@cabane/companion 0.6.156 → 0.6.158

package/dist/cli.js

@@ -692,16 +692,16 @@ function migrateConnectedHarnesses(cfg) {
 }
 function localAgentConfig(cfg, agent) {
   const map = cfg.agents ?? {};
-  const row2 = map[agent.agentId] ?? map[agent.agentUsername] ?? map[`${agent.workspaceSlug}/${agent.agentUsername}`] ?? {};
-  if (!cfg.prepareHook || row2.prepareHook) return row2;
-  return { ...row2, prepareHook: cfg.prepareHook };
+  const row3 = map[agent.agentId] ?? map[agent.agentUsername] ?? map[`${agent.workspaceSlug}/${agent.agentUsername}`] ?? {};
+  if (!cfg.prepareHook || row3.prepareHook) return row3;
+  return { ...row3, prepareHook: cfg.prepareHook };
 }
 function agentSandbox(cfg, agent) {
   const sandbox = cfg.agents?.[agent.agentId]?.sandbox;
   return sandbox ? { sandbox } : {};
 }
-function runnerSandboxFor(cfg, row2, host) {
-  const asked = row2.sandbox ?? cfg.runners?.sandbox ?? "none";
+function runnerSandboxFor(cfg, row3, host) {
+  const asked = row3.sandbox ?? cfg.runners?.sandbox ?? "none";
   if (asked !== "os" || cfg.runners?.provider === "docker") return "none";
   return host.osSandboxUsable() ? "os" : "none";
 }
@@ -715,7 +715,7 @@ function runnerSandboxReport(cfg, agents, host) {
 }
 function agentSandboxRows(cfg) {
   return Object.entries(cfg.agents ?? {}).flatMap(
-    ([key, row2]) => row2.sandbox ? [[key, row2.sandbox]] : []
+    ([key, row3]) => row3.sandbox ? [[key, row3.sandbox]] : []
   );
 }
 function loadConfig() {
@@ -897,8 +897,8 @@ var init_config = __esm({
     }).strict();
     AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx2) => {
-      for (const [key, row2] of Object.entries(agents)) {
-        if (row2.sandbox === void 0) continue;
+      for (const [key, row3] of Object.entries(agents)) {
+        if (row3.sandbox === void 0) continue;
         if (AGENT_ID_KEY.test(key)) continue;
         ctx2.addIssue({
           code: z2.ZodIssueCode.custom,
@@ -965,6 +965,15 @@ var init_config = __esm({
       // absent `claudeCode` block means "never offered"; without it, the block's
       // absence marks a config from before connectors were chosen.
       harnessesChosen: z2.boolean().optional(),
+      // Whether this companion keeps itself current: installs the version Cabane names, between
+      // turns, and rolls back one that doesn't come up (`updater.ts`). Absent means never asked,
+      // which `start` offers; off either way until someone says yes.
+      update: z2.object({
+        auto: z2.boolean()
+      }).strict().optional(),
+      // The answer to `start`'s "start at boot?" when it was no, so it isn't asked again.
+      // `cabane service install` still installs it.
+      serviceDeclined: z2.boolean().optional(),
       // OpenCode's decline. Its block is an address, so a decline can't live there
       // the way `claudeCode`/`codex` `enabled: false` does; without it a declined
       // serve would be offered again on every `start`.
@@ -2682,8 +2691,8 @@ var init_policy = __esm({
 // packages/agent-runtime/src/claude-code/model.ts
 function parseClaudeCodeModel(model) {
   if (!model) return null;
-  const sep5 = model.indexOf("/");
-  const bare = sep5 === -1 || model.slice(0, sep5) !== "anthropic" ? model : model.slice(sep5 + 1);
+  const sep6 = model.indexOf("/");
+  const bare = sep6 === -1 || model.slice(0, sep6) !== "anthropic" ? model : model.slice(sep6 + 1);
   return bare === CLAUDE_CODE_DEFAULT_MODEL_BARE ? null : model;
 }
 var CLAUDE_CODE_DEFAULT_MODEL_BARE;
@@ -2887,6 +2896,208 @@ var init_options = __esm({
   }
 });
 
+// packages/agent-runtime/src/claude-code/failure-evidence.ts
+function createFailureEvidence() {
+  const signals = { sawRejectedLimit: false };
+  return {
+    observe(msg) {
+      if (msg.type === "assistant" || msg.type === "auth_status") {
+        const error = msg.error;
+        if (typeof error === "string" && error.length > 0) {
+          if (msg.type === "assistant") signals.lastAssistantError = error;
+          else signals.authError = error;
+        }
+      } else if (msg.type === "rate_limit_event") {
+        const info = msg.rate_limit_info;
+        if (info?.status === "rejected") {
+          signals.sawRejectedLimit = true;
+          signals.rateLimitResetIso = resetsAtToIso(info.resetsAt) ?? signals.rateLimitResetIso;
+          if (typeof info.rateLimitType === "string") signals.rateLimitType = info.rateLimitType;
+        }
+      }
+    },
+    preInitReason(msg) {
+      const failure = msg ? classifyPreInitFrame(msg, signals) : classifyFailure(signals, { text: "" });
+      return failure ? encodeFailureReason(failure) : "session_start_failed";
+    },
+    failedResultReason(msg) {
+      const failure = classifyResultFailure(msg, signals);
+      const resultText = msg.result ?? "";
+      const isError = msg.is_error === true;
+      return failure ? encodeFailureReason(failure) : isError ? `error:${resultText.slice(0, 200) || "unknown"}` : `result_error:${msg.subtype}`;
+    },
+    thrownFailure(message2, initReceived) {
+      return initReceived ? classifyErrorText(message2) : classifyFailure(signals, { text: message2 });
+    }
+  };
+}
+function classifyFailure(s, frame) {
+  const rejectedIsCap = s.sawRejectedLimit && (s.rateLimitResetIso !== void 0 || isSubscriptionWindow(s.rateLimitType));
+  if (rejectedIsCap || frame.terminalReason === "blocking_limit")
+    return {
+      kind: "usage_capped",
+      ...s.rateLimitResetIso ? { resetsAt: s.rateLimitResetIso } : {}
+    };
+  return classifyAssistantError(s.lastAssistantError) ?? classifyErrorText([s.authError, frame.text].filter(Boolean).join(" "));
+}
+function classifyResultFailure(msg, s) {
+  const resultText = msg.result ?? "";
+  const terminalReason = msg.terminal_reason;
+  const errors = msg.errors;
+  const text = [resultText, ...Array.isArray(errors) ? errors.map(String) : []].join(" ");
+  return classifyFailure(s, { terminalReason, text });
+}
+function classifyPreInitFrame(msg, s) {
+  if (msg.type === "result") {
+    const isError = msg.is_error === true;
+    if (msg.subtype === "success" && !isError) return classifyFailure(s, { text: "" });
+    return classifyResultFailure(msg, s);
+  }
+  if (msg.type !== "assistant") return classifyFailure(s, { text: "" });
+  const text = contentBlocks(msg).flatMap((b) => b.type === "text" && typeof b.text === "string" ? [b.text] : []).join(" ");
+  return classifyFailure(s, { text });
+}
+function preInitToolActivity(msg) {
+  const kind = msg.type === "assistant" ? "tool_use" : msg.type === "user" ? "tool_result" : null;
+  return kind !== null && contentBlocks(msg).some((b) => b.type === kind);
+}
+function contentBlocks(msg) {
+  const content = msg.message?.content;
+  return Array.isArray(content) ? content : [];
+}
+function isSubscriptionWindow(value) {
+  return value === "five_hour" || value === "seven_day" || value === "seven_day_opus" || value === "seven_day_sonnet" || value === "overage";
+}
+var init_failure_evidence = __esm({
+  "packages/agent-runtime/src/claude-code/failure-evidence.ts"() {
+    "use strict";
+    init_failure();
+  }
+});
+
+// packages/agent-runtime/src/claude-code/context-usage.ts
+function createContextUsage() {
+  let resolvedModel;
+  let lastRequestContextTokens;
+  const compactions = [];
+  return {
+    get resolvedModel() {
+      return resolvedModel;
+    },
+    recordInit(msg) {
+      const model = msg.model;
+      if (typeof model === "string" && model.length > 0) resolvedModel = model;
+    },
+    recordCompaction(msg) {
+      const compaction = readCompaction(msg);
+      if (compaction) compactions.push(compaction);
+    },
+    recordRequest(msg) {
+      const tokens = readRequestContextTokens(msg);
+      if (tokens !== void 0) lastRequestContextTokens = tokens;
+    },
+    async resultUsage(msg, readContextUsage) {
+      const usage = readSdkUsage(msg.usage);
+      if (usage) {
+        if (lastRequestContextTokens !== void 0) usage.contextTokens = lastRequestContextTokens;
+        const window = readContextWindow(msg, resolvedModel);
+        if (window !== void 0) usage.contextWindow = window;
+        if (compactions.length > 0) usage.contextCompactions = compactions;
+        const reading = await readHarnessContext(readContextUsage);
+        if (reading) Object.assign(usage, reading);
+      }
+      return usage;
+    }
+  };
+}
+function readSdkUsage(usage) {
+  if (!usage || typeof usage !== "object") return void 0;
+  const fields = usage;
+  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+  const cacheReadTokens = num(fields.cache_read_input_tokens);
+  const cacheCreationTokens = num(fields.cache_creation_input_tokens);
+  const inputTokens = num(fields.input_tokens) + cacheCreationTokens + cacheReadTokens;
+  const outputTokens = num(fields.output_tokens);
+  return { inputTokens, outputTokens, cacheReadTokens, cacheCreationTokens };
+}
+function readRequestContextTokens(msg) {
+  return readSdkUsage(msg.message?.usage)?.inputTokens;
+}
+async function readHarnessContext(read) {
+  if (!read) return void 0;
+  let timer;
+  const timeout = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2(void 0), CONTEXT_READING_TIMEOUT_MS);
+  });
+  try {
+    return parseContextUsage(await Promise.race([read(), timeout]));
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseContextUsage(response) {
+  const r = response;
+  if (!r || typeof r !== "object") return void 0;
+  const total = readContextCount(r.totalTokens);
+  const window = readContextCount(r.maxTokens);
+  if (total === void 0 || window === void 0 || window === 0) return void 0;
+  const categories = [];
+  for (const c of Array.isArray(r.categories) ? r.categories : []) {
+    const row3 = c;
+    const tokens = readContextCount(row3?.tokens);
+    if (typeof row3?.name === "string" && tokens !== void 0 && typeof row3.kind === "string" && CATEGORY_KINDS.has(row3.kind)) {
+      categories.push({ name: row3.name, tokens, kind: row3.kind });
+    }
+  }
+  const buffer = categories.filter((c) => c.kind === "buffer").reduce((sum, c) => sum + c.tokens, 0);
+  return {
+    contextTokens: total,
+    contextWindow: window,
+    ...buffer > 0 && buffer < window ? { contextCompactAt: window - buffer } : {},
+    ...categories.length > 0 ? { contextCategories: categories } : {}
+  };
+}
+function readCompaction(msg) {
+  const meta = msg.compact_metadata;
+  const preTokens = readContextCount(meta?.pre_tokens);
+  if (!meta || preTokens === void 0) return void 0;
+  if (meta.trigger !== "manual" && meta.trigger !== "auto") return void 0;
+  const postTokens = readContextCount(meta.post_tokens);
+  return {
+    trigger: meta.trigger,
+    preTokens,
+    ...postTokens !== void 0 ? { postTokens } : {}
+  };
+}
+function readContextWindow(msg, resolvedModel) {
+  const modelUsage = msg.modelUsage;
+  if (!modelUsage || typeof modelUsage !== "object") return void 0;
+  const pos = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
+  if (resolvedModel) {
+    const direct = pos(modelUsage[resolvedModel]?.contextWindow);
+    if (direct !== void 0) return direct;
+  }
+  let max;
+  for (const entry of Object.values(modelUsage)) {
+    const w = pos(entry?.contextWindow);
+    if (w !== void 0 && (max === void 0 || w > max)) max = w;
+  }
+  return max;
+}
+function readContextCount(v) {
+  return typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.round(v) : void 0;
+}
+var CONTEXT_READING_TIMEOUT_MS, CATEGORY_KINDS;
+var init_context_usage = __esm({
+  "packages/agent-runtime/src/claude-code/context-usage.ts"() {
+    "use strict";
+    CONTEXT_READING_TIMEOUT_MS = 2e3;
+    CATEGORY_KINDS = /* @__PURE__ */ new Set(["used", "free", "buffer", "deferred"]);
+  }
+});
+
 // packages/agent-runtime/src/claude-code/loop.ts
 async function* decodeSdkStream(iter, ctx2) {
   const pending = /* @__PURE__ */ new Map();
@@ -2902,17 +3113,15 @@ async function* decodeSdkStream(iter, ctx2) {
   let resultReason;
   let sawResult = false;
   let usage;
-  const compactions = [];
-  let lastRequestContextTokens;
-  let resolvedModel;
-  const signals = { sawRejectedLimit: false };
+  const contextUsage = createContextUsage();
+  const failureEvidence = createFailureEvidence();
   let preInitNotice = null;
   try {
     for await (const msg of iter) {
       if (ctx2.signal.aborted) return;
+      failureEvidence.observe(msg);
       if (msg.type === "system" && msg.subtype === "init") {
-        const initModel = msg.model;
-        if (typeof initModel === "string" && initModel.length > 0) resolvedModel = initModel;
+        contextUsage.recordInit(msg);
         mcpInventory = readMcpInventory(msg);
         workspaceProven = provesWorkspaceTools(msg);
         if (!workspaceProven) {
@@ -2929,63 +3138,35 @@ async function* decodeSdkStream(iter, ctx2) {
           };
         }
       } else if (msg.type === "system" && msg.subtype === "compact_boundary") {
-        const compaction = readCompaction(msg);
-        if (compaction) compactions.push(compaction);
+        contextUsage.recordCompaction(msg);
       } else if (!workspaceProven && (msg.type === "assistant" || msg.type === "user" || msg.type === "result")) {
         if (preInitToolActivity(msg) && ctx2.startEvidence) ctx2.startEvidence.toolActivity = true;
-        const failure = classifyPreInitFrame(msg, signals);
-        resultReason = failure ? encodeFailureReason(failure) : "session_start_failed";
+        resultReason = failureEvidence.preInitReason(msg);
         if (msg.type === "assistant" && isHarnessAuthored(msg))
           preInitNotice = harnessNoticeText(msg);
         break;
       } else if (msg.type === "assistant") {
-        const assistantErr = msg.error;
-        if (typeof assistantErr === "string" && assistantErr.length > 0) {
-          signals.lastAssistantError = assistantErr;
-        }
         if (isHarnessAuthored(msg)) {
           await emitHarnessMessage(msg, emit, pending, buffer);
           yield* drain(out);
           continue;
         }
-        const reqContext = readRequestContextTokens(msg);
-        if (reqContext !== void 0) lastRequestContextTokens = reqContext;
+        contextUsage.recordRequest(msg);
         await processAssistantMessage(msg, emit, pending, buffer);
         yield* drain(out);
       } else if (msg.type === "user") {
         await emitToolResults(msg, emit, pending);
         yield* drain(out);
-      } else if (msg.type === "rate_limit_event") {
-        const info = msg.rate_limit_info;
-        if (info?.status === "rejected") {
-          signals.sawRejectedLimit = true;
-          signals.rateLimitResetIso = resetsAtToIso(info.resetsAt) ?? signals.rateLimitResetIso;
-          if (typeof info.rateLimitType === "string") signals.rateLimitType = info.rateLimitType;
-        }
-      } else if (msg.type === "auth_status") {
-        const err = msg.error;
-        if (typeof err === "string" && err.length > 0) signals.authError = err;
       } else if (msg.type === "result") {
         const origin = msg.origin;
         if (origin?.kind === "task-notification") continue;
         sawResult = true;
-        usage = readSdkUsage(msg);
-        if (usage) {
-          if (lastRequestContextTokens !== void 0)
-            usage.contextTokens = lastRequestContextTokens;
-          const window = readContextWindow(msg, resolvedModel);
-          if (window !== void 0) usage.contextWindow = window;
-          if (compactions.length > 0) usage.contextCompactions = compactions;
-          const reading = await readHarnessContext(ctx2.readContextUsage);
-          if (reading) Object.assign(usage, reading);
-        }
+        usage = await contextUsage.resultUsage(msg, ctx2.readContextUsage);
         const isError = msg.is_error === true;
         if (msg.subtype === "success" && !isError) {
           ok = true;
         } else {
-          const resultText = msg.result ?? "";
-          const failure = classifyResultFailure(msg, signals);
-          resultReason = failure ? encodeFailureReason(failure) : isError ? `error:${resultText.slice(0, 200) || "unknown"}` : `result_error:${msg.subtype}`;
+          resultReason = failureEvidence.failedResultReason(msg);
           ok = false;
         }
         break;
@@ -2994,7 +3175,7 @@ async function* decodeSdkStream(iter, ctx2) {
   } catch (err) {
     if (ctx2.signal.aborted) throw err;
     const message2 = err instanceof Error ? err.message : String(err);
-    const failure = mcpInventory.initReceived ? classifyErrorText(message2) : classifyFailure(signals, { text: message2 });
+    const failure = failureEvidence.thrownFailure(message2, mcpInventory.initReceived);
     if (!failure && (mcpInventory.initReceived || ctx2.resumedSessionId === null)) throw err;
     ok = false;
     if (failure) {
@@ -3009,8 +3190,7 @@ async function* decodeSdkStream(iter, ctx2) {
   if (!workspaceProven) {
     ok = false;
     if (resultReason === void 0) {
-      const failure = classifyFailure(signals, { text: "" });
-      resultReason = failure ? encodeFailureReason(failure) : "session_start_failed";
+      resultReason = failureEvidence.preInitReason();
     }
     if (preInitNotice) yield { type: "runtime_notice", body: preInitNotice };
   }
@@ -3028,7 +3208,7 @@ async function* decodeSdkStream(iter, ctx2) {
     ok,
     ...resultReason ? { reason: resultReason } : {},
     ...usage ? { usage } : {},
-    ...resolvedModel ? { resolvedModel } : {},
+    ...contextUsage.resolvedModel ? { resolvedModel: contextUsage.resolvedModel } : {},
     mcpInventory
   };
 }
@@ -3047,38 +3227,6 @@ function provesWorkspaceTools(msg) {
   const tools = msg.tools;
   return Array.isArray(tools) && tools.includes("mcp__cabane__query");
 }
-function classifyFailure(s, frame) {
-  const rejectedIsCap = s.sawRejectedLimit && (s.rateLimitResetIso !== void 0 || isSubscriptionWindow(s.rateLimitType));
-  if (rejectedIsCap || frame.terminalReason === "blocking_limit")
-    return {
-      kind: "usage_capped",
-      ...s.rateLimitResetIso ? { resetsAt: s.rateLimitResetIso } : {}
-    };
-  return classifyAssistantError(s.lastAssistantError) ?? classifyErrorText([s.authError, frame.text].filter(Boolean).join(" "));
-}
-function classifyResultFailure(msg, s) {
-  const resultText = msg.result ?? "";
-  const terminalReason = msg.terminal_reason;
-  const errors = msg.errors;
-  const text = [resultText, ...Array.isArray(errors) ? errors.map(String) : []].join(" ");
-  return classifyFailure(s, { terminalReason, text });
-}
-function classifyPreInitFrame(msg, s) {
-  if (msg.type === "result") {
-    const isError = msg.is_error === true;
-    if (msg.subtype === "success" && !isError) return classifyFailure(s, { text: "" });
-    return classifyResultFailure(msg, s);
-  }
-  if (msg.type !== "assistant") return classifyFailure(s, { text: "" });
-  const error = msg.error;
-  const signals = typeof error === "string" && error.length > 0 ? { ...s, lastAssistantError: error } : s;
-  const text = contentBlocks(msg).flatMap((b) => b.type === "text" && typeof b.text === "string" ? [b.text] : []).join(" ");
-  return classifyFailure(signals, { text });
-}
-function preInitToolActivity(msg) {
-  const kind = msg.type === "assistant" ? "tool_use" : msg.type === "user" ? "tool_result" : null;
-  return kind !== null && contentBlocks(msg).some((b) => b.type === kind);
-}
 function isHarnessAuthored(msg) {
   const error = msg.error;
   if (typeof error === "string" && error.length > 0) return true;
@@ -3102,107 +3250,19 @@ async function emitHarnessMessage(msg, emit, pending, buffer) {
     );
   }
 }
-function contentBlocks(msg) {
-  const content = msg.message?.content;
-  return Array.isArray(content) ? content : [];
-}
-function isSubscriptionWindow(value) {
-  return value === "five_hour" || value === "seven_day" || value === "seven_day_opus" || value === "seven_day_sonnet" || value === "overage";
-}
 function* drain(out) {
   while (out.length > 0) yield out.shift();
 }
-function readSdkUsage(msg) {
-  const usage = msg.usage;
-  if (!usage || typeof usage !== "object") return void 0;
-  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
-  const cacheReadTokens = num(usage.cache_read_input_tokens);
-  const cacheCreationTokens = num(usage.cache_creation_input_tokens);
-  const inputTokens = num(usage.input_tokens) + cacheCreationTokens + cacheReadTokens;
-  const outputTokens = num(usage.output_tokens);
-  return { inputTokens, outputTokens, cacheReadTokens, cacheCreationTokens };
-}
-function readRequestContextTokens(msg) {
-  const usage = msg.message?.usage;
-  if (!usage || typeof usage !== "object") return void 0;
-  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
-  return num(usage.input_tokens) + num(usage.cache_read_input_tokens) + num(usage.cache_creation_input_tokens);
-}
-async function readHarnessContext(read) {
-  if (!read) return void 0;
-  let timer;
-  const timeout = new Promise((resolve2) => {
-    timer = setTimeout(() => resolve2(void 0), CONTEXT_READING_TIMEOUT_MS);
-  });
-  try {
-    return parseContextUsage(await Promise.race([read(), timeout]));
-  } catch {
-    return void 0;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function parseContextUsage(response) {
-  const r = response;
-  if (!r || typeof r !== "object") return void 0;
-  const count = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.round(v) : void 0;
-  const total = count(r.totalTokens);
-  const window = count(r.maxTokens);
-  if (total === void 0 || window === void 0 || window === 0) return void 0;
-  const categories = [];
-  for (const c of Array.isArray(r.categories) ? r.categories : []) {
-    const row2 = c;
-    const tokens = count(row2?.tokens);
-    if (typeof row2?.name === "string" && tokens !== void 0 && typeof row2.kind === "string" && CATEGORY_KINDS.has(row2.kind)) {
-      categories.push({ name: row2.name, tokens, kind: row2.kind });
-    }
-  }
-  const buffer = categories.filter((c) => c.kind === "buffer").reduce((sum, c) => sum + c.tokens, 0);
-  return {
-    contextTokens: total,
-    contextWindow: window,
-    ...buffer > 0 && buffer < window ? { contextCompactAt: window - buffer } : {},
-    ...categories.length > 0 ? { contextCategories: categories } : {}
-  };
-}
-function readCompaction(msg) {
-  const meta = msg.compact_metadata;
-  const count = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.round(v) : void 0;
-  const preTokens = count(meta?.pre_tokens);
-  if (!meta || preTokens === void 0) return void 0;
-  if (meta.trigger !== "manual" && meta.trigger !== "auto") return void 0;
-  const postTokens = count(meta.post_tokens);
-  return {
-    trigger: meta.trigger,
-    preTokens,
-    ...postTokens !== void 0 ? { postTokens } : {}
-  };
-}
-function readContextWindow(msg, resolvedModel) {
-  const modelUsage = msg.modelUsage;
-  if (!modelUsage || typeof modelUsage !== "object") return void 0;
-  const pos = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
-  if (resolvedModel) {
-    const direct = pos(modelUsage[resolvedModel]?.contextWindow);
-    if (direct !== void 0) return direct;
-  }
-  let max;
-  for (const entry of Object.values(modelUsage)) {
-    const w = pos(entry?.contextWindow);
-    if (w !== void 0 && (max === void 0 || w > max)) max = w;
-  }
-  return max;
-}
-var HARNESS_PLACEHOLDERS, CONTEXT_READING_TIMEOUT_MS, CATEGORY_KINDS;
+var HARNESS_PLACEHOLDERS;
 var init_loop = __esm({
   "packages/agent-runtime/src/claude-code/loop.ts"() {
     "use strict";
     init_transcript();
     init_failure();
     init_session();
+    init_failure_evidence();
+    init_context_usage();
     HARNESS_PLACEHOLDERS = /* @__PURE__ */ new Set(["No response requested.", "(no content)"]);
-    CONTEXT_READING_TIMEOUT_MS = 2e3;
-    CATEGORY_KINDS = /* @__PURE__ */ new Set(["used", "free", "buffer", "deferred"]);
   }
 });
 
@@ -4236,9 +4296,9 @@ var init_policy2 = __esm({
 
 // packages/agent-runtime/src/opencode/model.ts
 function parseOpencodeModel(model) {
-  const sep5 = model.indexOf("/");
-  if (sep5 === -1) return { providerID: "", modelID: model };
-  return { providerID: model.slice(0, sep5), modelID: model.slice(sep5 + 1) };
+  const sep6 = model.indexOf("/");
+  if (sep6 === -1) return { providerID: "", modelID: model };
+  return { providerID: model.slice(0, sep6), modelID: model.slice(sep6 + 1) };
 }
 var init_model2 = __esm({
   "packages/agent-runtime/src/opencode/model.ts"() {
@@ -4539,10 +4599,10 @@ async function* parseSseStream(body, sessionId, signal) {
       const { value, done } = await reader.read();
       if (done) return;
       buf += decoder.decode(value, { stream: true });
-      let sep5;
-      while ((sep5 = buf.indexOf("\n\n")) !== -1) {
-        const frame = buf.slice(0, sep5);
-        buf = buf.slice(sep5 + 2);
+      let sep6;
+      while ((sep6 = buf.indexOf("\n\n")) !== -1) {
+        const frame = buf.slice(0, sep6);
+        buf = buf.slice(sep6 + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
         if (!data) continue;
         let ev;
@@ -5553,8 +5613,8 @@ var init_policy3 = __esm({
 
 // packages/agent-runtime/src/codex/model.ts
 function parseCodexModel(model) {
-  const sep5 = model.indexOf("/");
-  const bare = sep5 === -1 || model.slice(0, sep5) !== "openai" ? model : model.slice(sep5 + 1);
+  const sep6 = model.indexOf("/");
+  const bare = sep6 === -1 || model.slice(0, sep6) !== "openai" ? model : model.slice(sep6 + 1);
   return CODEX_DEFAULT_MODEL_BARES.has(bare) ? null : bare;
 }
 var CODEX_DEFAULT_MODEL_BARES;
@@ -10249,7 +10309,7 @@ var init_turn_execution = __esm({
 
 // src/dispatcher.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { join as join17 } from "path";
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
@@ -10267,7 +10327,7 @@ function checkoutState(cwd) {
   if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
-    stat = statSync2(gitPath);
+    stat = statSync3(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
@@ -11079,7 +11139,7 @@ import {
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync5,
   readFileSync as readFileSync11,
-  renameSync as renameSync6,
+  renameSync as renameSync7,
   rmSync as rmSync11,
   writeFileSync as writeFileSync8
 } from "fs";
@@ -11116,7 +11176,7 @@ var init_outbox = __esm({
         const tmp = `${target}.${process.pid}.tmp`;
         try {
           writeFileSync8(tmp, JSON.stringify(entry) + "\n", "utf8");
-          renameSync6(tmp, target);
+          renameSync7(tmp, target);
         } catch (err) {
           try {
             rmSync11(tmp, { force: true });
@@ -11285,8 +11345,8 @@ var init_image_manifest = __esm({
 });
 
 // src/runner/exec-shim.ts
-import { chmodSync as chmodSync7, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync2, rmSync as rmSync13, writeFileSync as writeFileSync10 } from "fs";
-import { join as join26 } from "path";
+import { chmodSync as chmodSync8, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, rmSync as rmSync17, writeFileSync as writeFileSync13 } from "fs";
+import { join as join31 } from "path";
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -11296,18 +11356,18 @@ function createShimDir() {
   return {
     write(argv) {
       if (!dir2) {
-        mkdirSync15(join26(cabaneDir(), "runner"), { recursive: true });
-        dir2 = mkdtempSync2(join26(cabaneDir(), "runner", "turn-"));
+        mkdirSync20(join31(cabaneDir(), "runner"), { recursive: true });
+        dir2 = mkdtempSync2(join31(cabaneDir(), "runner", "turn-"));
       }
-      const path = join26(dir2, `exec-${++count}`);
-      writeFileSync10(path, `#!/bin/sh
+      const path = join31(dir2, `exec-${++count}`);
+      writeFileSync13(path, `#!/bin/sh
 exec ${argv.map(shellQuote2).join(" ")} "$@"
 `);
-      chmodSync7(path, 448);
+      chmodSync8(path, 448);
       return path;
     },
     dispose() {
-      if (dir2) rmSync13(dir2, { recursive: true, force: true });
+      if (dir2) rmSync17(dir2, { recursive: true, force: true });
       dir2 = null;
     }
   };
@@ -12260,7 +12320,11 @@ async function serveConnection(socket, handlers) {
       reply(socket, result);
       return;
     }
-    if (req.cmd === "stop") {
+    if (req.cmd === "update") {
+      reply(socket, await handlers.update(req.auto));
+      return;
+    }
+    if (req.cmd === "stop") {
       reply(socket, { ok: true });
       setTimeout(() => handlers.stop(), 50).unref?.();
       return;
@@ -12885,13 +12949,19 @@ init_term();
 
 // src/commands/start.ts
 init_config();
-import { spawn as spawn9 } from "child_process";
+import { spawn as spawn10 } from "child_process";
 import { hostname as hostname3 } from "os";
 init_cabane_command();
 
 // src/logger.ts
 init_config();
-import { createWriteStream, mkdirSync as mkdirSync5 } from "fs";
+import {
+  createWriteStream,
+  mkdirSync as mkdirSync5,
+  openSync as openSync2,
+  renameSync as renameSync3,
+  statSync as statSync2
+} from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { stripVTControlCharacters } from "util";
 import pino from "pino";
@@ -12946,6 +13016,53 @@ function formatHumanLine(record) {
   }
   return line + "\n";
 }
+var LOG_ROTATE_BYTES = 50 * 1024 * 1024;
+var LOG_ROTATIONS_KEPT = 3;
+var RotatingLog = class {
+  constructor(path, maxBytes = LOG_ROTATE_BYTES, keep = LOG_ROTATIONS_KEPT) {
+    this.path = path;
+    this.maxBytes = maxBytes;
+    this.keep = keep;
+    this.size = sizeOf(path);
+    this.stream = openAppend(path);
+  }
+  path;
+  maxBytes;
+  keep;
+  stream;
+  size;
+  write(chunk) {
+    const ok = this.stream.write(chunk);
+    this.size += Buffer.byteLength(chunk);
+    if (this.size >= this.maxBytes) this.rotate();
+    return ok;
+  }
+  rotate() {
+    this.stream.end();
+    try {
+      for (let i = this.keep - 1; i >= 1; i--) {
+        try {
+          renameSync3(`${this.path}.${i}`, `${this.path}.${i + 1}`);
+        } catch {
+        }
+      }
+      renameSync3(this.path, `${this.path}.1`);
+    } catch {
+    }
+    this.stream = openAppend(this.path);
+    this.size = sizeOf(this.path);
+  }
+};
+function openAppend(path) {
+  return createWriteStream("", { fd: openSync2(path, "a") });
+}
+function sizeOf(path) {
+  try {
+    return statSync2(path).size;
+  } catch {
+    return 0;
+  }
+}
 var cached = null;
 var consoleLogging = true;
 var overrides = {};
@@ -12964,7 +13081,7 @@ function configureLogger(log, config) {
 function createLogger(destinations = {}, options = {}) {
   const path = companionLogPath();
   if (!destinations.file) mkdirSync5(dirname4(path), { recursive: true });
-  const file = destinations.file ?? createWriteStream(path, { flags: "a" });
+  const file = destinations.file ?? new RotatingLog(path);
   const state = { format: options.logFormat ?? "human" };
   const streams = [];
   const human = (chunk) => {
@@ -13022,7 +13139,7 @@ import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 
 // src/dashboard/routes.ts
-import { openSync as openSync2, readSync, closeSync as closeSync2, fstatSync, existsSync as existsSync6 } from "fs";
+import { openSync as openSync3, readSync, closeSync as closeSync2, fstatSync, existsSync as existsSync6 } from "fs";
 import { readFile } from "fs/promises";
 import { extname, join as join9, normalize } from "path";
 import { streamSSE } from "hono/streaming";
@@ -13406,7 +13523,7 @@ function tailFile(path, lines2) {
   const MAX_BYTES = 256 * 1024;
   let fd;
   try {
-    fd = openSync2(path, "r");
+    fd = openSync3(path, "r");
     const size = fstatSync(fd).size;
     const start2 = Math.max(0, size - MAX_BYTES);
     const len = size - start2;
@@ -13657,7 +13774,7 @@ init_config();
 
 // src/dispatch-dedupe.ts
 init_config();
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync4, existsSync as existsSync7 } from "fs";
 import { join as join11 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
@@ -13775,7 +13892,7 @@ function writeTurnIds(workspaceId, turns) {
   const path = turnPathFor(workspaceId);
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync4(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
-  renameSync3(tmp, path);
+  renameSync4(tmp, path);
   return entries.length;
 }
 function rememberTurnId(workspaceId, eventId, turnId) {
@@ -13971,9 +14088,9 @@ import {
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync4,
   readFileSync as readFileSync9,
-  renameSync as renameSync5,
+  renameSync as renameSync6,
   rmSync as rmSync9,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync6
 } from "fs";
 import { join as join20 } from "path";
@@ -14046,7 +14163,7 @@ import {
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
-  renameSync as renameSync4,
+  renameSync as renameSync5,
   rmSync as rmSync8
 } from "fs";
 import { join as join18 } from "path";
@@ -14082,11 +14199,11 @@ function admitCollectedEntry(raw, turn) {
 }
 var atomicMove = (from, to) => {
   try {
-    renameSync4(from, to);
+    renameSync5(from, to);
   } catch {
     const partial = `${to}.partial`;
     copyFileSync2(from, partial);
-    renameSync4(partial, to);
+    renameSync5(partial, to);
     rmSync8(from, { force: true });
   }
 };
@@ -14330,6 +14447,25 @@ function pruneOtherAttempts(deviceDir, pair2, keep) {
     }
   }
 }
+var IDLE_SESSION_ARCHIVE_MS = 30 * 24 * 60 * 6e4;
+function pruneIdleSessionArchives(deviceDir, now = Date.now(), maxAgeMs = IDLE_SESSION_ARCHIVE_MS) {
+  const root = join20(deviceDir, "attempts");
+  if (!existsSync14(root)) return [];
+  const removed = [];
+  for (const id of readdirSync4(root)) {
+    if (!UUID_RE.test(id)) continue;
+    let kept;
+    try {
+      kept = statSync4(join20(root, id)).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (now - kept < maxAgeMs) continue;
+    rmSync9(join20(root, id), { recursive: true, force: true });
+    removed.push(id);
+  }
+  return removed;
+}
 var CappedFile = class extends Writable {
   constructor(path, cap) {
     super();
@@ -14707,7 +14843,7 @@ function createDockerProvider(opts) {
       (resolve2) => file.writableFinished ? resolve2() : file.once("finish", resolve2)
     );
     if (r.code === 0 && !file.over) {
-      renameSync5(partial, archive);
+      renameSync6(partial, archive);
       writeFileSync6(join20(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
       pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
       await writeMarker(name, attemptId);
@@ -14844,7 +14980,7 @@ function createDockerProvider(opts) {
             );
           } else {
             log.info(
-              { container: name, attemptId, bytes: statSync3(archive).size },
+              { container: name, attemptId, bytes: statSync4(archive).size },
               "runners: session files restored"
             );
           }
@@ -15308,6 +15444,12 @@ var SseSubscriber = class {
     this.aborted = true;
     this.controller?.abort();
   }
+  // Connect again after a `stop()`, once its loop has exited.
+  async resume() {
+    await this.finished;
+    this.aborted = false;
+    this.start();
+  }
   setCursor(eventId) {
     this.lastEventId = eventId;
   }
@@ -15396,9 +15538,564 @@ function sleep4(ms) {
 
 // src/supervisor.ts
 init_transcript_writer();
+
+// src/updater.ts
+import { spawn as spawn8 } from "child_process";
+import { copyFileSync as copyFileSync3, existsSync as existsSync17, mkdirSync as mkdirSync16, renameSync as renameSync11, rmSync as rmSync14 } from "fs";
+import { dirname as dirname12, join as join26 } from "path";
+
+// src/boot-rule.ts
+import {
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync12,
+  realpathSync as realpathSync5,
+  renameSync as renameSync8,
+  rmSync as rmSync12,
+  symlinkSync,
+  writeFileSync as writeFileSync9
+} from "fs";
+import { dirname as dirname9, join as join23 } from "path";
+var UNCONFIRMED_WINDOW_MS = 10 * 6e4;
+var MAX_STAGE_ATTEMPTS = 3;
+function superseded(pending, ...running) {
+  return !!pending && !running.includes(pending.to);
+}
+function rolledBackState(state, pending, reason, now) {
+  const { pending: _done, ...rest } = state;
+  return {
+    ...rest,
+    lastResult: {
+      kind: "rolled_back",
+      from: pending.from,
+      to: pending.to,
+      at: now.toISOString(),
+      reason: reason.replace(/\s+/g, " ").trim().slice(0, 400)
+    },
+    failed: { version: pending.to, attempts: MAX_STAGE_ATTEMPTS, at: now.toISOString() }
+  };
+}
+
+// src/install-layout.ts
+init_config();
+import {
+  existsSync as existsSync16,
+  lstatSync,
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync6,
+  realpathSync as realpathSync6,
+  renameSync as renameSync9,
+  rmSync as rmSync13,
+  symlinkSync as symlinkSync2
+} from "fs";
+import { dirname as dirname10, join as join24 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+function versionsDir() {
+  return join24(cabaneDir(), "versions");
+}
+function currentLink() {
+  return join24(cabaneDir(), "current");
+}
+function bootGuardPath() {
+  return join24(cabaneDir(), "boot-guard.mjs");
+}
+function pinnedNodeDir() {
+  return join24(cabaneDir(), "node");
+}
+function pinnedNodePath() {
+  return join24(pinnedNodeDir(), "bin", "node");
+}
+function versionPackageRoot(version) {
+  return join24(versionsDir(), version, "node_modules", "@cabane", "companion");
+}
+function ownPackageRoot(moduleUrl = import.meta.url) {
+  return dirname10(dirname10(fileURLToPath6(moduleUrl)));
+}
+function packageVersion(root) {
+  try {
+    const pkg2 = JSON.parse(readFileSync13(join24(root, "package.json"), "utf8"));
+    return typeof pkg2.version === "string" ? pkg2.version : null;
+  } catch {
+    return null;
+  }
+}
+function currentRoot() {
+  try {
+    const root = realpathSync6(currentLink());
+    return existsSync16(join24(root, "dist", "cli.js")) ? root : null;
+  } catch {
+    return null;
+  }
+}
+function pointCurrentAt(root) {
+  const link = currentLink();
+  mkdirSync14(dirname10(link), { recursive: true });
+  const fresh = `${link}.${process.pid}.${Date.now()}`;
+  symlinkSync2(root, fresh);
+  try {
+    renameSync9(fresh, link);
+  } catch (err) {
+    rmSync13(fresh, { force: true });
+    throw err;
+  }
+}
+function pruneVersions(keep) {
+  const dir2 = versionsDir();
+  if (!existsSync16(dir2)) return [];
+  const removed = [];
+  for (const name of readdirSync6(dir2)) {
+    if (keep.includes(name)) continue;
+    rmSync13(join24(dir2, name), { recursive: true, force: true });
+    removed.push(name);
+  }
+  return removed;
+}
+function compareVersions(a, b) {
+  const parts = (v) => /^\d+(\.\d+)*$/.test(v) ? v.split(".").map(Number) : null;
+  const pa = parts(a);
+  const pb = parts(b);
+  if (!pa || !pb) return pa ? 1 : pb ? -1 : 0;
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+// src/update-state.ts
+init_config();
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync14, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname11, join as join25 } from "path";
+import { z as z18 } from "zod";
+var resultSchema = z18.object({
+  kind: z18.enum(["updated", "rolled_back", "failed"]),
+  from: z18.string(),
+  to: z18.string(),
+  at: z18.string(),
+  reason: z18.string().optional()
+});
+var pendingSchema = z18.object({
+  from: z18.string(),
+  // The package root `current` pointed at before the swap, so a rollback can point it back.
+  fromRoot: z18.string(),
+  to: z18.string(),
+  at: z18.string(),
+  boots: z18.number().int().nonnegative()
+});
+var stateSchema = z18.object({
+  server: z18.object({ latest: z18.string(), minimum: z18.string(), at: z18.string() }).optional(),
+  pending: pendingSchema.optional(),
+  lastResult: resultSchema.optional(),
+  failed: z18.object({ version: z18.string(), attempts: z18.number().int(), at: z18.string() }).optional()
+});
+function updateStatePath(dir2 = cabaneDir()) {
+  return join25(dir2, "update.json");
+}
+function readUpdateState(path = updateStatePath()) {
+  try {
+    const parsed = stateSchema.safeParse(JSON.parse(readFileSync14(path, "utf8")));
+    return parsed.success ? parsed.data : {};
+  } catch {
+    return {};
+  }
+}
+function writeUpdateState(state, path = updateStatePath()) {
+  mkdirSync15(dirname11(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync10(tmp, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+  renameSync10(tmp, path);
+}
+function updateUpdateState(change, path = updateStatePath()) {
+  const next = change(readUpdateState(path));
+  writeUpdateState(next, path);
+  return next;
+}
+
+// src/updater.ts
+function updateMode(env = process.env) {
+  return env.CABANE_COMPANION_SUPERVISED === "1" ? "supervised" : "attached";
+}
+var STAGE_RETRY_MS = 60 * 6e4;
+var SWAP_DRAIN_MS = 1e4;
+var SOURCE_BUILD_VERSION = "0.0.0";
+function versionToStage(input) {
+  const { own, state, now, force } = input;
+  if (!input.auto && !force) return null;
+  if (own === SOURCE_BUILD_VERSION) return null;
+  const latest = state.server?.latest;
+  if (!latest || compareVersions(latest, own) <= 0) return null;
+  if (state.pending) return null;
+  const failed = state.failed;
+  if (!force && failed?.version === latest) {
+    if (failed.attempts >= MAX_STAGE_ATTEMPTS) return null;
+    if (now - Date.parse(failed.at) < STAGE_RETRY_MS) return null;
+  }
+  return latest;
+}
+function rollBack(pending, reason, now = /* @__PURE__ */ new Date()) {
+  if (existsSync17(pending.fromRoot)) pointCurrentAt(pending.fromRoot);
+  return updateUpdateState((state) => rolledBackState(state, pending, reason, now));
+}
+function writeBootGuard(root = ownPackageRoot()) {
+  const built = join26(root, "dist", "boot-guard.js");
+  if (!existsSync17(built)) return false;
+  const target = bootGuardPath();
+  mkdirSync16(dirname12(target), { recursive: true });
+  const tmp = `${target}.${process.pid}.tmp`;
+  copyFileSync3(built, tmp);
+  renameSync11(tmp, target);
+  return true;
+}
+function oneLine(text) {
+  return text.replace(/\s+/g, " ").trim().slice(0, 400);
+}
+var runProcess = (command, args, opts = {}) => new Promise((resolve2) => {
+  let stdout = "";
+  let stderr = "";
+  let child;
+  try {
+    child = spawn8(command, [...args], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: opts.env ?? process.env
+    });
+  } catch (err) {
+    resolve2({ code: null, stdout, stderr: err instanceof Error ? err.message : String(err) });
+    return;
+  }
+  const timer = opts.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs) : null;
+  child.stdout.on("data", (d) => stdout += d.toString());
+  child.stderr.on("data", (d) => stderr += d.toString());
+  child.on("error", (err) => {
+    if (timer) clearTimeout(timer);
+    resolve2({ code: null, stdout, stderr: stderr || err.message });
+  });
+  child.on("close", (code) => {
+    if (timer) clearTimeout(timer);
+    resolve2({ code, stdout, stderr });
+  });
+});
+async function stageVersion(version, harnesses, deps = {}) {
+  const run = deps.run ?? runProcess;
+  const node = deps.execPath ?? process.execPath;
+  const target = join26(versionsDir(), version);
+  const placed = versionPackageRoot(version);
+  if (existsSync17(placed)) {
+    if (!await verifyInstall(placed, version, harnesses, { run, execPath: node }))
+      return { ok: true, root: placed };
+  }
+  const npm = join26(dirname12(node), "npm");
+  if (!existsSync17(npm))
+    return { ok: false, reason: `there is no npm beside Node at ${dirname12(node)}` };
+  mkdirSync16(versionsDir(), { recursive: true });
+  const staging = join26(versionsDir(), `.${version}.staging-${process.pid}`);
+  rmSync14(staging, { recursive: true, force: true });
+  const installed = await run(
+    npm,
+    [
+      "install",
+      "--prefix",
+      staging,
+      "--include=optional",
+      "--no-audit",
+      "--no-fund",
+      "--no-save",
+      "--loglevel=error",
+      `@cabane/companion@${version}`
+    ],
+    {
+      // npm's install scripts run on this Node, not whichever `node` is first on PATH.
+      env: { ...process.env, PATH: `${dirname12(node)}:${process.env.PATH ?? ""}` },
+      timeoutMs: 15 * 6e4
+    }
+  );
+  if (installed.code !== 0) {
+    rmSync14(staging, { recursive: true, force: true });
+    if (/\bE404\b|\bETARGET\b|No matching version found|is not in this registry/i.test(
+      installed.stderr
+    ))
+      return { ok: false, reason: `version ${version} isn't published yet`, unpublished: true };
+    return { ok: false, reason: `npm couldn't install it: ${lastLine(installed.stderr)}` };
+  }
+  const root = join26(staging, "node_modules", "@cabane", "companion");
+  const verdict = await verifyInstall(root, version, harnesses, { run, execPath: node });
+  if (verdict) {
+    rmSync14(staging, { recursive: true, force: true });
+    return { ok: false, reason: verdict };
+  }
+  rmSync14(target, { recursive: true, force: true });
+  renameSync11(staging, target);
+  return { ok: true, root: versionPackageRoot(version) };
+}
+async function verifyInstall(root, version, harnesses, deps) {
+  if (packageVersion(root) !== version) return `the installed package isn't version ${version}`;
+  const answered = await deps.run(deps.execPath, [join26(root, "dist", "bin.js"), "--version"], {
+    timeoutMs: 6e4,
+    env: { ...process.env, CABANE_LAUNCH_SELF: "1" }
+  });
+  if (answered.code !== 0 || answered.stdout.trim() !== version) {
+    return `it doesn't start: ${lastLine(answered.stderr) || "no version printed"}`;
+  }
+  if (harnesses.length === 0) return null;
+  const probed = await deps.run(deps.execPath, [join26(root, "dist", "postinstall.js"), "--json"], {
+    timeoutMs: 6e4
+  });
+  let resolutions = {};
+  try {
+    resolutions = JSON.parse(probed.stdout);
+  } catch {
+    return "it couldn't say which bundled agents it has";
+  }
+  const missing = harnesses.filter((h) => resolutions[h]?.status !== "present");
+  if (missing.length > 0) {
+    return `its bundled ${missing.map(harnessName).join(" and ")} ${missing.length > 1 ? "are" : "is"} missing`;
+  }
+  return null;
+}
+function harnessName(h) {
+  return h === "claude-code" ? "Claude Code" : "Codex";
+}
+function lastLine(text) {
+  const lines2 = text.split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines2.at(-1)?.slice(0, 300) ?? "";
+}
+var CompanionUpdater = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  deps;
+  staging = null;
+  ready = null;
+  swapping = false;
+  watchdog = null;
+  now;
+  // At start: a recorded swap to a version that will never start again (someone installed or
+  // chose another since) is dropped, or nothing would ever confirm it and no later update would
+  // be installed.
+  start() {
+    const pending = readUpdateState().pending;
+    const current = currentRoot();
+    const currentVersion = current ? packageVersion(current) : null;
+    if (superseded(pending, this.deps.own, ...currentVersion ? [currentVersion] : [])) {
+      updateUpdateState(({ pending: _gone, ...rest }) => rest);
+      this.deps.log.info(
+        { to: pending.to, own: this.deps.own },
+        `Dropped the update to ${pending.to}: Cabane ${this.deps.own} was installed since`
+      );
+    }
+  }
+  // The deadline for an update this process is the result of: ten minutes from the first time
+  // Cabane answers it without its stream connecting. Until Cabane answers, there's no verdict on
+  // time: a server or network that is down says nothing about the version.
+  armDeadline() {
+    if (this.watchdog) return;
+    this.watchdog = setTimeout(() => void this.giveUp(), UNCONFIRMED_WINDOW_MS);
+    this.watchdog.unref?.();
+  }
+  stop() {
+    if (this.watchdog) clearTimeout(this.watchdog);
+    this.watchdog = null;
+  }
+  async giveUp() {
+    const pending = readUpdateState().pending;
+    if (!pending || pending.to !== this.deps.own) return;
+    this.deps.log.warn(
+      { from: pending.from, to: pending.to },
+      `Cabane ${pending.to} didn't connect within ${UNCONFIRMED_WINDOW_MS / 6e4} minutes of Cabane answering; going back to ${pending.from}`
+    );
+    rollBack(
+      pending,
+      `it didn't connect to Cabane within ${UNCONFIRMED_WINDOW_MS / 6e4} minutes`
+    );
+    await this.deps.restart();
+  }
+  // Auto-update is on and something will restart this companion into the new version.
+  updatesItself() {
+    return this.deps.mode === "supervised" && this.deps.autoUpdate();
+  }
+  // What the heartbeat reports.
+  report() {
+    const last = readUpdateState().lastResult;
+    return { auto: this.updatesItself(), ...last ? { lastResult: last } : {} };
+  }
+  // A heartbeat landed. Record what the server named; confirm an update this process is the
+  // result of; then, when there is something newer, install it and swap when idle.
+  async onHeartbeat(server, streamConnected) {
+    const state = updateUpdateState((s) => ({
+      ...s,
+      ...server ? { server: { ...server, at: new Date(this.now()).toISOString() } } : {}
+    }));
+    if (state.pending?.to === this.deps.own) {
+      if (streamConnected) this.confirm(state.pending);
+      else this.armDeadline();
+    }
+    if (this.ready) {
+      await this.trySwap();
+      return;
+    }
+    this.maybeStage(false);
+  }
+  confirm(pending) {
+    this.stop();
+    updateUpdateState((s) => {
+      const { pending: _done, failed: _failed, ...rest } = s;
+      return {
+        ...rest,
+        lastResult: {
+          kind: "updated",
+          from: pending.from,
+          to: pending.to,
+          at: new Date(this.now()).toISOString()
+        }
+      };
+    });
+    const removed = pruneVersions([pending.to, pending.from]);
+    this.deps.log.info(
+      { from: pending.from, to: pending.to, removed },
+      `Updated Cabane from ${pending.from} to ${pending.to}`
+    );
+  }
+  // `cabane update`, from the person: install the latest now, whatever the setting.
+  async updateNow() {
+    const state = readUpdateState();
+    const latest = state.server?.latest;
+    if (!latest) return { ok: false, message: "Cabane hasn't said which version is latest yet." };
+    if (compareVersions(latest, this.deps.own) <= 0)
+      return { ok: true, message: `Cabane ${this.deps.own} is up to date.` };
+    if (state.pending?.to === latest) return { ok: true, message: this.waitingMessage(latest) };
+    if (this.ready === latest) {
+      void this.trySwap();
+      return { ok: true, message: this.waitingMessage(latest) };
+    }
+    this.maybeStage(true);
+    if (this.staging) await this.staging;
+    if (this.ready !== latest) {
+      const after = readUpdateState();
+      if (after.pending?.to === latest) return { ok: true, message: this.waitingMessage(latest) };
+      if (after.failed?.version === latest && after.failed.attempts === 0)
+        return { ok: false, message: `Cabane ${latest} isn't published yet. Try again later.` };
+      const failed = after.lastResult;
+      return {
+        ok: false,
+        message: failed?.kind === "failed" && failed.to === latest ? `Couldn't update to ${latest}: ${failed.reason ?? "see cabane logs"}.` : `Couldn't update to ${latest}. cabane logs says why.`
+      };
+    }
+    void this.trySwap();
+    return { ok: true, message: this.waitingMessage(latest) };
+  }
+  waitingMessage(version) {
+    if (this.deps.mode === "attached")
+      return `Cabane ${version} is installed. It runs from the next  cabane start.`;
+    return this.deps.isIdle() ? `Updating to ${version} now.` : `Updating to ${version} once the turns running now finish.`;
+  }
+  maybeStage(force) {
+    if (this.staging) return;
+    const version = versionToStage({
+      auto: this.updatesItself(),
+      own: this.deps.own,
+      state: readUpdateState(),
+      now: this.now(),
+      force
+    });
+    if (!version) return;
+    const stage = this.deps.stage ?? stageVersion;
+    this.staging = (async () => {
+      this.deps.log.info({ version }, `Installing Cabane ${version} beside this one`);
+      const outcome = await stage(version, this.deps.harnesses());
+      if (outcome.ok) {
+        this.ready = version;
+        updateUpdateState((s) => {
+          const { failed: _failed, ...rest } = s;
+          return rest;
+        });
+        return;
+      }
+      if (outcome.unpublished) {
+        this.deps.log.info({ version }, `Cabane ${version} isn't published yet; trying later`);
+        updateUpdateState((s) => ({
+          ...s,
+          failed: { version, attempts: 0, at: new Date(this.now()).toISOString() }
+        }));
+        return;
+      }
+      this.deps.log.warn({ version, reason: outcome.reason }, `Couldn't install Cabane ${version}`);
+      updateUpdateState((s) => {
+        const attempts = s.failed?.version === version ? s.failed.attempts + 1 : 1;
+        const at = new Date(this.now()).toISOString();
+        return {
+          ...s,
+          failed: { version, attempts, at },
+          // Reported once it has failed for good, so a registry blip isn't an email.
+          ...attempts >= MAX_STAGE_ATTEMPTS || force ? {
+            lastResult: {
+              kind: "failed",
+              from: this.deps.own,
+              to: version,
+              at,
+              reason: oneLine(outcome.reason)
+            }
+          } : {}
+        };
+      });
+    })().finally(() => {
+      this.staging = null;
+    });
+    void this.staging.then(() => this.trySwap());
+  }
+  // Swap into the ready version once nothing is running. Called on each heartbeat until it can.
+  async trySwap() {
+    const to = this.ready;
+    if (!to || this.swapping) return;
+    if (readUpdateState().pending) return;
+    if (this.deps.mode === "attached") {
+      this.select(to);
+      this.deps.log.info({ version: to }, `Cabane ${to} is installed; it runs from the next start`);
+      return;
+    }
+    if (!this.deps.isIdle()) return;
+    this.swapping = true;
+    try {
+      await this.deps.pauseStream();
+      const sleep5 = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+      const deadline = this.now() + SWAP_DRAIN_MS;
+      await sleep5(250);
+      while (!this.deps.isIdle() && this.now() < deadline) await sleep5(250);
+      if (!this.deps.isIdle()) {
+        this.deps.resumeStream();
+        return;
+      }
+      this.select(to);
+      this.deps.log.info({ from: this.deps.own, to }, `Restarting into Cabane ${to}`);
+      await this.deps.restart();
+    } finally {
+      this.swapping = false;
+    }
+  }
+  // Record the swap and point `current` at `to`, leaving the guard that counts its starts.
+  select(to) {
+    const fromRoot = currentRoot() ?? ownPackageRoot();
+    writeBootGuard();
+    updateUpdateState((s) => ({
+      ...s,
+      pending: {
+        from: this.deps.own,
+        fromRoot,
+        to,
+        at: new Date(this.now()).toISOString(),
+        boots: 0
+      }
+    }));
+    pointCurrentAt(versionPackageRoot(to));
+    this.ready = null;
+  }
+};
+
+// src/supervisor.ts
 init_version2();
 init_src();
 var HEARTBEAT_INTERVAL_MS = 3e4;
+var ARCHIVE_PRUNE_MS = 24 * 60 * 6e4;
 var SHUTDOWN_HEARTBEAT_WAIT_MS = 1e3;
 function positiveIntEnv(name) {
   const raw = process.env[name];
@@ -15480,6 +16177,10 @@ var CompanionSupervisor = class {
   // Which dispatches this process is running, so a redelivered frame doesn't
   // run the turn a second time.
   claims = new DispatchClaims();
+  archivePruneTimer = null;
+  // Keeps this companion current when its person said so; null until paired.
+  updater = null;
+  restartForUpdate;
   constructor(opts) {
     this.config = opts.config;
     this.log = opts.log;
@@ -15489,6 +16190,10 @@ var CompanionSupervisor = class {
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
+    this.restartForUpdate = opts.restartForUpdate ?? (async () => {
+      await this.shutdown();
+      this.exitFn(0);
+    });
     this.dispatcherFactory = opts.dispatcherFactory;
     if (opts.runnerCommand) this.runnerCommand = opts.runnerCommand;
     if (opts.runnerProvider) this.providerForRunners = opts.runnerProvider;
@@ -15539,6 +16244,9 @@ var CompanionSupervisor = class {
         if (!this.runnerImage) await invalidateCompanionVolume(docker, image, source);
       }
       this.latchBootBundledState();
+      this.pruneSessionArchives();
+      this.archivePruneTimer = setInterval(() => this.pruneSessionArchives(), ARCHIVE_PRUNE_MS);
+      this.archivePruneTimer.unref?.();
     }
     const sandboxRows = agentSandboxRows(this.config);
     if (sandboxRows.length > 0 && this.dockerRunners()) {
@@ -15548,7 +16256,7 @@ var CompanionSupervisor = class {
       );
     }
     const anySandboxed = [{}, ...sandboxRows.map(([, sandbox]) => ({ sandbox }))].some(
-      (row2) => this.runnerSandboxFor(row2) === "os"
+      (row3) => this.runnerSandboxFor(row3) === "os"
     );
     if (anySandboxed) {
       const policy = this.sandboxPolicy();
@@ -15602,6 +16310,23 @@ var CompanionSupervisor = class {
         );
       }
     });
+    this.updater = new CompanionUpdater({
+      own: COMPANION_VERSION,
+      mode: updateMode(),
+      autoUpdate: () => this.config.update?.auto === true,
+      harnesses: () => this.connectedBundledHarnesses(),
+      isIdle: () => this.idle(),
+      pauseStream: async () => {
+        const sub = this.deviceSub;
+        if (!sub) return;
+        sub.stop();
+        await sub.finished;
+      },
+      resumeStream: () => void this.deviceSub?.resume(),
+      restart: () => this.restartForUpdate(),
+      log: this.log
+    });
+    this.updater.start();
     await this.refreshAssignments();
     this.deviceSub.start();
     const firstHeartbeat = startupHarnessRefresh.then(async () => {
@@ -15662,13 +16387,20 @@ var CompanionSupervisor = class {
         // Omitted until the first observed failure or heal, so the server's
         // status-less manifest synthesis still runs for a fresh companion.
         ...connectorReports.length > 0 ? { connectors: connectorReports } : {},
-        ...opencodeModels !== null ? { models: opencodeModels } : {}
+        ...opencodeModels !== null ? { models: opencodeModels } : {},
+        ...this.updater ? { update: this.updater.report() } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
       this.checkVersionSkew(res.serverVersion);
       this.heartbeated = true;
       void this.recoverRuns();
+      void this.updater?.onHeartbeat(res.companion, this.deviceConnected).catch(
+        (err) => this.log.warn(
+          { err: err instanceof Error ? err.message : String(err) },
+          "Couldn't check for a Cabane update; trying again on the next check-in."
+        )
+      );
     } catch (err) {
       this.log.warn(
         { ...apiErrorLogFields(err) },
@@ -15991,8 +16723,8 @@ var CompanionSupervisor = class {
   // The sandbox one agent's turns run under: its `agents` row, then the
   // device's. Resolved from the current config on every ask, so a reload
   // changes it; only the host probe is kept.
-  runnerSandboxFor(row2) {
-    return runnerSandboxFor(this.config, row2, this.sandboxHost);
+  runnerSandboxFor(row3) {
+    return runnerSandboxFor(this.config, row3, this.sandboxHost);
   }
   // Resolved against the agents this device runs right now.
   runnerManifest() {
@@ -16699,9 +17431,54 @@ var CompanionSupervisor = class {
       }
     }
   }
+  // A long-lived device keeps a session archive per conversation and agent it ever ran; those
+  // nobody has used in a month go.
+  pruneSessionArchives() {
+    try {
+      const removed = pruneIdleSessionArchives(cabaneDir());
+      if (removed.length > 0)
+        this.log.info({ removed: removed.length }, "runners: removed idle session archives");
+    } catch (err) {
+      this.log.warn(
+        { err: err instanceof Error ? err.message : String(err) },
+        "runners: couldn't remove idle session archives"
+      );
+    }
+  }
+  // Nothing running and nothing about to: no dispatch claimed, no turn chained, no recovery
+  // in progress. What a self-update swap waits for.
+  idle() {
+    if (this.claims.size > 0 || this.recovering) return false;
+    for (const wr of this.workspaces.values()) if (wr.chains.size > 0) return false;
+    return true;
+  }
+  // The bundled harnesses this device has connected, which a new version must still carry.
+  connectedBundledHarnesses() {
+    return [
+      ...isClaudeCodeConnected(this.config) ? ["claude-code"] : [],
+      ...isCodexEnabled(this.config) ? ["codex"] : []
+    ];
+  }
+  // `cabane update`, over the control socket: set whether this companion keeps itself current
+  // (`auto`), or install the latest now.
+  async update(auto) {
+    if (auto !== void 0) {
+      this.config = { ...this.config, update: { auto } };
+      saveConfig(this.config);
+      if (auto) this.kickHeartbeat();
+      return {
+        ok: true,
+        message: auto ? "Cabane will keep itself up to date. Updates install between turns and roll back if they fail." : "Cabane won't update itself. Run  cabane update  to update."
+      };
+    }
+    if (!this.updater) return { ok: false, message: "This computer isn't paired yet." };
+    return this.updater.updateNow();
+  }
   // ---- control actions ----
   async shutdown() {
     this.stopped = true;
+    this.updater?.stop();
+    if (this.archivePruneTimer) clearInterval(this.archivePruneTimer);
     if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
     if (this.pollTimer) clearInterval(this.pollTimer);
     const heartbeat = this.inFlightHeartbeat;
@@ -16736,9 +17513,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn10 }) => {
+  void import("child_process").then(({ spawn: spawn11 }) => {
     try {
-      const child = spawn10(process.execPath, process.argv.slice(1), {
+      const child = spawn11(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -16812,22 +17589,22 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 init_config();
-import { existsSync as existsSync16, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync17, readFileSync as readFileSync15, rmSync as rmSync15, writeFileSync as writeFileSync11 } from "fs";
+import { join as join27 } from "path";
 function crashMarkerPath() {
-  return join23(cabaneDir(), "last-error.json");
+  return join27(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
-    mkdirSync13(cabaneDir(), { recursive: true });
-    writeFileSync9(crashMarkerPath(), JSON.stringify(rec2, null, 2) + "\n");
+    mkdirSync17(cabaneDir(), { recursive: true });
+    writeFileSync11(crashMarkerPath(), JSON.stringify(rec2, null, 2) + "\n");
   } catch {
   }
 }
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync16(path)) rmSync12(path, { force: true });
+    if (existsSync18(path)) rmSync15(path, { force: true });
   } catch {
   }
 }
@@ -16882,11 +17659,14 @@ async function createCompanionRuntime(opts = {}) {
     // process behind the marker pid is this companion (not a recycled pid).
     instanceId
   });
+  let restartForUpdate = async () => {
+  };
   const supervisor = new CompanionSupervisor({
     config: cfg,
     log,
     hub,
-    ...opts.checkHarness ? { checkHarness: opts.checkHarness } : {}
+    ...opts.checkHarness ? { checkHarness: opts.checkHarness } : {},
+    restartForUpdate: () => restartForUpdate()
   });
   await supervisor.start();
   const connectHarness = async (runtime, serverUrl) => {
@@ -16911,6 +17691,7 @@ async function createCompanionRuntime(opts = {}) {
     control = await startControlServer({
       status: () => hub.statusJson(),
       connect: (runtime, serverUrl) => connectHarness(runtime, serverUrl),
+      update: (auto) => supervisor.update(auto),
       stop: () => void supervisor.requestStop()
     });
     if (opts.dashboard) {
@@ -16963,6 +17744,10 @@ async function createCompanionRuntime(opts = {}) {
     } catch {
     }
   };
+  restartForUpdate = async () => {
+    await stop2();
+    process.exit(0);
+  };
   return {
     ok: true,
     runtime: {
@@ -16984,42 +17769,438 @@ async function closeSurfaces(control, dashboard) {
 // src/commands/start.ts
 init_term();
 
-// src/commands/daemon.ts
-init_cabane_command();
-init_cli_entry();
+// src/service.ts
 init_config();
-import { spawn as spawn8 } from "child_process";
-import { closeSync as closeSync3, mkdirSync as mkdirSync14, openSync as openSync3 } from "fs";
-var STARTUP_TIMEOUT_MS = 8e3;
-var POLL_INTERVAL_MS = 150;
-async function startDaemon(opts = {}, deps = {}) {
-  const ensureRuntime = deps.ensureRuntime ?? warnAboutHarnessReadiness;
-  const readState = deps.readState ?? readLiveRuntimeState;
-  const verify = deps.verify ?? ((s) => verifyRuntime(s));
-  const spawnDetached = deps.spawnDetached ?? defaultSpawnDetached;
-  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? (() => Date.now());
-  const quiet = opts.report === "failures";
-  const cfg = requireStartConfig({
-    // Unset → `requireStartConfig`'s own `requireConfig`, the real one.
-    ...deps.requireCfg ? { requireCfg: deps.requireCfg } : {},
-    ...deps.save ? { save: deps.save } : {},
-    // The child won't log it (the block is written by then), and this process owns
-    // the user's terminal — so the one-time record is one line, here.
-    onMigrated: () => {
-      if (!quiet) {
-        process.stdout.write(
-          "Carried Claude Code over as a connected harness on this device \u2014 connectors are chosen now, not detected.\n"
-        );
-      }
-    }
+import { createHash as createHash6 } from "crypto";
+import {
+  chmodSync as chmodSync7,
+  cpSync,
+  existsSync as existsSync19,
+  mkdirSync as mkdirSync18,
+  readFileSync as readFileSync16,
+  renameSync as renameSync12,
+  rmSync as rmSync16,
+  writeFileSync as writeFileSync12
+} from "fs";
+import { homedir as homedir7, userInfo as userInfo3 } from "os";
+import { dirname as dirname13, join as join28, sep as sep5 } from "path";
+function servicePlatform(platform = process.platform) {
+  if (platform === "linux") return "systemd";
+  if (platform === "darwin") return "launchd";
+  return null;
+}
+function serviceName(env = process.env) {
+  const home = env.CABANE_COMPANION_HOME;
+  if (!home) return "cabane-companion";
+  return `cabane-companion-${createHash6("sha256").update(home).digest("hex").slice(0, 8)}`;
+}
+function launchdLabel(env = process.env) {
+  return serviceName(env).replace(/^cabane-companion/, "ai.cabane.companion").replace("-", ".");
+}
+function serviceNode(execPath = process.execPath) {
+  return existsSync19(pinnedNodePath()) ? pinnedNodePath() : execPath;
+}
+function servicePaths(platform, env = process.env, home = homedir7(), node = serviceNode()) {
+  const unitFile = platform === "systemd" ? join28(
+    env.XDG_CONFIG_HOME || join28(home, ".config"),
+    "systemd",
+    "user",
+    `${serviceName(env)}.service`
+  ) : join28(home, "Library", "LaunchAgents", `${launchdLabel(env)}.plist`);
+  return {
+    unitFile,
+    envFile: join28(cabaneDir(), "service.env"),
+    node,
+    entry: bootGuardPath()
+  };
+}
+function unitEnvironment(env) {
+  return {
+    CABANE_COMPANION_SUPERVISED: "1",
+    ...env.CABANE_COMPANION_HOME ? { CABANE_COMPANION_HOME: env.CABANE_COMPANION_HOME } : {}
+  };
+}
+function renderSystemdUnit(paths, env = process.env) {
+  const environment = Object.entries(unitEnvironment(env)).map(
+    ([key, value]) => `Environment=${systemdQuote(`${key}=${value}`)}`
+  );
+  return [
+    "# Written by `cabane service install`. Remove with `cabane service uninstall`.",
+    "[Unit]",
+    "Description=Cabane companion",
+    "Wants=network-online.target",
+    "After=network-online.target",
+    // Never stop restarting: a machine nobody watches has nobody to reset a failed unit.
+    "StartLimitIntervalSec=0",
+    "",
+    "[Service]",
+    "Type=simple",
+    `ExecStart=${systemdQuote(paths.node)} ${systemdQuote(paths.entry)} start --foreground`,
+    "Restart=always",
+    "RestartSec=5",
+    ...environment,
+    `EnvironmentFile=-${paths.envFile}`,
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+function systemdQuote(value) {
+  return /[\s"\\]/.test(value) ? `"${value.replace(/(["\\])/g, "\\$1")}"` : value;
+}
+function renderLaunchdPlist(paths, env = process.env, servicePath) {
+  const xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  const vars = { ...unitEnvironment(env), PATH: servicePath };
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    "<!-- Written by `cabane service install`. Remove with `cabane service uninstall`. -->",
+    '<plist version="1.0">',
+    "<dict>",
+    `  <key>Label</key><string>${xml(launchdLabel(env))}</string>`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    ...[paths.node, paths.entry, "start", "--foreground"].map(
+      (arg) => `    <string>${xml(arg)}</string>`
+    ),
+    "  </array>",
+    "  <key>EnvironmentVariables</key>",
+    "  <dict>",
+    ...Object.entries(vars).map(
+      ([key, value]) => `    <key>${xml(key)}</key><string>${xml(value)}</string>`
+    ),
+    "  </dict>",
+    "  <key>RunAtLoad</key><true/>",
+    "  <key>KeepAlive</key><true/>",
+    "  <key>ThrottleInterval</key><integer>5</integer>",
+    // The companion writes its own log; the console copy would only grow a second one.
+    "  <key>StandardOutPath</key><string>/dev/null</string>",
+    `  <key>StandardErrorPath</key><string>${xml(join28(cabaneDir(), "service-error.log"))}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function withServicePath(existing, path) {
+  const kept = existing.split("\n").filter((line) => line.trim() && !/^\s*PATH\s*=/.test(line));
+  return [
+    "# The Cabane service reads this. PATH is your login shell's, written by `cabane service install`.",
+    "# Add a headless sign-in here if this machine has no keychain, e.g. CLAUDE_CODE_OAUTH_TOKEN=\u2026",
+    `PATH=${path}`,
+    ...kept.filter(
+      (line) => !line.startsWith("# The Cabane service reads this") && !line.startsWith("# Add a headless sign-in here")
+    ),
+    ""
+  ].join("\n");
+}
+async function loginShellPath(run = runProcess, env = process.env) {
+  const shell = env.SHELL;
+  if (shell) {
+    const r = await run(shell, ["-l", "-c", 'printf "%s" "$PATH"'], { timeoutMs: 1e4 });
+    const path = r.stdout.trim().split("\n").at(-1)?.trim();
+    if (r.code === 0 && path && path.includes("/")) return path;
+  }
+  return env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
+}
+async function installService(deps = {}) {
+  const run = deps.run ?? runProcess;
+  const env = deps.env ?? process.env;
+  const platform = servicePlatform(deps.platform);
+  if (!platform)
+    return {
+      ok: false,
+      lines: [
+        "Running Cabane as a service works on macOS and Linux. Start it with  cabane start  here."
+      ]
+    };
+  const node = serviceNode(deps.execPath);
+  const seeded = await seedManagedInstall({
+    run,
+    execPath: node,
+    ...deps.own ? { own: deps.own } : {}
   });
-  ensureRuntime(cfg, {
-    // The onboarding script already said what's connectable, in its own
-    // words. Saying it again here, on stderr, in the middle of the closing block
-    // would be the same news twice.
-    ...quiet ? { warn: () => {
-    } } : {}
+  if (!seeded.ok) return { ok: false, lines: [seeded.reason] };
+  if (!writeBootGuard(seeded.root))
+    return {
+      ok: false,
+      lines: [
+        "This install has no boot guard to run the service with. Reinstall Cabane, then run  cabane service install  again."
+      ]
+    };
+  rewriteScriptWrappers();
+  const paths = servicePaths(platform, env, deps.home, node);
+  const servicePath = await loginShellPath(run, env);
+  mkdirSync18(dirname13(paths.envFile), { recursive: true });
+  const existing = existsSync19(paths.envFile) ? readFileSync16(paths.envFile, "utf8") : "";
+  writeFileSync12(paths.envFile, withServicePath(existing, servicePath), { mode: 384 });
+  chmodSync7(paths.envFile, 384);
+  mkdirSync18(dirname13(paths.unitFile), { recursive: true });
+  const outcome = await writeAndStartUnit(platform, paths, env, servicePath, run);
+  if (!outcome.ok) await removeUnit(platform, paths, env, run);
+  return outcome;
+}
+async function writeAndStartUnit(platform, paths, env, servicePath, run) {
+  const lines2 = [];
+  if (platform === "systemd") {
+    writeAtomic(paths.unitFile, renderSystemdUnit(paths, env));
+    const unit = `${serviceName(env)}.service`;
+    for (const args of [
+      ["--user", "daemon-reload"],
+      ["--user", "enable", unit],
+      ["--user", "restart", unit]
+    ]) {
+      const r = await run("systemctl", args, { timeoutMs: 3e4 });
+      if (r.code !== 0)
+        return {
+          ok: false,
+          lines: [
+            `systemctl ${args.join(" ")} failed: ${r.stderr.trim() || `exit ${r.code}`}`,
+            "This needs a systemd user session. Start Cabane with  cabane start  instead."
+          ]
+        };
+    }
+    const linger = await run("loginctl", ["show-user", userName(), "--property=Linger"], {
+      timeoutMs: 1e4
+    });
+    if (linger.code === 0 && /Linger=no/.test(linger.stdout)) {
+      lines2.push(
+        "! It stops when you log out of this computer. To keep it running after logout, run once:",
+        `      sudo loginctl enable-linger ${userName()}`
+      );
+    }
+  } else {
+    writeAtomic(paths.unitFile, renderLaunchdPlist(paths, env, servicePath));
+    const domain = `gui/${process.getuid?.() ?? userInfo3().uid}`;
+    await run("launchctl", ["bootout", `${domain}/${launchdLabel(env)}`], { timeoutMs: 3e4 });
+    const r = await run("launchctl", ["bootstrap", domain, paths.unitFile], { timeoutMs: 3e4 });
+    if (r.code !== 0)
+      return {
+        ok: false,
+        lines: [`launchctl bootstrap failed: ${r.stderr.trim() || `exit ${r.code}`}`]
+      };
+  }
+  return { ok: true, lines: lines2 };
+}
+async function uninstallService(deps = {}) {
+  const run = deps.run ?? runProcess;
+  const env = deps.env ?? process.env;
+  const platform = servicePlatform(deps.platform);
+  if (!platform) return { ok: true, lines: [] };
+  const paths = servicePaths(platform, env, deps.home);
+  if (!existsSync19(paths.unitFile)) return { ok: true, lines: ["No Cabane service is installed."] };
+  await removeUnit(platform, paths, env, run);
+  return { ok: true, lines: [] };
+}
+async function removeUnit(platform, paths, env, run) {
+  if (platform === "systemd") {
+    await run("systemctl", ["--user", "disable", "--now", `${serviceName(env)}.service`], {
+      timeoutMs: 3e4
+    });
+    rmSync16(paths.unitFile, { force: true });
+    await run("systemctl", ["--user", "daemon-reload"], { timeoutMs: 3e4 });
+  } else {
+    const domain = `gui/${process.getuid?.() ?? userInfo3().uid}`;
+    await run("launchctl", ["bootout", `${domain}/${launchdLabel(env)}`], { timeoutMs: 3e4 });
+    rmSync16(paths.unitFile, { force: true });
+  }
+}
+async function seedManagedInstall(deps) {
+  const current = currentRoot();
+  if (current && current.startsWith(versionsDir() + sep5)) return { ok: true, root: current };
+  const own = deps.own ?? ownPackageRoot();
+  const version = packageVersion(own);
+  if (!version || version === "0.0.0") {
+    pointCurrentAt(own);
+    return { ok: true, root: own };
+  }
+  const target = versionPackageRoot(version);
+  if (!existsSync19(target)) {
+    const staging = join28(versionsDir(), `.${version}.seed-${process.pid}`);
+    rmSync16(staging, { recursive: true, force: true });
+    try {
+      cpSync(own, join28(staging, "node_modules", "@cabane", "companion"), {
+        recursive: true,
+        verbatimSymlinks: true
+      });
+      rmSync16(join28(versionsDir(), version), { recursive: true, force: true });
+      renameSync12(staging, join28(versionsDir(), version));
+    } catch (err) {
+      rmSync16(staging, { recursive: true, force: true });
+      return {
+        ok: false,
+        reason: `Couldn't copy Cabane into ${tildeDir()}/versions for the service: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
+  const unrunnable = await verifyInstall(target, version, [], deps);
+  if (unrunnable) {
+    rmSync16(join28(versionsDir(), version), { recursive: true, force: true });
+    return { ok: false, reason: `The copy of Cabane for the service can't run: ${unrunnable}.` };
+  }
+  pointCurrentAt(target);
+  return { ok: true, root: target };
+}
+function tildeDir() {
+  return cabaneDir().replace(homedir7(), "~");
+}
+function unitNode(platform, unitFile) {
+  let text;
+  try {
+    text = readFileSync16(unitFile, "utf8");
+  } catch {
+    return null;
+  }
+  const found = platform === "systemd" ? /^ExecStart=("(?:[^"\\]|\\.)*"|\S+)/m.exec(text)?.[1] : /<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>/.exec(text)?.[1];
+  if (!found) return null;
+  return found.startsWith('"') ? found.slice(1, -1).replace(/\\(.)/g, "$1") : found;
+}
+async function serviceState(deps = {}) {
+  const run = deps.run ?? runProcess;
+  const env = deps.env ?? process.env;
+  const platform = servicePlatform(deps.platform);
+  const none = {
+    installed: false,
+    platform,
+    state: "not installed",
+    pid: null,
+    node: null,
+    nodeOk: true
+  };
+  if (!platform) return none;
+  const paths = servicePaths(platform, env, deps.home);
+  if (!existsSync19(paths.unitFile)) return none;
+  const node = unitNode(platform, paths.unitFile);
+  const nodeOk = node === null || existsSync19(node);
+  if (platform === "systemd") {
+    const r2 = await run(
+      "systemctl",
+      ["--user", "show", `${serviceName(env)}.service`, "--property=ActiveState,SubState,MainPID"],
+      { timeoutMs: 1e4 }
+    );
+    const prop = (name) => new RegExp(`^${name}=(.*)$`, "m").exec(r2.stdout)?.[1] ?? "";
+    const active = prop("ActiveState");
+    const pid2 = Number(prop("MainPID")) || null;
+    return {
+      installed: true,
+      platform,
+      state: active === "active" ? "running" : prop("SubState") || active || "unknown",
+      pid: pid2,
+      node,
+      nodeOk
+    };
+  }
+  const domain = `gui/${process.getuid?.() ?? userInfo3().uid}`;
+  const r = await run("launchctl", ["print", `${domain}/${launchdLabel(env)}`], {
+    timeoutMs: 1e4
+  });
+  if (r.code !== 0)
+    return { installed: true, platform, state: "not loaded", pid: null, node, nodeOk };
+  const state = /^\s*state = (.+)$/m.exec(r.stdout)?.[1]?.trim() ?? "unknown";
+  const pid = Number(/^\s*pid = (\d+)$/m.exec(r.stdout)?.[1]) || null;
+  return { installed: true, platform, state, pid, node, nodeOk };
+}
+function serviceInstalled(deps = {}) {
+  const platform = servicePlatform(deps.platform);
+  if (!platform) return false;
+  return existsSync19(servicePaths(platform, deps.env ?? process.env, deps.home).unitFile);
+}
+function writeAtomic(path, content) {
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync12(tmp, content);
+  renameSync12(tmp, path);
+}
+function userName() {
+  try {
+    return userInfo3().username;
+  } catch {
+    return process.env.USER ?? "";
+  }
+}
+function rewriteScriptWrappers(dir2 = join28(cabaneDir(), "bin")) {
+  for (const name of ["cabane", "cabane-companion"]) {
+    const path = join28(dir2, name);
+    let text;
+    try {
+      text = readFileSync16(path, "utf8");
+    } catch {
+      continue;
+    }
+    if (!text.includes("Written by https://cabane.ai/install.sh")) continue;
+    if (!text.includes("/dist/cli.js")) continue;
+    writeAtomic(path, text.replace("/dist/cli.js", "/dist/bin.js"));
+    chmodSync7(path, 493);
+  }
+}
+async function startService(deps = {}) {
+  return controlService("start", deps);
+}
+async function stopService(deps = {}) {
+  return controlService("stop", deps);
+}
+async function controlService(action, deps) {
+  const run = deps.run ?? runProcess;
+  const env = deps.env ?? process.env;
+  const platform = servicePlatform(deps.platform);
+  if (!platform) return { ok: false, lines: [] };
+  const paths = servicePaths(platform, env, deps.home);
+  const r = platform === "systemd" ? await run("systemctl", ["--user", action, `${serviceName(env)}.service`], {
+    timeoutMs: 3e4
+  }) : action === "start" ? await run(
+    "launchctl",
+    ["bootstrap", `gui/${process.getuid?.() ?? userInfo3().uid}`, paths.unitFile],
+    {
+      timeoutMs: 3e4
+    }
+  ) : await run(
+    "launchctl",
+    ["bootout", `gui/${process.getuid?.() ?? userInfo3().uid}/${launchdLabel(env)}`],
+    {
+      timeoutMs: 3e4
+    }
+  );
+  return r.code === 0 ? { ok: true, lines: [] } : {
+    ok: false,
+    lines: [`Couldn't ${action} the Cabane service: ${r.stderr.trim() || `exit ${r.code}`}`]
+  };
+}
+
+// src/commands/daemon.ts
+init_cabane_command();
+init_cli_entry();
+init_config();
+import { spawn as spawn9 } from "child_process";
+import { closeSync as closeSync3, mkdirSync as mkdirSync19, openSync as openSync4 } from "fs";
+var STARTUP_TIMEOUT_MS = 8e3;
+var POLL_INTERVAL_MS = 150;
+async function startDaemon(opts = {}, deps = {}) {
+  const ensureRuntime = deps.ensureRuntime ?? warnAboutHarnessReadiness;
+  const readState = deps.readState ?? readLiveRuntimeState;
+  const verify = deps.verify ?? ((s) => verifyRuntime(s));
+  const spawnDetached = deps.spawnDetached ?? defaultSpawnDetached;
+  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const quiet = opts.report === "failures";
+  const cfg = requireStartConfig({
+    // Unset → `requireStartConfig`'s own `requireConfig`, the real one.
+    ...deps.requireCfg ? { requireCfg: deps.requireCfg } : {},
+    ...deps.save ? { save: deps.save } : {},
+    // The child won't log it (the block is written by then), and this process owns
+    // the user's terminal — so the one-time record is one line, here.
+    onMigrated: () => {
+      if (!quiet) {
+        process.stdout.write(
+          "Carried Claude Code over as a connected harness on this device \u2014 connectors are chosen now, not detected.\n"
+        );
+      }
+    }
+  });
+  ensureRuntime(cfg, {
+    // The onboarding script already said what's connectable, in its own
+    // words. Saying it again here, on stderr, in the middle of the closing block
+    // would be the same news twice.
+    ...quiet ? { warn: () => {
+    } } : {}
   });
   const existing = readState();
   if (existing) {
@@ -17079,10 +18260,10 @@ function alreadyRunningLines(pid) {
 }
 function defaultSpawnDetached(args) {
   const cliPath = companionCliEntry();
-  mkdirSync14(cabaneDir(), { recursive: true });
-  const logFd = openSync3(companionLogPath(), "a");
+  mkdirSync19(cabaneDir(), { recursive: true });
+  const logFd = openSync4(companionLogPath(), "a");
   try {
-    return spawn8(process.execPath, [cliPath, ...args], {
+    return spawn9(process.execPath, [cliPath, ...args], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env, CABANE_COMPANION_DAEMON: "1" }
@@ -17092,6 +18273,209 @@ function defaultSpawnDetached(args) {
   }
 }
 
+// src/commands/service.ts
+init_cabane_command();
+init_config();
+init_term();
+init_version2();
+
+// src/commands/stop.ts
+var TERM_GRACE_MS = 6e3;
+var POLL_INTERVAL_MS2 = 150;
+async function stop(deps = {}) {
+  if ((deps.serviceInstalled ?? serviceInstalled)()) {
+    const outcome = await (deps.stopService ?? stopService)();
+    for (const line of outcome.lines) process.stdout.write(`${line}
+`);
+    if (!outcome.ok) {
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(
+      "companion: stopped the service. It starts again at boot, or with `cabane start`.\n"
+    );
+    return;
+  }
+  const readState = deps.readState ?? readLiveRuntimeState;
+  const verify = deps.verify ?? ((s) => verifyRuntime(s));
+  const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
+  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const state = readState();
+  if (!state) {
+    process.stdout.write("companion: not running (nothing to stop).\n");
+    return;
+  }
+  if (await verify(state) === "stale") {
+    clearRuntimeState();
+    process.stdout.write("companion: not running (stale marker swept).\n");
+    return;
+  }
+  const { pid } = state;
+  process.stdout.write(`companion: stopping (pid ${pid})\u2026
+`);
+  try {
+    kill(pid, "SIGTERM");
+  } catch {
+    clearRuntimeState();
+    process.stdout.write("companion: already stopped.\n");
+    return;
+  }
+  const deadline = now() + TERM_GRACE_MS;
+  while (now() < deadline) {
+    if (!isAlive(kill, pid)) {
+      process.stdout.write("companion: stopped.\n");
+      return;
+    }
+    await sleep5(POLL_INTERVAL_MS2);
+  }
+  process.stdout.write(
+    `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
+`
+  );
+  try {
+    kill(pid, "SIGKILL");
+  } catch {
+  }
+  clearRuntimeState();
+  process.stdout.write("companion: force-stopped.\n");
+}
+function isAlive(kill, pid) {
+  try {
+    kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/service.ts
+var STARTUP_WAIT_MS = 2e4;
+async function installAndStartService(deps = {}) {
+  const readState = deps.readState ?? readLiveRuntimeState;
+  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const before = await serviceState(deps);
+  const running = readState();
+  if (running && running.pid !== before.pid) await (deps.stopRunning ?? (() => stop()))();
+  setRunsAsService(true);
+  const outcome = await installService(deps);
+  for (const line of outcome.lines) write(`${INDENT}${line}`);
+  if (!outcome.ok) {
+    setRunsAsService(false);
+    return false;
+  }
+  const deadline = now() + STARTUP_WAIT_MS;
+  while (now() < deadline) {
+    const state = readState();
+    if (state?.socket) return true;
+    await sleep5(250);
+  }
+  write(
+    `${INDENT}The service is installed but Cabane hasn't come up yet. ${cabane("service status")} and ${cabane("logs")} say why.`
+  );
+  return false;
+}
+async function serviceInstall(deps = {}) {
+  if (!await installAndStartService(deps)) {
+    process.exitCode = 1;
+    return;
+  }
+  write(
+    INDENT + tick(
+      "Cabane runs as a service. It starts at boot, restarts if it stops, and updates itself between turns."
+    )
+  );
+  write(`${INDENT}  Status:  ${cabane("service status")}        Logs:  ${cabane("logs")}`);
+}
+async function serviceUninstall(deps = {}) {
+  const outcome = await uninstallService(deps);
+  for (const line of outcome.lines) write(`${INDENT}${line}`);
+  if (outcome.lines.length > 0) return;
+  setRunsAsService(false);
+  write(
+    INDENT + tick("Removed the service. Cabane won't start at boot, and it isn't running now.")
+  );
+  write(`${INDENT}  Start it again with  ${cabane("start")}`);
+}
+async function serviceStatus(deps = {}) {
+  const state = await serviceState(deps);
+  for (const line of serviceRows(state)) write(line);
+  for (const line of updateRows(readUpdateState(), safeConfig()?.update?.auto, {
+    service: state.installed
+  }))
+    write(line);
+  if (state.installed && state.state !== "running") process.exitCode = 1;
+}
+var LABEL_WIDTH = 13;
+var row = (label, value) => `  ${label.padEnd(LABEL_WIDTH)}${value}`;
+function serviceRows(state) {
+  if (!state.installed) {
+    return [
+      row(
+        "Service",
+        state.platform ? `not installed \u2014 ${cabane("service install")} starts Cabane at boot` : "not available on this system"
+      )
+    ];
+  }
+  const via = state.platform === "systemd" ? "systemd" : "launchd";
+  const rows = [
+    row(
+      "Service",
+      state.state === "running" ? `running (${via}${state.pid ? `, pid ${state.pid}` : ""})` : `installed, not running (${via}: ${state.state})`
+    )
+  ];
+  if (!state.nodeOk) {
+    rows.push(
+      `  ! The service's Node at ${tildePath(state.node ?? "")} is gone. Run  ${cabane("service install")}  again.`
+    );
+  }
+  return rows;
+}
+function updateRows(state, auto, opts = {}) {
+  const rows = [];
+  if (opts.version !== false) rows.push(row("Version", COMPANION_VERSION));
+  if (state.server) {
+    rows.push(
+      row(
+        "Cabane wants",
+        `${state.server.latest} (the latest), ${state.server.minimum} or newer to run turns`
+      )
+    );
+  }
+  rows.push(
+    row(
+      "Auto-update",
+      !opts.service ? `off \u2014 runs with the service: ${cabane("service install")}` : auto === true ? "on \u2014 updates install between turns and roll back if they fail" : `off \u2014 ${cabane("update --auto on")} turns it on`
+    )
+  );
+  const last = state.lastResult;
+  if (last) {
+    const when = new Date(last.at).toLocaleDateString("en-GB", { day: "numeric", month: "short" });
+    const why = last.reason ? `: ${last.reason}` : "";
+    rows.push(
+      row(
+        "Last update",
+        last.kind === "updated" ? `${last.from} \u2192 ${last.to} on ${when}` : last.kind === "rolled_back" ? `${last.to} rolled back to ${last.from} on ${when}${why}` : `${last.to} failed on ${when}${why}`
+      )
+    );
+  }
+  return rows;
+}
+function safeConfig() {
+  try {
+    return loadConfig();
+  } catch {
+    return null;
+  }
+}
+function setRunsAsService(on) {
+  const cfg = safeConfig();
+  if (!cfg) return;
+  const { serviceDeclined: _declined, ...rest } = cfg;
+  saveConfig({ ...rest, update: { auto: on } });
+}
+
 // src/commands/start.ts
 var FORCE_EXIT_MS = 4e3;
 var MAX_CODES = 3;
@@ -17116,6 +18500,10 @@ async function startScript(opts, interactive) {
     await startSupervised(opts, interactive, daemon);
     return;
   }
+  if (serviceInstalled()) {
+    await startTheService();
+    return;
+  }
   await startForPerson(opts, interactive);
 }
 async function surveyAgents(cfg, deps = {}) {
@@ -17499,7 +18887,7 @@ function openLink(link, spinner) {
     `${INDENT}Couldn't open a browser here. Open this link on any device: ${link}`
   );
   try {
-    const child = spawn9(opener, [link], { stdio: "ignore", detached: true });
+    const child = spawn10(opener, [link], { stdio: "ignore", detached: true });
     child.once("error", failed);
     child.once("exit", (code) => {
       if (code !== 0) failed();
@@ -17510,32 +18898,67 @@ function openLink(link, spinner) {
   }
 }
 async function handOffToBackground(runtime, ctx2) {
+  const { asService } = ctx2.justPaired ? await askHowToRun() : { asService: false };
   await runtime.stop();
-  const outcome = await startDaemon({ report: "failures", ...ctx2 });
-  if (!outcome.started) {
-    return;
+  if (asService) {
+    if (!await installAndStartService()) {
+      write(`${INDENT}Running it in the background instead.`);
+      if (!(await startDaemon({ report: "failures", ...ctx2 })).started) return;
+    }
+  } else {
+    const outcome = await startDaemon({ report: "failures", ...ctx2 });
+    if (!outcome.started) {
+      return;
+    }
   }
+  const supervised = asService && serviceInstalled();
   for (const label of ctx2.connected) write(INDENT + tick(`${label} connected.`));
   for (const runtime2 of ctx2.signedOut) {
     write(
       `${INDENT}! ${HARNESS_LABELS[runtime2]} is connected here but signed out. Run  ${loginCommand(runtime2)}  to use it again.`
     );
   }
+  const where = supervised ? "as a service, and starts at boot" : "in the background";
   write(
     INDENT + tick(
-      ctx2.justPaired ? "Cabane is running in the background. You can close this window." : "Cabane is running in the background."
+      ctx2.justPaired ? `Cabane is running ${where}. You can close this window.` : `Cabane is running ${where}.`
     )
   );
   write(`    Stop:  ${cabane("stop")}        Logs:  ${cabane("logs")}`);
   if (ctx2.justPaired) {
-    blank();
-    write(
-      `${INDENT}! It won't restart on its own after a reboot \u2014 run  ${cabane("start")}  again.`
-    );
+    if (!supervised) {
+      blank();
+      write(
+        `${INDENT}! It won't restart on its own after a reboot \u2014 run  ${cabane("start")}  again, or  ${cabane("service install")}  to start it at boot.`
+      );
+    }
     blank();
     write(`${INDENT}All set on this side. Finish up in Cabane.`);
   }
 }
+async function askHowToRun(deps = {}) {
+  const ask = deps.confirm ?? confirm;
+  const cfg = safeLoadConfig();
+  if (!cfg || !servicePlatform() || cfg.serviceDeclined || serviceInstalled())
+    return { asService: false };
+  blank();
+  const asService = await ask(
+    "Keep Cabane running and up to date on this computer? It starts at boot, restarts if it stops, and updates itself between turns."
+  );
+  if (!asService) saveConfig({ ...cfg, serviceDeclined: true });
+  blank();
+  return { asService };
+}
+async function startTheService() {
+  const outcome = await startService();
+  for (const line of outcome.lines) write(`${INDENT}${line}`);
+  if (!outcome.ok) {
+    process.exitCode = 1;
+    return;
+  }
+  write(INDENT + tick("Cabane runs as a service here, and is starting."));
+  write(`    Status:  ${cabane("service status")}        Logs:  ${cabane("logs")}`);
+}
 async function runAttached(runtime) {
   await new Promise((resolve2) => {
     let shuttingDown = false;
@@ -17607,7 +19030,7 @@ async function pair(opts = {}, deps = {}) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 
 // src/commands/logs.ts
 init_cabane_command();
@@ -17691,18 +19114,18 @@ async function logs(opts = {}) {
 // src/commands/status.ts
 init_bundled_binaries();
 init_cabane_command();
-import { readdirSync as readdirSync6, realpathSync as realpathSync5, existsSync as existsSync17 } from "fs";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname9, join as join24 } from "path";
+import { readdirSync as readdirSync7, realpathSync as realpathSync7, existsSync as existsSync20 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname14, join as join29 } from "path";
 init_config();
 init_sandbox_policy();
 init_secrets();
 init_term();
 init_transcript_writer();
 init_version2();
-var LABEL_WIDTH = 13;
-function row(label, value) {
-  return `  ${label.padEnd(LABEL_WIDTH)}${value}`;
+var LABEL_WIDTH2 = 13;
+function row2(label, value) {
+  return `  ${label.padEnd(LABEL_WIDTH2)}${value}`;
 }
 async function status() {
   const out = (line) => void process.stdout.write(`${line}
@@ -17720,29 +19143,36 @@ async function status() {
     process.exitCode = 1;
     return;
   }
-  out(row("Paired with", `${cfg.baseUrl}${cfg.deviceLabel ? ` as ${cfg.deviceLabel}` : ""}`));
+  out(row2("Paired with", `${cfg.baseUrl}${cfg.deviceLabel ? ` as ${cfg.deviceLabel}` : ""}`));
   const running = await liveState();
   let harnesses = null;
   if (running) {
     const mode = running.daemon ? "in the background" : "in a terminal";
     const uptime = formatUptime(running.startedAt);
-    out(row("Running", `${mode} (pid ${running.pid}${uptime ? `, up ${uptime}` : ""})`));
+    out(row2("Running", `${mode} (pid ${running.pid}${uptime ? `, up ${uptime}` : ""})`));
     harnesses = await runningHarnesses(running);
   } else {
-    out(row("Running", `no \u2014 start it with  ${cabane("start")}`));
-  }
+    out(row2("Running", `no \u2014 start it with  ${cabane("start")}`));
+  }
+  const service2 = await serviceState();
+  for (const line of serviceRows(service2)) out(line);
+  for (const line of updateRows(readUpdateState(), cfg.update?.auto, {
+    version: false,
+    service: service2.installed
+  }))
+    out(line);
   for (const line of await agentLines(cfg, harnesses)) out(line);
-  out(row("Logs", `${cabane("logs")}   (${tildePath(companionLogPath())})`));
-  out(row("Transcripts", transcriptsLine()));
+  out(row2("Logs", `${cabane("logs")}   (${tildePath(companionLogPath())})`));
+  out(row2("Transcripts", transcriptsLine()));
   const names = loadSecretStoreTolerant().names();
   out(
-    names.length > 0 ? row("Secrets", `${names.length} declared (${names.join(", ")})`) : row(
+    names.length > 0 ? row2("Secrets", `${names.length} declared (${names.join(", ")})`) : row2(
       "Secrets",
       "none declared \u2014 add `${VAR}` values to ~/.cabane/secrets.json for MCP servers that need them"
     )
   );
   if (cfg.prepareHook) {
-    out(row("Prepare hook", `${cfg.prepareHook.command} (device-level, all agents)`));
+    out(row2("Prepare hook", `${cfg.prepareHook.command} (device-level, all agents)`));
   }
   for (const line of sandboxStatusLines(cfg)) out(line);
   const overrides2 = Object.keys(cfg.agents ?? {});
@@ -17752,10 +19182,10 @@ function versionLine() {
   const install = companionInstall();
   const own = installedCommandPath({ install });
   if (install === "script") {
-    return `Cabane ${COMPANION_VERSION} \xB7 installed by the install script (${tildePath(join24(homedir7(), ".cabane"))})`;
+    return `Cabane ${COMPANION_VERSION} \xB7 installed by the install script (${tildePath(join29(homedir8(), ".cabane"))})`;
   }
   if (own)
-    return `Cabane ${COMPANION_VERSION} \xB7 installed with npm (${tildePath(dirname9(dirname9(own)))})`;
+    return `Cabane ${COMPANION_VERSION} \xB7 installed with npm (${tildePath(dirname14(dirname14(own)))})`;
   return `Cabane ${COMPANION_VERSION}`;
 }
 function otherInstallLines(running) {
@@ -17772,14 +19202,14 @@ function otherInstallLines(running) {
 function otherInstall(install, own) {
   const real = (p) => {
     try {
-      return realpathSync5(p);
+      return realpathSync7(p);
     } catch {
       return null;
     }
   };
   if (install === "npm") {
-    const script = join24(
-      homedir7(),
+    const script = join29(
+      homedir8(),
       ".cabane",
       "node",
       "lib",
@@ -17787,12 +19217,12 @@ function otherInstall(install, own) {
       "@cabane",
       "companion"
     );
-    return existsSync17(script) ? join24(homedir7(), ".cabane") : null;
+    return existsSync20(script) ? join29(homedir8(), ".cabane") : null;
   }
   const found = firstOnPath("cabane-companion", process.env.PATH);
   if (!found) return null;
-  const ownAlias = own ? real(join24(dirname9(own), "cabane-companion")) : null;
-  return real(found) === ownAlias ? null : dirname9(found);
+  const ownAlias = own ? real(join29(dirname14(own), "cabane-companion")) : null;
+  return real(found) === ownAlias ? null : dirname14(found);
 }
 async function liveState() {
   const running = readLiveRuntimeState();
@@ -17819,18 +19249,18 @@ async function agentLines(cfg, running) {
     const label = HARNESS_LABELS[runtime];
     const connected = runtime === "codex" ? !!cfg.codex && cfg.codex.enabled !== false : !!cfg.claudeCode && cfg.claudeCode.enabled !== false;
     if (!connected) {
-      lines2.push(row(label, "not connected"));
+      lines2.push(row2(label, "not connected"));
       continue;
     }
     const fromRunning = running?.find((h) => h.runtime === runtime);
     const signIn = fromRunning ? { status: fromRunning.signIn, version: fromRunning.version } : await localSignIn(runtime);
-    lines2.push(row(label, signInText(runtime, signIn.status, signIn.version)));
+    lines2.push(row2(label, signInText(runtime, signIn.status, signIn.version)));
   }
   if (cfg.opencode?.serverUrl) {
     const fromRunning = running?.find((h) => h.runtime === "opencode");
     const answering = fromRunning ? fromRunning.state === "exposed" : null;
     lines2.push(
-      row(
+      row2(
         HARNESS_LABELS.opencode,
         `${cfg.opencode.serverUrl}${answering === false ? " \u2014 not answering" : ""}`
       )
@@ -17886,7 +19316,7 @@ function transcriptsLine() {
   let count = 0;
   let newest;
   try {
-    const files = readdirSync6(dir2).filter((f) => f.endsWith(".jsonl")).sort();
+    const files = readdirSync7(dir2).filter((f) => f.endsWith(".jsonl")).sort();
     count = files.length;
     newest = files[files.length - 1];
   } catch {
@@ -17906,61 +19336,107 @@ function formatUptime(startedAt) {
   return remMin ? `${hr}h${remMin}m` : `${hr}h`;
 }
 
-// src/commands/stop.ts
-var TERM_GRACE_MS = 6e3;
-var POLL_INTERVAL_MS2 = 150;
-async function stop(deps = {}) {
-  const readState = deps.readState ?? readLiveRuntimeState;
-  const verify = deps.verify ?? ((s) => verifyRuntime(s));
-  const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
-  const sleep5 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? (() => Date.now());
-  const state = readState();
-  if (!state) {
-    process.stdout.write("companion: not running (nothing to stop).\n");
+// src/commands/update.ts
+init_config();
+init_term();
+init_version2();
+init_cabane_command();
+var UPDATE_TIMEOUT_MS = 20 * 6e4;
+async function update(opts = {}) {
+  const running = readLiveRuntimeState();
+  if (opts.auto) {
+    const auto = opts.auto === "on";
+    if (auto && !serviceInstalled()) {
+      write(
+        `${INDENT}Cabane updates itself only when it runs as a service. Run  ${cabane("service install")}  to run it as one, with updates on.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (running?.socket) {
+      const r = await controlRequest(running.socket, { cmd: "update", auto });
+      write(`${INDENT}${r.ok ? tick(r.message) : r.message}`);
+      return;
+    }
+    const cfg2 = loadConfig();
+    if (!cfg2) {
+      write(`${INDENT}This computer isn't set up yet. Run  ${cabane("start")}  first.`);
+      process.exitCode = 1;
+      return;
+    }
+    saveConfig({ ...cfg2, update: { auto } });
+    write(
+      INDENT + tick(
+        auto ? "Cabane will keep itself up to date. Updates install between turns and roll back if they fail." : "Cabane won't update itself."
+      )
+    );
     return;
   }
-  if (await verify(state) === "stale") {
-    clearRuntimeState();
-    process.stdout.write("companion: not running (stale marker swept).\n");
+  if (running?.socket) {
+    const r = await controlRequest(
+      running.socket,
+      { cmd: "update" },
+      UPDATE_TIMEOUT_MS
+    );
+    write(`${INDENT}${r.ok ? tick(r.message) : r.message}`);
+    if (!r.ok) process.exitCode = 1;
     return;
   }
-  const { pid } = state;
-  process.stdout.write(`companion: stopping (pid ${pid})\u2026
-`);
-  try {
-    kill(pid, "SIGTERM");
-  } catch {
-    clearRuntimeState();
-    process.stdout.write("companion: already stopped.\n");
+  const latest = readUpdateState().server?.latest;
+  if (!latest) {
+    write(
+      `${INDENT}Cabane hasn't said which version is latest yet. Run  ${cabane("start")}, and it updates from there.`
+    );
+    process.exitCode = 1;
     return;
   }
-  const deadline = now() + TERM_GRACE_MS;
-  while (now() < deadline) {
-    if (!isAlive(kill, pid)) {
-      process.stdout.write("companion: stopped.\n");
-      return;
-    }
-    await sleep5(POLL_INTERVAL_MS2);
+  if (compareVersions(latest, COMPANION_VERSION) <= 0) {
+    write(INDENT + tick(`Cabane ${COMPANION_VERSION} is up to date.`));
+    return;
   }
-  process.stdout.write(
-    `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
-`
+  const cfg = loadConfig();
+  const harnesses = cfg ? [
+    ...isClaudeCodeConnected(cfg) ? ["claude-code"] : [],
+    ...isCodexEnabled(cfg) ? ["codex"] : []
+  ] : [];
+  write(
+    `${INDENT}Installing Cabane ${latest}. It brings its own copies of the agents, so this can take a few minutes.`
   );
-  try {
-    kill(pid, "SIGKILL");
-  } catch {
-  }
-  clearRuntimeState();
-  process.stdout.write("companion: force-stopped.\n");
-}
-function isAlive(kill, pid) {
-  try {
-    kill(pid, 0);
-    return true;
-  } catch {
-    return false;
+  const outcome = await stageVersion(latest, harnesses);
+  if (!outcome.ok) {
+    if (outcome.unpublished) {
+      write(`${INDENT}Cabane ${latest} isn't published yet. Try again later.`);
+      process.exitCode = 1;
+      return;
+    }
+    updateUpdateState((s) => ({
+      ...s,
+      lastResult: {
+        kind: "failed",
+        from: COMPANION_VERSION,
+        to: latest,
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        reason: outcome.reason
+      }
+    }));
+    write(`${INDENT}Couldn't update to ${latest}: ${outcome.reason}.`);
+    process.exitCode = 1;
+    return;
   }
+  const fromRoot = currentRoot() ?? ownPackageRoot();
+  updateUpdateState((s) => ({
+    ...s,
+    pending: {
+      from: COMPANION_VERSION,
+      fromRoot,
+      to: latest,
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      boots: 0
+    }
+  }));
+  writeBootGuard();
+  pointCurrentAt(outcome.root);
+  write(INDENT + tick(`Updated to ${latest}. Start it with  ${cabane("start")}`));
 }
 
 // src/commands/transcript.ts
@@ -17968,8 +19444,8 @@ init_cabane_command();
 init_errors();
 init_src();
 init_transcript_writer();
-import { existsSync as existsSync18, readFileSync as readFileSync13, readdirSync as readdirSync7 } from "fs";
-import { isAbsolute, join as join25 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync17, readdirSync as readdirSync8 } from "fs";
+import { isAbsolute, join as join30 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -17986,7 +19462,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join25(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join30(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -18069,7 +19545,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync13(join25(dir2, f), "utf8"),
+    read: (f) => readFileSync17(join30(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -18094,7 +19570,7 @@ async function followTranscripts(dir2) {
 }
 function listFiles(dir2) {
   try {
-    return readdirSync7(dir2).filter((f) => f.endsWith(".jsonl")).sort().reverse();
+    return readdirSync8(dir2).filter((f) => f.endsWith(".jsonl")).sort().reverse();
   } catch {
     return [];
   }
@@ -18109,7 +19585,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join25(dir2, f));
+    const { meta, outcome } = peek(join30(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -18131,7 +19607,7 @@ function peek(path) {
   let meta;
   let outcome;
   try {
-    for (const line of readFileSync13(path, "utf8").split("\n")) {
+    for (const line of readFileSync17(path, "utf8").split("\n")) {
       if (!line.trim()) continue;
       const o = safeParse(line);
       const t = str2(rec(o)?.type);
@@ -18144,13 +19620,13 @@ function peek(path) {
 }
 function resolveTarget(dir2, target) {
   if (isAbsolute(target) || target.includes("/")) {
-    if (existsSync18(target)) return target;
+    if (existsSync21(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join25(dir2, target);
-  if (existsSync18(exact)) return exact;
+  const exact = join30(dir2, target);
+  if (existsSync21(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join25(dir2, matches[0]);
+  if (matches.length === 1) return join30(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`${cabane("transcript")}\` to list them.`
@@ -18164,7 +19640,7 @@ function resolveTarget(dir2, target) {
 function renderFile(path) {
   let content;
   try {
-    content = readFileSync13(path, "utf8");
+    content = readFileSync17(path, "utf8");
   } catch (err) {
     throw new CompanionError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -18324,7 +19800,7 @@ program.command("pair").description(
   });
 });
 program.command("write-paired-config", { hidden: true }).description("persist an already-completed device enrollment payload from stdin.").action(() => {
-  writeCompletedPairing(readFileSync14(0, "utf8"));
+  writeCompletedPairing(readFileSync18(0, "utf8"));
 });
 program.command("start").description("pair this device if needed, connect an agent on it, and run in the background.").option("--foreground", "run attached in this terminal (for terminals and supervisors)").option("--daemon", "run in the background (the default; kept for compatibility)").option("--server <url>", "the cabane instance to pair with, if this device isn\u2019t paired yet").addOption(
   new Option("--log-level <level>", "info (default), warn, or debug").choices([
@@ -18348,6 +19824,21 @@ program.command("start").description("pair this device if needed, connect an age
 program.command("connect").description("connect an agent on this machine to Cabane (claude-code, codex, opencode).").argument("<harness>", "claude-code, codex, or opencode").option("--url <url>", "the `opencode serve` URL (opencode only)").action(async (harness, opts) => {
   await connect2(harness, { ...opts.url !== void 0 ? { serverUrl: opts.url } : {} });
 });
+program.command("update").description(
+  "update to the latest version now, or set whether Cabane keeps itself up to date (--auto on|off)."
+).addOption(new Option("--auto <setting>", "on or off").choices(["on", "off"])).action(async (opts) => {
+  await update(opts.auto ? { auto: opts.auto } : {});
+});
+var service = program.command("service").description("run Cabane as a service that starts at boot and restarts if it stops.");
+service.command("install").description("install the service and start it (systemd on Linux, launchd on macOS).").action(async () => {
+  await serviceInstall();
+});
+service.command("uninstall").description("stop the service and remove it.").action(async () => {
+  await serviceUninstall();
+});
+service.command("status").description("show the service's state, this version, and how updates are going.").action(async () => {
+  await serviceStatus();
+});
 program.command("stop").description("stop a running companion (SIGTERM, then force-kill after a timeout).").action(async () => {
   await stop();
 });