@cabane/companion 0.6.154 → 0.6.156

package/dist/runtime.js

@@ -1,6 +1,294 @@
 // src/runtime.ts
 import { randomUUID as randomUUID7 } from "crypto";
 
+// src/cabane-command.ts
+import { accessSync, constants, realpathSync as realpathSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { delimiter, join as join2, sep as sep2 } from "path";
+
+// src/bundled-binaries.ts
+import { realpathSync, statSync } from "fs";
+import { createRequire } from "module";
+import { homedir } from "os";
+import { dirname, join, sep } from "path";
+import { fileURLToPath } from "url";
+function nodeResolveSelf(specifier) {
+  const here = fileURLToPath(import.meta.url);
+  if (typeof import.meta.resolve === "function") {
+    try {
+      return fileURLToPath(import.meta.resolve(specifier));
+    } catch {
+    }
+  }
+  try {
+    return createRequire(here).resolve(specifier);
+  } catch {
+  }
+  return walkNodeModules(specifier, here);
+}
+function walkNodeModules(pkg2, fromPath) {
+  let dir2 = dirname(fromPath);
+  for (; ; ) {
+    const manifest = join(dir2, "node_modules", pkg2, "package.json");
+    if (nodeIsFile(manifest)) {
+      try {
+        return realpathSync(manifest);
+      } catch {
+        return manifest;
+      }
+    }
+    const parent = dirname(dir2);
+    if (parent === dir2) return null;
+    dir2 = parent;
+  }
+}
+function nodeResolve(specifier, fromPath) {
+  try {
+    return createRequire(fromPath).resolve(specifier);
+  } catch {
+    return null;
+  }
+}
+function nodeIsFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function detectPreferMusl(platform = process.platform) {
+  if (platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  const header = report?.header;
+  return report != null && header?.glibcVersionRuntime === void 0;
+}
+function defaultResolveEnv() {
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    preferMusl: detectPreferMusl(),
+    // Both resolutions start from this module, which tsup bundles into
+    // `dist/cli.js` and `dist/postinstall.js` — both at the package's `dist/`
+    // root — so one environment serves the runtime checks and the install
+    // verifier alike.
+    resolveSelf: nodeResolveSelf,
+    resolve: nodeResolve,
+    isFile: nodeIsFile
+  };
+}
+var CLAUDE_SDK = "@anthropic-ai/claude-agent-sdk";
+function claudePlatformPackages(platform, arch, preferMusl) {
+  if (platform === "android") return [`${CLAUDE_SDK}-linux-${arch}-android`];
+  if (platform === "linux") {
+    return preferMusl ? [`${CLAUDE_SDK}-linux-${arch}-musl`, `${CLAUDE_SDK}-linux-${arch}`] : [`${CLAUDE_SDK}-linux-${arch}`, `${CLAUDE_SDK}-linux-${arch}-musl`];
+  }
+  return [`${CLAUDE_SDK}-${platform}-${arch}`];
+}
+function resolveClaude(env) {
+  const candidates = claudePlatformPackages(env.platform, env.arch, env.preferMusl);
+  const base = {
+    runtime: "claude-code",
+    packageName: candidates[0] ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  const sdkEntry = env.resolveSelf(CLAUDE_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  let sawPackage = null;
+  for (const pkg2 of candidates) {
+    const manifest = env.resolve(`${pkg2}/package.json`, sdkEntry);
+    if (!manifest) continue;
+    sawPackage ??= pkg2;
+    const exe = join(dirname(manifest), env.platform === "win32" ? "claude.exe" : "claude");
+    if (env.isFile(exe)) {
+      return { ...base, packageName: pkg2, status: "present", path: exe };
+    }
+  }
+  return sawPackage ? { ...base, packageName: sawPackage, status: "executable_missing", path: null } : { ...base, status: "platform_package_missing", path: null };
+}
+var CODEX_SDK = "@openai/codex-sdk";
+var CODEX_CLI = "@openai/codex";
+function codexTargetTriple(platform, arch) {
+  if (platform === "linux" || platform === "android") {
+    if (arch === "x64") return "x86_64-unknown-linux-musl";
+    if (arch === "arm64") return "aarch64-unknown-linux-musl";
+    return null;
+  }
+  if (platform === "darwin") {
+    if (arch === "x64") return "x86_64-apple-darwin";
+    if (arch === "arm64") return "aarch64-apple-darwin";
+    return null;
+  }
+  if (platform === "win32") {
+    if (arch === "x64") return "x86_64-pc-windows-msvc";
+    if (arch === "arm64") return "aarch64-pc-windows-msvc";
+    return null;
+  }
+  return null;
+}
+var CODEX_PACKAGE_BY_TRIPLE = {
+  "x86_64-unknown-linux-musl": `${CODEX_CLI}-linux-x64`,
+  "aarch64-unknown-linux-musl": `${CODEX_CLI}-linux-arm64`,
+  "x86_64-apple-darwin": `${CODEX_CLI}-darwin-x64`,
+  "aarch64-apple-darwin": `${CODEX_CLI}-darwin-arm64`,
+  "x86_64-pc-windows-msvc": `${CODEX_CLI}-win32-x64`,
+  "aarch64-pc-windows-msvc": `${CODEX_CLI}-win32-arm64`
+};
+function resolveCodex(env) {
+  const triple = codexTargetTriple(env.platform, env.arch);
+  const pkg2 = triple ? CODEX_PACKAGE_BY_TRIPLE[triple] : void 0;
+  const base = {
+    runtime: "codex",
+    packageName: pkg2 ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  if (!triple || !pkg2) return { ...base, status: "platform_package_missing", path: null };
+  const sdkEntry = env.resolveSelf(CODEX_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  const cliManifest = env.resolve(`${CODEX_CLI}/package.json`, sdkEntry);
+  if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
+  const platformManifest = env.resolve(`${pkg2}/package.json`, cliManifest);
+  if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
+  const packageRoot = join(dirname(platformManifest), "vendor", triple);
+  const exeName = env.platform === "win32" ? "codex.exe" : "codex";
+  const current = join(packageRoot, "bin", exeName);
+  if (env.isFile(current) && env.isFile(join(packageRoot, "codex-package.json"))) {
+    return { ...base, status: "present", path: current };
+  }
+  const legacy = join(packageRoot, "codex", exeName);
+  if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
+  return { ...base, status: "executable_missing", path: null };
+}
+function resolveBundledBinary(runtime, env = defaultResolveEnv()) {
+  try {
+    return runtime === "codex" ? resolveCodex(env) : resolveClaude(env);
+  } catch {
+    return {
+      runtime,
+      status: "platform_package_missing",
+      path: null,
+      packageName: null,
+      platform: env.platform,
+      arch: env.arch
+    };
+  }
+}
+var HARNESS_LABEL = {
+  "claude-code": "Claude Code",
+  codex: "Codex"
+};
+var HARNESS_INTENT_WORD = {
+  "claude-code": "connected",
+  codex: "enabled"
+};
+function missingNoun(status) {
+  return status === "executable_missing" ? "executable" : "platform package";
+}
+var INSTALL_SCRIPT_COMMAND = "curl -fsSL https://cabane.ai/install.sh | bash";
+function companionInstall(execPath = process.execPath, home = homedir()) {
+  const real = (path) => {
+    try {
+      return realpathSync(path);
+    } catch {
+      return path;
+    }
+  };
+  const scriptNode = join(real(home), ".cabane", "node") + sep;
+  return real(execPath).startsWith(scriptNode) ? "script" : "npm";
+}
+function repairCommands(install = companionInstall()) {
+  return install === "script" ? [INSTALL_SCRIPT_COMMAND] : ["npm i -g @cabane/companion --include=optional"];
+}
+function repairAction(install = companionInstall()) {
+  return `Reinstall with \`${repairCommands(install)[0]}\`.`;
+}
+function startupWarning(r) {
+  const label = HARNESS_LABEL[r.runtime];
+  return `${label} is ${HARNESS_INTENT_WORD[r.runtime]}, but its installation is incomplete (${missingNoun(r.status)} is missing). It cannot run turns until repaired. ${repairAction()} Then restart the companion.`;
+}
+function harnessIssueNote(runtime, status, install = companionInstall()) {
+  const intent = HARNESS_INTENT_WORD[runtime];
+  const capitalized = `${intent[0].toUpperCase()}${intent.slice(1)}`;
+  return `${capitalized}, but @cabane/companion's bundled ${HARNESS_LABEL[runtime]} ${missingNoun(status)} is missing. ${repairAction(install)} Then restart the companion.`;
+}
+function turnIncompleteCopy(runtime) {
+  return `**This device's ${HARNESS_LABEL[runtime]} runtime is incomplete.** ${repairAction()} Restart it, then try again.`;
+}
+
+// src/cli-entry.ts
+import { existsSync } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var RELATIVE_CANDIDATES = ["./cli.js", "../dist/cli.js", "../cli.js"];
+function companionCliEntry(deps = {}) {
+  const exists = deps.exists ?? existsSync;
+  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath2(new URL(rel, import.meta.url)));
+  for (const candidate of candidates) {
+    if (exists(candidate)) return candidate;
+  }
+  const argv1 = "argv1" in deps ? deps.argv1 : process.argv[1];
+  if (argv1 && exists(argv1)) return argv1;
+  return candidates[0] ?? "";
+}
+
+// src/term.ts
+import { createInterface } from "readline";
+import { homedir as homedir2 } from "os";
+import pc from "picocolors";
+function tildePath(path, home = homedir2()) {
+  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
+  return path;
+}
+
+// src/cabane-command.ts
+function installedCommandPath(deps = {}) {
+  const install = deps.install ?? companionInstall();
+  const home = deps.home ?? homedir3();
+  if (install === "script") return join2(home, ".cabane", "bin", "cabane");
+  const entry = deps.cliEntry ?? companionCliEntry();
+  const marker = `${sep2}lib${sep2}node_modules${sep2}@cabane${sep2}companion${sep2}`;
+  const at = entry.indexOf(marker);
+  if (at < 0) return null;
+  return join2(entry.slice(0, at), "bin", "cabane");
+}
+function cabaneCommand(deps = {}) {
+  const own = installedCommandPath(deps);
+  if (!own) return "cabane";
+  const realpath = deps.realpath ?? safeRealpath;
+  const isExecutable = deps.isExecutable ?? executable;
+  const ownReal = realpath(own);
+  if (!ownReal) return "cabane";
+  const onPath = firstOnPath("cabane", "path" in deps ? deps.path : process.env.PATH, isExecutable);
+  if (onPath && realpath(onPath) === ownReal) return "cabane";
+  return tildePath(own, deps.home);
+}
+function cabane(rest, deps) {
+  return `${cabaneCommand(deps)} ${rest}`;
+}
+function firstOnPath(name, path, isExecutable = executable) {
+  for (const dir2 of (path ?? "").split(delimiter)) {
+    if (!dir2) continue;
+    const candidate = join2(dir2, name);
+    if (isExecutable(candidate)) return candidate;
+  }
+  return null;
+}
+function executable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function safeRealpath(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return null;
+  }
+}
+
 // src/config.ts
 import {
   chmodSync,
@@ -9,10 +297,10 @@ import {
   renameSync,
   rmSync,
   writeFileSync,
-  existsSync
+  existsSync as existsSync2
 } from "fs";
-import { homedir, userInfo } from "os";
-import { dirname, join } from "path";
+import { homedir as homedir4, userInfo } from "os";
+import { dirname as dirname2, join as join3 } from "path";
 import { z as z2 } from "zod";
 
 // src/errors.ts
@@ -225,13 +513,13 @@ function realAccountHome() {
   return realHomeCache;
 }
 function agentCompanionHome() {
-  return join(cabaneDir(), "agent-home");
+  return join3(cabaneDir(), "agent-home");
 }
 function cabaneDir() {
-  const dir2 = join(process.env.CABANE_COMPANION_HOME || homedir(), ".cabane");
+  const dir2 = join3(process.env.CABANE_COMPANION_HOME || homedir4(), ".cabane");
   if (process.env.VITEST) {
     const real = realAccountHome();
-    if (real && dir2 === join(real, ".cabane")) {
+    if (real && dir2 === join3(real, ".cabane")) {
       throw new Error(
         `cabaneDir() resolved to the real ${dir2} during a test run. Companion tests must swap process.env.HOME to a tmp dir before touching the config dir; this guard prevents wiping the operator's real companion config (see apps/companion/test/setup-home.ts).`
       );
@@ -240,7 +528,7 @@ function cabaneDir() {
   return dir2;
 }
 function configPath() {
-  return join(cabaneDir(), "config.json");
+  return join3(cabaneDir(), "config.json");
 }
 var localAgentConfigSchema = z2.object({
   cwd: z2.string().optional(),
@@ -259,11 +547,11 @@ var localAgentConfigSchema = z2.object({
   sandbox: z2.enum(["os", "none"]).optional()
 }).strict();
 var AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx) => {
+var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx2) => {
   for (const [key, row] of Object.entries(agents)) {
     if (row.sandbox === void 0) continue;
     if (AGENT_ID_KEY.test(key)) continue;
-    ctx.addIssue({
+    ctx2.addIssue({
       code: z2.ZodIssueCode.custom,
       path: [key, "sandbox"],
       message: "a sandbox exception must name one agent \u2014 key the row by the agent's id (shown in Cabane), not a username or workspace-slug/username"
@@ -314,15 +602,24 @@ var companionConfigSchema = z2.object({
   // the Agent SDK's bundled executable resolves (not `claude` on PATH, which the
   // SDK never runs).
   //
-  // The block's PRESENCE is also the migration marker
-  // (`migrateConnectedHarnesses`): absent means a config whose user was never
-  // asked. So every config written carries it, a fresh pair at `enabled: false`.
+  // Absent means one of two things, told apart by `harnessesChosen`: a legacy
+  // config whose user was never asked (`migrateConnectedHarnesses`), or a
+  // device that has never been offered Claude Code. `enabled: false` is a
+  // decline, and `start` doesn't offer it again.
   //
   // Not the per-agent `agents.<key>.claudeCode.autoMemory`, one agent's memory
   // switch.
   claudeCode: z2.object({
     enabled: z2.boolean().optional()
   }).strict().optional(),
+  // Written by every pairing that asks which agents to connect. With it, an
+  // absent `claudeCode` block means "never offered"; without it, the block's
+  // absence marks a config from before connectors were chosen.
+  harnessesChosen: z2.boolean().optional(),
+  // OpenCode's decline. Its block is an address, so a decline can't live there
+  // the way `claudeCode`/`codex` `enabled: false` does; without it a declined
+  // serve would be offered again on every `start`.
+  opencodeDeclined: z2.boolean().optional(),
   // Codex is a local CLI the SDK spawns per turn, so this is an opt-in flag, not
   // an address. The operator logs in (`codex login` or `CODEX_API_KEY`; Cabane
   // never sees the key). The block's presence enables it; `enabled: false` turns
@@ -377,6 +674,9 @@ var companionConfigSchema = z2.object({
 function runnersEnabled(cfg) {
   return cfg.runners?.enabled === true;
 }
+function dockerRunnersConfigured(cfg) {
+  return runnersEnabled(cfg) && cfg.runners?.provider === "docker";
+}
 function runnerStateDir() {
   return process.env.CABANE_RUNNER_STATE_DIR || cabaneDir();
 }
@@ -386,9 +686,9 @@ function isCodexEnabled(cfg) {
 function isClaudeCodeConnected(cfg) {
   return !!cfg.claudeCode && cfg.claudeCode.enabled !== false;
 }
-function migrateConnectedHarnesses(cfg, claudeOnPath2) {
-  if (cfg.claudeCode !== void 0) return null;
-  return { ...cfg, claudeCode: { enabled: claudeOnPath2 } };
+function migrateConnectedHarnesses(cfg) {
+  if (cfg.claudeCode !== void 0 || cfg.harnessesChosen) return null;
+  return { ...cfg, claudeCode: { enabled: true } };
 }
 function localAgentConfig(cfg, agent) {
   const map = cfg.agents ?? {};
@@ -420,7 +720,7 @@ function agentSandboxRows(cfg) {
 }
 function loadConfig() {
   const path = configPath();
-  if (!existsSync(path)) return null;
+  if (!existsSync2(path)) return null;
   let raw;
   try {
     raw = readFileSync(path, "utf8");
@@ -447,14 +747,14 @@ function loadConfig() {
       );
     }
     throw new ConfigError(
-      `${path} is from an incompatible or older version of the companion, or was hand-edited. Run \`cabane-companion pair\` to re-pair, or \`cabane-companion logout --purge\` to reset.`
+      `${path} is from an incompatible or older version of the companion, or was hand-edited. Run \`${cabane("pair")}\` to re-pair, or \`${cabane("logout --purge")}\` to reset.`
     );
   }
   return result.data;
 }
 function saveConfig(cfg) {
   const path = configPath();
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   try {
     chmodSync(cabaneDir(), 448);
   } catch {
@@ -479,321 +779,157 @@ function requireConfig() {
   const cfg = loadConfig();
   if (!cfg) {
     throw new ConfigError(
-      "this companion is not paired. Run `cabane-companion pair` \u2014 it shows a short code \u2014 then enter that code in the cabane app (Settings \u2192 Companions) to connect this machine."
+      `this companion is not paired. Run \`${cabane("start")}\` \u2014 it shows a short code \u2014 then enter that code in the cabane app (Settings \u2192 Companions) to connect this machine.`
     );
   }
   return cfg;
 }
 
 // src/dashboard/server.ts
-import { dirname as dirname4, join as join5 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname4, join as join7 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 
 // src/dashboard/routes.ts
-import { openSync, readSync, closeSync, fstatSync, existsSync as existsSync2 } from "fs";
+import { openSync, readSync, closeSync, fstatSync, existsSync as existsSync3 } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join4, normalize } from "path";
+import { extname, join as join6, normalize } from "path";
 import { streamSSE } from "hono/streaming";
 
-// src/harness-check.ts
-import { spawn as spawn3 } from "child_process";
+// src/harness-copy.ts
+import { homedir as homedir5 } from "os";
+import { join as join4 } from "path";
 
-// src/harness-versions.ts
+// src/harness-usable.ts
 import { spawn as spawn2 } from "child_process";
+
+// src/harness-versions.ts
 var EMPTY = { claudeCode: null, opencode: null, codex: null };
-var CLI_PROBE_TIMEOUT_MS = 4e3;
 function parseVersionToken(raw) {
   if (!raw) return null;
   const m = raw.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
   return m ? m[0] : null;
 }
-function probeCliPresence(command, spawnImpl = spawn2) {
-  return new Promise((resolve2) => {
-    let settled = false;
-    let timer = null;
-    const done = (result) => {
-      if (!settled) {
-        settled = true;
-        if (timer) clearTimeout(timer);
-        resolve2(result);
-      }
-    };
-    let child;
-    try {
-      child = spawnImpl(command, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
-    } catch {
-      done({ status: "absent" });
-      return;
-    }
-    let out = "";
-    child.stdout?.on("data", (chunk) => {
-      if (out.length < 4096) out += chunk.toString();
-    });
-    timer = setTimeout(() => {
-      child.kill?.("SIGKILL");
-      done({ status: "unusable" });
-    }, CLI_PROBE_TIMEOUT_MS);
-    timer.unref?.();
-    child.once("error", () => done({ status: "absent" }));
-    child.once("exit", (code) => {
-      const version = code === 0 ? parseVersionToken(out) : null;
-      done(version ? { status: "present", version } : { status: "unusable" });
-    });
-  });
-}
-function probeHarnessPresence(runtime, spawnImpl = spawn2) {
-  return probeCliPresence(runtime === "codex" ? "codex" : "claude", spawnImpl);
-}
-async function probeCliVersion(command, spawnImpl = spawn2) {
-  const result = await probeCliPresence(command, spawnImpl);
-  return result.status === "present" ? result.version : null;
-}
-async function probeOpencodeVersion(serverUrl, fetchImpl = fetch) {
-  try {
-    const base = serverUrl.endsWith("/") ? serverUrl.slice(0, -1) : serverUrl;
-    const res = await fetchImpl(`${base}/global/health`, {
-      headers: { accept: "application/json" }
-    });
-    if (!res.ok) return null;
-    return extractOpencodeVersion(await res.json());
-  } catch {
-    return null;
-  }
-}
-function extractOpencodeVersion(json) {
-  if (!json || typeof json !== "object") return null;
-  const obj = json;
-  const candidates = [obj.version];
-  for (const v of Object.values(obj)) {
-    if (v && typeof v === "object") candidates.push(v.version);
-  }
-  for (const c of candidates) {
-    if (typeof c === "string") {
-      const parsed = parseVersionToken(c);
-      if (parsed) return parsed;
-    }
-  }
-  return null;
-}
-async function probeHarnessVersions(opts, deps = {}) {
-  const probeClaudeCode = deps.probeClaudeCode ?? (() => probeCliVersion("claude"));
-  const probeCodex = deps.probeCodex ?? (() => probeCliVersion("codex"));
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
-  const [claudeCode, codex, opencode] = await Promise.all([
-    opts.claudeCode ? safe(probeClaudeCode) : Promise.resolve(null),
-    opts.codex ? safe(probeCodex) : Promise.resolve(null),
-    opts.opencodeServerUrl ? safe(() => probeOpencode(opts.opencodeServerUrl)) : Promise.resolve(null)
-  ]);
-  return { claudeCode, opencode, codex };
-}
-function emptyHarnessVersions() {
-  return { ...EMPTY };
-}
-async function safe(fn) {
-  try {
-    return await fn();
-  } catch {
-    return null;
-  }
-}
-
-// src/bundled-binaries.ts
-import { realpathSync, statSync } from "fs";
-import { createRequire } from "module";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath } from "url";
-function nodeResolveSelf(specifier) {
-  const here = fileURLToPath(import.meta.url);
-  if (typeof import.meta.resolve === "function") {
-    try {
-      return fileURLToPath(import.meta.resolve(specifier));
-    } catch {
-    }
-  }
-  try {
-    return createRequire(here).resolve(specifier);
-  } catch {
-  }
-  return walkNodeModules(specifier, here);
-}
-function walkNodeModules(pkg2, fromPath) {
-  let dir2 = dirname2(fromPath);
-  for (; ; ) {
-    const manifest = join2(dir2, "node_modules", pkg2, "package.json");
-    if (nodeIsFile(manifest)) {
-      try {
-        return realpathSync(manifest);
-      } catch {
-        return manifest;
-      }
-    }
-    const parent = dirname2(dir2);
-    if (parent === dir2) return null;
-    dir2 = parent;
-  }
-}
-function nodeResolve(specifier, fromPath) {
-  try {
-    return createRequire(fromPath).resolve(specifier);
-  } catch {
-    return null;
-  }
-}
-function nodeIsFile(path) {
-  try {
-    return statSync(path).isFile();
-  } catch {
-    return false;
-  }
-}
-function detectPreferMusl(platform = process.platform) {
-  if (platform !== "linux") return false;
-  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
-  const header = report?.header;
-  return report != null && header?.glibcVersionRuntime === void 0;
-}
-function defaultResolveEnv() {
-  return {
-    platform: process.platform,
-    arch: process.arch,
-    preferMusl: detectPreferMusl(),
-    // Both resolutions start from this module, which tsup bundles into
-    // `dist/cli.js` and `dist/postinstall.js` — both at the package's `dist/`
-    // root — so one environment serves the runtime checks and the install
-    // verifier alike.
-    resolveSelf: nodeResolveSelf,
-    resolve: nodeResolve,
-    isFile: nodeIsFile
-  };
-}
-var CLAUDE_SDK = "@anthropic-ai/claude-agent-sdk";
-function claudePlatformPackages(platform, arch, preferMusl) {
-  if (platform === "android") return [`${CLAUDE_SDK}-linux-${arch}-android`];
-  if (platform === "linux") {
-    return preferMusl ? [`${CLAUDE_SDK}-linux-${arch}-musl`, `${CLAUDE_SDK}-linux-${arch}`] : [`${CLAUDE_SDK}-linux-${arch}`, `${CLAUDE_SDK}-linux-${arch}-musl`];
-  }
-  return [`${CLAUDE_SDK}-${platform}-${arch}`];
-}
-function resolveClaude(env) {
-  const candidates = claudePlatformPackages(env.platform, env.arch, env.preferMusl);
-  const base = {
-    runtime: "claude-code",
-    packageName: candidates[0] ?? null,
-    platform: env.platform,
-    arch: env.arch
-  };
-  const sdkEntry = env.resolveSelf(CLAUDE_SDK);
-  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
-  let sawPackage = null;
-  for (const pkg2 of candidates) {
-    const manifest = env.resolve(`${pkg2}/package.json`, sdkEntry);
-    if (!manifest) continue;
-    sawPackage ??= pkg2;
-    const exe = join2(dirname2(manifest), env.platform === "win32" ? "claude.exe" : "claude");
-    if (env.isFile(exe)) {
-      return { ...base, packageName: pkg2, status: "present", path: exe };
-    }
-  }
-  return sawPackage ? { ...base, packageName: sawPackage, status: "executable_missing", path: null } : { ...base, status: "platform_package_missing", path: null };
-}
-var CODEX_SDK = "@openai/codex-sdk";
-var CODEX_CLI = "@openai/codex";
-function codexTargetTriple(platform, arch) {
-  if (platform === "linux" || platform === "android") {
-    if (arch === "x64") return "x86_64-unknown-linux-musl";
-    if (arch === "arm64") return "aarch64-unknown-linux-musl";
+async function probeOpencodeVersion(serverUrl, fetchImpl = fetch) {
+  try {
+    const base = serverUrl.endsWith("/") ? serverUrl.slice(0, -1) : serverUrl;
+    const res = await fetchImpl(`${base}/global/health`, {
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    return extractOpencodeVersion(await res.json());
+  } catch {
     return null;
   }
-  if (platform === "darwin") {
-    if (arch === "x64") return "x86_64-apple-darwin";
-    if (arch === "arm64") return "aarch64-apple-darwin";
-    return null;
+}
+function extractOpencodeVersion(json) {
+  if (!json || typeof json !== "object") return null;
+  const obj = json;
+  const candidates = [obj.version];
+  for (const v of Object.values(obj)) {
+    if (v && typeof v === "object") candidates.push(v.version);
   }
-  if (platform === "win32") {
-    if (arch === "x64") return "x86_64-pc-windows-msvc";
-    if (arch === "arm64") return "aarch64-pc-windows-msvc";
-    return null;
+  for (const c of candidates) {
+    if (typeof c === "string") {
+      const parsed = parseVersionToken(c);
+      if (parsed) return parsed;
+    }
   }
   return null;
 }
-var CODEX_PACKAGE_BY_TRIPLE = {
-  "x86_64-unknown-linux-musl": `${CODEX_CLI}-linux-x64`,
-  "aarch64-unknown-linux-musl": `${CODEX_CLI}-linux-arm64`,
-  "x86_64-apple-darwin": `${CODEX_CLI}-darwin-x64`,
-  "aarch64-apple-darwin": `${CODEX_CLI}-darwin-arm64`,
-  "x86_64-pc-windows-msvc": `${CODEX_CLI}-win32-x64`,
-  "aarch64-pc-windows-msvc": `${CODEX_CLI}-win32-arm64`
+function emptyHarnessVersions() {
+  return { ...EMPTY };
+}
+
+// src/harness-usable.ts
+function isUsable(check) {
+  return check.status === "signed_in" || check.status === "api_key";
+}
+var API_KEY_VARIABLES = {
+  "claude-code": ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"],
+  codex: ["CODEX_API_KEY"]
 };
-function resolveCodex(env) {
-  const triple = codexTargetTriple(env.platform, env.arch);
-  const pkg2 = triple ? CODEX_PACKAGE_BY_TRIPLE[triple] : void 0;
-  const base = {
-    runtime: "codex",
-    packageName: pkg2 ?? null,
-    platform: env.platform,
-    arch: env.arch
-  };
-  if (!triple || !pkg2) return { ...base, status: "platform_package_missing", path: null };
-  const sdkEntry = env.resolveSelf(CODEX_SDK);
-  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
-  const cliManifest = env.resolve(`${CODEX_CLI}/package.json`, sdkEntry);
-  if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
-  const platformManifest = env.resolve(`${pkg2}/package.json`, cliManifest);
-  if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
-  const packageRoot = join2(dirname2(platformManifest), "vendor", triple);
-  const exeName = env.platform === "win32" ? "codex.exe" : "codex";
-  const current = join2(packageRoot, "bin", exeName);
-  if (env.isFile(current) && env.isFile(join2(packageRoot, "codex-package.json"))) {
-    return { ...base, status: "present", path: current };
-  }
-  const legacy = join2(packageRoot, "codex", exeName);
-  if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
-  return { ...base, status: "executable_missing", path: null };
+function apiKeyVariable(runtime, env = process.env) {
+  return API_KEY_VARIABLES[runtime].find((name) => !!env[name]?.trim()) ?? null;
 }
-function resolveBundledBinary(runtime, env = defaultResolveEnv()) {
-  try {
-    return runtime === "codex" ? resolveCodex(env) : resolveClaude(env);
-  } catch {
+var CHECK_TIMEOUT_MS = 5e3;
+async function checkHarnessUsable(runtime, deps = {}) {
+  const env = deps.env ?? process.env;
+  const resolveBundled = deps.resolveBundled ?? ((r) => resolveBundledBinary(r));
+  const run = deps.run ?? runBounded;
+  const resolution = resolveBundled(runtime);
+  if (resolution.status !== "present" || !resolution.path) {
     return {
-      runtime,
-      status: "platform_package_missing",
-      path: null,
-      packageName: null,
-      platform: env.platform,
-      arch: env.arch
+      status: "bundle_missing",
+      bundled: resolution.status === "present" ? "executable_missing" : resolution.status
     };
   }
+  const path = resolution.path;
+  const version = run(path, ["--version"], env).then(
+    (r) => r.code === 0 ? parseVersionToken(r.output) : null
+  );
+  const variable = apiKeyVariable(runtime, env);
+  if (variable) return { status: "api_key", variable, version: await version };
+  const statusArgs = runtime === "codex" ? ["login", "status"] : ["auth", "status", "--json"];
+  const [answer, v] = await Promise.all([run(path, statusArgs, env), version]);
+  if (answer.error) return { status: "check_failed", reason: answer.error };
+  const signedIn = runtime === "codex" ? readCodexStatus(answer) : readClaudeStatus(answer);
+  if (typeof signedIn === "string") return { status: "check_failed", reason: signedIn };
+  return signedIn ? { status: "signed_in", version: v } : { status: "signed_out", version: v };
+}
+function readClaudeStatus(answer) {
+  const start = answer.output.indexOf("{");
+  const end = answer.output.lastIndexOf("}");
+  if (start < 0 || end < start) return "unreadable";
+  try {
+    const parsed = JSON.parse(answer.output.slice(start, end + 1));
+    const loggedIn = parsed?.loggedIn;
+    return typeof loggedIn === "boolean" ? loggedIn : "unreadable";
+  } catch {
+    return "unreadable";
+  }
 }
-var HARNESS_LABEL = {
-  "claude-code": "Claude Code",
-  codex: "Codex"
-};
-var HARNESS_INTENT_WORD = {
-  "claude-code": "connected",
-  codex: "enabled"
-};
-function missingNoun(status) {
-  return status === "executable_missing" ? "executable" : "platform package";
-}
-function repairCommands() {
-  return ["npm i -g @cabane/companion --include=optional"];
-}
-function repairAction() {
-  return `Reinstall with \`${repairCommands()[0]}\`.`;
-}
-function startupWarning(r) {
-  const label = HARNESS_LABEL[r.runtime];
-  return `${label} is ${HARNESS_INTENT_WORD[r.runtime]}, but its installation is incomplete (${missingNoun(r.status)} is missing). It cannot run turns until repaired. ${repairAction()} Then restart the companion.`;
+function readCodexStatus(answer) {
+  if (answer.code === 0) return true;
+  if (/not logged in/i.test(answer.output)) return false;
+  if (/config/i.test(answer.output)) return "config";
+  return "unreadable";
 }
-function harnessIssueNote(runtime, status) {
-  const intent = HARNESS_INTENT_WORD[runtime];
-  const capitalized = `${intent[0].toUpperCase()}${intent.slice(1)}`;
-  return `${capitalized}, but @cabane/companion's bundled ${HARNESS_LABEL[runtime]} ${missingNoun(status)} is missing. ${repairAction()} Then restart the companion.`;
+function runBounded(path, args, env) {
+  return new Promise((resolve2) => {
+    let settled = false;
+    let out = "";
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve2(result);
+    };
+    let child;
+    try {
+      child = spawn2(path, args, { stdio: ["ignore", "pipe", "pipe"], env });
+    } catch {
+      resolve2({ code: null, output: "", error: "spawn" });
+      return;
+    }
+    const capture = (chunk) => {
+      if (out.length < 8192) out += chunk.toString();
+    };
+    child.stdout?.on("data", capture);
+    child.stderr?.on("data", capture);
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      done({ code: null, output: out, error: "timeout" });
+    }, CHECK_TIMEOUT_MS);
+    timer.unref?.();
+    child.once("error", () => done({ code: null, output: out, error: "spawn" }));
+    child.once("close", (code) => done({ code, output: out }));
+  });
 }
-function turnIncompleteCopy(runtime) {
-  return `**This device's ${HARNESS_LABEL[runtime]} runtime is incomplete.** ${repairAction()} Restart it, then try again.`;
+function checkVersion(check) {
+  if (!check) return null;
+  return check.status === "signed_in" || check.status === "api_key" || check.status === "signed_out" ? check.version : null;
 }
 
 // src/manifest.ts
@@ -819,7 +955,7 @@ function runtimeIssuesFor(gates) {
   for (const name of ["claude-code", "codex"]) {
     const gate = name === "codex" ? gates.codex : gates.claudeCode;
     if (!gate.intended || gate.bundled === "present") continue;
-    issues.push({ name, reason: gate.bundled });
+    issues.push({ name, reason: gate.bundled, install: gates.install });
   }
   return issues;
 }
@@ -851,13 +987,15 @@ function deriveHarnessSnapshot(signals) {
 }
 function deriveClaudeCode(signals, manifestHas) {
   const base = { runtime: "claude-code", label: LABELS["claude-code"] };
+  const version = checkVersion(signals.claudeCheck);
   if (manifestHas) {
     return {
       ...base,
       state: "exposed",
-      version: signals.claudeVersion,
-      detail: "Claude Code is connected and exposed to Cabane.",
-      enable: null
+      version,
+      detail: exposedDetail("claude-code", signals.claudeCheck),
+      enable: null,
+      signIn: signals.claudeCheck?.status ?? null
     };
   }
   if (signals.claudeCodeConnected) {
@@ -866,37 +1004,56 @@ function deriveClaudeCode(signals, manifestHas) {
       state: "needs_attention",
       version: null,
       detail: harnessIssueNote("claude-code", signals.claudeBundled),
-      enable: null
+      enable: null,
+      signIn: signals.claudeCheck?.status ?? null
     };
   }
-  if (signals.claudeOnPath) {
+  if (signals.claudeCheck && isUsable(signals.claudeCheck)) {
     return {
       ...base,
       state: "detected_not_exposed",
-      version: signals.claudeVersion,
-      // Connecting records INTENT, not runnability: with the bundled binary
-      // missing a connect succeeds and nothing is advertised, so say so.
-      detail: signals.claudeBundled === "present" ? "Claude Code is installed here but not connected yet. Connect it to offer Claude Code from this device." : `Claude Code is installed here but not connected yet \u2014 and @cabane/companion's bundled Claude Code ${missingNoun(signals.claudeBundled)} is missing, so connecting alone won't make it runnable. ${repairAction()}`,
-      enable: "claude-code"
+      version,
+      detail: `${usableLine("claude-code", signals.claudeCheck)} Connect it to offer Claude Code from this device.`,
+      enable: "claude-code",
+      signIn: signals.claudeCheck?.status ?? null
     };
   }
   return {
     ...base,
     state: "not_detected",
     version: null,
-    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then connect it here.",
-    enable: null
+    detail: notUsableDetail("claude-code", signals.claudeCheck),
+    enable: null,
+    signIn: signals.claudeCheck?.status ?? null
   };
 }
+function exposedDetail(runtime, check) {
+  const label = LABELS[runtime];
+  const problem = check ? unusableReason(runtime, check) : null;
+  if (problem) return problem;
+  if (check?.status === "signed_out") {
+    const login = runtime === "codex" ? "codex login" : "claude auth login";
+    return `${label} is connected, but signed out on this computer. Run \`${login}\` to use it again.`;
+  }
+  if (check?.status === "api_key") return `${label} is connected with an API key configured.`;
+  return `${label} is connected and exposed to Cabane.`;
+}
+function notUsableDetail(runtime, check) {
+  const problem = check ? unusableReason(runtime, check) : null;
+  if (problem) return problem;
+  return runtime === "codex" ? "Not signed in on this computer. Sign in with `codex login`, then enable it here." : "Not signed in on this computer. Sign in with `claude auth login`, then connect it here.";
+}
 function deriveCodex(signals, manifestHas) {
   const base = { runtime: "codex", label: LABELS.codex };
+  const version = checkVersion(signals.codexCheck);
   if (manifestHas) {
     return {
       ...base,
       state: "exposed",
-      version: signals.codexVersion,
-      detail: "Codex is enabled and exposed to Cabane.",
-      enable: null
+      version,
+      detail: exposedDetail("codex", signals.codexCheck),
+      enable: null,
+      signIn: signals.codexCheck?.status ?? null
     };
   }
   if (signals.codexEnabled) {
@@ -905,25 +1062,27 @@ function deriveCodex(signals, manifestHas) {
       state: "needs_attention",
       version: null,
       detail: harnessIssueNote("codex", signals.codexBundled),
-      enable: null
+      enable: null,
+      signIn: signals.codexCheck?.status ?? null
     };
   }
-  if (signals.codexOnPath) {
+  if (signals.codexCheck && isUsable(signals.codexCheck)) {
     return {
       ...base,
       state: "detected_not_exposed",
-      version: signals.codexVersion,
-      // As for Claude Code: enabling is intent, not launchability.
-      detail: signals.codexBundled === "present" ? "Codex is installed but not enabled yet. Turn it on to offer Codex from this device." : `Codex is installed but not enabled yet \u2014 and @cabane/companion's bundled Codex ${missingNoun(signals.codexBundled)} is missing, so enabling alone won't make it runnable. ${repairAction()}`,
-      enable: "codex"
+      version,
+      detail: `${usableLine("codex", signals.codexCheck)} Turn it on to offer Codex from this device.`,
+      enable: "codex",
+      signIn: signals.codexCheck?.status ?? null
     };
   }
   return {
     ...base,
     state: "not_detected",
     version: null,
-    detail: "Not detected. Install the Codex CLI and sign in (`codex login`), then enable it here.",
-    enable: null
+    detail: notUsableDetail("codex", signals.codexCheck),
+    enable: null,
+    signIn: signals.codexCheck?.status ?? null
   };
 }
 function deriveOpencode(signals, manifestHas) {
@@ -935,7 +1094,8 @@ function deriveOpencode(signals, manifestHas) {
         state: "exposed",
         version: signals.opencodeVersion,
         detail: "An opencode server is reachable and exposed to Cabane.",
-        enable: null
+        enable: null,
+        signIn: null
       };
     }
     return {
@@ -943,7 +1103,8 @@ function deriveOpencode(signals, manifestHas) {
       state: "needs_attention",
       version: null,
       detail: "Configured, but the opencode server isn\u2019t answering. Start `opencode serve` and check the URL.",
-      enable: null
+      enable: null,
+      signIn: null
     };
   }
   if (signals.opencodeReachable && signals.opencodeDetectedUrl) {
@@ -952,7 +1113,8 @@ function deriveOpencode(signals, manifestHas) {
       state: "detected_not_exposed",
       version: signals.opencodeVersion,
       detail: signals.opencodeDetectedUrl,
-      enable: "opencode"
+      enable: "opencode",
+      signIn: null
     };
   }
   return {
@@ -960,7 +1122,8 @@ function deriveOpencode(signals, manifestHas) {
     state: "not_detected",
     version: null,
     detail: "Not detected. Run `opencode serve` and add its URL here to expose opencode.",
-    enable: "opencode"
+    enable: "opencode",
+    signIn: null
   };
 }
 var PROBE_TIMEOUT_MS = 4e3;
@@ -979,31 +1142,20 @@ async function resolveOpencodeServerUrl(configuredServerUrl, requestedServerUrl,
   return await probeDefault() !== null ? DEFAULT_OPENCODE_SERVER_URL : null;
 }
 async function probeHarnessSignals(cfg, deps = {}) {
-  const probePresence = deps.probePresence ?? probeHarnessPresence;
   const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
   const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const configuredServerUrl = cfg.opencode?.serverUrl;
   const opencodeProbeUrl = configuredServerUrl ?? DEFAULT_OPENCODE_SERVER_URL;
-  const [claudePresence, codexPresence, opencodeVersion] = await Promise.all([
-    deps.presence?.["claude-code"] ?? withTimeout(probePresence("claude-code"), { status: "absent" }),
-    deps.presence?.codex ?? withTimeout(probePresence("codex"), { status: "absent" }),
-    configuredServerUrl ? withTimeout(probeOpencode(opencodeProbeUrl), null) : probeDefaultOpencodeVersion(probeOpencode)
-  ]);
-  const claudeVersion = claudePresence.status === "present" ? claudePresence.version : null;
-  const codexVersion = codexPresence.status === "present" ? codexPresence.version : null;
+  const opencodeVersion = configuredServerUrl ? await withTimeout(probeOpencode(opencodeProbeUrl), null) : await probeDefaultOpencodeVersion(probeOpencode);
   return {
-    claudeOnPath: claudePresence.status === "present",
-    claudeVersion,
-    // The user's opt-in, the manifest gate; the probe above only suggests.
+    claudeCheck: deps.checks?.["claude-code"] ?? null,
+    // The user's opt-in, the manifest gate; the check above only suggests.
     claudeCodeConnected: isClaudeCodeConnected(cfg),
-    // The executable a Claude turn launches, resolved with every probe so a
+    // The executable a Claude turn launches, resolved with every refresh so a
     // binary that disappears is caught on the next beat, not at turn time.
     claudeBundled: resolveBundled("claude-code").status,
     codexBundled: resolveBundled("codex").status,
-    // A parseable `codex --version` is our presence signal (presence alone never
-    // exposes codex; its config flag is the manifest gate either way).
-    codexOnPath: codexVersion !== null,
-    codexVersion,
+    codexCheck: deps.checks?.codex ?? null,
     codexEnabled: isCodexEnabled(cfg),
     opencodeConfigured: !!configuredServerUrl,
     // A version came back ⟺ the serve answered its health endpoint.
@@ -1036,104 +1188,88 @@ function withTimeout(promise, fallback, timeoutMs = PROBE_TIMEOUT_MS) {
   });
 }
 
-// src/harness-check.ts
-var CHECK_TIMEOUT_MS = 4e3;
-async function shakeOutHarness(runtime, cfg, deps = {}) {
-  const run = deps.run ?? runBounded;
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
-  try {
-    if (runtime === "opencode") {
-      const url = cfg.opencode?.serverUrl;
-      if (!url) return "absent";
-      return await probeOpencode(url) !== null ? "ok" : "failed";
-    }
-    const { auth } = runtime === "codex" ? {
-      auth: ["codex", ["login", "status"]]
-    } : {
-      auth: ["claude", ["auth", "status"]]
-    };
-    const presence = deps.presence ?? await (deps.probePresence ?? probeHarnessPresence)(runtime);
-    if (presence.status !== "present") return presence.status;
-    const authRun = await run(auth[0], [...auth[1]]);
-    if (authRun.code === 0) return "ok";
-    if (looksUnsupported(authRun.output)) {
-      return "unverified";
-    }
-    return "failed";
-  } catch {
-    return "unverified";
-  }
+// src/harness-copy.ts
+function claudeLoginCommand(path = process.env.PATH) {
+  if (firstOnPath("claude", path)) return "claude auth login";
+  return "~/.local/bin/claude auth login";
 }
-function connectedLine(runtime, verdict) {
-  if (verdict === "absent" || verdict === "unusable") {
-    throw new Error("an unavailable harness cannot be connected");
-  }
+function ctx(c = {}) {
+  return {
+    cmd: c.cmd ?? ((rest) => cabane(rest)),
+    claudeLogin: c.claudeLogin ?? claudeLoginCommand()
+  };
+}
+function loginCommand(runtime, c = {}) {
+  return runtime === "codex" ? "codex login" : ctx(c).claudeLogin;
+}
+function usableLine(runtime, check) {
   const label = HARNESS_LABELS[runtime];
-  if (verdict !== "failed") return `${label} connected.`;
-  return `${label} connected \u2014 ${FAILED_SUFFIX[runtime]}`;
+  if (!check) return `${label} is running on this computer.`;
+  const version = "version" in check && check.version ? ` (${check.version})` : "";
+  if (check.status === "api_key")
+    return `${label} has an API key configured on this computer${version}.`;
+  return `${label} is signed in on this computer${version}.`;
 }
-var FAILED_SUFFIX = {
-  "claude-code": "it doesn\u2019t look signed in yet. Run `claude` once and sign in, then it\u2019s ready.",
-  codex: "it doesn\u2019t look signed in yet. Run `codex login` once, then it\u2019s ready.",
-  opencode: "its server isn\u2019t answering. Start `opencode serve`, then it\u2019s ready."
-};
-function presenceReason(runtime, status) {
-  if (runtime === "opencode") {
-    return "No opencode server is configured \u2014 run `opencode serve` and connect with `--url`.";
-  }
+function failureText(runtime, reason) {
   const label = HARNESS_LABELS[runtime];
-  return status === "absent" ? `${label} isn't installed on this machine.` : `${label} is installed here but didn't report a version Cabane can read.`;
+  switch (reason) {
+    case "timeout":
+      return `Couldn't check whether ${label} is signed in: the check didn't answer in time. Try again.`;
+    case "spawn":
+      return `Couldn't check whether ${label} is signed in: Cabane's bundled ${label} wouldn't start. Repair it with  ${repairCommands()[0]}  , then try again.`;
+    case "config":
+      return `Couldn't check whether ${label} is signed in: its configuration file didn't load${runtime === "codex" ? ` (${join4(homedir5(), ".codex", "config.toml").replace(homedir5(), "~")})` : ""}. Fix it, then try again.`;
+    case "unreadable":
+      return `Couldn't check whether ${label} is signed in: it answered in a way Cabane couldn't read. Try again, and if it keeps happening, update Cabane.`;
+  }
 }
-var CLI_PRESENCE_ACTION = "Install it and run this again.";
-var DASHBOARD_PRESENCE_ACTION = "Install it, then refresh.";
-function presenceRefusal(runtime, status, action) {
-  const reason = presenceReason(runtime, status);
-  return runtime === "opencode" ? reason : `${reason} ${action}`;
+function bundleMissingText(runtime) {
+  const label = HARNESS_LABELS[runtime];
+  return `This Cabane install is missing its bundled ${label}. Repair it with  ${repairCommands()[0]}  , then try again.`;
 }
-function looksUnsupported(output) {
-  return /unrecognized|unknown (sub)?command|unexpected argument|invalid (sub)?command|no such (sub)?command|usage:|did you mean/i.test(
-    output
-  );
+function unusableReason(runtime, check) {
+  if (check.status === "bundle_missing") return bundleMissingText(runtime);
+  if (check.status === "check_failed") return failureText(runtime, check.reason);
+  return null;
 }
-function runBounded(command, args) {
-  return new Promise((resolve2) => {
-    let settled = false;
-    const done = (result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve2(result);
-    };
-    let child;
-    try {
-      child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
-    } catch {
-      resolve2({ code: null, output: "", error: "spawn" });
-      return;
-    }
-    let out = "";
-    const capture = (chunk) => {
-      if (out.length < 4096) out += chunk.toString();
+function connectLines(outcome, opts = {}) {
+  const c = ctx(opts);
+  if (outcome.kind === "opencode") return { ok: false, lines: [outcome.message] };
+  const label = HARNESS_LABELS[outcome.runtime];
+  if (outcome.kind === "connected") return { ok: true, lines: [`${label} connected.`] };
+  if (outcome.kind === "already") {
+    const where = outcome.deviceLabel ?? "this computer";
+    const how = outcome.check?.status === "api_key" ? ", with an API key configured" : outcome.check?.status === "signed_in" ? ", and signed in" : "";
+    return { ok: true, lines: [`${label} is already connected on ${where}${how}.`] };
+  }
+  const { runtime, check, connected } = outcome;
+  const problem = unusableReason(runtime, check);
+  if (problem) return { ok: false, lines: [problem] };
+  if (opts.windowKey) {
+    return {
+      ok: false,
+      lines: [
+        `${label} has an API key in this window, but the running Cabane can't see it.`,
+        `Run  ${c.cmd("stop")}  then  ${c.cmd("start")}  here, and it will.`
+      ]
     };
-    child.stdout?.on("data", capture);
-    child.stderr?.on("data", capture);
-    const timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      done({ code: null, output: out, error: "timeout" });
-    }, CHECK_TIMEOUT_MS);
-    timer.unref?.();
-    child.once("error", () => done({ code: null, output: out, error: "spawn" }));
-    child.once("exit", (code) => done({ code, output: out }));
-  });
+  }
+  const again = c.cmd(`connect ${runtime}`);
+  return {
+    ok: false,
+    lines: [
+      connected ? `${label} is connected here but signed out. Run  ${loginCommand(runtime, c)}  , then  ${again}  again.` : `${label} isn't signed in on this computer. Run  ${loginCommand(runtime, c)}  , then  ${again}  again.`
+    ]
+  };
 }
 
 // src/logger.ts
 import { createWriteStream, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { stripVTControlCharacters } from "util";
 import pino from "pino";
 function companionLogPath() {
-  return join3(cabaneDir(), "companion.log");
+  return join5(cabaneDir(), "companion.log");
 }
 function humanText(value) {
   return stripVTControlCharacters(String(value ?? "")).replace(
@@ -1486,14 +1622,14 @@ var CONTENT_TYPES = {
 function registerRoutes(app, deps) {
   const { supervisor, hub, staticDir } = deps;
   app.get("/", async (c) => {
-    const html = await readFile(join4(staticDir, "index.html"), "utf8");
+    const html = await readFile(join6(staticDir, "index.html"), "utf8");
     return c.html(html);
   });
   app.get("/static/:file", async (c) => {
     const file = c.req.param("file");
-    const safe3 = normalize(file).replace(/^(\.\.[/\\])+/, "");
-    const full = join4(staticDir, safe3);
-    if (!full.startsWith(staticDir) || !existsSync2(full)) return c.notFound();
+    const safe2 = normalize(file).replace(/^(\.\.[/\\])+/, "");
+    const full = join6(staticDir, safe2);
+    if (!full.startsWith(staticDir) || !existsSync3(full)) return c.notFound();
     const body = await readFile(full);
     const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
     c.header("content-type", type);
@@ -1546,20 +1682,9 @@ function registerRoutes(app, deps) {
   app.post("/api/harnesses/enable", async (c) => {
     const body = await readJson(c);
     const runtime = body.runtime;
-    if (runtime === "claude-code") {
-      const result = await supervisor.enableHarness({ runtime: "claude-code" });
-      if (!result.ok) {
-        const error = result.presence ? `${result.error} ${DASHBOARD_PRESENCE_ACTION}` : result.error;
-        return c.json({ error }, 400);
-      }
-      return c.json({ ok: true, status: hub.statusJson() });
-    }
-    if (runtime === "codex") {
-      const result = await supervisor.enableHarness({ runtime: "codex" });
-      if (!result.ok) {
-        const error = result.presence ? `${result.error} ${DASHBOARD_PRESENCE_ACTION}` : result.error;
-        return c.json({ error }, 400);
-      }
+    if (runtime === "claude-code" || runtime === "codex") {
+      const result = await supervisor.enableHarness({ runtime });
+      if (!result.ok) return c.json({ error: connectLines(result.outcome).lines.join(" ") }, 400);
       return c.json({ ok: true, status: hub.statusJson() });
     }
     if (runtime === "opencode") {
@@ -1570,7 +1695,7 @@ function registerRoutes(app, deps) {
         runtime: "opencode",
         serverUrl: body.serverUrl
       });
-      if (!result.ok) return c.json({ error: result.error }, 400);
+      if (!result.ok) return c.json({ error: connectLines(result.outcome).lines.join(" ") }, 400);
       return c.json({ ok: true, status: hub.statusJson() });
     }
     return c.json({ error: `can't enable "${String(runtime)}" from the app` }, 400);
@@ -1626,7 +1751,7 @@ function clampLimit(raw, fallback, max = 200) {
   return Math.min(Math.floor(n), max);
 }
 function tailFile(path, lines2) {
-  if (!existsSync2(path)) return [];
+  if (!existsSync3(path)) return [];
   const MAX_BYTES = 256 * 1024;
   let fd;
   try {
@@ -1715,14 +1840,14 @@ function isAddrInUse(err) {
   return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
 }
 function resolveStaticDir() {
-  return join5(dirname4(fileURLToPath2(import.meta.url)), "static");
+  return join7(dirname4(fileURLToPath3(import.meta.url)), "static");
 }
 
 // src/control-socket.ts
 import { createHash } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync3, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync4, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
 import { createServer, connect } from "net";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 var CONTROL_TIMEOUT_MS = 1e3;
 var MAX_UNIX_SOCKET_PATH_BYTES = 103;
 function controlSocketPath() {
@@ -1731,16 +1856,16 @@ function controlSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\cabane-companion-${key}`;
   }
-  const besideRuntime = join6(dir2, "companion.sock");
+  const besideRuntime = join8(dir2, "companion.sock");
   if (Buffer.byteLength(besideRuntime) <= MAX_UNIX_SOCKET_PATH_BYTES) return besideRuntime;
   const filename = `cabane-companion-${key}.sock`;
-  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync3(process.env.XDG_RUNTIME_DIR) ? join6(process.env.XDG_RUNTIME_DIR, filename) : null;
-  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join6("/tmp", filename);
+  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync4(process.env.XDG_RUNTIME_DIR) ? join8(process.env.XDG_RUNTIME_DIR, filename) : null;
+  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join8("/tmp", filename);
 }
 async function startControlServer(handlers) {
   const path = controlSocketPath();
   mkdirSync3(cabaneDir(), { recursive: true });
-  if (process.platform !== "win32" && existsSync3(path)) {
+  if (process.platform !== "win32" && existsSync4(path)) {
     const alive = await ping(path);
     if (alive) throw new Error(`another companion is already listening on ${path}`);
     rmSync2(path, { force: true });
@@ -1800,7 +1925,9 @@ async function serveConnection(socket, handlers) {
       return;
     }
     if (req.cmd === "connect") {
-      const result = await handlers.connect(req.runtime, req.serverUrl);
+      const outcome = await handlers.connect(req.runtime, req.serverUrl);
+      const { ok, lines: lines2 } = connectLines(outcome, { cmd: (rest) => `cabane ${rest}` });
+      const result = { ok, message: lines2.join(" "), outcome };
       reply(socket, result);
       return;
     }
@@ -1890,77 +2017,38 @@ async function ping(path) {
 }
 
 // src/prereqs.ts
-async function claudeOnPath() {
-  return (await probeHarnessPresence("claude-code")).status === "present";
-}
-async function codexOnPath() {
-  return (await probeHarnessPresence("codex")).status === "present";
-}
-async function requireStartConfig(deps = {}) {
+function requireStartConfig(deps = {}) {
   const requireCfg = deps.requireCfg ?? requireConfig;
-  const probeClaude = deps.probeClaude ?? claudeOnPath;
   const save2 = deps.save ?? saveConfig;
   const cfg = requireCfg();
-  const claudeOnPathResult = await probeClaude();
-  const migrated = migrateConnectedHarnesses(cfg, claudeOnPathResult);
-  if (!migrated) return { cfg, claudeOnPath: claudeOnPathResult };
+  const migrated = migrateConnectedHarnesses(cfg);
+  if (!migrated) return cfg;
   save2(migrated);
-  deps.onMigrated?.(migrated, claudeOnPathResult);
-  return { cfg: migrated, claudeOnPath: claudeOnPathResult };
+  deps.onMigrated?.(migrated);
+  return migrated;
 }
-async function warnAboutHarnessReadiness(cfg, deps = {}) {
-  const probeClaude = deps.probeClaude ?? claudeOnPath;
-  const probeCodex = deps.probeCodex ?? codexOnPath;
+function warnAboutHarnessReadiness(cfg, deps = {}) {
   const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const warn = deps.warn ?? ((message2) => process.stderr.write(`${message2}
 `));
-  const connected = [
-    ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
-    ...isCodexEnabled(cfg) ? ["Codex"] : [],
-    ...cfg.opencode ? ["opencode"] : []
-  ];
-  if (connected.length > 0) {
-    for (const runtime of ["claude-code", "codex"]) {
-      const intended = runtime === "codex" ? isCodexEnabled(cfg) : isClaudeCodeConnected(cfg);
-      if (!intended) continue;
-      const resolution = resolveBundled(runtime);
-      if (resolution.status !== "present") warn(startupWarning(resolution));
-    }
+  const connected = isClaudeCodeConnected(cfg) || isCodexEnabled(cfg) || Boolean(cfg.opencode?.serverUrl);
+  if (!connected) {
+    warn(
+      `No agent is connected on this device yet, so no agent turn can run here. Sign in to one, then connect it with \`${cabane("connect claude-code")}\` (or codex, or opencode).`
+    );
     return;
   }
-  const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
-  const found = [
-    ...claudeInstalled ? [
-      {
-        label: "Claude Code",
-        command: "`cabane-companion connect claude-code`",
-        bundled: resolveBundled("claude-code").status
-      }
-    ] : [],
-    ...codexInstalled ? [
-      {
-        label: "Codex",
-        command: "`cabane-companion connect codex`",
-        bundled: resolveBundled("codex").status
-      }
-    ] : []
-  ];
-  const runnable = found.filter((h) => h.bundled === "present");
-  const incomplete = found.filter((h) => h.bundled !== "present");
-  const incompleteNote = incomplete.map(
-    (h) => `${h.label} is installed here, but @cabane/companion's bundled ${h.label} ${missingNoun(h.bundled)} is missing, so connecting it alone won't make it runnable.`
-  ).join(" ");
-  const guidance = runnable.length > 0 ? `We found ${runnable.map((h) => h.label).join(" and ")} on this machine \u2014 connect ${runnable.length > 1 ? "one with " : "it with "}${runnable.map((h) => h.command).join(" or ")} and turns start routing here.${incompleteNote ? ` ${incompleteNote} ${repairAction()}` : ""}` : incomplete.length > 0 ? (
-    // Their machine is fine; this companion's install is not. Repair that,
-    // then connect — no "install a harness" they already have.
-    `${incompleteNote} ${repairAction()} Then connect it with ${incomplete.map((h) => h.command).join(" or ")}.`
-  ) : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).";
-  warn(`No harness is connected on this device yet, so no agent turn can run here. ${guidance}`);
+  for (const runtime of ["claude-code", "codex"]) {
+    const intended = runtime === "codex" ? isCodexEnabled(cfg) : isClaudeCodeConnected(cfg);
+    if (!intended) continue;
+    const resolution = resolveBundled(runtime);
+    if (resolution.status !== "present") warn(startupWarning(resolution));
+  }
 }
 
 // src/runtime-file.ts
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   readFileSync as readFileSync2,
   rmSync as rmSync3,
   writeFileSync as writeFileSync2,
@@ -1968,10 +2056,10 @@ import {
   openSync as openSync2,
   closeSync as closeSync2
 } from "fs";
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 var PROBE_TIMEOUT_MS2 = 1e3;
 function runtimePath() {
-  return join7(cabaneDir(), "runtime.json");
+  return join9(cabaneDir(), "runtime.json");
 }
 function serialize(state) {
   return JSON.stringify(state, null, 2) + "\n";
@@ -2000,11 +2088,11 @@ function acquireRuntimeState(state) {
 }
 function clearRuntimeState() {
   const path = runtimePath();
-  if (existsSync4(path)) rmSync3(path, { force: true });
+  if (existsSync5(path)) rmSync3(path, { force: true });
 }
 function clearRuntimeStateIfOurs(instanceId) {
   const path = runtimePath();
-  if (!existsSync4(path)) return;
+  if (!existsSync5(path)) return;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
     if (parsed.instanceId && parsed.instanceId !== instanceId) return;
@@ -2014,7 +2102,7 @@ function clearRuntimeStateIfOurs(instanceId) {
 }
 function readLiveRuntimeState() {
   const path = runtimePath();
-  if (!existsSync4(path)) return null;
+  if (!existsSync5(path)) return null;
   let parsed;
   try {
     parsed = JSON.parse(readFileSync2(path, "utf8"));
@@ -2179,7 +2267,7 @@ function turnFailureCopy(reason, runtime) {
       return "Claude Code sign-in has expired on this machine. Open Claude Code, run /login, then reply in Cabane to try again.";
     if (runtime === "codex")
       return "Codex sign-in has expired on this machine. Run codex login, then reply in Cabane to try again.";
-    return "Sign-in has expired on this machine. Sign in to the coding agent, then reply in Cabane to try again.";
+    return "Sign-in has expired on this machine. Sign in to the agent, then reply in Cabane to try again.";
   }
   if (failure?.kind === "usage_capped")
     return failure.resetsAt ? `The usage limit is reached; it resets around ${new Date(failure.resetsAt).toLocaleTimeString()}. Reply in Cabane after it resets.` : "The usage limit is reached. Try again later in Cabane.";
@@ -2190,9 +2278,9 @@ function turnFailureCopy(reason, runtime) {
   if (reason?.startsWith("missing_secret:"))
     return `A required secret is missing: ${humanText(reason.slice(15))}. Add it to ~/.cabane/secrets.json, then reply in Cabane to try again.`;
   if (reason?.startsWith("runtime_incomplete:"))
-    return "The coding agent installation is incomplete. Reinstall with npm i -g @cabane/companion@latest, then restart the companion.";
+    return "The agent installation is incomplete. Reinstall with npm i -g @cabane/companion@latest, then restart the companion.";
   if (/^(runtime|codex|opencode)_unavailable:/.test(reason ?? ""))
-    return "The coding agent is unavailable on this machine. Enable it here or choose another connector in Cabane.";
+    return "The agent is unavailable on this machine. Enable it here or choose another connector in Cabane.";
   if (reason?.startsWith("model_unavailable:"))
     return "The selected model is unavailable. Choose a different model in the agent settings in Cabane.";
   if (reason?.startsWith("prepare_failed:"))
@@ -2200,17 +2288,17 @@ function turnFailureCopy(reason, runtime) {
   if (reason?.startsWith("fetch_failed:"))
     return `Could not load the conversation (${humanText(reason.slice(13))}). Reply in Cabane to try again.`;
   if (reason === "timeout_idle")
-    return "The coding agent stopped responding. Reply in Cabane to try again.";
+    return "The agent stopped responding. Reply in Cabane to try again.";
   if (reason === "timeout_total")
     return "The turn ran longer than expected and was stopped. Reply in Cabane to continue.";
   if (reason === "result_error:error_max_turns")
-    return "The coding agent reached its step limit. Reply in Cabane to continue.";
+    return "The agent reached its step limit. Reply in Cabane to continue.";
   if (reason === "no_result" || reason === "empty_result" || reason === "empty_result_unverified")
-    return "The coding agent finished without a response. Reply in Cabane to try again.";
+    return "The agent finished without a response. Reply in Cabane to try again.";
   if (reason === "session_start_failed")
-    return "The coding agent could not start a session. Restart the companion, then reply in Cabane to try again.";
+    return "The agent could not start a session. Restart the companion, then reply in Cabane to try again.";
   if (reason === "no_terminal")
-    return "The coding agent stopped before confirming the turn was complete. Reply in Cabane to continue.";
+    return "The agent stopped before confirming the turn was complete. Reply in Cabane to continue.";
   if (reason === "lease_unconfirmed")
     return "Could not confirm with Cabane that the turn could start. Check this machine\u2019s connection, then reply in Cabane to try again.";
   if (reason === "workspace_tools_missing")
@@ -2218,13 +2306,13 @@ function turnFailureCopy(reason, runtime) {
   if (reason?.startsWith("seq_floor_unavailable:"))
     return "The interrupted turn could not safely continue. Reply in Cabane to continue.";
   if (reason === "result_error:error_max_budget_usd")
-    return "The coding agent reached its spending limit. Check its budget settings before trying again in Cabane.";
+    return "The agent reached its spending limit. Check its budget settings before trying again in Cabane.";
   if (reason === "result_error:error_max_structured_output_retries")
-    return "The coding agent could not produce the requested response format. Check the requested format, then reply in Cabane to try again.";
+    return "The agent could not produce the requested response format. Check the requested format, then reply in Cabane to try again.";
   if (reason?.startsWith("result_error:"))
-    return "The coding agent stopped with an error while running. Check its transcript, then reply in Cabane to try again.";
+    return "The agent stopped with an error while running. Check its transcript, then reply in Cabane to try again.";
   if (reason === "setup_failed")
-    return "The turn could not be set up. Check the coding agent setup on this machine, then reply in Cabane to try again.";
+    return "The turn could not be set up. Check the agent setup on this machine, then reply in Cabane to try again.";
   if (reason === "unexpected_role")
     return "The message could not start an agent response. Send a new message in Cabane to try again.";
   if (reason === "lease_lost" || reason?.startsWith("lease_refused:"))
@@ -2232,11 +2320,11 @@ function turnFailureCopy(reason, runtime) {
   const detail = humanText(reason?.replace(/^error:/, "") ?? "").slice(0, 400);
   if (/\b(EACCES|EPERM)\b|permission denied/i.test(detail)) {
     const readable = detail.replace(/\b(EACCES|EPERM)\b/g, "permission denied");
-    return `The coding agent was denied access: ${readable}. Check access permissions for the reported file or command, then reply in Cabane to try again.`;
+    return `The agent was denied access: ${readable}. Check access permissions for the reported file or command, then reply in Cabane to try again.`;
   }
   if (detail)
-    return `The coding agent reported: ${detail}. Check the coding agent setup on this machine, then reply in Cabane to try again.`;
-  return "The coding agent could not finish this turn. Reply in Cabane to try again.";
+    return `The agent reported: ${detail}. Check the agent setup on this machine, then reply in Cabane to try again.`;
+  return "The agent could not finish this turn. Reply in Cabane to try again.";
 }
 
 // src/api-error-shape.ts
@@ -2870,22 +2958,22 @@ function errorMessage2(status, body) {
 // src/credentials.ts
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync3,
   renameSync as renameSync2,
   rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 import { z as z4 } from "zod";
 function credentialsPath() {
-  return join8(cabaneDir(), "credentials.json");
+  return join10(cabaneDir(), "credentials.json");
 }
 var credentialStoreSchema = z4.record(z4.string(), z4.string());
 function load() {
   const path = credentialsPath();
-  if (!existsSync5(path)) return {};
+  if (!existsSync6(path)) return {};
   let raw;
   try {
     raw = readFileSync3(path, "utf8");
@@ -2947,18 +3035,18 @@ function pruneCredentials(keepAgentIds) {
 }
 
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync6 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
+import { join as join11 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
-  return join9(cabaneDir(), log);
+  return join11(cabaneDir(), log);
 }
 function pathFor(log, workspaceId) {
-  return join9(dir(log), encodeURIComponent(workspaceId));
+  return join11(dir(log), encodeURIComponent(workspaceId));
 }
 function readIds(log, workspaceId) {
   const path = pathFor(log, workspaceId);
-  if (!existsSync6(path)) return [];
+  if (!existsSync7(path)) return [];
   try {
     return readFileSync4(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   } catch {
@@ -2991,15 +3079,15 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join9(cabaneDir(), "resume-attempts");
+  return join11(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join9(resumeDir(), encodeURIComponent(workspaceId));
+  return join11(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = resumePathFor(workspaceId);
-  if (!existsSync6(path)) return out;
+  if (!existsSync7(path)) return out;
   try {
     for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
@@ -3030,16 +3118,16 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join9(cabaneDir(), "turns");
+  return join11(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join9(turnDir(), encodeURIComponent(workspaceId));
+  return join11(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = turnPathFor(workspaceId);
-  if (!existsSync6(path)) return out;
+  if (!existsSync7(path)) return out;
   try {
     for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
@@ -3951,8 +4039,8 @@ function readThinking(runtimeOptions) {
 var CLAUDE_CODE_DEFAULT_MODEL_BARE = "default";
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep3 = model.indexOf("/");
-  const bare = sep3 === -1 || model.slice(0, sep3) !== "anthropic" ? model : model.slice(sep3 + 1);
+  const sep5 = model.indexOf("/");
+  const bare = sep5 === -1 || model.slice(0, sep5) !== "anthropic" ? model : model.slice(sep5 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 
@@ -4135,7 +4223,7 @@ function dedupe(xs) {
 }
 
 // packages/agent-runtime/src/claude-code/loop.ts
-async function* decodeSdkStream(iter, ctx) {
+async function* decodeSdkStream(iter, ctx2) {
   const pending = /* @__PURE__ */ new Map();
   const buffer = createTerminalTextBuffer();
   const out = [];
@@ -4156,7 +4244,7 @@ async function* decodeSdkStream(iter, ctx) {
   let preInitNotice = null;
   try {
     for await (const msg of iter) {
-      if (ctx.signal.aborted) return;
+      if (ctx2.signal.aborted) return;
       if (msg.type === "system" && msg.subtype === "init") {
         const initModel = msg.model;
         if (typeof initModel === "string" && initModel.length > 0) resolvedModel = initModel;
@@ -4167,19 +4255,19 @@ async function* decodeSdkStream(iter, ctx) {
           break;
         }
         const sdkSessionId = msg.session_id;
-        if (!sessionEmitted && sdkSessionId && sdkSessionId !== ctx.resumedSessionId) {
+        if (!sessionEmitted && sdkSessionId && sdkSessionId !== ctx2.resumedSessionId) {
           sessionEmitted = true;
           yield {
             type: "session",
-            state: encodeSession({ sdkSessionId, cwd: ctx.cwd ?? "" }),
-            ...ctx.degraded ? { degraded: true } : {}
+            state: encodeSession({ sdkSessionId, cwd: ctx2.cwd ?? "" }),
+            ...ctx2.degraded ? { degraded: true } : {}
           };
         }
       } else if (msg.type === "system" && msg.subtype === "compact_boundary") {
         const compaction = readCompaction(msg);
         if (compaction) compactions.push(compaction);
       } else if (!workspaceProven && (msg.type === "assistant" || msg.type === "user" || msg.type === "result")) {
-        if (preInitToolActivity(msg) && ctx.startEvidence) ctx.startEvidence.toolActivity = true;
+        if (preInitToolActivity(msg) && ctx2.startEvidence) ctx2.startEvidence.toolActivity = true;
         const failure = classifyPreInitFrame(msg, signals);
         resultReason = failure ? encodeFailureReason(failure) : "session_start_failed";
         if (msg.type === "assistant" && isHarnessAuthored(msg))
@@ -4223,7 +4311,7 @@ async function* decodeSdkStream(iter, ctx) {
           const window = readContextWindow(msg, resolvedModel);
           if (window !== void 0) usage.contextWindow = window;
           if (compactions.length > 0) usage.contextCompactions = compactions;
-          const reading = await readHarnessContext(ctx.readContextUsage);
+          const reading = await readHarnessContext(ctx2.readContextUsage);
           if (reading) Object.assign(usage, reading);
         }
         const isError = msg.is_error === true;
@@ -4239,20 +4327,20 @@ async function* decodeSdkStream(iter, ctx) {
       }
     }
   } catch (err) {
-    if (ctx.signal.aborted) throw err;
+    if (ctx2.signal.aborted) throw err;
     const message2 = err instanceof Error ? err.message : String(err);
     const failure = mcpInventory.initReceived ? classifyErrorText(message2) : classifyFailure(signals, { text: message2 });
-    if (!failure && (mcpInventory.initReceived || ctx.resumedSessionId === null)) throw err;
+    if (!failure && (mcpInventory.initReceived || ctx2.resumedSessionId === null)) throw err;
     ok = false;
     if (failure) {
       resultReason = encodeFailureReason(failure);
     } else {
       resultReason = "session_start_failed";
-      if (ctx.startEvidence) ctx.startEvidence.thrown = message2.slice(0, 200);
+      if (ctx2.startEvidence) ctx2.startEvidence.thrown = message2.slice(0, 200);
     }
     sawResult = true;
   }
-  if (ctx.signal.aborted) return;
+  if (ctx2.signal.aborted) return;
   if (!workspaceProven) {
     ok = false;
     if (resultReason === void 0) {
@@ -5260,7 +5348,7 @@ function deepestError(node) {
 }
 
 // packages/agent-runtime/src/opencode/loop.ts
-async function* decodeOpencodeStream(events, ctx) {
+async function* decodeOpencodeStream(events, ctx2) {
   let held = null;
   const pending = /* @__PURE__ */ new Map();
   const startedTools = /* @__PURE__ */ new Set();
@@ -5269,9 +5357,9 @@ async function* decodeOpencodeStream(events, ctx) {
   let reason;
   let settled = false;
   const userMessageIds = /* @__PURE__ */ new Set();
-  if (ctx.skipMessageId) userMessageIds.add(ctx.skipMessageId);
+  if (ctx2.skipMessageId) userMessageIds.add(ctx2.skipMessageId);
   for await (const ev of events) {
-    if (ctx.signal.aborted) return;
+    if (ctx2.signal.aborted) return;
     if (ev.type === "message.updated") {
       const info = readMessageInfo(ev.properties);
       if (info && info.role === "user") userMessageIds.add(info.id);
@@ -5324,7 +5412,7 @@ async function* decodeOpencodeStream(events, ctx) {
       }
     } else if (ev.type === "session.idle") {
       const sid = readSessionId(ev.properties);
-      if (sid && sid !== ctx.sessionId) continue;
+      if (sid && sid !== ctx2.sessionId) continue;
       const sealed = sealHeld(held, true);
       held = null;
       if (sealed) yield sealed;
@@ -5333,7 +5421,7 @@ async function* decodeOpencodeStream(events, ctx) {
       break;
     } else if (ev.type === "session.error") {
       const sid = readSessionId(ev.properties);
-      if (sid && sid !== ctx.sessionId) continue;
+      if (sid && sid !== ctx2.sessionId) continue;
       const sealed = sealHeld(held, false);
       held = null;
       if (sealed) yield sealed;
@@ -5349,7 +5437,7 @@ async function* decodeOpencodeStream(events, ctx) {
       break;
     }
   }
-  if (ctx.signal.aborted) return;
+  if (ctx2.signal.aborted) return;
   if (!settled) {
     const sealed = sealHeld(held, true);
     held = null;
@@ -5407,9 +5495,9 @@ function readOpencodeDialect(runtimeOptions) {
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep3 = model.indexOf("/");
-  if (sep3 === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep3), modelID: model.slice(sep3 + 1) };
+  const sep5 = model.indexOf("/");
+  if (sep5 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep5), modelID: model.slice(sep5 + 1) };
 }
 
 // packages/agent-runtime/src/opencode/run-spec.ts
@@ -5697,10 +5785,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep3;
-      while ((sep3 = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep3);
-        buf = buf.slice(sep3 + 2);
+      let sep5;
+      while ((sep5 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep5);
+        buf = buf.slice(sep5 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -6448,7 +6536,7 @@ function readUsageBaseline(raw) {
 }
 
 // packages/agent-runtime/src/codex/loop.ts
-async function* decodeCodexStream(events, ctx) {
+async function* decodeCodexStream(events, ctx2) {
   let held = null;
   const pending = /* @__PURE__ */ new Map();
   const startedTools = /* @__PURE__ */ new Set();
@@ -6458,7 +6546,7 @@ async function* decodeCodexStream(events, ctx) {
   let reason;
   let usage;
   let cumulativeUsage;
-  let threadIdForSession = ctx.resumedThreadId;
+  let threadIdForSession = ctx2.resumedThreadId;
   let settled = false;
   function* flushInterim() {
     const sealed = sealHeld2(held, false);
@@ -6466,26 +6554,26 @@ async function* decodeCodexStream(events, ctx) {
     if (sealed) yield sealed;
   }
   for await (const ev of events) {
-    if (ctx.signal.aborted) return;
+    if (ctx2.signal.aborted) return;
     if (ev.type === "thread.started") {
       const threadId = readThreadId(ev);
       if (threadId) threadIdForSession = threadId;
       if (threadId && !sessionEmitted) {
         const state = encodeSession3({
           threadId,
-          cwd: ctx.cwd ?? "",
-          promptFingerprint: ctx.promptFingerprint ?? null,
+          cwd: ctx2.cwd ?? "",
+          promptFingerprint: ctx2.promptFingerprint ?? null,
           // The baseline this turn inherited, carried through unchanged. This early write records the
           // thread id even if the turn dies mid-stream; it can't yet know what the turn will spend. The
           // closing write records the new baseline.
-          usageBaseline: ctx.usageBaseline ?? null
+          usageBaseline: ctx2.usageBaseline ?? null
         });
-        if (threadId !== ctx.resumedThreadId || state !== ctx.storedState) {
+        if (threadId !== ctx2.resumedThreadId || state !== ctx2.storedState) {
           sessionEmitted = true;
           yield {
             type: "session",
             state,
-            ...ctx.degraded ? { degraded: true } : {}
+            ...ctx2.degraded ? { degraded: true } : {}
           };
         }
       }
@@ -6554,7 +6642,7 @@ async function* decodeCodexStream(events, ctx) {
       held = null;
       if (sealed) yield sealed;
       cumulativeUsage = readUsage(ev);
-      usage = cumulativeUsage ? codexUsageDelta(cumulativeUsage, ctx.usageBaseline ?? null) : void 0;
+      usage = cumulativeUsage ? codexUsageDelta(cumulativeUsage, ctx2.usageBaseline ?? null) : void 0;
       ok = true;
       settled = true;
       break;
@@ -6573,7 +6661,7 @@ async function* decodeCodexStream(events, ctx) {
       break;
     }
   }
-  if (ctx.signal.aborted) return;
+  if (ctx2.signal.aborted) return;
   if (!settled) {
     const sealed = sealHeld2(held, true);
     held = null;
@@ -6583,19 +6671,19 @@ async function* decodeCodexStream(events, ctx) {
   if (ok && cumulativeUsage && threadIdForSession) {
     const closing = encodeSession3({
       threadId: threadIdForSession,
-      cwd: ctx.cwd ?? "",
-      promptFingerprint: ctx.promptFingerprint ?? null,
+      cwd: ctx2.cwd ?? "",
+      promptFingerprint: ctx2.promptFingerprint ?? null,
       usageBaseline: cumulativeUsage
     });
     yield { type: "session", state: closing };
   }
-  const resolvedConfig = ctx.resolvedReasoningEffort ? { reasoningEffort: ctx.resolvedReasoningEffort } : void 0;
+  const resolvedConfig = ctx2.resolvedReasoningEffort ? { reasoningEffort: ctx2.resolvedReasoningEffort } : void 0;
   yield {
     type: "result",
     ok,
     ...reason ? { reason } : {},
     ...usage ? { usage } : {},
-    ...ctx.resolvedModel ? { resolvedModel: ctx.resolvedModel } : {},
+    ...ctx2.resolvedModel ? { resolvedModel: ctx2.resolvedModel } : {},
     ...resolvedConfig ? { resolvedConfig } : {}
   };
 }
@@ -6640,8 +6728,8 @@ function readCodexDialect(runtimeOptions) {
 // packages/agent-runtime/src/codex/model.ts
 var CODEX_DEFAULT_MODEL_BARES = /* @__PURE__ */ new Set(["default"]);
 function parseCodexModel(model) {
-  const sep3 = model.indexOf("/");
-  const bare = sep3 === -1 || model.slice(0, sep3) !== "openai" ? model : model.slice(sep3 + 1);
+  const sep5 = model.indexOf("/");
+  const bare = sep5 === -1 || model.slice(0, sep5) !== "openai" ? model : model.slice(sep5 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 
@@ -7921,6 +8009,7 @@ import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 // src/connector-health.ts
 var ConnectorHealthStore = class {
   byRuntime = /* @__PURE__ */ new Map();
+  sources = /* @__PURE__ */ new Map();
   // Record a settled turn's outcome for `runtime`. A success heals to `ok`; a
   // classified failure sets `limited`(+reset) / `auth_expired` with the reason as
   // `last_error`; anything else (a user Stop, a timeout, an unclassified error)
@@ -7929,6 +8018,7 @@ var ConnectorHealthStore = class {
   recordSettle(runtime, outcome) {
     if (outcome.ok) {
       this.byRuntime.set(runtime, { quotaState: "ok", limitedUntil: null, lastError: null });
+      this.sources.set(runtime, "turn");
       return;
     }
     const failure = decodeFailureReason(outcome.errorReason);
@@ -7940,6 +8030,26 @@ var ConnectorHealthStore = class {
       limitedUntil: quota.limitedUntil,
       lastError: outcome.errorReason ?? null
     });
+    this.sources.set(runtime, "turn");
+  }
+  // Record what the companion's own sign-in check found for a connected
+  // runtime at `start` or `connect`, so the heartbeat carries "sign-in needed"
+  // before any turn fails. Signed out seeds `auth_expired` unless a turn has
+  // already spoken; usable clears only a seed of our own.
+  recordLocalCheck(runtime, usable) {
+    const source = this.sources.get(runtime);
+    if (!usable) {
+      if (source === "turn" && this.byRuntime.get(runtime)?.quotaState !== "ok") return;
+      this.byRuntime.set(runtime, {
+        quotaState: "auth_expired",
+        limitedUntil: null,
+        lastError: encodeFailureReason({ kind: "auth_expired" })
+      });
+      this.sources.set(runtime, "local");
+      return;
+    }
+    if (source !== "local") return;
+    this.byRuntime.set(runtime, { quotaState: "ok", limitedUntil: null, lastError: null });
   }
   // The store's current opinion for one runtime, or undefined when it has
   // no observation. Read by the dispatcher at idle-timeout fire: an idle reap
@@ -7968,11 +8078,11 @@ var ConnectorHealthStore = class {
 
 // src/dispatcher.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join17 } from "path";
 
 // src/runner/launch.ts
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 
 // src/runner/sandbox-policy.ts
 import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
@@ -8149,7 +8259,7 @@ async function stopRemoteOpencodeSession(serverUrl, sessionId, opts = {}) {
 }
 
 // src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn4 } from "child_process";
+import { execFile, execFileSync, spawn as spawn3 } from "child_process";
 import { readFileSync as readFileSync5 } from "fs";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -8158,8 +8268,8 @@ var CONTAINMENT_STOP_GRACE_SEC = 5;
 var FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
 var CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
 function turnScopeUnit(turnId, attempt) {
-  const safe3 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
-  return `cabane-turn-${safe3}-${attempt}`;
+  const safe2 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
+  return `cabane-turn-${safe2}-${attempt}`;
 }
 async function reapTurnScopes(turnId) {
   if (process.platform !== "linux") return { failures: [] };
@@ -8272,7 +8382,7 @@ function createTurnContainment(turnId, deps = {}) {
       command: options.command
     });
     return asContained(
-      spawn4("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
+      spawn3("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
         ...options.cwd ? { cwd: options.cwd } : {},
         env: options.env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -8280,7 +8390,7 @@ function createTurnContainment(turnId, deps = {}) {
     );
   }
   function spawnInGroup(options) {
-    const child = spawn4(options.command, options.args, {
+    const child = spawn3(options.command, options.args, {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
@@ -8427,17 +8537,17 @@ function createTurnContainment(turnId, deps = {}) {
 }
 
 // src/secrets.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join12 } from "path";
 import { z as z14 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join12(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z14.record(z14.string(), z14.string());
 function loadSecretStore() {
   const path = secretsPath();
-  if (!existsSync7(path)) return makeStore({});
+  if (!existsSync8(path)) return makeStore({});
   let raw;
   try {
     raw = readFileSync6(path, "utf8");
@@ -8816,7 +8926,7 @@ function relayRunnerLog(line, log) {
   log[method](fields, typeof msg === "string" ? msg : "");
 }
 function lines(stream, onLine) {
-  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  const rl = createInterface2({ input: stream, crlfDelay: Infinity });
   rl.on("line", onLine);
   return new Promise((resolve2) => rl.once("close", resolve2));
 }
@@ -9156,19 +9266,9 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   return { ok: false, durationMs, reason };
 }
 
-// src/term.ts
-import { createInterface as createInterface2 } from "readline";
-import { homedir as homedir2 } from "os";
-import pc from "picocolors";
-function tildePath(path) {
-  const home = homedir2();
-  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
-  return path;
-}
-
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -9412,11 +9512,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join11 } from "path";
+import { join as join13 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
-  const path = join11(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join13(tmpdir(), PREFIX));
+  const path = join13(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -9429,7 +9529,7 @@ async function writeCodexInstructionsFile(contents) {
 // src/codex-images.ts
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join12 } from "path";
+import { join as join14 } from "path";
 var FETCH_TIMEOUT_MS = 3e4;
 var EXTENSIONS = {
   "image/png": "png",
@@ -9442,7 +9542,7 @@ function createCodexImagePreparer(opts) {
   const timeoutMs = opts.timeoutMs ?? FETCH_TIMEOUT_MS;
   return async (urls, signal) => {
     signal.throwIfAborted();
-    const dir2 = await mkdtemp2(join12(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
+    const dir2 = await mkdtemp2(join14(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
     const cleanup = async () => {
       try {
         await rm2(dir2, { recursive: true, force: true });
@@ -9463,7 +9563,7 @@ function createCodexImagePreparer(opts) {
         const ext = EXTENSIONS[type];
         if (!ext) throw new Error(`not a vision image type: ${type || "none"}`);
         const bytes = new Uint8Array(await res.arrayBuffer());
-        const path = join12(dir2, `image-${index + 1}.${ext}`);
+        const path = join14(dir2, `image-${index + 1}.${ext}`);
         await writeFile2(path, bytes, { mode: 384 });
         return path;
       } catch (err) {
@@ -9497,14 +9597,14 @@ var SeqFloorUnavailable = class extends Error {
   }
   detail;
 };
-function resolveSeqFloor(sources, ctx) {
+function resolveSeqFloor(sources, ctx2) {
   const { serverFloor, outboxFloor } = sources;
   if (serverFloor === void 0) {
     throw new SeqFloorUnavailable("server sent no committed floor for a resumed turn");
   }
   const floor = Math.max(serverFloor, outboxFloor);
-  ctx.log.debug(
-    { turnId: ctx.turnId, floor, outboxFloor, serverFloor },
+  ctx2.log.debug(
+    { turnId: ctx2.turnId, floor, outboxFloor, serverFloor },
     "companion: resumed turn \u2014 seq counter seeded above its committed high-water mark"
   );
   return floor;
@@ -9522,7 +9622,7 @@ function readOutboxFloor(read, turnId, log) {
 }
 
 // src/prepare-failure.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { hostname } from "os";
 function prepareFailureCause(error) {
   const message2 = error instanceof Error ? error.message : String(error);
@@ -9560,7 +9660,7 @@ async function runPrepareWithReporting(runner, hook, input, context, reportError
 }
 function reportFailure(config, body) {
   return new Promise((resolve2, reject) => {
-    const child = spawn5(config.command, config.args ?? [], {
+    const child = spawn4(config.command, config.args ?? [], {
       stdio: ["pipe", "ignore", "ignore"],
       env: { ...process.env, ...config.env }
     });
@@ -9584,20 +9684,20 @@ function reportFailure(config, body) {
 }
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
+import { join as join15 } from "path";
 function dirFor(workspaceId) {
-  return join13(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join15(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join13(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join15(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor2(workspaceId, conversationId, agentId) {
-  return join13(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join15(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync7(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
@@ -9625,9 +9725,9 @@ function clearPrepared(workspaceId, conversationId, agentId) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname6, join as join14 } from "path";
+import { basename, dirname as dirname6, join as join16 } from "path";
 function transcriptsDir() {
-  return join14(runnerStateDir(), "transcripts");
+  return join16(runnerStateDir(), "transcripts");
 }
 var RETAIN = 200;
 var ANOMALY_RETAIN = 50;
@@ -9637,7 +9737,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join14(dir2, fileName(meta));
+    this.path = join16(dir2, fileName(meta));
     try {
       mkdirSync8(dir2, { recursive: true });
       try {
@@ -9666,10 +9766,10 @@ var TranscriptWriter = class {
   preserveAnomaly() {
     if (this.broken) return;
     try {
-      const dir2 = join14(dirname6(this.path), "anomalies");
+      const dir2 = join16(dirname6(this.path), "anomalies");
       mkdirSync8(dir2, { recursive: true, mode: 448 });
       chmodSync4(dir2, 448);
-      const target = join14(dir2, basename(this.path));
+      const target = join16(dir2, basename(this.path));
       copyFileSync(this.path, target);
       chmodSync4(target, 384);
       pruneOld(dir2, ANOMALY_RETAIN);
@@ -9694,14 +9794,14 @@ var TranscriptWriter = class {
 function fileName(meta) {
   const d = new Date(meta.ts);
   const stamp = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
-  const slug = safe2(meta.workspaceSlug) || "ws";
+  const slug = safe(meta.workspaceSlug) || "ws";
   const short = meta.dispatchId.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8) || "turn";
   return `${stamp}-${slug}-${short}.jsonl`;
 }
 function pad(n) {
   return String(n).padStart(2, "0");
 }
-function safe2(s) {
+function safe(s) {
   return s.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
 function pruneOld(dir2, retain) {
@@ -9715,7 +9815,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync6(join14(dir2, f), { force: true });
+      rmSync6(join16(dir2, f), { force: true });
     } catch {
     }
   }
@@ -9854,32 +9954,32 @@ var TurnCommitter = class {
 function bundledHarnessFor(runtime) {
   return runtime === "claude-code" || runtime === "codex" ? runtime : null;
 }
-function resolve(ctx, harness) {
-  return (ctx.resolveBundled ?? resolveBundledBinary)(harness);
+function resolve(ctx2, harness) {
+  return (ctx2.resolveBundled ?? resolveBundledBinary)(harness);
 }
-async function postIncompleteNotice(ctx, harness, resolution) {
+async function postIncompleteNotice(ctx2, harness, resolution) {
   try {
-    await ctx.postTurnMessage(ctx.workspaceId, ctx.conversationId, {
+    await ctx2.postTurnMessage(ctx2.workspaceId, ctx2.conversationId, {
       body: turnIncompleteCopy(harness),
       kind: "runtime_notice",
-      turnId: ctx.turnId,
-      parentMessageId: ctx.parentMessageId
+      turnId: ctx2.turnId,
+      parentMessageId: ctx2.parentMessageId
     });
     return true;
   } catch (err) {
-    ctx.log.warn(
+    ctx2.log.warn(
       { ...apiErrorLogFields(err) },
       "Couldn't save the explanation to Cabane. This companion may need an update: npm i -g @cabane/companion@latest"
     );
     return false;
   }
 }
-async function checkBundledBinary(ctx) {
-  const harness = bundledHarnessFor(ctx.runtime);
+async function checkBundledBinary(ctx2) {
+  const harness = bundledHarnessFor(ctx2.runtime);
   if (!harness) return null;
-  const resolution = resolve(ctx, harness);
+  const resolution = resolve(ctx2, harness);
   if (resolution.status === "present") return null;
-  ctx.log.debug(
+  ctx2.log.debug(
     {
       runtime: harness,
       status: resolution.status,
@@ -9891,15 +9991,15 @@ async function checkBundledBinary(ctx) {
   return {
     harness,
     reason: `runtime_incomplete:${harness}`,
-    posted: await postIncompleteNotice(ctx, harness, resolution)
+    posted: await postIncompleteNotice(ctx2, harness, resolution)
   };
 }
-async function reclassifyThrow(ctx, opts) {
-  const harness = bundledHarnessFor(ctx.runtime);
+async function reclassifyThrow(ctx2, opts) {
+  const harness = bundledHarnessFor(ctx2.runtime);
   if (!harness || opts.aborted) return null;
-  const resolution = resolve(ctx, harness);
+  const resolution = resolve(ctx2, harness);
   if (resolution.status === "present") return null;
-  ctx.log.debug(
+  ctx2.log.debug(
     {
       runtime: harness,
       status: resolution.status,
@@ -9912,17 +10012,17 @@ async function reclassifyThrow(ctx, opts) {
   return {
     harness,
     reason: `runtime_incomplete:${harness}`,
-    posted: await postIncompleteNotice(ctx, harness, resolution)
+    posted: await postIncompleteNotice(ctx2, harness, resolution)
   };
 }
-async function guardBundledBinary(ctx, concluded, outcome) {
-  const incomplete = await checkBundledBinary(ctx);
+async function guardBundledBinary(ctx2, concluded, outcome) {
+  const incomplete = await checkBundledBinary(ctx2);
   if (!incomplete) return;
   outcome.runtimeIncomplete = incomplete.posted;
   throw incomplete.posted ? concluded(incomplete.reason) : concluded(incomplete.reason, incomplete.reason);
 }
-async function absorbBundledLoss(ctx, aborted, outcome) {
-  const lost = await reclassifyThrow(ctx, { aborted, originalReason: outcome.resultReason });
+async function absorbBundledLoss(ctx2, aborted, outcome) {
+  const lost = await reclassifyThrow(ctx2, { aborted, originalReason: outcome.resultReason });
   if (!lost) return false;
   outcome.resultReason = lost.reason;
   return lost.posted;
@@ -10317,7 +10417,7 @@ var TurnExecution = class {
     const prepareHook = this.opts.local.prepareHook;
     const cabaneCwd = this.turnContext.cwd;
     let effectiveCwd = localCwd ?? cabaneCwd;
-    if (effectiveCwd && !existsSync9(effectiveCwd)) {
+    if (effectiveCwd && !existsSync10(effectiveCwd)) {
       turnLog.warn(
         { cwd: effectiveCwd },
         "The working directory is missing; using the companion's directory instead. Check this agent's working directory setting."
@@ -11085,7 +11185,7 @@ function fingerprintSessionState(state) {
 // src/dispatcher.ts
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
-  if (!existsSync10(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
+  if (!existsSync11(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
   let entries;
   try {
     entries = readdirSync2(cwd);
@@ -11095,15 +11195,15 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join15(cwd, ".git");
-  if (!existsSync10(gitPath)) return { ok: true, reason: "usable" };
+  const gitPath = join17(cwd, ".git");
+  if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
     stat = statSync2(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync10(join15(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync11(join17(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -11216,18 +11316,18 @@ var Dispatcher = class {
 };
 
 // src/providers/local-process.ts
-import { spawn as spawn6 } from "child_process";
-import { constants } from "os";
+import { spawn as spawn5 } from "child_process";
+import { constants as constants2 } from "os";
 var DEFAULT_KILL_GRACE_MS = 3e4;
 var DEFAULT_REAP_GRACE_MS = 3e3;
 function exitCode(code, signal) {
   if (code !== null) return code;
-  const signum = signal ? constants.signals[signal] : void 0;
+  const signum = signal ? constants2.signals[signal] : void 0;
   return signum !== void 0 ? 128 + signum : 1;
 }
 function createLocalProcessProvider(opts = {}) {
   const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
-  const spawnFn = opts.spawnFn ?? spawn6;
+  const spawnFn = opts.spawnFn ?? spawn5;
   const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
   const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
   const groupAlive = (pgid) => {
@@ -11308,11 +11408,11 @@ function createLocalProcessProvider(opts = {}) {
 
 // src/providers/docker.ts
 import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
-import { constants as constants2, tmpdir as tmpdir3 } from "os";
+import { constants as constants3, tmpdir as tmpdir3 } from "os";
 import {
   createReadStream,
   createWriteStream as createWriteStream2,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync4,
   readFileSync as readFileSync9,
@@ -11321,11 +11421,11 @@ import {
   statSync as statSync3,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 import { Writable } from "stream";
 
 // src/providers/docker-cli.ts
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 function cliEnv(extra) {
   const keep = [
     "PATH",
@@ -11345,7 +11445,7 @@ function dockerCli(bin = "docker") {
       return new Promise((resolve2) => {
         let child;
         try {
-          child = spawn7(bin, [...args], {
+          child = spawn6(bin, [...args], {
             env: cliEnv(opts.env),
             stdio: ["pipe", "pipe", "pipe"]
           });
@@ -11376,13 +11476,13 @@ function dockerCli(bin = "docker") {
       });
     },
     spawn(args, env) {
-      return spawn7(bin, [...args], { env: cliEnv(env), stdio: ["pipe", "pipe", "pipe"] });
+      return spawn6(bin, [...args], { env: cliEnv(env), stdio: ["pipe", "pipe", "pipe"] });
     }
   };
 }
 
 // src/runner/git-credential.ts
-import { spawn as spawn8 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import { chmodSync as chmodSync5, rmSync as rmSync7 } from "fs";
 import { connect as connect3, createServer as createServer3 } from "net";
 
@@ -11424,7 +11524,7 @@ function deviceGitFill(helper, timeoutMs = 15e3) {
       "credential",
       "fill"
     ];
-    const child = spawn8("git", args, {
+    const child = spawn7("git", args, {
       stdio: ["pipe", "pipe", "ignore"],
       env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "", SSH_ASKPASS: "" }
     });
@@ -11508,14 +11608,14 @@ async function serveGitCredentials(opts) {
 // src/runner/collected-outbox.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
   renameSync as renameSync4,
   rmSync as rmSync8
 } from "fs";
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 function routes(t) {
   const conv = `/api/workspaces/${t.workspaceId}/conversations/${t.conversationId}`;
   const agent = `${conv}/participants/agents/${t.agentId}`;
@@ -11557,11 +11657,11 @@ var atomicMove = (from, to) => {
   }
 };
 function publishStaged(from, to, move = atomicMove) {
-  if (!existsSync11(from)) return { published: 0, complete: true };
+  if (!existsSync12(from)) return { published: 0, complete: true };
   const staged = readdirSync3(from).filter((n) => n.endsWith(".json")).map((name) => {
     let entry = {};
     try {
-      entry = JSON.parse(readFileSync8(join16(from, name), "utf8"));
+      entry = JSON.parse(readFileSync8(join18(from, name), "utf8"));
     } catch {
     }
     return { name, entry };
@@ -11574,7 +11674,7 @@ function publishStaged(from, to, move = atomicMove) {
   let published = 0;
   for (const { name } of staged) {
     try {
-      move(join16(from, name), join16(to, name));
+      move(join18(from, name), join18(to, name));
     } catch {
       return { published, complete: false };
     }
@@ -11586,9 +11686,9 @@ function publishStaged(from, to, move = atomicMove) {
 
 // src/providers/runner-base.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync12, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname7, join as join17, sep } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync13, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname7, join as join19, sep as sep3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 var COMPANION_MOUNT = "/opt/cabane/companion";
 var BASE_DOCKERFILE = `FROM node:22-slim
 RUN apt-get update \\
@@ -11632,17 +11732,17 @@ async function ensureBaseImage(docker, image, log) {
   }
   return true;
 }
-function ownInstall(moduleFile = fileURLToPath3(import.meta.url)) {
+function ownInstall(moduleFile = fileURLToPath4(import.meta.url)) {
   let dir2 = dirname7(moduleFile);
   for (let i = 0; i < 4; i++) {
-    if (existsSync12(join17(dir2, "dist", "cli.js")) && existsSync12(join17(dir2, "package.json"))) break;
+    if (existsSync13(join19(dir2, "dist", "cli.js")) && existsSync13(join19(dir2, "package.json"))) break;
     dir2 = dirname7(dir2);
   }
-  if (!existsSync12(join17(dir2, "dist", "cli.js"))) return null;
-  const sdk = join17(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
-  if (!existsSync12(sdk)) return null;
-  const root = realpathSync2(dir2);
-  return realpathSync2(sdk).startsWith(root + sep) ? root : null;
+  if (!existsSync13(join19(dir2, "dist", "cli.js"))) return null;
+  const sdk = join19(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
+  if (!existsSync13(sdk)) return null;
+  const root = realpathSync3(dir2);
+  return realpathSync3(sdk).startsWith(root + sep3) ? root : null;
 }
 function companionSource(input) {
   if (input.configured) {
@@ -11778,21 +11878,21 @@ function networkCreateError(stderr) {
 }
 function sessionArchivePath(deviceDir, attemptId) {
   if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
-  return join18(deviceDir, "attempts", attemptId, "session.tar");
+  return join20(deviceDir, "attempts", attemptId, "session.tar");
 }
 function pruneOtherAttempts(deviceDir, pair, keep) {
-  const root = join18(deviceDir, "attempts");
-  if (!existsSync13(root)) return;
+  const root = join20(deviceDir, "attempts");
+  if (!existsSync14(root)) return;
   for (const id of readdirSync4(root)) {
     if (id === keep || !UUID_RE.test(id)) continue;
     let pairOf = "";
     try {
-      pairOf = readFileSync9(join18(root, id, "pair"), "utf8");
+      pairOf = readFileSync9(join20(root, id, "pair"), "utf8");
     } catch {
       continue;
     }
     if (pairOf === `${pair.conversationId}/${pair.agentId}`) {
-      rmSync9(join18(root, id), { recursive: true, force: true });
+      rmSync9(join20(root, id), { recursive: true, force: true });
     }
   }
 }
@@ -11992,15 +12092,15 @@ function createDockerProvider(opts) {
       await must(["network", "disconnect", "-f", other, name], "moving the container");
     if (others.includes(sharedNetwork)) await retireSharedNetwork();
   };
-  const socketRoot = opts.socketRoot ?? join18(
-    process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir3(),
+  const socketRoot = opts.socketRoot ?? join20(
+    process.env.XDG_RUNTIME_DIR && existsSync14(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir3(),
     `cabane-runners-${opts.deviceKey}`
   );
-  const socketDir = (name) => join18(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
+  const socketDir = (name) => join20(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
   const create = async (name, attempt) => {
     mkdirSync10(socketRoot, { recursive: true, mode: 448 });
     mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
-    const mounts = (opts.mounts ?? []).filter((m) => m.source.startsWith("/") && existsSync13(m.source)).flatMap((m) => ["--mount", `type=bind,src=${m.source},dst=${m.target},readonly`]);
+    const mounts = (opts.mounts ?? []).filter((m) => m.source.startsWith("/") && existsSync14(m.source)).flatMap((m) => ["--mount", `type=bind,src=${m.source},dst=${m.target},readonly`]);
     await must(
       [
         "create",
@@ -12138,7 +12238,7 @@ function createDockerProvider(opts) {
     }
   };
   const removeIn = (name, from, names) => names.length ? execIn(name, ["sh", "-c", 'cd "$1" && shift && rm -f -- "$@"', "sh", from, ...names]) : Promise.resolve(null);
-  const pendingPath = (name) => join18(opts.deviceDir, "runners-pending", `${name}.json`);
+  const pendingPath = (name) => join20(opts.deviceDir, "runners-pending", `${name}.json`);
   const readPending = (name) => {
     try {
       const ids = JSON.parse(readFileSync9(pendingPath(name), "utf8"));
@@ -12152,12 +12252,12 @@ function createDockerProvider(opts) {
       rmSync9(pendingPath(name), { force: true });
       return;
     }
-    mkdirSync10(join18(opts.deviceDir, "runners-pending"), { recursive: true });
+    mkdirSync10(join20(opts.deviceDir, "runners-pending"), { recursive: true });
     writeFileSync6(pendingPath(name), JSON.stringify([...new Set(ids)]));
   };
   const keepSession = async (name, attempt, attemptId) => {
     const archive = sessionArchivePath(opts.deviceDir, attemptId);
-    mkdirSync10(join18(archive, ".."), { recursive: true });
+    mkdirSync10(join20(archive, ".."), { recursive: true });
     const partial = `${archive}.${process.pid}.partial`;
     const file = new CappedFile(partial, sessionCap);
     const r = await execIn(
@@ -12174,7 +12274,7 @@ function createDockerProvider(opts) {
     );
     if (r.code === 0 && !file.over) {
       renameSync5(partial, archive);
-      writeFileSync6(join18(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
+      writeFileSync6(join20(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
       pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
       await writeMarker(name, attemptId);
       log.debug({ container: name, attemptId, bytes: file.bytes }, "runners: session files kept");
@@ -12188,7 +12288,7 @@ function createDockerProvider(opts) {
       file.over ? "runners: the session files are over the size cap and weren't kept; the next new container starts the session over" : "runners: couldn't keep the session files; the next new container starts the session over"
     );
   };
-  const stagingDir = (name) => join18(opts.deviceDir, "runners-pending", `${name}.outbox`);
+  const stagingDir = (name) => join20(opts.deviceDir, "runners-pending", `${name}.outbox`);
   const ensureRunning = async (name) => {
     const seen = await docker.run(["inspect", "-f", "{{.State.Running}}", name]);
     if (seen.code !== 0) return false;
@@ -12196,7 +12296,7 @@ function createDockerProvider(opts) {
     return (await docker.run(["start", name])).code === 0;
   };
   const dropArchive = (attemptId) => {
-    rmSync9(join18(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
+    rmSync9(join20(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
       recursive: true,
       force: true
     });
@@ -12265,7 +12365,7 @@ function createDockerProvider(opts) {
         if (seen.stdout.trim().split(" ")[0] !== "true")
           await must(["start", name], "starting the container");
         const git = await serveGitCredentials({
-          socketPath: join18(socketDir(name), "git.sock"),
+          socketPath: join20(socketDir(name), "git.sock"),
           hosts: opts.gitHosts,
           fill: opts.gitFill,
           log
@@ -12299,7 +12399,7 @@ function createDockerProvider(opts) {
       }
       if (attemptId && UUID_RE.test(attemptId)) {
         const archive = sessionArchivePath(opts.deviceDir, attemptId);
-        if (existsSync13(archive)) {
+        if (existsSync14(archive)) {
           const r = await execIn(name, ["tar", "-x", "-C", CONTAINER_HOME, "-f", "-"], {
             input: createReadStream(archive)
           });
@@ -12365,7 +12465,7 @@ function createDockerProvider(opts) {
         };
         child.once("error", () => done(1));
         child.once("close", (code, sig) => {
-          const signum = sig ? constants2.signals[sig] : void 0;
+          const signum = sig ? constants3.signals[sig] : void 0;
           done(code ?? (signum !== void 0 ? 128 + signum : 1));
         });
         if (signal.aborted) stop();
@@ -12414,15 +12514,15 @@ function createDockerProvider(opts) {
       const transcripts = await readDir(name, `${CONTAINER_STATE}/transcripts`);
       if (transcripts) {
         const kept = transcripts.files.filter((f) => SAFE_NAME_RE.test(f.name));
-        if (kept.length) mkdirSync10(join18(opts.hostStateDir, "transcripts"), { recursive: true });
-        for (const f of kept) writeFileSync6(join18(opts.hostStateDir, "transcripts", f.name), f.data);
+        if (kept.length) mkdirSync10(join20(opts.hostStateDir, "transcripts"), { recursive: true });
+        for (const f of kept) writeFileSync6(join20(opts.hostStateDir, "transcripts", f.name), f.data);
         await removeIn(
           name,
           `${CONTAINER_STATE}/transcripts`,
           kept.map((f) => f.name)
         );
       }
-      const outboxRel = join18("outbox", encodeURIComponent(attempt.agentId));
+      const outboxRel = join20("outbox", encodeURIComponent(attempt.agentId));
       const outbox = await readDir(name, `${CONTAINER_STATE}/${outboxRel}`);
       let unpublished = false;
       if (outbox) {
@@ -12448,7 +12548,7 @@ function createDockerProvider(opts) {
           const staged = stagingDir(name);
           mkdirSync10(staged, { recursive: true });
           writeFileSync6(
-            join18(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
+            join20(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
             `${JSON.stringify(entry)}
 `
           );
@@ -12461,7 +12561,7 @@ function createDockerProvider(opts) {
         if (outbox.complete) {
           const published = publishStaged(
             stagingDir(name),
-            join18(opts.hostStateDir, outboxRel),
+            join20(opts.hostStateDir, outboxRel),
             opts.moveFile
           );
           queued = published.published;
@@ -12670,15 +12770,15 @@ import {
   mkdirSync as mkdirSync11,
   mkdtempSync,
   readFileSync as readFileSync10,
-  realpathSync as realpathSync3,
+  realpathSync as realpathSync4,
   rmSync as rmSync10,
   writeFileSync as writeFileSync7
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
-import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo2 } from "os";
-import { dirname as dirname8, join as join19, sep as sep2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { homedir as homedir6, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo2 } from "os";
+import { dirname as dirname8, join as join21, sep as sep4 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
   try {
@@ -12774,13 +12874,13 @@ function companionStoreWatch(log) {
   return new CompanionStoreWatch({
     log,
     roots: () => {
-      const home = homedir3();
+      const home = homedir6();
       return storeWalkRoots([.../* @__PURE__ */ new Set([home, accountHome() ?? home])], cabaneDir());
     }
   });
 }
 function isAtOrUnder(path, dir2) {
-  return path === dir2 || path.startsWith(dir2 + sep2);
+  return path === dir2 || path.startsWith(dir2 + sep4);
 }
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
@@ -12879,7 +12979,7 @@ var DispatchClaims = class {
 
 // src/outbox.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync5,
   readFileSync as readFileSync11,
@@ -12887,7 +12987,7 @@ import {
   rmSync as rmSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -12900,10 +13000,10 @@ var Outbox = class {
   // Resolved lazily (per call) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join20(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join22(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join20(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join22(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -12935,7 +13035,7 @@ var Outbox = class {
   // wedging the drain.
   list() {
     const dir2 = this.dir();
-    if (!existsSync14(dir2)) return [];
+    if (!existsSync15(dir2)) return [];
     let names;
     try {
       names = readdirSync5(dir2);
@@ -12945,7 +13045,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join20(dir2, name);
+      const full = join22(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync11(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -12981,7 +13081,7 @@ var Outbox = class {
   // different: it is positive evidence that nothing was ever queued here.
   maxSeqForTurn(turnId) {
     const dir2 = this.dir();
-    if (!existsSync14(dir2)) return 0;
+    if (!existsSync15(dir2)) return 0;
     const names = readdirSync5(dir2);
     const prefix = `${encodeURIComponent(turnId)}__`;
     let max = 0;
@@ -13001,7 +13101,7 @@ var Outbox = class {
   }
   size() {
     const dir2 = this.dir();
-    if (!existsSync14(dir2)) return 0;
+    if (!existsSync15(dir2)) return 0;
     try {
       return readdirSync5(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
@@ -13202,9 +13302,10 @@ var CompanionSupervisor = class {
   // surface, so the UI never disagrees with what is advertised. Null until the
   // first probe.
   harnessSignals = null;
-  // Fresh per attempt, never the cached heartbeat signal: installing a harness
-  // between attempts must be observed immediately.
-  probePresence;
+  // Fresh per connect, cached for the heartbeat: a sign-in between attempts
+  // must be observed immediately, and a heartbeat must spawn nothing.
+  runHarnessCheck;
+  harnessChecks = {};
   exitFn;
   reexecFn;
   dispatcherFactory;
@@ -13248,7 +13349,7 @@ var CompanionSupervisor = class {
     this.log = opts.log;
     this.hub = opts.hub;
     this.resolveBundled = opts.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
-    this.probePresence = opts.probePresence ?? probeHarnessPresence;
+    this.runHarnessCheck = opts.checkHarness ?? ((runtime) => checkHarnessUsable(runtime));
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
@@ -13275,7 +13376,7 @@ var CompanionSupervisor = class {
     });
   }
   dockerRunners() {
-    return runnersEnabled(this.config) && this.config.runners?.provider === "docker";
+    return dockerRunnersConfigured(this.config);
   }
   // Stand up the data plane: pair check, initial assignments pull, then the
   // heartbeat + poll loops. A companion with no device token (logged out) does
@@ -13322,10 +13423,10 @@ var CompanionSupervisor = class {
       else this.log.error({ posture }, `runners: ${summary}`);
       void this.companionStores().refresh();
     }
-    const startupHarnessRefresh = this.refreshHarnessStatuses();
+    const startupHarnessRefresh = this.checkHarnesses().then(() => this.refreshHarnessStatuses());
     this.trackHeartbeat(startupHarnessRefresh);
     if (!this.config.deviceToken) {
-      this.log.warn("This device isn't paired. Run cabane-companion start to pair it.");
+      this.log.warn("This device isn't paired. Run cabane start to pair it.");
       return;
     }
     this.deviceApi = new DeviceApi({
@@ -13361,7 +13462,7 @@ var CompanionSupervisor = class {
       },
       onAuthFailure: () => {
         this.log.error(
-          "Cabane no longer accepts this device. Run cabane-companion logout, then cabane-companion start to pair again."
+          `Cabane no longer accepts this device. Run ${cabane("logout")}, then ${cabane("start")} to pair again.`
         );
       }
     });
@@ -13675,7 +13776,8 @@ var CompanionSupervisor = class {
         intended: isClaudeCodeConnected(this.config),
         bundled: this.bundledStatus("claude-code")
       },
-      codex: { intended: isCodexEnabled(this.config), bundled: this.bundledStatus("codex") }
+      codex: { intended: isCodexEnabled(this.config), bundled: this.bundledStatus("codex") },
+      install: companionInstall()
     });
   }
   // A missing binary is reported ONCE, and again only when the answer CHANGES,
@@ -13817,11 +13919,11 @@ var CompanionSupervisor = class {
     if (this.runnerCommand) return this.runnerCommand;
     return this.dockerRunners() ? ["cabane-companion", "run-turn"] : selfRunnerCommand();
   }
-  buildDispatcher(ctx) {
+  buildDispatcher(ctx2) {
     const hostLocal = localAgentConfig(this.config, {
-      agentId: ctx.agentId,
-      agentUsername: ctx.agentUsername,
-      workspaceSlug: ctx.workspaceSlug
+      agentId: ctx2.agentId,
+      agentUsername: ctx2.agentUsername,
+      workspaceSlug: ctx2.workspaceSlug
     });
     const local = this.dockerRunners() && hostLocal.prepareHook ? {
       ...hostLocal,
@@ -13830,20 +13932,20 @@ var CompanionSupervisor = class {
         command: containerHookPath(hostLocal.prepareHook.command)
       }
     } : hostLocal;
-    if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
+    if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx2, local });
     return new Dispatcher({
       deviceId: this.deviceId ?? void 0,
-      api: ctx.api,
-      baseUrl: ctx.baseUrl,
-      workspaceId: ctx.workspaceId,
-      workspaceSlug: ctx.workspaceSlug,
-      agentId: ctx.agentId,
-      agentUsername: ctx.agentUsername,
-      credential: ctx.credential,
+      api: ctx2.api,
+      baseUrl: ctx2.baseUrl,
+      workspaceId: ctx2.workspaceId,
+      workspaceSlug: ctx2.workspaceSlug,
+      agentId: ctx2.agentId,
+      agentUsername: ctx2.agentUsername,
+      credential: ctx2.credential,
       local,
-      aborts: ctx.aborts,
-      runConfig: ctx.runConfig,
-      log: this.log.child({ agentName: ctx.agentDisplayName ?? ctx.agentUsername }),
+      aborts: ctx2.aborts,
+      runConfig: ctx2.runConfig,
+      log: this.log.child({ agentName: ctx2.agentDisplayName ?? ctx2.agentUsername }),
       // Read PER TURN off the heartbeat's own predicates, so a harness installed
       // or connected after boot works on the next turn exactly as it appears on
       // the next beat, and a runtime advertised by one and refused by the other
@@ -13856,7 +13958,7 @@ var CompanionSupervisor = class {
       // DEFAULT_AGENT_IDLE_TIMEOUT_MS.
       ...positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") !== void 0 ? { idleTimeoutMs: positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") } : {},
       ...positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") !== void 0 ? { totalTimeoutMs: positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") } : {},
-      observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
+      observer: this.hub.observerFor(ctx2.workspaceId, ctx2.agentId, ctx2.workspaceSlug),
       transcriptDir: transcriptsDir(),
       connectorHealth: this.connectorHealth,
       ...runnersEnabled(this.config) ? {
@@ -13867,7 +13969,7 @@ var CompanionSupervisor = class {
           reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
-          sandbox: this.runnerSandboxFor(agentSandbox(this.config, ctx)),
+          sandbox: this.runnerSandboxFor(agentSandbox(this.config, ctx2)),
           policy: this.sandboxPolicy(),
           companionStores: () => this.companionStores().stores()
         }
@@ -14295,23 +14397,23 @@ var CompanionSupervisor = class {
     configureLogger(this.log, next);
   }
   // ---- harnesses ----
-  // Probe all three harnesses, cache signals and versions, and push the snapshot
-  // to the hub. `probeHarnessSignals` never throws, but this is wrapped anyway so
-  // a refresh can never take a heartbeat down.
-  async refreshHarnessStatuses(presence = {}) {
+  // Assemble the signals from the cached sign-in checks, cache versions, and
+  // push the snapshot to the hub. Runs no sign-in check: the heartbeat calls
+  // this. `probeHarnessSignals` never throws, but this is wrapped anyway so a
+  // refresh can never take a heartbeat down.
+  async refreshHarnessStatuses() {
     try {
       const signals = await probeHarnessSignals(this.config, {
-        probePresence: this.probePresence,
-        presence,
+        checks: this.harnessChecks,
         // Through the supervisor's seam, so a test pins the host fact.
         resolveBundled: this.resolveBundled
       });
       this.harnessSignals = signals;
       this.logBundledTransitions();
       this.harnessVersions = {
-        claudeCode: signals.claudeVersion,
+        claudeCode: checkVersion(signals.claudeCheck),
         opencode: signals.opencodeVersion,
-        codex: signals.codexVersion
+        codex: checkVersion(signals.codexCheck)
       };
       this.hub.setHarnesses(deriveHarnessSnapshot(signals).harnesses);
     } catch (err) {
@@ -14321,9 +14423,32 @@ var CompanionSupervisor = class {
       );
     }
   }
+  // Check one bundled harness's sign-in in this process, cache it for the
+  // heartbeat, and — for a harness the user connected — seed connector health,
+  // so Cabane says "sign-in needed" without waiting for a turn to fail. A
+  // check that couldn't answer seeds nothing either way.
+  async checkHarness(runtime) {
+    let check;
+    try {
+      check = await this.runHarnessCheck(runtime);
+    } catch {
+      check = { status: "check_failed", reason: "spawn" };
+    }
+    this.harnessChecks[runtime] = check;
+    const intended = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
+    if (intended && (isUsable(check) || check.status === "signed_out")) {
+      this.connectorHealth.recordLocalCheck(runtime, isUsable(check));
+    }
+    return check;
+  }
+  async checkHarnesses() {
+    if (this.dockerRunners()) return;
+    await Promise.all([this.checkHarness("claude-code"), this.checkHarness("codex")]);
+  }
   // The dashboard "recheck harnesses" control — an immediate re-probe so a user who
   // just installed/started a harness sees it flip without waiting for the next beat.
   async recheckHarnesses() {
+    await this.checkHarnesses();
     await this.refreshHarnessStatuses();
   }
   // Beat NOW and wait for it to land. `start` calls this before asking the
@@ -14343,48 +14468,57 @@ var CompanionSupervisor = class {
   currentConfig() {
     return this.config;
   }
-  // Enable a config-driven harness by flipping the flag the app owns in
+  // Connect a harness by flipping the flag the app owns in
   // `~/.cabane/config.json`. Never installs a binary or drives a login (BYO).
   //
-  // This records INTENT, the user's half: a harness is advertised only when also
-  // its bundled binary resolves, so an enable on a companion whose optional
-  // dependency never installed advertises nothing, and the Harnesses surface
-  // says why.
-  //   - claude-code: `claudeCode.enabled`, after a presence check. The terminal
-  //     offer and the web pairing flow both call this.
-  //   - codex: `codex.enabled`, after a presence check (login stays the user's).
+  // Claude Code and Codex are checked FIRST, in this process — the one that
+  // will run their turns — and an agent that isn't usable here is refused before
+  // anything is written: the terminal, the control socket and the dashboard all
+  // come through here, so they all get the same answer. An agent already
+  // connected is checked too and reported truthfully, with nothing written.
   //   - opencode: `opencode.serverUrl`, ONLY after health-probing the URL; an
   //     unreachable one is a typed failure shown in place.
-  // On success: persist, re-probe and beat at once, so the answer is true in
-  // Cabane promptly either way. Never throws for a valid input.
+  // A connect records INTENT: a harness is advertised only when its bundled
+  // binary also resolves. On success: persist, refresh and beat at once, so the
+  // answer is true in Cabane promptly either way. Never throws for a valid input.
   async enableHarness(input) {
     let next;
-    let checkedPresence = null;
-    if (input.runtime === "claude-code") {
-      const presence = input.presence ?? await this.probePresence("claude-code");
-      if (presence.status !== "present") {
+    let outcome;
+    if (input.runtime === "claude-code" || input.runtime === "codex") {
+      const runtime = input.runtime;
+      const connected = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
+      const check = this.dockerRunners() ? void 0 : await this.checkHarness(runtime);
+      if (check && !isUsable(check)) {
+        await this.refreshHarnessStatuses();
+        this.kickHeartbeat();
+        return { ok: false, outcome: { kind: "refused", runtime, check, connected } };
+      }
+      const label = this.config.deviceLabel;
+      if (connected) {
+        await this.refreshHarnessStatuses();
+        this.kickHeartbeat();
         return {
-          ok: false,
-          error: presenceReason("claude-code", presence.status),
-          presence: true
+          ok: true,
+          outcome: {
+            kind: "already",
+            runtime,
+            ...check ? { check } : {},
+            ...label ? { deviceLabel: label } : {}
+          }
         };
       }
-      checkedPresence = { runtime: "claude-code", result: presence };
-      next = { ...this.config, claudeCode: { enabled: true } };
-    } else if (input.runtime === "codex") {
-      const presence = input.presence ?? await this.probePresence("codex");
-      if (presence.status !== "present") {
-        return { ok: false, error: presenceReason("codex", presence.status), presence: true };
-      }
-      checkedPresence = { runtime: "codex", result: presence };
-      next = { ...this.config, codex: { enabled: true } };
+      next = runtime === "codex" ? { ...this.config, codex: { enabled: true } } : { ...this.config, claudeCode: { enabled: true } };
+      outcome = { kind: "connected", runtime, ...check ? { check } : {} };
     } else {
       const serverUrl = input.serverUrl.trim();
       const parsed = companionConfigSchema.shape.opencode.safeParse({ serverUrl });
       if (!parsed.success) {
         return {
           ok: false,
-          error: "That doesn\u2019t look like a valid URL (e.g. http://127.0.0.1:4096)."
+          outcome: {
+            kind: "opencode",
+            message: "That doesn\u2019t look like a valid URL (e.g. http://127.0.0.1:4096)."
+          }
         };
       }
       const boundedFetch = ((url, init2) => fetch(url, { ...init2, signal: AbortSignal.timeout(4e3) }));
@@ -14392,19 +14526,21 @@ var CompanionSupervisor = class {
       if (version === null) {
         return {
           ok: false,
-          error: `Couldn\u2019t reach an opencode server at ${serverUrl}. Start \`opencode serve\` and check the URL.`
+          outcome: {
+            kind: "opencode",
+            message: `Couldn\u2019t reach an opencode server at ${serverUrl}. Start \`opencode serve\` and check the URL.`
+          }
         };
       }
       next = { ...this.config, opencode: { serverUrl } };
+      outcome = { kind: "connected", runtime: "opencode" };
     }
     this.config = next;
     saveConfig(next);
     this.rebuildDispatchers();
-    await this.refreshHarnessStatuses(
-      checkedPresence ? { [checkedPresence.runtime]: checkedPresence.result } : {}
-    );
+    await this.refreshHarnessStatuses();
     this.kickHeartbeat();
-    return { ok: true };
+    return { ok: true, outcome };
   }
   // Re-create every running agent's Dispatcher from the CURRENT config, keeping
   // the runner (its api, outbox, chains) intact, so constructor-captured options
@@ -14464,9 +14600,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn9 }) => {
+  void import("child_process").then(({ spawn: spawn8 }) => {
     try {
-      const child = spawn9(process.execPath, process.argv.slice(1), {
+      const child = spawn8(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -14536,10 +14672,10 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
+import { join as join23 } from "path";
 function crashMarkerPath() {
-  return join21(cabaneDir(), "last-error.json");
+  return join23(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
@@ -14551,7 +14687,7 @@ function recordCrash(rec) {
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync15(path)) rmSync12(path, { force: true });
+    if (existsSync16(path)) rmSync12(path, { force: true });
   } catch {
   }
 }
@@ -14561,17 +14697,14 @@ async function createCompanionRuntime(opts = {}) {
   const log = getLogger();
   installProcessSafetyNet(log);
   let cfg;
-  let claudeCode;
   try {
-    ({ cfg, claudeOnPath: claudeCode } = await requireStartConfig({
-      ...opts.probeClaude ? { probeClaude: opts.probeClaude } : {},
-      onMigrated: (migrated, onPath) => log.debug(
+    cfg = requireStartConfig({
+      onMigrated: (migrated) => log.debug(
         { claudeCode: isClaudeCodeConnected(migrated) },
-        onPath ? "companion: carried Claude Code over as a connected harness on this device (connectors are now chosen, not detected)" : "companion: no Claude Code on PATH, so this device starts with it disconnected (connectors are now chosen, not detected)"
+        "companion: carried Claude Code over as a connected harness on this device (connectors are now chosen, not detected)"
       )
-    }));
-    await warnAboutHarnessReadiness(cfg, {
-      probeClaude: async () => claudeCode,
+    });
+    warnAboutHarnessReadiness(cfg, {
       // The CLI's onboarding script says this in its own words, so it hands a
       // sink that logs instead. Every other caller keeps the stderr line.
       ...opts.onReadinessWarning ? { warn: opts.onReadinessWarning } : {}
@@ -14586,13 +14719,6 @@ async function createCompanionRuntime(opts = {}) {
     throw err;
   }
   configureLogger(log, cfg);
-  const harnessVersions = await probeHarnessVersions({
-    // Connected AND its CLI answered — the two things that make a
-    // `claude --version` probe worth spawning. Not the offer predicate.
-    claudeCode: claudeCode && isClaudeCodeConnected(cfg),
-    opencodeServerUrl: cfg.opencode?.serverUrl,
-    codex: isCodexEnabled(cfg)
-  });
   const instanceId = randomUUID7();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
@@ -14620,35 +14746,31 @@ async function createCompanionRuntime(opts = {}) {
     config: cfg,
     log,
     hub,
-    harnessVersions
+    ...opts.checkHarness ? { checkHarness: opts.checkHarness } : {}
   });
   await supervisor.start();
   const connectHarness = async (runtime, serverUrl) => {
-    const currentConfig = supervisor.currentConfig();
-    const resolvedServerUrl = runtime === "opencode" ? await resolveOpencodeServerUrl(currentConfig.opencode?.serverUrl, serverUrl) : null;
-    const candidate = runtime === "opencode" ? { ...currentConfig, opencode: { serverUrl: resolvedServerUrl ?? "" } } : currentConfig;
-    const presence = runtime === "opencode" ? void 0 : await probeHarnessPresence(runtime);
-    const verdict = await shakeOutHarness(runtime, candidate, {
-      ...presence ? { presence } : {}
-    });
-    if (verdict === "absent" || verdict === "unusable") {
-      return { ok: false, error: presenceRefusal(runtime, verdict, CLI_PRESENCE_ACTION) };
+    if (runtime !== "opencode") return (await supervisor.enableHarness({ runtime })).outcome;
+    const configured = supervisor.currentConfig().opencode?.serverUrl;
+    const resolved = await resolveOpencodeServerUrl(configured, serverUrl);
+    if (!resolved) {
+      return {
+        kind: "opencode",
+        message: "No opencode server is answering at http://127.0.0.1:4096. Start `opencode serve`, or pass its address with `--url`."
+      };
     }
-    const result = await supervisor.enableHarness(
-      runtime === "opencode" ? { runtime: "opencode", serverUrl: resolvedServerUrl ?? "" } : { runtime, presence }
-    );
-    if (!result.ok) return { ok: false, error: result.error };
-    return { ok: true, message: connectedLine(runtime, verdict) };
+    if (!serverUrl?.trim() && configured === resolved) {
+      const label = supervisor.currentConfig().deviceLabel;
+      return { kind: "already", runtime, ...label ? { deviceLabel: label } : {} };
+    }
+    return (await supervisor.enableHarness({ runtime: "opencode", serverUrl: resolved })).outcome;
   };
   let control = null;
   let dashboard = null;
   try {
     control = await startControlServer({
       status: () => hub.statusJson(),
-      connect: async (runtime, serverUrl) => {
-        const result = await connectHarness(runtime, serverUrl);
-        return result.ok ? { ok: true, message: result.message } : { ok: false, message: result.error };
-      },
+      connect: (runtime, serverUrl) => connectHarness(runtime, serverUrl),
       stop: () => void supervisor.requestStop()
     });
     if (opts.dashboard) {
@@ -14669,7 +14791,8 @@ async function createCompanionRuntime(opts = {}) {
       // marker records whether this companion is backgrounded (foreground start
       // leaves it unset → false).
       daemon: process.env.CABANE_COMPANION_DAEMON === "1",
-      instanceId
+      instanceId,
+      ...installedCommandPath() ? { command: installedCommandPath() } : {}
     });
     clearCrash();
   } catch (err) {