@cabane/companion 0.6.155 → 0.6.157

package/dist/runtime.js

@@ -1,6 +1,294 @@
 // src/runtime.ts
 import { randomUUID as randomUUID7 } from "crypto";
 
+// src/cabane-command.ts
+import { accessSync, constants, realpathSync as realpathSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { delimiter, join as join2, sep as sep2 } from "path";
+
+// src/bundled-binaries.ts
+import { realpathSync, statSync } from "fs";
+import { createRequire } from "module";
+import { homedir } from "os";
+import { dirname, join, sep } from "path";
+import { fileURLToPath } from "url";
+function nodeResolveSelf(specifier) {
+  const here = fileURLToPath(import.meta.url);
+  if (typeof import.meta.resolve === "function") {
+    try {
+      return fileURLToPath(import.meta.resolve(specifier));
+    } catch {
+    }
+  }
+  try {
+    return createRequire(here).resolve(specifier);
+  } catch {
+  }
+  return walkNodeModules(specifier, here);
+}
+function walkNodeModules(pkg2, fromPath) {
+  let dir2 = dirname(fromPath);
+  for (; ; ) {
+    const manifest = join(dir2, "node_modules", pkg2, "package.json");
+    if (nodeIsFile(manifest)) {
+      try {
+        return realpathSync(manifest);
+      } catch {
+        return manifest;
+      }
+    }
+    const parent = dirname(dir2);
+    if (parent === dir2) return null;
+    dir2 = parent;
+  }
+}
+function nodeResolve(specifier, fromPath) {
+  try {
+    return createRequire(fromPath).resolve(specifier);
+  } catch {
+    return null;
+  }
+}
+function nodeIsFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function detectPreferMusl(platform = process.platform) {
+  if (platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  const header = report?.header;
+  return report != null && header?.glibcVersionRuntime === void 0;
+}
+function defaultResolveEnv() {
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    preferMusl: detectPreferMusl(),
+    // Both resolutions start from this module, which tsup bundles into
+    // `dist/cli.js` and `dist/postinstall.js` — both at the package's `dist/`
+    // root — so one environment serves the runtime checks and the install
+    // verifier alike.
+    resolveSelf: nodeResolveSelf,
+    resolve: nodeResolve,
+    isFile: nodeIsFile
+  };
+}
+var CLAUDE_SDK = "@anthropic-ai/claude-agent-sdk";
+function claudePlatformPackages(platform, arch, preferMusl) {
+  if (platform === "android") return [`${CLAUDE_SDK}-linux-${arch}-android`];
+  if (platform === "linux") {
+    return preferMusl ? [`${CLAUDE_SDK}-linux-${arch}-musl`, `${CLAUDE_SDK}-linux-${arch}`] : [`${CLAUDE_SDK}-linux-${arch}`, `${CLAUDE_SDK}-linux-${arch}-musl`];
+  }
+  return [`${CLAUDE_SDK}-${platform}-${arch}`];
+}
+function resolveClaude(env) {
+  const candidates = claudePlatformPackages(env.platform, env.arch, env.preferMusl);
+  const base = {
+    runtime: "claude-code",
+    packageName: candidates[0] ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  const sdkEntry = env.resolveSelf(CLAUDE_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  let sawPackage = null;
+  for (const pkg2 of candidates) {
+    const manifest = env.resolve(`${pkg2}/package.json`, sdkEntry);
+    if (!manifest) continue;
+    sawPackage ??= pkg2;
+    const exe = join(dirname(manifest), env.platform === "win32" ? "claude.exe" : "claude");
+    if (env.isFile(exe)) {
+      return { ...base, packageName: pkg2, status: "present", path: exe };
+    }
+  }
+  return sawPackage ? { ...base, packageName: sawPackage, status: "executable_missing", path: null } : { ...base, status: "platform_package_missing", path: null };
+}
+var CODEX_SDK = "@openai/codex-sdk";
+var CODEX_CLI = "@openai/codex";
+function codexTargetTriple(platform, arch) {
+  if (platform === "linux" || platform === "android") {
+    if (arch === "x64") return "x86_64-unknown-linux-musl";
+    if (arch === "arm64") return "aarch64-unknown-linux-musl";
+    return null;
+  }
+  if (platform === "darwin") {
+    if (arch === "x64") return "x86_64-apple-darwin";
+    if (arch === "arm64") return "aarch64-apple-darwin";
+    return null;
+  }
+  if (platform === "win32") {
+    if (arch === "x64") return "x86_64-pc-windows-msvc";
+    if (arch === "arm64") return "aarch64-pc-windows-msvc";
+    return null;
+  }
+  return null;
+}
+var CODEX_PACKAGE_BY_TRIPLE = {
+  "x86_64-unknown-linux-musl": `${CODEX_CLI}-linux-x64`,
+  "aarch64-unknown-linux-musl": `${CODEX_CLI}-linux-arm64`,
+  "x86_64-apple-darwin": `${CODEX_CLI}-darwin-x64`,
+  "aarch64-apple-darwin": `${CODEX_CLI}-darwin-arm64`,
+  "x86_64-pc-windows-msvc": `${CODEX_CLI}-win32-x64`,
+  "aarch64-pc-windows-msvc": `${CODEX_CLI}-win32-arm64`
+};
+function resolveCodex(env) {
+  const triple = codexTargetTriple(env.platform, env.arch);
+  const pkg2 = triple ? CODEX_PACKAGE_BY_TRIPLE[triple] : void 0;
+  const base = {
+    runtime: "codex",
+    packageName: pkg2 ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  if (!triple || !pkg2) return { ...base, status: "platform_package_missing", path: null };
+  const sdkEntry = env.resolveSelf(CODEX_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  const cliManifest = env.resolve(`${CODEX_CLI}/package.json`, sdkEntry);
+  if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
+  const platformManifest = env.resolve(`${pkg2}/package.json`, cliManifest);
+  if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
+  const packageRoot = join(dirname(platformManifest), "vendor", triple);
+  const exeName = env.platform === "win32" ? "codex.exe" : "codex";
+  const current = join(packageRoot, "bin", exeName);
+  if (env.isFile(current) && env.isFile(join(packageRoot, "codex-package.json"))) {
+    return { ...base, status: "present", path: current };
+  }
+  const legacy = join(packageRoot, "codex", exeName);
+  if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
+  return { ...base, status: "executable_missing", path: null };
+}
+function resolveBundledBinary(runtime, env = defaultResolveEnv()) {
+  try {
+    return runtime === "codex" ? resolveCodex(env) : resolveClaude(env);
+  } catch {
+    return {
+      runtime,
+      status: "platform_package_missing",
+      path: null,
+      packageName: null,
+      platform: env.platform,
+      arch: env.arch
+    };
+  }
+}
+var HARNESS_LABEL = {
+  "claude-code": "Claude Code",
+  codex: "Codex"
+};
+var HARNESS_INTENT_WORD = {
+  "claude-code": "connected",
+  codex: "enabled"
+};
+function missingNoun(status) {
+  return status === "executable_missing" ? "executable" : "platform package";
+}
+var INSTALL_SCRIPT_COMMAND = "curl -fsSL https://cabane.ai/install.sh | bash";
+function companionInstall(execPath = process.execPath, home = homedir()) {
+  const real = (path) => {
+    try {
+      return realpathSync(path);
+    } catch {
+      return path;
+    }
+  };
+  const scriptNode = join(real(home), ".cabane", "node") + sep;
+  return real(execPath).startsWith(scriptNode) ? "script" : "npm";
+}
+function repairCommands(install = companionInstall()) {
+  return install === "script" ? [INSTALL_SCRIPT_COMMAND] : ["npm i -g @cabane/companion --include=optional"];
+}
+function repairAction(install = companionInstall()) {
+  return `Reinstall with \`${repairCommands(install)[0]}\`.`;
+}
+function startupWarning(r) {
+  const label = HARNESS_LABEL[r.runtime];
+  return `${label} is ${HARNESS_INTENT_WORD[r.runtime]}, but its installation is incomplete (${missingNoun(r.status)} is missing). It cannot run turns until repaired. ${repairAction()} Then restart the companion.`;
+}
+function harnessIssueNote(runtime, status, install = companionInstall()) {
+  const intent = HARNESS_INTENT_WORD[runtime];
+  const capitalized = `${intent[0].toUpperCase()}${intent.slice(1)}`;
+  return `${capitalized}, but @cabane/companion's bundled ${HARNESS_LABEL[runtime]} ${missingNoun(status)} is missing. ${repairAction(install)} Then restart the companion.`;
+}
+function turnIncompleteCopy(runtime) {
+  return `**This device's ${HARNESS_LABEL[runtime]} runtime is incomplete.** ${repairAction()} Restart it, then try again.`;
+}
+
+// src/cli-entry.ts
+import { existsSync } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var RELATIVE_CANDIDATES = ["./cli.js", "../dist/cli.js", "../cli.js"];
+function companionCliEntry(deps = {}) {
+  const exists = deps.exists ?? existsSync;
+  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath2(new URL(rel, import.meta.url)));
+  for (const candidate of candidates) {
+    if (exists(candidate)) return candidate;
+  }
+  const argv1 = "argv1" in deps ? deps.argv1 : process.argv[1];
+  if (argv1 && exists(argv1)) return argv1;
+  return candidates[0] ?? "";
+}
+
+// src/term.ts
+import { createInterface } from "readline";
+import { homedir as homedir2 } from "os";
+import pc from "picocolors";
+function tildePath(path, home = homedir2()) {
+  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
+  return path;
+}
+
+// src/cabane-command.ts
+function installedCommandPath(deps = {}) {
+  const install = deps.install ?? companionInstall();
+  const home = deps.home ?? homedir3();
+  if (install === "script") return join2(home, ".cabane", "bin", "cabane");
+  const entry = deps.cliEntry ?? companionCliEntry();
+  const marker = `${sep2}lib${sep2}node_modules${sep2}@cabane${sep2}companion${sep2}`;
+  const at = entry.indexOf(marker);
+  if (at < 0) return null;
+  return join2(entry.slice(0, at), "bin", "cabane");
+}
+function cabaneCommand(deps = {}) {
+  const own = installedCommandPath(deps);
+  if (!own) return "cabane";
+  const realpath = deps.realpath ?? safeRealpath;
+  const isExecutable = deps.isExecutable ?? executable;
+  const ownReal = realpath(own);
+  if (!ownReal) return "cabane";
+  const onPath = firstOnPath("cabane", "path" in deps ? deps.path : process.env.PATH, isExecutable);
+  if (onPath && realpath(onPath) === ownReal) return "cabane";
+  return tildePath(own, deps.home);
+}
+function cabane(rest, deps) {
+  return `${cabaneCommand(deps)} ${rest}`;
+}
+function firstOnPath(name, path, isExecutable = executable) {
+  for (const dir2 of (path ?? "").split(delimiter)) {
+    if (!dir2) continue;
+    const candidate = join2(dir2, name);
+    if (isExecutable(candidate)) return candidate;
+  }
+  return null;
+}
+function executable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function safeRealpath(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return null;
+  }
+}
+
 // src/config.ts
 import {
   chmodSync,
@@ -9,10 +297,10 @@ import {
   renameSync,
   rmSync,
   writeFileSync,
-  existsSync
+  existsSync as existsSync2
 } from "fs";
-import { homedir, userInfo } from "os";
-import { dirname, join } from "path";
+import { homedir as homedir4, userInfo } from "os";
+import { dirname as dirname2, join as join3 } from "path";
 import { z as z2 } from "zod";
 
 // src/errors.ts
@@ -225,13 +513,13 @@ function realAccountHome() {
   return realHomeCache;
 }
 function agentCompanionHome() {
-  return join(cabaneDir(), "agent-home");
+  return join3(cabaneDir(), "agent-home");
 }
 function cabaneDir() {
-  const dir2 = join(process.env.CABANE_COMPANION_HOME || homedir(), ".cabane");
+  const dir2 = join3(process.env.CABANE_COMPANION_HOME || homedir4(), ".cabane");
   if (process.env.VITEST) {
     const real = realAccountHome();
-    if (real && dir2 === join(real, ".cabane")) {
+    if (real && dir2 === join3(real, ".cabane")) {
       throw new Error(
         `cabaneDir() resolved to the real ${dir2} during a test run. Companion tests must swap process.env.HOME to a tmp dir before touching the config dir; this guard prevents wiping the operator's real companion config (see apps/companion/test/setup-home.ts).`
       );
@@ -240,7 +528,7 @@ function cabaneDir() {
   return dir2;
 }
 function configPath() {
-  return join(cabaneDir(), "config.json");
+  return join3(cabaneDir(), "config.json");
 }
 var localAgentConfigSchema = z2.object({
   cwd: z2.string().optional(),
@@ -259,11 +547,11 @@ var localAgentConfigSchema = z2.object({
   sandbox: z2.enum(["os", "none"]).optional()
 }).strict();
 var AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx) => {
+var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx2) => {
   for (const [key, row] of Object.entries(agents)) {
     if (row.sandbox === void 0) continue;
     if (AGENT_ID_KEY.test(key)) continue;
-    ctx.addIssue({
+    ctx2.addIssue({
       code: z2.ZodIssueCode.custom,
       path: [key, "sandbox"],
       message: "a sandbox exception must name one agent \u2014 key the row by the agent's id (shown in Cabane), not a username or workspace-slug/username"
@@ -314,15 +602,33 @@ var companionConfigSchema = z2.object({
   // the Agent SDK's bundled executable resolves (not `claude` on PATH, which the
   // SDK never runs).
   //
-  // The block's PRESENCE is also the migration marker
-  // (`migrateConnectedHarnesses`): absent means a config whose user was never
-  // asked. So every config written carries it, a fresh pair at `enabled: false`.
+  // Absent means one of two things, told apart by `harnessesChosen`: a legacy
+  // config whose user was never asked (`migrateConnectedHarnesses`), or a
+  // device that has never been offered Claude Code. `enabled: false` is a
+  // decline, and `start` doesn't offer it again.
   //
   // Not the per-agent `agents.<key>.claudeCode.autoMemory`, one agent's memory
   // switch.
   claudeCode: z2.object({
     enabled: z2.boolean().optional()
   }).strict().optional(),
+  // Written by every pairing that asks which agents to connect. With it, an
+  // absent `claudeCode` block means "never offered"; without it, the block's
+  // absence marks a config from before connectors were chosen.
+  harnessesChosen: z2.boolean().optional(),
+  // Whether this companion keeps itself current: installs the version Cabane names, between
+  // turns, and rolls back one that doesn't come up (`updater.ts`). Absent means never asked,
+  // which `start` offers; off either way until someone says yes.
+  update: z2.object({
+    auto: z2.boolean()
+  }).strict().optional(),
+  // The answer to `start`'s "start at boot?" when it was no, so it isn't asked again.
+  // `cabane service install` still installs it.
+  serviceDeclined: z2.boolean().optional(),
+  // OpenCode's decline. Its block is an address, so a decline can't live there
+  // the way `claudeCode`/`codex` `enabled: false` does; without it a declined
+  // serve would be offered again on every `start`.
+  opencodeDeclined: z2.boolean().optional(),
   // Codex is a local CLI the SDK spawns per turn, so this is an opt-in flag, not
   // an address. The operator logs in (`codex login` or `CODEX_API_KEY`; Cabane
   // never sees the key). The block's presence enables it; `enabled: false` turns
@@ -377,6 +683,9 @@ var companionConfigSchema = z2.object({
 function runnersEnabled(cfg) {
   return cfg.runners?.enabled === true;
 }
+function dockerRunnersConfigured(cfg) {
+  return runnersEnabled(cfg) && cfg.runners?.provider === "docker";
+}
 function runnerStateDir() {
   return process.env.CABANE_RUNNER_STATE_DIR || cabaneDir();
 }
@@ -386,9 +695,9 @@ function isCodexEnabled(cfg) {
 function isClaudeCodeConnected(cfg) {
   return !!cfg.claudeCode && cfg.claudeCode.enabled !== false;
 }
-function migrateConnectedHarnesses(cfg, claudeOnPath2) {
-  if (cfg.claudeCode !== void 0) return null;
-  return { ...cfg, claudeCode: { enabled: claudeOnPath2 } };
+function migrateConnectedHarnesses(cfg) {
+  if (cfg.claudeCode !== void 0 || cfg.harnessesChosen) return null;
+  return { ...cfg, claudeCode: { enabled: true } };
 }
 function localAgentConfig(cfg, agent) {
   const map = cfg.agents ?? {};
@@ -420,7 +729,7 @@ function agentSandboxRows(cfg) {
 }
 function loadConfig() {
   const path = configPath();
-  if (!existsSync(path)) return null;
+  if (!existsSync2(path)) return null;
   let raw;
   try {
     raw = readFileSync(path, "utf8");
@@ -447,14 +756,14 @@ function loadConfig() {
       );
     }
     throw new ConfigError(
-      `${path} is from an incompatible or older version of the companion, or was hand-edited. Run \`cabane-companion pair\` to re-pair, or \`cabane-companion logout --purge\` to reset.`
+      `${path} is from an incompatible or older version of the companion, or was hand-edited. Run \`${cabane("pair")}\` to re-pair, or \`${cabane("logout --purge")}\` to reset.`
     );
   }
   return result.data;
 }
 function saveConfig(cfg) {
   const path = configPath();
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   try {
     chmodSync(cabaneDir(), 448);
   } catch {
@@ -479,77 +788,38 @@ function requireConfig() {
   const cfg = loadConfig();
   if (!cfg) {
     throw new ConfigError(
-      "this companion is not paired. Run `cabane-companion pair` \u2014 it shows a short code \u2014 then enter that code in the cabane app (Settings \u2192 Companions) to connect this machine."
+      `this companion is not paired. Run \`${cabane("start")}\` \u2014 it shows a short code \u2014 then enter that code in the cabane app (Settings \u2192 Companions) to connect this machine.`
     );
   }
   return cfg;
 }
 
 // src/dashboard/server.ts
-import { dirname as dirname4, join as join5 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname4, join as join7 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 
 // src/dashboard/routes.ts
-import { openSync, readSync, closeSync, fstatSync, existsSync as existsSync2 } from "fs";
+import { openSync as openSync2, readSync, closeSync, fstatSync, existsSync as existsSync3 } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join4, normalize } from "path";
+import { extname, join as join6, normalize } from "path";
 import { streamSSE } from "hono/streaming";
 
-// src/harness-check.ts
-import { spawn as spawn3 } from "child_process";
+// src/harness-copy.ts
+import { homedir as homedir5 } from "os";
+import { join as join4 } from "path";
 
-// src/harness-versions.ts
+// src/harness-usable.ts
 import { spawn as spawn2 } from "child_process";
+
+// src/harness-versions.ts
 var EMPTY = { claudeCode: null, opencode: null, codex: null };
-var CLI_PROBE_TIMEOUT_MS = 4e3;
 function parseVersionToken(raw) {
   if (!raw) return null;
   const m = raw.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
   return m ? m[0] : null;
 }
-function probeCliPresence(command, spawnImpl = spawn2) {
-  return new Promise((resolve2) => {
-    let settled = false;
-    let timer = null;
-    const done = (result) => {
-      if (!settled) {
-        settled = true;
-        if (timer) clearTimeout(timer);
-        resolve2(result);
-      }
-    };
-    let child;
-    try {
-      child = spawnImpl(command, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
-    } catch {
-      done({ status: "absent" });
-      return;
-    }
-    let out = "";
-    child.stdout?.on("data", (chunk) => {
-      if (out.length < 4096) out += chunk.toString();
-    });
-    timer = setTimeout(() => {
-      child.kill?.("SIGKILL");
-      done({ status: "unusable" });
-    }, CLI_PROBE_TIMEOUT_MS);
-    timer.unref?.();
-    child.once("error", () => done({ status: "absent" }));
-    child.once("exit", (code) => {
-      const version = code === 0 ? parseVersionToken(out) : null;
-      done(version ? { status: "present", version } : { status: "unusable" });
-    });
-  });
-}
-function probeHarnessPresence(runtime, spawnImpl = spawn2) {
-  return probeCliPresence(runtime === "codex" ? "codex" : "claude", spawnImpl);
-}
-async function probeCliVersion(command, spawnImpl = spawn2) {
-  const result = await probeCliPresence(command, spawnImpl);
-  return result.status === "present" ? result.version : null;
-}
 async function probeOpencodeVersion(serverUrl, fetchImpl = fetch) {
   try {
     const base = serverUrl.endsWith("/") ? serverUrl.slice(0, -1) : serverUrl;
@@ -577,236 +847,98 @@ function extractOpencodeVersion(json) {
   }
   return null;
 }
-async function probeHarnessVersions(opts, deps = {}) {
-  const probeClaudeCode = deps.probeClaudeCode ?? (() => probeCliVersion("claude"));
-  const probeCodex = deps.probeCodex ?? (() => probeCliVersion("codex"));
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
-  const [claudeCode, codex, opencode] = await Promise.all([
-    opts.claudeCode ? safe(probeClaudeCode) : Promise.resolve(null),
-    opts.codex ? safe(probeCodex) : Promise.resolve(null),
-    opts.opencodeServerUrl ? safe(() => probeOpencode(opts.opencodeServerUrl)) : Promise.resolve(null)
-  ]);
-  return { claudeCode, opencode, codex };
-}
 function emptyHarnessVersions() {
   return { ...EMPTY };
 }
-async function safe(fn) {
-  try {
-    return await fn();
-  } catch {
-    return null;
-  }
-}
 
-// src/bundled-binaries.ts
-import { realpathSync, statSync } from "fs";
-import { createRequire } from "module";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2, sep } from "path";
-import { fileURLToPath } from "url";
-function nodeResolveSelf(specifier) {
-  const here = fileURLToPath(import.meta.url);
-  if (typeof import.meta.resolve === "function") {
-    try {
-      return fileURLToPath(import.meta.resolve(specifier));
-    } catch {
-    }
-  }
-  try {
-    return createRequire(here).resolve(specifier);
-  } catch {
-  }
-  return walkNodeModules(specifier, here);
+// src/harness-usable.ts
+function isUsable(check) {
+  return check.status === "signed_in" || check.status === "api_key";
 }
-function walkNodeModules(pkg2, fromPath) {
-  let dir2 = dirname2(fromPath);
-  for (; ; ) {
-    const manifest = join2(dir2, "node_modules", pkg2, "package.json");
-    if (nodeIsFile(manifest)) {
-      try {
-        return realpathSync(manifest);
-      } catch {
-        return manifest;
-      }
-    }
-    const parent = dirname2(dir2);
-    if (parent === dir2) return null;
-    dir2 = parent;
-  }
+var API_KEY_VARIABLES = {
+  "claude-code": ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"],
+  codex: ["CODEX_API_KEY"]
+};
+function apiKeyVariable(runtime, env = process.env) {
+  return API_KEY_VARIABLES[runtime].find((name) => !!env[name]?.trim()) ?? null;
 }
-function nodeResolve(specifier, fromPath) {
-  try {
-    return createRequire(fromPath).resolve(specifier);
-  } catch {
-    return null;
+var CHECK_TIMEOUT_MS = 5e3;
+async function checkHarnessUsable(runtime, deps = {}) {
+  const env = deps.env ?? process.env;
+  const resolveBundled = deps.resolveBundled ?? ((r) => resolveBundledBinary(r));
+  const run = deps.run ?? runBounded;
+  const resolution = resolveBundled(runtime);
+  if (resolution.status !== "present" || !resolution.path) {
+    return {
+      status: "bundle_missing",
+      bundled: resolution.status === "present" ? "executable_missing" : resolution.status
+    };
   }
-}
-function nodeIsFile(path) {
+  const path = resolution.path;
+  const version = run(path, ["--version"], env).then(
+    (r) => r.code === 0 ? parseVersionToken(r.output) : null
+  );
+  const variable = apiKeyVariable(runtime, env);
+  if (variable) return { status: "api_key", variable, version: await version };
+  const statusArgs = runtime === "codex" ? ["login", "status"] : ["auth", "status", "--json"];
+  const [answer, v] = await Promise.all([run(path, statusArgs, env), version]);
+  if (answer.error) return { status: "check_failed", reason: answer.error };
+  const signedIn = runtime === "codex" ? readCodexStatus(answer) : readClaudeStatus(answer);
+  if (typeof signedIn === "string") return { status: "check_failed", reason: signedIn };
+  return signedIn ? { status: "signed_in", version: v } : { status: "signed_out", version: v };
+}
+function readClaudeStatus(answer) {
+  const start = answer.output.indexOf("{");
+  const end = answer.output.lastIndexOf("}");
+  if (start < 0 || end < start) return "unreadable";
   try {
-    return statSync(path).isFile();
+    const parsed = JSON.parse(answer.output.slice(start, end + 1));
+    const loggedIn = parsed?.loggedIn;
+    return typeof loggedIn === "boolean" ? loggedIn : "unreadable";
   } catch {
-    return false;
-  }
-}
-function detectPreferMusl(platform = process.platform) {
-  if (platform !== "linux") return false;
-  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
-  const header = report?.header;
-  return report != null && header?.glibcVersionRuntime === void 0;
-}
-function defaultResolveEnv() {
-  return {
-    platform: process.platform,
-    arch: process.arch,
-    preferMusl: detectPreferMusl(),
-    // Both resolutions start from this module, which tsup bundles into
-    // `dist/cli.js` and `dist/postinstall.js` — both at the package's `dist/`
-    // root — so one environment serves the runtime checks and the install
-    // verifier alike.
-    resolveSelf: nodeResolveSelf,
-    resolve: nodeResolve,
-    isFile: nodeIsFile
-  };
-}
-var CLAUDE_SDK = "@anthropic-ai/claude-agent-sdk";
-function claudePlatformPackages(platform, arch, preferMusl) {
-  if (platform === "android") return [`${CLAUDE_SDK}-linux-${arch}-android`];
-  if (platform === "linux") {
-    return preferMusl ? [`${CLAUDE_SDK}-linux-${arch}-musl`, `${CLAUDE_SDK}-linux-${arch}`] : [`${CLAUDE_SDK}-linux-${arch}`, `${CLAUDE_SDK}-linux-${arch}-musl`];
+    return "unreadable";
   }
-  return [`${CLAUDE_SDK}-${platform}-${arch}`];
 }
-function resolveClaude(env) {
-  const candidates = claudePlatformPackages(env.platform, env.arch, env.preferMusl);
-  const base = {
-    runtime: "claude-code",
-    packageName: candidates[0] ?? null,
-    platform: env.platform,
-    arch: env.arch
-  };
-  const sdkEntry = env.resolveSelf(CLAUDE_SDK);
-  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
-  let sawPackage = null;
-  for (const pkg2 of candidates) {
-    const manifest = env.resolve(`${pkg2}/package.json`, sdkEntry);
-    if (!manifest) continue;
-    sawPackage ??= pkg2;
-    const exe = join2(dirname2(manifest), env.platform === "win32" ? "claude.exe" : "claude");
-    if (env.isFile(exe)) {
-      return { ...base, packageName: pkg2, status: "present", path: exe };
-    }
-  }
-  return sawPackage ? { ...base, packageName: sawPackage, status: "executable_missing", path: null } : { ...base, status: "platform_package_missing", path: null };
-}
-var CODEX_SDK = "@openai/codex-sdk";
-var CODEX_CLI = "@openai/codex";
-function codexTargetTriple(platform, arch) {
-  if (platform === "linux" || platform === "android") {
-    if (arch === "x64") return "x86_64-unknown-linux-musl";
-    if (arch === "arm64") return "aarch64-unknown-linux-musl";
-    return null;
-  }
-  if (platform === "darwin") {
-    if (arch === "x64") return "x86_64-apple-darwin";
-    if (arch === "arm64") return "aarch64-apple-darwin";
-    return null;
-  }
-  if (platform === "win32") {
-    if (arch === "x64") return "x86_64-pc-windows-msvc";
-    if (arch === "arm64") return "aarch64-pc-windows-msvc";
-    return null;
-  }
-  return null;
-}
-var CODEX_PACKAGE_BY_TRIPLE = {
-  "x86_64-unknown-linux-musl": `${CODEX_CLI}-linux-x64`,
-  "aarch64-unknown-linux-musl": `${CODEX_CLI}-linux-arm64`,
-  "x86_64-apple-darwin": `${CODEX_CLI}-darwin-x64`,
-  "aarch64-apple-darwin": `${CODEX_CLI}-darwin-arm64`,
-  "x86_64-pc-windows-msvc": `${CODEX_CLI}-win32-x64`,
-  "aarch64-pc-windows-msvc": `${CODEX_CLI}-win32-arm64`
-};
-function resolveCodex(env) {
-  const triple = codexTargetTriple(env.platform, env.arch);
-  const pkg2 = triple ? CODEX_PACKAGE_BY_TRIPLE[triple] : void 0;
-  const base = {
-    runtime: "codex",
-    packageName: pkg2 ?? null,
-    platform: env.platform,
-    arch: env.arch
-  };
-  if (!triple || !pkg2) return { ...base, status: "platform_package_missing", path: null };
-  const sdkEntry = env.resolveSelf(CODEX_SDK);
-  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
-  const cliManifest = env.resolve(`${CODEX_CLI}/package.json`, sdkEntry);
-  if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
-  const platformManifest = env.resolve(`${pkg2}/package.json`, cliManifest);
-  if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
-  const packageRoot = join2(dirname2(platformManifest), "vendor", triple);
-  const exeName = env.platform === "win32" ? "codex.exe" : "codex";
-  const current = join2(packageRoot, "bin", exeName);
-  if (env.isFile(current) && env.isFile(join2(packageRoot, "codex-package.json"))) {
-    return { ...base, status: "present", path: current };
-  }
-  const legacy = join2(packageRoot, "codex", exeName);
-  if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
-  return { ...base, status: "executable_missing", path: null };
+function readCodexStatus(answer) {
+  if (answer.code === 0) return true;
+  if (/not logged in/i.test(answer.output)) return false;
+  if (/config/i.test(answer.output)) return "config";
+  return "unreadable";
 }
-function resolveBundledBinary(runtime, env = defaultResolveEnv()) {
-  try {
-    return runtime === "codex" ? resolveCodex(env) : resolveClaude(env);
-  } catch {
-    return {
-      runtime,
-      status: "platform_package_missing",
-      path: null,
-      packageName: null,
-      platform: env.platform,
-      arch: env.arch
+function runBounded(path, args, env) {
+  return new Promise((resolve2) => {
+    let settled = false;
+    let out = "";
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve2(result);
     };
-  }
-}
-var HARNESS_LABEL = {
-  "claude-code": "Claude Code",
-  codex: "Codex"
-};
-var HARNESS_INTENT_WORD = {
-  "claude-code": "connected",
-  codex: "enabled"
-};
-function missingNoun(status) {
-  return status === "executable_missing" ? "executable" : "platform package";
-}
-var INSTALL_SCRIPT_COMMAND = "curl -fsSL https://cabane.ai/install.sh | bash";
-function companionInstall(execPath = process.execPath, home = homedir2()) {
-  const real = (path) => {
+    let child;
     try {
-      return realpathSync(path);
+      child = spawn2(path, args, { stdio: ["ignore", "pipe", "pipe"], env });
     } catch {
-      return path;
+      resolve2({ code: null, output: "", error: "spawn" });
+      return;
     }
-  };
-  const scriptNode = join2(real(home), ".cabane", "node") + sep;
-  return real(execPath).startsWith(scriptNode) ? "script" : "npm";
-}
-function repairCommands(install = companionInstall()) {
-  return install === "script" ? [INSTALL_SCRIPT_COMMAND] : ["npm i -g @cabane/companion --include=optional"];
-}
-function repairAction(install = companionInstall()) {
-  return `Reinstall with \`${repairCommands(install)[0]}\`.`;
-}
-function startupWarning(r) {
-  const label = HARNESS_LABEL[r.runtime];
-  return `${label} is ${HARNESS_INTENT_WORD[r.runtime]}, but its installation is incomplete (${missingNoun(r.status)} is missing). It cannot run turns until repaired. ${repairAction()} Then restart the companion.`;
-}
-function harnessIssueNote(runtime, status, install = companionInstall()) {
-  const intent = HARNESS_INTENT_WORD[runtime];
-  const capitalized = `${intent[0].toUpperCase()}${intent.slice(1)}`;
-  return `${capitalized}, but @cabane/companion's bundled ${HARNESS_LABEL[runtime]} ${missingNoun(status)} is missing. ${repairAction(install)} Then restart the companion.`;
+    const capture = (chunk) => {
+      if (out.length < 8192) out += chunk.toString();
+    };
+    child.stdout?.on("data", capture);
+    child.stderr?.on("data", capture);
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      done({ code: null, output: out, error: "timeout" });
+    }, CHECK_TIMEOUT_MS);
+    timer.unref?.();
+    child.once("error", () => done({ code: null, output: out, error: "spawn" }));
+    child.once("close", (code) => done({ code, output: out }));
+  });
 }
-function turnIncompleteCopy(runtime) {
-  return `**This device's ${HARNESS_LABEL[runtime]} runtime is incomplete.** ${repairAction()} Restart it, then try again.`;
+function checkVersion(check) {
+  if (!check) return null;
+  return check.status === "signed_in" || check.status === "api_key" || check.status === "signed_out" ? check.version : null;
 }
 
 // src/manifest.ts
@@ -864,13 +996,15 @@ function deriveHarnessSnapshot(signals) {
 }
 function deriveClaudeCode(signals, manifestHas) {
   const base = { runtime: "claude-code", label: LABELS["claude-code"] };
+  const version = checkVersion(signals.claudeCheck);
   if (manifestHas) {
     return {
       ...base,
       state: "exposed",
-      version: signals.claudeVersion,
-      detail: "Claude Code is connected and exposed to Cabane.",
-      enable: null
+      version,
+      detail: exposedDetail("claude-code", signals.claudeCheck),
+      enable: null,
+      signIn: signals.claudeCheck?.status ?? null
     };
   }
   if (signals.claudeCodeConnected) {
@@ -879,37 +1013,56 @@ function deriveClaudeCode(signals, manifestHas) {
       state: "needs_attention",
       version: null,
       detail: harnessIssueNote("claude-code", signals.claudeBundled),
-      enable: null
+      enable: null,
+      signIn: signals.claudeCheck?.status ?? null
     };
   }
-  if (signals.claudeOnPath) {
+  if (signals.claudeCheck && isUsable(signals.claudeCheck)) {
     return {
       ...base,
       state: "detected_not_exposed",
-      version: signals.claudeVersion,
-      // Connecting records INTENT, not runnability: with the bundled binary
-      // missing a connect succeeds and nothing is advertised, so say so.
-      detail: signals.claudeBundled === "present" ? "Claude Code is installed here but not connected yet. Connect it to offer Claude Code from this device." : `Claude Code is installed here but not connected yet \u2014 and @cabane/companion's bundled Claude Code ${missingNoun(signals.claudeBundled)} is missing, so connecting alone won't make it runnable. ${repairAction()}`,
-      enable: "claude-code"
+      version,
+      detail: `${usableLine("claude-code", signals.claudeCheck)} Connect it to offer Claude Code from this device.`,
+      enable: "claude-code",
+      signIn: signals.claudeCheck?.status ?? null
     };
   }
   return {
     ...base,
     state: "not_detected",
     version: null,
-    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then connect it here.",
-    enable: null
+    detail: notUsableDetail("claude-code", signals.claudeCheck),
+    enable: null,
+    signIn: signals.claudeCheck?.status ?? null
   };
 }
+function exposedDetail(runtime, check) {
+  const label = LABELS[runtime];
+  const problem = check ? unusableReason(runtime, check) : null;
+  if (problem) return problem;
+  if (check?.status === "signed_out") {
+    const login = runtime === "codex" ? "codex login" : "claude auth login";
+    return `${label} is connected, but signed out on this computer. Run \`${login}\` to use it again.`;
+  }
+  if (check?.status === "api_key") return `${label} is connected with an API key configured.`;
+  return `${label} is connected and exposed to Cabane.`;
+}
+function notUsableDetail(runtime, check) {
+  const problem = check ? unusableReason(runtime, check) : null;
+  if (problem) return problem;
+  return runtime === "codex" ? "Not signed in on this computer. Sign in with `codex login`, then enable it here." : "Not signed in on this computer. Sign in with `claude auth login`, then connect it here.";
+}
 function deriveCodex(signals, manifestHas) {
   const base = { runtime: "codex", label: LABELS.codex };
+  const version = checkVersion(signals.codexCheck);
   if (manifestHas) {
     return {
       ...base,
       state: "exposed",
-      version: signals.codexVersion,
-      detail: "Codex is enabled and exposed to Cabane.",
-      enable: null
+      version,
+      detail: exposedDetail("codex", signals.codexCheck),
+      enable: null,
+      signIn: signals.codexCheck?.status ?? null
     };
   }
   if (signals.codexEnabled) {
@@ -918,25 +1071,27 @@ function deriveCodex(signals, manifestHas) {
       state: "needs_attention",
       version: null,
       detail: harnessIssueNote("codex", signals.codexBundled),
-      enable: null
+      enable: null,
+      signIn: signals.codexCheck?.status ?? null
     };
   }
-  if (signals.codexOnPath) {
+  if (signals.codexCheck && isUsable(signals.codexCheck)) {
     return {
       ...base,
       state: "detected_not_exposed",
-      version: signals.codexVersion,
-      // As for Claude Code: enabling is intent, not launchability.
-      detail: signals.codexBundled === "present" ? "Codex is installed but not enabled yet. Turn it on to offer Codex from this device." : `Codex is installed but not enabled yet \u2014 and @cabane/companion's bundled Codex ${missingNoun(signals.codexBundled)} is missing, so enabling alone won't make it runnable. ${repairAction()}`,
-      enable: "codex"
+      version,
+      detail: `${usableLine("codex", signals.codexCheck)} Turn it on to offer Codex from this device.`,
+      enable: "codex",
+      signIn: signals.codexCheck?.status ?? null
     };
   }
   return {
     ...base,
     state: "not_detected",
     version: null,
-    detail: "Not detected. Install the Codex CLI and sign in (`codex login`), then enable it here.",
-    enable: null
+    detail: notUsableDetail("codex", signals.codexCheck),
+    enable: null,
+    signIn: signals.codexCheck?.status ?? null
   };
 }
 function deriveOpencode(signals, manifestHas) {
@@ -948,7 +1103,8 @@ function deriveOpencode(signals, manifestHas) {
         state: "exposed",
         version: signals.opencodeVersion,
         detail: "An opencode server is reachable and exposed to Cabane.",
-        enable: null
+        enable: null,
+        signIn: null
       };
     }
     return {
@@ -956,7 +1112,8 @@ function deriveOpencode(signals, manifestHas) {
       state: "needs_attention",
       version: null,
       detail: "Configured, but the opencode server isn\u2019t answering. Start `opencode serve` and check the URL.",
-      enable: null
+      enable: null,
+      signIn: null
     };
   }
   if (signals.opencodeReachable && signals.opencodeDetectedUrl) {
@@ -965,7 +1122,8 @@ function deriveOpencode(signals, manifestHas) {
       state: "detected_not_exposed",
       version: signals.opencodeVersion,
       detail: signals.opencodeDetectedUrl,
-      enable: "opencode"
+      enable: "opencode",
+      signIn: null
     };
   }
   return {
@@ -973,7 +1131,8 @@ function deriveOpencode(signals, manifestHas) {
     state: "not_detected",
     version: null,
     detail: "Not detected. Run `opencode serve` and add its URL here to expose opencode.",
-    enable: "opencode"
+    enable: "opencode",
+    signIn: null
   };
 }
 var PROBE_TIMEOUT_MS = 4e3;
@@ -992,31 +1151,20 @@ async function resolveOpencodeServerUrl(configuredServerUrl, requestedServerUrl,
   return await probeDefault() !== null ? DEFAULT_OPENCODE_SERVER_URL : null;
 }
 async function probeHarnessSignals(cfg, deps = {}) {
-  const probePresence = deps.probePresence ?? probeHarnessPresence;
   const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
   const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const configuredServerUrl = cfg.opencode?.serverUrl;
   const opencodeProbeUrl = configuredServerUrl ?? DEFAULT_OPENCODE_SERVER_URL;
-  const [claudePresence, codexPresence, opencodeVersion] = await Promise.all([
-    deps.presence?.["claude-code"] ?? withTimeout(probePresence("claude-code"), { status: "absent" }),
-    deps.presence?.codex ?? withTimeout(probePresence("codex"), { status: "absent" }),
-    configuredServerUrl ? withTimeout(probeOpencode(opencodeProbeUrl), null) : probeDefaultOpencodeVersion(probeOpencode)
-  ]);
-  const claudeVersion = claudePresence.status === "present" ? claudePresence.version : null;
-  const codexVersion = codexPresence.status === "present" ? codexPresence.version : null;
+  const opencodeVersion = configuredServerUrl ? await withTimeout(probeOpencode(opencodeProbeUrl), null) : await probeDefaultOpencodeVersion(probeOpencode);
   return {
-    claudeOnPath: claudePresence.status === "present",
-    claudeVersion,
-    // The user's opt-in, the manifest gate; the probe above only suggests.
+    claudeCheck: deps.checks?.["claude-code"] ?? null,
+    // The user's opt-in, the manifest gate; the check above only suggests.
     claudeCodeConnected: isClaudeCodeConnected(cfg),
-    // The executable a Claude turn launches, resolved with every probe so a
+    // The executable a Claude turn launches, resolved with every refresh so a
     // binary that disappears is caught on the next beat, not at turn time.
     claudeBundled: resolveBundled("claude-code").status,
     codexBundled: resolveBundled("codex").status,
-    // A parseable `codex --version` is our presence signal (presence alone never
-    // exposes codex; its config flag is the manifest gate either way).
-    codexOnPath: codexVersion !== null,
-    codexVersion,
+    codexCheck: deps.checks?.codex ?? null,
     codexEnabled: isCodexEnabled(cfg),
     opencodeConfigured: !!configuredServerUrl,
     // A version came back ⟺ the serve answered its health endpoint.
@@ -1049,104 +1197,94 @@ function withTimeout(promise, fallback, timeoutMs = PROBE_TIMEOUT_MS) {
   });
 }
 
-// src/harness-check.ts
-var CHECK_TIMEOUT_MS = 4e3;
-async function shakeOutHarness(runtime, cfg, deps = {}) {
-  const run = deps.run ?? runBounded;
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
-  try {
-    if (runtime === "opencode") {
-      const url = cfg.opencode?.serverUrl;
-      if (!url) return "absent";
-      return await probeOpencode(url) !== null ? "ok" : "failed";
-    }
-    const { auth } = runtime === "codex" ? {
-      auth: ["codex", ["login", "status"]]
-    } : {
-      auth: ["claude", ["auth", "status"]]
-    };
-    const presence = deps.presence ?? await (deps.probePresence ?? probeHarnessPresence)(runtime);
-    if (presence.status !== "present") return presence.status;
-    const authRun = await run(auth[0], [...auth[1]]);
-    if (authRun.code === 0) return "ok";
-    if (looksUnsupported(authRun.output)) {
-      return "unverified";
-    }
-    return "failed";
-  } catch {
-    return "unverified";
-  }
+// src/harness-copy.ts
+function claudeLoginCommand(path = process.env.PATH) {
+  if (firstOnPath("claude", path)) return "claude auth login";
+  return "~/.local/bin/claude auth login";
 }
-function connectedLine(runtime, verdict) {
-  if (verdict === "absent" || verdict === "unusable") {
-    throw new Error("an unavailable harness cannot be connected");
-  }
+function ctx(c = {}) {
+  return {
+    cmd: c.cmd ?? ((rest) => cabane(rest)),
+    claudeLogin: c.claudeLogin ?? claudeLoginCommand()
+  };
+}
+function loginCommand(runtime, c = {}) {
+  return runtime === "codex" ? "codex login" : ctx(c).claudeLogin;
+}
+function usableLine(runtime, check) {
   const label = HARNESS_LABELS[runtime];
-  if (verdict !== "failed") return `${label} connected.`;
-  return `${label} connected \u2014 ${FAILED_SUFFIX[runtime]}`;
+  if (!check) return `${label} is running on this computer.`;
+  const version = "version" in check && check.version ? ` (${check.version})` : "";
+  if (check.status === "api_key")
+    return `${label} has an API key configured on this computer${version}.`;
+  return `${label} is signed in on this computer${version}.`;
 }
-var FAILED_SUFFIX = {
-  "claude-code": "it doesn\u2019t look signed in yet. Run `claude` once and sign in, then it\u2019s ready.",
-  codex: "it doesn\u2019t look signed in yet. Run `codex login` once, then it\u2019s ready.",
-  opencode: "its server isn\u2019t answering. Start `opencode serve`, then it\u2019s ready."
-};
-function presenceReason(runtime, status) {
-  if (runtime === "opencode") {
-    return "No opencode server is configured \u2014 run `opencode serve` and connect with `--url`.";
-  }
+function failureText(runtime, reason) {
   const label = HARNESS_LABELS[runtime];
-  return status === "absent" ? `${label} isn't installed on this machine.` : `${label} is installed here but didn't report a version Cabane can read.`;
+  switch (reason) {
+    case "timeout":
+      return `Couldn't check whether ${label} is signed in: the check didn't answer in time. Try again.`;
+    case "spawn":
+      return `Couldn't check whether ${label} is signed in: Cabane's bundled ${label} wouldn't start. Repair it with  ${repairCommands()[0]}  , then try again.`;
+    case "config":
+      return `Couldn't check whether ${label} is signed in: its configuration file didn't load${runtime === "codex" ? ` (${join4(homedir5(), ".codex", "config.toml").replace(homedir5(), "~")})` : ""}. Fix it, then try again.`;
+    case "unreadable":
+      return `Couldn't check whether ${label} is signed in: it answered in a way Cabane couldn't read. Try again, and if it keeps happening, update Cabane.`;
+  }
 }
-var CLI_PRESENCE_ACTION = "Install it and run this again.";
-var DASHBOARD_PRESENCE_ACTION = "Install it, then refresh.";
-function presenceRefusal(runtime, status, action) {
-  const reason = presenceReason(runtime, status);
-  return runtime === "opencode" ? reason : `${reason} ${action}`;
+function bundleMissingText(runtime) {
+  const label = HARNESS_LABELS[runtime];
+  return `This Cabane install is missing its bundled ${label}. Repair it with  ${repairCommands()[0]}  , then try again.`;
 }
-function looksUnsupported(output) {
-  return /unrecognized|unknown (sub)?command|unexpected argument|invalid (sub)?command|no such (sub)?command|usage:|did you mean/i.test(
-    output
-  );
+function unusableReason(runtime, check) {
+  if (check.status === "bundle_missing") return bundleMissingText(runtime);
+  if (check.status === "check_failed") return failureText(runtime, check.reason);
+  return null;
 }
-function runBounded(command, args) {
-  return new Promise((resolve2) => {
-    let settled = false;
-    const done = (result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve2(result);
-    };
-    let child;
-    try {
-      child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
-    } catch {
-      resolve2({ code: null, output: "", error: "spawn" });
-      return;
-    }
-    let out = "";
-    const capture = (chunk) => {
-      if (out.length < 4096) out += chunk.toString();
+function connectLines(outcome, opts = {}) {
+  const c = ctx(opts);
+  if (outcome.kind === "opencode") return { ok: false, lines: [outcome.message] };
+  const label = HARNESS_LABELS[outcome.runtime];
+  if (outcome.kind === "connected") return { ok: true, lines: [`${label} connected.`] };
+  if (outcome.kind === "already") {
+    const where = outcome.deviceLabel ?? "this computer";
+    const how = outcome.check?.status === "api_key" ? ", with an API key configured" : outcome.check?.status === "signed_in" ? ", and signed in" : "";
+    return { ok: true, lines: [`${label} is already connected on ${where}${how}.`] };
+  }
+  const { runtime, check, connected } = outcome;
+  const problem = unusableReason(runtime, check);
+  if (problem) return { ok: false, lines: [problem] };
+  if (opts.windowKey) {
+    return {
+      ok: false,
+      lines: [
+        `${label} has an API key in this window, but the running Cabane can't see it.`,
+        `Run  ${c.cmd("stop")}  then  ${c.cmd("start")}  here, and it will.`
+      ]
     };
-    child.stdout?.on("data", capture);
-    child.stderr?.on("data", capture);
-    const timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      done({ code: null, output: out, error: "timeout" });
-    }, CHECK_TIMEOUT_MS);
-    timer.unref?.();
-    child.once("error", () => done({ code: null, output: out, error: "spawn" }));
-    child.once("exit", (code) => done({ code, output: out }));
-  });
+  }
+  const again = c.cmd(`connect ${runtime}`);
+  return {
+    ok: false,
+    lines: [
+      connected ? `${label} is connected here but signed out. Run  ${loginCommand(runtime, c)}  , then  ${again}  again.` : `${label} isn't signed in on this computer. Run  ${loginCommand(runtime, c)}  , then  ${again}  again.`
+    ]
+  };
 }
 
 // src/logger.ts
-import { createWriteStream, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname3, join as join3 } from "path";
+import {
+  createWriteStream,
+  mkdirSync as mkdirSync2,
+  openSync,
+  renameSync as renameSync2,
+  statSync as statSync2
+} from "fs";
+import { dirname as dirname3, join as join5 } from "path";
 import { stripVTControlCharacters } from "util";
 import pino from "pino";
 function companionLogPath() {
-  return join3(cabaneDir(), "companion.log");
+  return join5(cabaneDir(), "companion.log");
 }
 function humanText(value) {
   return stripVTControlCharacters(String(value ?? "")).replace(
@@ -1196,6 +1334,53 @@ function formatHumanLine(record) {
   }
   return line + "\n";
 }
+var LOG_ROTATE_BYTES = 50 * 1024 * 1024;
+var LOG_ROTATIONS_KEPT = 3;
+var RotatingLog = class {
+  constructor(path, maxBytes = LOG_ROTATE_BYTES, keep = LOG_ROTATIONS_KEPT) {
+    this.path = path;
+    this.maxBytes = maxBytes;
+    this.keep = keep;
+    this.size = sizeOf(path);
+    this.stream = openAppend(path);
+  }
+  path;
+  maxBytes;
+  keep;
+  stream;
+  size;
+  write(chunk) {
+    const ok = this.stream.write(chunk);
+    this.size += Buffer.byteLength(chunk);
+    if (this.size >= this.maxBytes) this.rotate();
+    return ok;
+  }
+  rotate() {
+    this.stream.end();
+    try {
+      for (let i = this.keep - 1; i >= 1; i--) {
+        try {
+          renameSync2(`${this.path}.${i}`, `${this.path}.${i + 1}`);
+        } catch {
+        }
+      }
+      renameSync2(this.path, `${this.path}.1`);
+    } catch {
+    }
+    this.stream = openAppend(this.path);
+    this.size = sizeOf(this.path);
+  }
+};
+function openAppend(path) {
+  return createWriteStream("", { fd: openSync(path, "a") });
+}
+function sizeOf(path) {
+  try {
+    return statSync2(path).size;
+  } catch {
+    return 0;
+  }
+}
 var cached = null;
 var consoleLogging = true;
 var overrides = {};
@@ -1208,7 +1393,7 @@ function configureLogger(log, config) {
 function createLogger(destinations = {}, options = {}) {
   const path = companionLogPath();
   if (!destinations.file) mkdirSync2(dirname3(path), { recursive: true });
-  const file = destinations.file ?? createWriteStream(path, { flags: "a" });
+  const file = destinations.file ?? new RotatingLog(path);
   const state = { format: options.logFormat ?? "human" };
   const streams = [];
   const human = (chunk) => {
@@ -1499,14 +1684,14 @@ var CONTENT_TYPES = {
 function registerRoutes(app, deps) {
   const { supervisor, hub, staticDir } = deps;
   app.get("/", async (c) => {
-    const html = await readFile(join4(staticDir, "index.html"), "utf8");
+    const html = await readFile(join6(staticDir, "index.html"), "utf8");
     return c.html(html);
   });
   app.get("/static/:file", async (c) => {
     const file = c.req.param("file");
-    const safe3 = normalize(file).replace(/^(\.\.[/\\])+/, "");
-    const full = join4(staticDir, safe3);
-    if (!full.startsWith(staticDir) || !existsSync2(full)) return c.notFound();
+    const safe2 = normalize(file).replace(/^(\.\.[/\\])+/, "");
+    const full = join6(staticDir, safe2);
+    if (!full.startsWith(staticDir) || !existsSync3(full)) return c.notFound();
     const body = await readFile(full);
     const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
     c.header("content-type", type);
@@ -1559,20 +1744,9 @@ function registerRoutes(app, deps) {
   app.post("/api/harnesses/enable", async (c) => {
     const body = await readJson(c);
     const runtime = body.runtime;
-    if (runtime === "claude-code") {
-      const result = await supervisor.enableHarness({ runtime: "claude-code" });
-      if (!result.ok) {
-        const error = result.presence ? `${result.error} ${DASHBOARD_PRESENCE_ACTION}` : result.error;
-        return c.json({ error }, 400);
-      }
-      return c.json({ ok: true, status: hub.statusJson() });
-    }
-    if (runtime === "codex") {
-      const result = await supervisor.enableHarness({ runtime: "codex" });
-      if (!result.ok) {
-        const error = result.presence ? `${result.error} ${DASHBOARD_PRESENCE_ACTION}` : result.error;
-        return c.json({ error }, 400);
-      }
+    if (runtime === "claude-code" || runtime === "codex") {
+      const result = await supervisor.enableHarness({ runtime });
+      if (!result.ok) return c.json({ error: connectLines(result.outcome).lines.join(" ") }, 400);
       return c.json({ ok: true, status: hub.statusJson() });
     }
     if (runtime === "opencode") {
@@ -1583,7 +1757,7 @@ function registerRoutes(app, deps) {
         runtime: "opencode",
         serverUrl: body.serverUrl
       });
-      if (!result.ok) return c.json({ error: result.error }, 400);
+      if (!result.ok) return c.json({ error: connectLines(result.outcome).lines.join(" ") }, 400);
       return c.json({ ok: true, status: hub.statusJson() });
     }
     return c.json({ error: `can't enable "${String(runtime)}" from the app` }, 400);
@@ -1639,11 +1813,11 @@ function clampLimit(raw, fallback, max = 200) {
   return Math.min(Math.floor(n), max);
 }
 function tailFile(path, lines2) {
-  if (!existsSync2(path)) return [];
+  if (!existsSync3(path)) return [];
   const MAX_BYTES = 256 * 1024;
   let fd;
   try {
-    fd = openSync(path, "r");
+    fd = openSync2(path, "r");
     const size = fstatSync(fd).size;
     const start = Math.max(0, size - MAX_BYTES);
     const len = size - start;
@@ -1728,14 +1902,14 @@ function isAddrInUse(err) {
   return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
 }
 function resolveStaticDir() {
-  return join5(dirname4(fileURLToPath2(import.meta.url)), "static");
+  return join7(dirname4(fileURLToPath3(import.meta.url)), "static");
 }
 
 // src/control-socket.ts
 import { createHash } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync3, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync4, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
 import { createServer, connect } from "net";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 var CONTROL_TIMEOUT_MS = 1e3;
 var MAX_UNIX_SOCKET_PATH_BYTES = 103;
 function controlSocketPath() {
@@ -1744,16 +1918,16 @@ function controlSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\cabane-companion-${key}`;
   }
-  const besideRuntime = join6(dir2, "companion.sock");
+  const besideRuntime = join8(dir2, "companion.sock");
   if (Buffer.byteLength(besideRuntime) <= MAX_UNIX_SOCKET_PATH_BYTES) return besideRuntime;
   const filename = `cabane-companion-${key}.sock`;
-  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync3(process.env.XDG_RUNTIME_DIR) ? join6(process.env.XDG_RUNTIME_DIR, filename) : null;
-  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join6("/tmp", filename);
+  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync4(process.env.XDG_RUNTIME_DIR) ? join8(process.env.XDG_RUNTIME_DIR, filename) : null;
+  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join8("/tmp", filename);
 }
 async function startControlServer(handlers) {
   const path = controlSocketPath();
   mkdirSync3(cabaneDir(), { recursive: true });
-  if (process.platform !== "win32" && existsSync3(path)) {
+  if (process.platform !== "win32" && existsSync4(path)) {
     const alive = await ping(path);
     if (alive) throw new Error(`another companion is already listening on ${path}`);
     rmSync2(path, { force: true });
@@ -1813,10 +1987,16 @@ async function serveConnection(socket, handlers) {
       return;
     }
     if (req.cmd === "connect") {
-      const result = await handlers.connect(req.runtime, req.serverUrl);
+      const outcome = await handlers.connect(req.runtime, req.serverUrl);
+      const { ok, lines: lines2 } = connectLines(outcome, { cmd: (rest) => `cabane ${rest}` });
+      const result = { ok, message: lines2.join(" "), outcome };
       reply(socket, result);
       return;
     }
+    if (req.cmd === "update") {
+      reply(socket, await handlers.update(req.auto));
+      return;
+    }
     if (req.cmd === "stop") {
       reply(socket, { ok: true });
       setTimeout(() => handlers.stop(), 50).unref?.();
@@ -1903,88 +2083,49 @@ async function ping(path) {
 }
 
 // src/prereqs.ts
-async function claudeOnPath() {
-  return (await probeHarnessPresence("claude-code")).status === "present";
-}
-async function codexOnPath() {
-  return (await probeHarnessPresence("codex")).status === "present";
-}
-async function requireStartConfig(deps = {}) {
+function requireStartConfig(deps = {}) {
   const requireCfg = deps.requireCfg ?? requireConfig;
-  const probeClaude = deps.probeClaude ?? claudeOnPath;
   const save2 = deps.save ?? saveConfig;
   const cfg = requireCfg();
-  const claudeOnPathResult = await probeClaude();
-  const migrated = migrateConnectedHarnesses(cfg, claudeOnPathResult);
-  if (!migrated) return { cfg, claudeOnPath: claudeOnPathResult };
+  const migrated = migrateConnectedHarnesses(cfg);
+  if (!migrated) return cfg;
   save2(migrated);
-  deps.onMigrated?.(migrated, claudeOnPathResult);
-  return { cfg: migrated, claudeOnPath: claudeOnPathResult };
+  deps.onMigrated?.(migrated);
+  return migrated;
 }
-async function warnAboutHarnessReadiness(cfg, deps = {}) {
-  const probeClaude = deps.probeClaude ?? claudeOnPath;
-  const probeCodex = deps.probeCodex ?? codexOnPath;
+function warnAboutHarnessReadiness(cfg, deps = {}) {
   const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const warn = deps.warn ?? ((message2) => process.stderr.write(`${message2}
 `));
-  const connected = [
-    ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
-    ...isCodexEnabled(cfg) ? ["Codex"] : [],
-    ...cfg.opencode ? ["opencode"] : []
-  ];
-  if (connected.length > 0) {
-    for (const runtime of ["claude-code", "codex"]) {
-      const intended = runtime === "codex" ? isCodexEnabled(cfg) : isClaudeCodeConnected(cfg);
-      if (!intended) continue;
-      const resolution = resolveBundled(runtime);
-      if (resolution.status !== "present") warn(startupWarning(resolution));
-    }
+  const connected = isClaudeCodeConnected(cfg) || isCodexEnabled(cfg) || Boolean(cfg.opencode?.serverUrl);
+  if (!connected) {
+    warn(
+      `No agent is connected on this device yet, so no agent turn can run here. Sign in to one, then connect it with \`${cabane("connect claude-code")}\` (or codex, or opencode).`
+    );
     return;
   }
-  const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
-  const found = [
-    ...claudeInstalled ? [
-      {
-        label: "Claude Code",
-        command: "`cabane-companion connect claude-code`",
-        bundled: resolveBundled("claude-code").status
-      }
-    ] : [],
-    ...codexInstalled ? [
-      {
-        label: "Codex",
-        command: "`cabane-companion connect codex`",
-        bundled: resolveBundled("codex").status
-      }
-    ] : []
-  ];
-  const runnable = found.filter((h) => h.bundled === "present");
-  const incomplete = found.filter((h) => h.bundled !== "present");
-  const incompleteNote = incomplete.map(
-    (h) => `${h.label} is installed here, but @cabane/companion's bundled ${h.label} ${missingNoun(h.bundled)} is missing, so connecting it alone won't make it runnable.`
-  ).join(" ");
-  const guidance = runnable.length > 0 ? `We found ${runnable.map((h) => h.label).join(" and ")} on this machine \u2014 connect ${runnable.length > 1 ? "one with " : "it with "}${runnable.map((h) => h.command).join(" or ")} and turns start routing here.${incompleteNote ? ` ${incompleteNote} ${repairAction()}` : ""}` : incomplete.length > 0 ? (
-    // Their machine is fine; this companion's install is not. Repair that,
-    // then connect — no "install a harness" they already have.
-    `${incompleteNote} ${repairAction()} Then connect it with ${incomplete.map((h) => h.command).join(" or ")}.`
-  ) : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).";
-  warn(`No harness is connected on this device yet, so no agent turn can run here. ${guidance}`);
+  for (const runtime of ["claude-code", "codex"]) {
+    const intended = runtime === "codex" ? isCodexEnabled(cfg) : isClaudeCodeConnected(cfg);
+    if (!intended) continue;
+    const resolution = resolveBundled(runtime);
+    if (resolution.status !== "present") warn(startupWarning(resolution));
+  }
 }
 
 // src/runtime-file.ts
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   readFileSync as readFileSync2,
   rmSync as rmSync3,
   writeFileSync as writeFileSync2,
   mkdirSync as mkdirSync4,
-  openSync as openSync2,
+  openSync as openSync3,
   closeSync as closeSync2
 } from "fs";
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 var PROBE_TIMEOUT_MS2 = 1e3;
 function runtimePath() {
-  return join7(cabaneDir(), "runtime.json");
+  return join9(cabaneDir(), "runtime.json");
 }
 function serialize(state) {
   return JSON.stringify(state, null, 2) + "\n";
@@ -2000,7 +2141,7 @@ function acquireRuntimeState(state) {
   mkdirSync4(cabaneDir(), { recursive: true });
   let fd;
   try {
-    fd = openSync2(runtimePath(), "wx");
+    fd = openSync3(runtimePath(), "wx");
   } catch {
     return { acquired: false, existing: readLiveRuntimeState() };
   }
@@ -2013,11 +2154,11 @@ function acquireRuntimeState(state) {
 }
 function clearRuntimeState() {
   const path = runtimePath();
-  if (existsSync4(path)) rmSync3(path, { force: true });
+  if (existsSync5(path)) rmSync3(path, { force: true });
 }
 function clearRuntimeStateIfOurs(instanceId) {
   const path = runtimePath();
-  if (!existsSync4(path)) return;
+  if (!existsSync5(path)) return;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
     if (parsed.instanceId && parsed.instanceId !== instanceId) return;
@@ -2027,7 +2168,7 @@ function clearRuntimeStateIfOurs(instanceId) {
 }
 function readLiveRuntimeState() {
   const path = runtimePath();
-  if (!existsSync4(path)) return null;
+  if (!existsSync5(path)) return null;
   let parsed;
   try {
     parsed = JSON.parse(readFileSync2(path, "utf8"));
@@ -2192,7 +2333,7 @@ function turnFailureCopy(reason, runtime) {
       return "Claude Code sign-in has expired on this machine. Open Claude Code, run /login, then reply in Cabane to try again.";
     if (runtime === "codex")
       return "Codex sign-in has expired on this machine. Run codex login, then reply in Cabane to try again.";
-    return "Sign-in has expired on this machine. Sign in to the coding agent, then reply in Cabane to try again.";
+    return "Sign-in has expired on this machine. Sign in to the agent, then reply in Cabane to try again.";
   }
   if (failure?.kind === "usage_capped")
     return failure.resetsAt ? `The usage limit is reached; it resets around ${new Date(failure.resetsAt).toLocaleTimeString()}. Reply in Cabane after it resets.` : "The usage limit is reached. Try again later in Cabane.";
@@ -2203,9 +2344,9 @@ function turnFailureCopy(reason, runtime) {
   if (reason?.startsWith("missing_secret:"))
     return `A required secret is missing: ${humanText(reason.slice(15))}. Add it to ~/.cabane/secrets.json, then reply in Cabane to try again.`;
   if (reason?.startsWith("runtime_incomplete:"))
-    return "The coding agent installation is incomplete. Reinstall with npm i -g @cabane/companion@latest, then restart the companion.";
+    return "The agent installation is incomplete. Reinstall with npm i -g @cabane/companion@latest, then restart the companion.";
   if (/^(runtime|codex|opencode)_unavailable:/.test(reason ?? ""))
-    return "The coding agent is unavailable on this machine. Enable it here or choose another connector in Cabane.";
+    return "The agent is unavailable on this machine. Enable it here or choose another connector in Cabane.";
   if (reason?.startsWith("model_unavailable:"))
     return "The selected model is unavailable. Choose a different model in the agent settings in Cabane.";
   if (reason?.startsWith("prepare_failed:"))
@@ -2213,17 +2354,17 @@ function turnFailureCopy(reason, runtime) {
   if (reason?.startsWith("fetch_failed:"))
     return `Could not load the conversation (${humanText(reason.slice(13))}). Reply in Cabane to try again.`;
   if (reason === "timeout_idle")
-    return "The coding agent stopped responding. Reply in Cabane to try again.";
+    return "The agent stopped responding. Reply in Cabane to try again.";
   if (reason === "timeout_total")
     return "The turn ran longer than expected and was stopped. Reply in Cabane to continue.";
   if (reason === "result_error:error_max_turns")
-    return "The coding agent reached its step limit. Reply in Cabane to continue.";
+    return "The agent reached its step limit. Reply in Cabane to continue.";
   if (reason === "no_result" || reason === "empty_result" || reason === "empty_result_unverified")
-    return "The coding agent finished without a response. Reply in Cabane to try again.";
+    return "The agent finished without a response. Reply in Cabane to try again.";
   if (reason === "session_start_failed")
-    return "The coding agent could not start a session. Restart the companion, then reply in Cabane to try again.";
+    return "The agent could not start a session. Restart the companion, then reply in Cabane to try again.";
   if (reason === "no_terminal")
-    return "The coding agent stopped before confirming the turn was complete. Reply in Cabane to continue.";
+    return "The agent stopped before confirming the turn was complete. Reply in Cabane to continue.";
   if (reason === "lease_unconfirmed")
     return "Could not confirm with Cabane that the turn could start. Check this machine\u2019s connection, then reply in Cabane to try again.";
   if (reason === "workspace_tools_missing")
@@ -2231,13 +2372,13 @@ function turnFailureCopy(reason, runtime) {
   if (reason?.startsWith("seq_floor_unavailable:"))
     return "The interrupted turn could not safely continue. Reply in Cabane to continue.";
   if (reason === "result_error:error_max_budget_usd")
-    return "The coding agent reached its spending limit. Check its budget settings before trying again in Cabane.";
+    return "The agent reached its spending limit. Check its budget settings before trying again in Cabane.";
   if (reason === "result_error:error_max_structured_output_retries")
-    return "The coding agent could not produce the requested response format. Check the requested format, then reply in Cabane to try again.";
+    return "The agent could not produce the requested response format. Check the requested format, then reply in Cabane to try again.";
   if (reason?.startsWith("result_error:"))
-    return "The coding agent stopped with an error while running. Check its transcript, then reply in Cabane to try again.";
+    return "The agent stopped with an error while running. Check its transcript, then reply in Cabane to try again.";
   if (reason === "setup_failed")
-    return "The turn could not be set up. Check the coding agent setup on this machine, then reply in Cabane to try again.";
+    return "The turn could not be set up. Check the agent setup on this machine, then reply in Cabane to try again.";
   if (reason === "unexpected_role")
     return "The message could not start an agent response. Send a new message in Cabane to try again.";
   if (reason === "lease_lost" || reason?.startsWith("lease_refused:"))
@@ -2245,11 +2386,11 @@ function turnFailureCopy(reason, runtime) {
   const detail = humanText(reason?.replace(/^error:/, "") ?? "").slice(0, 400);
   if (/\b(EACCES|EPERM)\b|permission denied/i.test(detail)) {
     const readable = detail.replace(/\b(EACCES|EPERM)\b/g, "permission denied");
-    return `The coding agent was denied access: ${readable}. Check access permissions for the reported file or command, then reply in Cabane to try again.`;
+    return `The agent was denied access: ${readable}. Check access permissions for the reported file or command, then reply in Cabane to try again.`;
   }
   if (detail)
-    return `The coding agent reported: ${detail}. Check the coding agent setup on this machine, then reply in Cabane to try again.`;
-  return "The coding agent could not finish this turn. Reply in Cabane to try again.";
+    return `The agent reported: ${detail}. Check the agent setup on this machine, then reply in Cabane to try again.`;
+  return "The agent could not finish this turn. Reply in Cabane to try again.";
 }
 
 // src/api-error-shape.ts
@@ -2883,22 +3024,22 @@ function errorMessage2(status, body) {
 // src/credentials.ts
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync3,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 import { z as z4 } from "zod";
 function credentialsPath() {
-  return join8(cabaneDir(), "credentials.json");
+  return join10(cabaneDir(), "credentials.json");
 }
 var credentialStoreSchema = z4.record(z4.string(), z4.string());
 function load() {
   const path = credentialsPath();
-  if (!existsSync5(path)) return {};
+  if (!existsSync6(path)) return {};
   let raw;
   try {
     raw = readFileSync3(path, "utf8");
@@ -2927,7 +3068,7 @@ function save(map) {
       chmodSync3(tmp, 384);
     } catch {
     }
-    renameSync2(tmp, path);
+    renameSync3(tmp, path);
   } catch (err) {
     try {
       rmSync4(tmp, { force: true });
@@ -2960,18 +3101,18 @@ function pruneCredentials(keepAgentIds) {
 }
 
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync6 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync4, existsSync as existsSync7 } from "fs";
+import { join as join11 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
-  return join9(cabaneDir(), log);
+  return join11(cabaneDir(), log);
 }
 function pathFor(log, workspaceId) {
-  return join9(dir(log), encodeURIComponent(workspaceId));
+  return join11(dir(log), encodeURIComponent(workspaceId));
 }
 function readIds(log, workspaceId) {
   const path = pathFor(log, workspaceId);
-  if (!existsSync6(path)) return [];
+  if (!existsSync7(path)) return [];
   try {
     return readFileSync4(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   } catch {
@@ -3004,15 +3145,15 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join9(cabaneDir(), "resume-attempts");
+  return join11(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join9(resumeDir(), encodeURIComponent(workspaceId));
+  return join11(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = resumePathFor(workspaceId);
-  if (!existsSync6(path)) return out;
+  if (!existsSync7(path)) return out;
   try {
     for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
@@ -3043,16 +3184,16 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join9(cabaneDir(), "turns");
+  return join11(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join9(turnDir(), encodeURIComponent(workspaceId));
+  return join11(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = turnPathFor(workspaceId);
-  if (!existsSync6(path)) return out;
+  if (!existsSync7(path)) return out;
   try {
     for (const line of readFileSync4(path, "utf8").split("\n")) {
       const trimmed = line.trim();
@@ -3078,7 +3219,7 @@ function writeTurnIds(workspaceId, turns) {
   const path = turnPathFor(workspaceId);
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync4(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
-  renameSync3(tmp, path);
+  renameSync4(tmp, path);
   return entries.length;
 }
 function rememberTurnId(workspaceId, eventId, turnId) {
@@ -3964,8 +4105,8 @@ function readThinking(runtimeOptions) {
 var CLAUDE_CODE_DEFAULT_MODEL_BARE = "default";
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep4 = model.indexOf("/");
-  const bare = sep4 === -1 || model.slice(0, sep4) !== "anthropic" ? model : model.slice(sep4 + 1);
+  const sep5 = model.indexOf("/");
+  const bare = sep5 === -1 || model.slice(0, sep5) !== "anthropic" ? model : model.slice(sep5 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 
@@ -4148,7 +4289,7 @@ function dedupe(xs) {
 }
 
 // packages/agent-runtime/src/claude-code/loop.ts
-async function* decodeSdkStream(iter, ctx) {
+async function* decodeSdkStream(iter, ctx2) {
   const pending = /* @__PURE__ */ new Map();
   const buffer = createTerminalTextBuffer();
   const out = [];
@@ -4169,7 +4310,7 @@ async function* decodeSdkStream(iter, ctx) {
   let preInitNotice = null;
   try {
     for await (const msg of iter) {
-      if (ctx.signal.aborted) return;
+      if (ctx2.signal.aborted) return;
       if (msg.type === "system" && msg.subtype === "init") {
         const initModel = msg.model;
         if (typeof initModel === "string" && initModel.length > 0) resolvedModel = initModel;
@@ -4180,19 +4321,19 @@ async function* decodeSdkStream(iter, ctx) {
           break;
         }
         const sdkSessionId = msg.session_id;
-        if (!sessionEmitted && sdkSessionId && sdkSessionId !== ctx.resumedSessionId) {
+        if (!sessionEmitted && sdkSessionId && sdkSessionId !== ctx2.resumedSessionId) {
           sessionEmitted = true;
           yield {
             type: "session",
-            state: encodeSession({ sdkSessionId, cwd: ctx.cwd ?? "" }),
-            ...ctx.degraded ? { degraded: true } : {}
+            state: encodeSession({ sdkSessionId, cwd: ctx2.cwd ?? "" }),
+            ...ctx2.degraded ? { degraded: true } : {}
           };
         }
       } else if (msg.type === "system" && msg.subtype === "compact_boundary") {
         const compaction = readCompaction(msg);
         if (compaction) compactions.push(compaction);
       } else if (!workspaceProven && (msg.type === "assistant" || msg.type === "user" || msg.type === "result")) {
-        if (preInitToolActivity(msg) && ctx.startEvidence) ctx.startEvidence.toolActivity = true;
+        if (preInitToolActivity(msg) && ctx2.startEvidence) ctx2.startEvidence.toolActivity = true;
         const failure = classifyPreInitFrame(msg, signals);
         resultReason = failure ? encodeFailureReason(failure) : "session_start_failed";
         if (msg.type === "assistant" && isHarnessAuthored(msg))
@@ -4236,7 +4377,7 @@ async function* decodeSdkStream(iter, ctx) {
           const window = readContextWindow(msg, resolvedModel);
           if (window !== void 0) usage.contextWindow = window;
           if (compactions.length > 0) usage.contextCompactions = compactions;
-          const reading = await readHarnessContext(ctx.readContextUsage);
+          const reading = await readHarnessContext(ctx2.readContextUsage);
           if (reading) Object.assign(usage, reading);
         }
         const isError = msg.is_error === true;
@@ -4252,20 +4393,20 @@ async function* decodeSdkStream(iter, ctx) {
       }
     }
   } catch (err) {
-    if (ctx.signal.aborted) throw err;
+    if (ctx2.signal.aborted) throw err;
     const message2 = err instanceof Error ? err.message : String(err);
     const failure = mcpInventory.initReceived ? classifyErrorText(message2) : classifyFailure(signals, { text: message2 });
-    if (!failure && (mcpInventory.initReceived || ctx.resumedSessionId === null)) throw err;
+    if (!failure && (mcpInventory.initReceived || ctx2.resumedSessionId === null)) throw err;
     ok = false;
     if (failure) {
       resultReason = encodeFailureReason(failure);
     } else {
       resultReason = "session_start_failed";
-      if (ctx.startEvidence) ctx.startEvidence.thrown = message2.slice(0, 200);
+      if (ctx2.startEvidence) ctx2.startEvidence.thrown = message2.slice(0, 200);
     }
     sawResult = true;
   }
-  if (ctx.signal.aborted) return;
+  if (ctx2.signal.aborted) return;
   if (!workspaceProven) {
     ok = false;
     if (resultReason === void 0) {
@@ -5273,7 +5414,7 @@ function deepestError(node) {
 }
 
 // packages/agent-runtime/src/opencode/loop.ts
-async function* decodeOpencodeStream(events, ctx) {
+async function* decodeOpencodeStream(events, ctx2) {
   let held = null;
   const pending = /* @__PURE__ */ new Map();
   const startedTools = /* @__PURE__ */ new Set();
@@ -5282,9 +5423,9 @@ async function* decodeOpencodeStream(events, ctx) {
   let reason;
   let settled = false;
   const userMessageIds = /* @__PURE__ */ new Set();
-  if (ctx.skipMessageId) userMessageIds.add(ctx.skipMessageId);
+  if (ctx2.skipMessageId) userMessageIds.add(ctx2.skipMessageId);
   for await (const ev of events) {
-    if (ctx.signal.aborted) return;
+    if (ctx2.signal.aborted) return;
     if (ev.type === "message.updated") {
       const info = readMessageInfo(ev.properties);
       if (info && info.role === "user") userMessageIds.add(info.id);
@@ -5337,7 +5478,7 @@ async function* decodeOpencodeStream(events, ctx) {
       }
     } else if (ev.type === "session.idle") {
       const sid = readSessionId(ev.properties);
-      if (sid && sid !== ctx.sessionId) continue;
+      if (sid && sid !== ctx2.sessionId) continue;
       const sealed = sealHeld(held, true);
       held = null;
       if (sealed) yield sealed;
@@ -5346,7 +5487,7 @@ async function* decodeOpencodeStream(events, ctx) {
       break;
     } else if (ev.type === "session.error") {
       const sid = readSessionId(ev.properties);
-      if (sid && sid !== ctx.sessionId) continue;
+      if (sid && sid !== ctx2.sessionId) continue;
       const sealed = sealHeld(held, false);
       held = null;
       if (sealed) yield sealed;
@@ -5362,7 +5503,7 @@ async function* decodeOpencodeStream(events, ctx) {
       break;
     }
   }
-  if (ctx.signal.aborted) return;
+  if (ctx2.signal.aborted) return;
   if (!settled) {
     const sealed = sealHeld(held, true);
     held = null;
@@ -5420,9 +5561,9 @@ function readOpencodeDialect(runtimeOptions) {
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep4 = model.indexOf("/");
-  if (sep4 === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep4), modelID: model.slice(sep4 + 1) };
+  const sep5 = model.indexOf("/");
+  if (sep5 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep5), modelID: model.slice(sep5 + 1) };
 }
 
 // packages/agent-runtime/src/opencode/run-spec.ts
@@ -5710,10 +5851,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep4;
-      while ((sep4 = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep4);
-        buf = buf.slice(sep4 + 2);
+      let sep5;
+      while ((sep5 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep5);
+        buf = buf.slice(sep5 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -6461,7 +6602,7 @@ function readUsageBaseline(raw) {
 }
 
 // packages/agent-runtime/src/codex/loop.ts
-async function* decodeCodexStream(events, ctx) {
+async function* decodeCodexStream(events, ctx2) {
   let held = null;
   const pending = /* @__PURE__ */ new Map();
   const startedTools = /* @__PURE__ */ new Set();
@@ -6471,7 +6612,7 @@ async function* decodeCodexStream(events, ctx) {
   let reason;
   let usage;
   let cumulativeUsage;
-  let threadIdForSession = ctx.resumedThreadId;
+  let threadIdForSession = ctx2.resumedThreadId;
   let settled = false;
   function* flushInterim() {
     const sealed = sealHeld2(held, false);
@@ -6479,26 +6620,26 @@ async function* decodeCodexStream(events, ctx) {
     if (sealed) yield sealed;
   }
   for await (const ev of events) {
-    if (ctx.signal.aborted) return;
+    if (ctx2.signal.aborted) return;
     if (ev.type === "thread.started") {
       const threadId = readThreadId(ev);
       if (threadId) threadIdForSession = threadId;
       if (threadId && !sessionEmitted) {
         const state = encodeSession3({
           threadId,
-          cwd: ctx.cwd ?? "",
-          promptFingerprint: ctx.promptFingerprint ?? null,
+          cwd: ctx2.cwd ?? "",
+          promptFingerprint: ctx2.promptFingerprint ?? null,
           // The baseline this turn inherited, carried through unchanged. This early write records the
           // thread id even if the turn dies mid-stream; it can't yet know what the turn will spend. The
           // closing write records the new baseline.
-          usageBaseline: ctx.usageBaseline ?? null
+          usageBaseline: ctx2.usageBaseline ?? null
         });
-        if (threadId !== ctx.resumedThreadId || state !== ctx.storedState) {
+        if (threadId !== ctx2.resumedThreadId || state !== ctx2.storedState) {
           sessionEmitted = true;
           yield {
             type: "session",
             state,
-            ...ctx.degraded ? { degraded: true } : {}
+            ...ctx2.degraded ? { degraded: true } : {}
           };
         }
       }
@@ -6567,7 +6708,7 @@ async function* decodeCodexStream(events, ctx) {
       held = null;
       if (sealed) yield sealed;
       cumulativeUsage = readUsage(ev);
-      usage = cumulativeUsage ? codexUsageDelta(cumulativeUsage, ctx.usageBaseline ?? null) : void 0;
+      usage = cumulativeUsage ? codexUsageDelta(cumulativeUsage, ctx2.usageBaseline ?? null) : void 0;
       ok = true;
       settled = true;
       break;
@@ -6586,7 +6727,7 @@ async function* decodeCodexStream(events, ctx) {
       break;
     }
   }
-  if (ctx.signal.aborted) return;
+  if (ctx2.signal.aborted) return;
   if (!settled) {
     const sealed = sealHeld2(held, true);
     held = null;
@@ -6596,19 +6737,19 @@ async function* decodeCodexStream(events, ctx) {
   if (ok && cumulativeUsage && threadIdForSession) {
     const closing = encodeSession3({
       threadId: threadIdForSession,
-      cwd: ctx.cwd ?? "",
-      promptFingerprint: ctx.promptFingerprint ?? null,
+      cwd: ctx2.cwd ?? "",
+      promptFingerprint: ctx2.promptFingerprint ?? null,
       usageBaseline: cumulativeUsage
     });
     yield { type: "session", state: closing };
   }
-  const resolvedConfig = ctx.resolvedReasoningEffort ? { reasoningEffort: ctx.resolvedReasoningEffort } : void 0;
+  const resolvedConfig = ctx2.resolvedReasoningEffort ? { reasoningEffort: ctx2.resolvedReasoningEffort } : void 0;
   yield {
     type: "result",
     ok,
     ...reason ? { reason } : {},
     ...usage ? { usage } : {},
-    ...ctx.resolvedModel ? { resolvedModel: ctx.resolvedModel } : {},
+    ...ctx2.resolvedModel ? { resolvedModel: ctx2.resolvedModel } : {},
     ...resolvedConfig ? { resolvedConfig } : {}
   };
 }
@@ -6653,8 +6794,8 @@ function readCodexDialect(runtimeOptions) {
 // packages/agent-runtime/src/codex/model.ts
 var CODEX_DEFAULT_MODEL_BARES = /* @__PURE__ */ new Set(["default"]);
 function parseCodexModel(model) {
-  const sep4 = model.indexOf("/");
-  const bare = sep4 === -1 || model.slice(0, sep4) !== "openai" ? model : model.slice(sep4 + 1);
+  const sep5 = model.indexOf("/");
+  const bare = sep5 === -1 || model.slice(0, sep5) !== "openai" ? model : model.slice(sep5 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 
@@ -7934,6 +8075,7 @@ import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 // src/connector-health.ts
 var ConnectorHealthStore = class {
   byRuntime = /* @__PURE__ */ new Map();
+  sources = /* @__PURE__ */ new Map();
   // Record a settled turn's outcome for `runtime`. A success heals to `ok`; a
   // classified failure sets `limited`(+reset) / `auth_expired` with the reason as
   // `last_error`; anything else (a user Stop, a timeout, an unclassified error)
@@ -7942,6 +8084,7 @@ var ConnectorHealthStore = class {
   recordSettle(runtime, outcome) {
     if (outcome.ok) {
       this.byRuntime.set(runtime, { quotaState: "ok", limitedUntil: null, lastError: null });
+      this.sources.set(runtime, "turn");
       return;
     }
     const failure = decodeFailureReason(outcome.errorReason);
@@ -7953,6 +8096,26 @@ var ConnectorHealthStore = class {
       limitedUntil: quota.limitedUntil,
       lastError: outcome.errorReason ?? null
     });
+    this.sources.set(runtime, "turn");
+  }
+  // Record what the companion's own sign-in check found for a connected
+  // runtime at `start` or `connect`, so the heartbeat carries "sign-in needed"
+  // before any turn fails. Signed out seeds `auth_expired` unless a turn has
+  // already spoken; usable clears only a seed of our own.
+  recordLocalCheck(runtime, usable) {
+    const source = this.sources.get(runtime);
+    if (!usable) {
+      if (source === "turn" && this.byRuntime.get(runtime)?.quotaState !== "ok") return;
+      this.byRuntime.set(runtime, {
+        quotaState: "auth_expired",
+        limitedUntil: null,
+        lastError: encodeFailureReason({ kind: "auth_expired" })
+      });
+      this.sources.set(runtime, "local");
+      return;
+    }
+    if (source !== "local") return;
+    this.byRuntime.set(runtime, { quotaState: "ok", limitedUntil: null, lastError: null });
   }
   // The store's current opinion for one runtime, or undefined when it has
   // no observation. Read by the dispatcher at idle-timeout fire: an idle reap
@@ -7981,11 +8144,11 @@ var ConnectorHealthStore = class {
 
 // src/dispatcher.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { join as join17 } from "path";
 
 // src/runner/launch.ts
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 
 // src/runner/sandbox-policy.ts
 import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
@@ -8162,7 +8325,7 @@ async function stopRemoteOpencodeSession(serverUrl, sessionId, opts = {}) {
 }
 
 // src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn4 } from "child_process";
+import { execFile, execFileSync, spawn as spawn3 } from "child_process";
 import { readFileSync as readFileSync5 } from "fs";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -8171,8 +8334,8 @@ var CONTAINMENT_STOP_GRACE_SEC = 5;
 var FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
 var CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
 function turnScopeUnit(turnId, attempt) {
-  const safe3 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
-  return `cabane-turn-${safe3}-${attempt}`;
+  const safe2 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
+  return `cabane-turn-${safe2}-${attempt}`;
 }
 async function reapTurnScopes(turnId) {
   if (process.platform !== "linux") return { failures: [] };
@@ -8285,7 +8448,7 @@ function createTurnContainment(turnId, deps = {}) {
       command: options.command
     });
     return asContained(
-      spawn4("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
+      spawn3("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
         ...options.cwd ? { cwd: options.cwd } : {},
         env: options.env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -8293,7 +8456,7 @@ function createTurnContainment(turnId, deps = {}) {
     );
   }
   function spawnInGroup(options) {
-    const child = spawn4(options.command, options.args, {
+    const child = spawn3(options.command, options.args, {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
@@ -8440,17 +8603,17 @@ function createTurnContainment(turnId, deps = {}) {
 }
 
 // src/secrets.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join12 } from "path";
 import { z as z14 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join12(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z14.record(z14.string(), z14.string());
 function loadSecretStore() {
   const path = secretsPath();
-  if (!existsSync7(path)) return makeStore({});
+  if (!existsSync8(path)) return makeStore({});
   let raw;
   try {
     raw = readFileSync6(path, "utf8");
@@ -8829,7 +8992,7 @@ function relayRunnerLog(line, log) {
   log[method](fields, typeof msg === "string" ? msg : "");
 }
 function lines(stream, onLine) {
-  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  const rl = createInterface2({ input: stream, crlfDelay: Infinity });
   rl.on("line", onLine);
   return new Promise((resolve2) => rl.once("close", resolve2));
 }
@@ -9169,19 +9332,9 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   return { ok: false, durationMs, reason };
 }
 
-// src/term.ts
-import { createInterface as createInterface2 } from "readline";
-import { homedir as homedir3 } from "os";
-import pc from "picocolors";
-function tildePath(path) {
-  const home = homedir3();
-  if (home && path.startsWith(home + "/")) return `~${path.slice(home.length)}`;
-  return path;
-}
-
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -9425,11 +9578,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join11 } from "path";
+import { join as join13 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
-  const path = join11(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join13(tmpdir(), PREFIX));
+  const path = join13(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -9442,7 +9595,7 @@ async function writeCodexInstructionsFile(contents) {
 // src/codex-images.ts
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join12 } from "path";
+import { join as join14 } from "path";
 var FETCH_TIMEOUT_MS = 3e4;
 var EXTENSIONS = {
   "image/png": "png",
@@ -9455,7 +9608,7 @@ function createCodexImagePreparer(opts) {
   const timeoutMs = opts.timeoutMs ?? FETCH_TIMEOUT_MS;
   return async (urls, signal) => {
     signal.throwIfAborted();
-    const dir2 = await mkdtemp2(join12(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
+    const dir2 = await mkdtemp2(join14(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
     const cleanup = async () => {
       try {
         await rm2(dir2, { recursive: true, force: true });
@@ -9476,7 +9629,7 @@ function createCodexImagePreparer(opts) {
         const ext = EXTENSIONS[type];
         if (!ext) throw new Error(`not a vision image type: ${type || "none"}`);
         const bytes = new Uint8Array(await res.arrayBuffer());
-        const path = join12(dir2, `image-${index + 1}.${ext}`);
+        const path = join14(dir2, `image-${index + 1}.${ext}`);
         await writeFile2(path, bytes, { mode: 384 });
         return path;
       } catch (err) {
@@ -9510,14 +9663,14 @@ var SeqFloorUnavailable = class extends Error {
   }
   detail;
 };
-function resolveSeqFloor(sources, ctx) {
+function resolveSeqFloor(sources, ctx2) {
   const { serverFloor, outboxFloor } = sources;
   if (serverFloor === void 0) {
     throw new SeqFloorUnavailable("server sent no committed floor for a resumed turn");
   }
   const floor = Math.max(serverFloor, outboxFloor);
-  ctx.log.debug(
-    { turnId: ctx.turnId, floor, outboxFloor, serverFloor },
+  ctx2.log.debug(
+    { turnId: ctx2.turnId, floor, outboxFloor, serverFloor },
     "companion: resumed turn \u2014 seq counter seeded above its committed high-water mark"
   );
   return floor;
@@ -9535,7 +9688,7 @@ function readOutboxFloor(read, turnId, log) {
 }
 
 // src/prepare-failure.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { hostname } from "os";
 function prepareFailureCause(error) {
   const message2 = error instanceof Error ? error.message : String(error);
@@ -9573,7 +9726,7 @@ async function runPrepareWithReporting(runner, hook, input, context, reportError
 }
 function reportFailure(config, body) {
   return new Promise((resolve2, reject) => {
-    const child = spawn5(config.command, config.args ?? [], {
+    const child = spawn4(config.command, config.args ?? [], {
       stdio: ["pipe", "ignore", "ignore"],
       env: { ...process.env, ...config.env }
     });
@@ -9597,20 +9750,20 @@ function reportFailure(config, body) {
 }
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
+import { join as join15 } from "path";
 function dirFor(workspaceId) {
-  return join13(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join15(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join13(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join15(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor2(workspaceId, conversationId, agentId) {
-  return join13(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join15(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync7(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
@@ -9638,9 +9791,9 @@ function clearPrepared(workspaceId, conversationId, agentId) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname6, join as join14 } from "path";
+import { basename, dirname as dirname6, join as join16 } from "path";
 function transcriptsDir() {
-  return join14(runnerStateDir(), "transcripts");
+  return join16(runnerStateDir(), "transcripts");
 }
 var RETAIN = 200;
 var ANOMALY_RETAIN = 50;
@@ -9650,7 +9803,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join14(dir2, fileName(meta));
+    this.path = join16(dir2, fileName(meta));
     try {
       mkdirSync8(dir2, { recursive: true });
       try {
@@ -9679,10 +9832,10 @@ var TranscriptWriter = class {
   preserveAnomaly() {
     if (this.broken) return;
     try {
-      const dir2 = join14(dirname6(this.path), "anomalies");
+      const dir2 = join16(dirname6(this.path), "anomalies");
       mkdirSync8(dir2, { recursive: true, mode: 448 });
       chmodSync4(dir2, 448);
-      const target = join14(dir2, basename(this.path));
+      const target = join16(dir2, basename(this.path));
       copyFileSync(this.path, target);
       chmodSync4(target, 384);
       pruneOld(dir2, ANOMALY_RETAIN);
@@ -9707,14 +9860,14 @@ var TranscriptWriter = class {
 function fileName(meta) {
   const d = new Date(meta.ts);
   const stamp = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
-  const slug = safe2(meta.workspaceSlug) || "ws";
+  const slug = safe(meta.workspaceSlug) || "ws";
   const short = meta.dispatchId.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8) || "turn";
   return `${stamp}-${slug}-${short}.jsonl`;
 }
 function pad(n) {
   return String(n).padStart(2, "0");
 }
-function safe2(s) {
+function safe(s) {
   return s.replace(/[^a-zA-Z0-9_-]/g, "-");
 }
 function pruneOld(dir2, retain) {
@@ -9728,7 +9881,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync6(join14(dir2, f), { force: true });
+      rmSync6(join16(dir2, f), { force: true });
     } catch {
     }
   }
@@ -9867,32 +10020,32 @@ var TurnCommitter = class {
 function bundledHarnessFor(runtime) {
   return runtime === "claude-code" || runtime === "codex" ? runtime : null;
 }
-function resolve(ctx, harness) {
-  return (ctx.resolveBundled ?? resolveBundledBinary)(harness);
+function resolve(ctx2, harness) {
+  return (ctx2.resolveBundled ?? resolveBundledBinary)(harness);
 }
-async function postIncompleteNotice(ctx, harness, resolution) {
+async function postIncompleteNotice(ctx2, harness, resolution) {
   try {
-    await ctx.postTurnMessage(ctx.workspaceId, ctx.conversationId, {
+    await ctx2.postTurnMessage(ctx2.workspaceId, ctx2.conversationId, {
       body: turnIncompleteCopy(harness),
       kind: "runtime_notice",
-      turnId: ctx.turnId,
-      parentMessageId: ctx.parentMessageId
+      turnId: ctx2.turnId,
+      parentMessageId: ctx2.parentMessageId
     });
     return true;
   } catch (err) {
-    ctx.log.warn(
+    ctx2.log.warn(
       { ...apiErrorLogFields(err) },
       "Couldn't save the explanation to Cabane. This companion may need an update: npm i -g @cabane/companion@latest"
     );
     return false;
   }
 }
-async function checkBundledBinary(ctx) {
-  const harness = bundledHarnessFor(ctx.runtime);
+async function checkBundledBinary(ctx2) {
+  const harness = bundledHarnessFor(ctx2.runtime);
   if (!harness) return null;
-  const resolution = resolve(ctx, harness);
+  const resolution = resolve(ctx2, harness);
   if (resolution.status === "present") return null;
-  ctx.log.debug(
+  ctx2.log.debug(
     {
       runtime: harness,
       status: resolution.status,
@@ -9904,15 +10057,15 @@ async function checkBundledBinary(ctx) {
   return {
     harness,
     reason: `runtime_incomplete:${harness}`,
-    posted: await postIncompleteNotice(ctx, harness, resolution)
+    posted: await postIncompleteNotice(ctx2, harness, resolution)
   };
 }
-async function reclassifyThrow(ctx, opts) {
-  const harness = bundledHarnessFor(ctx.runtime);
+async function reclassifyThrow(ctx2, opts) {
+  const harness = bundledHarnessFor(ctx2.runtime);
   if (!harness || opts.aborted) return null;
-  const resolution = resolve(ctx, harness);
+  const resolution = resolve(ctx2, harness);
   if (resolution.status === "present") return null;
-  ctx.log.debug(
+  ctx2.log.debug(
     {
       runtime: harness,
       status: resolution.status,
@@ -9925,17 +10078,17 @@ async function reclassifyThrow(ctx, opts) {
   return {
     harness,
     reason: `runtime_incomplete:${harness}`,
-    posted: await postIncompleteNotice(ctx, harness, resolution)
+    posted: await postIncompleteNotice(ctx2, harness, resolution)
   };
 }
-async function guardBundledBinary(ctx, concluded, outcome) {
-  const incomplete = await checkBundledBinary(ctx);
+async function guardBundledBinary(ctx2, concluded, outcome) {
+  const incomplete = await checkBundledBinary(ctx2);
   if (!incomplete) return;
   outcome.runtimeIncomplete = incomplete.posted;
   throw incomplete.posted ? concluded(incomplete.reason) : concluded(incomplete.reason, incomplete.reason);
 }
-async function absorbBundledLoss(ctx, aborted, outcome) {
-  const lost = await reclassifyThrow(ctx, { aborted, originalReason: outcome.resultReason });
+async function absorbBundledLoss(ctx2, aborted, outcome) {
+  const lost = await reclassifyThrow(ctx2, { aborted, originalReason: outcome.resultReason });
   if (!lost) return false;
   outcome.resultReason = lost.reason;
   return lost.posted;
@@ -10330,7 +10483,7 @@ var TurnExecution = class {
     const prepareHook = this.opts.local.prepareHook;
     const cabaneCwd = this.turnContext.cwd;
     let effectiveCwd = localCwd ?? cabaneCwd;
-    if (effectiveCwd && !existsSync9(effectiveCwd)) {
+    if (effectiveCwd && !existsSync10(effectiveCwd)) {
       turnLog.warn(
         { cwd: effectiveCwd },
         "The working directory is missing; using the companion's directory instead. Check this agent's working directory setting."
@@ -11098,7 +11251,7 @@ function fingerprintSessionState(state) {
 // src/dispatcher.ts
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
-  if (!existsSync10(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
+  if (!existsSync11(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
   let entries;
   try {
     entries = readdirSync2(cwd);
@@ -11108,15 +11261,15 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join15(cwd, ".git");
-  if (!existsSync10(gitPath)) return { ok: true, reason: "usable" };
+  const gitPath = join17(cwd, ".git");
+  if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
-    stat = statSync2(gitPath);
+    stat = statSync3(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync10(join15(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync11(join17(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -11229,18 +11382,18 @@ var Dispatcher = class {
 };
 
 // src/providers/local-process.ts
-import { spawn as spawn6 } from "child_process";
-import { constants } from "os";
+import { spawn as spawn5 } from "child_process";
+import { constants as constants2 } from "os";
 var DEFAULT_KILL_GRACE_MS = 3e4;
 var DEFAULT_REAP_GRACE_MS = 3e3;
 function exitCode(code, signal) {
   if (code !== null) return code;
-  const signum = signal ? constants.signals[signal] : void 0;
+  const signum = signal ? constants2.signals[signal] : void 0;
   return signum !== void 0 ? 128 + signum : 1;
 }
 function createLocalProcessProvider(opts = {}) {
   const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
-  const spawnFn = opts.spawnFn ?? spawn6;
+  const spawnFn = opts.spawnFn ?? spawn5;
   const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
   const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
   const groupAlive = (pgid) => {
@@ -11321,24 +11474,24 @@ function createLocalProcessProvider(opts = {}) {
 
 // src/providers/docker.ts
 import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
-import { constants as constants2, tmpdir as tmpdir3 } from "os";
+import { constants as constants3, tmpdir as tmpdir3 } from "os";
 import {
   createReadStream,
   createWriteStream as createWriteStream2,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync4,
   readFileSync as readFileSync9,
-  renameSync as renameSync5,
+  renameSync as renameSync6,
   rmSync as rmSync9,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 import { Writable } from "stream";
 
 // src/providers/docker-cli.ts
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 function cliEnv(extra) {
   const keep = [
     "PATH",
@@ -11358,7 +11511,7 @@ function dockerCli(bin = "docker") {
       return new Promise((resolve2) => {
         let child;
         try {
-          child = spawn7(bin, [...args], {
+          child = spawn6(bin, [...args], {
             env: cliEnv(opts.env),
             stdio: ["pipe", "pipe", "pipe"]
           });
@@ -11389,13 +11542,13 @@ function dockerCli(bin = "docker") {
       });
     },
     spawn(args, env) {
-      return spawn7(bin, [...args], { env: cliEnv(env), stdio: ["pipe", "pipe", "pipe"] });
+      return spawn6(bin, [...args], { env: cliEnv(env), stdio: ["pipe", "pipe", "pipe"] });
     }
   };
 }
 
 // src/runner/git-credential.ts
-import { spawn as spawn8 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import { chmodSync as chmodSync5, rmSync as rmSync7 } from "fs";
 import { connect as connect3, createServer as createServer3 } from "net";
 
@@ -11437,7 +11590,7 @@ function deviceGitFill(helper, timeoutMs = 15e3) {
       "credential",
       "fill"
     ];
-    const child = spawn8("git", args, {
+    const child = spawn7("git", args, {
       stdio: ["pipe", "pipe", "ignore"],
       env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "", SSH_ASKPASS: "" }
     });
@@ -11521,14 +11674,14 @@ async function serveGitCredentials(opts) {
 // src/runner/collected-outbox.ts
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
-  renameSync as renameSync4,
+  renameSync as renameSync5,
   rmSync as rmSync8
 } from "fs";
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 function routes(t) {
   const conv = `/api/workspaces/${t.workspaceId}/conversations/${t.conversationId}`;
   const agent = `${conv}/participants/agents/${t.agentId}`;
@@ -11561,20 +11714,20 @@ function admitCollectedEntry(raw, turn) {
 }
 var atomicMove = (from, to) => {
   try {
-    renameSync4(from, to);
+    renameSync5(from, to);
   } catch {
     const partial = `${to}.partial`;
     copyFileSync2(from, partial);
-    renameSync4(partial, to);
+    renameSync5(partial, to);
     rmSync8(from, { force: true });
   }
 };
 function publishStaged(from, to, move = atomicMove) {
-  if (!existsSync11(from)) return { published: 0, complete: true };
+  if (!existsSync12(from)) return { published: 0, complete: true };
   const staged = readdirSync3(from).filter((n) => n.endsWith(".json")).map((name) => {
     let entry = {};
     try {
-      entry = JSON.parse(readFileSync8(join16(from, name), "utf8"));
+      entry = JSON.parse(readFileSync8(join18(from, name), "utf8"));
     } catch {
     }
     return { name, entry };
@@ -11587,7 +11740,7 @@ function publishStaged(from, to, move = atomicMove) {
   let published = 0;
   for (const { name } of staged) {
     try {
-      move(join16(from, name), join16(to, name));
+      move(join18(from, name), join18(to, name));
     } catch {
       return { published, complete: false };
     }
@@ -11599,9 +11752,9 @@ function publishStaged(from, to, move = atomicMove) {
 
 // src/providers/runner-base.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync12, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname7, join as join17, sep as sep2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync13, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname7, join as join19, sep as sep3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 var COMPANION_MOUNT = "/opt/cabane/companion";
 var BASE_DOCKERFILE = `FROM node:22-slim
 RUN apt-get update \\
@@ -11645,17 +11798,17 @@ async function ensureBaseImage(docker, image, log) {
   }
   return true;
 }
-function ownInstall(moduleFile = fileURLToPath3(import.meta.url)) {
+function ownInstall(moduleFile = fileURLToPath4(import.meta.url)) {
   let dir2 = dirname7(moduleFile);
   for (let i = 0; i < 4; i++) {
-    if (existsSync12(join17(dir2, "dist", "cli.js")) && existsSync12(join17(dir2, "package.json"))) break;
+    if (existsSync13(join19(dir2, "dist", "cli.js")) && existsSync13(join19(dir2, "package.json"))) break;
     dir2 = dirname7(dir2);
   }
-  if (!existsSync12(join17(dir2, "dist", "cli.js"))) return null;
-  const sdk = join17(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
-  if (!existsSync12(sdk)) return null;
-  const root = realpathSync2(dir2);
-  return realpathSync2(sdk).startsWith(root + sep2) ? root : null;
+  if (!existsSync13(join19(dir2, "dist", "cli.js"))) return null;
+  const sdk = join19(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
+  if (!existsSync13(sdk)) return null;
+  const root = realpathSync3(dir2);
+  return realpathSync3(sdk).startsWith(root + sep3) ? root : null;
 }
 function companionSource(input) {
   if (input.configured) {
@@ -11791,23 +11944,42 @@ function networkCreateError(stderr) {
 }
 function sessionArchivePath(deviceDir, attemptId) {
   if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
-  return join18(deviceDir, "attempts", attemptId, "session.tar");
+  return join20(deviceDir, "attempts", attemptId, "session.tar");
 }
 function pruneOtherAttempts(deviceDir, pair, keep) {
-  const root = join18(deviceDir, "attempts");
-  if (!existsSync13(root)) return;
+  const root = join20(deviceDir, "attempts");
+  if (!existsSync14(root)) return;
   for (const id of readdirSync4(root)) {
     if (id === keep || !UUID_RE.test(id)) continue;
     let pairOf = "";
     try {
-      pairOf = readFileSync9(join18(root, id, "pair"), "utf8");
+      pairOf = readFileSync9(join20(root, id, "pair"), "utf8");
     } catch {
       continue;
     }
     if (pairOf === `${pair.conversationId}/${pair.agentId}`) {
-      rmSync9(join18(root, id), { recursive: true, force: true });
+      rmSync9(join20(root, id), { recursive: true, force: true });
+    }
+  }
+}
+var IDLE_SESSION_ARCHIVE_MS = 30 * 24 * 60 * 6e4;
+function pruneIdleSessionArchives(deviceDir, now = Date.now(), maxAgeMs = IDLE_SESSION_ARCHIVE_MS) {
+  const root = join20(deviceDir, "attempts");
+  if (!existsSync14(root)) return [];
+  const removed = [];
+  for (const id of readdirSync4(root)) {
+    if (!UUID_RE.test(id)) continue;
+    let kept;
+    try {
+      kept = statSync4(join20(root, id)).mtimeMs;
+    } catch {
+      continue;
     }
+    if (now - kept < maxAgeMs) continue;
+    rmSync9(join20(root, id), { recursive: true, force: true });
+    removed.push(id);
   }
+  return removed;
 }
 var CappedFile = class extends Writable {
   constructor(path, cap) {
@@ -12005,15 +12177,15 @@ function createDockerProvider(opts) {
       await must(["network", "disconnect", "-f", other, name], "moving the container");
     if (others.includes(sharedNetwork)) await retireSharedNetwork();
   };
-  const socketRoot = opts.socketRoot ?? join18(
-    process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir3(),
+  const socketRoot = opts.socketRoot ?? join20(
+    process.env.XDG_RUNTIME_DIR && existsSync14(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir3(),
     `cabane-runners-${opts.deviceKey}`
   );
-  const socketDir = (name) => join18(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
+  const socketDir = (name) => join20(socketRoot, createHash4("sha256").update(name).digest("hex").slice(0, 12));
   const create = async (name, attempt) => {
     mkdirSync10(socketRoot, { recursive: true, mode: 448 });
     mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
-    const mounts = (opts.mounts ?? []).filter((m) => m.source.startsWith("/") && existsSync13(m.source)).flatMap((m) => ["--mount", `type=bind,src=${m.source},dst=${m.target},readonly`]);
+    const mounts = (opts.mounts ?? []).filter((m) => m.source.startsWith("/") && existsSync14(m.source)).flatMap((m) => ["--mount", `type=bind,src=${m.source},dst=${m.target},readonly`]);
     await must(
       [
         "create",
@@ -12151,7 +12323,7 @@ function createDockerProvider(opts) {
     }
   };
   const removeIn = (name, from, names) => names.length ? execIn(name, ["sh", "-c", 'cd "$1" && shift && rm -f -- "$@"', "sh", from, ...names]) : Promise.resolve(null);
-  const pendingPath = (name) => join18(opts.deviceDir, "runners-pending", `${name}.json`);
+  const pendingPath = (name) => join20(opts.deviceDir, "runners-pending", `${name}.json`);
   const readPending = (name) => {
     try {
       const ids = JSON.parse(readFileSync9(pendingPath(name), "utf8"));
@@ -12165,12 +12337,12 @@ function createDockerProvider(opts) {
       rmSync9(pendingPath(name), { force: true });
       return;
     }
-    mkdirSync10(join18(opts.deviceDir, "runners-pending"), { recursive: true });
+    mkdirSync10(join20(opts.deviceDir, "runners-pending"), { recursive: true });
     writeFileSync6(pendingPath(name), JSON.stringify([...new Set(ids)]));
   };
   const keepSession = async (name, attempt, attemptId) => {
     const archive = sessionArchivePath(opts.deviceDir, attemptId);
-    mkdirSync10(join18(archive, ".."), { recursive: true });
+    mkdirSync10(join20(archive, ".."), { recursive: true });
     const partial = `${archive}.${process.pid}.partial`;
     const file = new CappedFile(partial, sessionCap);
     const r = await execIn(
@@ -12186,8 +12358,8 @@ function createDockerProvider(opts) {
       (resolve2) => file.writableFinished ? resolve2() : file.once("finish", resolve2)
     );
     if (r.code === 0 && !file.over) {
-      renameSync5(partial, archive);
-      writeFileSync6(join18(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
+      renameSync6(partial, archive);
+      writeFileSync6(join20(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
       pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
       await writeMarker(name, attemptId);
       log.debug({ container: name, attemptId, bytes: file.bytes }, "runners: session files kept");
@@ -12201,7 +12373,7 @@ function createDockerProvider(opts) {
       file.over ? "runners: the session files are over the size cap and weren't kept; the next new container starts the session over" : "runners: couldn't keep the session files; the next new container starts the session over"
     );
   };
-  const stagingDir = (name) => join18(opts.deviceDir, "runners-pending", `${name}.outbox`);
+  const stagingDir = (name) => join20(opts.deviceDir, "runners-pending", `${name}.outbox`);
   const ensureRunning = async (name) => {
     const seen = await docker.run(["inspect", "-f", "{{.State.Running}}", name]);
     if (seen.code !== 0) return false;
@@ -12209,7 +12381,7 @@ function createDockerProvider(opts) {
     return (await docker.run(["start", name])).code === 0;
   };
   const dropArchive = (attemptId) => {
-    rmSync9(join18(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
+    rmSync9(join20(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
       recursive: true,
       force: true
     });
@@ -12278,7 +12450,7 @@ function createDockerProvider(opts) {
         if (seen.stdout.trim().split(" ")[0] !== "true")
           await must(["start", name], "starting the container");
         const git = await serveGitCredentials({
-          socketPath: join18(socketDir(name), "git.sock"),
+          socketPath: join20(socketDir(name), "git.sock"),
           hosts: opts.gitHosts,
           fill: opts.gitFill,
           log
@@ -12312,7 +12484,7 @@ function createDockerProvider(opts) {
       }
       if (attemptId && UUID_RE.test(attemptId)) {
         const archive = sessionArchivePath(opts.deviceDir, attemptId);
-        if (existsSync13(archive)) {
+        if (existsSync14(archive)) {
           const r = await execIn(name, ["tar", "-x", "-C", CONTAINER_HOME, "-f", "-"], {
             input: createReadStream(archive)
           });
@@ -12323,7 +12495,7 @@ function createDockerProvider(opts) {
             );
           } else {
             log.info(
-              { container: name, attemptId, bytes: statSync3(archive).size },
+              { container: name, attemptId, bytes: statSync4(archive).size },
               "runners: session files restored"
             );
           }
@@ -12378,7 +12550,7 @@ function createDockerProvider(opts) {
         };
         child.once("error", () => done(1));
         child.once("close", (code, sig) => {
-          const signum = sig ? constants2.signals[sig] : void 0;
+          const signum = sig ? constants3.signals[sig] : void 0;
           done(code ?? (signum !== void 0 ? 128 + signum : 1));
         });
         if (signal.aborted) stop();
@@ -12427,15 +12599,15 @@ function createDockerProvider(opts) {
       const transcripts = await readDir(name, `${CONTAINER_STATE}/transcripts`);
       if (transcripts) {
         const kept = transcripts.files.filter((f) => SAFE_NAME_RE.test(f.name));
-        if (kept.length) mkdirSync10(join18(opts.hostStateDir, "transcripts"), { recursive: true });
-        for (const f of kept) writeFileSync6(join18(opts.hostStateDir, "transcripts", f.name), f.data);
+        if (kept.length) mkdirSync10(join20(opts.hostStateDir, "transcripts"), { recursive: true });
+        for (const f of kept) writeFileSync6(join20(opts.hostStateDir, "transcripts", f.name), f.data);
         await removeIn(
           name,
           `${CONTAINER_STATE}/transcripts`,
           kept.map((f) => f.name)
         );
       }
-      const outboxRel = join18("outbox", encodeURIComponent(attempt.agentId));
+      const outboxRel = join20("outbox", encodeURIComponent(attempt.agentId));
       const outbox = await readDir(name, `${CONTAINER_STATE}/${outboxRel}`);
       let unpublished = false;
       if (outbox) {
@@ -12461,7 +12633,7 @@ function createDockerProvider(opts) {
           const staged = stagingDir(name);
           mkdirSync10(staged, { recursive: true });
           writeFileSync6(
-            join18(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
+            join20(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
             `${JSON.stringify(entry)}
 `
           );
@@ -12474,7 +12646,7 @@ function createDockerProvider(opts) {
         if (outbox.complete) {
           const published = publishStaged(
             stagingDir(name),
-            join18(opts.hostStateDir, outboxRel),
+            join20(opts.hostStateDir, outboxRel),
             opts.moveFile
           );
           queued = published.published;
@@ -12683,15 +12855,15 @@ import {
   mkdirSync as mkdirSync11,
   mkdtempSync,
   readFileSync as readFileSync10,
-  realpathSync as realpathSync3,
+  realpathSync as realpathSync4,
   rmSync as rmSync10,
   writeFileSync as writeFileSync7
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
-import { homedir as homedir4, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo2 } from "os";
-import { dirname as dirname8, join as join19, sep as sep3 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { homedir as homedir6, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo2 } from "os";
+import { dirname as dirname8, join as join21, sep as sep4 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
   try {
@@ -12787,13 +12959,13 @@ function companionStoreWatch(log) {
   return new CompanionStoreWatch({
     log,
     roots: () => {
-      const home = homedir4();
+      const home = homedir6();
       return storeWalkRoots([.../* @__PURE__ */ new Set([home, accountHome() ?? home])], cabaneDir());
     }
   });
 }
 function isAtOrUnder(path, dir2) {
-  return path === dir2 || path.startsWith(dir2 + sep3);
+  return path === dir2 || path.startsWith(dir2 + sep4);
 }
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
@@ -12892,15 +13064,15 @@ var DispatchClaims = class {
 
 // src/outbox.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync5,
   readFileSync as readFileSync11,
-  renameSync as renameSync6,
+  renameSync as renameSync7,
   rmSync as rmSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -12913,10 +13085,10 @@ var Outbox = class {
   // Resolved lazily (per call) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join20(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join22(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join20(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join22(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -12928,7 +13100,7 @@ var Outbox = class {
     const tmp = `${target}.${process.pid}.tmp`;
     try {
       writeFileSync8(tmp, JSON.stringify(entry) + "\n", "utf8");
-      renameSync6(tmp, target);
+      renameSync7(tmp, target);
     } catch (err) {
       try {
         rmSync11(tmp, { force: true });
@@ -12948,7 +13120,7 @@ var Outbox = class {
   // wedging the drain.
   list() {
     const dir2 = this.dir();
-    if (!existsSync14(dir2)) return [];
+    if (!existsSync15(dir2)) return [];
     let names;
     try {
       names = readdirSync5(dir2);
@@ -12958,7 +13130,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join20(dir2, name);
+      const full = join22(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync11(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -12994,7 +13166,7 @@ var Outbox = class {
   // different: it is positive evidence that nothing was ever queued here.
   maxSeqForTurn(turnId) {
     const dir2 = this.dir();
-    if (!existsSync14(dir2)) return 0;
+    if (!existsSync15(dir2)) return 0;
     const names = readdirSync5(dir2);
     const prefix = `${encodeURIComponent(turnId)}__`;
     let max = 0;
@@ -13014,7 +13186,7 @@ var Outbox = class {
   }
   size() {
     const dir2 = this.dir();
-    if (!existsSync14(dir2)) return 0;
+    if (!existsSync15(dir2)) return 0;
     try {
       return readdirSync5(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
@@ -13083,6 +13255,12 @@ var SseSubscriber = class {
     this.aborted = true;
     this.controller?.abort();
   }
+  // Connect again after a `stop()`, once its loop has exited.
+  async resume() {
+    await this.finished;
+    this.aborted = false;
+    this.start();
+  }
   setCursor(eventId) {
     this.lastEventId = eventId;
   }
@@ -13169,6 +13347,550 @@ function sleep3(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
+// src/updater.ts
+import { spawn as spawn8 } from "child_process";
+import { copyFileSync as copyFileSync3, existsSync as existsSync17, mkdirSync as mkdirSync16, renameSync as renameSync11, rmSync as rmSync14 } from "fs";
+import { dirname as dirname12, join as join26 } from "path";
+
+// src/boot-rule.ts
+import {
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync12,
+  realpathSync as realpathSync5,
+  renameSync as renameSync8,
+  rmSync as rmSync12,
+  symlinkSync,
+  writeFileSync as writeFileSync9
+} from "fs";
+import { dirname as dirname9, join as join23 } from "path";
+var UNCONFIRMED_WINDOW_MS = 10 * 6e4;
+var MAX_STAGE_ATTEMPTS = 3;
+function superseded(pending, ...running) {
+  return !!pending && !running.includes(pending.to);
+}
+function rolledBackState(state, pending, reason, now) {
+  const { pending: _done, ...rest } = state;
+  return {
+    ...rest,
+    lastResult: {
+      kind: "rolled_back",
+      from: pending.from,
+      to: pending.to,
+      at: now.toISOString(),
+      reason: reason.replace(/\s+/g, " ").trim().slice(0, 400)
+    },
+    failed: { version: pending.to, attempts: MAX_STAGE_ATTEMPTS, at: now.toISOString() }
+  };
+}
+
+// src/install-layout.ts
+import {
+  existsSync as existsSync16,
+  lstatSync,
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync6,
+  realpathSync as realpathSync6,
+  renameSync as renameSync9,
+  rmSync as rmSync13,
+  symlinkSync as symlinkSync2
+} from "fs";
+import { dirname as dirname10, join as join24 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+function versionsDir() {
+  return join24(cabaneDir(), "versions");
+}
+function currentLink() {
+  return join24(cabaneDir(), "current");
+}
+function bootGuardPath() {
+  return join24(cabaneDir(), "boot-guard.mjs");
+}
+function versionPackageRoot(version) {
+  return join24(versionsDir(), version, "node_modules", "@cabane", "companion");
+}
+function ownPackageRoot(moduleUrl = import.meta.url) {
+  return dirname10(dirname10(fileURLToPath6(moduleUrl)));
+}
+function packageVersion(root) {
+  try {
+    const pkg2 = JSON.parse(readFileSync13(join24(root, "package.json"), "utf8"));
+    return typeof pkg2.version === "string" ? pkg2.version : null;
+  } catch {
+    return null;
+  }
+}
+function currentRoot() {
+  try {
+    const root = realpathSync6(currentLink());
+    return existsSync16(join24(root, "dist", "cli.js")) ? root : null;
+  } catch {
+    return null;
+  }
+}
+function pointCurrentAt(root) {
+  const link = currentLink();
+  mkdirSync14(dirname10(link), { recursive: true });
+  const fresh = `${link}.${process.pid}.${Date.now()}`;
+  symlinkSync2(root, fresh);
+  try {
+    renameSync9(fresh, link);
+  } catch (err) {
+    rmSync13(fresh, { force: true });
+    throw err;
+  }
+}
+function pruneVersions(keep) {
+  const dir2 = versionsDir();
+  if (!existsSync16(dir2)) return [];
+  const removed = [];
+  for (const name of readdirSync6(dir2)) {
+    if (keep.includes(name)) continue;
+    rmSync13(join24(dir2, name), { recursive: true, force: true });
+    removed.push(name);
+  }
+  return removed;
+}
+function compareVersions(a, b) {
+  const parts = (v) => /^\d+(\.\d+)*$/.test(v) ? v.split(".").map(Number) : null;
+  const pa = parts(a);
+  const pb = parts(b);
+  if (!pa || !pb) return pa ? 1 : pb ? -1 : 0;
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+// src/update-state.ts
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync14, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname11, join as join25 } from "path";
+import { z as z18 } from "zod";
+var resultSchema = z18.object({
+  kind: z18.enum(["updated", "rolled_back", "failed"]),
+  from: z18.string(),
+  to: z18.string(),
+  at: z18.string(),
+  reason: z18.string().optional()
+});
+var pendingSchema = z18.object({
+  from: z18.string(),
+  // The package root `current` pointed at before the swap, so a rollback can point it back.
+  fromRoot: z18.string(),
+  to: z18.string(),
+  at: z18.string(),
+  boots: z18.number().int().nonnegative()
+});
+var stateSchema = z18.object({
+  server: z18.object({ latest: z18.string(), minimum: z18.string(), at: z18.string() }).optional(),
+  pending: pendingSchema.optional(),
+  lastResult: resultSchema.optional(),
+  failed: z18.object({ version: z18.string(), attempts: z18.number().int(), at: z18.string() }).optional()
+});
+function updateStatePath(dir2 = cabaneDir()) {
+  return join25(dir2, "update.json");
+}
+function readUpdateState(path = updateStatePath()) {
+  try {
+    const parsed = stateSchema.safeParse(JSON.parse(readFileSync14(path, "utf8")));
+    return parsed.success ? parsed.data : {};
+  } catch {
+    return {};
+  }
+}
+function writeUpdateState(state, path = updateStatePath()) {
+  mkdirSync15(dirname11(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync10(tmp, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+  renameSync10(tmp, path);
+}
+function updateUpdateState(change, path = updateStatePath()) {
+  const next = change(readUpdateState(path));
+  writeUpdateState(next, path);
+  return next;
+}
+
+// src/updater.ts
+function updateMode(env = process.env) {
+  return env.CABANE_COMPANION_SUPERVISED === "1" ? "supervised" : "attached";
+}
+var STAGE_RETRY_MS = 60 * 6e4;
+var SWAP_DRAIN_MS = 1e4;
+var SOURCE_BUILD_VERSION = "0.0.0";
+function versionToStage(input) {
+  const { own, state, now, force } = input;
+  if (!input.auto && !force) return null;
+  if (own === SOURCE_BUILD_VERSION) return null;
+  const latest = state.server?.latest;
+  if (!latest || compareVersions(latest, own) <= 0) return null;
+  if (state.pending) return null;
+  const failed = state.failed;
+  if (!force && failed?.version === latest) {
+    if (failed.attempts >= MAX_STAGE_ATTEMPTS) return null;
+    if (now - Date.parse(failed.at) < STAGE_RETRY_MS) return null;
+  }
+  return latest;
+}
+function rollBack(pending, reason, now = /* @__PURE__ */ new Date()) {
+  if (existsSync17(pending.fromRoot)) pointCurrentAt(pending.fromRoot);
+  return updateUpdateState((state) => rolledBackState(state, pending, reason, now));
+}
+function writeBootGuard(root = ownPackageRoot()) {
+  const built = join26(root, "dist", "boot-guard.js");
+  if (!existsSync17(built)) return false;
+  const target = bootGuardPath();
+  mkdirSync16(dirname12(target), { recursive: true });
+  const tmp = `${target}.${process.pid}.tmp`;
+  copyFileSync3(built, tmp);
+  renameSync11(tmp, target);
+  return true;
+}
+function oneLine(text) {
+  return text.replace(/\s+/g, " ").trim().slice(0, 400);
+}
+var runProcess = (command, args, opts = {}) => new Promise((resolve2) => {
+  let stdout = "";
+  let stderr = "";
+  let child;
+  try {
+    child = spawn8(command, [...args], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: opts.env ?? process.env
+    });
+  } catch (err) {
+    resolve2({ code: null, stdout, stderr: err instanceof Error ? err.message : String(err) });
+    return;
+  }
+  const timer = opts.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs) : null;
+  child.stdout.on("data", (d) => stdout += d.toString());
+  child.stderr.on("data", (d) => stderr += d.toString());
+  child.on("error", (err) => {
+    if (timer) clearTimeout(timer);
+    resolve2({ code: null, stdout, stderr: stderr || err.message });
+  });
+  child.on("close", (code) => {
+    if (timer) clearTimeout(timer);
+    resolve2({ code, stdout, stderr });
+  });
+});
+async function stageVersion(version, harnesses, deps = {}) {
+  const run = deps.run ?? runProcess;
+  const node = deps.execPath ?? process.execPath;
+  const target = join26(versionsDir(), version);
+  const placed = versionPackageRoot(version);
+  if (existsSync17(placed)) {
+    if (!await verifyInstall(placed, version, harnesses, { run, execPath: node }))
+      return { ok: true, root: placed };
+  }
+  const npm = join26(dirname12(node), "npm");
+  if (!existsSync17(npm))
+    return { ok: false, reason: `there is no npm beside Node at ${dirname12(node)}` };
+  mkdirSync16(versionsDir(), { recursive: true });
+  const staging = join26(versionsDir(), `.${version}.staging-${process.pid}`);
+  rmSync14(staging, { recursive: true, force: true });
+  const installed = await run(
+    npm,
+    [
+      "install",
+      "--prefix",
+      staging,
+      "--include=optional",
+      "--no-audit",
+      "--no-fund",
+      "--no-save",
+      "--loglevel=error",
+      `@cabane/companion@${version}`
+    ],
+    {
+      // npm's install scripts run on this Node, not whichever `node` is first on PATH.
+      env: { ...process.env, PATH: `${dirname12(node)}:${process.env.PATH ?? ""}` },
+      timeoutMs: 15 * 6e4
+    }
+  );
+  if (installed.code !== 0) {
+    rmSync14(staging, { recursive: true, force: true });
+    if (/\bE404\b|\bETARGET\b|No matching version found|is not in this registry/i.test(
+      installed.stderr
+    ))
+      return { ok: false, reason: `version ${version} isn't published yet`, unpublished: true };
+    return { ok: false, reason: `npm couldn't install it: ${lastLine(installed.stderr)}` };
+  }
+  const root = join26(staging, "node_modules", "@cabane", "companion");
+  const verdict = await verifyInstall(root, version, harnesses, { run, execPath: node });
+  if (verdict) {
+    rmSync14(staging, { recursive: true, force: true });
+    return { ok: false, reason: verdict };
+  }
+  rmSync14(target, { recursive: true, force: true });
+  renameSync11(staging, target);
+  return { ok: true, root: versionPackageRoot(version) };
+}
+async function verifyInstall(root, version, harnesses, deps) {
+  if (packageVersion(root) !== version) return `the installed package isn't version ${version}`;
+  const answered = await deps.run(deps.execPath, [join26(root, "dist", "bin.js"), "--version"], {
+    timeoutMs: 6e4,
+    env: { ...process.env, CABANE_LAUNCH_SELF: "1" }
+  });
+  if (answered.code !== 0 || answered.stdout.trim() !== version) {
+    return `it doesn't start: ${lastLine(answered.stderr) || "no version printed"}`;
+  }
+  if (harnesses.length === 0) return null;
+  const probed = await deps.run(deps.execPath, [join26(root, "dist", "postinstall.js"), "--json"], {
+    timeoutMs: 6e4
+  });
+  let resolutions = {};
+  try {
+    resolutions = JSON.parse(probed.stdout);
+  } catch {
+    return "it couldn't say which bundled agents it has";
+  }
+  const missing = harnesses.filter((h) => resolutions[h]?.status !== "present");
+  if (missing.length > 0) {
+    return `its bundled ${missing.map(harnessName).join(" and ")} ${missing.length > 1 ? "are" : "is"} missing`;
+  }
+  return null;
+}
+function harnessName(h) {
+  return h === "claude-code" ? "Claude Code" : "Codex";
+}
+function lastLine(text) {
+  const lines2 = text.split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines2.at(-1)?.slice(0, 300) ?? "";
+}
+var CompanionUpdater = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  deps;
+  staging = null;
+  ready = null;
+  swapping = false;
+  watchdog = null;
+  now;
+  // At start: a recorded swap to a version that will never start again (someone installed or
+  // chose another since) is dropped, or nothing would ever confirm it and no later update would
+  // be installed.
+  start() {
+    const pending = readUpdateState().pending;
+    const current = currentRoot();
+    const currentVersion = current ? packageVersion(current) : null;
+    if (superseded(pending, this.deps.own, ...currentVersion ? [currentVersion] : [])) {
+      updateUpdateState(({ pending: _gone, ...rest }) => rest);
+      this.deps.log.info(
+        { to: pending.to, own: this.deps.own },
+        `Dropped the update to ${pending.to}: Cabane ${this.deps.own} was installed since`
+      );
+    }
+  }
+  // The deadline for an update this process is the result of: ten minutes from the first time
+  // Cabane answers it without its stream connecting. Until Cabane answers, there's no verdict on
+  // time: a server or network that is down says nothing about the version.
+  armDeadline() {
+    if (this.watchdog) return;
+    this.watchdog = setTimeout(() => void this.giveUp(), UNCONFIRMED_WINDOW_MS);
+    this.watchdog.unref?.();
+  }
+  stop() {
+    if (this.watchdog) clearTimeout(this.watchdog);
+    this.watchdog = null;
+  }
+  async giveUp() {
+    const pending = readUpdateState().pending;
+    if (!pending || pending.to !== this.deps.own) return;
+    this.deps.log.warn(
+      { from: pending.from, to: pending.to },
+      `Cabane ${pending.to} didn't connect within ${UNCONFIRMED_WINDOW_MS / 6e4} minutes of Cabane answering; going back to ${pending.from}`
+    );
+    rollBack(
+      pending,
+      `it didn't connect to Cabane within ${UNCONFIRMED_WINDOW_MS / 6e4} minutes`
+    );
+    await this.deps.restart();
+  }
+  // Auto-update is on and something will restart this companion into the new version.
+  updatesItself() {
+    return this.deps.mode === "supervised" && this.deps.autoUpdate();
+  }
+  // What the heartbeat reports.
+  report() {
+    const last = readUpdateState().lastResult;
+    return { auto: this.updatesItself(), ...last ? { lastResult: last } : {} };
+  }
+  // A heartbeat landed. Record what the server named; confirm an update this process is the
+  // result of; then, when there is something newer, install it and swap when idle.
+  async onHeartbeat(server, streamConnected) {
+    const state = updateUpdateState((s) => ({
+      ...s,
+      ...server ? { server: { ...server, at: new Date(this.now()).toISOString() } } : {}
+    }));
+    if (state.pending?.to === this.deps.own) {
+      if (streamConnected) this.confirm(state.pending);
+      else this.armDeadline();
+    }
+    if (this.ready) {
+      await this.trySwap();
+      return;
+    }
+    this.maybeStage(false);
+  }
+  confirm(pending) {
+    this.stop();
+    updateUpdateState((s) => {
+      const { pending: _done, failed: _failed, ...rest } = s;
+      return {
+        ...rest,
+        lastResult: {
+          kind: "updated",
+          from: pending.from,
+          to: pending.to,
+          at: new Date(this.now()).toISOString()
+        }
+      };
+    });
+    const removed = pruneVersions([pending.to, pending.from]);
+    this.deps.log.info(
+      { from: pending.from, to: pending.to, removed },
+      `Updated Cabane from ${pending.from} to ${pending.to}`
+    );
+  }
+  // `cabane update`, from the person: install the latest now, whatever the setting.
+  async updateNow() {
+    const state = readUpdateState();
+    const latest = state.server?.latest;
+    if (!latest) return { ok: false, message: "Cabane hasn't said which version is latest yet." };
+    if (compareVersions(latest, this.deps.own) <= 0)
+      return { ok: true, message: `Cabane ${this.deps.own} is up to date.` };
+    if (state.pending?.to === latest) return { ok: true, message: this.waitingMessage(latest) };
+    if (this.ready === latest) {
+      void this.trySwap();
+      return { ok: true, message: this.waitingMessage(latest) };
+    }
+    this.maybeStage(true);
+    if (this.staging) await this.staging;
+    if (this.ready !== latest) {
+      const after = readUpdateState();
+      if (after.pending?.to === latest) return { ok: true, message: this.waitingMessage(latest) };
+      if (after.failed?.version === latest && after.failed.attempts === 0)
+        return { ok: false, message: `Cabane ${latest} isn't published yet. Try again later.` };
+      const failed = after.lastResult;
+      return {
+        ok: false,
+        message: failed?.kind === "failed" && failed.to === latest ? `Couldn't update to ${latest}: ${failed.reason ?? "see cabane logs"}.` : `Couldn't update to ${latest}. cabane logs says why.`
+      };
+    }
+    void this.trySwap();
+    return { ok: true, message: this.waitingMessage(latest) };
+  }
+  waitingMessage(version) {
+    if (this.deps.mode === "attached")
+      return `Cabane ${version} is installed. It runs from the next  cabane start.`;
+    return this.deps.isIdle() ? `Updating to ${version} now.` : `Updating to ${version} once the turns running now finish.`;
+  }
+  maybeStage(force) {
+    if (this.staging) return;
+    const version = versionToStage({
+      auto: this.updatesItself(),
+      own: this.deps.own,
+      state: readUpdateState(),
+      now: this.now(),
+      force
+    });
+    if (!version) return;
+    const stage = this.deps.stage ?? stageVersion;
+    this.staging = (async () => {
+      this.deps.log.info({ version }, `Installing Cabane ${version} beside this one`);
+      const outcome = await stage(version, this.deps.harnesses());
+      if (outcome.ok) {
+        this.ready = version;
+        updateUpdateState((s) => {
+          const { failed: _failed, ...rest } = s;
+          return rest;
+        });
+        return;
+      }
+      if (outcome.unpublished) {
+        this.deps.log.info({ version }, `Cabane ${version} isn't published yet; trying later`);
+        updateUpdateState((s) => ({
+          ...s,
+          failed: { version, attempts: 0, at: new Date(this.now()).toISOString() }
+        }));
+        return;
+      }
+      this.deps.log.warn({ version, reason: outcome.reason }, `Couldn't install Cabane ${version}`);
+      updateUpdateState((s) => {
+        const attempts = s.failed?.version === version ? s.failed.attempts + 1 : 1;
+        const at = new Date(this.now()).toISOString();
+        return {
+          ...s,
+          failed: { version, attempts, at },
+          // Reported once it has failed for good, so a registry blip isn't an email.
+          ...attempts >= MAX_STAGE_ATTEMPTS || force ? {
+            lastResult: {
+              kind: "failed",
+              from: this.deps.own,
+              to: version,
+              at,
+              reason: oneLine(outcome.reason)
+            }
+          } : {}
+        };
+      });
+    })().finally(() => {
+      this.staging = null;
+    });
+    void this.staging.then(() => this.trySwap());
+  }
+  // Swap into the ready version once nothing is running. Called on each heartbeat until it can.
+  async trySwap() {
+    const to = this.ready;
+    if (!to || this.swapping) return;
+    if (readUpdateState().pending) return;
+    if (this.deps.mode === "attached") {
+      this.select(to);
+      this.deps.log.info({ version: to }, `Cabane ${to} is installed; it runs from the next start`);
+      return;
+    }
+    if (!this.deps.isIdle()) return;
+    this.swapping = true;
+    try {
+      await this.deps.pauseStream();
+      const sleep4 = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+      const deadline = this.now() + SWAP_DRAIN_MS;
+      await sleep4(250);
+      while (!this.deps.isIdle() && this.now() < deadline) await sleep4(250);
+      if (!this.deps.isIdle()) {
+        this.deps.resumeStream();
+        return;
+      }
+      this.select(to);
+      this.deps.log.info({ from: this.deps.own, to }, `Restarting into Cabane ${to}`);
+      await this.deps.restart();
+    } finally {
+      this.swapping = false;
+    }
+  }
+  // Record the swap and point `current` at `to`, leaving the guard that counts its starts.
+  select(to) {
+    const fromRoot = currentRoot() ?? ownPackageRoot();
+    writeBootGuard();
+    updateUpdateState((s) => ({
+      ...s,
+      pending: {
+        from: this.deps.own,
+        fromRoot,
+        to,
+        at: new Date(this.now()).toISOString(),
+        boots: 0
+      }
+    }));
+    pointCurrentAt(versionPackageRoot(to));
+    this.ready = null;
+  }
+};
+
 // src/version.ts
 import { createRequire as createRequire3 } from "module";
 var pkg = createRequire3(import.meta.url)("../package.json");
@@ -13176,6 +13898,7 @@ var COMPANION_VERSION = pkg.version;
 
 // src/supervisor.ts
 var HEARTBEAT_INTERVAL_MS = 3e4;
+var ARCHIVE_PRUNE_MS = 24 * 60 * 6e4;
 var SHUTDOWN_HEARTBEAT_WAIT_MS = 1e3;
 function positiveIntEnv(name) {
   const raw = process.env[name];
@@ -13215,9 +13938,10 @@ var CompanionSupervisor = class {
   // surface, so the UI never disagrees with what is advertised. Null until the
   // first probe.
   harnessSignals = null;
-  // Fresh per attempt, never the cached heartbeat signal: installing a harness
-  // between attempts must be observed immediately.
-  probePresence;
+  // Fresh per connect, cached for the heartbeat: a sign-in between attempts
+  // must be observed immediately, and a heartbeat must spawn nothing.
+  runHarnessCheck;
+  harnessChecks = {};
   exitFn;
   reexecFn;
   dispatcherFactory;
@@ -13256,15 +13980,23 @@ var CompanionSupervisor = class {
   // Which dispatches this process is running, so a redelivered frame doesn't
   // run the turn a second time.
   claims = new DispatchClaims();
+  archivePruneTimer = null;
+  // Keeps this companion current when its person said so; null until paired.
+  updater = null;
+  restartForUpdate;
   constructor(opts) {
     this.config = opts.config;
     this.log = opts.log;
     this.hub = opts.hub;
     this.resolveBundled = opts.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
-    this.probePresence = opts.probePresence ?? probeHarnessPresence;
+    this.runHarnessCheck = opts.checkHarness ?? ((runtime) => checkHarnessUsable(runtime));
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
+    this.restartForUpdate = opts.restartForUpdate ?? (async () => {
+      await this.shutdown();
+      this.exitFn(0);
+    });
     this.dispatcherFactory = opts.dispatcherFactory;
     if (opts.runnerCommand) this.runnerCommand = opts.runnerCommand;
     if (opts.runnerProvider) this.providerForRunners = opts.runnerProvider;
@@ -13288,7 +14020,7 @@ var CompanionSupervisor = class {
     });
   }
   dockerRunners() {
-    return runnersEnabled(this.config) && this.config.runners?.provider === "docker";
+    return dockerRunnersConfigured(this.config);
   }
   // Stand up the data plane: pair check, initial assignments pull, then the
   // heartbeat + poll loops. A companion with no device token (logged out) does
@@ -13315,6 +14047,9 @@ var CompanionSupervisor = class {
         if (!this.runnerImage) await invalidateCompanionVolume(docker, image, source);
       }
       this.latchBootBundledState();
+      this.pruneSessionArchives();
+      this.archivePruneTimer = setInterval(() => this.pruneSessionArchives(), ARCHIVE_PRUNE_MS);
+      this.archivePruneTimer.unref?.();
     }
     const sandboxRows = agentSandboxRows(this.config);
     if (sandboxRows.length > 0 && this.dockerRunners()) {
@@ -13335,10 +14070,10 @@ var CompanionSupervisor = class {
       else this.log.error({ posture }, `runners: ${summary}`);
       void this.companionStores().refresh();
     }
-    const startupHarnessRefresh = this.refreshHarnessStatuses();
+    const startupHarnessRefresh = this.checkHarnesses().then(() => this.refreshHarnessStatuses());
     this.trackHeartbeat(startupHarnessRefresh);
     if (!this.config.deviceToken) {
-      this.log.warn("This device isn't paired. Run cabane-companion start to pair it.");
+      this.log.warn("This device isn't paired. Run cabane start to pair it.");
       return;
     }
     this.deviceApi = new DeviceApi({
@@ -13374,10 +14109,27 @@ var CompanionSupervisor = class {
       },
       onAuthFailure: () => {
         this.log.error(
-          "Cabane no longer accepts this device. Run cabane-companion logout, then cabane-companion start to pair again."
+          `Cabane no longer accepts this device. Run ${cabane("logout")}, then ${cabane("start")} to pair again.`
         );
       }
     });
+    this.updater = new CompanionUpdater({
+      own: COMPANION_VERSION,
+      mode: updateMode(),
+      autoUpdate: () => this.config.update?.auto === true,
+      harnesses: () => this.connectedBundledHarnesses(),
+      isIdle: () => this.idle(),
+      pauseStream: async () => {
+        const sub = this.deviceSub;
+        if (!sub) return;
+        sub.stop();
+        await sub.finished;
+      },
+      resumeStream: () => void this.deviceSub?.resume(),
+      restart: () => this.restartForUpdate(),
+      log: this.log
+    });
+    this.updater.start();
     await this.refreshAssignments();
     this.deviceSub.start();
     const firstHeartbeat = startupHarnessRefresh.then(async () => {
@@ -13438,13 +14190,20 @@ var CompanionSupervisor = class {
         // Omitted until the first observed failure or heal, so the server's
         // status-less manifest synthesis still runs for a fresh companion.
         ...connectorReports.length > 0 ? { connectors: connectorReports } : {},
-        ...opencodeModels !== null ? { models: opencodeModels } : {}
+        ...opencodeModels !== null ? { models: opencodeModels } : {},
+        ...this.updater ? { update: this.updater.report() } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
       this.checkVersionSkew(res.serverVersion);
       this.heartbeated = true;
       void this.recoverRuns();
+      void this.updater?.onHeartbeat(res.companion, this.deviceConnected).catch(
+        (err) => this.log.warn(
+          { err: err instanceof Error ? err.message : String(err) },
+          "Couldn't check for a Cabane update; trying again on the next check-in."
+        )
+      );
     } catch (err) {
       this.log.warn(
         { ...apiErrorLogFields(err) },
@@ -13831,11 +14590,11 @@ var CompanionSupervisor = class {
     if (this.runnerCommand) return this.runnerCommand;
     return this.dockerRunners() ? ["cabane-companion", "run-turn"] : selfRunnerCommand();
   }
-  buildDispatcher(ctx) {
+  buildDispatcher(ctx2) {
     const hostLocal = localAgentConfig(this.config, {
-      agentId: ctx.agentId,
-      agentUsername: ctx.agentUsername,
-      workspaceSlug: ctx.workspaceSlug
+      agentId: ctx2.agentId,
+      agentUsername: ctx2.agentUsername,
+      workspaceSlug: ctx2.workspaceSlug
     });
     const local = this.dockerRunners() && hostLocal.prepareHook ? {
       ...hostLocal,
@@ -13844,20 +14603,20 @@ var CompanionSupervisor = class {
         command: containerHookPath(hostLocal.prepareHook.command)
       }
     } : hostLocal;
-    if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
+    if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx2, local });
     return new Dispatcher({
       deviceId: this.deviceId ?? void 0,
-      api: ctx.api,
-      baseUrl: ctx.baseUrl,
-      workspaceId: ctx.workspaceId,
-      workspaceSlug: ctx.workspaceSlug,
-      agentId: ctx.agentId,
-      agentUsername: ctx.agentUsername,
-      credential: ctx.credential,
+      api: ctx2.api,
+      baseUrl: ctx2.baseUrl,
+      workspaceId: ctx2.workspaceId,
+      workspaceSlug: ctx2.workspaceSlug,
+      agentId: ctx2.agentId,
+      agentUsername: ctx2.agentUsername,
+      credential: ctx2.credential,
       local,
-      aborts: ctx.aborts,
-      runConfig: ctx.runConfig,
-      log: this.log.child({ agentName: ctx.agentDisplayName ?? ctx.agentUsername }),
+      aborts: ctx2.aborts,
+      runConfig: ctx2.runConfig,
+      log: this.log.child({ agentName: ctx2.agentDisplayName ?? ctx2.agentUsername }),
       // Read PER TURN off the heartbeat's own predicates, so a harness installed
       // or connected after boot works on the next turn exactly as it appears on
       // the next beat, and a runtime advertised by one and refused by the other
@@ -13870,7 +14629,7 @@ var CompanionSupervisor = class {
       // DEFAULT_AGENT_IDLE_TIMEOUT_MS.
       ...positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") !== void 0 ? { idleTimeoutMs: positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") } : {},
       ...positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") !== void 0 ? { totalTimeoutMs: positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") } : {},
-      observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
+      observer: this.hub.observerFor(ctx2.workspaceId, ctx2.agentId, ctx2.workspaceSlug),
       transcriptDir: transcriptsDir(),
       connectorHealth: this.connectorHealth,
       ...runnersEnabled(this.config) ? {
@@ -13881,7 +14640,7 @@ var CompanionSupervisor = class {
           reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
-          sandbox: this.runnerSandboxFor(agentSandbox(this.config, ctx)),
+          sandbox: this.runnerSandboxFor(agentSandbox(this.config, ctx2)),
           policy: this.sandboxPolicy(),
           companionStores: () => this.companionStores().stores()
         }
@@ -14309,23 +15068,23 @@ var CompanionSupervisor = class {
     configureLogger(this.log, next);
   }
   // ---- harnesses ----
-  // Probe all three harnesses, cache signals and versions, and push the snapshot
-  // to the hub. `probeHarnessSignals` never throws, but this is wrapped anyway so
-  // a refresh can never take a heartbeat down.
-  async refreshHarnessStatuses(presence = {}) {
+  // Assemble the signals from the cached sign-in checks, cache versions, and
+  // push the snapshot to the hub. Runs no sign-in check: the heartbeat calls
+  // this. `probeHarnessSignals` never throws, but this is wrapped anyway so a
+  // refresh can never take a heartbeat down.
+  async refreshHarnessStatuses() {
     try {
       const signals = await probeHarnessSignals(this.config, {
-        probePresence: this.probePresence,
-        presence,
+        checks: this.harnessChecks,
         // Through the supervisor's seam, so a test pins the host fact.
         resolveBundled: this.resolveBundled
       });
       this.harnessSignals = signals;
       this.logBundledTransitions();
       this.harnessVersions = {
-        claudeCode: signals.claudeVersion,
+        claudeCode: checkVersion(signals.claudeCheck),
         opencode: signals.opencodeVersion,
-        codex: signals.codexVersion
+        codex: checkVersion(signals.codexCheck)
       };
       this.hub.setHarnesses(deriveHarnessSnapshot(signals).harnesses);
     } catch (err) {
@@ -14335,9 +15094,32 @@ var CompanionSupervisor = class {
       );
     }
   }
+  // Check one bundled harness's sign-in in this process, cache it for the
+  // heartbeat, and — for a harness the user connected — seed connector health,
+  // so Cabane says "sign-in needed" without waiting for a turn to fail. A
+  // check that couldn't answer seeds nothing either way.
+  async checkHarness(runtime) {
+    let check;
+    try {
+      check = await this.runHarnessCheck(runtime);
+    } catch {
+      check = { status: "check_failed", reason: "spawn" };
+    }
+    this.harnessChecks[runtime] = check;
+    const intended = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
+    if (intended && (isUsable(check) || check.status === "signed_out")) {
+      this.connectorHealth.recordLocalCheck(runtime, isUsable(check));
+    }
+    return check;
+  }
+  async checkHarnesses() {
+    if (this.dockerRunners()) return;
+    await Promise.all([this.checkHarness("claude-code"), this.checkHarness("codex")]);
+  }
   // The dashboard "recheck harnesses" control — an immediate re-probe so a user who
   // just installed/started a harness sees it flip without waiting for the next beat.
   async recheckHarnesses() {
+    await this.checkHarnesses();
     await this.refreshHarnessStatuses();
   }
   // Beat NOW and wait for it to land. `start` calls this before asking the
@@ -14357,48 +15139,57 @@ var CompanionSupervisor = class {
   currentConfig() {
     return this.config;
   }
-  // Enable a config-driven harness by flipping the flag the app owns in
+  // Connect a harness by flipping the flag the app owns in
   // `~/.cabane/config.json`. Never installs a binary or drives a login (BYO).
   //
-  // This records INTENT, the user's half: a harness is advertised only when also
-  // its bundled binary resolves, so an enable on a companion whose optional
-  // dependency never installed advertises nothing, and the Harnesses surface
-  // says why.
-  //   - claude-code: `claudeCode.enabled`, after a presence check. The terminal
-  //     offer and the web pairing flow both call this.
-  //   - codex: `codex.enabled`, after a presence check (login stays the user's).
+  // Claude Code and Codex are checked FIRST, in this process — the one that
+  // will run their turns — and an agent that isn't usable here is refused before
+  // anything is written: the terminal, the control socket and the dashboard all
+  // come through here, so they all get the same answer. An agent already
+  // connected is checked too and reported truthfully, with nothing written.
   //   - opencode: `opencode.serverUrl`, ONLY after health-probing the URL; an
   //     unreachable one is a typed failure shown in place.
-  // On success: persist, re-probe and beat at once, so the answer is true in
-  // Cabane promptly either way. Never throws for a valid input.
+  // A connect records INTENT: a harness is advertised only when its bundled
+  // binary also resolves. On success: persist, refresh and beat at once, so the
+  // answer is true in Cabane promptly either way. Never throws for a valid input.
   async enableHarness(input) {
     let next;
-    let checkedPresence = null;
-    if (input.runtime === "claude-code") {
-      const presence = input.presence ?? await this.probePresence("claude-code");
-      if (presence.status !== "present") {
+    let outcome;
+    if (input.runtime === "claude-code" || input.runtime === "codex") {
+      const runtime = input.runtime;
+      const connected = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
+      const check = this.dockerRunners() ? void 0 : await this.checkHarness(runtime);
+      if (check && !isUsable(check)) {
+        await this.refreshHarnessStatuses();
+        this.kickHeartbeat();
+        return { ok: false, outcome: { kind: "refused", runtime, check, connected } };
+      }
+      const label = this.config.deviceLabel;
+      if (connected) {
+        await this.refreshHarnessStatuses();
+        this.kickHeartbeat();
         return {
-          ok: false,
-          error: presenceReason("claude-code", presence.status),
-          presence: true
+          ok: true,
+          outcome: {
+            kind: "already",
+            runtime,
+            ...check ? { check } : {},
+            ...label ? { deviceLabel: label } : {}
+          }
         };
       }
-      checkedPresence = { runtime: "claude-code", result: presence };
-      next = { ...this.config, claudeCode: { enabled: true } };
-    } else if (input.runtime === "codex") {
-      const presence = input.presence ?? await this.probePresence("codex");
-      if (presence.status !== "present") {
-        return { ok: false, error: presenceReason("codex", presence.status), presence: true };
-      }
-      checkedPresence = { runtime: "codex", result: presence };
-      next = { ...this.config, codex: { enabled: true } };
+      next = runtime === "codex" ? { ...this.config, codex: { enabled: true } } : { ...this.config, claudeCode: { enabled: true } };
+      outcome = { kind: "connected", runtime, ...check ? { check } : {} };
     } else {
       const serverUrl = input.serverUrl.trim();
       const parsed = companionConfigSchema.shape.opencode.safeParse({ serverUrl });
       if (!parsed.success) {
         return {
           ok: false,
-          error: "That doesn\u2019t look like a valid URL (e.g. http://127.0.0.1:4096)."
+          outcome: {
+            kind: "opencode",
+            message: "That doesn\u2019t look like a valid URL (e.g. http://127.0.0.1:4096)."
+          }
         };
       }
       const boundedFetch = ((url, init2) => fetch(url, { ...init2, signal: AbortSignal.timeout(4e3) }));
@@ -14406,19 +15197,21 @@ var CompanionSupervisor = class {
       if (version === null) {
         return {
           ok: false,
-          error: `Couldn\u2019t reach an opencode server at ${serverUrl}. Start \`opencode serve\` and check the URL.`
+          outcome: {
+            kind: "opencode",
+            message: `Couldn\u2019t reach an opencode server at ${serverUrl}. Start \`opencode serve\` and check the URL.`
+          }
         };
       }
       next = { ...this.config, opencode: { serverUrl } };
+      outcome = { kind: "connected", runtime: "opencode" };
     }
     this.config = next;
     saveConfig(next);
     this.rebuildDispatchers();
-    await this.refreshHarnessStatuses(
-      checkedPresence ? { [checkedPresence.runtime]: checkedPresence.result } : {}
-    );
+    await this.refreshHarnessStatuses();
     this.kickHeartbeat();
-    return { ok: true };
+    return { ok: true, outcome };
   }
   // Re-create every running agent's Dispatcher from the CURRENT config, keeping
   // the runner (its api, outbox, chains) intact, so constructor-captured options
@@ -14441,9 +15234,54 @@ var CompanionSupervisor = class {
       }
     }
   }
+  // A long-lived device keeps a session archive per conversation and agent it ever ran; those
+  // nobody has used in a month go.
+  pruneSessionArchives() {
+    try {
+      const removed = pruneIdleSessionArchives(cabaneDir());
+      if (removed.length > 0)
+        this.log.info({ removed: removed.length }, "runners: removed idle session archives");
+    } catch (err) {
+      this.log.warn(
+        { err: err instanceof Error ? err.message : String(err) },
+        "runners: couldn't remove idle session archives"
+      );
+    }
+  }
+  // Nothing running and nothing about to: no dispatch claimed, no turn chained, no recovery
+  // in progress. What a self-update swap waits for.
+  idle() {
+    if (this.claims.size > 0 || this.recovering) return false;
+    for (const wr of this.workspaces.values()) if (wr.chains.size > 0) return false;
+    return true;
+  }
+  // The bundled harnesses this device has connected, which a new version must still carry.
+  connectedBundledHarnesses() {
+    return [
+      ...isClaudeCodeConnected(this.config) ? ["claude-code"] : [],
+      ...isCodexEnabled(this.config) ? ["codex"] : []
+    ];
+  }
+  // `cabane update`, over the control socket: set whether this companion keeps itself current
+  // (`auto`), or install the latest now.
+  async update(auto) {
+    if (auto !== void 0) {
+      this.config = { ...this.config, update: { auto } };
+      saveConfig(this.config);
+      if (auto) this.kickHeartbeat();
+      return {
+        ok: true,
+        message: auto ? "Cabane will keep itself up to date. Updates install between turns and roll back if they fail." : "Cabane won't update itself. Run  cabane update  to update."
+      };
+    }
+    if (!this.updater) return { ok: false, message: "This computer isn't paired yet." };
+    return this.updater.updateNow();
+  }
   // ---- control actions ----
   async shutdown() {
     this.stopped = true;
+    this.updater?.stop();
+    if (this.archivePruneTimer) clearInterval(this.archivePruneTimer);
     if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
     if (this.pollTimer) clearInterval(this.pollTimer);
     const heartbeat = this.inFlightHeartbeat;
@@ -14550,22 +15388,22 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync17, readFileSync as readFileSync15, rmSync as rmSync15, writeFileSync as writeFileSync11 } from "fs";
+import { join as join27 } from "path";
 function crashMarkerPath() {
-  return join21(cabaneDir(), "last-error.json");
+  return join27(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
-    mkdirSync13(cabaneDir(), { recursive: true });
-    writeFileSync9(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
+    mkdirSync17(cabaneDir(), { recursive: true });
+    writeFileSync11(crashMarkerPath(), JSON.stringify(rec, null, 2) + "\n");
   } catch {
   }
 }
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync15(path)) rmSync12(path, { force: true });
+    if (existsSync18(path)) rmSync15(path, { force: true });
   } catch {
   }
 }
@@ -14575,17 +15413,14 @@ async function createCompanionRuntime(opts = {}) {
   const log = getLogger();
   installProcessSafetyNet(log);
   let cfg;
-  let claudeCode;
   try {
-    ({ cfg, claudeOnPath: claudeCode } = await requireStartConfig({
-      ...opts.probeClaude ? { probeClaude: opts.probeClaude } : {},
-      onMigrated: (migrated, onPath) => log.debug(
+    cfg = requireStartConfig({
+      onMigrated: (migrated) => log.debug(
         { claudeCode: isClaudeCodeConnected(migrated) },
-        onPath ? "companion: carried Claude Code over as a connected harness on this device (connectors are now chosen, not detected)" : "companion: no Claude Code on PATH, so this device starts with it disconnected (connectors are now chosen, not detected)"
+        "companion: carried Claude Code over as a connected harness on this device (connectors are now chosen, not detected)"
       )
-    }));
-    await warnAboutHarnessReadiness(cfg, {
-      probeClaude: async () => claudeCode,
+    });
+    warnAboutHarnessReadiness(cfg, {
       // The CLI's onboarding script says this in its own words, so it hands a
       // sink that logs instead. Every other caller keeps the stderr line.
       ...opts.onReadinessWarning ? { warn: opts.onReadinessWarning } : {}
@@ -14600,13 +15435,6 @@ async function createCompanionRuntime(opts = {}) {
     throw err;
   }
   configureLogger(log, cfg);
-  const harnessVersions = await probeHarnessVersions({
-    // Connected AND its CLI answered — the two things that make a
-    // `claude --version` probe worth spawning. Not the offer predicate.
-    claudeCode: claudeCode && isClaudeCodeConnected(cfg),
-    opencodeServerUrl: cfg.opencode?.serverUrl,
-    codex: isCodexEnabled(cfg)
-  });
   const instanceId = randomUUID7();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
@@ -14630,39 +15458,39 @@ async function createCompanionRuntime(opts = {}) {
     // process behind the marker pid is this companion (not a recycled pid).
     instanceId
   });
+  let restartForUpdate = async () => {
+  };
   const supervisor = new CompanionSupervisor({
     config: cfg,
     log,
     hub,
-    harnessVersions
+    ...opts.checkHarness ? { checkHarness: opts.checkHarness } : {},
+    restartForUpdate: () => restartForUpdate()
   });
   await supervisor.start();
   const connectHarness = async (runtime, serverUrl) => {
-    const currentConfig = supervisor.currentConfig();
-    const resolvedServerUrl = runtime === "opencode" ? await resolveOpencodeServerUrl(currentConfig.opencode?.serverUrl, serverUrl) : null;
-    const candidate = runtime === "opencode" ? { ...currentConfig, opencode: { serverUrl: resolvedServerUrl ?? "" } } : currentConfig;
-    const presence = runtime === "opencode" ? void 0 : await probeHarnessPresence(runtime);
-    const verdict = await shakeOutHarness(runtime, candidate, {
-      ...presence ? { presence } : {}
-    });
-    if (verdict === "absent" || verdict === "unusable") {
-      return { ok: false, error: presenceRefusal(runtime, verdict, CLI_PRESENCE_ACTION) };
+    if (runtime !== "opencode") return (await supervisor.enableHarness({ runtime })).outcome;
+    const configured = supervisor.currentConfig().opencode?.serverUrl;
+    const resolved = await resolveOpencodeServerUrl(configured, serverUrl);
+    if (!resolved) {
+      return {
+        kind: "opencode",
+        message: "No opencode server is answering at http://127.0.0.1:4096. Start `opencode serve`, or pass its address with `--url`."
+      };
     }
-    const result = await supervisor.enableHarness(
-      runtime === "opencode" ? { runtime: "opencode", serverUrl: resolvedServerUrl ?? "" } : { runtime, presence }
-    );
-    if (!result.ok) return { ok: false, error: result.error };
-    return { ok: true, message: connectedLine(runtime, verdict) };
+    if (!serverUrl?.trim() && configured === resolved) {
+      const label = supervisor.currentConfig().deviceLabel;
+      return { kind: "already", runtime, ...label ? { deviceLabel: label } : {} };
+    }
+    return (await supervisor.enableHarness({ runtime: "opencode", serverUrl: resolved })).outcome;
   };
   let control = null;
   let dashboard = null;
   try {
     control = await startControlServer({
       status: () => hub.statusJson(),
-      connect: async (runtime, serverUrl) => {
-        const result = await connectHarness(runtime, serverUrl);
-        return result.ok ? { ok: true, message: result.message } : { ok: false, message: result.error };
-      },
+      connect: (runtime, serverUrl) => connectHarness(runtime, serverUrl),
+      update: (auto) => supervisor.update(auto),
       stop: () => void supervisor.requestStop()
     });
     if (opts.dashboard) {
@@ -14683,7 +15511,8 @@ async function createCompanionRuntime(opts = {}) {
       // marker records whether this companion is backgrounded (foreground start
       // leaves it unset → false).
       daemon: process.env.CABANE_COMPANION_DAEMON === "1",
-      instanceId
+      instanceId,
+      ...installedCommandPath() ? { command: installedCommandPath() } : {}
     });
     clearCrash();
   } catch (err) {
@@ -14714,6 +15543,10 @@ async function createCompanionRuntime(opts = {}) {
     } catch {
     }
   };
+  restartForUpdate = async () => {
+    await stop();
+    process.exit(0);
+  };
   return {
     ok: true,
     runtime: {