@cabane/companion 0.6.162 → 0.6.163

package/dist/cli.js

@@ -3048,14 +3048,14 @@ function readSdkUsage(usage) {
 function readRequestContextTokens(msg) {
   return readSdkUsage(msg.message?.usage)?.inputTokens;
 }
-async function readHarnessContext(read) {
-  if (!read) return void 0;
+async function readHarnessContext(read2) {
+  if (!read2) return void 0;
   let timer;
   const timeout = new Promise((resolve2) => {
     timer = setTimeout(() => resolve2(void 0), CONTEXT_READING_TIMEOUT_MS);
   });
   try {
-    return parseContextUsage(await Promise.race([read(), timeout]));
+    return parseContextUsage(await Promise.race([read2(), timeout]));
   } catch {
     return void 0;
   } finally {
@@ -5412,14 +5412,14 @@ function decideResume3(stored, currentCwd) {
 function readUsageBaseline(raw) {
   if (!raw || typeof raw !== "object") return null;
   const rec2 = raw;
-  const read = (key) => {
+  const read2 = (key) => {
     const v = rec2[key];
     return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : null;
   };
-  const inputTokens = read("inputTokens");
-  const outputTokens = read("outputTokens");
-  const cacheReadTokens = read("cacheReadTokens");
-  const cacheCreationTokens = read("cacheCreationTokens");
+  const inputTokens = read2("inputTokens");
+  const outputTokens = read2("outputTokens");
+  const cacheReadTokens = read2("cacheReadTokens");
+  const cacheCreationTokens = read2("cacheCreationTokens");
   if (inputTokens === null || outputTokens === null || cacheReadTokens === null || cacheCreationTokens === null) {
     return null;
   }
@@ -7244,7 +7244,7 @@ var init_opencode_lock = __esm({
 
 // src/turn-containment.ts
 import { execFile, execFileSync, spawn as spawn6 } from "child_process";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { promisify } from "util";
 function turnScopeUnit(turnId, attempt) {
   const safe2 = turnId.replace(/[^A-Za-z0-9_.-]/g, "-");
@@ -7297,7 +7297,7 @@ function currentSystemdUnit(cgroupText) {
 }
 function readCurrentSystemdUnit() {
   try {
-    return currentSystemdUnit(readFileSync10("/proc/self/cgroup", "utf8"));
+    return currentSystemdUnit(readFileSync11("/proc/self/cgroup", "utf8"));
   } catch {
     return null;
   }
@@ -7527,18 +7527,18 @@ var init_turn_containment = __esm({
 });
 
 // src/secrets.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { join as join20 } from "path";
 import { z as z15 } from "zod";
 function secretsPath() {
-  return join19(cabaneDir(), "secrets.json");
+  return join20(cabaneDir(), "secrets.json");
 }
 function loadSecretStore() {
   const path = secretsPath();
   if (!existsSync12(path)) return makeStore({});
   let raw;
   try {
-    raw = readFileSync11(path, "utf8");
+    raw = readFileSync12(path, "utf8");
   } catch (err) {
     throw new ConfigError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -8581,10 +8581,10 @@ var init_build_options = __esm({
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join20(tmpdir(), PREFIX));
-  const path = join20(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join21(tmpdir(), PREFIX));
+  const path = join21(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -8604,13 +8604,13 @@ var init_codex_instructions = __esm({
 // src/codex-images.ts
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function createCodexImagePreparer(opts) {
   const doFetch = opts.fetch ?? fetch;
   const timeoutMs = opts.timeoutMs ?? FETCH_TIMEOUT_MS;
   return async (urls, signal) => {
     signal.throwIfAborted();
-    const dir2 = await mkdtemp2(join21(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
+    const dir2 = await mkdtemp2(join22(tmpdir2(), `cabane-codex-images-${opts.turnId}-`));
     const cleanup = async () => {
       try {
         await rm2(dir2, { recursive: true, force: true });
@@ -8631,7 +8631,7 @@ function createCodexImagePreparer(opts) {
         const ext = EXTENSIONS[type];
         if (!ext) throw new Error(`not a vision image type: ${type || "none"}`);
         const bytes = new Uint8Array(await res.arrayBuffer());
-        const path = join21(dir2, `image-${index + 1}.${ext}`);
+        const path = join22(dir2, `image-${index + 1}.${ext}`);
         await writeFile2(path, bytes, { mode: 384 });
         return path;
       } catch (err) {
@@ -8682,9 +8682,9 @@ function resolveSeqFloor(sources, ctx2) {
   );
   return floor;
 }
-function readOutboxFloor(read, turnId, log2) {
+function readOutboxFloor(read2, turnId, log2) {
   try {
-    return read(turnId);
+    return read2(turnId);
   } catch (err) {
     log2.debug(
       { turnId, err: err instanceof Error ? err.message : String(err) },
@@ -8776,22 +8776,22 @@ var init_prepare_failure = __esm({
 });
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync9, writeFileSync as writeFileSync8, existsSync as existsSync13 } from "fs";
-import { join as join22 } from "path";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync13, rmSync as rmSync9, writeFileSync as writeFileSync8, existsSync as existsSync13 } from "fs";
+import { join as join23 } from "path";
 function dirFor(workspaceId) {
-  return join22(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join23(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join22(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join23(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor2(workspaceId, conversationId, agentId) {
-  return join22(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join23(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor2(workspaceId, conversationId, agentId);
   if (!existsSync13(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     if (parsed && typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
       return {
         cwd: parsed.cwd,
@@ -8823,9 +8823,9 @@ var init_prepared = __esm({
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync5, copyFileSync as copyFileSync2, mkdirSync as mkdirSync14, readdirSync as readdirSync2, rmSync as rmSync10 } from "fs";
-import { basename as basename3, dirname as dirname13, join as join23 } from "path";
+import { basename as basename3, dirname as dirname12, join as join24 } from "path";
 function transcriptsDir() {
-  return join23(runnerStateDir(), "transcripts");
+  return join24(runnerStateDir(), "transcripts");
 }
 function fileName(meta) {
   const d = new Date(meta.ts);
@@ -8851,7 +8851,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync10(join23(dir2, f), { force: true });
+      rmSync10(join24(dir2, f), { force: true });
     } catch {
     }
   }
@@ -8869,7 +8869,7 @@ var init_transcript_writer = __esm({
       onWarn;
       constructor(dir2, meta, onWarn) {
         this.onWarn = onWarn;
-        this.path = join23(dir2, fileName(meta));
+        this.path = join24(dir2, fileName(meta));
         try {
           mkdirSync14(dir2, { recursive: true });
           try {
@@ -8898,10 +8898,10 @@ var init_transcript_writer = __esm({
       preserveAnomaly() {
         if (this.broken) return;
         try {
-          const dir2 = join23(dirname13(this.path), "anomalies");
+          const dir2 = join24(dirname12(this.path), "anomalies");
           mkdirSync14(dir2, { recursive: true, mode: 448 });
           chmodSync5(dir2, 448);
-          const target = join23(dir2, basename3(this.path));
+          const target = join24(dir2, basename3(this.path));
           copyFileSync2(this.path, target);
           chmodSync5(target, 384);
           pruneOld(dir2, ANOMALY_RETAIN);
@@ -10338,7 +10338,7 @@ var init_turn_execution = __esm({
 // src/dispatcher.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { existsSync as existsSync15, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function checkoutState(cwd) {
   if (!cwd) return { ok: false, reason: "no working directory was resolved for this turn" };
   if (!existsSync15(cwd)) return { ok: false, reason: `the working directory is gone (${cwd})` };
@@ -10351,7 +10351,7 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join24(cwd, ".git");
+  const gitPath = join25(cwd, ".git");
   if (!existsSync15(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
@@ -10359,7 +10359,7 @@ function checkoutState(cwd) {
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync15(join24(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync15(join25(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -10730,7 +10730,7 @@ import {
   chmodSync as chmodSync7,
   mkdirSync as mkdirSync17,
   mkdtempSync,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync7,
   rmSync as rmSync14,
   writeFileSync as writeFileSync10
@@ -10738,7 +10738,7 @@ import {
 import { createRequire as createRequire3 } from "module";
 import { isIP } from "net";
 import { homedir as homedir8, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo3 } from "os";
-import { dirname as dirname15, join as join28, sep as sep5 } from "path";
+import { dirname as dirname14, join as join29, sep as sep5 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
@@ -10770,23 +10770,23 @@ async function resolvedAddresses(baseUrl) {
   }
 }
 function companionPackageRoot(modulePath) {
-  for (let dir2 = dirname15(modulePath); ; dir2 = dirname15(dir2)) {
+  for (let dir2 = dirname14(modulePath); ; dir2 = dirname14(dir2)) {
     try {
-      const manifest = JSON.parse(readFileSync15(join28(dir2, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync16(join29(dir2, "package.json"), "utf8"));
       if (manifest.name === "@cabane/companion") return dir2;
     } catch {
     }
-    if (dirname15(dir2) === dir2) return null;
+    if (dirname14(dir2) === dir2) return null;
   }
 }
 function harnessRuntimePaths() {
-  const paths = [dirname15(dirname15(process.execPath))];
+  const paths = [dirname14(dirname14(process.execPath))];
   const root = companionPackageRoot(fileURLToPath7(import.meta.url));
   if (root) paths.push(root);
   try {
     const require2 = createRequire3(import.meta.url);
     paths.push(
-      dirname15(realpathSync7(require2.resolve("@anthropic-ai/sandbox-runtime/package.json")))
+      dirname14(realpathSync7(require2.resolve("@anthropic-ai/sandbox-runtime/package.json")))
     );
   } catch {
   }
@@ -10794,7 +10794,7 @@ function harnessRuntimePaths() {
     const bundled = resolveBundledBinary(runtime).path;
     if (bundled) {
       try {
-        paths.push(dirname15(realpathSync7(bundled)));
+        paths.push(dirname14(realpathSync7(bundled)));
       } catch {
       }
     }
@@ -10805,9 +10805,9 @@ function ownAddresses() {
   return Object.values(networkInterfaces()).flat().flatMap((i) => i ? [i.address] : []);
 }
 function storeWalkRoots(homes, cabaneDir2) {
-  const companionHome = dirname15(cabaneDir2);
-  const parent = dirname15(companionHome);
-  const beside = homes.includes(companionHome) || dirname15(parent) === parent ? [] : [parent];
+  const companionHome = dirname14(cabaneDir2);
+  const parent = dirname14(companionHome);
+  const beside = homes.includes(companionHome) || dirname14(parent) === parent ? [] : [parent];
   const candidates = [.../* @__PURE__ */ new Set([...homes, ...beside])];
   return candidates.filter(
     (root) => !candidates.some((other) => other !== root && isAtOrUnder(root, other))
@@ -10845,19 +10845,19 @@ async function walkCompanionStores(roots, opts = {}) {
 }
 function companionStoreDenies(input) {
   const { homes, cabaneDir: cabaneDir2, foundStores } = input;
-  const parent = dirname15(dirname15(cabaneDir2));
+  const parent = dirname14(dirname14(cabaneDir2));
   const always = [
     cabaneDir2,
     ...homes.flatMap((home) => [
-      join28(home, ".cabane"),
-      join28(home, "*", ".cabane"),
-      join28(home, "*", "*", ".cabane")
+      join29(home, ".cabane"),
+      join29(home, "*", ".cabane"),
+      join29(home, "*", "*", ".cabane")
     ]),
     // A glob anchored at the root has no directory to start from.
-    ...dirname15(parent) === parent ? [] : [join28(parent, "*", ".cabane")]
+    ...dirname14(parent) === parent ? [] : [join29(parent, "*", ".cabane")]
   ];
-  const companionHome = dirname15(cabaneDir2);
-  const otherLogins = foundStores.map((store) => dirname15(store)).filter((home) => home !== companionHome).flatMap((home) => [join28(home, ".claude"), join28(home, ".codex")]).filter((path) => !input.ownState.some((own) => isAtOrUnder(own, path)));
+  const companionHome = dirname14(cabaneDir2);
+  const otherLogins = foundStores.map((store) => dirname14(store)).filter((home) => home !== companionHome).flatMap((home) => [join29(home, ".claude"), join29(home, ".codex")]).filter((path) => !input.ownState.some((own) => isAtOrUnder(own, path)));
   return [.../* @__PURE__ */ new Set([...always, ...foundStores, ...otherLogins])];
 }
 function companionStoreWatch(log2) {
@@ -10874,7 +10874,7 @@ function isAtOrUnder(path, dir2) {
 }
 function expandHome(path, home) {
   if (path === "~") return home;
-  return path.startsWith("~/") ? join28(home, path.slice(2)) : path;
+  return path.startsWith("~/") ? join29(home, path.slice(2)) : path;
 }
 function stripPort(pattern) {
   return pattern.startsWith("[") ? pattern.replace(/^\[([^\]]+)\](:\d+)?$/, "$1") : pattern.replace(/:\d+$/, "");
@@ -10892,8 +10892,8 @@ function patternsOverlap(a, b) {
 }
 function harnessSandboxConfig(input) {
   const { policy } = input;
-  const claudeDir = input.claudeConfigDir ?? join28(input.home, ".claude");
-  const codexDir = input.codexHome ?? join28(input.home, ".codex");
+  const claudeDir = input.claudeConfigDir ?? join29(input.home, ".claude");
+  const codexDir = input.codexHome ?? join29(input.home, ".codex");
   const homes = [.../* @__PURE__ */ new Set([input.home, input.accountHome ?? input.home])];
   const expand = (paths) => (paths ?? []).map((p) => expandHome(p, input.home));
   const cabane2 = cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses);
@@ -10910,7 +10910,7 @@ function harnessSandboxConfig(input) {
       foundStores: input.foundStores,
       ownState: [claudeDir, codexDir]
     }),
-    ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join28(home, p))),
+    ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join29(home, p))),
     ...expand(policy.filesystem?.denyRead)
   ];
   const strict = policy.filesystem?.mode === "strict";
@@ -10918,7 +10918,7 @@ function harnessSandboxConfig(input) {
   const allowRead = strict ? [
     ...input.cwd ? [input.cwd] : [],
     claudeDir,
-    join28(input.home, ".claude.json"),
+    join29(input.home, ".claude.json"),
     codexDir,
     ...input.runtimePaths ?? [],
     ...expand(policy.filesystem?.allowRead)
@@ -10958,7 +10958,7 @@ function harnessSandboxConfig(input) {
         ...input.cwd ? [input.cwd] : [],
         input.tmp,
         claudeDir,
-        join28(input.home, ".claude.json"),
+        join29(input.home, ".claude.json"),
         codexDir,
         ...expand(policy.filesystem?.allowWrite)
       ],
@@ -11060,9 +11060,9 @@ async function prepareHarnessSandbox(input) {
   } finally {
     for (const name of held) delete process.env[name];
   }
-  mkdirSync17(join28(cabaneDir(), "sandbox"), { recursive: true });
-  const dir2 = mkdtempSync(join28(cabaneDir(), "sandbox", "turn-"));
-  const script = join28(dir2, "exec-sandboxed");
+  mkdirSync17(join29(cabaneDir(), "sandbox"), { recursive: true });
+  const dir2 = mkdtempSync(join29(cabaneDir(), "sandbox", "turn-"));
+  const script = join29(dir2, "exec-sandboxed");
   writeFileSync10(
     script,
     [
@@ -11078,7 +11078,7 @@ async function prepareHarnessSandbox(input) {
   return {
     wrap: (command, args) => ({ command: script, args: [command, ...args] }),
     executableFor: (real) => {
-      const shim = join28(dir2, `exec-${++shims}`);
+      const shim = join29(dir2, `exec-${++shims}`);
       writeFileSync10(shim, `#!/bin/bash
 exec ${shellQuote(script)} ${shellQuote(real)} "$@"
 `);
@@ -11166,12 +11166,12 @@ import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync18,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   renameSync as renameSync12,
   rmSync as rmSync15,
   writeFileSync as writeFileSync11
 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 var MAX_ENTRIES, MAX_AGE_MS, Outbox;
 var init_outbox = __esm({
   "src/outbox.ts"() {
@@ -11189,10 +11189,10 @@ var init_outbox = __esm({
       // Resolved lazily (per call) so tests that swap HOME between
       // cases route writes at the right tmpdir.
       dir() {
-        return join29(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
+        return join30(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
       }
       fileFor(turnId, seq) {
-        return join29(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+        return join30(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
       }
       // Persist a commit for later draining. Atomic (temp file + rename) so a
       // concurrent `list()` never reads a half-written entry, then enforces the
@@ -11234,9 +11234,9 @@ var init_outbox = __esm({
         const entries = [];
         for (const name of names) {
           if (!name.endsWith(".json")) continue;
-          const full = join29(dir2, name);
+          const full = join30(dir2, name);
           try {
-            const parsed = JSON.parse(readFileSync16(full, "utf8"));
+            const parsed = JSON.parse(readFileSync17(full, "utf8"));
             if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
               entries.push(parsed);
             } else {
@@ -11363,7 +11363,7 @@ var init_image_manifest = __esm({
 
 // src/runner/exec-shim.ts
 import { chmodSync as chmodSync8, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, rmSync as rmSync17, writeFileSync as writeFileSync13 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -11373,10 +11373,10 @@ function createShimDir() {
   return {
     write(argv) {
       if (!dir2) {
-        mkdirSync20(join33(cabaneDir(), "runner"), { recursive: true });
-        dir2 = mkdtempSync2(join33(cabaneDir(), "runner", "turn-"));
+        mkdirSync20(join34(cabaneDir(), "runner"), { recursive: true });
+        dir2 = mkdtempSync2(join34(cabaneDir(), "runner", "turn-"));
       }
-      const path = join33(dir2, `exec-${++count}`);
+      const path = join34(dir2, `exec-${++count}`);
       writeFileSync13(path, `#!/bin/sh
 exec ${argv.map(shellQuote2).join(" ")} "$@"
 `);
@@ -11486,7 +11486,7 @@ __export(run_turn_exports, {
   runnerLogger: () => runnerLogger,
   stopWithLauncher: () => stopWithLauncher
 });
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import pino2 from "pino";
 async function drainBeforeExit(outbox, api, graceMs = OUTBOX_GRACE_MS, log2) {
   if (outbox.size() === 0) return;
@@ -11595,7 +11595,7 @@ async function stopWithLauncher(groups, deps = {}) {
   process.stdout.on("error", () => {
   });
   const ownGroup = () => {
-    const ps = spawnSync("ps", ["-eo", "pid=,pgid="], { timeout: 5e3 });
+    const ps = spawnSync2("ps", ["-eo", "pid=,pgid="], { timeout: 5e3 });
     if (ps.status !== 0) return null;
     return String(ps.stdout).split("\n").map((line) => /^\s*(\d+)\s+(\d+)\s*$/.exec(line)).filter((m) => m !== null).filter((m) => Number(m[2]) === process.pid).map((m) => Number(m[1])).filter((pid) => pid !== process.pid && pid !== ps.pid);
   };
@@ -13004,6 +13004,96 @@ function plainUi() {
   };
 }
 
+// src/stray-companion.ts
+init_config();
+import { spawnSync } from "child_process";
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join10 } from "path";
+var COMPANION_ENTRY = /@cabane\/companion\/|cabane-companion|(^|[\s/])cabane\s|\.cabane\/(versions|current|boot-guard)/;
+var START = /\sstart(\s|$)/;
+function companionStarts(psOutput) {
+  const found = [];
+  for (const line of psOutput.split("\n")) {
+    const match = /^\s*(\d+)\s+(.*)$/.exec(line);
+    if (!match) continue;
+    const command = match[2];
+    if (COMPANION_ENTRY.test(command) && START.test(command)) {
+      found.push({ pid: Number(match[1]), command });
+    }
+  }
+  return found;
+}
+function stateDirOf(env) {
+  const home = env.CABANE_COMPANION_HOME || env.HOME;
+  return home ? join10(home, ".cabane") : null;
+}
+function envFromPsE(output, command) {
+  const line = output.replace(/\n$/, "");
+  if (!line.startsWith(command)) return {};
+  const env = {};
+  for (const entry of line.slice(command.length).trim().split(/ (?=[A-Za-z_][A-Za-z0-9_]*=)/)) {
+    const eq = entry.indexOf("=");
+    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return env;
+}
+function envFromProc(pid) {
+  try {
+    const env = {};
+    for (const entry of readFileSync4(`/proc/${pid}/environ`, "utf8").split("\0")) {
+      const eq = entry.indexOf("=");
+      if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
+    }
+    return env;
+  } catch {
+    return null;
+  }
+}
+function envOf(pid, command) {
+  if (process.platform === "linux") return envFromProc(pid);
+  const result = spawnSync("ps", ["-E", "-ww", "-o", "command=", "-p", String(pid)], {
+    encoding: "utf8",
+    timeout: 5e3
+  });
+  if (result.error || result.status !== 0) return null;
+  return envFromPsE(result.stdout, command);
+}
+function findStrayCompanions(exclude = [], deps = {}) {
+  if (!deps.ps && (process.platform === "win32" || typeof process.getuid !== "function")) {
+    return [];
+  }
+  const ps = deps.ps ?? (() => {
+    const result = spawnSync("ps", ["-U", String(process.getuid()), "-o", "pid=,command="], {
+      encoding: "utf8",
+      timeout: 5e3,
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return result.error || typeof result.stdout !== "string" ? null : result.stdout;
+  });
+  const listing = ps();
+  if (!listing) return [];
+  const dir2 = deps.dir ?? cabaneDir();
+  const skip = /* @__PURE__ */ new Set([...deps.self ?? [process.pid, process.ppid], ...exclude]);
+  return companionStarts(listing).filter((c) => {
+    if (skip.has(c.pid)) return false;
+    const env = (deps.env ?? envOf)(c.pid, c.command);
+    return env !== null && stateDirOf(env) === dir2;
+  });
+}
+var SERVICE_ENTRY = /\.cabane\/boot-guard/;
+function strayCompanionLines(strays, retry) {
+  const one = strays.length === 1;
+  return [
+    `Another Cabane companion is running for this computer's ~/.cabane, and ~/.cabane has no record of it:`,
+    ...strays.map((s) => `  pid ${s.pid}  ${s.command}`),
+    `Two companions for one ~/.cabane sign each other's agents out. Stop ${one ? "it" : "them"} first:`,
+    ...strays.map(
+      (s) => SERVICE_ENTRY.test(s.command) ? `  pid ${s.pid} is a service, which restarts if killed:  cabane service uninstall` : `  kill ${s.pid}`
+    ),
+    `then run  ${retry}  again.`
+  ];
+}
+
 // src/service.ts
 init_config();
 import { createHash as createHash2 } from "crypto";
@@ -13012,13 +13102,13 @@ import {
   cpSync,
   existsSync as existsSync8,
   mkdirSync as mkdirSync9,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   renameSync as renameSync7,
   rmSync as rmSync7,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir as homedir7, userInfo as userInfo2 } from "os";
-import { dirname as dirname10, join as join14, sep as sep3 } from "path";
+import { dirname as dirname10, join as join15, sep as sep3 } from "path";
 
 // src/install-layout.ts
 init_config();
@@ -13026,39 +13116,39 @@ import {
   existsSync as existsSync6,
   lstatSync,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   readdirSync,
   realpathSync as realpathSync4,
   renameSync as renameSync3,
   rmSync as rmSync4,
   symlinkSync
 } from "fs";
-import { dirname as dirname6, join as join10 } from "path";
+import { dirname as dirname6, join as join11 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function versionsDir() {
-  return join10(cabaneDir(), "versions");
+  return join11(cabaneDir(), "versions");
 }
 function currentLink() {
-  return join10(cabaneDir(), "current");
+  return join11(cabaneDir(), "current");
 }
 function bootGuardPath() {
-  return join10(cabaneDir(), "boot-guard.mjs");
+  return join11(cabaneDir(), "boot-guard.mjs");
 }
 function pinnedNodeDir() {
-  return join10(cabaneDir(), "node");
+  return join11(cabaneDir(), "node");
 }
 function pinnedNodePath() {
-  return join10(pinnedNodeDir(), "bin", "node");
+  return join11(pinnedNodeDir(), "bin", "node");
 }
 function versionPackageRoot(version) {
-  return join10(versionsDir(), version, "node_modules", "@cabane", "companion");
+  return join11(versionsDir(), version, "node_modules", "@cabane", "companion");
 }
 function ownPackageRoot(moduleUrl = import.meta.url) {
   return dirname6(dirname6(fileURLToPath4(moduleUrl)));
 }
 function packageVersion(root) {
   try {
-    const pkg2 = JSON.parse(readFileSync4(join10(root, "package.json"), "utf8"));
+    const pkg2 = JSON.parse(readFileSync5(join11(root, "package.json"), "utf8"));
     return typeof pkg2.version === "string" ? pkg2.version : null;
   } catch {
     return null;
@@ -13067,7 +13157,7 @@ function packageVersion(root) {
 function currentRoot() {
   try {
     const root = realpathSync4(currentLink());
-    return existsSync6(join10(root, "dist", "cli.js")) ? root : null;
+    return existsSync6(join11(root, "dist", "cli.js")) ? root : null;
   } catch {
     return null;
   }
@@ -13090,7 +13180,7 @@ function pruneVersions(keep) {
   const removed = [];
   for (const name of readdirSync(dir2)) {
     if (keep.includes(name)) continue;
-    rmSync4(join10(dir2, name), { recursive: true, force: true });
+    rmSync4(join11(dir2, name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -13110,19 +13200,19 @@ function compareVersions(a, b) {
 // src/updater.ts
 import { spawn as spawn4 } from "child_process";
 import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync8, renameSync as renameSync6, rmSync as rmSync6 } from "fs";
-import { dirname as dirname9, join as join13 } from "path";
+import { dirname as dirname9, join as join14 } from "path";
 
 // src/boot-rule.ts
 import {
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   realpathSync as realpathSync5,
   renameSync as renameSync4,
   rmSync as rmSync5,
   symlinkSync as symlinkSync2,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname7, join as join11 } from "path";
+import { dirname as dirname7, join as join12 } from "path";
 var UNCONFIRMED_WINDOW_MS = 10 * 6e4;
 var MAX_STAGE_ATTEMPTS = 3;
 function superseded(pending, ...running) {
@@ -13145,8 +13235,8 @@ function rolledBackState(state, pending, reason, now) {
 
 // src/update-state.ts
 init_config();
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, renameSync as renameSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname8, join as join12 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, renameSync as renameSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname8, join as join13 } from "path";
 import { z as z3 } from "zod";
 var resultSchema = z3.object({
   kind: z3.enum(["updated", "rolled_back", "failed"]),
@@ -13170,11 +13260,11 @@ var stateSchema = z3.object({
   failed: z3.object({ version: z3.string(), attempts: z3.number().int(), at: z3.string() }).optional()
 });
 function updateStatePath(dir2 = cabaneDir()) {
-  return join12(dir2, "update.json");
+  return join13(dir2, "update.json");
 }
 function readUpdateState(path = updateStatePath()) {
   try {
-    const parsed = stateSchema.safeParse(JSON.parse(readFileSync6(path, "utf8")));
+    const parsed = stateSchema.safeParse(JSON.parse(readFileSync7(path, "utf8")));
     return parsed.success ? parsed.data : {};
   } catch {
     return {};
@@ -13219,7 +13309,7 @@ function rollBack(pending, reason, now = /* @__PURE__ */ new Date()) {
   return updateUpdateState((state) => rolledBackState(state, pending, reason, now));
 }
 function writeBootGuard(root = ownPackageRoot()) {
-  const built = join13(root, "dist", "boot-guard.js");
+  const built = join14(root, "dist", "boot-guard.js");
   if (!existsSync7(built)) return false;
   const target = bootGuardPath();
   mkdirSync8(dirname9(target), { recursive: true });
@@ -13259,17 +13349,17 @@ var runProcess = (command, args, opts = {}) => new Promise((resolve2) => {
 async function stageVersion(version, harnesses, deps = {}) {
   const run = deps.run ?? runProcess;
   const node = deps.execPath ?? process.execPath;
-  const target = join13(versionsDir(), version);
+  const target = join14(versionsDir(), version);
   const placed = versionPackageRoot(version);
   if (existsSync7(placed)) {
     if (!await verifyInstall(placed, version, harnesses, { run, execPath: node }))
       return { ok: true, root: placed };
   }
-  const npm = join13(dirname9(node), "npm");
+  const npm = join14(dirname9(node), "npm");
   if (!existsSync7(npm))
     return { ok: false, reason: `there is no npm beside Node at ${dirname9(node)}` };
   mkdirSync8(versionsDir(), { recursive: true });
-  const staging = join13(versionsDir(), `.${version}.staging-${process.pid}`);
+  const staging = join14(versionsDir(), `.${version}.staging-${process.pid}`);
   rmSync6(staging, { recursive: true, force: true });
   const installed = await run(
     npm,
@@ -13298,7 +13388,7 @@ async function stageVersion(version, harnesses, deps = {}) {
       return { ok: false, reason: `version ${version} isn't published yet`, unpublished: true };
     return { ok: false, reason: `npm couldn't install it: ${lastLine(installed.stderr)}` };
   }
-  const root = join13(staging, "node_modules", "@cabane", "companion");
+  const root = join14(staging, "node_modules", "@cabane", "companion");
   const verdict = await verifyInstall(root, version, harnesses, { run, execPath: node });
   if (verdict) {
     rmSync6(staging, { recursive: true, force: true });
@@ -13310,7 +13400,7 @@ async function stageVersion(version, harnesses, deps = {}) {
 }
 async function verifyInstall(root, version, harnesses, deps) {
   if (packageVersion(root) !== version) return `the installed package isn't version ${version}`;
-  const answered = await deps.run(deps.execPath, [join13(root, "dist", "bin.js"), "--version"], {
+  const answered = await deps.run(deps.execPath, [join14(root, "dist", "bin.js"), "--version"], {
     timeoutMs: 6e4,
     env: { ...process.env, CABANE_LAUNCH_SELF: "1" }
   });
@@ -13318,7 +13408,7 @@ async function verifyInstall(root, version, harnesses, deps) {
     return `it doesn't start: ${lastLine(answered.stderr) || "no version printed"}`;
   }
   if (harnesses.length === 0) return null;
-  const probed = await deps.run(deps.execPath, [join13(root, "dist", "postinstall.js"), "--json"], {
+  const probed = await deps.run(deps.execPath, [join14(root, "dist", "postinstall.js"), "--json"], {
     timeoutMs: 6e4
   });
   let resolutions = {};
@@ -13606,15 +13696,15 @@ function serviceNode(execPath = process.execPath) {
   return existsSync8(pinnedNodePath()) ? pinnedNodePath() : execPath;
 }
 function servicePaths(platform, env = process.env, home = homedir7(), node = serviceNode()) {
-  const unitFile = platform === "systemd" ? join14(
-    env.XDG_CONFIG_HOME || join14(home, ".config"),
+  const unitFile = platform === "systemd" ? join15(
+    env.XDG_CONFIG_HOME || join15(home, ".config"),
     "systemd",
     "user",
     `${serviceName(env)}.service`
-  ) : join14(home, "Library", "LaunchAgents", `${launchdLabel(env)}.plist`);
+  ) : join15(home, "Library", "LaunchAgents", `${launchdLabel(env)}.plist`);
   return {
     unitFile,
-    envFile: join14(cabaneDir(), "service.env"),
+    envFile: join15(cabaneDir(), "service.env"),
     node,
     entry: bootGuardPath()
   };
@@ -13681,7 +13771,7 @@ function renderLaunchdPlist(paths, env = process.env, servicePath) {
     "  <key>ThrottleInterval</key><integer>5</integer>",
     // The companion writes its own log; the console copy would only grow a second one.
     "  <key>StandardOutPath</key><string>/dev/null</string>",
-    `  <key>StandardErrorPath</key><string>${xml(join14(cabaneDir(), "service-error.log"))}</string>`,
+    `  <key>StandardErrorPath</key><string>${xml(join15(cabaneDir(), "service-error.log"))}</string>`,
     "</dict>",
     "</plist>",
     ""
@@ -13737,7 +13827,7 @@ async function installService(deps = {}) {
   const paths = servicePaths(platform, env, deps.home, node);
   const servicePath = await loginShellPath(run, env);
   mkdirSync9(dirname10(paths.envFile), { recursive: true });
-  const existing = existsSync8(paths.envFile) ? readFileSync7(paths.envFile, "utf8") : "";
+  const existing = existsSync8(paths.envFile) ? readFileSync8(paths.envFile, "utf8") : "";
   writeFileSync5(paths.envFile, withServicePath(existing, servicePath), { mode: 384 });
   chmodSync3(paths.envFile, 384);
   mkdirSync9(dirname10(paths.unitFile), { recursive: true });
@@ -13821,15 +13911,15 @@ async function seedManagedInstall(deps) {
   }
   const target = versionPackageRoot(version);
   if (!existsSync8(target)) {
-    const staging = join14(versionsDir(), `.${version}.seed-${process.pid}`);
+    const staging = join15(versionsDir(), `.${version}.seed-${process.pid}`);
     rmSync7(staging, { recursive: true, force: true });
     try {
-      cpSync(own, join14(staging, "node_modules", "@cabane", "companion"), {
+      cpSync(own, join15(staging, "node_modules", "@cabane", "companion"), {
         recursive: true,
         verbatimSymlinks: true
       });
-      rmSync7(join14(versionsDir(), version), { recursive: true, force: true });
-      renameSync7(staging, join14(versionsDir(), version));
+      rmSync7(join15(versionsDir(), version), { recursive: true, force: true });
+      renameSync7(staging, join15(versionsDir(), version));
     } catch (err) {
       rmSync7(staging, { recursive: true, force: true });
       return {
@@ -13840,7 +13930,7 @@ async function seedManagedInstall(deps) {
   }
   const unrunnable = await verifyInstall(target, version, [], deps);
   if (unrunnable) {
-    rmSync7(join14(versionsDir(), version), { recursive: true, force: true });
+    rmSync7(join15(versionsDir(), version), { recursive: true, force: true });
     return { ok: false, reason: `The copy of Cabane for the service can't run: ${unrunnable}.` };
   }
   pointCurrentAt(target);
@@ -13852,7 +13942,7 @@ function tildeDir() {
 function unitNode(platform, unitFile) {
   let text;
   try {
-    text = readFileSync7(unitFile, "utf8");
+    text = readFileSync8(unitFile, "utf8");
   } catch {
     return null;
   }
@@ -13922,12 +14012,12 @@ function userName() {
     return process.env.USER ?? "";
   }
 }
-function rewriteScriptWrappers(dir2 = join14(cabaneDir(), "bin")) {
+function rewriteScriptWrappers(dir2 = join15(cabaneDir(), "bin")) {
   for (const name of ["cabane", "cabane-companion"]) {
-    const path = join14(dir2, name);
+    const path = join15(dir2, name);
     let text;
     try {
-      text = readFileSync7(path, "utf8");
+      text = readFileSync8(path, "utf8");
     } catch {
       continue;
     }
@@ -14339,6 +14429,12 @@ async function setupScript(opts, deps) {
     ui.outro(["Nothing left to set up."]);
     return;
   }
+  const strays = (deps.strays ?? findStrayCompanions)(running ? [running.pid] : []);
+  if (strays.length > 0) {
+    ui.cancel(strayCompanionLines(strays, cabane("setup")).join("\n"));
+    process.exitCode = 1;
+    return;
+  }
   let justPaired = false;
   if (!paired) {
     const device = await (deps.pair ?? pairDevice)({
@@ -14497,41 +14593,52 @@ import {
   chmodSync as chmodSync4,
   existsSync as existsSync9,
   mkdirSync as mkdirSync11,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   renameSync as renameSync8,
   rmSync as rmSync8,
   writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname11, join as join15 } from "path";
+import { join as join16 } from "path";
 import { z as z4 } from "zod";
-function credentialsPath() {
-  return join15(cabaneDir(), "credentials.json");
+var credentialMapSchema = z4.record(z4.string(), z4.string());
+function credentialsDir() {
+  return join16(cabaneDir(), "credentials");
+}
+function legacyPath() {
+  return join16(cabaneDir(), "credentials.json");
 }
-var credentialStoreSchema = z4.record(z4.string(), z4.string());
-function load() {
-  const path = credentialsPath();
-  if (!existsSync9(path)) return {};
+function devicePath(deviceId) {
+  return join16(credentialsDir(), `${deviceId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+}
+function read(path) {
+  if (!existsSync9(path)) return null;
   let raw;
   try {
-    raw = readFileSync8(path, "utf8");
+    raw = readFileSync9(path, "utf8");
   } catch {
     return {};
   }
   if (raw.trim().length === 0) return {};
   try {
-    const result = credentialStoreSchema.safeParse(JSON.parse(raw));
+    const result = credentialMapSchema.safeParse(JSON.parse(raw));
     return result.success ? result.data : {};
   } catch {
     return {};
   }
 }
-function save(map) {
-  const path = credentialsPath();
-  mkdirSync11(dirname11(path), { recursive: true });
-  try {
-    chmodSync4(cabaneDir(), 448);
-  } catch {
+function load(deviceId) {
+  return read(devicePath(deviceId)) ?? read(legacyPath()) ?? {};
+}
+function save(deviceId, map) {
+  const dir2 = credentialsDir();
+  mkdirSync11(dir2, { recursive: true });
+  for (const d of [cabaneDir(), dir2]) {
+    try {
+      chmodSync4(d, 448);
+    } catch {
+    }
   }
+  const path = devicePath(deviceId);
   const tmp = `${path}.${process.pid}.tmp`;
   try {
     writeFileSync6(tmp, JSON.stringify(map, null, 2) + "\n", { mode: 384 });
@@ -14548,31 +14655,28 @@ function save(map) {
     throw err;
   }
 }
-function getCredential(agentId) {
-  return load()[agentId] ?? null;
+function getCredential(deviceId, agentId) {
+  return load(deviceId)[agentId] ?? null;
 }
-function setCredential(agentId, pat) {
-  const map = load();
-  if (map[agentId] === pat) return;
+function setCredential(deviceId, agentId, pat) {
+  if (read(devicePath(deviceId))?.[agentId] === pat) return;
+  const map = load(deviceId);
   map[agentId] = pat;
-  save(map);
+  save(deviceId, map);
 }
-function pruneCredentials(keepAgentIds) {
-  const map = load();
+function pruneCredentials(deviceId, keepAgentIds) {
   const keep = new Set(keepAgentIds);
-  let removed = 0;
-  for (const id of Object.keys(map)) {
-    if (!keep.has(id)) {
-      delete map[id];
-      removed += 1;
-    }
-  }
-  if (removed > 0) save(map);
+  if (keep.size === 0) return [];
+  const own = read(devicePath(deviceId));
+  const map = own ?? load(deviceId);
+  const removed = Object.keys(map).filter((id) => !keep.has(id));
+  for (const id of removed) delete map[id];
+  if (removed.length > 0 || own === null) save(deviceId, map);
   return removed;
 }
 function clearCredentials() {
-  const path = credentialsPath();
-  if (existsSync9(path)) writeFileSync6(path, "", { mode: 384 });
+  rmSync8(credentialsDir(), { recursive: true, force: true });
+  if (existsSync9(legacyPath())) writeFileSync6(legacyPath(), "", { mode: 384 });
 }
 
 // src/commands/logout.ts
@@ -14628,7 +14732,7 @@ function writeCompletedPairing(raw) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync19 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 
 // src/commands/logs.ts
 init_cabane_command();
@@ -14720,7 +14824,7 @@ import { randomUUID as randomUUID7 } from "crypto";
 
 // src/dashboard/server.ts
 init_errors();
-import { dirname as dirname12, join as join17 } from "path";
+import { dirname as dirname11, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
@@ -14728,7 +14832,7 @@ import { Hono } from "hono";
 // src/dashboard/routes.ts
 import { openSync as openSync4, readSync, closeSync as closeSync3, fstatSync, existsSync as existsSync10 } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join16, normalize } from "path";
+import { extname, join as join17, normalize } from "path";
 import { streamSSE } from "hono/streaming";
 
 // src/state.ts
@@ -14977,13 +15081,13 @@ var CONTENT_TYPES = {
 function registerRoutes(app, deps) {
   const { supervisor, hub, staticDir } = deps;
   app.get("/", async (c) => {
-    const html = await readFile(join16(staticDir, "index.html"), "utf8");
+    const html = await readFile(join17(staticDir, "index.html"), "utf8");
     return c.html(html);
   });
   app.get("/static/:file", async (c) => {
     const file = c.req.param("file");
     const safe2 = normalize(file).replace(/^(\.\.[/\\])+/, "");
-    const full = join16(staticDir, safe2);
+    const full = join17(staticDir, safe2);
     if (!full.startsWith(staticDir) || !existsSync10(full)) return c.notFound();
     const body = await readFile(full);
     const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
@@ -15174,7 +15278,7 @@ function isAddrInUse(err) {
   return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
 }
 function resolveStaticDir() {
-  return join17(dirname12(fileURLToPath5(import.meta.url)), "static");
+  return join18(dirname11(fileURLToPath5(import.meta.url)), "static");
 }
 
 // src/supervisor.ts
@@ -15341,20 +15445,20 @@ init_config();
 
 // src/dispatch-dedupe.ts
 init_config();
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync9, writeFileSync as writeFileSync7, renameSync as renameSync9, existsSync as existsSync11 } from "fs";
-import { join as join18 } from "path";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync7, renameSync as renameSync9, existsSync as existsSync11 } from "fs";
+import { join as join19 } from "path";
 var MAX_IDS = 256;
 function dir(log2) {
-  return join18(cabaneDir(), log2);
+  return join19(cabaneDir(), log2);
 }
 function pathFor(log2, workspaceId) {
-  return join18(dir(log2), encodeURIComponent(workspaceId));
+  return join19(dir(log2), encodeURIComponent(workspaceId));
 }
 function readIds(log2, workspaceId) {
   const path = pathFor(log2, workspaceId);
   if (!existsSync11(path)) return [];
   try {
-    return readFileSync9(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+    return readFileSync10(path, "utf8").split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   } catch {
     return [];
   }
@@ -15385,17 +15489,17 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join18(cabaneDir(), "resume-attempts");
+  return join19(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join18(resumeDir(), encodeURIComponent(workspaceId));
+  return join19(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
   const path = resumePathFor(workspaceId);
   if (!existsSync11(path)) return out;
   try {
-    for (const line of readFileSync9(path, "utf8").split("\n")) {
+    for (const line of readFileSync10(path, "utf8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       const tab = trimmed.lastIndexOf("	");
@@ -15424,10 +15528,10 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join18(cabaneDir(), "turns");
+  return join19(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join18(turnDir(), encodeURIComponent(workspaceId));
+  return join19(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
@@ -15435,7 +15539,7 @@ function readTurnIds(workspaceId) {
   const path = turnPathFor(workspaceId);
   if (!existsSync11(path)) return out;
   try {
-    for (const line of readFileSync9(path, "utf8").split("\n")) {
+    for (const line of readFileSync10(path, "utf8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       const tab = trimmed.lastIndexOf("	");
@@ -15655,13 +15759,13 @@ import {
   existsSync as existsSync18,
   mkdirSync as mkdirSync16,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   renameSync as renameSync11,
   rmSync as rmSync13,
   statSync as statSync4,
   writeFileSync as writeFileSync9
 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 import { Writable } from "stream";
 
 // src/providers/docker-cli.ts
@@ -15730,11 +15834,11 @@ import {
   existsSync as existsSync16,
   mkdirSync as mkdirSync15,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   renameSync as renameSync10,
   rmSync as rmSync12
 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function routes(t) {
   const conv = `/api/workspaces/${t.workspaceId}/conversations/${t.conversationId}`;
   const agent = `${conv}/participants/agents/${t.agentId}`;
@@ -15780,7 +15884,7 @@ function publishStaged(from, to, move = atomicMove) {
   const staged = readdirSync4(from).filter((n) => n.endsWith(".json")).map((name) => {
     let entry = {};
     try {
-      entry = JSON.parse(readFileSync13(join25(from, name), "utf8"));
+      entry = JSON.parse(readFileSync14(join26(from, name), "utf8"));
     } catch {
     }
     return { name, entry };
@@ -15793,7 +15897,7 @@ function publishStaged(from, to, move = atomicMove) {
   let published = 0;
   for (const { name } of staged) {
     try {
-      move(join25(from, name), join25(to, name));
+      move(join26(from, name), join26(to, name));
     } catch {
       return { published, complete: false };
     }
@@ -15806,7 +15910,7 @@ function publishStaged(from, to, move = atomicMove) {
 // src/providers/runner-base.ts
 import { createHash as createHash4 } from "crypto";
 import { existsSync as existsSync17, realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname14, join as join26, sep as sep4 } from "path";
+import { dirname as dirname13, join as join27, sep as sep4 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var COMPANION_MOUNT = "/opt/cabane/companion";
 var BASE_DOCKERFILE = `FROM node:22-slim
@@ -15852,13 +15956,13 @@ async function ensureBaseImage(docker, image, log2) {
   return true;
 }
 function ownInstall(moduleFile = fileURLToPath6(import.meta.url)) {
-  let dir2 = dirname14(moduleFile);
+  let dir2 = dirname13(moduleFile);
   for (let i = 0; i < 4; i++) {
-    if (existsSync17(join26(dir2, "dist", "cli.js")) && existsSync17(join26(dir2, "package.json"))) break;
-    dir2 = dirname14(dir2);
+    if (existsSync17(join27(dir2, "dist", "cli.js")) && existsSync17(join27(dir2, "package.json"))) break;
+    dir2 = dirname13(dir2);
   }
-  if (!existsSync17(join26(dir2, "dist", "cli.js"))) return null;
-  const sdk = join26(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
+  if (!existsSync17(join27(dir2, "dist", "cli.js"))) return null;
+  const sdk = join27(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
   if (!existsSync17(sdk)) return null;
   const root = realpathSync6(dir2);
   return realpathSync6(sdk).startsWith(root + sep4) ? root : null;
@@ -15997,39 +16101,39 @@ function networkCreateError(stderr) {
 }
 function sessionArchivePath(deviceDir, attemptId) {
   if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
-  return join27(deviceDir, "attempts", attemptId, "session.tar");
+  return join28(deviceDir, "attempts", attemptId, "session.tar");
 }
 function pruneOtherAttempts(deviceDir, pair2, keep) {
-  const root = join27(deviceDir, "attempts");
+  const root = join28(deviceDir, "attempts");
   if (!existsSync18(root)) return;
   for (const id of readdirSync5(root)) {
     if (id === keep || !UUID_RE.test(id)) continue;
     let pairOf = "";
     try {
-      pairOf = readFileSync14(join27(root, id, "pair"), "utf8");
+      pairOf = readFileSync15(join28(root, id, "pair"), "utf8");
     } catch {
       continue;
     }
     if (pairOf === `${pair2.conversationId}/${pair2.agentId}`) {
-      rmSync13(join27(root, id), { recursive: true, force: true });
+      rmSync13(join28(root, id), { recursive: true, force: true });
     }
   }
 }
 var IDLE_SESSION_ARCHIVE_MS = 30 * 24 * 60 * 6e4;
 function pruneIdleSessionArchives(deviceDir, now = Date.now(), maxAgeMs = IDLE_SESSION_ARCHIVE_MS) {
-  const root = join27(deviceDir, "attempts");
+  const root = join28(deviceDir, "attempts");
   if (!existsSync18(root)) return [];
   const removed = [];
   for (const id of readdirSync5(root)) {
     if (!UUID_RE.test(id)) continue;
     let kept;
     try {
-      kept = statSync4(join27(root, id)).mtimeMs;
+      kept = statSync4(join28(root, id)).mtimeMs;
     } catch {
       continue;
     }
     if (now - kept < maxAgeMs) continue;
-    rmSync13(join27(root, id), { recursive: true, force: true });
+    rmSync13(join28(root, id), { recursive: true, force: true });
     removed.push(id);
   }
   return removed;
@@ -16230,11 +16334,11 @@ function createDockerProvider(opts) {
       await must(["network", "disconnect", "-f", other, name], "moving the container");
     if (others.includes(sharedNetwork)) await retireSharedNetwork();
   };
-  const socketRoot = opts.socketRoot ?? join27(
+  const socketRoot = opts.socketRoot ?? join28(
     process.env.XDG_RUNTIME_DIR && existsSync18(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir3(),
     `cabane-runners-${opts.deviceKey}`
   );
-  const socketDir = (name) => join27(socketRoot, createHash5("sha256").update(name).digest("hex").slice(0, 12));
+  const socketDir = (name) => join28(socketRoot, createHash5("sha256").update(name).digest("hex").slice(0, 12));
   const create = async (name, attempt) => {
     mkdirSync16(socketRoot, { recursive: true, mode: 448 });
     mkdirSync16(socketDir(name), { recursive: true, mode: 457 });
@@ -16376,10 +16480,10 @@ function createDockerProvider(opts) {
     }
   };
   const removeIn = (name, from, names) => names.length ? execIn(name, ["sh", "-c", 'cd "$1" && shift && rm -f -- "$@"', "sh", from, ...names]) : Promise.resolve(null);
-  const pendingPath = (name) => join27(opts.deviceDir, "runners-pending", `${name}.json`);
+  const pendingPath = (name) => join28(opts.deviceDir, "runners-pending", `${name}.json`);
   const readPending = (name) => {
     try {
-      const ids = JSON.parse(readFileSync14(pendingPath(name), "utf8"));
+      const ids = JSON.parse(readFileSync15(pendingPath(name), "utf8"));
       return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
     } catch {
       return [];
@@ -16390,12 +16494,12 @@ function createDockerProvider(opts) {
       rmSync13(pendingPath(name), { force: true });
       return;
     }
-    mkdirSync16(join27(opts.deviceDir, "runners-pending"), { recursive: true });
+    mkdirSync16(join28(opts.deviceDir, "runners-pending"), { recursive: true });
     writeFileSync9(pendingPath(name), JSON.stringify([...new Set(ids)]));
   };
   const keepSession = async (name, attempt, attemptId) => {
     const archive = sessionArchivePath(opts.deviceDir, attemptId);
-    mkdirSync16(join27(archive, ".."), { recursive: true });
+    mkdirSync16(join28(archive, ".."), { recursive: true });
     const partial = `${archive}.${process.pid}.partial`;
     const file = new CappedFile(partial, sessionCap);
     const r = await execIn(
@@ -16412,7 +16516,7 @@ function createDockerProvider(opts) {
     );
     if (r.code === 0 && !file.over) {
       renameSync11(partial, archive);
-      writeFileSync9(join27(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
+      writeFileSync9(join28(archive, "..", "pair"), `${attempt.conversationId}/${attempt.agentId}`);
       pruneOtherAttempts(opts.deviceDir, attempt, attemptId);
       await writeMarker(name, attemptId);
       log2.debug({ container: name, attemptId, bytes: file.bytes }, "runners: session files kept");
@@ -16426,7 +16530,7 @@ function createDockerProvider(opts) {
       file.over ? "runners: the session files are over the size cap and weren't kept; the next new container starts the session over" : "runners: couldn't keep the session files; the next new container starts the session over"
     );
   };
-  const stagingDir = (name) => join27(opts.deviceDir, "runners-pending", `${name}.outbox`);
+  const stagingDir = (name) => join28(opts.deviceDir, "runners-pending", `${name}.outbox`);
   const ensureRunning = async (name) => {
     const seen = await docker.run(["inspect", "-f", "{{.State.Running}}", name]);
     if (seen.code !== 0) return false;
@@ -16434,7 +16538,7 @@ function createDockerProvider(opts) {
     return (await docker.run(["start", name])).code === 0;
   };
   const dropArchive = (attemptId) => {
-    rmSync13(join27(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
+    rmSync13(join28(sessionArchivePath(opts.deviceDir, attemptId), ".."), {
       recursive: true,
       force: true
     });
@@ -16503,7 +16607,7 @@ function createDockerProvider(opts) {
         if (seen.stdout.trim().split(" ")[0] !== "true")
           await must(["start", name], "starting the container");
         const git = await serveGitCredentials({
-          socketPath: join27(socketDir(name), "git.sock"),
+          socketPath: join28(socketDir(name), "git.sock"),
           hosts: opts.gitHosts,
           fill: opts.gitFill,
           log: log2
@@ -16652,15 +16756,15 @@ function createDockerProvider(opts) {
       const transcripts = await readDir(name, `${CONTAINER_STATE}/transcripts`);
       if (transcripts) {
         const kept = transcripts.files.filter((f) => SAFE_NAME_RE.test(f.name));
-        if (kept.length) mkdirSync16(join27(opts.hostStateDir, "transcripts"), { recursive: true });
-        for (const f of kept) writeFileSync9(join27(opts.hostStateDir, "transcripts", f.name), f.data);
+        if (kept.length) mkdirSync16(join28(opts.hostStateDir, "transcripts"), { recursive: true });
+        for (const f of kept) writeFileSync9(join28(opts.hostStateDir, "transcripts", f.name), f.data);
         await removeIn(
           name,
           `${CONTAINER_STATE}/transcripts`,
           kept.map((f) => f.name)
         );
       }
-      const outboxRel = join27("outbox", encodeURIComponent(attempt.agentId));
+      const outboxRel = join28("outbox", encodeURIComponent(attempt.agentId));
       const outbox = await readDir(name, `${CONTAINER_STATE}/${outboxRel}`);
       let unpublished = false;
       if (outbox) {
@@ -16686,7 +16790,7 @@ function createDockerProvider(opts) {
           const staged = stagingDir(name);
           mkdirSync16(staged, { recursive: true });
           writeFileSync9(
-            join27(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
+            join28(staged, `${encodeURIComponent(entry.turnId)}__${entry.seq}.json`),
             `${JSON.stringify(entry)}
 `
           );
@@ -16699,7 +16803,7 @@ function createDockerProvider(opts) {
         if (outbox.complete) {
           const published = publishStaged(
             stagingDir(name),
-            join27(opts.hostStateDir, outboxRel),
+            join28(opts.hostStateDir, outboxRel),
             opts.moveFile
           );
           queued = published.published;
@@ -17500,7 +17604,7 @@ var CompanionSupervisor = class {
           saveConfig(this.config);
         }
         for (const it of items) {
-          if (it.credential) setCredential(it.agentId, it.credential);
+          if (it.credential) setCredential(device.id, it.agentId, it.credential);
         }
         const byWorkspace = /* @__PURE__ */ new Map();
         for (const it of items) {
@@ -17511,8 +17615,17 @@ var CompanionSupervisor = class {
         for (const wsId of [...this.workspaces.keys()]) {
           if (!byWorkspace.has(wsId)) await this.removeWorkspace(wsId);
         }
-        for (const [wsId, list] of byWorkspace) this.reconcileWorkspace(wsId, list);
-        pruneCredentials(items.map((i) => i.agentId));
+        for (const [wsId, list] of byWorkspace) this.reconcileWorkspace(device.id, wsId, list);
+        const pruned = pruneCredentials(
+          device.id,
+          items.map((i) => i.agentId)
+        );
+        if (pruned.length > 0) {
+          this.log.info(
+            { deviceId: device.id, agentIds: pruned },
+            `Removed the saved sign-in of ${pruned.length === 1 ? "agent" : "agents"} ${pruned.join(", ")}: no longer assigned to this device (${device.id}).`
+          );
+        }
         void this.recoverRuns();
       } finally {
         this.refreshing = false;
@@ -17526,7 +17639,7 @@ var CompanionSupervisor = class {
     }
   }
   // ---- reconciliation ----
-  reconcileWorkspace(workspaceId, list) {
+  reconcileWorkspace(deviceId, workspaceId, list) {
     const first = list[0];
     let wr = this.workspaces.get(workspaceId);
     if (!wr) {
@@ -17552,7 +17665,7 @@ var CompanionSupervisor = class {
       if (!desired.has(agentId)) this.removeAgent(wr, agentId);
     }
     for (const it of list) {
-      const credential = it.credential ?? getCredential(it.agentId);
+      const credential = it.credential ?? getCredential(deviceId, it.agentId);
       const runConfig = parseRunConfig(
         it.runConfig,
         (m) => this.log.warn(
@@ -18619,10 +18732,10 @@ function handleUncaught(log2, err, origin) {
 
 // src/crash-marker.ts
 init_config();
-import { existsSync as existsSync20, mkdirSync as mkdirSync19, readFileSync as readFileSync17, rmSync as rmSync16, writeFileSync as writeFileSync12 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync19, readFileSync as readFileSync18, rmSync as rmSync16, writeFileSync as writeFileSync12 } from "fs";
+import { join as join31 } from "path";
 function crashMarkerPath() {
-  return join30(cabaneDir(), "last-error.json");
+  return join31(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
@@ -18665,6 +18778,8 @@ async function createCompanionRuntime(opts = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();
+  const strays = findStrayCompanions(pre ? [pre.pid] : []);
+  if (strays.length > 0) return { ok: false, reason: "stray-companion", strays };
   const claim = acquireRuntimeState({
     pid: process.pid,
     startedAt,
@@ -18844,6 +18959,11 @@ async function startSupervised(opts, interactive, daemon) {
   if (daemon) write(`Running in the background (pid ${process.pid}). Stop with ${cabane("stop")}.`);
   else blank();
   if (!isDevicePaired()) {
+    const strays = findStrayCompanions();
+    if (strays.length > 0) {
+      refuse(strayCompanionLines(strays, cabane("start")));
+      return;
+    }
     const paired = await pairDevice({
       baseUrl: resolvePairBaseUrl(opts.server),
       interactive,
@@ -18879,6 +18999,10 @@ async function bringUp2() {
     // the middle of it would be the same news, worse.
     onReadinessWarning: (message2) => log2.warn(message2)
   });
+  if (!result.ok && result.reason === "stray-companion") {
+    refuse(strayCompanionLines(result.strays, cabane("start")));
+    return null;
+  }
   if (!result.ok) {
     for (const line of alreadyRunningLines(result.existing?.pid)) write(`${INDENT}${line}`);
     return null;
@@ -18925,7 +19049,7 @@ init_install_kind();
 init_cabane_command();
 import { readdirSync as readdirSync7, realpathSync as realpathSync8, existsSync as existsSync21 } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname16, join as join31 } from "path";
+import { dirname as dirname15, join as join32 } from "path";
 init_config();
 init_sandbox_policy();
 init_secrets();
@@ -18991,10 +19115,10 @@ function versionLine() {
   const install = companionInstall();
   const own = installedCommandPath({ install });
   if (install === "script") {
-    return `Cabane ${COMPANION_VERSION} \xB7 installed by the install script (${tildePath(join31(homedir9(), ".cabane"))})`;
+    return `Cabane ${COMPANION_VERSION} \xB7 installed by the install script (${tildePath(join32(homedir9(), ".cabane"))})`;
   }
   if (own)
-    return `Cabane ${COMPANION_VERSION} \xB7 installed with npm (${tildePath(dirname16(dirname16(own)))})`;
+    return `Cabane ${COMPANION_VERSION} \xB7 installed with npm (${tildePath(dirname15(dirname15(own)))})`;
   return `Cabane ${COMPANION_VERSION}`;
 }
 function otherInstallLines(running) {
@@ -19017,7 +19141,7 @@ function otherInstall(install, own) {
     }
   };
   if (install === "npm") {
-    const script = join31(
+    const script = join32(
       homedir9(),
       ".cabane",
       "node",
@@ -19026,12 +19150,12 @@ function otherInstall(install, own) {
       "@cabane",
       "companion"
     );
-    return existsSync21(script) ? join31(homedir9(), ".cabane") : null;
+    return existsSync21(script) ? join32(homedir9(), ".cabane") : null;
   }
   const found = firstOnPath("cabane-companion", process.env.PATH);
   if (!found) return null;
-  const ownAlias = own ? real(join31(dirname16(own), "cabane-companion")) : null;
-  return real(found) === ownAlias ? null : dirname16(found);
+  const ownAlias = own ? real(join32(dirname15(own), "cabane-companion")) : null;
+  return real(found) === ownAlias ? null : dirname15(found);
 }
 async function liveState() {
   const running = readLiveRuntimeState();
@@ -19254,8 +19378,8 @@ init_cabane_command();
 init_errors();
 init_src();
 init_transcript_writer();
-import { existsSync as existsSync22, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
-import { isAbsolute, join as join32 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync19, readdirSync as readdirSync8 } from "fs";
+import { isAbsolute, join as join33 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -19272,7 +19396,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join32(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join33(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -19355,7 +19479,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync18(join32(dir2, f), "utf8"),
+    read: (f) => readFileSync19(join33(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -19395,7 +19519,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join32(dir2, f));
+    const { meta, outcome } = peek(join33(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -19417,7 +19541,7 @@ function peek(path) {
   let meta;
   let outcome;
   try {
-    for (const line of readFileSync18(path, "utf8").split("\n")) {
+    for (const line of readFileSync19(path, "utf8").split("\n")) {
       if (!line.trim()) continue;
       const o = safeParse(line);
       const t = str2(rec(o)?.type);
@@ -19433,10 +19557,10 @@ function resolveTarget(dir2, target) {
     if (existsSync22(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join32(dir2, target);
+  const exact = join33(dir2, target);
   if (existsSync22(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join32(dir2, matches[0]);
+  if (matches.length === 1) return join33(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`${cabane("transcript")}\` to list them.`
@@ -19450,7 +19574,7 @@ function resolveTarget(dir2, target) {
 function renderFile(path) {
   let content;
   try {
-    content = readFileSync18(path, "utf8");
+    content = readFileSync19(path, "utf8");
   } catch (err) {
     throw new CompanionError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -19628,7 +19752,7 @@ program.command("pair", { hidden: true }).allowExcessArguments(false).option("--
   });
 });
 program.command("write-paired-config", { hidden: true }).description("persist an already-completed device enrollment payload from stdin.").action(() => {
-  writeCompletedPairing(readFileSync19(0, "utf8"));
+  writeCompletedPairing(readFileSync20(0, "utf8"));
 });
 program.command("start").description("run Cabane on this device in the background.").option("--foreground", "run attached in this terminal (for terminals and supervisors)").option("--daemon", "run in the background (the default; kept for compatibility)").addOption(new Option("--server <url>").hideHelp()).addOption(
   new Option("--log-level <level>", "info (default), warn, or debug").choices([