@cabane/companion 0.6.162 → 0.6.163

package/dist/runtime.js

@@ -2543,15 +2543,20 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname7, join as join11 } from "path";
+import { join as join11 } from "path";
 import { z as z4 } from "zod";
-function credentialsPath() {
+var credentialMapSchema = z4.record(z4.string(), z4.string());
+function credentialsDir() {
+  return join11(cabaneDir(), "credentials");
+}
+function legacyPath() {
   return join11(cabaneDir(), "credentials.json");
 }
-var credentialStoreSchema = z4.record(z4.string(), z4.string());
-function load() {
-  const path = credentialsPath();
-  if (!existsSync7(path)) return {};
+function devicePath(deviceId) {
+  return join11(credentialsDir(), `${deviceId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+}
+function read(path) {
+  if (!existsSync7(path)) return null;
   let raw;
   try {
     raw = readFileSync4(path, "utf8");
@@ -2560,19 +2565,25 @@ function load() {
   }
   if (raw.trim().length === 0) return {};
   try {
-    const result = credentialStoreSchema.safeParse(JSON.parse(raw));
+    const result = credentialMapSchema.safeParse(JSON.parse(raw));
     return result.success ? result.data : {};
   } catch {
     return {};
   }
 }
-function save(map) {
-  const path = credentialsPath();
-  mkdirSync5(dirname7(path), { recursive: true });
-  try {
-    chmodSync3(cabaneDir(), 448);
-  } catch {
+function load(deviceId) {
+  return read(devicePath(deviceId)) ?? read(legacyPath()) ?? {};
+}
+function save(deviceId, map) {
+  const dir2 = credentialsDir();
+  mkdirSync5(dir2, { recursive: true });
+  for (const d of [cabaneDir(), dir2]) {
+    try {
+      chmodSync3(d, 448);
+    } catch {
+    }
   }
+  const path = devicePath(deviceId);
   const tmp = `${path}.${process.pid}.tmp`;
   try {
     writeFileSync3(tmp, JSON.stringify(map, null, 2) + "\n", { mode: 384 });
@@ -2589,26 +2600,23 @@ function save(map) {
     throw err;
   }
 }
-function getCredential(agentId) {
-  return load()[agentId] ?? null;
+function getCredential(deviceId, agentId) {
+  return load(deviceId)[agentId] ?? null;
 }
-function setCredential(agentId, pat) {
-  const map = load();
-  if (map[agentId] === pat) return;
+function setCredential(deviceId, agentId, pat) {
+  if (read(devicePath(deviceId))?.[agentId] === pat) return;
+  const map = load(deviceId);
   map[agentId] = pat;
-  save(map);
+  save(deviceId, map);
 }
-function pruneCredentials(keepAgentIds) {
-  const map = load();
+function pruneCredentials(deviceId, keepAgentIds) {
   const keep = new Set(keepAgentIds);
-  let removed = 0;
-  for (const id of Object.keys(map)) {
-    if (!keep.has(id)) {
-      delete map[id];
-      removed += 1;
-    }
-  }
-  if (removed > 0) save(map);
+  if (keep.size === 0) return [];
+  const own = read(devicePath(deviceId));
+  const map = own ?? load(deviceId);
+  const removed = Object.keys(map).filter((id) => !keep.has(id));
+  for (const id of removed) delete map[id];
+  if (removed.length > 0 || own === null) save(deviceId, map);
   return removed;
 }
 
@@ -3922,14 +3930,14 @@ function readRequestContextTokens(msg) {
   return readSdkUsage(msg.message?.usage)?.inputTokens;
 }
 var CONTEXT_READING_TIMEOUT_MS = 2e3;
-async function readHarnessContext(read) {
-  if (!read) return void 0;
+async function readHarnessContext(read2) {
+  if (!read2) return void 0;
   let timer;
   const timeout = new Promise((resolve2) => {
     timer = setTimeout(() => resolve2(void 0), CONTEXT_READING_TIMEOUT_MS);
   });
   try {
-    return parseContextUsage(await Promise.race([read(), timeout]));
+    return parseContextUsage(await Promise.race([read2(), timeout]));
   } catch {
     return void 0;
   } finally {
@@ -6136,14 +6144,14 @@ function decideResume3(stored, currentCwd) {
 function readUsageBaseline(raw) {
   if (!raw || typeof raw !== "object") return null;
   const rec = raw;
-  const read = (key) => {
+  const read2 = (key) => {
     const v = rec[key];
     return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : null;
   };
-  const inputTokens = read("inputTokens");
-  const outputTokens = read("outputTokens");
-  const cacheReadTokens = read("cacheReadTokens");
-  const cacheCreationTokens = read("cacheCreationTokens");
+  const inputTokens = read2("inputTokens");
+  const outputTokens = read2("outputTokens");
+  const cacheReadTokens = read2("cacheReadTokens");
+  const cacheCreationTokens = read2("cacheCreationTokens");
   if (inputTokens === null || outputTokens === null || cacheReadTokens === null || cacheCreationTokens === null) {
     return null;
   }
@@ -9224,9 +9232,9 @@ function resolveSeqFloor(sources, ctx) {
   );
   return floor;
 }
-function readOutboxFloor(read, turnId, log) {
+function readOutboxFloor(read2, turnId, log) {
   try {
-    return read(turnId);
+    return read2(turnId);
   } catch (err) {
     log.debug(
       { turnId, err: err instanceof Error ? err.message : String(err) },
@@ -9340,7 +9348,7 @@ function clearPrepared(workspaceId, conversationId, agentId) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename as basename3, dirname as dirname8, join as join17 } from "path";
+import { basename as basename3, dirname as dirname7, join as join17 } from "path";
 function transcriptsDir() {
   return join17(runnerStateDir(), "transcripts");
 }
@@ -9381,7 +9389,7 @@ var TranscriptWriter = class {
   preserveAnomaly() {
     if (this.broken) return;
     try {
-      const dir2 = join17(dirname8(this.path), "anomalies");
+      const dir2 = join17(dirname7(this.path), "anomalies");
       mkdirSync8(dir2, { recursive: true, mode: 448 });
       chmodSync4(dir2, 448);
       const target = join17(dir2, basename3(this.path));
@@ -11302,7 +11310,7 @@ function publishStaged(from, to, move = atomicMove) {
 // src/providers/runner-base.ts
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync14, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname9, join as join20, sep as sep3 } from "path";
+import { dirname as dirname8, join as join20, sep as sep3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var COMPANION_MOUNT = "/opt/cabane/companion";
 var BASE_DOCKERFILE = `FROM node:22-slim
@@ -11348,10 +11356,10 @@ async function ensureBaseImage(docker, image, log) {
   return true;
 }
 function ownInstall(moduleFile = fileURLToPath5(import.meta.url)) {
-  let dir2 = dirname9(moduleFile);
+  let dir2 = dirname8(moduleFile);
   for (let i = 0; i < 4; i++) {
     if (existsSync14(join20(dir2, "dist", "cli.js")) && existsSync14(join20(dir2, "package.json"))) break;
-    dir2 = dirname9(dir2);
+    dir2 = dirname8(dir2);
   }
   if (!existsSync14(join20(dir2, "dist", "cli.js"))) return null;
   const sdk = join20(dir2, "node_modules", "@anthropic-ai", "claude-agent-sdk");
@@ -12411,7 +12419,7 @@ import {
 import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
 import { homedir as homedir6, networkInterfaces, tmpdir as tmpdir4, userInfo as userInfo2 } from "os";
-import { dirname as dirname10, join as join22, sep as sep4 } from "path";
+import { dirname as dirname9, join as join22, sep as sep4 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
@@ -12424,9 +12432,9 @@ function accountHome() {
 var STORE_WALK_TIMEOUT_MS = 6e4;
 var STORE_WALK_MAX_AGE_MS = 5 * 6e4;
 function storeWalkRoots(homes, cabaneDir2) {
-  const companionHome = dirname10(cabaneDir2);
-  const parent = dirname10(companionHome);
-  const beside = homes.includes(companionHome) || dirname10(parent) === parent ? [] : [parent];
+  const companionHome = dirname9(cabaneDir2);
+  const parent = dirname9(companionHome);
+  const beside = homes.includes(companionHome) || dirname9(parent) === parent ? [] : [parent];
   const candidates = [.../* @__PURE__ */ new Set([...homes, ...beside])];
   return candidates.filter(
     (root) => !candidates.some((other) => other !== root && isAtOrUnder(root, other))
@@ -13244,7 +13252,7 @@ var SseSubscriber = class {
 // src/updater.ts
 import { spawn as spawn8 } from "child_process";
 import { copyFileSync as copyFileSync3, existsSync as existsSync18, mkdirSync as mkdirSync16, renameSync as renameSync11, rmSync as rmSync14 } from "fs";
-import { dirname as dirname14, join as join28 } from "path";
+import { dirname as dirname13, join as join28 } from "path";
 
 // src/boot-rule.ts
 import {
@@ -13256,7 +13264,7 @@ import {
   symlinkSync,
   writeFileSync as writeFileSync9
 } from "fs";
-import { dirname as dirname11, join as join25 } from "path";
+import { dirname as dirname10, join as join25 } from "path";
 var UNCONFIRMED_WINDOW_MS = 10 * 6e4;
 var MAX_STAGE_ATTEMPTS = 3;
 function superseded(pending, ...running) {
@@ -13289,7 +13297,7 @@ import {
   rmSync as rmSync13,
   symlinkSync as symlinkSync2
 } from "fs";
-import { dirname as dirname12, join as join26 } from "path";
+import { dirname as dirname11, join as join26 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function versionsDir() {
   return join26(cabaneDir(), "versions");
@@ -13304,7 +13312,7 @@ function versionPackageRoot(version) {
   return join26(versionsDir(), version, "node_modules", "@cabane", "companion");
 }
 function ownPackageRoot(moduleUrl = import.meta.url) {
-  return dirname12(dirname12(fileURLToPath7(moduleUrl)));
+  return dirname11(dirname11(fileURLToPath7(moduleUrl)));
 }
 function packageVersion(root) {
   try {
@@ -13324,7 +13332,7 @@ function currentRoot() {
 }
 function pointCurrentAt(root) {
   const link = currentLink();
-  mkdirSync14(dirname12(link), { recursive: true });
+  mkdirSync14(dirname11(link), { recursive: true });
   const fresh = `${link}.${process.pid}.${Date.now()}`;
   symlinkSync2(root, fresh);
   try {
@@ -13359,7 +13367,7 @@ function compareVersions(a, b) {
 
 // src/update-state.ts
 import { mkdirSync as mkdirSync15, readFileSync as readFileSync15, renameSync as renameSync10, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname13, join as join27 } from "path";
+import { dirname as dirname12, join as join27 } from "path";
 import { z as z18 } from "zod";
 var resultSchema = z18.object({
   kind: z18.enum(["updated", "rolled_back", "failed"]),
@@ -13394,7 +13402,7 @@ function readUpdateState(path = updateStatePath()) {
   }
 }
 function writeUpdateState(state, path = updateStatePath()) {
-  mkdirSync15(dirname13(path), { recursive: true });
+  mkdirSync15(dirname12(path), { recursive: true });
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync10(tmp, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
@@ -13435,7 +13443,7 @@ function writeBootGuard(root = ownPackageRoot()) {
   const built = join28(root, "dist", "boot-guard.js");
   if (!existsSync18(built)) return false;
   const target = bootGuardPath();
-  mkdirSync16(dirname14(target), { recursive: true });
+  mkdirSync16(dirname13(target), { recursive: true });
   const tmp = `${target}.${process.pid}.tmp`;
   copyFileSync3(built, tmp);
   renameSync11(tmp, target);
@@ -13478,9 +13486,9 @@ async function stageVersion(version, harnesses, deps = {}) {
     if (!await verifyInstall(placed, version, harnesses, { run, execPath: node }))
       return { ok: true, root: placed };
   }
-  const npm = join28(dirname14(node), "npm");
+  const npm = join28(dirname13(node), "npm");
   if (!existsSync18(npm))
-    return { ok: false, reason: `there is no npm beside Node at ${dirname14(node)}` };
+    return { ok: false, reason: `there is no npm beside Node at ${dirname13(node)}` };
   mkdirSync16(versionsDir(), { recursive: true });
   const staging = join28(versionsDir(), `.${version}.staging-${process.pid}`);
   rmSync14(staging, { recursive: true, force: true });
@@ -13499,7 +13507,7 @@ async function stageVersion(version, harnesses, deps = {}) {
     ],
     {
       // npm's install scripts run on this Node, not whichever `node` is first on PATH.
-      env: { ...process.env, PATH: `${dirname14(node)}:${process.env.PATH ?? ""}` },
+      env: { ...process.env, PATH: `${dirname13(node)}:${process.env.PATH ?? ""}` },
       timeoutMs: 15 * 6e4
     }
   );
@@ -14162,7 +14170,7 @@ var CompanionSupervisor = class {
           saveConfig(this.config);
         }
         for (const it of items) {
-          if (it.credential) setCredential(it.agentId, it.credential);
+          if (it.credential) setCredential(device.id, it.agentId, it.credential);
         }
         const byWorkspace = /* @__PURE__ */ new Map();
         for (const it of items) {
@@ -14173,8 +14181,17 @@ var CompanionSupervisor = class {
         for (const wsId of [...this.workspaces.keys()]) {
           if (!byWorkspace.has(wsId)) await this.removeWorkspace(wsId);
         }
-        for (const [wsId, list] of byWorkspace) this.reconcileWorkspace(wsId, list);
-        pruneCredentials(items.map((i) => i.agentId));
+        for (const [wsId, list] of byWorkspace) this.reconcileWorkspace(device.id, wsId, list);
+        const pruned = pruneCredentials(
+          device.id,
+          items.map((i) => i.agentId)
+        );
+        if (pruned.length > 0) {
+          this.log.info(
+            { deviceId: device.id, agentIds: pruned },
+            `Removed the saved sign-in of ${pruned.length === 1 ? "agent" : "agents"} ${pruned.join(", ")}: no longer assigned to this device (${device.id}).`
+          );
+        }
         void this.recoverRuns();
       } finally {
         this.refreshing = false;
@@ -14188,7 +14205,7 @@ var CompanionSupervisor = class {
     }
   }
   // ---- reconciliation ----
-  reconcileWorkspace(workspaceId, list) {
+  reconcileWorkspace(deviceId, workspaceId, list) {
     const first = list[0];
     let wr = this.workspaces.get(workspaceId);
     if (!wr) {
@@ -14214,7 +14231,7 @@ var CompanionSupervisor = class {
       if (!desired.has(agentId)) this.removeAgent(wr, agentId);
     }
     for (const it of list) {
-      const credential = it.credential ?? getCredential(it.agentId);
+      const credential = it.credential ?? getCredential(deviceId, it.agentId);
       const runConfig = parseRunConfig(
         it.runConfig,
         (m) => this.log.warn(
@@ -15297,6 +15314,95 @@ function clearCrash() {
   }
 }
 
+// src/stray-companion.ts
+import { spawnSync } from "child_process";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join30 } from "path";
+var COMPANION_ENTRY = /@cabane\/companion\/|cabane-companion|(^|[\s/])cabane\s|\.cabane\/(versions|current|boot-guard)/;
+var START = /\sstart(\s|$)/;
+function companionStarts(psOutput) {
+  const found = [];
+  for (const line of psOutput.split("\n")) {
+    const match = /^\s*(\d+)\s+(.*)$/.exec(line);
+    if (!match) continue;
+    const command = match[2];
+    if (COMPANION_ENTRY.test(command) && START.test(command)) {
+      found.push({ pid: Number(match[1]), command });
+    }
+  }
+  return found;
+}
+function stateDirOf(env) {
+  const home = env.CABANE_COMPANION_HOME || env.HOME;
+  return home ? join30(home, ".cabane") : null;
+}
+function envFromPsE(output, command) {
+  const line = output.replace(/\n$/, "");
+  if (!line.startsWith(command)) return {};
+  const env = {};
+  for (const entry of line.slice(command.length).trim().split(/ (?=[A-Za-z_][A-Za-z0-9_]*=)/)) {
+    const eq = entry.indexOf("=");
+    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return env;
+}
+function envFromProc(pid) {
+  try {
+    const env = {};
+    for (const entry of readFileSync17(`/proc/${pid}/environ`, "utf8").split("\0")) {
+      const eq = entry.indexOf("=");
+      if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
+    }
+    return env;
+  } catch {
+    return null;
+  }
+}
+function envOf(pid, command) {
+  if (process.platform === "linux") return envFromProc(pid);
+  const result = spawnSync("ps", ["-E", "-ww", "-o", "command=", "-p", String(pid)], {
+    encoding: "utf8",
+    timeout: 5e3
+  });
+  if (result.error || result.status !== 0) return null;
+  return envFromPsE(result.stdout, command);
+}
+function findStrayCompanions(exclude = [], deps = {}) {
+  if (!deps.ps && (process.platform === "win32" || typeof process.getuid !== "function")) {
+    return [];
+  }
+  const ps = deps.ps ?? (() => {
+    const result = spawnSync("ps", ["-U", String(process.getuid()), "-o", "pid=,command="], {
+      encoding: "utf8",
+      timeout: 5e3,
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return result.error || typeof result.stdout !== "string" ? null : result.stdout;
+  });
+  const listing = ps();
+  if (!listing) return [];
+  const dir2 = deps.dir ?? cabaneDir();
+  const skip = /* @__PURE__ */ new Set([...deps.self ?? [process.pid, process.ppid], ...exclude]);
+  return companionStarts(listing).filter((c) => {
+    if (skip.has(c.pid)) return false;
+    const env = (deps.env ?? envOf)(c.pid, c.command);
+    return env !== null && stateDirOf(env) === dir2;
+  });
+}
+var SERVICE_ENTRY = /\.cabane\/boot-guard/;
+function strayCompanionLines(strays, retry) {
+  const one = strays.length === 1;
+  return [
+    `Another Cabane companion is running for this computer's ~/.cabane, and ~/.cabane has no record of it:`,
+    ...strays.map((s) => `  pid ${s.pid}  ${s.command}`),
+    `Two companions for one ~/.cabane sign each other's agents out. Stop ${one ? "it" : "them"} first:`,
+    ...strays.map(
+      (s) => SERVICE_ENTRY.test(s.command) ? `  pid ${s.pid} is a service, which restarts if killed:  cabane service uninstall` : `  kill ${s.pid}`
+    ),
+    `then run  ${retry}  again.`
+  ];
+}
+
 // src/runtime.ts
 async function createCompanionRuntime(opts = {}) {
   const log = getLogger();
@@ -15323,6 +15429,8 @@ async function createCompanionRuntime(opts = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();
+  const strays = findStrayCompanions(pre ? [pre.pid] : []);
+  if (strays.length > 0) return { ok: false, reason: "stray-companion", strays };
   const claim = acquireRuntimeState({
     pid: process.pid,
     startedAt,
@@ -15434,5 +15542,6 @@ async function closeSurfaces(control, dashboard) {
   if (dashboard) await dashboard.close();
 }
 export {
-  createCompanionRuntime
+  createCompanionRuntime,
+  strayCompanionLines
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.162",
+  "version": "0.6.163",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",