@cabane/companion 0.6.185 → 0.6.186

package/dist/launch.js

@@ -41,7 +41,7 @@ import {
   existsSync as existsSync3
 } from "fs";
 import { homedir as homedir5, userInfo } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, isAbsolute, join as join4 } from "path";
 import { z as z2 } from "zod";
 
 // src/pairing.ts
@@ -132,24 +132,12 @@ var localAgentConfigSchema = z2.object({
   // own `~/.claude/settings.json` — Cabane then stops
   // injecting the off switch and your normal Claude Code memory workflow applies
   // (in coding mode, where the checkout's project settings are read).
-  claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional(),
-  // This agent's exception to `runners.sandbox`: an ops agent that runs with
-  // the machine on a sandboxed device, or one sandboxed agent on a device that
-  // isn't. Absent is "inherit". Only on a row keyed by the agent's id.
-  sandbox: z2.enum(["os", "none"]).optional()
+  claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional()
 }).strict();
-var AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx) => {
-  for (const [key, row] of Object.entries(agents)) {
-    if (row.sandbox === void 0) continue;
-    if (AGENT_ID_KEY.test(key)) continue;
-    ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
-      path: [key, "sandbox"],
-      message: "a sandbox exception must name one agent \u2014 key the row by the agent's id (shown in Cabane), not a username or workspace-slug/username"
-    });
-  }
-});
+var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema);
+function isRootPath(value) {
+  return isAbsolute(value) || value === "~" || value.startsWith("~/");
+}
 var companionConfigSchema = z2.object({
   // https-enforced (loopback exempt), so a hand-edited config can't put the
   // device token and prompt on a plaintext channel.
@@ -204,48 +192,11 @@ var companionConfigSchema = z2.object({
   // The answer to `start`'s "start at boot?" when it was no, so it isn't asked again.
   // `cabane service install` still installs it.
   serviceDeclined: z2.boolean().optional(),
-  // Run each turn in a child runner process. Absent or `enabled: false` is the
-  // in-process path. `sandbox: 'os'` wraps the runner in an OS sandbox where the
-  // host supports one; `'none'` (the default) is a plain child, supported in its
-  // own right. `policy` is what the sandbox lets a turn reach, read and hold,
-  // validated in `runner/sandbox-policy.ts` so a bad policy refuses the turns it
-  // governs, field named, instead of stopping the companion starting.
-  runners: z2.object({
-    enabled: z2.boolean().optional(),
-    provider: z2.enum(["local-process", "docker"]).optional(),
-    sandbox: z2.enum(["os", "none"]).optional(),
-    // A container per conversation and agent, from one image, on a network
-    // whose only way out is an allow-listed proxy.
-    docker: z2.object({
-      // The base image a container runs. Default: the one this companion
-      // builds from its own Dockerfile on first use. One named here must
-      // have that one's layout (the `runner` user, `cabane-companion` on
-      // PATH reading `CABANE_COMPANION_ROOT`).
-      image: z2.string().min(1).optional(),
-      // The companion install mounted into every container. Default, on
-      // Linux: this companion's own. Needed for one run from a checkout
-      // (a `pnpm --filter @cabane/companion deploy --prod <dir>`).
-      companionDir: z2.string().min(1).optional(),
-      // Hosts a turn may reach besides the Cabane API, the model providers
-      // and the git host. `*.example.com` matches any subdomain.
-      egressAllow: z2.array(z2.string().min(1)).optional(),
-      // Keep a turn's container between turns and start it again for the
-      // next one. Off by default: the container goes after every turn and
-      // the runtime's session files are restored into the next.
-      keepContainers: z2.boolean().optional(),
-      // The Cabane URL as a container reaches it, for a device whose own
-      // `baseUrl` is a loopback address the container can't see.
-      apiUrl: z2.string().url().refine(isAllowedBaseUrl).optional(),
-      // Env set on each turn's runner, `${NAME}` resolved from secrets.json
-      // at exec: the runtime's own auth, which the image never carries.
-      env: z2.record(z2.string(), z2.string()).optional(),
-      // A git credential helper run on this device to answer the
-      // container's git for an allowed host, e.g. `!gh auth git-credential`.
-      // Absent: git's own configured helpers on this device.
-      gitCredentialHelper: z2.string().min(1).optional()
-    }).strict().optional(),
-    policy: z2.unknown().optional()
-  }).strict().optional()
+  // Where agents stand on this device. Every (agent, conversation) pair gets a directory under it,
+  // and an agent with no folder of its own and no prepare hook works there
+  // (`turn-execution.ts`, `prepareEnvironment`). Default `~/.cabane/work`: hidden, so pairing a
+  // laptop creates no new visible folder; set it to make the work visible.
+  root: z2.string().min(1).refine(isRootPath, { message: "must be an absolute path, or start with ~/" }).optional()
 });
 var legacyOfferSchema = z2.object({
   claudeCode: z2.object({ enabled: z2.boolean().optional() }).passthrough().optional(),

package/dist/pairing-config.js

@@ -39,7 +39,7 @@ import {
   existsSync as existsSync3
 } from "fs";
 import { homedir as homedir5, userInfo } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, isAbsolute, join as join4 } from "path";
 import { z as z2 } from "zod";
 
 // src/errors.ts
@@ -157,24 +157,12 @@ var localAgentConfigSchema = z2.object({
   // own `~/.claude/settings.json` — Cabane then stops
   // injecting the off switch and your normal Claude Code memory workflow applies
   // (in coding mode, where the checkout's project settings are read).
-  claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional(),
-  // This agent's exception to `runners.sandbox`: an ops agent that runs with
-  // the machine on a sandboxed device, or one sandboxed agent on a device that
-  // isn't. Absent is "inherit". Only on a row keyed by the agent's id.
-  sandbox: z2.enum(["os", "none"]).optional()
+  claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional()
 }).strict();
-var AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRefine((agents, ctx) => {
-  for (const [key, row] of Object.entries(agents)) {
-    if (row.sandbox === void 0) continue;
-    if (AGENT_ID_KEY.test(key)) continue;
-    ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
-      path: [key, "sandbox"],
-      message: "a sandbox exception must name one agent \u2014 key the row by the agent's id (shown in Cabane), not a username or workspace-slug/username"
-    });
-  }
-});
+var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema);
+function isRootPath(value) {
+  return isAbsolute(value) || value === "~" || value.startsWith("~/");
+}
 var companionConfigSchema = z2.object({
   // https-enforced (loopback exempt), so a hand-edited config can't put the
   // device token and prompt on a plaintext channel.
@@ -229,49 +217,40 @@ var companionConfigSchema = z2.object({
   // The answer to `start`'s "start at boot?" when it was no, so it isn't asked again.
   // `cabane service install` still installs it.
   serviceDeclined: z2.boolean().optional(),
-  // Run each turn in a child runner process. Absent or `enabled: false` is the
-  // in-process path. `sandbox: 'os'` wraps the runner in an OS sandbox where the
-  // host supports one; `'none'` (the default) is a plain child, supported in its
-  // own right. `policy` is what the sandbox lets a turn reach, read and hold,
-  // validated in `runner/sandbox-policy.ts` so a bad policy refuses the turns it
-  // governs, field named, instead of stopping the companion starting.
-  runners: z2.object({
-    enabled: z2.boolean().optional(),
-    provider: z2.enum(["local-process", "docker"]).optional(),
-    sandbox: z2.enum(["os", "none"]).optional(),
-    // A container per conversation and agent, from one image, on a network
-    // whose only way out is an allow-listed proxy.
-    docker: z2.object({
-      // The base image a container runs. Default: the one this companion
-      // builds from its own Dockerfile on first use. One named here must
-      // have that one's layout (the `runner` user, `cabane-companion` on
-      // PATH reading `CABANE_COMPANION_ROOT`).
-      image: z2.string().min(1).optional(),
-      // The companion install mounted into every container. Default, on
-      // Linux: this companion's own. Needed for one run from a checkout
-      // (a `pnpm --filter @cabane/companion deploy --prod <dir>`).
-      companionDir: z2.string().min(1).optional(),
-      // Hosts a turn may reach besides the Cabane API, the model providers
-      // and the git host. `*.example.com` matches any subdomain.
-      egressAllow: z2.array(z2.string().min(1)).optional(),
-      // Keep a turn's container between turns and start it again for the
-      // next one. Off by default: the container goes after every turn and
-      // the runtime's session files are restored into the next.
-      keepContainers: z2.boolean().optional(),
-      // The Cabane URL as a container reaches it, for a device whose own
-      // `baseUrl` is a loopback address the container can't see.
-      apiUrl: z2.string().url().refine(isAllowedBaseUrl).optional(),
-      // Env set on each turn's runner, `${NAME}` resolved from secrets.json
-      // at exec: the runtime's own auth, which the image never carries.
-      env: z2.record(z2.string(), z2.string()).optional(),
-      // A git credential helper run on this device to answer the
-      // container's git for an allowed host, e.g. `!gh auth git-credential`.
-      // Absent: git's own configured helpers on this device.
-      gitCredentialHelper: z2.string().min(1).optional()
-    }).strict().optional(),
-    policy: z2.unknown().optional()
-  }).strict().optional()
+  // Where agents stand on this device. Every (agent, conversation) pair gets a directory under it,
+  // and an agent with no folder of its own and no prepare hook works there
+  // (`turn-execution.ts`, `prepareEnvironment`). Default `~/.cabane/work`: hidden, so pairing a
+  // laptop creates no new visible folder; set it to make the work visible.
+  root: z2.string().min(1).refine(isRootPath, { message: "must be an absolute path, or start with ~/" }).optional()
 });
+function retiredConfigKeys(raw) {
+  if (!raw || typeof raw !== "object") return [];
+  const obj = raw;
+  const keys = [];
+  if ("runners" in obj) keys.push("runners");
+  const agents = obj.agents;
+  if (agents && typeof agents === "object") {
+    for (const [key, row] of Object.entries(agents)) {
+      if (row && typeof row === "object" && "sandbox" in row) keys.push(`agents.${key}.sandbox`);
+    }
+  }
+  return keys;
+}
+function withoutRetiredKeys(raw) {
+  if (retiredConfigKeys(raw).length === 0) return raw;
+  const { runners: _runners, ...rest } = raw;
+  if (!rest.agents || typeof rest.agents !== "object") return rest;
+  const agents = {};
+  for (const [key, row] of Object.entries(rest.agents)) {
+    if (row && typeof row === "object" && "sandbox" in row) {
+      const { sandbox: _sandbox, ...kept } = row;
+      agents[key] = kept;
+    } else {
+      agents[key] = row;
+    }
+  }
+  return { ...rest, agents };
+}
 var legacyOfferSchema = z2.object({
   claudeCode: z2.object({ enabled: z2.boolean().optional() }).passthrough().optional(),
   codex: z2.object({ enabled: z2.boolean().optional() }).passthrough().optional(),
@@ -307,7 +286,7 @@ function loadConfig() {
   if (raw.trim().length === 0) return null;
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = withoutRetiredKeys(JSON.parse(raw));
   } catch (err) {
     throw new ConfigError(
       `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -321,6 +300,12 @@ function loadConfig() {
         `${path}: invalid "agents" config at \`${agentIssue.path.join(".")}\` \u2014 ${agentIssue.message}. Fix the agents block in the config and retry.`
       );
     }
+    const rootIssue = result.error.issues.find((i) => i.path[0] === "root");
+    if (rootIssue) {
+      throw new ConfigError(
+        `${path}: invalid "root" \u2014 ${rootIssue.message}. Fix it in the config and retry.`
+      );
+    }
     throw new ConfigError(
       `${path} is from an incompatible or older version of the companion, or was hand-edited. Run \`${cabane("setup")}\` to pair again, or \`${cabane("logout --purge")}\` to reset.`
     );
@@ -350,7 +335,7 @@ function loadConfigTolerant() {
   if (raw.trim().length === 0) return fresh;
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = withoutRetiredKeys(JSON.parse(raw));
   } catch {
     return {
       local: empty,
@@ -363,6 +348,7 @@ function loadConfigTolerant() {
     const {
       agents: agents2,
       prepareHook: prepareHook2,
+      root: root2,
       dashboardPort,
       autoOpen,
       logLevel,
@@ -374,6 +360,7 @@ function loadConfigTolerant() {
       local: {
         ...agents2 !== void 0 ? { agents: agents2 } : {},
         ...prepareHook2 !== void 0 ? { prepareHook: prepareHook2 } : {},
+        ...root2 !== void 0 ? { root: root2 } : {},
         ...dashboardPort !== void 0 ? { dashboardPort } : {},
         ...autoOpen !== void 0 ? { autoOpen } : {},
         ...logLevel !== void 0 ? { logLevel } : {},
@@ -391,6 +378,8 @@ function loadConfigTolerant() {
   if (agents.success) local.agents = agents.data;
   const prepareHook = prepareHookSchema.safeParse(obj.prepareHook);
   if (prepareHook.success) local.prepareHook = prepareHook.data;
+  const root = companionConfigSchema.shape.root.safeParse(obj.root);
+  if (root.success && root.data !== void 0) local.root = root.data;
   if (typeof obj.dashboardPort === "number") local.dashboardPort = obj.dashboardPort;
   if (typeof obj.autoOpen === "boolean") local.autoOpen = obj.autoOpen;
   if (obj.logFormat === "human" || obj.logFormat === "json") local.logFormat = obj.logFormat;