@cabane/companion 0.6.128 → 0.6.130

package/README.md

@@ -310,15 +310,17 @@ What the sandbox allows is `runners.policy` in `~/.cabane/config.json`. Every ke
 }
 ```
 
-| Setting                                   | Default                                                                                                                                                                                                                                                                                                                                                                                    |
-| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Hosts**, always reachable               | Cabane, and the model provider of the turn's harness (Anthropic for Claude Code, OpenAI for Codex). `allow` and `defaults` never remove these; a `deny` entry naming one does, and blocks the turn from reaching it.                                                                                                                                                                       |
-| **Hosts**, `defaults`                     | `github.com`, `*.github.com`, `*.githubusercontent.com`, `registry.npmjs.org`, `pypi.org`, `files.pythonhosted.org`, `crates.io`, `static.crates.io`, `index.crates.io`. `allow` adds to them, `deny` removes a host (and wins), `defaults: false` drops the list.                                                                                                                         |
-| **Reads**, `blocklist` mode (the default) | Everything is readable except `~/.cabane`, `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.config/gh`, `~/.git-credentials`, `~/.netrc`, `~/.npmrc`, `~/.pypirc`, `~/.docker/config.json`, `~/.kube`, `~/.config/gcloud`, `~/.azure`, `~/.config/op`, `~/.password-store`, any `.env` or `.env.*` in the working directory, and your `denyRead` paths. `allowRead` reopens a path inside a denied one. |
-| **Writes**                                | The working directory, the temp dir, `~/.claude`, `~/.claude.json`, `~/.codex`, plus `allowWrite`.                                                                                                                                                                                                                                                                                         |
+| Setting                                   | Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Hosts**, always reachable               | Cabane, and the model provider of the turn's harness (Anthropic for Claude Code, OpenAI for Codex). `allow` and `defaults` never remove these; a `deny` entry naming one does, and blocks the turn from reaching it.                                                                                                                                                                                                                                                                                                                                                            |
+| **Hosts**, `defaults`                     | `github.com`, `*.github.com`, `*.githubusercontent.com`, `registry.npmjs.org`, `pypi.org`, `files.pythonhosted.org`, `crates.io`, `static.crates.io`, `index.crates.io`. `allow` adds to them, `deny` removes a host (and wins), `defaults: false` drops the list.                                                                                                                                                                                                                                                                                                              |
+| **Reads**, `blocklist` mode (the default) | Everything is readable except every companion's store (`~/.cabane`, and any `.cabane` under your home or beside this companion's home; see below), the `.claude` and `.codex` of the other companion homes those stores sit in, `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.config/gh`, `~/.git-credentials`, `~/.netrc`, `~/.npmrc`, `~/.pypirc`, `~/.docker/config.json`, `~/.kube`, `~/.config/gcloud`, `~/.azure`, `~/.config/op`, `~/.password-store`, any `.env` or `.env.*` in the working directory, and your `denyRead` paths. `allowRead` reopens a path inside a denied one. |
+| **Writes**                                | The working directory, the temp dir, `~/.claude`, `~/.claude.json`, `~/.codex`, plus `allowWrite`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 Paths may start with `~/` and may be globs. An invalid `policy` doesn't stop the Companion from starting. Instead, every sandboxed turn is refused and the conversation names the field that's wrong, for example `runners.policy.filesystem.mode`.
 
+**Other companions on the same machine.** A second companion (another account, a test device) keeps its own secrets in its own `.cabane`, so a turn can't read any companion's store, not only this device's. Every turn denies this companion's store and `~/.cabane` (both, when the Companion runs from a home set with `CABANE_COMPANION_HOME`), plus any `.cabane` up to two levels under your home or beside this companion's home, where companion homes conventionally sit. Stores anywhere deeper are found by a search of your home with `find`, along with the `.claude` and `.codex` beside each one, which hold that companion's harness logins. That search takes seconds over a large home, so the Companion runs it in the background: when it starts, and again whenever a turn starts more than 5 minutes after the last search finished. Only the first turn after a start waits for it. **A store created deeper than two levels is denied within about 5 minutes plus one search, not instantly.** If a search can't finish (`find` is missing, runs past 60 seconds, or hits a directory it can't list), the stores it did find are still denied, and the log says so. The search runs in strict mode too, because strict mode reopens the working directory, and a store inside it must stay hidden.
+
 **`.env` files in other projects.** Only the working directory's `.env` files are denied by default. Another project's `.env` stays readable by its absolute path. If your other projects hold secrets, list their roots, for example `"denyRead": ["~/work/**/.env", "~/work/**/.env.*"]`. Each glob is expanded when the turn starts, which costs a walk of that tree on every turn and misses files created during the turn. When other projects' secrets really matter, strict mode is the better answer, because it hides them all without a walk.
 
 **Strict mode.** `"filesystem": { "mode": "strict" }` hides your whole home directory except the working directory, the harness state (`~/.claude`, `~/.codex`), what the Companion and its harnesses run from, and the paths you list in `allowRead`. Toolchains live all over a home directory (`~/.nvm`, `~/.local/share/pnpm`, `~/.cargo`, `~/.pyenv`, mise or asdf shims), so list yours, or builds will fail with "No such file or directory" on a path you didn't expect. On Linux a hidden path looks missing rather than denied, so the Companion log prints the readable list at the start of each strict turn. Compare it against the path the build couldn't find.

package/dist/cli.js

@@ -2592,8 +2592,8 @@ var init_policy = __esm({
 // packages/agent-runtime/src/claude-code/model.ts
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep2 = model.indexOf("/");
-  const bare = sep2 === -1 || model.slice(0, sep2) !== "anthropic" ? model : model.slice(sep2 + 1);
+  const sep3 = model.indexOf("/");
+  const bare = sep3 === -1 || model.slice(0, sep3) !== "anthropic" ? model : model.slice(sep3 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 var CLAUDE_CODE_DEFAULT_MODEL_BARE;
@@ -4040,9 +4040,9 @@ var init_policy2 = __esm({
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep2 = model.indexOf("/");
-  if (sep2 === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep2), modelID: model.slice(sep2 + 1) };
+  const sep3 = model.indexOf("/");
+  if (sep3 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep3), modelID: model.slice(sep3 + 1) };
 }
 var init_model2 = __esm({
   "packages/agent-runtime/src/opencode/model.ts"() {
@@ -4311,10 +4311,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep2;
-      while ((sep2 = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep2);
-        buf = buf.slice(sep2 + 2);
+      let sep3;
+      while ((sep3 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep3);
+        buf = buf.slice(sep3 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -5340,8 +5340,8 @@ var init_policy3 = __esm({
 
 // packages/agent-runtime/src/codex/model.ts
 function parseCodexModel(model) {
-  const sep2 = model.indexOf("/");
-  const bare = sep2 === -1 || model.slice(0, sep2) !== "openai" ? model : model.slice(sep2 + 1);
+  const sep3 = model.indexOf("/");
+  const bare = sep3 === -1 || model.slice(0, sep3) !== "openai" ? model : model.slice(sep3 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 var CODEX_DEFAULT_MODEL_BARES;
@@ -7486,6 +7486,9 @@ var init_protocol = __esm({
       // CT1684: the device's sandbox policy, validated by the launcher. Absent
       // when the sandbox is off.
       sandboxPolicy: sandboxPolicySchema.optional(),
+      // CT1691: every companion store the launcher's latest walk found, denied
+      // to the harness. Absent when the sandbox is off.
+      companionStores: z16.array(z16.string()).optional(),
       logLevel: z16.string(),
       // The launcher's connector-health observations, by runtime, as of the start.
       connectorHealth: z16.record(z16.string(), runtimeHealthSchema),
@@ -7549,7 +7552,7 @@ function healthSnapshot(store) {
   }
   return out;
 }
-function runnerSpec(opts, launch, duties, runnerId) {
+function runnerSpec(opts, launch, duties, runnerId, companionStores) {
   return {
     runnerId,
     ...opts.deviceId ? { deviceId: opts.deviceId } : {},
@@ -7574,6 +7577,7 @@ function runnerSpec(opts, launch, duties, runnerId) {
     ...launch.provider.bindAttempt ? { attemptState: true } : {},
     ...launch.provider.inheritsEnvironment === false ? { secretsFromLauncher: true } : {},
     ...launch.sandbox === "os" && launch.policy?.ok ? { sandboxPolicy: launch.policy.policy } : {},
+    ...launch.sandbox === "os" && companionStores ? { companionStores: [...companionStores] } : {},
     logLevel: opts.log.level,
     connectorHealth: healthSnapshot(launch.connectorHealth),
     sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
@@ -7772,6 +7776,7 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
         if (v !== void 0) env[k] = v;
       }
     }
+    const companionStores = launch.sandbox === "os" ? await launch.companionStores?.() : void 0;
     const input = {
       baseUrl: launch.runnerBaseUrl ?? opts.baseUrl,
       credential: minted.credential,
@@ -7779,7 +7784,7 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
-      spec: runnerSpec(opts, launch, duties, minted.runnerId)
+      spec: runnerSpec(opts, launch, duties, minted.runnerId, companionStores)
     };
     Object.assign(env, runnerEnv(input));
     const running = launch.provider.exec(handle, launch.command, env, {
@@ -10266,6 +10271,7 @@ var init_git_credential = __esm({
 });
 
 // src/runner/harness-sandbox.ts
+import { execFile as execFile2 } from "child_process";
 import { lookup } from "dns/promises";
 import {
   chmodSync as chmodSync6,
@@ -10279,7 +10285,7 @@ import {
 import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
 import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
-import { dirname as dirname8, join as join18 } from "path";
+import { dirname as dirname8, join as join18, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
@@ -10345,6 +10351,74 @@ function harnessRuntimePaths() {
 function ownAddresses() {
   return Object.values(networkInterfaces()).flat().flatMap((i) => i ? [i.address] : []);
 }
+function storeWalkRoots(homes, cabaneDir2) {
+  const companionHome = dirname8(cabaneDir2);
+  const parent = dirname8(companionHome);
+  const beside = homes.includes(companionHome) || dirname8(parent) === parent ? [] : [parent];
+  const candidates = [.../* @__PURE__ */ new Set([...homes, ...beside])];
+  return candidates.filter(
+    (root) => !candidates.some((other) => other !== root && isAtOrUnder(root, other))
+  );
+}
+async function walkCompanionStores(roots, opts = {}) {
+  const started = Date.now();
+  const { stdout, error } = await new Promise((resolve2) => {
+    execFile2(
+      opts.command ?? "find",
+      // `-prune`: nothing inside a store needs looking at. `-print0`: a
+      // directory name may hold a newline.
+      [...roots, "-type", "d", "-name", ".cabane", "-prune", "-print0"],
+      {
+        encoding: "buffer",
+        timeout: opts.timeoutMs ?? STORE_WALK_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024
+      },
+      (err, out) => resolve2({
+        stdout: Buffer.isBuffer(out) ? out : Buffer.alloc(0),
+        ...err ? { error: err.message } : {}
+      })
+    );
+  });
+  const ms = Date.now() - started;
+  const stores = [];
+  let complete = error === void 0;
+  for (let at = 0, end = stdout.indexOf(0); end !== -1; at = end + 1, end = stdout.indexOf(0, at)) {
+    const raw = stdout.subarray(at, end);
+    const path = raw.toString("utf8");
+    if (Buffer.from(path, "utf8").equals(raw)) stores.push(path);
+    else complete = false;
+  }
+  return { stores: [...new Set(stores)].sort(), complete, ms, ...error ? { error } : {} };
+}
+function companionStoreDenies(input) {
+  const { homes, cabaneDir: cabaneDir2, foundStores } = input;
+  const parent = dirname8(dirname8(cabaneDir2));
+  const always = [
+    cabaneDir2,
+    ...homes.flatMap((home) => [
+      join18(home, ".cabane"),
+      join18(home, "*", ".cabane"),
+      join18(home, "*", "*", ".cabane")
+    ]),
+    // A glob anchored at the root has no directory to start from.
+    ...dirname8(parent) === parent ? [] : [join18(parent, "*", ".cabane")]
+  ];
+  const companionHome = dirname8(cabaneDir2);
+  const otherLogins = foundStores.map((store) => dirname8(store)).filter((home) => home !== companionHome).flatMap((home) => [join18(home, ".claude"), join18(home, ".codex")]).filter((path) => !input.ownState.some((own) => isAtOrUnder(own, path)));
+  return [.../* @__PURE__ */ new Set([...always, ...foundStores, ...otherLogins])];
+}
+function companionStoreWatch(log) {
+  return new CompanionStoreWatch({
+    log,
+    roots: () => {
+      const home = homedir3();
+      return storeWalkRoots([.../* @__PURE__ */ new Set([home, accountHome() ?? home])], cabaneDir());
+    }
+  });
+}
+function isAtOrUnder(path, dir2) {
+  return path === dir2 || path.startsWith(dir2 + sep2);
+}
 function expandHome(path, home) {
   if (path === "~") return home;
   return path.startsWith("~/") ? join18(home, path.slice(2)) : path;
@@ -10378,7 +10452,12 @@ function harnessSandboxConfig(input) {
   const allowedDomains = [.../* @__PURE__ */ new Set([...cabane, ...models, ...reachable])];
   const envGlobs = input.cwd ? [join18(input.cwd, "**/.env"), join18(input.cwd, "**/.env.*")] : [];
   const secrets = [
-    input.cabaneDir,
+    ...companionStoreDenies({
+      homes,
+      cabaneDir: input.cabaneDir,
+      foundStores: input.foundStores,
+      ownState: [claudeDir, codexDir]
+    }),
     ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join18(home, p))),
     ...envGlobs,
     ...expand(policy.filesystem?.denyRead)
@@ -10441,11 +10520,12 @@ function gitCredentialExports(credentials) {
   const git = credentials.filter((c) => c.gitHost);
   if (!git.length) return "";
   const lines2 = ["n=${GIT_CONFIG_COUNT:-0}"];
+  const set = (key, value) => lines2.push(`export "GIT_CONFIG_KEY_$n=${key}" "GIT_CONFIG_VALUE_$n=${value}"`, "n=$((n+1))");
   for (const c of git) {
-    lines2.push(
-      `export "GIT_CONFIG_KEY_$n=http.https://${c.gitHost}/.extraHeader" "GIT_CONFIG_VALUE_$n=Authorization: Basic $${c.name}"`,
-      "n=$((n+1))"
-    );
+    const h = c.gitHost;
+    set(`http.https://${h}/.extraHeader`, `Authorization: Basic $${c.name}`);
+    set(`url.https://${h}/.insteadOf`, `git@${h}:`);
+    set(`url.https://${h}/.insteadOf`, `ssh://git@${h}/`);
   }
   lines2.push("export GIT_CONFIG_COUNT=$n");
   return lines2.join("; ") + "; ";
@@ -10487,7 +10567,8 @@ async function prepareHarnessSandbox(input) {
       runtime: input.runtime,
       policy: input.policy,
       credentials: input.credentials,
-      runtimePaths: harnessRuntimePaths()
+      runtimePaths: harnessRuntimePaths(),
+      foundStores: input.companionStores ?? []
     });
     await SandboxManager.initialize(config);
     if (input.policy.filesystem?.mode === "strict") {
@@ -10559,7 +10640,7 @@ exec ${shellQuote(script)} ${shellQuote(real)} "$@"
     }
   };
 }
-var SECRET_PATHS_UNDER_HOME;
+var SECRET_PATHS_UNDER_HOME, STORE_WALK_TIMEOUT_MS, STORE_WALK_MAX_AGE_MS, CompanionStoreWatch;
 var init_harness_sandbox = __esm({
   "src/runner/harness-sandbox.ts"() {
     "use strict";
@@ -10582,6 +10663,50 @@ var init_harness_sandbox = __esm({
       ".config/op",
       ".password-store"
     ];
+    STORE_WALK_TIMEOUT_MS = 6e4;
+    STORE_WALK_MAX_AGE_MS = 5 * 6e4;
+    CompanionStoreWatch = class {
+      constructor(opts) {
+        this.opts = opts;
+      }
+      opts;
+      latest;
+      running;
+      // Start a walk unless one is running; resolves with the stores held after it.
+      refresh() {
+        this.running ??= (this.opts.walk ?? walkCompanionStores)(this.opts.roots()).then((walk2) => {
+          const stores = walk2.complete ? walk2.stores : [.../* @__PURE__ */ new Set([...this.latest?.stores ?? [], ...walk2.stores])].sort();
+          this.latest = { stores, at: this.now() };
+          if (!walk2.complete) {
+            this.opts.log.warn(
+              { err: walk2.error, ms: walk2.ms, stores: walk2.stores.length },
+              "runners: couldn't search all of this machine for other companions' stores; the ones found and those matched by name are denied"
+            );
+          } else {
+            this.opts.log.debug(
+              { ms: walk2.ms, stores: walk2.stores.length },
+              "runners: companion stores found"
+            );
+          }
+          return stores;
+        }).finally(() => {
+          this.running = void 0;
+        });
+        return this.running;
+      }
+      // The stores a turn starting now denies.
+      async stores() {
+        const latest = this.latest;
+        if (!latest) return this.refresh();
+        if (this.now() - latest.at > (this.opts.maxAgeMs ?? STORE_WALK_MAX_AGE_MS)) {
+          void this.refresh();
+        }
+        return latest.stores;
+      }
+      now() {
+        return (this.opts.now ?? Date.now)();
+      }
+    };
   }
 });
 
@@ -11013,6 +11138,7 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
           runtime,
           policy: spec.sandboxPolicy ?? {},
           credentials: input.sandboxCredentials ?? [],
+          ...spec.companionStores ? { companionStores: spec.companionStores } : {},
           log: turnLog
         });
         if (sandbox) onSandbox?.(sandbox);
@@ -15087,6 +15213,7 @@ var CompanionSupervisor = class {
       const summary = posture.join("; ");
       if (policy.ok) this.log.info({ posture }, `runners: OS sandbox policy \u2014 ${summary}`);
       else this.log.error({ posture }, `runners: ${summary}`);
+      void this.companionStores().refresh();
     }
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
@@ -15536,6 +15663,12 @@ var CompanionSupervisor = class {
     this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
     return this.parsedSandboxPolicy;
   }
+  // CT1691: the walk for other companions' stores, run off the turn path.
+  storeWatch;
+  companionStores() {
+    this.storeWatch ??= companionStoreWatch(this.log);
+    return this.storeWatch;
+  }
   runnerSandbox() {
     if (this.config.runners?.sandbox !== "os" || this.dockerRunners()) return "none";
     this.sandboxUsable ??= osSandboxUsable(this.log);
@@ -15656,7 +15789,8 @@ var CompanionSupervisor = class {
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
           sandbox: this.runnerSandbox(),
-          policy: this.sandboxPolicy()
+          policy: this.sandboxPolicy(),
+          companionStores: () => this.companionStores().stores()
         }
       } : {}
     });

package/dist/runtime.js

@@ -4011,8 +4011,8 @@ function readThinking(runtimeOptions) {
 var CLAUDE_CODE_DEFAULT_MODEL_BARE = "default";
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep2 = model.indexOf("/");
-  const bare = sep2 === -1 || model.slice(0, sep2) !== "anthropic" ? model : model.slice(sep2 + 1);
+  const sep3 = model.indexOf("/");
+  const bare = sep3 === -1 || model.slice(0, sep3) !== "anthropic" ? model : model.slice(sep3 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 
@@ -5363,9 +5363,9 @@ function readOpencodeDialect(runtimeOptions) {
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep2 = model.indexOf("/");
-  if (sep2 === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep2), modelID: model.slice(sep2 + 1) };
+  const sep3 = model.indexOf("/");
+  if (sep3 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep3), modelID: model.slice(sep3 + 1) };
 }
 
 // packages/agent-runtime/src/opencode/run-spec.ts
@@ -5617,10 +5617,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep2;
-      while ((sep2 = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep2);
-        buf = buf.slice(sep2 + 2);
+      let sep3;
+      while ((sep3 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep3);
+        buf = buf.slice(sep3 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -6580,8 +6580,8 @@ function readCodexDialect(runtimeOptions) {
 // packages/agent-runtime/src/codex/model.ts
 var CODEX_DEFAULT_MODEL_BARES = /* @__PURE__ */ new Set(["default"]);
 function parseCodexModel(model) {
-  const sep2 = model.indexOf("/");
-  const bare = sep2 === -1 || model.slice(0, sep2) !== "openai" ? model : model.slice(sep2 + 1);
+  const sep3 = model.indexOf("/");
+  const bare = sep3 === -1 || model.slice(0, sep3) !== "openai" ? model : model.slice(sep3 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 
@@ -8543,6 +8543,9 @@ var runnerSpecSchema = z16.object({
   // CT1684: the device's sandbox policy, validated by the launcher. Absent
   // when the sandbox is off.
   sandboxPolicy: sandboxPolicySchema.optional(),
+  // CT1691: every companion store the launcher's latest walk found, denied
+  // to the harness. Absent when the sandbox is off.
+  companionStores: z16.array(z16.string()).optional(),
   logLevel: z16.string(),
   // The launcher's connector-health observations, by runtime, as of the start.
   connectorHealth: z16.record(z16.string(), runtimeHealthSchema),
@@ -8634,7 +8637,7 @@ function healthSnapshot(store) {
   }
   return out;
 }
-function runnerSpec(opts, launch, duties, runnerId) {
+function runnerSpec(opts, launch, duties, runnerId, companionStores) {
   return {
     runnerId,
     ...opts.deviceId ? { deviceId: opts.deviceId } : {},
@@ -8659,6 +8662,7 @@ function runnerSpec(opts, launch, duties, runnerId) {
     ...launch.provider.bindAttempt ? { attemptState: true } : {},
     ...launch.provider.inheritsEnvironment === false ? { secretsFromLauncher: true } : {},
     ...launch.sandbox === "os" && launch.policy?.ok ? { sandboxPolicy: launch.policy.policy } : {},
+    ...launch.sandbox === "os" && companionStores ? { companionStores: [...companionStores] } : {},
     logLevel: opts.log.level,
     connectorHealth: healthSnapshot(launch.connectorHealth),
     sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
@@ -8865,6 +8869,7 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
         if (v !== void 0) env[k] = v;
       }
     }
+    const companionStores = launch.sandbox === "os" ? await launch.companionStores?.() : void 0;
     const input = {
       baseUrl: launch.runnerBaseUrl ?? opts.baseUrl,
       credential: minted.credential,
@@ -8872,7 +8877,7 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
-      spec: runnerSpec(opts, launch, duties, minted.runnerId)
+      spec: runnerSpec(opts, launch, duties, minted.runnerId, companionStores)
     };
     Object.assign(env, runnerEnv(input));
     const running = launch.provider.exec(handle, launch.command, env, {
@@ -12451,6 +12456,7 @@ var DeviceLocks = class {
 };
 
 // src/runner/harness-sandbox.ts
+import { execFile as execFile2 } from "child_process";
 import { lookup } from "dns/promises";
 import {
   chmodSync as chmodSync6,
@@ -12464,9 +12470,111 @@ import {
 import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
 import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
-import { dirname as dirname8, join as join18 } from "path";
+import { dirname as dirname8, join as join18, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+function accountHome() {
+  try {
+    return userInfo2().homedir;
+  } catch {
+    return null;
+  }
+}
+var STORE_WALK_TIMEOUT_MS = 6e4;
+var STORE_WALK_MAX_AGE_MS = 5 * 6e4;
+function storeWalkRoots(homes, cabaneDir2) {
+  const companionHome = dirname8(cabaneDir2);
+  const parent = dirname8(companionHome);
+  const beside = homes.includes(companionHome) || dirname8(parent) === parent ? [] : [parent];
+  const candidates = [.../* @__PURE__ */ new Set([...homes, ...beside])];
+  return candidates.filter(
+    (root) => !candidates.some((other) => other !== root && isAtOrUnder(root, other))
+  );
+}
+async function walkCompanionStores(roots, opts = {}) {
+  const started = Date.now();
+  const { stdout, error } = await new Promise((resolve2) => {
+    execFile2(
+      opts.command ?? "find",
+      // `-prune`: nothing inside a store needs looking at. `-print0`: a
+      // directory name may hold a newline.
+      [...roots, "-type", "d", "-name", ".cabane", "-prune", "-print0"],
+      {
+        encoding: "buffer",
+        timeout: opts.timeoutMs ?? STORE_WALK_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024
+      },
+      (err, out) => resolve2({
+        stdout: Buffer.isBuffer(out) ? out : Buffer.alloc(0),
+        ...err ? { error: err.message } : {}
+      })
+    );
+  });
+  const ms = Date.now() - started;
+  const stores = [];
+  let complete = error === void 0;
+  for (let at = 0, end = stdout.indexOf(0); end !== -1; at = end + 1, end = stdout.indexOf(0, at)) {
+    const raw = stdout.subarray(at, end);
+    const path = raw.toString("utf8");
+    if (Buffer.from(path, "utf8").equals(raw)) stores.push(path);
+    else complete = false;
+  }
+  return { stores: [...new Set(stores)].sort(), complete, ms, ...error ? { error } : {} };
+}
+var CompanionStoreWatch = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  latest;
+  running;
+  // Start a walk unless one is running; resolves with the stores held after it.
+  refresh() {
+    this.running ??= (this.opts.walk ?? walkCompanionStores)(this.opts.roots()).then((walk2) => {
+      const stores = walk2.complete ? walk2.stores : [.../* @__PURE__ */ new Set([...this.latest?.stores ?? [], ...walk2.stores])].sort();
+      this.latest = { stores, at: this.now() };
+      if (!walk2.complete) {
+        this.opts.log.warn(
+          { err: walk2.error, ms: walk2.ms, stores: walk2.stores.length },
+          "runners: couldn't search all of this machine for other companions' stores; the ones found and those matched by name are denied"
+        );
+      } else {
+        this.opts.log.debug(
+          { ms: walk2.ms, stores: walk2.stores.length },
+          "runners: companion stores found"
+        );
+      }
+      return stores;
+    }).finally(() => {
+      this.running = void 0;
+    });
+    return this.running;
+  }
+  // The stores a turn starting now denies.
+  async stores() {
+    const latest = this.latest;
+    if (!latest) return this.refresh();
+    if (this.now() - latest.at > (this.opts.maxAgeMs ?? STORE_WALK_MAX_AGE_MS)) {
+      void this.refresh();
+    }
+    return latest.stores;
+  }
+  now() {
+    return (this.opts.now ?? Date.now)();
+  }
+};
+function companionStoreWatch(log) {
+  return new CompanionStoreWatch({
+    log,
+    roots: () => {
+      const home = homedir3();
+      return storeWalkRoots([.../* @__PURE__ */ new Set([home, accountHome() ?? home])], cabaneDir());
+    }
+  });
+}
+function isAtOrUnder(path, dir2) {
+  return path === dir2 || path.startsWith(dir2 + sep2);
+}
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
     log.warn(
@@ -12999,6 +13107,7 @@ var CompanionSupervisor = class {
       const summary = posture.join("; ");
       if (policy.ok) this.log.info({ posture }, `runners: OS sandbox policy \u2014 ${summary}`);
       else this.log.error({ posture }, `runners: ${summary}`);
+      void this.companionStores().refresh();
     }
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
@@ -13448,6 +13557,12 @@ var CompanionSupervisor = class {
     this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
     return this.parsedSandboxPolicy;
   }
+  // CT1691: the walk for other companions' stores, run off the turn path.
+  storeWatch;
+  companionStores() {
+    this.storeWatch ??= companionStoreWatch(this.log);
+    return this.storeWatch;
+  }
   runnerSandbox() {
     if (this.config.runners?.sandbox !== "os" || this.dockerRunners()) return "none";
     this.sandboxUsable ??= osSandboxUsable(this.log);
@@ -13568,7 +13683,8 @@ var CompanionSupervisor = class {
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
           sandbox: this.runnerSandbox(),
-          policy: this.sandboxPolicy()
+          policy: this.sandboxPolicy(),
+          companionStores: () => this.companionStores().stores()
         }
       } : {}
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.128",
+  "version": "0.6.130",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",