@cabane/companion 0.6.141 → 0.6.143

package/dist/cli.js

@@ -15,14 +15,14 @@ var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
     CompanionError = class extends Error {
-      constructor(message) {
-        super(message);
+      constructor(message2) {
+        super(message2);
         this.name = "CompanionError";
       }
     };
     ApiError = class extends CompanionError {
-      constructor(status2, message, body) {
-        super(message);
+      constructor(status2, message2, body) {
+        super(message2);
         this.status = status2;
         this.body = body;
         this.name = "ApiError";
@@ -31,14 +31,14 @@ var init_errors = __esm({
       body;
     };
     ConfigError = class extends CompanionError {
-      constructor(message) {
-        super(message);
+      constructor(message2) {
+        super(message2);
         this.name = "ConfigError";
       }
     };
     PrepareHookError = class extends CompanionError {
-      constructor(message) {
-        super(message);
+      constructor(message2) {
+        super(message2);
         this.name = "PrepareHookError";
       }
     };
@@ -1063,8 +1063,8 @@ function apiErrorCode(err) {
 function apiErrorMessage(err) {
   const body = err instanceof ApiError ? err.body : void 0;
   if (body !== null && typeof body === "object") {
-    const message = body.message;
-    if (typeof message === "string" && message.length > 0) return message;
+    const message2 = body.message;
+    if (typeof message2 === "string" && message2.length > 0) return message2;
   }
   return err instanceof Error ? err.message : String(err);
 }
@@ -1097,9 +1097,9 @@ function describeErrorBody(body) {
   return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
 }
 function describeError(err) {
-  const message = err instanceof Error ? err.message : String(err);
+  const message2 = err instanceof Error ? err.message : String(err);
   const cause = describeCause(err);
-  return cause === void 0 ? message : `${message}: ${cause}`;
+  return cause === void 0 ? message2 : `${message2}: ${cause}`;
 }
 function describeCause(err) {
   if (!(err instanceof Error)) return void 0;
@@ -2564,8 +2564,7 @@ var init_addendum = __esm({
     CLAUDE_CODE_ADDENDUM = [
       "On this harness the Cabane tools register under MCP prefixes. The workspace tools are",
       "`mcp__cabane__query`, `mcp__cabane__mutate` and `mcp__cabane__describe`; the ancillary",
-      "tools are `mcp__cabane__list_workspaces`,",
-      "`mcp__cabane__read_binary`, `mcp__cabane__upload`, `mcp__cabane__begin_upload`,",
+      "tools are `mcp__cabane__read_binary`, `mcp__cabane__upload`, `mcp__cabane__begin_upload`,",
       "`mcp__cabane__finalize_upload`, and `mcp__cabane__mint_render_token`.",
       turnControlPromptGuidance("mcp__cabane_companion__"),
       "Where this prompt names a tool by its bare verb, call",
@@ -2987,15 +2986,15 @@ async function* decodeSdkStream(iter, ctx) {
     }
   } catch (err) {
     if (ctx.signal.aborted) throw err;
-    const message = err instanceof Error ? err.message : String(err);
-    const failure = mcpInventory.initReceived ? classifyErrorText(message) : classifyFailure(signals, { text: message });
+    const message2 = err instanceof Error ? err.message : String(err);
+    const failure = mcpInventory.initReceived ? classifyErrorText(message2) : classifyFailure(signals, { text: message2 });
     if (!failure && (mcpInventory.initReceived || ctx.resumedSessionId === null)) throw err;
     ok = false;
     if (failure) {
       resultReason = encodeFailureReason(failure);
     } else {
       resultReason = "session_start_failed";
-      if (ctx.startEvidence) ctx.startEvidence.thrown = message.slice(0, 200);
+      if (ctx.startEvidence) ctx.startEvidence.thrown = message2.slice(0, 200);
     }
     sawResult = true;
   }
@@ -3890,7 +3889,7 @@ var init_addendum2 = __esm({
       "Every tool here goes by its plain name: the workspace tools are `query`, `mutate` and",
       "`describe`.",
       turnControlPromptGuidance(""),
-      "The ancillary tools are `list_workspaces`, `read_binary`, `upload`, `begin_upload`,",
+      "The ancillary tools are `read_binary`, `upload`, `begin_upload`,",
       "`finalize_upload`, `mint_render_token`; and the host tools are plain verbs too (`bash`,",
       "`read`, `edit`). Mind the collision: a bare `read` or `edit` is the HOST tool, acting on the",
       "local machine \u2014 a workspace read is `query` with the operation name `files.read`. The",
@@ -3980,9 +3979,9 @@ function readSessionError(properties) {
   if (typeof err === "string") return err;
   const rec2 = asRecord(err);
   if (!rec2) return "unknown";
-  const { name, message } = deepestError(rec2);
-  if (message && name && !isGenericErrorName(name)) return `${name}: ${message}`;
-  if (message) return message;
+  const { name, message: message2 } = deepestError(rec2);
+  if (message2 && name && !isGenericErrorName(name)) return `${name}: ${message2}`;
+  if (message2) return message2;
   if (name) return name;
   if (typeof rec2.name === "string") return rec2.name;
   return "unknown";
@@ -3994,10 +3993,10 @@ function deepestError(node) {
   const best = {};
   let current = node;
   for (let depth = 0; current && depth < 8; depth++) {
-    const message = typeof current.message === "string" ? current.message : void 0;
+    const message2 = typeof current.message === "string" ? current.message : void 0;
     const name = typeof current.name === "string" && !isGenericErrorName(current.name) ? current.name : void 0;
-    if (message) {
-      best.message = message;
+    if (message2) {
+      best.message = message2;
       if (name) best.name = name;
     } else if (name && !best.name) {
       best.name = name;
@@ -4660,9 +4659,9 @@ var init_conformance3 = __esm({
       properties: { part: { type: "text", id: partId, messageID, text } }
     });
     idle = () => ({ type: "session.idle", properties: {} });
-    errored = (message) => ({
+    errored = (message2) => ({
       type: "session.error",
-      properties: { error: { message } }
+      properties: { error: { message: message2 } }
     });
     sessionEvent2 = (sessionId, directory = DIR, degraded = false) => ({
       type: "session",
@@ -5075,8 +5074,8 @@ var init_addendum3 = __esm({
       // in sat two lines under the instruction to invoke the exact qualified names,
       // so the sentence contradicted itself. The bare `query` / `mutate` below stay:
       // that sentence is about operation names, after the qualified forms are given.
-      "The ancillary tools are `mcp__cabane__list_workspaces`, `mcp__cabane__read_binary`,",
-      "`mcp__cabane__upload`, `mcp__cabane__begin_upload`, `mcp__cabane__finalize_upload` and",
+      "The ancillary tools are `mcp__cabane__read_binary`, `mcp__cabane__upload`,",
+      "`mcp__cabane__begin_upload`, `mcp__cabane__finalize_upload` and",
       "`mcp__cabane__mint_render_token` \u2014 all possibly deferred too.",
       "There is no Cabane `read`/`write`/`search` tool \u2014 those are",
       "operation NAMES you pass to `query` / `mutate`. One more harness fact: you can interleave",
@@ -5106,8 +5105,8 @@ function readItemText(item) {
 function readItemMessage(item) {
   return str(item.message) ?? "";
 }
-function isModelMetadataError(message) {
-  return message.includes("Defaulting to fallback metadata");
+function isModelMetadataError(message2) {
+  return message2.includes("Defaulting to fallback metadata");
 }
 function readToolItem(item, eventType) {
   const type = str(item.type);
@@ -5352,11 +5351,11 @@ async function* decodeCodexStream(events, ctx) {
       if (!item) continue;
       const itemType = readItemType(item);
       if (itemType === "error") {
-        const message = readItemMessage(item);
-        if (isModelMetadataError(message)) {
+        const message2 = readItemMessage(item);
+        if (isModelMetadataError(message2)) {
           yield* flushInterim();
           ok = false;
-          reason = `model_unavailable:${message.slice(0, 200)}`;
+          reason = `model_unavailable:${message2.slice(0, 200)}`;
           settled = true;
           break;
         }
@@ -5523,7 +5522,7 @@ var init_model3 = __esm({
 });
 
 // packages/agent-runtime/src/codex/run-spec.ts
-function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromptFingerprint = null) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromptFingerprint = null, imagePaths = []) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
@@ -5540,7 +5539,7 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromp
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
     baseInstructionsFile,
-    input: buildInput(req, promptRidesInput),
+    input: withImages(buildInput(req, promptRidesInput), imagePaths),
     promptRidesInput,
     promptFingerprint,
     config: buildConfig(req, baseInstructionsFile),
@@ -5556,6 +5555,13 @@ function buildInput(req, promptRidesInput) {
 
 ${body}` : body;
 }
+function withImages(text, imagePaths) {
+  if (imagePaths.length === 0) return text;
+  return [
+    { type: "text", text },
+    ...imagePaths.map((path) => ({ type: "local_image", path }))
+  ];
+}
 function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
@@ -5827,12 +5833,35 @@ function createCodexAdapter(deps = {}) {
           }
         }
       }
+      let images = null;
       try {
+        const imageUrls = req.content.flatMap((b) => b.type === "image" ? [b.source.url] : []);
+        if (imageUrls.length > 0) {
+          if (!deps.prepareImages) {
+            deps.onWarn?.(
+              "codex adapter: no image preparer wired on this host \u2014 the turn runs without its images (CT1757)",
+              { images: imageUrls.length }
+            );
+          } else {
+            try {
+              images = await deps.prepareImages(imageUrls, signal);
+            } catch (err) {
+              if (!signal.aborted) {
+                deps.onWarn?.(
+                  "codex adapter: preparing the images failed \u2014 the turn runs without them (CT1757)",
+                  { err: err instanceof Error ? err.message : String(err) }
+                );
+              }
+            }
+          }
+          if (signal.aborted) return;
+        }
         const spec = buildRunSpec2(
           req,
           resumeThreadId,
           instructions?.path ?? null,
-          threadPromptFingerprint
+          threadPromptFingerprint,
+          images?.paths ?? []
         );
         if (spec.model === null) {
           deps.onWarn?.("Codex is using its default model because no model was resolved", {
@@ -5861,6 +5890,15 @@ function createCodexAdapter(deps = {}) {
           resolvedReasoningEffort: spec.modelReasoningEffort ?? null
         });
       } finally {
+        if (images) {
+          try {
+            await images.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: image cleanup failed (CT1757)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
         if (instructions) {
           try {
             await instructions.cleanup();
@@ -5953,14 +5991,14 @@ var init_conformance4 = __esm({
       type: "turn.completed",
       ...usage ? { usage } : {}
     });
-    turnFailed = (message) => ({
+    turnFailed = (message2) => ({
       type: "turn.failed",
-      error: { message }
+      error: { message: message2 }
     });
-    fatalError = (message) => ({ type: "error", message });
-    errorItem = (id, message) => ({
+    fatalError = (message2) => ({ type: "error", message: message2 });
+    errorItem = (id, message2) => ({
       type: "item.completed",
-      item: { id, type: "error", message }
+      item: { id, type: "error", message: message2 }
     });
     OP_SUCCESS = { ok: true, result: { source: "native" } };
     OP_FAILURE = {
@@ -6898,8 +6936,8 @@ function unenforceable(policy) {
         deniedDomains: as === "deniedDomains" ? [host] : []
       });
       if (!check.success) {
-        const message = check.error.issues[0]?.message ?? "not a host pattern the sandbox accepts";
-        return `runners.policy.${field}.${i}: ${message}`;
+        const message2 = check.error.issues[0]?.message ?? "not a host pattern the sandbox accepts";
+        return `runners.policy.${field}.${i}: ${message2}`;
       }
     }
   }
@@ -6913,8 +6951,8 @@ function unenforceable(policy) {
       try {
         new RegExp(globToRegex(path));
       } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return `runners.policy.${field}.${i}: not a pattern the sandbox can match (${message})`;
+        const message2 = err instanceof Error ? err.message : String(err);
+        return `runners.policy.${field}.${i}: not a pattern the sandbox can match (${message2})`;
       }
     }
   }
@@ -7119,8 +7157,8 @@ async function reapTurnScopes(turnId) {
     });
     return { failures: [] };
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return classifyStopError(message) === "absent" ? { failures: [] } : { failures: [message.slice(0, 200)] };
+    const message2 = err instanceof Error ? err.message : String(err);
+    return classifyStopError(message2) === "absent" ? { failures: [] } : { failures: [message2.slice(0, 200)] };
   }
 }
 function scopeCapabilityUsable(env, timeoutMs = CAPABILITY_PROBE_TIMEOUT_MS) {
@@ -7136,13 +7174,13 @@ function scopeCapabilityUsable(env, timeoutMs = CAPABILITY_PROBE_TIMEOUT_MS) {
     return false;
   }
 }
-function classifyStopError(message) {
+function classifyStopError(message2) {
   if (/failed to connect to bus|failed to get d-?bus connection|connection refused|refusing to operate|spawn systemctl|systemctl.*ENOENT|ENOENT.*systemctl/i.test(
-    message
+    message2
   )) {
     return "failure";
   }
-  if (/not loaded|could not be found|no such unit|unit .* not found/i.test(message))
+  if (/not loaded|could not be found|no such unit|unit .* not found/i.test(message2))
     return "absent";
   return "failure";
 }
@@ -7251,9 +7289,9 @@ function createTurnContainment(turnId, deps = {}) {
           timeout: (CONTAINMENT_STOP_GRACE_SEC + 10) * 1e3
         });
       } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (classifyStopError(message) === "failure") {
-          result.failures.push({ target: unit, error: message.slice(0, 200) });
+        const message2 = err instanceof Error ? err.message : String(err);
+        if (classifyStopError(message2) === "failure") {
+          result.failures.push({ target: unit, error: message2.slice(0, 200) });
           continue;
         }
         result.reaped.push(unit);
@@ -7617,8 +7655,8 @@ function runnerStdin(input) {
   })}
 `;
 }
-function encodeLauncherMessage(message) {
-  return `${JSON.stringify(message)}
+function encodeLauncherMessage(message2) {
+  return `${JSON.stringify(message2)}
 `;
 }
 function decodeLauncherMessage(line) {
@@ -8480,6 +8518,74 @@ var init_codex_instructions = __esm({
   }
 });
 
+// src/codex-images.ts
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join12 } from "path";
+function createCodexImagePreparer(opts) {
+  const doFetch = opts.fetch ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? FETCH_TIMEOUT_MS;
+  return async (urls, signal) => {
+    signal.throwIfAborted();
+    const dir2 = await mkdtemp2(join12(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
+    const cleanup = async () => {
+      try {
+        await rm2(dir2, { recursive: true, force: true });
+      } catch (err) {
+        opts.warn(
+          { dir: dir2, err: message(err) },
+          "codex images: could not remove the scratch directory"
+        );
+      }
+    };
+    const prepareOne = async (url, index) => {
+      try {
+        const res = await doFetch(url, {
+          signal: AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)])
+        });
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const type = (res.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+        const ext = EXTENSIONS[type];
+        if (!ext) throw new Error(`not a vision image type: ${type || "none"}`);
+        const bytes = new Uint8Array(await res.arrayBuffer());
+        const path = join12(dir2, `image-${index + 1}.${ext}`);
+        await writeFile2(path, bytes, { mode: 384 });
+        return path;
+      } catch (err) {
+        if (!signal.aborted) {
+          opts.warn(
+            { image: index + 1, of: urls.length, err: message(err) },
+            "codex images: an image could not be prepared; the turn runs without it"
+          );
+        }
+        return null;
+      }
+    };
+    const paths = await Promise.all(urls.map(prepareOne));
+    if (signal.aborted) {
+      await cleanup();
+      signal.throwIfAborted();
+    }
+    return { paths: paths.filter((p) => p !== null), cleanup };
+  };
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var FETCH_TIMEOUT_MS, EXTENSIONS;
+var init_codex_images = __esm({
+  "src/codex-images.ts"() {
+    "use strict";
+    FETCH_TIMEOUT_MS = 3e4;
+    EXTENSIONS = {
+      "image/png": "png",
+      "image/jpeg": "jpg",
+      "image/gif": "gif",
+      "image/webp": "webp"
+    };
+  }
+});
+
 // src/turn-seq-floor.ts
 function resolveSeqFloor(sources, ctx) {
   const { serverFloor, outboxFloor } = sources;
@@ -8523,15 +8629,15 @@ var init_turn_seq_floor = __esm({
 import { spawn as spawn5 } from "child_process";
 import { hostname as hostname2 } from "os";
 function prepareFailureCause(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  if (/timed out/i.test(message)) return "prepare hook timed out";
-  if (/MODULE_NOT_FOUND|Cannot find (?:module|package)/.test(message))
+  const message2 = error instanceof Error ? error.message : String(error);
+  if (/timed out/i.test(message2)) return "prepare hook timed out";
+  if (/MODULE_NOT_FOUND|Cannot find (?:module|package)/.test(message2))
     return "prepare hook module missing; check the configured command and its installation for this device";
-  if (/not valid JSON|JSON must carry|produced no output/.test(message))
+  if (/not valid JSON|JSON must carry|produced no output/.test(message2))
     return "prepare hook returned malformed output; expected a cwd path or JSON with a non-empty cwd";
-  if (/ENOENT/.test(message)) return "prepare hook executable missing (ENOENT)";
-  if (/EACCES/.test(message)) return "prepare hook executable is not accessible (EACCES)";
-  const exit = message.match(/exited with code (\d+)/)?.[1];
+  if (/ENOENT/.test(message2)) return "prepare hook executable missing (ENOENT)";
+  if (/EACCES/.test(message2)) return "prepare hook executable is not accessible (EACCES)";
+  const exit = message2.match(/exited with code (\d+)/)?.[1];
   return exit ? `prepare hook exited with code ${exit}` : "prepare hook failed; inspect the device-local hook log";
 }
 async function runPrepareWithReporting(runner, hook, input, context, reportError) {
@@ -8588,15 +8694,15 @@ var init_prepare_failure = __esm({
 
 // src/prepared.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 function dirFor(workspaceId) {
-  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join13(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join13(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor2(workspaceId, conversationId, agentId) {
-  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join13(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
@@ -8634,9 +8740,9 @@ var init_prepared = __esm({
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname6, join as join13 } from "path";
+import { basename, dirname as dirname6, join as join14 } from "path";
 function transcriptsDir() {
-  return join13(runnerStateDir(), "transcripts");
+  return join14(runnerStateDir(), "transcripts");
 }
 function fileName(meta) {
   const d = new Date(meta.ts);
@@ -8662,7 +8768,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync6(join13(dir2, f), { force: true });
+      rmSync6(join14(dir2, f), { force: true });
     } catch {
     }
   }
@@ -8680,7 +8786,7 @@ var init_transcript_writer = __esm({
       onWarn;
       constructor(dir2, meta, onWarn) {
         this.onWarn = onWarn;
-        this.path = join13(dir2, fileName(meta));
+        this.path = join14(dir2, fileName(meta));
         try {
           mkdirSync8(dir2, { recursive: true });
           try {
@@ -8709,10 +8815,10 @@ var init_transcript_writer = __esm({
       preserveAnomaly() {
         if (this.broken) return;
         try {
-          const dir2 = join13(dirname6(this.path), "anomalies");
+          const dir2 = join14(dirname6(this.path), "anomalies");
           mkdirSync8(dir2, { recursive: true, mode: 448 });
           chmodSync4(dir2, 448);
-          const target = join13(dir2, basename(this.path));
+          const target = join14(dir2, basename(this.path));
           copyFileSync(this.path, target);
           chmodSync4(target, 384);
           pruneOld(dir2, ANOMALY_RETAIN);
@@ -9007,6 +9113,7 @@ var init_turn_execution = __esm({
     init_build_options();
     init_bundled_binaries();
     init_codex_instructions();
+    init_codex_images();
     init_config();
     init_api_error_shape();
     init_errors();
@@ -9355,16 +9462,16 @@ var init_turn_execution = __esm({
       }
       gateTrigger() {
         const { payload, turnLog } = this;
-        const message = this.turnContext.message;
-        const isDispatchableTrigger = message.role === "user" || message.role === "agent" || message.role === "system";
+        const message2 = this.turnContext.message;
+        const isDispatchableTrigger = message2.role === "user" || message2.role === "agent" || message2.role === "system";
         if (!isDispatchableTrigger) {
-          turnLog.debug({ role: message.role }, "dispatcher: trigger role not dispatchable \u2014 skipping");
+          turnLog.debug({ role: message2.role }, "dispatcher: trigger role not dispatchable \u2014 skipping");
           throw this.concluded("unexpected_role", UNEXPECTED_ROLE_REASON);
         }
         this.supervisor.notifyStart({
           id: this.dispatchId,
           conversationId: payload.conversationId,
-          message: message.body
+          message: message2.body
         });
       }
       async resolveSecrets() {
@@ -9715,6 +9822,10 @@ var init_turn_execution = __esm({
               enabled: true,
               onWarn,
               writeInstructionsFile: writeCodexInstructionsFile,
+              prepareImages: createCodexImagePreparer({
+                turnId: this.turnId,
+                warn: (meta, msg) => turnLog.warn(meta, msg)
+              }),
               ...codexPath ? { transport: createSdkCodexTransport({ codexPathOverride: codexPath }) } : {}
             })
           );
@@ -10175,7 +10286,7 @@ var init_turn_execution = __esm({
 // src/dispatcher.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
   if (!existsSync10(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
@@ -10188,7 +10299,7 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join14(cwd, ".git");
+  const gitPath = join15(cwd, ".git");
   if (!existsSync10(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
@@ -10196,7 +10307,7 @@ function checkoutState(cwd) {
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync10(join14(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync10(join15(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -10562,8 +10673,8 @@ import {
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
-import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
-import { dirname as dirname8, join as join18, sep as sep2 } from "path";
+import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo2 } from "os";
+import { dirname as dirname8, join as join19, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
@@ -10597,7 +10708,7 @@ async function resolvedAddresses(baseUrl) {
 function companionPackageRoot(modulePath) {
   for (let dir2 = dirname8(modulePath); ; dir2 = dirname8(dir2)) {
     try {
-      const manifest = JSON.parse(readFileSync10(join18(dir2, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync10(join19(dir2, "package.json"), "utf8"));
       if (manifest.name === "@cabane/companion") return dir2;
     } catch {
     }
@@ -10674,15 +10785,15 @@ function companionStoreDenies(input) {
   const always = [
     cabaneDir2,
     ...homes.flatMap((home) => [
-      join18(home, ".cabane"),
-      join18(home, "*", ".cabane"),
-      join18(home, "*", "*", ".cabane")
+      join19(home, ".cabane"),
+      join19(home, "*", ".cabane"),
+      join19(home, "*", "*", ".cabane")
     ]),
     // A glob anchored at the root has no directory to start from.
-    ...dirname8(parent) === parent ? [] : [join18(parent, "*", ".cabane")]
+    ...dirname8(parent) === parent ? [] : [join19(parent, "*", ".cabane")]
   ];
   const companionHome = dirname8(cabaneDir2);
-  const otherLogins = foundStores.map((store) => dirname8(store)).filter((home) => home !== companionHome).flatMap((home) => [join18(home, ".claude"), join18(home, ".codex")]).filter((path) => !input.ownState.some((own) => isAtOrUnder(own, path)));
+  const otherLogins = foundStores.map((store) => dirname8(store)).filter((home) => home !== companionHome).flatMap((home) => [join19(home, ".claude"), join19(home, ".codex")]).filter((path) => !input.ownState.some((own) => isAtOrUnder(own, path)));
   return [.../* @__PURE__ */ new Set([...always, ...foundStores, ...otherLogins])];
 }
 function companionStoreWatch(log) {
@@ -10699,7 +10810,7 @@ function isAtOrUnder(path, dir2) {
 }
 function expandHome(path, home) {
   if (path === "~") return home;
-  return path.startsWith("~/") ? join18(home, path.slice(2)) : path;
+  return path.startsWith("~/") ? join19(home, path.slice(2)) : path;
 }
 function stripPort(pattern) {
   return pattern.startsWith("[") ? pattern.replace(/^\[([^\]]+)\](:\d+)?$/, "$1") : pattern.replace(/:\d+$/, "");
@@ -10717,8 +10828,8 @@ function patternsOverlap(a, b) {
 }
 function harnessSandboxConfig(input) {
   const { policy } = input;
-  const claudeDir = input.claudeConfigDir ?? join18(input.home, ".claude");
-  const codexDir = input.codexHome ?? join18(input.home, ".codex");
+  const claudeDir = input.claudeConfigDir ?? join19(input.home, ".claude");
+  const codexDir = input.codexHome ?? join19(input.home, ".codex");
   const homes = [.../* @__PURE__ */ new Set([input.home, input.accountHome ?? input.home])];
   const expand = (paths) => (paths ?? []).map((p) => expandHome(p, input.home));
   const cabane = cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses);
@@ -10735,7 +10846,7 @@ function harnessSandboxConfig(input) {
       foundStores: input.foundStores,
       ownState: [claudeDir, codexDir]
     }),
-    ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join18(home, p))),
+    ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join19(home, p))),
     ...expand(policy.filesystem?.denyRead)
   ];
   const strict = policy.filesystem?.mode === "strict";
@@ -10743,7 +10854,7 @@ function harnessSandboxConfig(input) {
   const allowRead = strict ? [
     ...input.cwd ? [input.cwd] : [],
     claudeDir,
-    join18(input.home, ".claude.json"),
+    join19(input.home, ".claude.json"),
     codexDir,
     ...input.runtimePaths ?? [],
     ...expand(policy.filesystem?.allowRead)
@@ -10783,7 +10894,7 @@ function harnessSandboxConfig(input) {
         ...input.cwd ? [input.cwd] : [],
         input.tmp,
         claudeDir,
-        join18(input.home, ".claude.json"),
+        join19(input.home, ".claude.json"),
         codexDir,
         ...expand(policy.filesystem?.allowWrite)
       ],
@@ -10836,7 +10947,7 @@ async function prepareHarnessSandbox(input) {
       ownAddresses: ownAddresses(),
       home: homedir3(),
       accountHome: accountHome(),
-      tmp: tmpdir3(),
+      tmp: tmpdir4(),
       cabaneDir: cabaneDir(),
       claudeConfigDir: process.env.CLAUDE_CONFIG_DIR,
       codexHome: process.env.CODEX_HOME,
@@ -10867,27 +10978,27 @@ async function prepareHarnessSandbox(input) {
       "export NO_PROXY= no_proxy=; " + gitCredentialExports(input.credentials) + 'eval "exec $CABANE_SANDBOXED_ARGV"'
     );
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    const message2 = err instanceof Error ? err.message : String(err);
     await SandboxManager.reset().catch(() => {
     });
     if (held.length || Object.keys(input.policy).length) {
       input.log.warn(
-        { err: message, masked: held },
+        { err: message2, masked: held },
         "runners: the OS sandbox could not start under this device's runners.policy; refusing the turn rather than running it unsandboxed"
       );
-      throw new HarnessSandboxRefused(`the OS sandbox could not start: ${message}`);
+      throw new HarnessSandboxRefused(`the OS sandbox could not start: ${message2}`);
     }
     input.log.warn(
-      { err: message },
+      { err: message2 },
       "runners: the OS sandbox could not start; running the turn unsandboxed"
     );
     return null;
   } finally {
     for (const name of held) delete process.env[name];
   }
-  mkdirSync11(join18(cabaneDir(), "sandbox"), { recursive: true });
-  const dir2 = mkdtempSync(join18(cabaneDir(), "sandbox", "turn-"));
-  const script = join18(dir2, "exec-sandboxed");
+  mkdirSync11(join19(cabaneDir(), "sandbox"), { recursive: true });
+  const dir2 = mkdtempSync(join19(cabaneDir(), "sandbox", "turn-"));
+  const script = join19(dir2, "exec-sandboxed");
   writeFileSync7(
     script,
     [
@@ -10903,7 +11014,7 @@ async function prepareHarnessSandbox(input) {
   return {
     wrap: (command, args) => ({ command: script, args: [command, ...args] }),
     executableFor: (real) => {
-      const shim = join18(dir2, `exec-${++shims}`);
+      const shim = join19(dir2, `exec-${++shims}`);
       writeFileSync7(shim, `#!/bin/bash
 exec ${shellQuote(script)} ${shellQuote(real)} "$@"
 `);
@@ -10996,7 +11107,7 @@ import {
   rmSync as rmSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var MAX_ENTRIES, MAX_AGE_MS, Outbox;
 var init_outbox = __esm({
   "src/outbox.ts"() {
@@ -11014,10 +11125,10 @@ var init_outbox = __esm({
       // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
       // cases route writes at the right tmpdir.
       dir() {
-        return join19(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
+        return join20(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
       }
       fileFor(turnId, seq) {
-        return join19(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+        return join20(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
       }
       // Persist a commit for later draining. Atomic (temp file + rename) so a
       // concurrent `list()` never reads a half-written entry, then enforces the
@@ -11059,7 +11170,7 @@ var init_outbox = __esm({
         const entries = [];
         for (const name of names) {
           if (!name.endsWith(".json")) continue;
-          const full = join19(dir2, name);
+          const full = join20(dir2, name);
           try {
             const parsed = JSON.parse(readFileSync11(full, "utf8"));
             if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -11199,7 +11310,7 @@ var init_image_manifest = __esm({
 
 // src/runner/exec-shim.ts
 import { chmodSync as chmodSync7, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync2, rmSync as rmSync13, writeFileSync as writeFileSync10 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -11209,10 +11320,10 @@ function createShimDir() {
   return {
     write(argv) {
       if (!dir2) {
-        mkdirSync15(join22(cabaneDir(), "runner"), { recursive: true });
-        dir2 = mkdtempSync2(join22(cabaneDir(), "runner", "turn-"));
+        mkdirSync15(join23(cabaneDir(), "runner"), { recursive: true });
+        dir2 = mkdtempSync2(join23(cabaneDir(), "runner", "turn-"));
       }
-      const path = join22(dir2, `exec-${++count}`);
+      const path = join23(dir2, `exec-${++count}`);
       writeFileSync10(path, `#!/bin/sh
 exec ${argv.map(shellQuote2).join(" ")} "$@"
 `);
@@ -11248,9 +11359,9 @@ function openLauncherChannel(stdin, emit, onLauncherGone) {
       resolveFirst(line);
       return;
     }
-    const message = decodeLauncherMessage(line);
-    if (message?.cabaneLauncher === "granted") waiting.get(message.id)?.();
-    else if (message) replies.get(message.id)?.(message);
+    const message2 = decodeLauncherMessage(line);
+    if (message2?.cabaneLauncher === "granted") waiting.get(message2.id)?.();
+    else if (message2) replies.get(message2.id)?.(message2);
   });
   let gone = false;
   lines2.once("close", () => {
@@ -11263,9 +11374,9 @@ function openLauncherChannel(stdin, emit, onLauncherGone) {
     if (gone) return Promise.resolve(null);
     const id = String(++next);
     return new Promise((resolve2) => {
-      replies.set(id, (message) => {
+      replies.set(id, (message2) => {
         replies.delete(id);
-        resolve2(message);
+        resolve2(message2);
       });
       emit(event(id));
     });
@@ -12475,8 +12586,8 @@ async function logout(opts = {}) {
     return;
   }
   if (!opts.yes) {
-    const message = opts.purge ? "Purge the entire local companion config (device + agent overrides + settings)?" : "Log out this device (removes the device token + cached agent credentials; keeps your config)?";
-    const ok = await confirm2({ message, default: false });
+    const message2 = opts.purge ? "Purge the entire local companion config (device + agent overrides + settings)?" : "Log out this device (removes the device token + cached agent credentials; keeps your config)?";
+    const ok = await confirm2({ message: message2, default: false });
     if (!ok) {
       process.stdout.write("cancelled\n");
       return;
@@ -12732,8 +12843,8 @@ function formatHumanLine(record) {
   let line = `${time}  ${word ? `${word}  ` : ""}${context ? `${context}  ` : ""}${humanText(record.msg)}`;
   const err = record.err;
   const errorRecord = err !== null && typeof err === "object" ? err : null;
-  const message = humanText(errorRecord && "message" in errorRecord ? errorRecord.message : err);
-  const detail = typeof record.status === "number" ? `HTTP ${record.status}: ${humanText(record.responseBody) || message}` : message;
+  const message2 = humanText(errorRecord && "message" in errorRecord ? errorRecord.message : err);
+  const detail = typeof record.status === "number" ? `HTTP ${record.status}: ${humanText(record.responseBody) || message2}` : message2;
   if (detail && !line.includes(detail)) line += ` (${detail})`;
   if (level < 30) {
     const hidden = /* @__PURE__ */ new Set([
@@ -12967,9 +13078,9 @@ var CompanionStateHub = class {
     if (info.deviceLabel !== void 0) this.deviceLabel = info.deviceLabel;
     this.emitStatus();
   }
-  setDeviceError(message) {
-    if (this.deviceError === message) return;
-    this.deviceError = message;
+  setDeviceError(message2) {
+    if (this.deviceError === message2) return;
+    this.deviceError = message2;
     this.emitStatus();
   }
   clearDeviceError() {
@@ -13421,7 +13532,7 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
   const probeClaude = deps.probeClaude ?? claudeOnPath;
   const probeCodex = deps.probeCodex ?? codexOnPath;
   const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
-  const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
+  const warn = deps.warn ?? ((message2) => process.stderr.write(`${message2}
 `));
   const connected = [
     ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
@@ -13913,7 +14024,7 @@ function createLocalProcessProvider(opts = {}) {
 
 // src/providers/docker.ts
 import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
-import { constants as constants2, tmpdir as tmpdir2 } from "os";
+import { constants as constants2, tmpdir as tmpdir3 } from "os";
 import {
   createReadStream,
   createWriteStream as createWriteStream2,
@@ -13926,7 +14037,7 @@ import {
   statSync as statSync3,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { Writable } from "stream";
 
 // src/providers/docker-cli.ts
@@ -13999,7 +14110,7 @@ import {
   renameSync as renameSync4,
   rmSync as rmSync8
 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function routes(t) {
   const conv = `/api/workspaces/${t.workspaceId}/conversations/${t.conversationId}`;
   const agent = `${conv}/participants/agents/${t.agentId}`;
@@ -14045,7 +14156,7 @@ function publishStaged(from, to, move = atomicMove) {
   const staged = readdirSync3(from).filter((n) => n.endsWith(".json")).map((name) => {
     let entry = {};
     try {
-      entry = JSON.parse(readFileSync8(join15(from, name), "utf8"));
+      entry = JSON.parse(readFileSync8(join16(from, name), "utf8"));
     } catch {
     }
     return { name, entry };
@@ -14058,7 +14169,7 @@ function publishStaged(from, to, move = atomicMove) {
   let published = 0;
   for (const { name } of staged) {
     try {
-      move(join15(from, name), join15(to, name));
+      move(join16(from, name), join16(to, name));
     } catch {
       return { published, complete: false };
     }
@@ -14071,7 +14182,7 @@ function publishStaged(from, to, move = atomicMove) {
 // src/providers/runner-base.ts
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync12, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname7, join as join16, sep } from "path";
+import { dirname as dirname7, join as join17, sep } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var COMPANION_MOUNT = "/opt/cabane/companion";
 var BASE_DOCKERFILE = `FROM node:22-slim
@@ -14119,11 +14230,11 @@ async function ensureBaseImage(docker, image, log) {
 function ownInstall(moduleFile = fileURLToPath3(import.meta.url)) {
   let dir2 = dirname7(moduleFile);
   for (let i = 0; i < 4; i++) {
-    if (existsSync12(join16(dir2, "dist", "cli.js")) && existsSync12(join16(dir2, "package.json"))) break;
+    if (existsSync12(join17(dir2, "dist", "cli.js")) && existsSync12(join17(dir2, "package.json"))) break;
     dir2 = dirname7(dir2);
   }
-  if (!existsSync12(join16(dir2, "dist", "cli.js"))) return null;
-  const sdk = join16(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
+  if (!existsSync12(join17(dir2, "dist", "cli.js"))) return null;
+  const sdk = join17(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
   if (!existsSync12(sdk)) return null;
   const root = realpathSync2(dir2);
   return realpathSync2(sdk).startsWith(root + sep) ? root : null;
@@ -14262,21 +14373,21 @@ function networkCreateError(stderr) {
 }
 function sessionArchivePath(deviceDir, attemptId) {
   if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
-  return join17(deviceDir, "attempts", attemptId, "session.tar");
+  return join18(deviceDir, "attempts", attemptId, "session.tar");
 }
 function pruneOtherAttempts(deviceDir, pair2, keep) {
-  const root = join17(deviceDir, "attempts");
+  const root = join18(deviceDir, "attempts");
   if (!existsSync13(root)) return;
   for (const id of readdirSync4(root)) {
     if (id === keep || !UUID_RE.test(id)) continue;
     let pairOf = "";
     try {
-      pairOf = readFileSync9(join17(root, id, "pair"), "utf8");
+      pairOf = readFileSync9(join18(root, id, "pair"), "utf8");
     } catch {
       continue;
     }
     if (pairOf === `${pair2.conversationId}/${pair2.agentId}`) {
-      rmSync9(join17(root, id), { recursive: true, force: true });
+      rmSync9(join18(root, id), { recursive: true, force: true });
     }
   }
 }
@@ -14476,11 +14587,11 @@ function createDockerProvider(opts) {
       await must(["network", "disconnect", "-f", other, name], "moving the container");
     if (others.includes(sharedNetwork)) await retireSharedNetwork();
   };
-  const socketRoot = opts.socketRoot ?? join17(
-    process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir2(),
+  const socketRoot = opts.socketRoot ?? join18(
+    process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir3(),
     `cabane-runners-${opts.deviceKey}`
   );
-  const socketDir = (name) => join17(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
+  const socketDir = (name) => join18(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
   const create = async (name, attempt) => {
     mkdirSync10(socketRoot, { recursive: true, mode: 448 });
     mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
@@ -14622,7 +14733,7 @@ function createDockerProvider(opts) {
     }
   };
   const removeIn = (name, from, names) => names.length ? execIn(name, ["sh", "-c", 'cd "$1" && shift && rm -f -- "$@"', "sh", from, ...names]) : Promise.resolve(null);
-  const pendingPath = (name) => join17(opts.deviceDir, "runners-pending", `${name}.json`);
+  const pendingPath = (name) => join18(opts.deviceDir, "runners-pending", `${name}.json`);
   const readPending = (name) => {
     try {
       const ids = JSON.parse(readFileSync9(pendingPath(name), "utf8"));
@@ -14636,12 +14747,12 @@ function createDockerProvider(opts) {
       rmSync9(pendingPath(name), { force: true });
       return;
     }
-    mkdirSync10(join17(opts.deviceDir, "runners-pending"), { recursive: true });
+    mkdirSync10(join18(opts.deviceDir, "runners-pending"), { recursive: true });
     writeFileSync6(pendingPath(name), JSON.stringify([...new Set(ids)]));
   };
   const keepSession = async (name, attempt, attemptId) => {
     const archive = sessionArchivePath(opts.deviceDir, attemptId);
-    mkdirSync10(join17(archive, ".."), { recursive: true });
+    mkdirSync10(join18(archive, ".."), { recursive: true });
     const partial = `${archive}.${process.pid}.partial`;
     const file = new CappedFile(partial, sessionCap);
     const r = await execIn(
@@ -14658,7 +14769,7 @@ function createDockerProvider(opts) {
     );
     if (r.code === 0 && !file.over) {
       renameSync5(partial, archive);
-      writeFileSync6(join17(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
+      writeFileSync6(join18(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
       pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
       await writeMarker(name, attemptId);
       log.debug({ container: name, attemptId, bytes: file.bytes }, "runners: session files kept");
@@ -14672,7 +14783,7 @@ function createDockerProvider(opts) {
       file.over ? "runners: the session files are over the size cap and weren't kept; the next new container starts the session over" : "runners: couldn't keep the session files; the next new container starts the session over"
     );
   };
-  const stagingDir = (name) => join17(opts.deviceDir, "runners-pending", `${name}.outbox`);
+  const stagingDir = (name) => join18(opts.deviceDir, "runners-pending", `${name}.outbox`);
   const ensureRunning = async (name) => {
     const seen = await docker.run(["inspect", "-f", "{{.State.Running}}", name]);
     if (seen.code !== 0) return false;
@@ -14680,7 +14791,7 @@ function createDockerProvider(opts) {
     return (await docker.run(["start", name])).code === 0;
   };
   const dropArchive = (attemptId) => {
-    rmSync9(join17(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
+    rmSync9(join18(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
       recursive: true,
       force: true
     });
@@ -14749,7 +14860,7 @@ function createDockerProvider(opts) {
         if (seen.stdout.trim().split(" ")[0] !== "true")
           await must(["start", name], "starting the container");
         const git = await serveGitCredentials({
-          socketPath: join17(socketDir(name), "git.sock"),
+          socketPath: join18(socketDir(name), "git.sock"),
           hosts: opts.gitHosts,
           fill: opts.gitFill,
           log
@@ -14898,15 +15009,15 @@ function createDockerProvider(opts) {
       const transcripts = await readDir(name, `${CONTAINER_STATE}/transcripts`);
       if (transcripts) {
         const kept = transcripts.files.filter((f) => SAFE_NAME_RE.test(f.name));
-        if (kept.length) mkdirSync10(join17(opts.hostStateDir, "transcripts"), { recursive: true });
-        for (const f of kept) writeFileSync6(join17(opts.hostStateDir, "transcripts", f.name), f.data);
+        if (kept.length) mkdirSync10(join18(opts.hostStateDir, "transcripts"), { recursive: true });
+        for (const f of kept) writeFileSync6(join18(opts.hostStateDir, "transcripts", f.name), f.data);
         await removeIn(
           name,
           `${CONTAINER_STATE}/transcripts`,
           kept.map((f) => f.name)
         );
       }
-      const outboxRel = join17("outbox", encodeURIComponent(attempt.agentId));
+      const outboxRel = join18("outbox", encodeURIComponent(attempt.agentId));
       const outbox = await readDir(name, `${CONTAINER_STATE}/${outboxRel}`);
       let unpublished = false;
       if (outbox) {
@@ -14932,7 +15043,7 @@ function createDockerProvider(opts) {
           const staged = stagingDir(name);
           mkdirSync10(staged, { recursive: true });
           writeFileSync6(
-            join17(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
+            join18(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
             `${JSON.stringify(entry)}
 `
           );
@@ -14945,7 +15056,7 @@ function createDockerProvider(opts) {
         if (outbox.complete) {
           const published = publishStaged(
             stagingDir(name),
-            join17(opts.hostStateDir, outboxRel),
+            join18(opts.hostStateDir, outboxRel),
             opts.moveFile
           );
           queued = published.published;
@@ -16775,8 +16886,8 @@ function errorCode(err) {
 function isRecoverableSocketError(err) {
   const code = errorCode(err);
   if (code && RECOVERABLE_CODES.has(code)) return true;
-  const message = err instanceof Error ? err.message : String(err);
-  return /\bEPIPE\b|\bECONNRESET\b/.test(message);
+  const message2 = err instanceof Error ? err.message : String(err);
+  return /\bEPIPE\b|\bECONNRESET\b/.test(message2);
 }
 function installProcessSafetyNet(log, opts = {}) {
   const proc = opts.proc ?? process;
@@ -16791,17 +16902,17 @@ function installProcessSafetyNet(log, opts = {}) {
   );
 }
 function handleUncaught(log, err, origin) {
-  const message = err instanceof Error ? err.message : String(err);
+  const message2 = err instanceof Error ? err.message : String(err);
   const code = errorCode(err);
   if (isRecoverableSocketError(err)) {
     log.debug(
-      { origin, code, err: message },
+      { origin, code, err: message2 },
       "companion: recovered from a socket error (kept running \u2014 a broken pipe never kills the companion)"
     );
     return;
   }
   log.error(
-    { origin, code, err: message, stack: err instanceof Error ? err.stack : void 0 },
+    { origin, code, err: message2, stack: err instanceof Error ? err.stack : void 0 },
     "An unexpected error occurred; the companion is still running."
   );
 }
@@ -16809,9 +16920,9 @@ function handleUncaught(log, err, origin) {
 // src/crash-marker.ts
 init_config();
 import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function crashMarkerPath() {
-  return join20(cabaneDir(), "last-error.json");
+  return join21(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
@@ -17162,7 +17273,7 @@ async function startScript(opts, interactive) {
   const result = await createCompanionRuntime({
     // The script says what's connectable in its own words below; a stderr warning
     // in the middle of it would be the same news, worse.
-    onReadinessWarning: (message) => log.warn(message)
+    onReadinessWarning: (message2) => log.warn(message2)
   });
   if (!result.ok) {
     reportAlreadyRunning(result.existing?.pid);
@@ -17567,7 +17678,7 @@ init_errors();
 init_src();
 init_transcript_writer();
 import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync7 } from "fs";
-import { isAbsolute, join as join21 } from "path";
+import { isAbsolute, join as join22 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -17584,7 +17695,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join21(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join22(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -17667,7 +17778,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync13(join21(dir2, f), "utf8"),
+    read: (f) => readFileSync13(join22(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -17707,7 +17818,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join21(dir2, f));
+    const { meta, outcome } = peek(join22(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -17744,10 +17855,10 @@ function resolveTarget(dir2, target) {
     if (existsSync17(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join21(dir2, target);
+  const exact = join22(dir2, target);
   if (existsSync17(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join21(dir2, matches[0]);
+  if (matches.length === 1) return join22(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`cabane-companion transcript\` to list them.`