ??= (async () => {
+      const allowKey = await proxyKey();
+      if ((await docker.run(["network", "inspect", network])).code !== 0) {
+        await must(
+          [
+            "network",
+            "create",
+            // No route off the host, and no address of the host's on the
+            // bridge: the host's own ports are out of reach too. The proxy is
+            // the only other thing on the network.
+            "--internal",
+            "-o",
+            "com.docker.network.bridge.inhibit_ipv4=true",
+            "--label",
+            `cabane.device=${opts.deviceKey}`,
+            network
+          ],
+          "creating the runners network"
+        );
+      }
+      const seen = await docker.run([
+        "inspect",
+        "-f",
+        '{{index .Config.Labels "cabane.allow"}} {{.State.Running}}',
+        proxy
+      ]);
+      const [key, running] = seen.stdout.trim().split(" ");
+      if (seen.code === 0 && key === allowKey) {
+        if (running !== "true") {
+          await must(["start", proxy], "starting the egress proxy");
+          await proxyListening();
+        }
+        return;
+      }
+      if (seen.code === 0) await docker.run(["rm", "-f", proxy]);
+      await must(
+        [
+          "run",
+          "-d",
+          "--name",
+          proxy,
+          "--label",
+          `cabane.allow=${allowKey}`,
+          "--label",
+          `cabane.device=${opts.deviceKey}`,
+          "--restart",
+          "unless-stopped",
+          "--cap-drop",
+          "ALL",
+          "--security-opt",
+          "no-new-privileges",
+          "-e",
+          `CABANE_EGRESS_ALLOW=${JSON.stringify(opts.egressAllow)}`,
+          ...companionMountArgs(opts.companion),
+          opts.image,
+          "cabane-companion",
+          "egress-proxy",
+          "--port",
+          String(PROXY_PORT)
+        ],
+        "starting the egress proxy"
+      );
+      await must(
+        ["network", "connect", "--alias", PROXY_ALIAS, network, proxy],
+        "connecting the proxy"
+      );
+      await proxyListening();
+      log.info({ network, proxy, allow: opts.egressAllow }, "runners: egress proxy ready");
+    })().catch((err) => {
+      networkReady = null;
+      throw err;
+    });
+    return networkReady;
+  };
+  const socketRoot = opts.socketRoot ?? join17(
+    process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir2(),
+    `cabane-runners-${opts.deviceKey}`
+  );
+  const socketDir = (name) => join17(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
+  const create = async (name, attempt) => {
+    mkdirSync10(socketRoot, { recursive: true, mode: 448 });
+    mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
+    const mounts = (opts.mounts ?? []).filter((m) => m.source.startsWith("/") && existsSync13(m.source)).flatMap((m) => ["--mount", `type=bind,src=${m.source},dst=${m.target},readonly`]);
+    await must(
+      [
+        "create",
+        "--name",
+        name,
+        "--init",
+        "--hostname",
+        "cabane-runner",
+        "--label",
+        "cabane.runner=1",
+        "--label",
+        `cabane.device=${opts.deviceKey}`,
+        "--label",
+        `cabane.workspace=${attempt.workspaceId}`,
+        "--label",
+        `cabane.conversation=${attempt.conversationId}`,
+        "--label",
+        `cabane.agent=${attempt.agentId}`,
+        "--label",
+        `cabane.companion=${companionLabel}`,
+        "--network",
+        network,
+        "--mount",
+        `type=volume,src=${name}-home,dst=${CONTAINER_HOME}`,
+        "--mount",
+        `type=volume,src=${name}-work,dst=${CONTAINER_WORK}`,
+        "--mount",
+        `type=bind,src=${socketDir(name)},dst=${CONTAINER_SOCKETS},readonly`,
+        ...mounts,
+        ...companionMountArgs(opts.companion),
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--pids-limit",
+        "4096",
+        opts.image,
+        "sleep",
+        "infinity"
+      ],
+      "creating the container"
+    );
+  };
+  const destroy = async (name) => {
+    await docker.run(["rm", "-f", "-v", name]);
+    await docker.run(["volume", "rm", "-f", `${name}-home`, `${name}-work`]);
+    rmSync9(socketDir(name), { recursive: true, force: true });
+  };
+  const containerEnv = () => {
+    const proxyUrl = `http://${PROXY_ALIAS}:${PROXY_PORT}`;
+    const git = [
+      ["credential.helper", ""],
+      // The helper speaks a socket, not the network: no proxy, and none of
+      // Node's warning about it in git's output.
+      ["credential.helper", "!NODE_USE_ENV_PROXY= cabane-companion git-credential"],
+      ...opts.gitHosts.flatMap((h) => [
+        [`url.https://${h}/.insteadOf`, `git@${h}:`],
+        [`url.https://${h}/.insteadOf`, `ssh://git@${h}/`]
+      ])
+    ];
+    return {
+      HOME: CONTAINER_HOME,
+      CABANE_COMPANION_HOME: CONTAINER_STATE,
+      CABANE_RUNNER_STATE_DIR: CONTAINER_STATE,
+      HTTPS_PROXY: proxyUrl,
+      HTTP_PROXY: proxyUrl,
+      https_proxy: proxyUrl,
+      http_proxy: proxyUrl,
+      NO_PROXY: "localhost,127.0.0.1,::1",
+      no_proxy: "localhost,127.0.0.1,::1",
+      // Node's own fetch — the runner's wire — honours the proxy only when asked.
+      NODE_USE_ENV_PROXY: "1",
+      CABANE_GIT_CREDENTIAL_SOCKET: `${CONTAINER_SOCKETS}/git.sock`,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_CONFIG_COUNT: String(git.length),
+      ...Object.fromEntries(
+        git.flatMap(([k, v], i) => [
+          [`GIT_CONFIG_KEY_${i}`, k],
+          [`GIT_CONFIG_VALUE_${i}`, v]
+        ])
+      )
+    };
+  };
+  const heldFor = (handle) => {
+    const h = held.get(handle.id);
+    if (!h) throw new Error(`docker: ${handle.id} is not held`);
+    return h;
+  };
+  const writeMarker = (name, attemptId) => execIn(name, [
+    "sh",
+    "-c",
+    `mkdir -p ${CONTAINER_STATE} && printf %s "$1" > ${CONTAINER_STATE}/attempt`,
+    "sh",
+    attemptId
+  ]);
+  const readDir = async (name, from) => {
+    const r = await execIn(name, [
+      "sh",
+      "-c",
+      '[ -e "$1" ] && chmod -R u+rwX "$1"; exec node -e "$2" "$1" "$3"',
+      "sh",
+      from,
+      DUMP_SCRIPT,
+      String(collectCap)
+    ]);
+    if (r.code !== 0) {
+      log.warn(
+        { container: name, dir: from, err: r.stderr.trim() },
+        "runners: couldn't read what the runner left"
+      );
+      return null;
+    }
+    try {
+      const dump = JSON.parse(r.stdout);
+      if (typeof dump.complete !== "boolean" || !Array.isArray(dump.files)) return null;
+      return {
+        complete: dump.complete,
+        files: dump.files.filter(
+          (f) => typeof f.name === "string" && typeof f.data === "string"
+        ).map((f) => ({ name: f.name, data: Buffer.from(f.data, "base64") }))
+      };
+    } catch {
+      return null;
+    }
+  };
+  const removeIn = (name, from, names) => names.length ? execIn(name, ["sh", "-c", 'cd "$1" && shift && rm -f -- "$@"', "sh", from, ...names]) : Promise.resolve(null);
+  const pendingPath = (name) => join17(opts.deviceDir, "runners-pending", `${name}.json`);
+  const readPending = (name) => {
+    try {
+      const ids = JSON.parse(readFileSync9(pendingPath(name), "utf8"));
+      return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
+    } catch {
+      return [];
+    }
+  };
+  const writePending = (name, ids) => {
+    if (!ids.length) {
+      rmSync9(pendingPath(name), { force: true });
+      return;
+    }
+    mkdirSync10(join17(opts.deviceDir, "runners-pending"), { recursive: true });
+    writeFileSync6(pendingPath(name), JSON.stringify([...new Set(ids)]));
+  };
+  const keepSession = async (name, attempt, attemptId) => {
+    const archive = sessionArchivePath(opts.deviceDir, attemptId);
+    mkdirSync10(join17(archive, ".."), { recursive: true });
+    const partial = `${archive}.${process.pid}.partial`;
+    const file = new CappedFile(partial, sessionCap);
+    const r = await execIn(
+      name,
+      [
+        "sh",
+        "-c",
+        'cd "$HOME" && set -- && for p in .claude/projects .codex; do [ -e "$p" ] && set -- "$@" "$p"; done; [ $# -gt 0 ] || exit 3; exec tar -cf - --exclude=.codex/auth.json "$@"'
+      ],
+      { stdout: file }
+    );
+    await new Promise(
+      (resolve2) => file.writableFinished ? resolve2() : file.once("finish", resolve2)
+    );
+    if (r.code === 0 && !file.over) {
+      renameSync5(partial, archive);
+      writeFileSync6(join17(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
+      pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
+      await writeMarker(name, attemptId);
+      log.debug({ container: name, attemptId, bytes: file.bytes }, "runners: session files kept");
+      return;
+    }
+    rmSync9(partial, { force: true });
+    if (r.code === 3 && !file.over) return;
+    dropArchive(attemptId);
+    log.warn(
+      file.over ? { container: name, attemptId, capBytes: sessionCap } : { container: name, attemptId, err: r.stderr.trim() },
+      file.over ? "runners: the session files are over the size cap and weren't kept; the next new container starts the session over" : "runners: couldn't keep the session files; the next new container starts the session over"
+    );
+  };
+  const stagingDir = (name) => join17(opts.deviceDir, "runners-pending", `${name}.outbox`);
+  const ensureRunning = async (name) => {
+    const seen = await docker.run(["inspect", "-f", "{{.State.Running}}", name]);
+    if (seen.code !== 0) return false;
+    if (seen.stdout.trim() === "true") return true;
+    return (await docker.run(["start", name])).code === 0;
+  };
+  const dropArchive = (attemptId) => {
+    rmSync9(join17(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
+      recursive: true,
+      force: true
+    });
+  };
+  const RETIRE_SCRIPT = [
+    `chmod -R u+rwX /work ${CONTAINER_HOME}`,
+    "find /work -mindepth 1 -delete",
+    `find ${CONTAINER_HOME} -mindepth 1 -delete`,
+    `cp -a /etc/skel/. ${CONTAINER_HOME}/`,
+    `mkdir -p ${CONTAINER_HOME}/.codex`,
+    `cp /opt/cabane/codex-config.toml ${CONTAINER_HOME}/.codex/config.toml`,
+    `rm -rf ${CONTAINER_STATE}/prepared`
+  ].join(" && ");
+  const provider = {
+    name: "docker",
+    inheritsEnvironment: false,
+    async acquire(attempt) {
+      const name = containerName(attempt);
+      const before = queues.get(name) ?? Promise.resolve();
+      let release;
+      const mine = new Promise((resolve2) => release = resolve2);
+      const tail = before.then(() => mine);
+      queues.set(name, tail);
+      void tail.then(() => {
+        if (queues.get(name) === tail) queues.delete(name);
+      });
+      await before;
+      try {
+        await ensureNetwork();
+        mkdirSync10(socketRoot, { recursive: true, mode: 448 });
+        mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
+        let seen = await docker.run([
+          "inspect",
+          "-f",
+          '{{.State.Running}} {{index .Config.Labels "cabane.companion"}}',
+          name
+        ]);
+        if (seen.code === 0 && seen.stdout.trim().split(" ")[1] !== companionLabel) {
+          held.set(name, { attempt, release: () => {
+          }, collected: false });
+          let collected = false;
+          try {
+            await provider.collect({ provider: "docker", id: name }, { attemptId: null });
+            collected = held.get(name)?.collected === true;
+          } finally {
+            held.delete(name);
+          }
+          if (!collected)
+            throw new Error(
+              "docker: this conversation's container runs another companion and what it holds couldn't be collected"
+            );
+          await destroy(name);
+          log.info(
+            { container: name },
+            "runners: replaced a container made with another companion"
+          );
+          seen = { code: 1, stdout: "", stderr: "" };
+        }
+        if (seen.code !== 0) {
+          await create(name, attempt);
+          log.debug({ container: name }, "runners: container created");
+        }
+        if (seen.stdout.trim().split(" ")[0] !== "true")
+          await must(["start", name], "starting the container");
+        const git = await serveGitCredentials({
+          socketPath: join17(socketDir(name), "git.sock"),
+          hosts: opts.gitHosts,
+          fill: opts.gitFill,
+          log
+        });
+        held.set(name, { attempt, release, git, collected: false });
+        return { provider: "docker", id: name };
+      } catch (err) {
+        const keep = opts.keepContainers || readPending(name).length > 0;
+        await (keep ? docker.run(["stop", "-t", "1", name]) : destroy(name)).catch(() => {
+        });
+        release();
+        throw err;
+      }
+    },
+    async bindAttempt(handle, attemptId) {
+      const name = handle.id;
+      const marker = await execIn(name, ["cat", `${CONTAINER_STATE}/attempt`]);
+      const bound = marker.code === 0 ? marker.stdout.trim() : "";
+      if (bound === (attemptId ?? "")) return;
+      const { attempt } = heldFor(handle);
+      pruneOtherAttempts(opts.deviceDir, attempt, attemptId ?? "");
+      if (bound) {
+        const wiped = await execIn(name, ["sh", "-c", RETIRE_SCRIPT]);
+        if (wiped.code !== 0)
+          throw new Error(`docker: couldn't clear the retired attempt: ${wiped.stderr.trim()}`);
+        log.info(
+          { container: name, retired: bound, attemptId },
+          "runners: retired attempt cleared"
+        );
+      }
+      if (attemptId && UUID_RE.test(attemptId)) {
+        const archive = sessionArchivePath(opts.deviceDir, attemptId);
+        if (existsSync13(archive)) {
+          const r = await execIn(name, ["tar", "-x", "-C", CONTAINER_HOME, "-f", "-"], {
+            input: createReadStream(archive)
+          });
+          if (r.code !== 0) {
+            log.warn(
+              { container: name, attemptId, err: r.stderr.trim() },
+              "runners: couldn't restore the session files; the runtime will start its session over"
+            );
+          } else {
+            log.info(
+              { container: name, attemptId, bytes: statSync3(archive).size },
+              "runners: session files restored"
+            );
+          }
+        } else {
+          log.info(
+            { container: name, attemptId },
+            "runners: no session files kept for this attempt on this device"
+          );
+        }
+      }
+      await writeMarker(name, attemptId ?? "");
+    },
+    exec(handle, argv, env, { signal, stdin }) {
+      const name = handle.id;
+      const pidFile = `/tmp/cabane-runner-${randomUUID5()}.pid`;
+      const passed = { ...env, ...opts.runtimeEnv?.() ?? {} };
+      const literal = containerEnv();
+      const args = [
+        "exec",
+        "-i",
+        "-u",
+        "runner",
+        "-w",
+        CONTAINER_HOME,
+        ...Object.entries(literal).flatMap(([k, v]) => ["-e", `${k}=${v}`]),
+        ...Object.keys(passed).flatMap((k) => ["-e", k]),
+        name,
+        "sh",
+        "-c",
+        'echo $$ > "$0" && exec "$@"',
+        pidFile,
+        ...argv
+      ];
+      const child = docker.spawn(args, passed);
+      child.stdin?.on("error", () => {
+      });
+      if (stdin) child.stdin?.write(stdin);
+      let forceTimer;
+      const stop = () => {
+        void execIn(name, ["sh", "-c", 'kill -TERM "$(cat "$1")"', "sh", pidFile]);
+        forceTimer = setTimeout(() => void docker.run(["kill", name]), killGraceMs);
+        forceTimer.unref?.();
+      };
+      const exit = new Promise((resolve2) => {
+        let settled = false;
+        const done = (code) => {
+          if (settled) return;
+          settled = true;
+          signal.removeEventListener("abort", stop);
+          if (forceTimer) clearTimeout(forceTimer);
+          resolve2(code);
+        };
+        child.once("error", () => done(1));
+        child.once("close", (code, sig) => {
+          const signum = sig ? constants2.signals[sig] : void 0;
+          done(code ?? (signum !== void 0 ? 128 + signum : 1));
+        });
+        if (signal.aborted) stop();
+        else signal.addEventListener("abort", stop, { once: true });
+      });
+      if (!child.stdout || !child.stderr || !child.stdin)
+        throw new Error("docker: runner stdio missing");
+      return {
+        exit,
+        ...child.pid !== void 0 ? { pid: child.pid } : {},
+        stdout: child.stdout,
+        stderr: child.stderr,
+        stdin: child.stdin,
+        // The runner is the only thing this user runs in the container, so
+        // everything it left is everything the user has left.
+        async reap() {
+          await execIn(name, [
+            "sh",
+            "-c",
+            `kill -TERM -1 2>/dev/null; sleep ${REAP_GRACE_S}; kill -KILL -1 2>/dev/null; true`
+          ]);
+        }
+      };
+    },
+    async collect(handle, { attemptId }) {
+      const name = handle.id;
+      const held2 = heldFor(handle);
+      const { attempt } = held2;
+      const turnIds = [.../* @__PURE__ */ new Set([attempt.turnId, ...readPending(name)])];
+      const running = await ensureRunning(name);
+      if (attemptId && UUID_RE.test(attemptId)) {
+        if (!running) {
+          dropArchive(attemptId);
+          log.warn(
+            { container: name, attemptId },
+            "runners: couldn't reach the container to keep the session files; the next turn starts the session over"
+          );
+        } else {
+          await keepSession(name, attempt, attemptId);
+        }
+      }
+      if (!running) {
+        writePending(name, turnIds);
+        return;
+      }
+      const transcripts = await readDir(name, `${CONTAINER_STATE}/transcripts`);
+      if (transcripts) {
+        const kept = transcripts.files.filter((f) => SAFE_NAME_RE.test(f.name));
+        if (kept.length) mkdirSync10(join17(opts.hostStateDir, "transcripts"), { recursive: true });
+        for (const f of kept) writeFileSync6(join17(opts.hostStateDir, "transcripts", f.name), f.data);
+        await removeIn(
+          name,
+          `${CONTAINER_STATE}/transcripts`,
+          kept.map((f) => f.name)
+        );
+      }
+      const outboxRel = join17("outbox", encodeURIComponent(attempt.agentId));
+      const outbox = await readDir(name, `${CONTAINER_STATE}/${outboxRel}`);
+      let unpublished = false;
+      if (outbox) {
+        const scope = {
+          workspaceId: attempt.workspaceId,
+          conversationId: attempt.conversationId,
+          agentId: attempt.agentId,
+          turnIds
+        };
+        let queued = 0;
+        let refused = 0;
+        for (const f of outbox.files) {
+          let entry = null;
+          try {
+            entry = admitCollectedEntry(JSON.parse(f.data.toString("utf8")), scope);
+          } catch {
+            entry = null;
+          }
+          if (!entry) {
+            refused++;
+            continue;
+          }
+          const staged = stagingDir(name);
+          mkdirSync10(staged, { recursive: true });
+          writeFileSync6(
+            join17(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
+            `${JSON.stringify(entry)}
+`
+          );
+        }
+        await removeIn(
+          name,
+          `${CONTAINER_STATE}/${outboxRel}`,
+          outbox.files.map((f) => f.name)
+        );
+        if (outbox.complete) {
+          const published = publishStaged(
+            stagingDir(name),
+            join17(opts.hostStateDir, outboxRel),
+            opts.moveFile
+          );
+          queued = published.published;
+          if (!published.complete) {
+            unpublished = true;
+            log.warn(
+              { container: name },
+              "runners: couldn't hand all of the runner's outbox to the companion; the rest waits for the next collection"
+            );
+          }
+        }
+        if (refused) {
+          log.warn(
+            { container: name, refused },
+            "runners: refused outbox entries a runner's own credential couldn't have sent"
+          );
+        }
+        if (queued) {
+          log.info(
+            { container: name, queued },
+            "runners: delivering what the runner left in its outbox"
+          );
+          opts.onOutboxCollected?.(attempt.agentId);
+        }
+      }
+      held2.collected = !!transcripts?.complete && !!outbox?.complete && !unpublished;
+      writePending(name, held2.collected ? [] : turnIds);
+    },
+    async release(handle, { destroy: over }) {
+      const h = held.get(handle.id);
+      held.delete(handle.id);
+      try {
+        await h?.git?.close();
+        if (h && !h.collected) {
+          log.warn(
+            { container: handle.id },
+            "runners: kept the container: what its runner left couldn't be collected yet"
+          );
+          await docker.run(["stop", "-t", "10", handle.id]);
+        } else if (over || !opts.keepContainers) await destroy(handle.id);
+        else await docker.run(["stop", "-t", "10", handle.id]);
+      } finally {
+        h?.release();
+      }
+    }
+  };
+  return provider;
+}
+
+// src/providers/docker-setup.ts
+import { createHash as createHash5 } from "crypto";
+var MODEL_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "chatgpt.com",
+  "auth.openai.com"
+];
+var GIT_HOSTS = ["github.com"];
+function dockerRunnerSettings(config) {
+  const docker = config.runners?.docker ?? {};
+  const apiUrl = docker.apiUrl ?? config.baseUrl;
+  const apiHost = new URL(apiUrl).host;
+  const egressAllow = [
+    .../* @__PURE__ */ new Set([apiHost, ...MODEL_HOSTS, ...GIT_HOSTS, ...docker.egressAllow ?? []])
+  ];
+  return {
+    image: docker.image ?? baseImageTag(),
+    keepContainers: docker.keepContainers === true,
+    apiUrl,
+    egressAllow,
+    gitHosts: [...GIT_HOSTS]
+  };
+}
+function loopbackApi(apiUrl) {
+  const host = new URL(apiUrl).hostname;
+  return host === "localhost" || host === "::1" || host === "[::1]" || host.startsWith("127.");
+}
+function deviceKey(config) {
+  const seed = config.deviceId ?? config.baseUrl;
+  return createHash5("sha256").update(seed).digest("hex").slice(0, 12);
+}
+function resolveRuntimeEnv(env, store, log) {
+  const out = {};
+  for (const [name, template] of Object.entries(env ?? {})) {
+    const missing = [];
+    const value = template.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, key) => {
+      const v = store.get(key);
+      if (v === void 0) missing.push(key);
+      return v ?? "";
+    });
+    if (missing.length) {
+      log?.warn({ name, missing }, "runners: a runner env value names secrets this device lacks");
+      continue;
+    }
+    out[name] = value;
+  }
+  return out;
+}
+async function probeRunner(docker, image, source, log) {
+  const r = await docker.run(
+    [
+      "run",
+      "--rm",
+      "--network",
+      "none",
+      ...companionMountArgs(source),
+      image,
+      "cabane-companion",
+      "run-turn",
+      "--manifest"
+    ],
+    { timeoutMs: 6e4 }
+  );
+  try {
+    const manifest = JSON.parse(r.stdout.trim());
+    log.info(
+      { image, version: manifest.version, bundled: manifest.bundled },
+      "runners: runner ready"
+    );
+    return manifest;
+  } catch {
+    log.error(
+      { image, err: r.stderr.trim().slice(-2e3) },
+      "runners: the companion didn't start in a runner container"
+    );
+    return null;
+  }
+}
+function imageResolution(manifest, image, runtime) {
+  const status = manifest?.bundled[runtime] ?? "platform_package_missing";
+  return {
+    runtime,
+    status,
+    path: status === "present" ? `${image} (bundled)` : null,
+    packageName: null,
+    platform: "linux",
+    arch: "image"
+  };
+}
+function containerHookPath(hostPath) {
+  const name = hostPath.split("/").pop() || "hook";
+  const tag = createHash5("sha256").update(hostPath).digest("hex").slice(0, 8);
+  return `/opt/cabane/hooks/${tag}-${name}`;
+}
+
+// src/runner/device-locks.ts
+var DeviceLocks = class {
+  holders = /* @__PURE__ */ new Map();
+  queues = /* @__PURE__ */ new Map();
+  // `owner` is unique across the device; `grant` is called once, when it holds.
+  request(key, owner, grant) {
+    if (!this.holders.has(key)) {
+      this.holders.set(key, owner);
+      grant();
+      return;
+    }
+    const queue = this.queues.get(key) ?? [];
     queue.push({ owner, grant });
     this.queues.set(key, queue);
   }
@@ -10798,10 +12171,10 @@ var DeviceLocks = class {
 
 // src/runner/harness-sandbox.ts
 import { lookup } from "dns/promises";
-import { chmodSync as chmodSync5, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync as chmodSync6, mkdirSync as mkdirSync11, mkdtempSync, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
 import { isIP } from "net";
-import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
-import { join as join15 } from "path";
+import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
+import { join as join18 } from "path";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
@@ -10900,15 +12273,15 @@ var DispatchClaims = class {
 
 // src/outbox.ts
 import {
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync10,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync8,
-  renameSync as renameSync4,
-  rmSync as rmSync8,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync12,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync10,
+  renameSync as renameSync6,
+  rmSync as rmSync11,
+  writeFileSync as writeFileSync8
 } from "fs";
-import { join as join16 } from "path";
+import { join as join19 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -10921,25 +12294,25 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join16(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join19(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join19(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
   // per-workspace bounds.
   persist(entry) {
     const dir2 = this.dir();
-    mkdirSync10(dir2, { recursive: true });
+    mkdirSync12(dir2, { recursive: true });
     const target = this.fileFor(entry.turnId, entry.seq);
     const tmp = `${target}.${process.pid}.tmp`;
     try {
-      writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
-      renameSync4(tmp, target);
+      writeFileSync8(tmp, JSON.stringify(entry) + "\n", "utf8");
+      renameSync6(tmp, target);
     } catch (err) {
       try {
-        rmSync8(tmp, { force: true });
+        rmSync11(tmp, { force: true });
       } catch {
       }
       this.log?.warn(
@@ -10956,19 +12329,19 @@ var Outbox = class {
   // wedging the drain.
   list() {
     const dir2 = this.dir();
-    if (!existsSync11(dir2)) return [];
+    if (!existsSync14(dir2)) return [];
     let names;
     try {
-      names = readdirSync3(dir2);
+      names = readdirSync5(dir2);
     } catch {
       return [];
     }
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join16(dir2, name);
+      const full = join19(dir2, name);
       try {
-        const parsed = JSON.parse(readFileSync8(full, "utf8"));
+        const parsed = JSON.parse(readFileSync10(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
           entries.push(parsed);
         } else {
@@ -11002,8 +12375,8 @@ var Outbox = class {
   // different: it is positive evidence that nothing was ever queued here.
   maxSeqForTurn(turnId) {
     const dir2 = this.dir();
-    if (!existsSync11(dir2)) return 0;
-    const names = readdirSync3(dir2);
+    if (!existsSync14(dir2)) return 0;
+    const names = readdirSync5(dir2);
     const prefix = `${encodeURIComponent(turnId)}__`;
     let max = 0;
     for (const name of names) {
@@ -11016,15 +12389,15 @@ var Outbox = class {
   // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
   remove(turnId, seq) {
     try {
-      rmSync8(this.fileFor(turnId, seq), { force: true });
+      rmSync11(this.fileFor(turnId, seq), { force: true });
     } catch {
     }
   }
   size() {
     const dir2 = this.dir();
-    if (!existsSync11(dir2)) return 0;
+    if (!existsSync14(dir2)) return 0;
     try {
-      return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
+      return readdirSync5(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
       return 0;
     }
@@ -11035,7 +12408,7 @@ var Outbox = class {
       "A saved update is unreadable and couldn't be delivered. Check the conversation for missing replies."
     );
     try {
-      rmSync8(full, { force: true });
+      rmSync11(full, { force: true });
     } catch {
     }
   }
@@ -11282,8 +12655,27 @@ var CompanionSupervisor = class {
     if (opts.runnerCommand) this.runnerCommand = opts.runnerCommand;
     if (opts.runnerProvider) this.providerForRunners = opts.runnerProvider;
     this.unrunnableRetryDelaysMs = opts.unrunnableRetryDelaysMs ?? DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS;
+    if (this.dockerRunners()) {
+      const { image } = dockerRunnerSettings(this.config);
+      this.resolveBundled = (runtime) => imageResolution(this.runnerImage, image, runtime);
+    }
     this.latchBootBundledState();
   }
+  // CT1681: what a runner container said it can run, probed once at start;
+  // null until then, and when no container could be started.
+  runnerImage = null;
+  // CT1681: the companion every container mounts — this one's own install.
+  runnerCompanion() {
+    return companionSource({
+      configured: this.config.runners?.docker?.companionDir,
+      platform: process.platform,
+      version: COMPANION_VERSION,
+      own: ownInstall()
+    });
+  }
+  dockerRunners() {
+    return runnersEnabled(this.config) && this.config.runners?.provider === "docker";
+  }
   // Stand up the data plane: pair check, initial assignments pull, then the
   // heartbeat + poll loops. A companion with no device token (logged out) does
   // nothing but say so.
@@ -11292,6 +12684,24 @@ var CompanionSupervisor = class {
       { protocolVersion: TURN_PROTOCOL_VERSION, version: COMPANION_VERSION },
       `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname2()}`
     );
+    if (this.dockerRunners() && !this.providerForRunners) {
+      const { image, apiUrl } = dockerRunnerSettings(this.config);
+      if (loopbackApi(apiUrl)) {
+        this.log.error(
+          { apiUrl },
+          "runners: a container can't reach this machine's loopback; set runners.docker.apiUrl to an address it can"
+        );
+      }
+      const source = this.runnerCompanion();
+      const docker = dockerCli();
+      if ("error" in source) {
+        this.log.error({ reason: source.error }, "runners: no companion to put in a container");
+      } else if (await ensureBaseImage(docker, image, this.log) && await ensureCompanionVolume(docker, image, source, this.log)) {
+        this.runnerImage = await probeRunner(docker, image, source, this.log);
+        if (!this.runnerImage) await invalidateCompanionVolume(docker, image, source);
+      }
+      this.latchBootBundledState();
+    }
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
     if (!this.config.deviceToken) {
@@ -11399,7 +12809,9 @@ var CompanionSupervisor = class {
           runtimeIssues: this.runtimeIssues(),
           // CT571/CT586: each runtime's `version` from the latest harness probe
           // (fail-soft to null). Informational only — the server matches on name.
-          versions: this.harnessVersions
+          versions: this.harnessVersions,
+          // CT1681: shown on the device page.
+          ...runnersEnabled(this.config) ? { runnerProvider: this.config.runners?.provider ?? "local-process" } : {}
         }),
         // CT566: echo the last classified credential state per runtime, when the
         // companion has seen any. Omitted (undefined) until the first observed
@@ -11732,21 +13144,71 @@ var CompanionSupervisor = class {
   // can't make the sandbox says so once and runs its turns unwrapped.
   sandboxUsable;
   runnerSandbox() {
-    if (this.config.runners?.sandbox !== "os") return "none";
+    if (this.config.runners?.sandbox !== "os" || this.dockerRunners()) return "none";
     this.sandboxUsable ??= osSandboxUsable(this.log);
     return this.sandboxUsable ? "os" : "none";
   }
   // CT1679: one provider for the device, built on first use.
   runnerProvider() {
-    this.providerForRunners ??= createLocalProcessProvider();
+    this.providerForRunners ??= this.dockerRunners() ? this.createDockerRunners() : createLocalProcessProvider();
     return this.providerForRunners;
   }
+  createDockerRunners() {
+    const settings = dockerRunnerSettings(this.config);
+    const docker = this.config.runners?.docker ?? {};
+    const hooks = [
+      this.config.prepareHook?.command,
+      ...Object.values(this.config.agents ?? {}).map((a) => a.prepareHook?.command)
+    ].filter((c) => typeof c === "string");
+    const source = this.runnerCompanion();
+    return createDockerProvider({
+      image: settings.image,
+      // Without a companion nothing is advertised, so nothing is sent; a turn
+      // that arrives anyway fails at the mount and says so.
+      companion: "error" in source ? { kind: "dir", path: "/nonexistent", key: "none" } : source,
+      deviceKey: deviceKey(this.config),
+      keepContainers: settings.keepContainers,
+      egressAllow: settings.egressAllow,
+      gitHosts: settings.gitHosts,
+      gitFill: deviceGitFill(docker.gitCredentialHelper),
+      runtimeEnv: () => resolveRuntimeEnv(
+        docker.env,
+        loadSecretStoreTolerant(
+          (m) => this.log.warn(
+            { err: m },
+            "Could not read the secrets file. Check ~/.cabane/secrets.json."
+          )
+        ),
+        this.log
+      ),
+      mounts: [...new Set(hooks)].map((source2) => ({ source: source2, target: containerHookPath(source2) })),
+      deviceDir: cabaneDir(),
+      hostStateDir: runnerStateDir(),
+      onOutboxCollected: (agentId) => {
+        for (const wr of this.workspaces.values()) wr.agents.get(agentId)?.kickDrain();
+      },
+      log: this.log
+    });
+  }
+  // CT1681: the runner command for this device's provider: the image's own
+  // companion in a container, this process's otherwise.
+  runnerCommandFor() {
+    if (this.runnerCommand) return this.runnerCommand;
+    return this.dockerRunners() ? ["cabane-companion", "run-turn"] : selfRunnerCommand();
+  }
   buildDispatcher(ctx) {
-    const local = localAgentConfig(this.config, {
+    const hostLocal = localAgentConfig(this.config, {
       agentId: ctx.agentId,
       agentUsername: ctx.agentUsername,
       workspaceSlug: ctx.workspaceSlug
     });
+    const local = this.dockerRunners() && hostLocal.prepareHook ? {
+      ...hostLocal,
+      prepareHook: {
+        ...hostLocal.prepareHook,
+        command: containerHookPath(hostLocal.prepareHook.command)
+      }
+    } : hostLocal;
     if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
     return new Dispatcher({
       deviceId: this.deviceId ?? void 0,
@@ -11795,7 +13257,8 @@ var CompanionSupervisor = class {
       ...runnersEnabled(this.config) ? {
         runner: {
           provider: this.runnerProvider(),
-          command: this.runnerCommand ?? selfRunnerCommand(),
+          command: this.runnerCommandFor(),
+          ...this.dockerRunners() ? { runnerBaseUrl: dockerRunnerSettings(this.config).apiUrl } : {},
           reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
@@ -12119,7 +13582,7 @@ var CompanionSupervisor = class {
       );
     }
     const resumedTurnId = recoveredTurnId ?? (dispatchId ? turnIdForEvent(workspaceId, dispatchId) : null);
-    const turnId = resumedTurnId ?? randomUUID5();
+    const turnId = resumedTurnId ?? randomUUID6();
     if (dispatchId) {
       const liveTurnIds = rememberTurnId(workspaceId, dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
@@ -12424,9 +13887,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn7 }) => {
+  void import("child_process").then(({ spawn: spawn9 }) => {
     try {
-      const child = spawn7(process.execPath, process.argv.slice(1), {
+      const child = spawn9(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -12496,22 +13959,22 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync9, writeFileSync as writeFileSync8 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync11, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
+import { join as join20 } from "path";
 function crashMarkerPath() {
-  return join17(cabaneDir(), "last-error.json");
+  return join20(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
-    mkdirSync11(cabaneDir(), { recursive: true });
-    writeFileSync8(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
+    mkdirSync13(cabaneDir(), { recursive: true });
+    writeFileSync9(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
   } catch {
   }
 }
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync12(path)) rmSync9(path, { force: true });
+    if (existsSync15(path)) rmSync12(path, { force: true });
   } catch {
   }
 }
@@ -12554,7 +14017,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID6();
+  const instanceId = randomUUID7();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();