@cabane/companion 0.6.124 → 0.6.126

package/dist/cli.js

@@ -541,10 +541,45 @@ var init_config = __esm({
       // wraps the runner in an OS sandbox where the host supports one; `'none'`
       // (the default) runs it as a plain child beside this process, a supported
       // configuration in its own right rather than a degraded one.
+      // CT1684: `policy` is what the OS sandbox lets a turn reach, read and hold
+      // (`runner/sandbox-policy.ts`). It is validated there rather than here, so a
+      // bad policy refuses the turns it governs, with the field named, instead of
+      // keeping the companion from starting at all.
       runners: z2.object({
         enabled: z2.boolean().optional(),
-        provider: z2.literal("local-process").optional(),
-        sandbox: z2.enum(["os", "none"]).optional()
+        provider: z2.enum(["local-process", "docker"]).optional(),
+        sandbox: z2.enum(["os", "none"]).optional(),
+        // CT1681: the `docker` provider — a container per conversation and agent,
+        // from one image, on a network whose only way out is an allow-listed proxy.
+        docker: z2.object({
+          // The base image a container runs. Default: the one this companion
+          // builds from its own Dockerfile on first use. One named here must
+          // have that one's layout (the `runner` user, `cabane-companion` on
+          // PATH reading `CABANE_COMPANION_ROOT`).
+          image: z2.string().min(1).optional(),
+          // The companion install mounted into every container. Default, on
+          // Linux: this companion's own. Needed for one run from a checkout
+          // (a `pnpm --filter @cabane/companion deploy --prod <dir>`).
+          companionDir: z2.string().min(1).optional(),
+          // Hosts a turn may reach besides the Cabane API, the model providers
+          // and the git host. `*.example.com` matches any subdomain.
+          egressAllow: z2.array(z2.string().min(1)).optional(),
+          // Keep a turn's container between turns and start it again for the
+          // next one. Off by default: the container goes after every turn and
+          // the runtime's session files are restored into the next.
+          keepContainers: z2.boolean().optional(),
+          // The Cabane URL as a container reaches it, for a device whose own
+          // `baseUrl` is a loopback address the container can't see.
+          apiUrl: z2.string().url().refine(isAllowedBaseUrl).optional(),
+          // Env set on each turn's runner, `${NAME}` resolved from secrets.json
+          // at exec: the runtime's own auth, which the image never carries.
+          env: z2.record(z2.string(), z2.string()).optional(),
+          // A git credential helper run on this device to answer the
+          // container's git for an allowed host, e.g. `!gh auth git-credential`.
+          // Absent: git's own configured helpers on this device.
+          gitCredentialHelper: z2.string().min(1).optional()
+        }).strict().optional(),
+        policy: z2.unknown().optional()
       }).strict().optional()
     });
   }
@@ -2543,8 +2578,8 @@ var init_policy = __esm({
 // packages/agent-runtime/src/claude-code/model.ts
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep = model.indexOf("/");
-  const bare = sep === -1 || model.slice(0, sep) !== "anthropic" ? model : model.slice(sep + 1);
+  const sep2 = model.indexOf("/");
+  const bare = sep2 === -1 || model.slice(0, sep2) !== "anthropic" ? model : model.slice(sep2 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 var CLAUDE_CODE_DEFAULT_MODEL_BARE;
@@ -3991,9 +4026,9 @@ var init_policy2 = __esm({
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep = model.indexOf("/");
-  if (sep === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep), modelID: model.slice(sep + 1) };
+  const sep2 = model.indexOf("/");
+  if (sep2 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep2), modelID: model.slice(sep2 + 1) };
 }
 var init_model2 = __esm({
   "packages/agent-runtime/src/opencode/model.ts"() {
@@ -4262,10 +4297,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep;
-      while ((sep = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep);
-        buf = buf.slice(sep + 2);
+      let sep2;
+      while ((sep2 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep2);
+        buf = buf.slice(sep2 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -5291,8 +5326,8 @@ var init_policy3 = __esm({
 
 // packages/agent-runtime/src/codex/model.ts
 function parseCodexModel(model) {
-  const sep = model.indexOf("/");
-  const bare = sep === -1 || model.slice(0, sep) !== "openai" ? model : model.slice(sep + 1);
+  const sep2 = model.indexOf("/");
+  const bare = sep2 === -1 || model.slice(0, sep2) !== "openai" ? model : model.slice(sep2 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 var CODEX_DEFAULT_MODEL_BARES;
@@ -6632,6 +6667,173 @@ var init_src = __esm({
   }
 });
 
+// src/runner/sandbox-policy.ts
+import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
+import { globToRegex } from "@anthropic-ai/sandbox-runtime/dist/sandbox/sandbox-utils.js";
+import { z as z13 } from "zod";
+function parseSandboxPolicy(raw) {
+  if (raw === void 0) return { ok: true, policy: {} };
+  const result = sandboxPolicySchema.safeParse(raw);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    return { ok: false, error: `${fieldPath(issue.path)}: ${issue.message}` };
+  }
+  const refused = unenforceable(result.data);
+  return refused ? { ok: false, error: refused } : { ok: true, policy: result.data };
+}
+function fieldPath(path) {
+  return ["runners", "policy", ...path.map(String)].join(".");
+}
+function unenforceable(policy) {
+  const hostLists = [
+    ["hosts.allow", "allowedDomains", policy.hosts?.allow],
+    ["hosts.deny", "deniedDomains", policy.hosts?.deny],
+    ...Object.entries(policy.credentials?.env ?? {}).map(
+      ([name, entry]) => [
+        `credentials.env.${name}.hosts`,
+        "allowedDomains",
+        entry.hosts
+      ]
+    )
+  ];
+  for (const [field, as, hosts] of hostLists) {
+    for (const [i, host] of (hosts ?? []).entries()) {
+      const check = NetworkConfigSchema.safeParse({
+        allowedDomains: as === "allowedDomains" ? [host] : [],
+        deniedDomains: as === "deniedDomains" ? [host] : []
+      });
+      if (!check.success) {
+        const message = check.error.issues[0]?.message ?? "not a host pattern the sandbox accepts";
+        return `runners.policy.${field}.${i}: ${message}`;
+      }
+    }
+  }
+  const pathLists = [
+    ["filesystem.denyRead", policy.filesystem?.denyRead],
+    ["filesystem.allowRead", policy.filesystem?.allowRead],
+    ["filesystem.allowWrite", policy.filesystem?.allowWrite]
+  ];
+  for (const [field, paths] of pathLists) {
+    for (const [i, path] of (paths ?? []).entries()) {
+      try {
+        new RegExp(globToRegex(path));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return `runners.policy.${field}.${i}: not a pattern the sandbox can match (${message})`;
+      }
+    }
+  }
+  return null;
+}
+function modelHostsFor(runtime) {
+  if (runtime === "claude-code") return ANTHROPIC_HOSTS;
+  if (runtime === "codex") return OPENAI_HOSTS;
+  return [...ANTHROPIC_HOSTS, ...OPENAI_HOSTS];
+}
+function gitAuthVar(index) {
+  return `CABANE_GIT_AUTH_${index}`;
+}
+function resolvePolicyCredentials(policy, store) {
+  const missing = /* @__PURE__ */ new Set();
+  const credentials = [];
+  const lookup2 = (ref) => {
+    const name = placeholderName(ref);
+    const value = store.get(name);
+    if (value === void 0) missing.add(name);
+    return value;
+  };
+  for (const [name, entry] of Object.entries(policy.credentials?.env ?? {})) {
+    const value = lookup2(entry.secret);
+    if (value === void 0) continue;
+    credentials.push({ name, value, hosts: entry.hosts });
+  }
+  (policy.credentials?.git ?? []).forEach((entry, i) => {
+    const secret = lookup2(entry.secret);
+    if (secret === void 0) return;
+    const user = entry.username ?? "x-access-token";
+    credentials.push({
+      name: gitAuthVar(i),
+      value: Buffer.from(`${user}:${secret}`).toString("base64"),
+      hosts: [entry.host.replace(/:\d+$/, "")],
+      gitHost: entry.host
+    });
+  });
+  return { credentials, missing: [...missing].sort() };
+}
+function policyHasCredentials(policy) {
+  return Object.keys(policy.credentials?.env ?? {}).length > 0 || (policy.credentials?.git ?? []).length > 0;
+}
+function postureLines(parsed) {
+  if (!parsed.ok) return [`policy invalid \u2014 turns are refused until it's fixed: ${parsed.error}`];
+  const { policy } = parsed;
+  const mode = policy.filesystem?.mode ?? "blocklist";
+  const defaults = policy.hosts?.defaults !== false;
+  const lines2 = [
+    `filesystem: ${mode}${mode === "strict" ? " (home unreadable except the checkout, harness state and allowRead)" : ""}`,
+    `hosts: Cabane + the turn's model provider${defaults ? " + defaults (GitHub, npm, PyPI, crates.io)" : ""}${policy.hosts?.allow?.length ? ` + ${policy.hosts.allow.join(", ")}` : ""}`
+  ];
+  if (policy.hosts?.deny?.length) lines2.push(`hosts denied: ${policy.hosts.deny.join(", ")}`);
+  const extraDeny = policy.filesystem?.denyRead ?? [];
+  if (extraDeny.length) lines2.push(`denied reads (extra): ${extraDeny.join(", ")}`);
+  const allowRead = policy.filesystem?.allowRead ?? [];
+  if (allowRead.length) lines2.push(`reads allowed back: ${allowRead.join(", ")}`);
+  const allowWrite = policy.filesystem?.allowWrite ?? [];
+  if (allowWrite.length) lines2.push(`writes allowed (extra): ${allowWrite.join(", ")}`);
+  const env = Object.keys(policy.credentials?.env ?? {});
+  const git = (policy.credentials?.git ?? []).map((g) => `git@${g.host}`);
+  if (env.length || git.length) {
+    lines2.push(`masked credentials: ${[...env, ...git].join(", ")}`);
+  }
+  return lines2;
+}
+var hostPattern, secretRef, envCredentialSchema, gitCredentialSchema, sandboxPolicySchema, DEFAULT_ALLOWED_HOSTS, ANTHROPIC_HOSTS, OPENAI_HOSTS, placeholderName, HarnessSandboxRefused;
+var init_sandbox_policy = __esm({
+  "src/runner/sandbox-policy.ts"() {
+    "use strict";
+    hostPattern = z13.string().min(1);
+    secretRef = z13.string().regex(/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/, "must be a ${NAME} reference into secrets.json");
+    envCredentialSchema = z13.object({ secret: secretRef, hosts: z13.array(hostPattern).min(1) }).strict();
+    gitCredentialSchema = z13.object({
+      host: z13.string().regex(/^[A-Za-z0-9.-]+(:\d+)?$/, "must be a host name, like github.com"),
+      username: z13.string().min(1).optional(),
+      secret: secretRef
+    }).strict();
+    sandboxPolicySchema = z13.object({
+      hosts: z13.object({
+        allow: z13.array(hostPattern).optional(),
+        deny: z13.array(hostPattern).optional(),
+        defaults: z13.boolean().optional()
+      }).strict().optional(),
+      filesystem: z13.object({
+        mode: z13.enum(["blocklist", "strict"]).optional(),
+        denyRead: z13.array(z13.string().min(1)).optional(),
+        allowRead: z13.array(z13.string().min(1)).optional(),
+        allowWrite: z13.array(z13.string().min(1)).optional()
+      }).strict().optional(),
+      credentials: z13.object({
+        env: z13.record(z13.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), envCredentialSchema).optional(),
+        git: z13.array(gitCredentialSchema).optional()
+      }).strict().optional()
+    }).strict();
+    DEFAULT_ALLOWED_HOSTS = [
+      "github.com",
+      "*.github.com",
+      "*.githubusercontent.com",
+      "registry.npmjs.org",
+      "pypi.org",
+      "files.pythonhosted.org",
+      "crates.io",
+      "static.crates.io",
+      "index.crates.io"
+    ];
+    ANTHROPIC_HOSTS = ["api.anthropic.com", "*.anthropic.com", "claude.ai", "*.claude.ai"];
+    OPENAI_HOSTS = ["api.openai.com", "auth.openai.com", "chatgpt.com", "*.chatgpt.com"];
+    placeholderName = (ref) => ref.slice(2, -1);
+    HarnessSandboxRefused = class extends Error {
+    };
+  }
+});
+
 // src/runner/opencode-lock.ts
 function opencodeLockKey(serverUrl) {
   return `opencode:${serverUrl}`;
@@ -6990,8 +7192,118 @@ var init_turn_containment = __esm({
   }
 });
 
+// src/secrets.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { join as join10 } from "path";
+import { z as z14 } from "zod";
+function secretsPath() {
+  return join10(cabaneDir(), "secrets.json");
+}
+function loadSecretStore() {
+  const path = secretsPath();
+  if (!existsSync7(path)) return makeStore({});
+  let raw;
+  try {
+    raw = readFileSync6(path, "utf8");
+  } catch (err) {
+    throw new ConfigError(
+      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (raw.trim().length === 0) return makeStore({});
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ConfigError(
+      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
+    );
+  }
+  const result = secretStoreSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new ConfigError(
+      `${path} must be a flat object mapping secret names to string values (e.g. { "GITHUB_TOKEN": "ghp_\u2026" }).`
+    );
+  }
+  return makeStore(result.data);
+}
+function loadSecretStoreTolerant(onWarn) {
+  try {
+    return loadSecretStore();
+  } catch (err) {
+    onWarn?.(err instanceof Error ? err.message : String(err));
+    return makeStore({});
+  }
+}
+function makeStore(map) {
+  return {
+    get: (name) => map[name],
+    names: () => Object.keys(map).sort()
+  };
+}
+function requiredSecretNames(mcpServers) {
+  const names = /* @__PURE__ */ new Set();
+  for (const server of Object.values(mcpServers ?? {})) {
+    const bags = [
+      "env" in server ? server.env : void 0,
+      "headers" in server ? server.headers : void 0
+    ];
+    for (const bag of bags) {
+      for (const value of Object.values(bag ?? {})) {
+        for (const [, name] of value.matchAll(PLACEHOLDER_RE)) names.add(name);
+      }
+    }
+  }
+  return [...names].sort();
+}
+function resolveMcpSecrets(mcpServers, store) {
+  const missing = /* @__PURE__ */ new Set();
+  const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
+    const resolved = store.get(name);
+    if (resolved === void 0) {
+      missing.add(name);
+      return _match;
+    }
+    return resolved;
+  });
+  const mapBag = (bag) => {
+    const out = {};
+    for (const [k, v] of Object.entries(bag)) out[k] = interpolate(v);
+    return out;
+  };
+  const servers = {};
+  for (const [name, server] of Object.entries(mcpServers)) {
+    const next = { ...server };
+    if ("env" in next && next.env) next.env = mapBag(next.env);
+    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    servers[name] = next;
+  }
+  return { servers, missing: [...missing].sort() };
+}
+function missingSecretReason(missing) {
+  const prefix = "missing_secret: ";
+  for (let shown = missing.length; shown >= 0; shown--) {
+    const omitted = missing.length - shown;
+    const parts = [...missing.slice(0, shown), ...omitted > 0 ? [`+${omitted}`] : []];
+    const reason = prefix + parts.join(",");
+    if (reason.length <= ERROR_REASON_MAX) return reason;
+  }
+  return `${prefix}+${missing.length}`;
+}
+var PLACEHOLDER_RE, secretStoreSchema, ERROR_REASON_MAX;
+var init_secrets = __esm({
+  "src/secrets.ts"() {
+    "use strict";
+    init_config();
+    init_errors();
+    PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+    secretStoreSchema = z14.record(z14.string(), z14.string());
+    ERROR_REASON_MAX = 200;
+  }
+});
+
 // src/run-config.ts
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 function parseRunConfig(raw, onWarn) {
   const result = runConfigSchema.safeParse(raw ?? {});
   if (result.success) return result.data;
@@ -7004,38 +7316,38 @@ var mcpStdioServerSchema, mcpHttpServerSchema, mcpSseServerSchema, mcpServerDefS
 var init_run_config = __esm({
   "src/run-config.ts"() {
     "use strict";
-    mcpStdioServerSchema = z13.object({
-      type: z13.literal("stdio").optional(),
-      command: z13.string().min(1),
-      args: z13.array(z13.string()).optional(),
-      env: z13.record(z13.string(), z13.string()).optional()
+    mcpStdioServerSchema = z15.object({
+      type: z15.literal("stdio").optional(),
+      command: z15.string().min(1),
+      args: z15.array(z15.string()).optional(),
+      env: z15.record(z15.string(), z15.string()).optional()
     });
-    mcpHttpServerSchema = z13.object({
-      type: z13.literal("http"),
-      url: z13.string().url(),
-      headers: z13.record(z13.string(), z13.string()).optional()
+    mcpHttpServerSchema = z15.object({
+      type: z15.literal("http"),
+      url: z15.string().url(),
+      headers: z15.record(z15.string(), z15.string()).optional()
     });
-    mcpSseServerSchema = z13.object({
-      type: z13.literal("sse"),
-      url: z13.string().url(),
-      headers: z13.record(z13.string(), z13.string()).optional()
+    mcpSseServerSchema = z15.object({
+      type: z15.literal("sse"),
+      url: z15.string().url(),
+      headers: z15.record(z15.string(), z15.string()).optional()
     });
-    mcpServerDefSchema = z13.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-    thinkingConfigSchema = z13.discriminatedUnion("type", [
-      z13.object({ type: z13.literal("adaptive") }),
-      z13.object({ type: z13.literal("enabled"), budgetTokens: z13.number().int().positive().optional() }),
-      z13.object({ type: z13.literal("disabled") })
+    mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+    thinkingConfigSchema = z15.discriminatedUnion("type", [
+      z15.object({ type: z15.literal("adaptive") }),
+      z15.object({ type: z15.literal("enabled"), budgetTokens: z15.number().int().positive().optional() }),
+      z15.object({ type: z15.literal("disabled") })
     ]);
-    effortSchema = z13.enum(["low", "medium", "high", "xhigh", "max"]);
-    runConfigSchema = z13.object({
+    effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
+    runConfigSchema = z15.object({
       // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
       // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
       // is the locked surface. Kept in lockstep with `@cabane/shared`'s
       // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
       // stripped, so an older companion riding a newer server never rejects the config).
-      hostAccess: z13.boolean().optional(),
-      mcpServers: z13.record(z13.string(), mcpServerDefSchema).optional(),
-      model: z13.string().min(1).optional(),
+      hostAccess: z15.boolean().optional(),
+      mcpServers: z15.record(z15.string(), mcpServerDefSchema).optional(),
+      model: z15.string().min(1).optional(),
       thinking: thinkingConfigSchema.optional(),
       effort: effortSchema.optional()
     });
@@ -7044,7 +7356,7 @@ var init_run_config = __esm({
 });
 
 // src/runner/protocol.ts
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 function required(env, name) {
   const value = env[name];
   if (!value) throw new Error(`runner: ${name} is not set`);
@@ -7057,6 +7369,7 @@ function parseRunnerInput(env, stdin) {
   return {
     baseUrl: required(env, RUNNER_ENV.url),
     credential: credentials.credential,
+    sandboxCredentials: credentials.sandboxCredentials ?? [],
     dispatch,
     turnId: required(env, RUNNER_ENV.turnId),
     resumed: env[RUNNER_ENV.resumed] === "1",
@@ -7073,7 +7386,10 @@ function runnerEnv(input) {
   };
 }
 function runnerStdin(input) {
-  return `${JSON.stringify({ credential: input.credential })}
+  return `${JSON.stringify({
+    credential: input.credential,
+    ...input.sandboxCredentials?.length ? { sandboxCredentials: input.sandboxCredentials } : {}
+  })}
 `;
 }
 function encodeLauncherMessage(message) {
@@ -7109,6 +7425,7 @@ var init_protocol = __esm({
     "use strict";
     init_config();
     init_run_config();
+    init_sandbox_policy();
     RUNNER_ENV = {
       // The wire the runner speaks.
       url: "CABANE_URL",
@@ -7122,56 +7439,75 @@ var init_protocol = __esm({
       // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
       spec: "CABANE_RUNNER_SPEC"
     };
-    runtimeHealthSchema = z14.object({
-      quotaState: z14.enum(["ok", "limited", "auth_expired", "unknown"]),
-      limitedUntil: z14.string().nullable(),
-      lastError: z14.string().nullable()
+    runtimeHealthSchema = z16.object({
+      quotaState: z16.enum(["ok", "limited", "auth_expired", "unknown"]),
+      limitedUntil: z16.string().nullable(),
+      lastError: z16.string().nullable()
     });
-    runnerSpecSchema = z14.object({
-      deviceId: z14.string().optional(),
+    runnerSpecSchema = z16.object({
+      deviceId: z16.string().optional(),
       // The launcher's boot id: the one its heartbeat carries, so a runner's lease
       // matches the device that holds it.
-      bootId: z14.string(),
-      workspaceId: z14.string(),
-      workspaceSlug: z14.string(),
-      agentId: z14.string(),
-      agentUsername: z14.string(),
-      agentName: z14.string(),
+      bootId: z16.string(),
+      workspaceId: z16.string(),
+      workspaceSlug: z16.string(),
+      agentId: z16.string(),
+      agentUsername: z16.string(),
+      agentName: z16.string(),
       local: localAgentConfigSchema,
       runConfig: runConfigSchema,
-      opencodeServerUrl: z14.string().optional(),
-      claudeCodeAvailable: z14.boolean(),
-      codexAvailable: z14.boolean(),
-      idleTimeoutMs: z14.number().int().positive().optional(),
-      totalTimeoutMs: z14.number().int().positive().optional(),
-      leaseRenewalMs: z14.number().int().positive().optional(),
-      preparingRowDelayMs: z14.number().int().nonnegative().optional(),
+      opencodeServerUrl: z16.string().optional(),
+      claudeCodeAvailable: z16.boolean(),
+      codexAvailable: z16.boolean(),
+      idleTimeoutMs: z16.number().int().positive().optional(),
+      totalTimeoutMs: z16.number().int().positive().optional(),
+      leaseRenewalMs: z16.number().int().positive().optional(),
+      preparingRowDelayMs: z16.number().int().nonnegative().optional(),
       // Whether the turn writes a transcript. The directory is the runner's own
       // (`transcriptsDir()`), so `CABANE_RUNNER_STATE_DIR` moves it with the outbox.
-      transcripts: z14.boolean(),
+      transcripts: z16.boolean(),
       // Whether the harness starts under the OS sandbox. The launcher sends 'os'
       // only when this host can make one.
-      sandbox: z14.enum(["os", "none"]),
-      logLevel: z14.string(),
+      sandbox: z16.enum(["os", "none"]),
+      // CT1684: the device's sandbox policy, validated by the launcher. Absent
+      // when the sandbox is off.
+      sandboxPolicy: sandboxPolicySchema.optional(),
+      logLevel: z16.string(),
       // The launcher's connector-health observations, by runtime, as of the start.
-      connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
+      connectorHealth: z16.record(z16.string(), runtimeHealthSchema),
       // True when this (conversation, agent) pair was already told its session
       // could not be saved: the notice is once per pair, not once per process.
-      sessionWriteNoticeClaimed: z14.boolean(),
+      sessionWriteNoticeClaimed: z16.boolean(),
       // CT1680: the runner's identity, minted with its credential. The start
       // PATCH carries it so the lease knows which runner holds the span.
-      runnerId: z14.string()
+      runnerId: z16.string(),
+      // CT1681: the launcher keeps the runtime's session files beside the attempt
+      // and restores them into this runner's home, so the runner names the attempt
+      // each context was composed for and waits for the launcher to say it's in
+      // place. Absent: nothing to wait for (a runner on the launcher's own disk).
+      attemptState: z16.boolean().optional(),
+      // CT1681: MCP `${NAME}` secrets come from the launcher, by name, instead of
+      // this machine's secrets.json. Absent: the runner reads the device's file.
+      secretsFromLauncher: z16.boolean().optional()
     });
-    dispatchSchema = z14.object({
-      type: z14.literal("device:dispatch_requested"),
-      agentId: z14.string(),
-      deviceId: z14.string(),
-      conversationId: z14.string(),
-      messageId: z14.string(),
-      episode: z14.number().int().optional()
+    dispatchSchema = z16.object({
+      type: z16.literal("device:dispatch_requested"),
+      agentId: z16.string(),
+      deviceId: z16.string(),
+      conversationId: z16.string(),
+      messageId: z16.string(),
+      episode: z16.number().int().optional()
     });
-    credentialsSchema = z14.object({
-      credential: z14.string().startsWith("cabrn_")
+    credentialsSchema = z16.object({
+      credential: z16.string().startsWith("cabrn_"),
+      sandboxCredentials: z16.array(
+        z16.object({
+          name: z16.string(),
+          value: z16.string(),
+          hosts: z16.array(z16.string()),
+          gitHost: z16.string().optional()
+        })
+      ).optional()
     });
   }
 });
@@ -7183,6 +7519,11 @@ function selfRunnerCommand() {
   if (!script) throw new Error("runners: cannot tell which script started this companion");
   return [process.execPath, ...process.execArgv, script, "run-turn"];
 }
+function defaultSecretStore(log) {
+  return loadSecretStoreTolerant(
+    (m) => log.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
+  );
+}
 function healthSnapshot(store) {
   const out = {};
   for (const r of store?.reports() ?? []) {
@@ -7216,6 +7557,9 @@ function runnerSpec(opts, launch, duties, runnerId) {
     ...opts.preparingRowDelayMs !== void 0 ? { preparingRowDelayMs: opts.preparingRowDelayMs } : {},
     transcripts: opts.transcriptDir !== void 0,
     sandbox: launch.sandbox ?? "none",
+    ...launch.provider.bindAttempt ? { attemptState: true } : {},
+    ...launch.provider.inheritsEnvironment === false ? { secretsFromLauncher: true } : {},
+    ...launch.sandbox === "os" && launch.policy?.ok ? { sandboxPolicy: launch.policy.policy } : {},
     logLevel: opts.log.level,
     connectorHealth: healthSnapshot(launch.connectorHealth),
     sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
@@ -7314,6 +7658,32 @@ async function settleUnstarted(opts, payload, turnId, errorReason, log) {
     );
   }
 }
+function sandboxInputs(launch, log) {
+  const policy = launch.policy ?? { ok: true, policy: {} };
+  if (launch.sandbox !== "os") {
+    if (policy.ok && policyHasCredentials(policy.policy)) {
+      log.debug(
+        "runners: runners.policy names credentials, but turns here run without the OS sandbox; none are given to the harness"
+      );
+    }
+    return { ok: true, credentials: [] };
+  }
+  if (!policy.ok) {
+    log.warn({ error: policy.error }, "runners: the sandbox policy is invalid; refusing the turn");
+    return { ok: false, reason: `setup_failed: ${policy.error}`.slice(0, 200) };
+  }
+  if (!policyHasCredentials(policy.policy)) return { ok: true, credentials: [] };
+  const store = (launch.secretStore ?? defaultSecretStore)(log);
+  const { credentials, missing } = resolvePolicyCredentials(policy.policy, store);
+  if (missing.length) {
+    log.debug(
+      { missing },
+      "runners: the sandbox policy names secrets this device does not declare"
+    );
+    return { ok: false, reason: missingSecretReason(missing) };
+  }
+  return { ok: true, credentials };
+}
 async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const startedAt = Date.now();
   const { turnId } = handleOpts;
@@ -7337,7 +7707,8 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     agentId: payload.agentId,
     turnId
   };
-  const minted = await mintForRunner(opts, payload, handleOpts, controller.signal, log);
+  const sandboxed = sandboxInputs(launch, log);
+  const minted = sandboxed.ok ? await mintForRunner(opts, payload, handleOpts, controller.signal, log) : { ok: false, reason: sandboxed.reason, errorReason: sandboxed.reason };
   if (!minted.ok) {
     controller.signal.removeEventListener("abort", forwardStop);
     duties.releaseAbort(turnId, controller);
@@ -7355,15 +7726,42 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const remote = [];
   const lockOwner = (id) => `${turnId}#${id}`;
   const locks = launch.locks;
+  let leasedAttemptId = null;
   try {
     handle = await launch.provider.acquire(attempt);
+  } catch (err) {
+    const reason2 = `runner_unavailable: ${describeError(err)}`;
+    log.warn(
+      { turnId, provider: launch.provider.name, err: describeError(err) },
+      "runner: no place to run the turn"
+    );
+    controller.signal.removeEventListener("abort", forwardStop);
+    duties.releaseAbort(turnId, controller);
+    await settleUnstarted(opts, payload, turnId, reason2, log);
+    await launch.reportRunnerGone?.({
+      workspaceId: opts.workspaceId,
+      conversationId: payload.conversationId,
+      agentId: payload.agentId,
+      messageId: payload.messageId,
+      runnerId: minted.runnerId,
+      reason: "provider_failed"
+    });
+    const durationMs2 = Date.now() - startedAt;
+    duties.notifyEnd({ id: payload.messageId, ok: false, durationMs: durationMs2, reason: reason2 });
+    return { ok: false, durationMs: durationMs2, reason: reason2 };
+  }
+  try {
+    const place = handle;
     const env = {};
-    for (const [k, v] of Object.entries(launch.env ?? process.env)) {
-      if (v !== void 0) env[k] = v;
+    if (launch.provider.inheritsEnvironment !== false) {
+      for (const [k, v] of Object.entries(launch.env ?? process.env)) {
+        if (v !== void 0) env[k] = v;
+      }
     }
     const input = {
-      baseUrl: opts.baseUrl,
+      baseUrl: launch.runnerBaseUrl ?? opts.baseUrl,
       credential: minted.credential,
+      sandboxCredentials: sandboxed.ok ? sandboxed.credentials : [],
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
@@ -7440,6 +7838,38 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
         case "remote_session":
           remote.push({ serverUrl: event.serverUrl, sessionId: event.sessionId });
           return;
+        case "attempt": {
+          const bind = launch.provider.bindAttempt?.(place, event.attemptId) ?? Promise.resolve();
+          void bind.then(
+            () => running.stdin.write(encodeLauncherMessage({ cabaneLauncher: "bound", id: event.id })),
+            (err) => {
+              const refused = describeError(err);
+              log.warn(
+                { attemptId: event.attemptId, err: refused },
+                "runner: couldn't make the place ready for the turn's attempt; not running it there"
+              );
+              running.stdin.write(
+                encodeLauncherMessage({ cabaneLauncher: "bound", id: event.id, refused })
+              );
+            }
+          );
+          return;
+        }
+        case "leased":
+          leasedAttemptId = event.attemptId;
+          return;
+        case "secrets": {
+          const store = (launch.secretStore ?? defaultSecretStore)(log);
+          const values = {};
+          for (const name of event.names) {
+            const value = store.get(name);
+            if (value !== void 0) values[name] = value;
+          }
+          running.stdin.write(
+            encodeLauncherMessage({ cabaneLauncher: "secrets", id: event.id, values })
+          );
+          return;
+        }
       }
     });
     const stderrDone = lines(running.stderr, (line) => relayRunnerLog(line, opts.log));
@@ -7450,7 +7880,14 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     child?.stdin.end();
     controller.signal.removeEventListener("abort", forwardStop);
     duties.releaseAbort(turnId, controller);
-    if (handle) await launch.provider.release(handle, { destroy: false });
+    if (handle) {
+      await launch.provider.collect?.(handle, { attemptId: leasedAttemptId }).catch(
+        (err) => log.warn({ err: describeError(err) }, "runner: couldn't collect what the runner left")
+      );
+      await launch.provider.release(handle, { destroy: false }).catch(
+        (err) => log.warn({ err: describeError(err) }, "runner: couldn't give its place back")
+      );
+    }
   }
   if (result) return result;
   const durationMs = Date.now() - startedAt;
@@ -7496,11 +7933,13 @@ var PINO_LEVELS;
 var init_launch = __esm({
   "src/runner/launch.ts"() {
     "use strict";
+    init_sandbox_policy();
     init_opencode_lock();
     init_api_error_shape();
     init_errors();
     init_boot_id();
     init_turn_containment();
+    init_secrets();
     init_protocol();
     PINO_LEVELS = {
       10: "trace",
@@ -7515,7 +7954,7 @@ var init_launch = __esm({
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 function createSkipState() {
   return { skipped: false, reason: null };
 }
@@ -7566,7 +8005,7 @@ function createTurnControlMcpServer(acts, skipState) {
           SKIP_TURN_TOOL,
           TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
           {
-            reason: z15.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+            reason: z17.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
           },
           async (args) => {
             skipState.skipped = true;
@@ -7582,42 +8021,42 @@ function createTurnControlMcpServer(acts, skipState) {
         ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
         {
-          targetUserId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z15.array(
-            z15.union([
-              z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
-              z15.object({
-                label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
-                move: z15.object({
-                  task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
-                  status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
+          targetUserId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z17.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z17.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z17.array(
+            z17.union([
+              z17.string().min(1).max(MAX_ASK_OPTION_BYTES),
+              z17.object({
+                label: z17.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
+                move: z17.object({
+                  task: z17.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
+                  status: z17.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
                 }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
               })
             ])
           ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z15.array(
-            z15.object({
-              headline: z15.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z15.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z15.array(
-                z15.union([
-                  z15.string().min(1).max(MAX_ASK_OPTION_BYTES),
-                  z15.object({
-                    label: z15.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
-                    move: z15.object({
-                      task: z15.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
-                      status: z15.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
+          questions: z17.array(
+            z17.object({
+              headline: z17.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z17.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z17.array(
+                z17.union([
+                  z17.string().min(1).max(MAX_ASK_OPTION_BYTES),
+                  z17.object({
+                    label: z17.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
+                    move: z17.object({
+                      task: z17.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
+                      status: z17.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
                     }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
                   })
                 ])
               ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
             })
           ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z15.object({
-            askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          replaces: z17.object({
+            askId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z17.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
           }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
         },
         async (args) => {
@@ -7658,9 +8097,9 @@ function createTurnControlMcpServer(acts, skipState) {
         WAKE_ME_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
         {
-          afterSeconds: z15.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z15.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z15.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+          afterSeconds: z17.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z17.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z17.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
         },
         async (args) => {
           const hasAfter = args.afterSeconds !== void 0;
@@ -7694,8 +8133,8 @@ function createTurnControlMcpServer(acts, skipState) {
         WITHDRAW_ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
         {
-          askId: z15.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z15.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+          askId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z17.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
@@ -7790,10 +8229,10 @@ var init_build_options = __esm({
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join10(tmpdir(), PREFIX));
-  const path = join10(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
+  const path = join11(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -7917,22 +8356,22 @@ var init_prepare_failure = __esm({
 });
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
+import { join as join12 } from "path";
 function dirFor(workspaceId) {
-  return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join11(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor2(workspaceId, conversationId, agentId) {
-  return join11(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
       return {
         cwd: parsed.cwd,
@@ -7962,105 +8401,6 @@ var init_prepared = __esm({
   }
 });
 
-// src/secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join12 } from "path";
-import { z as z16 } from "zod";
-function secretsPath() {
-  return join12(cabaneDir(), "secrets.json");
-}
-function loadSecretStore() {
-  const path = secretsPath();
-  if (!existsSync8(path)) return makeStore({});
-  let raw;
-  try {
-    raw = readFileSync7(path, "utf8");
-  } catch (err) {
-    throw new ConfigError(
-      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (raw.trim().length === 0) return makeStore({});
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new ConfigError(
-      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}. It must be a flat object of "NAME": "value" secret pairs.`
-    );
-  }
-  const result = secretStoreSchema.safeParse(parsed);
-  if (!result.success) {
-    throw new ConfigError(
-      `${path} must be a flat object mapping secret names to string values (e.g. { "GITHUB_TOKEN": "ghp_\u2026" }).`
-    );
-  }
-  return makeStore(result.data);
-}
-function loadSecretStoreTolerant(onWarn) {
-  try {
-    return loadSecretStore();
-  } catch (err) {
-    onWarn?.(err instanceof Error ? err.message : String(err));
-    return makeStore({});
-  }
-}
-function makeStore(map) {
-  return {
-    get: (name) => map[name],
-    names: () => Object.keys(map).sort()
-  };
-}
-function requiredSecretNames(mcpServers) {
-  const names = /* @__PURE__ */ new Set();
-  for (const server of Object.values(mcpServers ?? {})) {
-    const bags = [
-      "env" in server ? server.env : void 0,
-      "headers" in server ? server.headers : void 0
-    ];
-    for (const bag of bags) {
-      for (const value of Object.values(bag ?? {})) {
-        for (const [, name] of value.matchAll(PLACEHOLDER_RE)) names.add(name);
-      }
-    }
-  }
-  return [...names].sort();
-}
-function resolveMcpSecrets(mcpServers, store) {
-  const missing = /* @__PURE__ */ new Set();
-  const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
-    const resolved = store.get(name);
-    if (resolved === void 0) {
-      missing.add(name);
-      return _match;
-    }
-    return resolved;
-  });
-  const mapBag = (bag) => {
-    const out = {};
-    for (const [k, v] of Object.entries(bag)) out[k] = interpolate(v);
-    return out;
-  };
-  const servers = {};
-  for (const [name, server] of Object.entries(mcpServers)) {
-    const next = { ...server };
-    if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
-    servers[name] = next;
-  }
-  return { servers, missing: [...missing].sort() };
-}
-var PLACEHOLDER_RE, secretStoreSchema;
-var init_secrets = __esm({
-  "src/secrets.ts"() {
-    "use strict";
-    init_config();
-    init_errors();
-    PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-    secretStoreSchema = z16.record(z16.string(), z16.string());
-  }
-});
-
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
 import { basename, dirname as dirname6, join as join13 } from "path";
@@ -8387,16 +8727,6 @@ var init_turn_runtime_integrity = __esm({
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import { existsSync as existsSync9 } from "fs";
-function missingSecretReason(missing) {
-  const prefix = "missing_secret: ";
-  for (let shown = missing.length; shown >= 0; shown--) {
-    const omitted = missing.length - shown;
-    const parts = [...missing.slice(0, shown), ...omitted > 0 ? [`+${omitted}`] : []];
-    const reason = prefix + parts.join(",");
-    if (reason.length <= ERROR_REASON_MAX) return reason;
-  }
-  return `${prefix}+${missing.length}`;
-}
 function resolveIdleTimeoutMs(override) {
   return override ?? DEFAULT_AGENT_IDLE_TIMEOUT_MS;
 }
@@ -8433,7 +8763,7 @@ function fingerprintSessionState(state) {
   }
   return createHash2("sha256").update(opaqueId).digest("hex").slice(0, 16);
 }
-var PREPARING_TOOL_NAME, ERROR_REASON_MAX, RUNTIME_UNAVAILABLE_PREFIX, NO_TURN_TOKEN_REASON, UNEXPECTED_ROLE_REASON, DEFAULT_PREPARING_ROW_DELAY_MS, DEFAULT_AGENT_IDLE_TIMEOUT_MS, DEFAULT_AGENT_TOTAL_TIMEOUT_MS, DEFAULT_LEASE_RENEWAL_MS, TurnConcluded, TurnExecution;
+var PREPARING_TOOL_NAME, RUNTIME_UNAVAILABLE_PREFIX, NO_TURN_TOKEN_REASON, UNEXPECTED_ROLE_REASON, DEFAULT_PREPARING_ROW_DELAY_MS, DEFAULT_AGENT_IDLE_TIMEOUT_MS, DEFAULT_AGENT_TOTAL_TIMEOUT_MS, DEFAULT_LEASE_RENEWAL_MS, TurnConcluded, TurnExecution;
 var init_turn_execution = __esm({
   "src/turn-execution.ts"() {
     "use strict";
@@ -8457,8 +8787,8 @@ var init_turn_execution = __esm({
     init_turn_committer();
     init_turn_runtime_integrity();
     init_dispatcher();
+    init_sandbox_policy();
     PREPARING_TOOL_NAME = "preparing";
-    ERROR_REASON_MAX = 200;
     RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
     NO_TURN_TOKEN_REASON = "no_turn_token: the server issued no turn credential for this turn";
     UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
@@ -8727,6 +9057,12 @@ var init_turn_execution = __esm({
           this.resumedSpoke = turnContext.turnSpoke === true || outboxSpoke;
           if (this.resumedSpoke) turnLog.debug({ turnId }, "dispatcher: resumed span already spoke");
         }
+        try {
+          await this.opts.inRunner?.onContext?.(turnContext.attemptId ?? null);
+        } catch (err) {
+          const reason = `runner_unavailable: ${err instanceof Error ? err.message : String(err)}`;
+          throw this.concluded(reason, reason);
+        }
       }
       gateTrigger() {
         const { payload, turnLog } = this;
@@ -8744,7 +9080,8 @@ var init_turn_execution = __esm({
       }
       async resolveSecrets() {
         const { payload, workspaceId, turnLog } = this;
-        const secretStore = this.opts.secretStore ?? loadSecretStoreTolerant(
+        const fromLauncher = this.opts.inRunner?.secrets;
+        const secretStore = this.opts.secretStore ?? (fromLauncher ? await fromLauncher(requiredSecretNames(this.turnContext.mcpServers)) : null) ?? loadSecretStoreTolerant(
           (m) => turnLog.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
         );
         const { servers: resolvedMcpServers, missing } = resolveMcpSecrets(
@@ -8904,42 +9241,48 @@ var init_turn_execution = __esm({
         const { payload, workspaceId, turnId, turnLog } = this;
         const abortController = this.abortController;
         this.supervisor.registerAbort(turnId, abortController);
+        let started;
         try {
-          await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
-            activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            // CT1679: a runner leases under its launcher's boot id — the one the
-            // device heartbeats — or the lost-run sweep reads it as a restart.
-            bootId: this.opts.inRunner?.bootId ?? bootId,
-            // CT1680: the runner holding the span, beside the device's boot id.
-            ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
-            // CT1380: the durable record that this turn resumed, and from where.
-            ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
-            // CT1454: the issuance the context THIS attempt runs on came from. Read
-            // off `this.turnContext`, which is the fetch that composed this request —
-            // so a retransmitted start echoes the same id and reuses the same record,
-            // and a resumed attempt echoes its own, newer one. The post-admission
-            // fresh-session recompose (`freshRequest`) deliberately does not touch it:
-            // it adopts only the prompt, never the run-config, so its issuance must
-            // not become this attempt's evidence.
-            ...this.turnContext.issuanceId ? { issuanceId: this.turnContext.issuanceId } : {},
-            // CT33: hand the server this turn's id so the new-run chokepoint's
-            // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
-            // already emitted a "preparing" activity row for this turn above (it
-            // runs before this flip), which would otherwise make the sweep mistake
-            // this live turn for an abandoned one and close it with a `stopped`.
-            turnId,
-            // The newest message this turn's read covered: the lease records it,
-            // and settle moves the cursor to it. Omitted when the server sent
-            // none (an older API), so the cursor stays where it was.
-            ...this.turnContext.readThrough !== void 0 ? { readThrough: this.turnContext.readThrough } : {},
-            ...this.turnContext.readRevision !== void 0 ? { readRevision: this.turnContext.readRevision } : {},
-            // Rooms: the attempt this request's session belongs to (null = fresh).
-            ...this.turnContext.attemptId !== void 0 ? { attemptId: this.turnContext.attemptId } : {},
-            // CT1543: the frame this start acts on. The turn-context fetch already
-            // checked it, but that was before an assembly this turn awaited — the
-            // lease checks it again where the stamp is actually taken.
-            ...payload.episode !== void 0 ? { dispatchMessageId: payload.messageId, dispatchEpisode: payload.episode } : {}
-          });
+          started = await this.opts.api.setActiveRun(
+            workspaceId,
+            payload.conversationId,
+            payload.agentId,
+            {
+              activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+              // CT1679: a runner leases under its launcher's boot id — the one the
+              // device heartbeats — or the lost-run sweep reads it as a restart.
+              bootId: this.opts.inRunner?.bootId ?? bootId,
+              // CT1680: the runner holding the span, beside the device's boot id.
+              ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
+              // CT1380: the durable record that this turn resumed, and from where.
+              ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
+              // CT1454: the issuance the context THIS attempt runs on came from. Read
+              // off `this.turnContext`, which is the fetch that composed this request —
+              // so a retransmitted start echoes the same id and reuses the same record,
+              // and a resumed attempt echoes its own, newer one. The post-admission
+              // fresh-session recompose (`freshRequest`) deliberately does not touch it:
+              // it adopts only the prompt, never the run-config, so its issuance must
+              // not become this attempt's evidence.
+              ...this.turnContext.issuanceId ? { issuanceId: this.turnContext.issuanceId } : {},
+              // CT33: hand the server this turn's id so the new-run chokepoint's
+              // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
+              // already emitted a "preparing" activity row for this turn above (it
+              // runs before this flip), which would otherwise make the sweep mistake
+              // this live turn for an abandoned one and close it with a `stopped`.
+              turnId,
+              // The newest message this turn's read covered: the lease records it,
+              // and settle moves the cursor to it. Omitted when the server sent
+              // none (an older API), so the cursor stays where it was.
+              ...this.turnContext.readThrough !== void 0 ? { readThrough: this.turnContext.readThrough } : {},
+              ...this.turnContext.readRevision !== void 0 ? { readRevision: this.turnContext.readRevision } : {},
+              // Rooms: the attempt this request's session belongs to (null = fresh).
+              ...this.turnContext.attemptId !== void 0 ? { attemptId: this.turnContext.attemptId } : {},
+              // CT1543: the frame this start acts on. The turn-context fetch already
+              // checked it, but that was before an assembly this turn awaited — the
+              // lease checks it again where the stamp is actually taken.
+              ...payload.episode !== void 0 ? { dispatchMessageId: payload.messageId, dispatchEpisode: payload.episode } : {}
+            }
+          );
         } catch (err) {
           if (leaseRefusal(err) === "dispatch_context_stale" && !this.recomposedForLease) {
             this.recomposedForLease = true;
@@ -8964,6 +9307,7 @@ var init_turn_execution = __esm({
           throw this.concluded(reason, reason);
         }
         this.admitted = true;
+        if (started?.attemptId) this.opts.inRunner?.onLeased?.(started.attemptId);
       }
       buildRequest() {
         const { payload, workspaceId } = this;
@@ -9008,7 +9352,18 @@ var init_turn_execution = __esm({
         const { payload, workspaceId, turnId, turnLog } = this;
         await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
         const onWarn = (msg, meta) => turnLog.debug(meta ?? {}, msg);
-        const sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({ cwd: this.effectiveCwd, log: turnLog }) : null;
+        let sandbox = null;
+        try {
+          sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({
+            cwd: this.effectiveCwd,
+            runtime: this.turnContext.runtime,
+            log: turnLog
+          }) : null;
+        } catch (err) {
+          if (!(err instanceof HarnessSandboxRefused)) throw err;
+          const reason = `setup_failed: ${err.message}`.slice(0, 200);
+          throw this.concluded(reason, reason);
+        }
         const adapters = [];
         if (this.opts.claudeCodeAvailable?.() ?? true) {
           this.containment = createTurnContainment(this.turnId, {
@@ -9639,12 +9994,265 @@ var init_dispatcher = __esm({
   }
 });
 
+// src/runner/egress-proxy.ts
+var egress_proxy_exports = {};
+__export(egress_proxy_exports, {
+  connectTarget: () => connectTarget,
+  createEgressProxy: () => createEgressProxy,
+  egressAllowed: () => egressAllowed
+});
+import { createServer as createServer2, request as httpRequest } from "http";
+import { connect as connect3 } from "net";
+function egressAllowed(host, allow, port, defaultPort = 443) {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  if (!h) return false;
+  const p = port ?? defaultPort;
+  return allow.some((entry) => {
+    const raw = entry.toLowerCase().trim();
+    const m = /^(.*):(\d{1,5})$/.exec(raw);
+    const name = m ? m[1] : raw;
+    const wanted = m ? Number(m[2]) : defaultPort;
+    if (p !== wanted) return false;
+    if (name.startsWith("*.")) return h.endsWith(name.slice(1));
+    return h === name;
+  });
+}
+function connectTarget(target) {
+  const m = /^\[?([^\]]+?)\]?:(\d{1,5})$/.exec(target);
+  if (!m) return null;
+  const port = Number(m[2]);
+  if (!m[1] || port < 1 || port > 65535) return null;
+  return { host: m[1], port };
+}
+function createEgressProxy(opts) {
+  const { allow, log } = opts;
+  const refuse = (host) => `cabane: ${host} is not on this device's egress allow-list (runners.docker.egressAllow)
+`;
+  const server = createServer2((req, res) => {
+    req.on("error", () => res.destroy());
+    res.on("error", () => req.destroy());
+    let url;
+    try {
+      url = new URL(req.url ?? "");
+    } catch {
+      res.writeHead(400).end("cabane: this proxy forwards absolute http:// URLs only\n");
+      return;
+    }
+    if (url.protocol !== "http:" || !egressAllowed(url.hostname, allow, url.port ? Number(url.port) : 80, 80)) {
+      log?.warn({ host: url.hostname }, "egress: refused");
+      res.writeHead(403, { "content-type": "text/plain" }).end(refuse(url.hostname));
+      return;
+    }
+    const upstream = httpRequest(
+      {
+        host: url.hostname,
+        port: url.port || 80,
+        method: req.method,
+        path: `${url.pathname}${url.search}`,
+        headers: req.headers
+      },
+      (up) => {
+        res.writeHead(up.statusCode ?? 502, up.headers);
+        up.pipe(res);
+      }
+    );
+    upstream.on("error", () => {
+      if (!res.headersSent) res.writeHead(502);
+      res.end();
+    });
+    req.pipe(upstream);
+  });
+  server.on("clientError", (_err, socket) => socket.destroy());
+  server.on("connect", (req, socket, head) => {
+    socket.on("error", () => socket.destroy());
+    const target = connectTarget(req.url ?? "");
+    if (!target || !egressAllowed(target.host, allow, target.port)) {
+      const host = target?.host ?? String(req.url);
+      log?.warn({ host }, "egress: refused");
+      const body = refuse(host);
+      socket.end(
+        `HTTP/1.1 403 Forbidden\r
+content-type: text/plain\r
+content-length: ${Buffer.byteLength(body)}\r
+\r
+${body}`
+      );
+      return;
+    }
+    const upstream = connect3(target.port, target.host, () => {
+      socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      if (head.length) upstream.write(head);
+      upstream.pipe(socket);
+      socket.pipe(upstream);
+    });
+    const close = () => {
+      upstream.destroy();
+      socket.destroy();
+    };
+    upstream.on("error", () => {
+      if (!socket.destroyed) socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+      close();
+    });
+    socket.on("error", close);
+    socket.on("close", () => upstream.destroy());
+  });
+  return server;
+}
+var init_egress_proxy = __esm({
+  "src/runner/egress-proxy.ts"() {
+    "use strict";
+  }
+});
+
+// src/runner/git-credential.ts
+var git_credential_exports = {};
+__export(git_credential_exports, {
+  askGitCredential: () => askGitCredential,
+  deviceGitFill: () => deviceGitFill,
+  parseCredential: () => parseCredential,
+  serveGitCredentials: () => serveGitCredentials
+});
+import { spawn as spawn8 } from "child_process";
+import { chmodSync as chmodSync5, rmSync as rmSync7 } from "fs";
+import { connect as connect4, createServer as createServer3 } from "net";
+function parseCredential(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
+function formatCredential(fields) {
+  return Object.entries(fields).map(([k, v]) => `${k}=${v}`).join("\n") + "\n\n";
+}
+function deviceGitFill(helper, timeoutMs = 15e3) {
+  return (request) => new Promise((resolve2) => {
+    const args = [
+      ...helper ? ["-c", "credential.helper=", "-c", `credential.helper=${helper}`] : [],
+      "credential",
+      "fill"
+    ];
+    const child = spawn8("git", args, {
+      stdio: ["pipe", "pipe", "ignore"],
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "", SSH_ASKPASS: "" }
+    });
+    let out = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+    child.stdout.on("data", (chunk) => out += String(chunk));
+    child.once("error", () => resolve2(null));
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      resolve2(code === 0 ? out : null);
+    });
+    child.stdin.end(formatCredential(request));
+  });
+}
+async function serveGitCredentials(opts) {
+  const { socketPath, hosts, fill, log } = opts;
+  rmSync7(socketPath, { force: true });
+  const server = createServer3({ allowHalfOpen: true }, (socket) => {
+    let input = "";
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => input += chunk);
+    socket.on("error", () => socket.destroy());
+    socket.on("end", () => {
+      void (async () => {
+        const [op = "", ...rest] = input.split("\n");
+        const request = parseCredential(rest.join("\n"));
+        if (op !== "get" || request.protocol !== "https" || !request.host) {
+          socket.end();
+          return;
+        }
+        if (!egressAllowed(request.host.replace(/:\d+$/, ""), hosts)) {
+          log?.warn(
+            { host: request.host },
+            "runner: git asked for a credential for a host it may not use"
+          );
+          socket.end();
+          return;
+        }
+        const answer = await fill({
+          protocol: "https",
+          host: request.host,
+          ...request.path ? { path: request.path } : {},
+          ...request.username ? { username: request.username } : {}
+        });
+        if (!answer) {
+          log?.warn(
+            { host: request.host },
+            "runner: this device's git has no credential for the host"
+          );
+          socket.end();
+          return;
+        }
+        const filled = parseCredential(answer);
+        socket.end(
+          formatCredential({
+            protocol: "https",
+            host: request.host,
+            ...filled.username ? { username: filled.username } : {},
+            ...filled.password ? { password: filled.password } : {}
+          })
+        );
+      })();
+    });
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.off("error", reject);
+      resolve2();
+    });
+  });
+  chmodSync5(socketPath, 438);
+  return {
+    close: () => new Promise((resolve2) => {
+      server.close(() => resolve2());
+      rmSync7(socketPath, { force: true });
+    })
+  };
+}
+function askGitCredential(socketPath, op, request, timeoutMs = 2e4) {
+  return new Promise((resolve2) => {
+    const socket = connect4(socketPath);
+    let out = "";
+    const timer = setTimeout(() => socket.destroy(), timeoutMs);
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => out += chunk);
+    socket.on("error", () => resolve2(""));
+    socket.on("close", () => {
+      clearTimeout(timer);
+      resolve2(out);
+    });
+    socket.end(`${op}
+${request}`);
+  });
+}
+var init_git_credential = __esm({
+  "src/runner/git-credential.ts"() {
+    "use strict";
+    init_egress_proxy();
+  }
+});
+
 // src/runner/harness-sandbox.ts
 import { lookup } from "dns/promises";
-import { chmodSync as chmodSync5, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
+import {
+  chmodSync as chmodSync6,
+  mkdirSync as mkdirSync11,
+  mkdtempSync,
+  readFileSync as readFileSync10,
+  realpathSync as realpathSync3,
+  rmSync as rmSync10,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
-import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
-import { join as join15 } from "path";
+import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
+import { dirname as dirname8, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
   try {
@@ -9674,32 +10282,117 @@ async function resolvedAddresses(baseUrl) {
     return [];
   }
 }
+function companionPackageRoot(modulePath) {
+  for (let dir2 = dirname8(modulePath); ; dir2 = dirname8(dir2)) {
+    try {
+      const manifest = JSON.parse(readFileSync10(join18(dir2, "package.json"), "utf8"));
+      if (manifest.name === "@cabane/companion") return dir2;
+    } catch {
+    }
+    if (dirname8(dir2) === dir2) return null;
+  }
+}
+function harnessRuntimePaths() {
+  const paths = [dirname8(dirname8(process.execPath))];
+  const root = companionPackageRoot(fileURLToPath4(import.meta.url));
+  if (root) paths.push(root);
+  try {
+    const require2 = createRequire2(import.meta.url);
+    paths.push(
+      dirname8(realpathSync3(require2.resolve("@anthropic-ai/sandbox-runtime/package.json")))
+    );
+  } catch {
+  }
+  for (const runtime of ["claude-code", "codex"]) {
+    const bundled = resolveBundledBinary(runtime).path;
+    if (bundled) {
+      try {
+        paths.push(dirname8(realpathSync3(bundled)));
+      } catch {
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
 function ownAddresses() {
   return Object.values(networkInterfaces()).flat().flatMap((i) => i ? [i.address] : []);
 }
+function expandHome(path, home) {
+  if (path === "~") return home;
+  return path.startsWith("~/") ? join18(home, path.slice(2)) : path;
+}
+function stripPort(pattern) {
+  return pattern.startsWith("[") ? pattern.replace(/^\[([^\]]+)\](:\d+)?$/, "$1") : pattern.replace(/:\d+$/, "");
+}
+function hostMatches(host, pattern) {
+  return pattern.startsWith("*.") ? host.endsWith(pattern.slice(1)) : host === pattern;
+}
+function patternsOverlap(a, b) {
+  if (a === b) return true;
+  const bare = (p) => p.startsWith("*.") ? p.slice(1) : p;
+  if (a.startsWith("*.") && b.startsWith("*.")) {
+    return bare(a).endsWith(bare(b)) || bare(b).endsWith(bare(a));
+  }
+  return hostMatches(a, b) || hostMatches(b, a);
+}
 function harnessSandboxConfig(input) {
-  const claudeDir = input.claudeConfigDir ?? join15(input.home, ".claude");
-  const codexDir = input.codexHome ?? join15(input.home, ".codex");
+  const { policy } = input;
+  const claudeDir = input.claudeConfigDir ?? join18(input.home, ".claude");
+  const codexDir = input.codexHome ?? join18(input.home, ".codex");
+  const homes = [.../* @__PURE__ */ new Set([input.home, input.accountHome ?? input.home])];
+  const expand = (paths) => (paths ?? []).map((p) => expandHome(p, input.home));
+  const cabane = cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses);
+  const models = modelHostsFor(input.runtime);
+  const reachable = [
+    ...policy.hosts?.defaults === false ? [] : DEFAULT_ALLOWED_HOSTS,
+    ...policy.hosts?.allow ?? []
+  ];
+  const allowedDomains = [.../* @__PURE__ */ new Set([...cabane, ...models, ...reachable])];
+  const envGlobs = input.cwd ? [join18(input.cwd, "**/.env"), join18(input.cwd, "**/.env.*")] : [];
+  const secrets = [
+    input.cabaneDir,
+    ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join18(home, p))),
+    ...envGlobs,
+    ...expand(policy.filesystem?.denyRead)
+  ];
+  const strict = policy.filesystem?.mode === "strict";
+  const denyRead = strict ? [...homes, ...secrets] : secrets;
+  const allowRead = strict ? [
+    ...input.cwd ? [input.cwd] : [],
+    claudeDir,
+    join18(input.home, ".claude.json"),
+    codexDir,
+    ...input.runtimePaths ?? [],
+    ...expand(policy.filesystem?.allowRead)
+  ] : expand(policy.filesystem?.allowRead);
+  const masked = input.credentials.map((c) => ({
+    name: c.name,
+    mode: "mask",
+    injectHosts: [...new Set(c.hosts.map(stripPort))]
+  }));
+  const injectAt = masked.flatMap((c) => c.injectHosts);
   return {
     network: {
-      allowedDomains: [
-        ...cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses),
-        ...MODEL_AND_GIT_HOSTS
-      ],
-      deniedDomains: [],
-      allowLocalBinding: true
+      allowedDomains,
+      deniedDomains: policy.hosts?.deny ?? [],
+      allowLocalBinding: true,
+      // A masked credential is swapped in by a proxy that reads the request,
+      // so TLS is terminated — but only for the hosts a credential goes to.
+      // Cabane, the model provider and every other host keep their own
+      // end-to-end TLS through an opaque tunnel.
+      ...masked.length ? {
+        tlsTerminate: {
+          excludeDomains: [
+            ...new Set(
+              allowedDomains.map(stripPort).filter((host) => !injectAt.some((p) => patternsOverlap(host, p)))
+            )
+          ]
+        }
+      } : {}
     },
     filesystem: {
-      // The device's own state (its token, the agents' PATs, the secret store)
-      // and the account's keys, under whichever homes this process has.
-      denyRead: [
-        input.cabaneDir,
-        ...[.../* @__PURE__ */ new Set([input.home, input.accountHome ?? input.home])].flatMap((home) => [
-          join15(home, ".ssh"),
-          join15(home, ".aws"),
-          join15(home, ".gnupg")
-        ])
-      ],
+      denyRead,
+      ...allowRead.length ? { allowRead } : {},
       // The checkout, scratch, and the harnesses' own session state — a turn
       // resumes from `~/.claude` and `~/.codex`, and without write there every
       // resume starts from nothing.
@@ -9707,13 +10400,28 @@ function harnessSandboxConfig(input) {
         ...input.cwd ? [input.cwd] : [],
         input.tmp,
         claudeDir,
-        join15(input.home, ".claude.json"),
-        codexDir
+        join18(input.home, ".claude.json"),
+        codexDir,
+        ...expand(policy.filesystem?.allowWrite)
       ],
       denyWrite: []
-    }
+    },
+    ...masked.length ? { credentials: { envVars: masked } } : {}
   };
 }
+function gitCredentialExports(credentials) {
+  const git = credentials.filter((c) => c.gitHost);
+  if (!git.length) return "";
+  const lines2 = ["n=${GIT_CONFIG_COUNT:-0}"];
+  for (const c of git) {
+    lines2.push(
+      `export "GIT_CONFIG_KEY_$n=http.https://${c.gitHost}/.extraHeader" "GIT_CONFIG_VALUE_$n=Authorization: Basic $${c.name}"`,
+      "n=$((n+1))"
+    );
+  }
+  lines2.push("export GIT_CONFIG_COUNT=$n");
+  return lines2.join("; ") + "; ";
+}
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
     log.warn(
@@ -9734,7 +10442,9 @@ function osSandboxUsable(log) {
 }
 async function prepareHarnessSandbox(input) {
   let wrapped;
+  const held = input.credentials.map((c) => c.name);
   try {
+    for (const c of input.credentials) process.env[c.name] = c.value;
     const config = harnessSandboxConfig({
       cwd: input.cwd,
       baseUrl: input.baseUrl,
@@ -9742,36 +10452,58 @@ async function prepareHarnessSandbox(input) {
       ownAddresses: ownAddresses(),
       home: homedir3(),
       accountHome: accountHome(),
-      tmp: tmpdir2(),
+      tmp: tmpdir3(),
       cabaneDir: cabaneDir(),
       claudeConfigDir: process.env.CLAUDE_CONFIG_DIR,
-      codexHome: process.env.CODEX_HOME
+      codexHome: process.env.CODEX_HOME,
+      runtime: input.runtime,
+      policy: input.policy,
+      credentials: input.credentials,
+      runtimePaths: harnessRuntimePaths()
     });
     await SandboxManager.initialize(config);
+    if (input.policy.filesystem?.mode === "strict") {
+      input.log.info(
+        { readable: config.filesystem.allowRead },
+        "runners: strict sandbox \u2014 the home is unreadable except these paths; a path missing inside a turn and not listed here is hidden by the policy (add it to runners.policy.filesystem.allowRead)"
+      );
+    }
     input.log.debug(
       {
         allowWrite: config.filesystem.allowWrite,
         denyRead: config.filesystem.denyRead,
-        hosts: config.network.allowedDomains.length
+        allowRead: config.filesystem.allowRead,
+        hosts: config.network.allowedDomains,
+        masked: held
       },
       "runners: harness sandbox ready"
     );
     wrapped = await SandboxManager.wrapWithSandbox(
-      'export NO_PROXY= no_proxy=; eval "exec $CABANE_SANDBOXED_ARGV"'
+      "export NO_PROXY= no_proxy=; " + gitCredentialExports(input.credentials) + 'eval "exec $CABANE_SANDBOXED_ARGV"'
     );
   } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    await SandboxManager.reset().catch(() => {
+    });
+    if (held.length || Object.keys(input.policy).length) {
+      input.log.warn(
+        { err: message, masked: held },
+        "runners: the OS sandbox could not start under this device's runners.policy; refusing the turn rather than running it unsandboxed"
+      );
+      throw new HarnessSandboxRefused(`the OS sandbox could not start: ${message}`);
+    }
     input.log.warn(
-      { err: err instanceof Error ? err.message : String(err) },
+      { err: message },
       "runners: the OS sandbox could not start; running the turn unsandboxed"
     );
-    await SandboxManager.reset().catch(() => {
-    });
     return null;
+  } finally {
+    for (const name of held) delete process.env[name];
   }
-  mkdirSync9(join15(cabaneDir(), "sandbox"), { recursive: true });
-  const dir2 = mkdtempSync(join15(cabaneDir(), "sandbox", "turn-"));
-  const script = join15(dir2, "exec-sandboxed");
-  writeFileSync6(
+  mkdirSync11(join18(cabaneDir(), "sandbox"), { recursive: true });
+  const dir2 = mkdtempSync(join18(cabaneDir(), "sandbox", "turn-"));
+  const script = join18(dir2, "exec-sandboxed");
+  writeFileSync7(
     script,
     [
       "#!/bin/bash",
@@ -9781,56 +10513,61 @@ async function prepareHarnessSandbox(input) {
       ""
     ].join("\n")
   );
-  chmodSync5(script, 448);
+  chmodSync6(script, 448);
   let shims = 0;
   return {
     wrap: (command, args) => ({ command: script, args: [command, ...args] }),
     executableFor: (real) => {
-      const shim = join15(dir2, `exec-${++shims}`);
-      writeFileSync6(shim, `#!/bin/bash
+      const shim = join18(dir2, `exec-${++shims}`);
+      writeFileSync7(shim, `#!/bin/bash
 exec ${shellQuote(script)} ${shellQuote(real)} "$@"
 `);
-      chmodSync5(shim, 448);
+      chmodSync6(shim, 448);
       return shim;
     },
     dispose: async () => {
-      rmSync7(dir2, { recursive: true, force: true });
+      rmSync10(dir2, { recursive: true, force: true });
       await SandboxManager.reset();
     }
   };
 }
-var MODEL_AND_GIT_HOSTS;
+var SECRET_PATHS_UNDER_HOME;
 var init_harness_sandbox = __esm({
   "src/runner/harness-sandbox.ts"() {
     "use strict";
+    init_bundled_binaries();
     init_config();
-    MODEL_AND_GIT_HOSTS = [
-      "api.anthropic.com",
-      "*.anthropic.com",
-      "claude.ai",
-      "*.claude.ai",
-      "api.openai.com",
-      "auth.openai.com",
-      "chatgpt.com",
-      "*.chatgpt.com",
-      "github.com",
-      "*.github.com",
-      "*.githubusercontent.com"
+    init_sandbox_policy();
+    SECRET_PATHS_UNDER_HOME = [
+      ".ssh",
+      ".aws",
+      ".gnupg",
+      ".config/gh",
+      ".git-credentials",
+      ".netrc",
+      ".npmrc",
+      ".pypirc",
+      ".docker/config.json",
+      ".kube",
+      ".config/gcloud",
+      ".azure",
+      ".config/op",
+      ".password-store"
     ];
   }
 });
 
 // src/outbox.ts
 import {
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync10,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync8,
-  renameSync as renameSync4,
-  rmSync as rmSync8,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync12,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync11,
+  renameSync as renameSync6,
+  rmSync as rmSync11,
+  writeFileSync as writeFileSync8
 } from "fs";
-import { join as join16 } from "path";
+import { join as join19 } from "path";
 var MAX_ENTRIES, MAX_AGE_MS, Outbox;
 var init_outbox = __esm({
   "src/outbox.ts"() {
@@ -9848,25 +10585,25 @@ var init_outbox = __esm({
       // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
       // cases route writes at the right tmpdir.
       dir() {
-        return join16(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
+        return join19(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
       }
       fileFor(turnId, seq) {
-        return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+        return join19(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
       }
       // Persist a commit for later draining. Atomic (temp file + rename) so a
       // concurrent `list()` never reads a half-written entry, then enforces the
       // per-workspace bounds.
       persist(entry) {
         const dir2 = this.dir();
-        mkdirSync10(dir2, { recursive: true });
+        mkdirSync12(dir2, { recursive: true });
         const target = this.fileFor(entry.turnId, entry.seq);
         const tmp = `${target}.${process.pid}.tmp`;
         try {
-          writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
-          renameSync4(tmp, target);
+          writeFileSync8(tmp, JSON.stringify(entry) + "\n", "utf8");
+          renameSync6(tmp, target);
         } catch (err) {
           try {
-            rmSync8(tmp, { force: true });
+            rmSync11(tmp, { force: true });
           } catch {
           }
           this.log?.warn(
@@ -9883,19 +10620,19 @@ var init_outbox = __esm({
       // wedging the drain.
       list() {
         const dir2 = this.dir();
-        if (!existsSync11(dir2)) return [];
+        if (!existsSync14(dir2)) return [];
         let names;
         try {
-          names = readdirSync3(dir2);
+          names = readdirSync5(dir2);
         } catch {
           return [];
         }
         const entries = [];
         for (const name of names) {
           if (!name.endsWith(".json")) continue;
-          const full = join16(dir2, name);
+          const full = join19(dir2, name);
           try {
-            const parsed = JSON.parse(readFileSync8(full, "utf8"));
+            const parsed = JSON.parse(readFileSync11(full, "utf8"));
             if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
               entries.push(parsed);
             } else {
@@ -9929,8 +10666,8 @@ var init_outbox = __esm({
       // different: it is positive evidence that nothing was ever queued here.
       maxSeqForTurn(turnId) {
         const dir2 = this.dir();
-        if (!existsSync11(dir2)) return 0;
-        const names = readdirSync3(dir2);
+        if (!existsSync14(dir2)) return 0;
+        const names = readdirSync5(dir2);
         const prefix = `${encodeURIComponent(turnId)}__`;
         let max = 0;
         for (const name of names) {
@@ -9943,15 +10680,15 @@ var init_outbox = __esm({
       // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
       remove(turnId, seq) {
         try {
-          rmSync8(this.fileFor(turnId, seq), { force: true });
+          rmSync11(this.fileFor(turnId, seq), { force: true });
         } catch {
         }
       }
       size() {
         const dir2 = this.dir();
-        if (!existsSync11(dir2)) return 0;
+        if (!existsSync14(dir2)) return 0;
         try {
-          return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
+          return readdirSync5(dir2).filter((n) => n.endsWith(".json")).length;
         } catch {
           return 0;
         }
@@ -9962,7 +10699,7 @@ var init_outbox = __esm({
           "A saved update is unreadable and couldn't be delivered. Check the conversation for missing replies."
         );
         try {
-          rmSync8(full, { force: true });
+          rmSync11(full, { force: true });
         } catch {
         }
       }
@@ -9998,9 +10735,42 @@ var init_outbox = __esm({
   }
 });
 
+// src/version.ts
+import { createRequire as createRequire3 } from "module";
+var pkg, COMPANION_VERSION;
+var init_version2 = __esm({
+  "src/version.ts"() {
+    "use strict";
+    pkg = createRequire3(import.meta.url)("../package.json");
+    COMPANION_VERSION = pkg.version;
+  }
+});
+
+// src/runner/image-manifest.ts
+var image_manifest_exports = {};
+__export(image_manifest_exports, {
+  runnerManifest: () => runnerManifest
+});
+function runnerManifest() {
+  return {
+    version: COMPANION_VERSION,
+    bundled: {
+      "claude-code": resolveBundledBinary("claude-code").status,
+      codex: resolveBundledBinary("codex").status
+    }
+  };
+}
+var init_image_manifest = __esm({
+  "src/runner/image-manifest.ts"() {
+    "use strict";
+    init_bundled_binaries();
+    init_version2();
+  }
+});
+
 // src/runner/exec-shim.ts
-import { chmodSync as chmodSync6, mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync2, rmSync as rmSync10, writeFileSync as writeFileSync9 } from "fs";
-import { join as join19 } from "path";
+import { chmodSync as chmodSync7, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync2, rmSync as rmSync13, writeFileSync as writeFileSync10 } from "fs";
+import { join as join22 } from "path";
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -10010,18 +10780,18 @@ function createShimDir() {
   return {
     write(argv) {
       if (!dir2) {
-        mkdirSync13(join19(cabaneDir(), "runner"), { recursive: true });
-        dir2 = mkdtempSync2(join19(cabaneDir(), "runner", "turn-"));
+        mkdirSync15(join22(cabaneDir(), "runner"), { recursive: true });
+        dir2 = mkdtempSync2(join22(cabaneDir(), "runner", "turn-"));
       }
-      const path = join19(dir2, `exec-${++count}`);
-      writeFileSync9(path, `#!/bin/sh
+      const path = join22(dir2, `exec-${++count}`);
+      writeFileSync10(path, `#!/bin/sh
 exec ${argv.map(shellQuote2).join(" ")} "$@"
 `);
-      chmodSync6(path, 448);
+      chmodSync7(path, 448);
       return path;
     },
     dispose() {
-      if (dir2) rmSync10(dir2, { recursive: true, force: true });
+      if (dir2) rmSync13(dir2, { recursive: true, force: true });
       dir2 = null;
     }
   };
@@ -10037,6 +10807,7 @@ var init_exec_shim = __esm({
 import { createInterface as createInterface3 } from "readline";
 function openLauncherChannel(stdin, emit, onLauncherGone) {
   const waiting = /* @__PURE__ */ new Map();
+  const replies = /* @__PURE__ */ new Map();
   let next = 0;
   let resolveFirst;
   let gotFirst = false;
@@ -10050,11 +10821,26 @@ function openLauncherChannel(stdin, emit, onLauncherGone) {
     }
     const message = decodeLauncherMessage(line);
     if (message?.cabaneLauncher === "granted") waiting.get(message.id)?.();
+    else if (message) replies.get(message.id)?.(message);
   });
+  let gone = false;
   lines2.once("close", () => {
+    gone = true;
     if (!gotFirst) resolveFirst("");
+    for (const reply2 of [...replies.values()]) reply2(null);
     onLauncherGone();
   });
+  const ask = (event) => {
+    if (gone) return Promise.resolve(null);
+    const id = String(++next);
+    return new Promise((resolve2) => {
+      replies.set(id, (message) => {
+        replies.delete(id);
+        resolve2(message);
+      });
+      emit(event(id));
+    });
+  };
   return {
     first,
     acquire(key, signal) {
@@ -10080,6 +10866,14 @@ function openLauncherChannel(stdin, emit, onLauncherGone) {
         signal.addEventListener("abort", onAbort, { once: true });
         emit({ cabaneRunner: "lock", id, key });
       });
+    },
+    async bindAttempt(attemptId) {
+      const reply2 = await ask((id) => ({ cabaneRunner: "attempt", id, attemptId }));
+      if (reply2?.cabaneLauncher === "bound" && reply2.refused) throw new Error(reply2.refused);
+    },
+    async secrets(names) {
+      const reply2 = await ask((id) => ({ cabaneRunner: "secrets", id, names: [...names] }));
+      return reply2?.cabaneLauncher === "secrets" ? reply2.values : {};
     }
   };
 }
@@ -10093,6 +10887,7 @@ var init_launcher_channel = __esm({
 // src/runner/run-turn.ts
 var run_turn_exports = {};
 __export(run_turn_exports, {
+  drainBeforeExit: () => drainBeforeExit,
   runTurn: () => runTurn,
   runnerDispatcherOptions: () => runnerDispatcherOptions,
   runnerLogger: () => runnerLogger,
@@ -10100,6 +10895,19 @@ __export(run_turn_exports, {
 });
 import { spawnSync } from "child_process";
 import pino2 from "pino";
+async function drainBeforeExit(outbox, api, graceMs = OUTBOX_GRACE_MS, log) {
+  if (outbox.size() === 0) return;
+  const deadline = Date.now() + graceMs;
+  while (Date.now() < deadline) {
+    const { remaining } = await api.drainOutbox().catch(() => ({ remaining: outbox.size() }));
+    if (remaining === 0) return;
+    await new Promise((resolve2) => setTimeout(resolve2, Math.min(OUTBOX_RETRY_MS, graceMs)));
+  }
+  log?.warn(
+    { remaining: outbox.size() },
+    "runner: exiting with updates Cabane hasn't taken yet; the companion delivers them"
+  );
+}
 function runnerLogger(input, stderr) {
   return pino2({ level: input.spec.logLevel }, stderr).child({ agentName: input.spec.agentName });
 }
@@ -10116,6 +10924,8 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
     outbox,
     log
   });
+  extras.onOutbox?.(outbox, api);
+  const { bindAttempt, secrets } = extras;
   const health = new Map(Object.entries(spec.connectorHealth));
   const connectorHealth = {
     lookup: (runtime) => health.get(runtime),
@@ -10157,16 +10967,24 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
         (sessionId) => emit({ cabaneRunner: "remote_session", serverUrl, sessionId })
       ),
       ...extras.onProcessGroup ? { onProcessGroup: extras.onProcessGroup } : {},
+      ...spec.attemptState && bindAttempt ? {
+        onContext: (attemptId) => bindAttempt(attemptId),
+        onLeased: (attemptId) => emit({ cabaneRunner: "leased", attemptId })
+      } : {},
+      ...spec.secretsFromLauncher && secrets ? { secrets: async (names) => makeStore(await secrets(names)) } : {},
       codexExecutable: (path, containment) => {
         const prefix = containment.scopePrefix(process.env);
         return prefix ? shims.write([...prefix, path]) : path;
       }
     },
     ...spec.sandbox === "os" ? {
-      harnessSandbox: async ({ cwd, log: turnLog }) => {
+      harnessSandbox: async ({ cwd, runtime, log: turnLog }) => {
         const sandbox = await prepareHarnessSandbox({
           cwd,
           baseUrl: input.baseUrl,
+          runtime,
+          policy: spec.sandboxPolicy ?? {},
+          credentials: input.sandboxCredentials ?? [],
           log: turnLog
         });
         if (sandbox) onSandbox?.(sandbox);
@@ -10259,6 +11077,7 @@ async function runTurn(env, deps) {
       notifyStart: (info) => emit({ cabaneRunner: "start", ...info }),
       notifyEnd: (info) => emit({ cabaneRunner: "end", ...info })
     };
+    let outbox;
     const opts = runnerDispatcherOptions(input, log, emit, {
       ...deps.queryFn ? { queryFn: deps.queryFn } : {},
       onSandbox: (s) => sandbox = s,
@@ -10267,7 +11086,10 @@ async function runTurn(env, deps) {
       onProcessGroup: (pgid) => {
         groups.push(pgid);
         emit({ cabaneRunner: "process_group", pgid });
-      }
+      },
+      bindAttempt: (attemptId) => channel.bindAttempt(attemptId),
+      secrets: (names) => channel.secrets(names),
+      onOutbox: (o, a) => outbox = { outbox: o, api: a }
     });
     const result = await new TurnExecution(opts, supervisor, input.dispatch, {
       turnId: input.turnId,
@@ -10276,6 +11098,7 @@ async function runTurn(env, deps) {
       shims.dispose();
       await sandbox?.dispose();
     });
+    if (outbox) await drainBeforeExit(outbox.outbox, outbox.api, deps.outboxGraceMs, log);
     emit({ cabaneRunner: "result", result });
     return { code: result.ok ? 0 : 1, result };
   } catch (err) {
@@ -10285,12 +11108,13 @@ async function runTurn(env, deps) {
     deps.signals.off("SIGTERM", onTerm);
   }
 }
-var LAUNCHER_GONE_GRACE_MS;
+var OUTBOX_GRACE_MS, OUTBOX_RETRY_MS, LAUNCHER_GONE_GRACE_MS;
 var init_run_turn = __esm({
   "src/runner/run-turn.ts"() {
     "use strict";
     init_api();
     init_outbox();
+    init_secrets();
     init_exec_shim();
     init_harness_sandbox();
     init_launcher_channel();
@@ -10298,6 +11122,8 @@ var init_run_turn = __esm({
     init_transcript_writer();
     init_turn_execution();
     init_protocol();
+    OUTBOX_GRACE_MS = 3e4;
+    OUTBOX_RETRY_MS = 1e3;
     LAUNCHER_GONE_GRACE_MS = 3e3;
   }
 });
@@ -10601,7 +11427,8 @@ function buildCompanionManifest(opts) {
   return {
     runtimes,
     capabilities: { ...DEVICE_MANIFEST.capabilities },
-    runtimeIssues: opts.runtimeIssues ?? []
+    runtimeIssues: opts.runtimeIssues ?? [],
+    ...opts.runnerProvider ? { runner: { provider: opts.runnerProvider } } : {}
   };
 }
 function runtimeIssuesFor(gates) {
@@ -11431,7 +12258,7 @@ async function pair(opts = {}) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 
 // src/commands/logs.ts
 import { once } from "events";
@@ -11637,7 +12464,7 @@ import { hostname as hostname4 } from "os";
 
 // src/runtime.ts
 init_config();
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // src/dashboard/server.ts
 init_errors();
@@ -12277,7 +13104,7 @@ function turnFailureCopy(reason, runtime) {
 init_api_error_shape();
 init_boot_id();
 init_api();
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/device-api.ts
 init_errors();
@@ -12549,56 +13376,976 @@ var ConnectorHealthStore = class {
       lastError: h.lastError
     }));
   }
-};
-
-// src/supervisor.ts
-init_dispatcher();
+};
+
+// src/supervisor.ts
+init_dispatcher();
+
+// src/providers/local-process.ts
+import { spawn as spawn6 } from "child_process";
+import { constants } from "os";
+var DEFAULT_KILL_GRACE_MS = 3e4;
+var DEFAULT_REAP_GRACE_MS = 3e3;
+function exitCode(code, signal) {
+  if (code !== null) return code;
+  const signum = signal ? constants.signals[signal] : void 0;
+  return signum !== void 0 ? 128 + signum : 1;
+}
+function createLocalProcessProvider(opts = {}) {
+  const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+  const spawnFn = opts.spawnFn ?? spawn6;
+  const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
+  const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
+  const groupAlive = (pgid) => {
+    try {
+      killFn(-pgid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const signalGroup = (pgid, signal) => {
+    try {
+      killFn(-pgid, signal);
+    } catch {
+    }
+  };
+  return {
+    name: "local-process",
+    async acquire(attempt) {
+      return { provider: "local-process", id: attempt.turnId };
+    },
+    exec(_handle, argv, env, { signal, stdin }) {
+      const [command, ...args] = argv;
+      if (!command) throw new Error("local-process: exec needs a command");
+      const child = spawnFn(command, args, {
+        env: { ...env },
+        stdio: ["pipe", "pipe", "pipe"],
+        detached: process.platform !== "win32"
+      });
+      child.stdin?.on("error", () => {
+      });
+      if (stdin) child.stdin?.write(stdin);
+      const exit = new Promise((resolve2) => {
+        let settled = false;
+        const done = (code) => {
+          if (settled) return;
+          settled = true;
+          signal.removeEventListener("abort", stop2);
+          if (forceTimer) clearTimeout(forceTimer);
+          resolve2(code);
+        };
+        let forceTimer;
+        const stop2 = () => {
+          child.kill("SIGTERM");
+          forceTimer = setTimeout(() => child.kill("SIGKILL"), killGraceMs);
+          forceTimer.unref?.();
+        };
+        child.once("error", () => done(1));
+        child.once("close", (code, sig) => done(exitCode(code, sig)));
+        if (signal.aborted) stop2();
+        else signal.addEventListener("abort", stop2, { once: true });
+      });
+      if (!child.stdout || !child.stderr || !child.stdin)
+        throw new Error("local-process: runner stdio missing");
+      const pid = child.pid;
+      return {
+        exit,
+        ...pid !== void 0 ? { pid } : {},
+        stdout: child.stdout,
+        stderr: child.stderr,
+        stdin: child.stdin,
+        async reap(groups) {
+          if (process.platform === "win32") return;
+          const targets = [.../* @__PURE__ */ new Set([...pid !== void 0 ? [pid] : [], ...groups])].filter(
+            groupAlive
+          );
+          if (!targets.length) return;
+          for (const pgid of targets) signalGroup(pgid, "SIGTERM");
+          await new Promise((resolve2) => setTimeout(resolve2, reapGraceMs));
+          for (const pgid of targets.filter(groupAlive)) signalGroup(pgid, "SIGKILL");
+        }
+      };
+    },
+    async release() {
+    }
+  };
+}
+
+// src/providers/docker.ts
+import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
+import { constants as constants2, tmpdir as tmpdir2 } from "os";
+import {
+  createReadStream,
+  createWriteStream as createWriteStream2,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync10,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync9,
+  renameSync as renameSync5,
+  rmSync as rmSync9,
+  statSync as statSync3,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { join as join17 } from "path";
+import { Writable } from "stream";
+
+// src/providers/docker-cli.ts
+import { spawn as spawn7 } from "child_process";
+function cliEnv(extra) {
+  const keep = [
+    "PATH",
+    "HOME",
+    "DOCKER_HOST",
+    "DOCKER_CONFIG",
+    "DOCKER_CONTEXT",
+    "DOCKER_CERT_PATH"
+  ];
+  const env = {};
+  for (const k of keep) if (process.env[k] !== void 0) env[k] = process.env[k];
+  return { ...env, ...extra };
+}
+function dockerCli(bin = "docker") {
+  return {
+    run(args, opts = {}) {
+      return new Promise((resolve2) => {
+        let child;
+        try {
+          child = spawn7(bin, [...args], {
+            env: cliEnv(opts.env),
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+        } catch (err) {
+          resolve2({ code: 127, stdout: "", stderr: String(err) });
+          return;
+        }
+        let stdout = "";
+        let stderr = "";
+        const timer = opts.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs) : void 0;
+        if (opts.stdout) child.stdout?.pipe(opts.stdout);
+        else child.stdout?.on("data", (chunk) => stdout += String(chunk));
+        child.stderr?.on("data", (chunk) => stderr += String(chunk));
+        child.stdin?.on("error", () => {
+        });
+        child.once("error", (err) => {
+          if (timer) clearTimeout(timer);
+          resolve2({ code: 127, stdout, stderr: stderr || err.message });
+        });
+        child.once("close", (code, signal) => {
+          if (timer) clearTimeout(timer);
+          resolve2({ code: code ?? (signal ? 137 : 1), stdout, stderr });
+        });
+        const input = opts.input;
+        if (input === void 0) child.stdin?.end();
+        else if (typeof input === "string" || Buffer.isBuffer(input)) child.stdin?.end(input);
+        else input.pipe(child.stdin);
+      });
+    },
+    spawn(args, env) {
+      return spawn7(bin, [...args], { env: cliEnv(env), stdio: ["pipe", "pipe", "pipe"] });
+    }
+  };
+}
+
+// src/providers/docker.ts
+init_git_credential();
+
+// src/runner/collected-outbox.ts
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync8,
+  renameSync as renameSync4,
+  rmSync as rmSync8
+} from "fs";
+import { join as join15 } from "path";
+function routes(t) {
+  const conv = `/api/workspaces/${t.workspaceId}/conversations/${t.conversationId}`;
+  const agent = `${conv}/participants/agents/${t.agentId}`;
+  return {
+    message: { method: "POST", path: `${conv}/messages` },
+    activity: { method: "POST", path: `${agent}/activity` },
+    thinking: { method: "POST", path: `${agent}/thinking` },
+    text: { method: "POST", path: `${agent}/text` },
+    "active-run": { method: "PATCH", path: `${agent}/active-run` }
+  };
+}
+function admitCollectedEntry(raw, turn) {
+  if (!raw || typeof raw !== "object") return null;
+  const entry = raw;
+  const kind = entry.kind;
+  if (!kind || !(kind in routes(turn))) return null;
+  const route = routes(turn)[kind];
+  if (entry.method !== route.method || entry.path !== route.path) return null;
+  if (typeof entry.seq !== "number" || typeof entry.enqueuedAt !== "number") return null;
+  const body = entry.body;
+  if (!body || typeof body !== "object" || typeof body.turnId !== "string") return null;
+  if (!turn.turnIds.includes(body.turnId)) return null;
+  if (kind === "active-run") {
+    if (body.activeRunStartedAt !== null) return null;
+    if (entry.turnId !== `activerun:${turn.conversationId}:${turn.agentId}`) return null;
+  } else if (entry.turnId !== body.turnId) {
+    return null;
+  }
+  return entry;
+}
+var atomicMove = (from, to) => {
+  try {
+    renameSync4(from, to);
+  } catch {
+    const partial = `${to}.partial`;
+    copyFileSync2(from, partial);
+    renameSync4(partial, to);
+    rmSync8(from, { force: true });
+  }
+};
+function publishStaged(from, to, move = atomicMove) {
+  if (!existsSync11(from)) return { published: 0, complete: true };
+  const staged = readdirSync3(from).filter((n) => n.endsWith(".json")).map((name) => {
+    let entry = {};
+    try {
+      entry = JSON.parse(readFileSync8(join15(from, name), "utf8"));
+    } catch {
+    }
+    return { name, entry };
+  });
+  const settle = (e) => e.kind === "active-run" ? 1 : 0;
+  staged.sort(
+    (a, b) => settle(a.entry) - settle(b.entry) || (a.entry.enqueuedAt ?? 0) - (b.entry.enqueuedAt ?? 0) || String(a.entry.turnId).localeCompare(String(b.entry.turnId)) || (a.entry.seq ?? 0) - (b.entry.seq ?? 0)
+  );
+  if (staged.length) mkdirSync9(to, { recursive: true });
+  let published = 0;
+  for (const { name } of staged) {
+    try {
+      move(join15(from, name), join15(to, name));
+    } catch {
+      return { published, complete: false };
+    }
+    published++;
+  }
+  rmSync8(from, { recursive: true, force: true });
+  return { published, complete: true };
+}
+
+// src/providers/runner-base.ts
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync12, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname7, join as join16, sep } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+var COMPANION_MOUNT = "/opt/cabane/companion";
+var BASE_DOCKERFILE = `FROM node:22-slim
+RUN apt-get update \\
+  && apt-get install -y --no-install-recommends git curl ca-certificates procps \\
+  && rm -rf /var/lib/apt/lists/* \\
+  && corepack enable
+RUN usermod -l runner -d /home/runner -m node \\
+  && groupmod -n runner node \\
+  && mkdir -p /work /var/lib/cabane-runner /run/cabane ${COMPANION_MOUNT} \\
+  && chown runner:runner /work /var/lib/cabane-runner
+RUN mkdir -p /home/runner/.codex /opt/cabane \\
+  && printf '[features]\\nuse_legacy_landlock = true\\n' > /opt/cabane/codex-config.toml \\
+  && cp /opt/cabane/codex-config.toml /home/runner/.codex/config.toml \\
+  && chown -R runner:runner /home/runner/.codex
+RUN printf '#!/bin/sh\\nexec node "\${CABANE_COMPANION_ROOT:-${COMPANION_MOUNT}}/dist/cli.js" "$@"\\n' > /usr/local/bin/cabane-companion \\
+  && chmod 755 /usr/local/bin/cabane-companion
+USER runner
+WORKDIR /home/runner
+CMD ["sleep", "infinity"]
+`;
+function baseImageTag(dockerfile = BASE_DOCKERFILE) {
+  return `cabane-runner-base:${createHash3("sha256").update(dockerfile).digest("hex").slice(0, 12)}`;
+}
+async function ensureBaseImage(docker, image, log) {
+  if ((await docker.run(["image", "inspect", image])).code === 0) return true;
+  if (image !== baseImageTag()) {
+    log.error({ image }, "runners: the configured runner image isn't on this engine");
+    return false;
+  }
+  log.info({ image }, "runners: building the runner base image (once per base)");
+  const built = await docker.run(["build", "-t", image, "-"], {
+    input: BASE_DOCKERFILE,
+    timeoutMs: 20 * 6e4
+  });
+  if (built.code !== 0) {
+    log.error(
+      { image, err: built.stderr.trim().slice(-2e3) },
+      "runners: couldn't build the runner base image; no turn can run until it is"
+    );
+    return false;
+  }
+  return true;
+}
+function ownInstall(moduleFile = fileURLToPath3(import.meta.url)) {
+  let dir2 = dirname7(moduleFile);
+  for (let i = 0; i < 4; i++) {
+    if (existsSync12(join16(dir2, "dist", "cli.js")) && existsSync12(join16(dir2, "package.json"))) break;
+    dir2 = dirname7(dir2);
+  }
+  if (!existsSync12(join16(dir2, "dist", "cli.js"))) return null;
+  const sdk = join16(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
+  if (!existsSync12(sdk)) return null;
+  const root = realpathSync2(dir2);
+  return realpathSync2(sdk).startsWith(root + sep) ? root : null;
+}
+function companionSource(input) {
+  if (input.configured) {
+    return { kind: "dir", path: input.configured, key: `dir:${input.configured}` };
+  }
+  if (input.platform === "linux") {
+    if (input.own)
+      return { kind: "dir", path: input.own, key: `dir:${input.own}:${input.version}` };
+    return {
+      error: "this companion runs from a checkout, which a container can't mount on its own; build one with `pnpm --filter @cabane/companion deploy --prod <dir>` and set runners.docker.companionDir"
+    };
+  }
+  if (input.version === "0.0.0") {
+    return {
+      error: "an unreleased companion can't be installed into a container from npm; set runners.docker.companionDir to a Linux install of it"
+    };
+  }
+  return {
+    kind: "volume",
+    volume: `cabane-companion-${input.version}`,
+    version: input.version,
+    key: `volume:${input.version}`
+  };
+}
+function companionRoot(source) {
+  return source.kind === "dir" ? COMPANION_MOUNT : `${COMPANION_MOUNT}/lib/node_modules/@cabane/companion`;
+}
+function companionMountArgs(source) {
+  const mount = source.kind === "dir" ? `type=bind,src=${source.path},dst=${COMPANION_MOUNT},readonly` : `type=volume,src=${source.volume},dst=${COMPANION_MOUNT},readonly`;
+  return ["--mount", mount, "-e", `CABANE_COMPANION_ROOT=${companionRoot(source)}`];
+}
+var INSTALL_MARKER = `${COMPANION_MOUNT}/.cabane-install-complete`;
+function volumeInstallScript(version, install = `npm install -g --prefix ${COMPANION_MOUNT} @cabane/companion@${version}`) {
+  const root = `${COMPANION_MOUNT}/lib/node_modules/@cabane/companion`;
+  return [
+    `find ${COMPANION_MOUNT} -mindepth 1 -delete`,
+    install,
+    // Installed is not the same as runnable: the package must start and say
+    // what it runs before the volume counts as done.
+    `node ${root}/dist/cli.js run-turn --manifest > /dev/null`,
+    `printf %s ${version} > ${INSTALL_MARKER}`
+  ].join(" && ");
+}
+var volumeMount = (source) => `type=volume,src=${source.volume},dst=${COMPANION_MOUNT}`;
+async function ensureCompanionVolume(docker, image, source, log, script = volumeInstallScript) {
+  if (source.kind !== "volume") return true;
+  const done = await docker.run([
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--mount",
+    volumeMount(source),
+    image,
+    "sh",
+    "-c",
+    `[ "$(cat ${INSTALL_MARKER} 2>/dev/null)" = "$1" ]`,
+    "sh",
+    source.version
+  ]);
+  if (done.code === 0) return true;
+  log.info(
+    { version: source.version },
+    "runners: installing this companion version for its containers"
+  );
+  const installed = await docker.run(
+    [
+      "run",
+      "--rm",
+      "-u",
+      "root",
+      "--mount",
+      volumeMount(source),
+      image,
+      "sh",
+      "-c",
+      script(source.version)
+    ],
+    { timeoutMs: 20 * 6e4 }
+  );
+  if (installed.code !== 0) {
+    log.error(
+      { version: source.version, err: installed.stderr.trim().slice(-2e3) },
+      "runners: couldn't install the companion for its containers; the next start tries again"
+    );
+    return false;
+  }
+  return true;
+}
+async function invalidateCompanionVolume(docker, image, source) {
+  if (source.kind !== "volume") return;
+  await docker.run([
+    "run",
+    "--rm",
+    "-u",
+    "root",
+    "--network",
+    "none",
+    "--mount",
+    volumeMount(source),
+    image,
+    "rm",
+    "-f",
+    INSTALL_MARKER
+  ]);
+}
 
-// src/providers/local-process.ts
-import { spawn as spawn6 } from "child_process";
-import { constants } from "os";
-var DEFAULT_KILL_GRACE_MS = 3e4;
-var DEFAULT_REAP_GRACE_MS = 3e3;
-function exitCode(code, signal) {
-  if (code !== null) return code;
-  const signum = signal ? constants.signals[signal] : void 0;
-  return signum !== void 0 ? 128 + signum : 1;
+// src/providers/docker.ts
+var CONTAINER_HOME = "/home/runner";
+var CONTAINER_WORK = "/work";
+var CONTAINER_STATE = "/var/lib/cabane-runner";
+var CONTAINER_SOCKETS = "/run/cabane";
+var PROXY_ALIAS = "cabane-egress";
+var PROXY_PORT = 3128;
+var DEFAULT_KILL_GRACE_MS2 = 3e4;
+var REAP_GRACE_S = 3;
+var DEFAULT_SESSION_CAP_BYTES = 512 * 1024 * 1024;
+var COLLECT_CAP_BYTES = 128 * 1024 * 1024;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function containerName(attempt) {
+  return `cabane-runner-${attempt.conversationId}-${attempt.agentId}`;
+}
+function sessionArchivePath(deviceDir, attemptId) {
+  if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
+  return join17(deviceDir, "attempts", attemptId, "session.tar");
+}
+function pruneOtherAttempts(deviceDir, pair2, keep) {
+  const root = join17(deviceDir, "attempts");
+  if (!existsSync13(root)) return;
+  for (const id of readdirSync4(root)) {
+    if (id === keep || !UUID_RE.test(id)) continue;
+    let pairOf = "";
+    try {
+      pairOf = readFileSync9(join17(root, id, "pair"), "utf8");
+    } catch {
+      continue;
+    }
+    if (pairOf === `${pair2.conversationId}/${pair2.agentId}`) {
+      rmSync9(join17(root, id), { recursive: true, force: true });
+    }
+  }
 }
-function createLocalProcessProvider(opts = {}) {
-  const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
-  const spawnFn = opts.spawnFn ?? spawn6;
-  const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
-  const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
-  const groupAlive = (pgid) => {
+var CappedFile = class extends Writable {
+  constructor(path, cap) {
+    super();
+    this.path = path;
+    this.cap = cap;
+    this.out = createWriteStream2(path);
+  }
+  path;
+  cap;
+  bytes = 0;
+  over = false;
+  out;
+  _write(chunk, _enc, done) {
+    this.bytes += chunk.length;
+    if (this.bytes > this.cap) {
+      this.over = true;
+      done();
+      return;
+    }
+    this.out.write(chunk, done);
+  }
+  _final(done) {
+    this.out.end(done);
+  }
+};
+var DUMP_SCRIPT = `
+const fs = require('fs'), path = require('path');
+const dir = process.argv[1], cap = Number(process.argv[2]);
+let names;
+try { names = fs.readdirSync(dir); }
+catch (e) {
+  if (e.code === 'ENOENT') { process.stdout.write(JSON.stringify({ complete: true, files: [] })); process.exit(0); }
+  process.stderr.write(String(e.message)); process.exit(2);
+}
+let total = 0, complete = true; const files = [];
+for (const name of names) {
+  const p = path.join(dir, name);
+  let st;
+  try { st = fs.lstatSync(p); } catch (e) { process.stderr.write(String(e.message)); process.exit(2); }
+  if (!st.isFile()) continue;
+  // Always at least one file per read, so one over the cap is still collected.
+  if (files.length && total + st.size > cap) { complete = false; continue; }
+  let data;
+  try { data = fs.readFileSync(p); } catch (e) { process.stderr.write(String(e.message)); process.exit(2); }
+  total += st.size;
+  files.push({ name, data: data.toString('base64') });
+}
+process.stdout.write(JSON.stringify({ complete, files }));
+`;
+var SAFE_NAME_RE = /^[\w.%@+-]+$/;
+function createDockerProvider(opts) {
+  const docker = opts.docker ?? dockerCli();
+  const log = opts.log;
+  const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS2;
+  const sessionCap = opts.sessionCapBytes ?? DEFAULT_SESSION_CAP_BYTES;
+  const collectCap = opts.collectCapBytes ?? COLLECT_CAP_BYTES;
+  const network = `cabane-runners-${opts.deviceKey}`;
+  const companionLabel = createHash4("sha256").update(opts.companion.key).digest("hex").slice(0, 16);
+  const proxy = `cabane-egress-${opts.deviceKey}`;
+  const held = /* @__PURE__ */ new Map();
+  const queues = /* @__PURE__ */ new Map();
+  const must = async (args, what) => {
+    const r = await docker.run(args);
+    if (r.code !== 0)
+      throw new Error(`docker: ${what} failed: ${r.stderr.trim() || `exit ${r.code}`}`);
+    return r.stdout;
+  };
+  const execIn = (name, args, extra = {}) => docker.run(
+    ["exec", ...extra.input !== void 0 ? ["-i"] : [], "-u", "runner", name, ...args],
+    extra
+  );
+  const proxyListening = async () => {
+    for (let i = 0; i < 40; i++) {
+      const r = await docker.run([
+        "exec",
+        proxy,
+        "curl",
+        "-s",
+        "-o",
+        "/dev/null",
+        "--max-time",
+        "1",
+        `http://127.0.0.1:${PROXY_PORT}/`
+      ]);
+      if (r.code === 0) return;
+      await new Promise((resolve2) => setTimeout(resolve2, 250));
+    }
+    throw new Error("docker: the egress proxy never started listening");
+  };
+  let networkReady = null;
+  const proxyKey = async () => {
+    const id = (await docker.run(["image", "inspect", "-f", "{{.Id}}", opts.image])).stdout.trim();
+    return createHash4("sha256").update(JSON.stringify([id || opts.image, opts.companion.key, [...opts.egressAllow].sort()])).digest("hex").slice(0, 16);
+  };
+  const ensureNetwork = () => {
+    networkReady ??= (async () => {
+      const allowKey = await proxyKey();
+      if ((await docker.run(["network", "inspect", network])).code !== 0) {
+        await must(
+          [
+            "network",
+            "create",
+            // No route off the host, and no address of the host's on the
+            // bridge: the host's own ports are out of reach too. The proxy is
+            // the only other thing on the network.
+            "--internal",
+            "-o",
+            "com.docker.network.bridge.inhibit_ipv4=true",
+            "--label",
+            `cabane.device=${opts.deviceKey}`,
+            network
+          ],
+          "creating the runners network"
+        );
+      }
+      const seen = await docker.run([
+        "inspect",
+        "-f",
+        '{{index .Config.Labels "cabane.allow"}} {{.State.Running}}',
+        proxy
+      ]);
+      const [key, running] = seen.stdout.trim().split(" ");
+      if (seen.code === 0 && key === allowKey) {
+        if (running !== "true") {
+          await must(["start", proxy], "starting the egress proxy");
+          await proxyListening();
+        }
+        return;
+      }
+      if (seen.code === 0) await docker.run(["rm", "-f", proxy]);
+      await must(
+        [
+          "run",
+          "-d",
+          "--name",
+          proxy,
+          "--label",
+          `cabane.allow=${allowKey}`,
+          "--label",
+          `cabane.device=${opts.deviceKey}`,
+          "--restart",
+          "unless-stopped",
+          "--cap-drop",
+          "ALL",
+          "--security-opt",
+          "no-new-privileges",
+          "-e",
+          `CABANE_EGRESS_ALLOW=${JSON.stringify(opts.egressAllow)}`,
+          ...companionMountArgs(opts.companion),
+          opts.image,
+          "cabane-companion",
+          "egress-proxy",
+          "--port",
+          String(PROXY_PORT)
+        ],
+        "starting the egress proxy"
+      );
+      await must(
+        ["network", "connect", "--alias", PROXY_ALIAS, network, proxy],
+        "connecting the proxy"
+      );
+      await proxyListening();
+      log.info({ network, proxy, allow: opts.egressAllow }, "runners: egress proxy ready");
+    })().catch((err) => {
+      networkReady = null;
+      throw err;
+    });
+    return networkReady;
+  };
+  const socketRoot = opts.socketRoot ?? join17(
+    process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir2(),
+    `cabane-runners-${opts.deviceKey}`
+  );
+  const socketDir = (name) => join17(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
+  const create = async (name, attempt) => {
+    mkdirSync10(socketRoot, { recursive: true, mode: 448 });
+    mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
+    const mounts = (opts.mounts ?? []).filter((m) => m.source.startsWith("/") && existsSync13(m.source)).flatMap((m) => ["--mount", `type=bind,src=${m.source},dst=${m.target},readonly`]);
+    await must(
+      [
+        "create",
+        "--name",
+        name,
+        "--init",
+        "--hostname",
+        "cabane-runner",
+        "--label",
+        "cabane.runner=1",
+        "--label",
+        `cabane.device=${opts.deviceKey}`,
+        "--label",
+        `cabane.workspace=${attempt.workspaceId}`,
+        "--label",
+        `cabane.conversation=${attempt.conversationId}`,
+        "--label",
+        `cabane.agent=${attempt.agentId}`,
+        "--label",
+        `cabane.companion=${companionLabel}`,
+        "--network",
+        network,
+        "--mount",
+        `type=volume,src=${name}-home,dst=${CONTAINER_HOME}`,
+        "--mount",
+        `type=volume,src=${name}-work,dst=${CONTAINER_WORK}`,
+        "--mount",
+        `type=bind,src=${socketDir(name)},dst=${CONTAINER_SOCKETS},readonly`,
+        ...mounts,
+        ...companionMountArgs(opts.companion),
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--pids-limit",
+        "4096",
+        opts.image,
+        "sleep",
+        "infinity"
+      ],
+      "creating the container"
+    );
+  };
+  const destroy = async (name) => {
+    await docker.run(["rm", "-f", "-v", name]);
+    await docker.run(["volume", "rm", "-f", `${name}-home`, `${name}-work`]);
+    rmSync9(socketDir(name), { recursive: true, force: true });
+  };
+  const containerEnv = () => {
+    const proxyUrl = `http://${PROXY_ALIAS}:${PROXY_PORT}`;
+    const git = [
+      ["credential.helper", ""],
+      // The helper speaks a socket, not the network: no proxy, and none of
+      // Node's warning about it in git's output.
+      ["credential.helper", "!NODE_USE_ENV_PROXY= cabane-companion git-credential"],
+      ...opts.gitHosts.flatMap((h) => [
+        [`url.https://${h}/.insteadOf`, `git@${h}:`],
+        [`url.https://${h}/.insteadOf`, `ssh://git@${h}/`]
+      ])
+    ];
+    return {
+      HOME: CONTAINER_HOME,
+      CABANE_COMPANION_HOME: CONTAINER_STATE,
+      CABANE_RUNNER_STATE_DIR: CONTAINER_STATE,
+      HTTPS_PROXY: proxyUrl,
+      HTTP_PROXY: proxyUrl,
+      https_proxy: proxyUrl,
+      http_proxy: proxyUrl,
+      NO_PROXY: "localhost,127.0.0.1,::1",
+      no_proxy: "localhost,127.0.0.1,::1",
+      // Node's own fetch — the runner's wire — honours the proxy only when asked.
+      NODE_USE_ENV_PROXY: "1",
+      CABANE_GIT_CREDENTIAL_SOCKET: `${CONTAINER_SOCKETS}/git.sock`,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_CONFIG_COUNT: String(git.length),
+      ...Object.fromEntries(
+        git.flatMap(([k, v], i) => [
+          [`GIT_CONFIG_KEY_${i}`, k],
+          [`GIT_CONFIG_VALUE_${i}`, v]
+        ])
+      )
+    };
+  };
+  const heldFor = (handle) => {
+    const h = held.get(handle.id);
+    if (!h) throw new Error(`docker: ${handle.id} is not held`);
+    return h;
+  };
+  const writeMarker = (name, attemptId) => execIn(name, [
+    "sh",
+    "-c",
+    `mkdir -p ${CONTAINER_STATE} && printf %s "$1" > ${CONTAINER_STATE}/attempt`,
+    "sh",
+    attemptId
+  ]);
+  const readDir = async (name, from) => {
+    const r = await execIn(name, [
+      "sh",
+      "-c",
+      '[ -e "$1" ] && chmod -R u+rwX "$1"; exec node -e "$2" "$1" "$3"',
+      "sh",
+      from,
+      DUMP_SCRIPT,
+      String(collectCap)
+    ]);
+    if (r.code !== 0) {
+      log.warn(
+        { container: name, dir: from, err: r.stderr.trim() },
+        "runners: couldn't read what the runner left"
+      );
+      return null;
+    }
     try {
-      killFn(-pgid, 0);
-      return true;
+      const dump = JSON.parse(r.stdout);
+      if (typeof dump.complete !== "boolean" || !Array.isArray(dump.files)) return null;
+      return {
+        complete: dump.complete,
+        files: dump.files.filter(
+          (f) => typeof f.name === "string" && typeof f.data === "string"
+        ).map((f) => ({ name: f.name, data: Buffer.from(f.data, "base64") }))
+      };
     } catch {
-      return false;
+      return null;
     }
   };
-  const signalGroup = (pgid, signal) => {
+  const removeIn = (name, from, names) => names.length ? execIn(name, ["sh", "-c", 'cd "$1" && shift && rm -f -- "$@"', "sh", from, ...names]) : Promise.resolve(null);
+  const pendingPath = (name) => join17(opts.deviceDir, "runners-pending", `${name}.json`);
+  const readPending = (name) => {
     try {
-      killFn(-pgid, signal);
+      const ids = JSON.parse(readFileSync9(pendingPath(name), "utf8"));
+      return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
     } catch {
+      return [];
     }
   };
-  return {
-    name: "local-process",
+  const writePending = (name, ids) => {
+    if (!ids.length) {
+      rmSync9(pendingPath(name), { force: true });
+      return;
+    }
+    mkdirSync10(join17(opts.deviceDir, "runners-pending"), { recursive: true });
+    writeFileSync6(pendingPath(name), JSON.stringify([...new Set(ids)]));
+  };
+  const keepSession = async (name, attempt, attemptId) => {
+    const archive = sessionArchivePath(opts.deviceDir, attemptId);
+    mkdirSync10(join17(archive, ".."), { recursive: true });
+    const partial = `${archive}.${process.pid}.partial`;
+    const file = new CappedFile(partial, sessionCap);
+    const r = await execIn(
+      name,
+      [
+        "sh",
+        "-c",
+        'cd "$HOME" && set -- && for p in .claude/projects .codex; do [ -e "$p" ] && set -- "$@" "$p"; done; [ $# -gt 0 ] || exit 3; exec tar -cf - --exclude=.codex/auth.json "$@"'
+      ],
+      { stdout: file }
+    );
+    await new Promise(
+      (resolve2) => file.writableFinished ? resolve2() : file.once("finish", resolve2)
+    );
+    if (r.code === 0 && !file.over) {
+      renameSync5(partial, archive);
+      writeFileSync6(join17(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
+      pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
+      await writeMarker(name, attemptId);
+      log.debug({ container: name, attemptId, bytes: file.bytes }, "runners: session files kept");
+      return;
+    }
+    rmSync9(partial, { force: true });
+    if (r.code === 3 && !file.over) return;
+    dropArchive(attemptId);
+    log.warn(
+      file.over ? { container: name, attemptId, capBytes: sessionCap } : { container: name, attemptId, err: r.stderr.trim() },
+      file.over ? "runners: the session files are over the size cap and weren't kept; the next new container starts the session over" : "runners: couldn't keep the session files; the next new container starts the session over"
+    );
+  };
+  const stagingDir = (name) => join17(opts.deviceDir, "runners-pending", `${name}.outbox`);
+  const ensureRunning = async (name) => {
+    const seen = await docker.run(["inspect", "-f", "{{.State.Running}}", name]);
+    if (seen.code !== 0) return false;
+    if (seen.stdout.trim() === "true") return true;
+    return (await docker.run(["start", name])).code === 0;
+  };
+  const dropArchive = (attemptId) => {
+    rmSync9(join17(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
+      recursive: true,
+      force: true
+    });
+  };
+  const RETIRE_SCRIPT = [
+    `chmod -R u+rwX /work ${CONTAINER_HOME}`,
+    "find /work -mindepth 1 -delete",
+    `find ${CONTAINER_HOME} -mindepth 1 -delete`,
+    `cp -a /etc/skel/. ${CONTAINER_HOME}/`,
+    `mkdir -p ${CONTAINER_HOME}/.codex`,
+    `cp /opt/cabane/codex-config.toml ${CONTAINER_HOME}/.codex/config.toml`,
+    `rm -rf ${CONTAINER_STATE}/prepared`
+  ].join(" && ");
+  const provider = {
+    name: "docker",
+    inheritsEnvironment: false,
     async acquire(attempt) {
-      return { provider: "local-process", id: attempt.turnId };
-    },
-    exec(_handle, argv, env, { signal, stdin }) {
-      const [command, ...args] = argv;
-      if (!command) throw new Error("local-process: exec needs a command");
-      const child = spawnFn(command, args, {
-        env: { ...env },
-        stdio: ["pipe", "pipe", "pipe"],
-        detached: process.platform !== "win32"
+      const name = containerName(attempt);
+      const before = queues.get(name) ?? Promise.resolve();
+      let release;
+      const mine = new Promise((resolve2) => release = resolve2);
+      const tail = before.then(() => mine);
+      queues.set(name, tail);
+      void tail.then(() => {
+        if (queues.get(name) === tail) queues.delete(name);
       });
+      await before;
+      try {
+        await ensureNetwork();
+        mkdirSync10(socketRoot, { recursive: true, mode: 448 });
+        mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
+        let seen = await docker.run([
+          "inspect",
+          "-f",
+          '{{.State.Running}} {{index .Config.Labels "cabane.companion"}}',
+          name
+        ]);
+        if (seen.code === 0 && seen.stdout.trim().split(" ")[1] !== companionLabel) {
+          held.set(name, { attempt, release: () => {
+          }, collected: false });
+          let collected = false;
+          try {
+            await provider.collect({ provider: "docker", id: name }, { attemptId: null });
+            collected = held.get(name)?.collected === true;
+          } finally {
+            held.delete(name);
+          }
+          if (!collected)
+            throw new Error(
+              "docker: this conversation's container runs another companion and what it holds couldn't be collected"
+            );
+          await destroy(name);
+          log.info(
+            { container: name },
+            "runners: replaced a container made with another companion"
+          );
+          seen = { code: 1, stdout: "", stderr: "" };
+        }
+        if (seen.code !== 0) {
+          await create(name, attempt);
+          log.debug({ container: name }, "runners: container created");
+        }
+        if (seen.stdout.trim().split(" ")[0] !== "true")
+          await must(["start", name], "starting the container");
+        const git = await serveGitCredentials({
+          socketPath: join17(socketDir(name), "git.sock"),
+          hosts: opts.gitHosts,
+          fill: opts.gitFill,
+          log
+        });
+        held.set(name, { attempt, release, git, collected: false });
+        return { provider: "docker", id: name };
+      } catch (err) {
+        const keep = opts.keepContainers || readPending(name).length > 0;
+        await (keep ? docker.run(["stop", "-t", "1", name]) : destroy(name)).catch(() => {
+        });
+        release();
+        throw err;
+      }
+    },
+    async bindAttempt(handle, attemptId) {
+      const name = handle.id;
+      const marker = await execIn(name, ["cat", `${CONTAINER_STATE}/attempt`]);
+      const bound = marker.code === 0 ? marker.stdout.trim() : "";
+      if (bound === (attemptId ?? "")) return;
+      const { attempt } = heldFor(handle);
+      pruneOtherAttempts(opts.deviceDir, attempt, attemptId ?? "");
+      if (bound) {
+        const wiped = await execIn(name, ["sh", "-c", RETIRE_SCRIPT]);
+        if (wiped.code !== 0)
+          throw new Error(`docker: couldn't clear the retired attempt: ${wiped.stderr.trim()}`);
+        log.info(
+          { container: name, retired: bound, attemptId },
+          "runners: retired attempt cleared"
+        );
+      }
+      if (attemptId && UUID_RE.test(attemptId)) {
+        const archive = sessionArchivePath(opts.deviceDir, attemptId);
+        if (existsSync13(archive)) {
+          const r = await execIn(name, ["tar", "-x", "-C", CONTAINER_HOME, "-f", "-"], {
+            input: createReadStream(archive)
+          });
+          if (r.code !== 0) {
+            log.warn(
+              { container: name, attemptId, err: r.stderr.trim() },
+              "runners: couldn't restore the session files; the runtime will start its session over"
+            );
+          } else {
+            log.info(
+              { container: name, attemptId, bytes: statSync3(archive).size },
+              "runners: session files restored"
+            );
+          }
+        } else {
+          log.info(
+            { container: name, attemptId },
+            "runners: no session files kept for this attempt on this device"
+          );
+        }
+      }
+      await writeMarker(name, attemptId ?? "");
+    },
+    exec(handle, argv, env, { signal, stdin }) {
+      const name = handle.id;
+      const pidFile = `/tmp/cabane-runner-${randomUUID5()}.pid`;
+      const passed = { ...env, ...opts.runtimeEnv?.() ?? {} };
+      const literal = containerEnv();
+      const args = [
+        "exec",
+        "-i",
+        "-u",
+        "runner",
+        "-w",
+        CONTAINER_HOME,
+        ...Object.entries(literal).flatMap(([k, v]) => ["-e", `${k}=${v}`]),
+        ...Object.keys(passed).flatMap((k) => ["-e", k]),
+        name,
+        "sh",
+        "-c",
+        'echo $$ > "$0" && exec "$@"',
+        pidFile,
+        ...argv
+      ];
+      const child = docker.spawn(args, passed);
       child.stdin?.on("error", () => {
       });
       if (stdin) child.stdin?.write(stdin);
+      let forceTimer;
+      const stop2 = () => {
+        void execIn(name, ["sh", "-c", 'kill -TERM "$(cat "$1")"', "sh", pidFile]);
+        forceTimer = setTimeout(() => void docker.run(["kill", name]), killGraceMs);
+        forceTimer.unref?.();
+      };
       const exit = new Promise((resolve2) => {
         let settled = false;
         const done = (code) => {
@@ -12608,42 +14355,252 @@ function createLocalProcessProvider(opts = {}) {
           if (forceTimer) clearTimeout(forceTimer);
           resolve2(code);
         };
-        let forceTimer;
-        const stop2 = () => {
-          child.kill("SIGTERM");
-          forceTimer = setTimeout(() => child.kill("SIGKILL"), killGraceMs);
-          forceTimer.unref?.();
-        };
         child.once("error", () => done(1));
-        child.once("close", (code, sig) => done(exitCode(code, sig)));
+        child.once("close", (code, sig) => {
+          const signum = sig ? constants2.signals[sig] : void 0;
+          done(code ?? (signum !== void 0 ? 128 + signum : 1));
+        });
         if (signal.aborted) stop2();
         else signal.addEventListener("abort", stop2, { once: true });
       });
       if (!child.stdout || !child.stderr || !child.stdin)
-        throw new Error("local-process: runner stdio missing");
-      const pid = child.pid;
+        throw new Error("docker: runner stdio missing");
       return {
         exit,
-        ...pid !== void 0 ? { pid } : {},
+        ...child.pid !== void 0 ? { pid: child.pid } : {},
         stdout: child.stdout,
         stderr: child.stderr,
         stdin: child.stdin,
-        async reap(groups) {
-          if (process.platform === "win32") return;
-          const targets = [.../* @__PURE__ */ new Set([...pid !== void 0 ? [pid] : [], ...groups])].filter(
-            groupAlive
-          );
-          if (!targets.length) return;
-          for (const pgid of targets) signalGroup(pgid, "SIGTERM");
-          await new Promise((resolve2) => setTimeout(resolve2, reapGraceMs));
-          for (const pgid of targets.filter(groupAlive)) signalGroup(pgid, "SIGKILL");
+        // The runner is the only thing this user runs in the container, so
+        // everything it left is everything the user has left.
+        async reap() {
+          await execIn(name, [
+            "sh",
+            "-c",
+            `kill -TERM -1 2>/dev/null; sleep ${REAP_GRACE_S}; kill -KILL -1 2>/dev/null; true`
+          ]);
         }
       };
     },
-    async release() {
+    async collect(handle, { attemptId }) {
+      const name = handle.id;
+      const held2 = heldFor(handle);
+      const { attempt } = held2;
+      const turnIds = [.../* @__PURE__ */ new Set([attempt.turnId, ...readPending(name)])];
+      const running = await ensureRunning(name);
+      if (attemptId && UUID_RE.test(attemptId)) {
+        if (!running) {
+          dropArchive(attemptId);
+          log.warn(
+            { container: name, attemptId },
+            "runners: couldn't reach the container to keep the session files; the next turn starts the session over"
+          );
+        } else {
+          await keepSession(name, attempt, attemptId);
+        }
+      }
+      if (!running) {
+        writePending(name, turnIds);
+        return;
+      }
+      const transcripts = await readDir(name, `${CONTAINER_STATE}/transcripts`);
+      if (transcripts) {
+        const kept = transcripts.files.filter((f) => SAFE_NAME_RE.test(f.name));
+        if (kept.length) mkdirSync10(join17(opts.hostStateDir, "transcripts"), { recursive: true });
+        for (const f of kept) writeFileSync6(join17(opts.hostStateDir, "transcripts", f.name), f.data);
+        await removeIn(
+          name,
+          `${CONTAINER_STATE}/transcripts`,
+          kept.map((f) => f.name)
+        );
+      }
+      const outboxRel = join17("outbox", encodeURIComponent(attempt.agentId));
+      const outbox = await readDir(name, `${CONTAINER_STATE}/${outboxRel}`);
+      let unpublished = false;
+      if (outbox) {
+        const scope = {
+          workspaceId: attempt.workspaceId,
+          conversationId: attempt.conversationId,
+          agentId: attempt.agentId,
+          turnIds
+        };
+        let queued = 0;
+        let refused = 0;
+        for (const f of outbox.files) {
+          let entry = null;
+          try {
+            entry = admitCollectedEntry(JSON.parse(f.data.toString("utf8")), scope);
+          } catch {
+            entry = null;
+          }
+          if (!entry) {
+            refused++;
+            continue;
+          }
+          const staged = stagingDir(name);
+          mkdirSync10(staged, { recursive: true });
+          writeFileSync6(
+            join17(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
+            `${JSON.stringify(entry)}
+`
+          );
+        }
+        await removeIn(
+          name,
+          `${CONTAINER_STATE}/${outboxRel}`,
+          outbox.files.map((f) => f.name)
+        );
+        if (outbox.complete) {
+          const published = publishStaged(
+            stagingDir(name),
+            join17(opts.hostStateDir, outboxRel),
+            opts.moveFile
+          );
+          queued = published.published;
+          if (!published.complete) {
+            unpublished = true;
+            log.warn(
+              { container: name },
+              "runners: couldn't hand all of the runner's outbox to the companion; the rest waits for the next collection"
+            );
+          }
+        }
+        if (refused) {
+          log.warn(
+            { container: name, refused },
+            "runners: refused outbox entries a runner's own credential couldn't have sent"
+          );
+        }
+        if (queued) {
+          log.info(
+            { container: name, queued },
+            "runners: delivering what the runner left in its outbox"
+          );
+          opts.onOutboxCollected?.(attempt.agentId);
+        }
+      }
+      held2.collected = !!transcripts?.complete && !!outbox?.complete && !unpublished;
+      writePending(name, held2.collected ? [] : turnIds);
+    },
+    async release(handle, { destroy: over }) {
+      const h = held.get(handle.id);
+      held.delete(handle.id);
+      try {
+        await h?.git?.close();
+        if (h && !h.collected) {
+          log.warn(
+            { container: handle.id },
+            "runners: kept the container: what its runner left couldn't be collected yet"
+          );
+          await docker.run(["stop", "-t", "10", handle.id]);
+        } else if (over || !opts.keepContainers) await destroy(handle.id);
+        else await docker.run(["stop", "-t", "10", handle.id]);
+      } finally {
+        h?.release();
+      }
+    }
+  };
+  return provider;
+}
+
+// src/providers/docker-setup.ts
+import { createHash as createHash5 } from "crypto";
+var MODEL_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "chatgpt.com",
+  "auth.openai.com"
+];
+var GIT_HOSTS = ["github.com"];
+function dockerRunnerSettings(config) {
+  const docker = config.runners?.docker ?? {};
+  const apiUrl = docker.apiUrl ?? config.baseUrl;
+  const apiHost = new URL(apiUrl).host;
+  const egressAllow = [
+    .../* @__PURE__ */ new Set([apiHost, ...MODEL_HOSTS, ...GIT_HOSTS, ...docker.egressAllow ?? []])
+  ];
+  return {
+    image: docker.image ?? baseImageTag(),
+    keepContainers: docker.keepContainers === true,
+    apiUrl,
+    egressAllow,
+    gitHosts: [...GIT_HOSTS]
+  };
+}
+function loopbackApi(apiUrl) {
+  const host = new URL(apiUrl).hostname;
+  return host === "localhost" || host === "::1" || host === "[::1]" || host.startsWith("127.");
+}
+function deviceKey(config) {
+  const seed = config.deviceId ?? config.baseUrl;
+  return createHash5("sha256").update(seed).digest("hex").slice(0, 12);
+}
+function resolveRuntimeEnv(env, store, log) {
+  const out = {};
+  for (const [name, template] of Object.entries(env ?? {})) {
+    const missing = [];
+    const value = template.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, key) => {
+      const v = store.get(key);
+      if (v === void 0) missing.push(key);
+      return v ?? "";
+    });
+    if (missing.length) {
+      log?.warn({ name, missing }, "runners: a runner env value names secrets this device lacks");
+      continue;
     }
+    out[name] = value;
+  }
+  return out;
+}
+async function probeRunner(docker, image, source, log) {
+  const r = await docker.run(
+    [
+      "run",
+      "--rm",
+      "--network",
+      "none",
+      ...companionMountArgs(source),
+      image,
+      "cabane-companion",
+      "run-turn",
+      "--manifest"
+    ],
+    { timeoutMs: 6e4 }
+  );
+  try {
+    const manifest = JSON.parse(r.stdout.trim());
+    log.info(
+      { image, version: manifest.version, bundled: manifest.bundled },
+      "runners: runner ready"
+    );
+    return manifest;
+  } catch {
+    log.error(
+      { image, err: r.stderr.trim().slice(-2e3) },
+      "runners: the companion didn't start in a runner container"
+    );
+    return null;
+  }
+}
+function imageResolution(manifest, image, runtime) {
+  const status2 = manifest?.bundled[runtime] ?? "platform_package_missing";
+  return {
+    runtime,
+    status: status2,
+    path: status2 === "present" ? `${image} (bundled)` : null,
+    packageName: null,
+    platform: "linux",
+    arch: "image"
   };
 }
+function containerHookPath(hostPath) {
+  const name = hostPath.split("/").pop() || "hook";
+  const tag = createHash5("sha256").update(hostPath).digest("hex").slice(0, 8);
+  return `/opt/cabane/hooks/${tag}-${name}`;
+}
+
+// src/supervisor.ts
+init_git_credential();
 
 // src/runner/device-locks.ts
 var DeviceLocks = class {
@@ -12702,6 +14659,7 @@ var DeviceLocks = class {
 
 // src/supervisor.ts
 init_harness_sandbox();
+init_sandbox_policy();
 init_launch();
 
 // src/opencode-models.ts
@@ -12896,13 +14854,7 @@ function sleep4(ms) {
 
 // src/supervisor.ts
 init_transcript_writer();
-
-// src/version.ts
-import { createRequire as createRequire2 } from "module";
-var pkg = createRequire2(import.meta.url)("../package.json");
-var COMPANION_VERSION = pkg.version;
-
-// src/supervisor.ts
+init_version2();
 init_src();
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var SHUTDOWN_HEARTBEAT_WAIT_MS = 1e3;
@@ -13003,8 +14955,27 @@ var CompanionSupervisor = class {
     if (opts.runnerCommand) this.runnerCommand = opts.runnerCommand;
     if (opts.runnerProvider) this.providerForRunners = opts.runnerProvider;
     this.unrunnableRetryDelaysMs = opts.unrunnableRetryDelaysMs ?? DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS;
+    if (this.dockerRunners()) {
+      const { image } = dockerRunnerSettings(this.config);
+      this.resolveBundled = (runtime) => imageResolution(this.runnerImage, image, runtime);
+    }
     this.latchBootBundledState();
   }
+  // CT1681: what a runner container said it can run, probed once at start;
+  // null until then, and when no container could be started.
+  runnerImage = null;
+  // CT1681: the companion every container mounts — this one's own install.
+  runnerCompanion() {
+    return companionSource({
+      configured: this.config.runners?.docker?.companionDir,
+      platform: process.platform,
+      version: COMPANION_VERSION,
+      own: ownInstall()
+    });
+  }
+  dockerRunners() {
+    return runnersEnabled(this.config) && this.config.runners?.provider === "docker";
+  }
   // Stand up the data plane: pair check, initial assignments pull, then the
   // heartbeat + poll loops. A companion with no device token (logged out) does
   // nothing but say so.
@@ -13013,6 +14984,31 @@ var CompanionSupervisor = class {
       { protocolVersion: TURN_PROTOCOL_VERSION, version: COMPANION_VERSION },
       `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname3()}`
     );
+    if (this.dockerRunners() && !this.providerForRunners) {
+      const { image, apiUrl } = dockerRunnerSettings(this.config);
+      if (loopbackApi(apiUrl)) {
+        this.log.error(
+          { apiUrl },
+          "runners: a container can't reach this machine's loopback; set runners.docker.apiUrl to an address it can"
+        );
+      }
+      const source = this.runnerCompanion();
+      const docker = dockerCli();
+      if ("error" in source) {
+        this.log.error({ reason: source.error }, "runners: no companion to put in a container");
+      } else if (await ensureBaseImage(docker, image, this.log) && await ensureCompanionVolume(docker, image, source, this.log)) {
+        this.runnerImage = await probeRunner(docker, image, source, this.log);
+        if (!this.runnerImage) await invalidateCompanionVolume(docker, image, source);
+      }
+      this.latchBootBundledState();
+    }
+    if (this.runnerSandbox() === "os") {
+      const policy = this.sandboxPolicy();
+      const posture = postureLines(policy);
+      const summary = posture.join("; ");
+      if (policy.ok) this.log.info({ posture }, `runners: OS sandbox policy \u2014 ${summary}`);
+      else this.log.error({ posture }, `runners: ${summary}`);
+    }
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
     if (!this.config.deviceToken) {
@@ -13120,7 +15116,9 @@ var CompanionSupervisor = class {
           runtimeIssues: this.runtimeIssues(),
           // CT571/CT586: each runtime's `version` from the latest harness probe
           // (fail-soft to null). Informational only — the server matches on name.
-          versions: this.harnessVersions
+          versions: this.harnessVersions,
+          // CT1681: shown on the device page.
+          ...runnersEnabled(this.config) ? { runnerProvider: this.config.runners?.provider ?? "local-process" } : {}
         }),
         // CT566: echo the last classified credential state per runtime, when the
         // companion has seen any. Omitted (undefined) until the first observed
@@ -13452,22 +15450,79 @@ var CompanionSupervisor = class {
   // CT1679: `runners.sandbox`, checked against this host once. A host that
   // can't make the sandbox says so once and runs its turns unwrapped.
   sandboxUsable;
+  // CT1684: `runners.policy`, parsed once. An invalid one is kept as the
+  // error, which every sandboxed turn is refused with.
+  parsedSandboxPolicy;
+  sandboxPolicy() {
+    this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
+    return this.parsedSandboxPolicy;
+  }
   runnerSandbox() {
-    if (this.config.runners?.sandbox !== "os") return "none";
+    if (this.config.runners?.sandbox !== "os" || this.dockerRunners()) return "none";
     this.sandboxUsable ??= osSandboxUsable(this.log);
     return this.sandboxUsable ? "os" : "none";
   }
   // CT1679: one provider for the device, built on first use.
   runnerProvider() {
-    this.providerForRunners ??= createLocalProcessProvider();
+    this.providerForRunners ??= this.dockerRunners() ? this.createDockerRunners() : createLocalProcessProvider();
     return this.providerForRunners;
   }
+  createDockerRunners() {
+    const settings = dockerRunnerSettings(this.config);
+    const docker = this.config.runners?.docker ?? {};
+    const hooks = [
+      this.config.prepareHook?.command,
+      ...Object.values(this.config.agents ?? {}).map((a) => a.prepareHook?.command)
+    ].filter((c) => typeof c === "string");
+    const source = this.runnerCompanion();
+    return createDockerProvider({
+      image: settings.image,
+      // Without a companion nothing is advertised, so nothing is sent; a turn
+      // that arrives anyway fails at the mount and says so.
+      companion: "error" in source ? { kind: "dir", path: "/nonexistent", key: "none" } : source,
+      deviceKey: deviceKey(this.config),
+      keepContainers: settings.keepContainers,
+      egressAllow: settings.egressAllow,
+      gitHosts: settings.gitHosts,
+      gitFill: deviceGitFill(docker.gitCredentialHelper),
+      runtimeEnv: () => resolveRuntimeEnv(
+        docker.env,
+        loadSecretStoreTolerant(
+          (m) => this.log.warn(
+            { err: m },
+            "Could not read the secrets file. Check ~/.cabane/secrets.json."
+          )
+        ),
+        this.log
+      ),
+      mounts: [...new Set(hooks)].map((source2) => ({ source: source2, target: containerHookPath(source2) })),
+      deviceDir: cabaneDir(),
+      hostStateDir: runnerStateDir(),
+      onOutboxCollected: (agentId) => {
+        for (const wr of this.workspaces.values()) wr.agents.get(agentId)?.kickDrain();
+      },
+      log: this.log
+    });
+  }
+  // CT1681: the runner command for this device's provider: the image's own
+  // companion in a container, this process's otherwise.
+  runnerCommandFor() {
+    if (this.runnerCommand) return this.runnerCommand;
+    return this.dockerRunners() ? ["cabane-companion", "run-turn"] : selfRunnerCommand();
+  }
   buildDispatcher(ctx) {
-    const local = localAgentConfig(this.config, {
+    const hostLocal = localAgentConfig(this.config, {
       agentId: ctx.agentId,
       agentUsername: ctx.agentUsername,
       workspaceSlug: ctx.workspaceSlug
     });
+    const local = this.dockerRunners() && hostLocal.prepareHook ? {
+      ...hostLocal,
+      prepareHook: {
+        ...hostLocal.prepareHook,
+        command: containerHookPath(hostLocal.prepareHook.command)
+      }
+    } : hostLocal;
     if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
     return new Dispatcher({
       deviceId: this.deviceId ?? void 0,
@@ -13516,11 +15571,13 @@ var CompanionSupervisor = class {
       ...runnersEnabled(this.config) ? {
         runner: {
           provider: this.runnerProvider(),
-          command: this.runnerCommand ?? selfRunnerCommand(),
+          command: this.runnerCommandFor(),
+          ...this.dockerRunners() ? { runnerBaseUrl: dockerRunnerSettings(this.config).apiUrl } : {},
           reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
-          sandbox: this.runnerSandbox()
+          sandbox: this.runnerSandbox(),
+          policy: this.sandboxPolicy()
         }
       } : {}
     });
@@ -13840,7 +15897,7 @@ var CompanionSupervisor = class {
       );
     }
     const resumedTurnId = recoveredTurnId ?? (dispatchId ? turnIdForEvent(workspaceId, dispatchId) : null);
-    const turnId = resumedTurnId ?? randomUUID5();
+    const turnId = resumedTurnId ?? randomUUID6();
     if (dispatchId) {
       const liveTurnIds = rememberTurnId(workspaceId, dispatchId, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
@@ -14145,9 +16202,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn8 }) => {
+  void import("child_process").then(({ spawn: spawn10 }) => {
     try {
-      const child = spawn8(process.execPath, process.argv.slice(1), {
+      const child = spawn10(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -14159,6 +16216,9 @@ function defaultReexec() {
   });
 }
 
+// src/runtime.ts
+init_version2();
+
 // src/safety.ts
 var RECOVERABLE_CODES = /* @__PURE__ */ new Set([
   "EPIPE",
@@ -14218,22 +16278,22 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 init_config();
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync9, writeFileSync as writeFileSync8 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
+import { join as join20 } from "path";
 function crashMarkerPath() {
-  return join17(cabaneDir(), "last-error.json");
+  return join20(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
-    mkdirSync11(cabaneDir(), { recursive: true });
-    writeFileSync8(crashMarkerPath(), JSON.stringify(rec2, null, 2) + "\n");
+    mkdirSync13(cabaneDir(), { recursive: true });
+    writeFileSync9(crashMarkerPath(), JSON.stringify(rec2, null, 2) + "\n");
   } catch {
   }
 }
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync12(path)) rmSync9(path, { force: true });
+    if (existsSync15(path)) rmSync12(path, { force: true });
   } catch {
   }
 }
@@ -14276,7 +16336,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID6();
+  const instanceId = randomUUID7();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();
@@ -14406,16 +16466,16 @@ async function closeSurfaces(control, dashboard) {
 init_term();
 
 // src/commands/daemon.ts
-import { spawn as spawn7 } from "child_process";
-import { closeSync as closeSync3, mkdirSync as mkdirSync12, openSync as openSync3 } from "fs";
+import { spawn as spawn9 } from "child_process";
+import { closeSync as closeSync3, mkdirSync as mkdirSync14, openSync as openSync3 } from "fs";
 
 // src/cli-entry.ts
-import { existsSync as existsSync13 } from "fs";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync16 } from "fs";
+import { fileURLToPath as fileURLToPath5 } from "url";
 var RELATIVE_CANDIDATES = ["./cli.js", "../dist/cli.js", "../cli.js"];
 function companionCliEntry(deps = {}) {
-  const exists = deps.exists ?? existsSync13;
-  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath3(new URL(rel, import.meta.url)));
+  const exists = deps.exists ?? existsSync16;
+  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath5(new URL(rel, import.meta.url)));
   for (const candidate of candidates) {
     if (exists(candidate)) return candidate;
   }
@@ -14516,10 +16576,10 @@ Stop:    cabane-companion stop
 }
 function defaultSpawnDetached(args) {
   const cliPath = companionCliEntry();
-  mkdirSync12(cabaneDir(), { recursive: true });
+  mkdirSync14(cabaneDir(), { recursive: true });
   const logFd = openSync3(companionLogPath(), "a");
   try {
-    return spawn7(process.execPath, [cliPath, ...args], {
+    return spawn9(process.execPath, [cliPath, ...args], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env, CABANE_COMPANION_DAEMON: "1" }
@@ -14808,7 +16868,8 @@ async function runAttached(runtime) {
 
 // src/commands/status.ts
 init_config();
-import { readdirSync as readdirSync4 } from "fs";
+import { readdirSync as readdirSync6 } from "fs";
+init_sandbox_policy();
 init_secrets();
 init_transcript_writer();
 async function status() {
@@ -14859,6 +16920,13 @@ async function status() {
     process.stdout.write(`prepare hook: ${cfg.prepareHook.command} (device-level, all agents)
 `);
   }
+  if (runnersEnabled(cfg) && cfg.runners?.sandbox === "os") {
+    process.stdout.write("sandbox:      os\n");
+    for (const line of postureLines(parseSandboxPolicy(cfg.runners.policy))) {
+      process.stdout.write(`  ${line}
+`);
+    }
+  }
   const overrides2 = Object.keys(cfg.agents ?? {});
   if (overrides2.length > 0) {
     process.stdout.write(`local overrides for: ${overrides2.join(", ")}
@@ -14870,7 +16938,7 @@ function transcriptsLine() {
   let count = 0;
   let newest;
   try {
-    const files = readdirSync4(dir2).filter((f) => f.endsWith(".jsonl")).sort();
+    const files = readdirSync6(dir2).filter((f) => f.endsWith(".jsonl")).sort();
     count = files.length;
     newest = files[files.length - 1];
   } catch {
@@ -14951,8 +17019,8 @@ function isAlive(kill, pid) {
 init_errors();
 init_src();
 init_transcript_writer();
-import { existsSync as existsSync14, readFileSync as readFileSync10, readdirSync as readdirSync5 } from "fs";
-import { isAbsolute, join as join18 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync7 } from "fs";
+import { isAbsolute, join as join21 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -14969,7 +17037,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join18(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join21(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -15052,7 +17120,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync10(join18(dir2, f), "utf8"),
+    read: (f) => readFileSync13(join21(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -15077,7 +17145,7 @@ async function followTranscripts(dir2) {
 }
 function listFiles(dir2) {
   try {
-    return readdirSync5(dir2).filter((f) => f.endsWith(".jsonl")).sort().reverse();
+    return readdirSync7(dir2).filter((f) => f.endsWith(".jsonl")).sort().reverse();
   } catch {
     return [];
   }
@@ -15092,7 +17160,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join18(dir2, f));
+    const { meta, outcome } = peek(join21(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -15113,7 +17181,7 @@ function peek(path) {
   let meta;
   let outcome;
   try {
-    for (const line of readFileSync10(path, "utf8").split("\n")) {
+    for (const line of readFileSync13(path, "utf8").split("\n")) {
       if (!line.trim()) continue;
       const o = safeParse(line);
       const t = str2(rec(o)?.type);
@@ -15126,13 +17194,13 @@ function peek(path) {
 }
 function resolveTarget(dir2, target) {
   if (isAbsolute(target) || target.includes("/")) {
-    if (existsSync14(target)) return target;
+    if (existsSync17(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join18(dir2, target);
-  if (existsSync14(exact)) return exact;
+  const exact = join21(dir2, target);
+  if (existsSync17(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join18(dir2, matches[0]);
+  if (matches.length === 1) return join21(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`cabane-companion transcript\` to list them.`
@@ -15146,7 +17214,7 @@ function resolveTarget(dir2, target) {
 function renderFile(path) {
   let content;
   try {
-    content = readFileSync10(path, "utf8");
+    content = readFileSync13(path, "utf8");
   } catch (err) {
     throw new CompanionError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -15295,6 +17363,7 @@ They are written per dispatch while \`cabane-companion start\` is running.
 
 // src/cli.ts
 init_errors();
+init_version2();
 var program = new Command();
 program.name("cabane-companion").description(
   "Connect a coding agent on your machine to your Cabane workspace as a responder \u2014 reply to Cabane messages while staying a full local AI client (Claude Code or OpenCode)."
@@ -15307,7 +17376,7 @@ program.command("pair").description(
   });
 });
 program.command("write-paired-config", { hidden: true }).description("persist an already-completed device enrollment payload from stdin.").action(() => {
-  writeCompletedPairing(readFileSync11(0, "utf8"));
+  writeCompletedPairing(readFileSync14(0, "utf8"));
 });
 program.command("start").description(
   "pair this device if needed, connect a coding agent on it, and run in the background."
@@ -15364,7 +17433,13 @@ program.command("logout").description(
     ...opts.purge ? { purge: true } : {}
   });
 });
-program.command("run-turn", { hidden: true }).action(async () => {
+program.command("run-turn", { hidden: true }).option("--manifest", "print what this install can run, as JSON, and exit").action(async (opts) => {
+  if (opts.manifest) {
+    const { runnerManifest: runnerManifest2 } = await Promise.resolve().then(() => (init_image_manifest(), image_manifest_exports));
+    process.stdout.write(`${JSON.stringify(runnerManifest2())}
+`);
+    return;
+  }
   const { runTurn: runTurn2 } = await Promise.resolve().then(() => (init_run_turn(), run_turn_exports));
   const { code } = await runTurn2(process.env, {
     stdin: process.stdin,
@@ -15376,6 +17451,28 @@ program.command("run-turn", { hidden: true }).action(async () => {
   await new Promise((resolve2) => process.stderr.write("", () => resolve2()));
   process.exit(code);
 });
+program.command("egress-proxy", { hidden: true }).requiredOption("--port <port>", "port to listen on").action(async (opts) => {
+  const { createEgressProxy: createEgressProxy2 } = await Promise.resolve().then(() => (init_egress_proxy(), egress_proxy_exports));
+  const allow = JSON.parse(process.env.CABANE_EGRESS_ALLOW ?? "[]");
+  const log = (await import("pino")).default({ level: "info" }, process.stderr);
+  createEgressProxy2({ allow, log }).listen(
+    Number(opts.port),
+    "0.0.0.0",
+    () => log.info({ allow }, "egress proxy listening")
+  );
+});
+program.command("git-credential <operation>", { hidden: true }).action(async (operation) => {
+  const socket = process.env.CABANE_GIT_CREDENTIAL_SOCKET;
+  if (!socket) return;
+  const { askGitCredential: askGitCredential2 } = await Promise.resolve().then(() => (init_git_credential(), git_credential_exports));
+  const request = await new Promise((resolve2) => {
+    let input = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => input += chunk);
+    process.stdin.on("end", () => resolve2(input));
+  });
+  process.stdout.write(await askGitCredential2(socket, operation, request));
+});
 program.parseAsync(process.argv).catch((err) => {
   if (err instanceof CompanionError) {
     process.stderr.write(`error: ${err.message}