@cabane/companion 0.6.186 → 0.6.187

package/dist/runtime.js

@@ -230,7 +230,7 @@ var localAgentConfigSchema = z2.object({
   // yourself, `claudeCode: { autoMemory: true }` hands auto-memory back to your
   // own `~/.claude/settings.json` — Cabane then stops
   // injecting the off switch and your normal Claude Code memory workflow applies
-  // (in coding mode, where the checkout's project settings are read).
+  // (the user and project settings load on every Claude Code turn).
   claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional()
 }).strict();
 var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema);
@@ -847,7 +847,6 @@ var CompanionStateHub = class {
           agent_id: a.agentId,
           username: a.username,
           display_name: a.displayName,
-          mode: a.mode,
           has_credential: a.hasCredential,
           missing_secrets: a.missingSecrets
         }))
@@ -2620,35 +2619,9 @@ function noResume() {
 // packages/agent-runtime/src/version.ts
 var TURN_PROTOCOL_VERSION = 1;
 
-// packages/agent-runtime/src/host-policy.ts
-import { z as z6 } from "zod";
-var hostPolicySchema = z6.object({
-  // Host filesystem and shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the notebook pair,
-  // git-worktree tools and `REPL`. Off on the locked assistant surface; on in the coding posture.
-  hostFs: z6.boolean(),
-  // Public web (`WebSearch` / `WebFetch`). Not host reach; a grant like the rest.
-  web: z6.boolean(),
-  // Browser automation (the Playwright MCP surface). Varies by host.
-  browser: z6.boolean(),
-  // User-configured MCP servers permitted.
-  userMcp: z6.boolean(),
-  // Subagent dispatch (`Task` / `Agent`) — a grant: `false` on the locked surface, `true` in the
-  // coding posture, where the coding allow-hook reaches sub-agent tool calls. A subagent completes
-  // within the turn, so it's not an invariant like `scheduling`.
-  subagents: z6.boolean(),
-  // ── Hard platform invariants — always denied, never granted ────────────────
-  // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*` families,
-  // `Monitor`, `Workflow`, …). A turn is one query that resolves on `result`; a scheduled callback
-  // fires after the reply window has closed and strands the agent.
-  scheduling: z6.literal("never"),
-  // Human-facing UI prompts (`AskUserQuestion`). Nothing in a Cabane conversation can answer a
-  // structured prompt, so the call hangs the turn. The agent asks in its reply instead.
-  uiPrompts: z6.literal("never")
-});
-
 // packages/agent-runtime/src/turn-event.ts
-import { z as z7 } from "zod";
-var turnEventSchema = z7.discriminatedUnion("type", [
+import { z as z6 } from "zod";
+var turnEventSchema = z6.discriminatedUnion("type", [
   // The runtime's opaque session state, emitted when the adapter learns it (e.g. the SDK
   // `system/init` frame). The platform stores `state` verbatim per (conversation, agent) and
   // hands it back next turn; only the adapter knows what it means.
@@ -2660,21 +2633,21 @@ var turnEventSchema = z7.discriminatedUnion("type", [
   // server rewinds the mark, so the next turn rebuilds a full catch-up (this turn is unavoidably
   // lossy — the degrade is known only after the manifest was committed). A plain boolean; the
   // runtime-specific reason stays in the adapter's `onWarn` log. Optional.
-  z7.object({
-    type: z7.literal("session"),
-    state: z7.string(),
-    degraded: z7.boolean().optional()
+  z6.object({
+    type: z6.literal("session"),
+    state: z6.string(),
+    degraded: z6.boolean().optional()
   }),
   // One readable thinking summary. Transient — surfaced live, never persisted as content.
-  z7.object({ type: z7.literal("thinking"), text: z7.string() }),
+  z6.object({ type: z6.literal("thinking"), text: z6.string() }),
   // Assistant text. `terminal: false` is interim narration (commits as `progress`);
   // `terminal: true` is the turn's closing reply (commits as `final`).
-  z7.object({ type: z7.literal("text"), body: z7.string(), terminal: z7.boolean() }),
+  z6.object({ type: z6.literal("text"), body: z6.string(), terminal: z6.boolean() }),
   // Runtime/provider-authored prose about the turn — a failure's explanation, or a line the
   // harness wrote on a turn it recovered. Not the agent's words: the pump persists it as
   // `runtime_notice`, drawn in the SystemNote voice. Adapters emit it only from positive runtime
   // evidence; the web never classifies English strings.
-  z7.object({ type: z7.literal("runtime_notice"), body: z7.string() }),
+  z6.object({ type: z6.literal("runtime_notice"), body: z6.string() }),
   // A tool-activity transition. `name` is prefix-stripped (`cabane_read`, not
   // `mcp__cabane__cabane_read`); `summary` is the short card label; `phase` pairs `start` with a
   // later `done`/`error` on the same `id`.
@@ -2683,15 +2656,15 @@ var turnEventSchema = z7.discriminatedUnion("type", [
   // log are a consumer concern (docs/turn-protocol.md). `mcpServer` is the MCP server the call
   // came from (`cabane`, `playwright`, …), derived before `name` dropped the prefix; null for a
   // host tool. Optional, read as null when absent.
-  z7.object({
-    type: z7.literal("tool"),
-    id: z7.string(),
-    name: z7.string(),
-    phase: z7.enum(["start", "done", "error"]),
-    summary: z7.string(),
-    input: z7.unknown().optional(),
-    result: z7.unknown().optional(),
-    mcpServer: z7.string().nullable().optional()
+  z6.object({
+    type: z6.literal("tool"),
+    id: z6.string(),
+    name: z6.string(),
+    phase: z6.enum(["start", "done", "error"]),
+    summary: z6.string(),
+    input: z6.unknown().optional(),
+    result: z6.unknown().optional(),
+    mcpServer: z6.string().nullable().optional()
   }),
   // The turn's terminal outcome. `ok:false` carries a machine reason (`no_session`, an error
   // code), surfaced by the host's clear-PATCH as `errorReason`.
@@ -2712,70 +2685,70 @@ var turnEventSchema = z7.discriminatedUnion("type", [
   // started with); `resolvedConfig` the knobs the harness reported (`{ reasoningEffort }` for
   // codex). Known only after the run streams, so they ride this event home and the host relays
   // them on settle. A cancel has no result event at all.
-  z7.object({
-    type: z7.literal("result"),
-    ok: z7.boolean(),
-    reason: z7.string().optional(),
-    usage: z7.object({
-      inputTokens: z7.number(),
-      outputTokens: z7.number(),
-      cacheReadTokens: z7.number().optional(),
-      cacheCreationTokens: z7.number().optional(),
-      contextTokens: z7.number().optional(),
-      contextWindow: z7.number().optional(),
+  z6.object({
+    type: z6.literal("result"),
+    ok: z6.boolean(),
+    reason: z6.string().optional(),
+    usage: z6.object({
+      inputTokens: z6.number(),
+      outputTokens: z6.number(),
+      cacheReadTokens: z6.number().optional(),
+      cacheCreationTokens: z6.number().optional(),
+      contextTokens: z6.number().optional(),
+      contextWindow: z6.number().optional(),
       // The rest of the harness's context reading, when it gave one: where it will compact, its
       // `/context` breakdown, and every compaction it reported. Claude Code only.
-      contextCompactAt: z7.number().optional(),
-      contextCategories: z7.array(
-        z7.object({
-          name: z7.string(),
-          tokens: z7.number(),
-          kind: z7.enum(["used", "free", "buffer", "deferred"])
+      contextCompactAt: z6.number().optional(),
+      contextCategories: z6.array(
+        z6.object({
+          name: z6.string(),
+          tokens: z6.number(),
+          kind: z6.enum(["used", "free", "buffer", "deferred"])
         })
       ).optional(),
-      contextCompactions: z7.array(
-        z7.object({
-          trigger: z7.enum(["manual", "auto"]),
-          preTokens: z7.number(),
-          postTokens: z7.number().optional()
+      contextCompactions: z6.array(
+        z6.object({
+          trigger: z6.enum(["manual", "auto"]),
+          preTokens: z6.number(),
+          postTokens: z6.number().optional()
         })
       ).optional()
     }).optional(),
-    resolvedModel: z7.string().optional(),
-    resolvedConfig: z7.object({
-      effort: z7.string().optional(),
-      thinking: z7.string().optional(),
-      reasoningEffort: z7.string().optional()
+    resolvedModel: z6.string().optional(),
+    resolvedConfig: z6.object({
+      effort: z6.string().optional(),
+      thinking: z6.string().optional(),
+      reasoningEffort: z6.string().optional()
     }).optional(),
     // The harness-reported MCP inventory from this turn's init frame. Diagnostic only: names,
     // statuses and a count — never server definitions, credentials or session ids.
     // `initReceived:false` tells a missing init frame from a real empty inventory.
-    mcpInventory: z7.object({
-      initReceived: z7.boolean(),
-      servers: z7.array(z7.object({ name: z7.string(), status: z7.string() })),
-      toolCount: z7.number().int().nonnegative()
+    mcpInventory: z6.object({
+      initReceived: z6.boolean(),
+      servers: z6.array(z6.object({ name: z6.string(), status: z6.string() })),
+      toolCount: z6.number().int().nonnegative()
     }).optional()
   })
 ]);
 
 // packages/agent-runtime/src/turn-diagnostics.ts
-import { z as z8 } from "zod";
-var turnResultReasonSchema = z8.discriminatedUnion("kind", [
-  z8.object({ kind: z8.literal("usage_capped"), resetsAt: z8.string().optional() }),
-  z8.object({ kind: z8.literal("rate_limited") }),
-  z8.object({ kind: z8.literal("server_error") }),
-  z8.object({ kind: z8.literal("auth_expired") }),
-  z8.object({ kind: z8.literal("no_result") }),
-  z8.object({ kind: z8.literal("empty_result") }),
-  z8.object({ kind: z8.literal("empty_result_unverified") }),
-  z8.object({ kind: z8.literal("timeout_idle") }),
-  z8.object({ kind: z8.literal("timeout_total") }),
-  z8.object({ kind: z8.literal("cancelled") }),
-  z8.object({ kind: z8.literal("lease_lost") }),
-  z8.object({ kind: z8.literal("skipped") }),
-  z8.object({ kind: z8.literal("session_start_failed") }),
-  z8.object({ kind: z8.literal("workspace_tools_missing") }),
-  z8.object({ kind: z8.literal("runtime_error") })
+import { z as z7 } from "zod";
+var turnResultReasonSchema = z7.discriminatedUnion("kind", [
+  z7.object({ kind: z7.literal("usage_capped"), resetsAt: z7.string().optional() }),
+  z7.object({ kind: z7.literal("rate_limited") }),
+  z7.object({ kind: z7.literal("server_error") }),
+  z7.object({ kind: z7.literal("auth_expired") }),
+  z7.object({ kind: z7.literal("no_result") }),
+  z7.object({ kind: z7.literal("empty_result") }),
+  z7.object({ kind: z7.literal("empty_result_unverified") }),
+  z7.object({ kind: z7.literal("timeout_idle") }),
+  z7.object({ kind: z7.literal("timeout_total") }),
+  z7.object({ kind: z7.literal("cancelled") }),
+  z7.object({ kind: z7.literal("lease_lost") }),
+  z7.object({ kind: z7.literal("skipped") }),
+  z7.object({ kind: z7.literal("session_start_failed") }),
+  z7.object({ kind: z7.literal("workspace_tools_missing") }),
+  z7.object({ kind: z7.literal("runtime_error") })
 ]);
 var turnOutcomes = ["success", "failure", "cancelled", "skipped"];
 var turnSessionModes = ["fresh", "resumed", "degraded"];
@@ -2787,123 +2760,125 @@ var turnFinalSources = [
   "marker",
   "none"
 ];
-var turnDiagnosticsSchema = z8.object({
-  outcome: z8.enum(turnOutcomes),
+var turnDiagnosticsSchema = z7.object({
+  outcome: z7.enum(turnOutcomes),
   resultReason: turnResultReasonSchema.nullable(),
-  sessionMode: z8.enum(turnSessionModes),
-  sessionFingerprint: z8.string().regex(/^[a-f0-9]{16}$/).nullable(),
-  eventCounts: z8.object({
-    session: z8.number().int().nonnegative(),
-    text: z8.number().int().nonnegative(),
-    runtime_notice: z8.number().int().nonnegative(),
-    thinking: z8.number().int().nonnegative(),
-    tool: z8.number().int().nonnegative(),
-    result: z8.number().int().nonnegative()
+  sessionMode: z7.enum(turnSessionModes),
+  sessionFingerprint: z7.string().regex(/^[a-f0-9]{16}$/).nullable(),
+  eventCounts: z7.object({
+    session: z7.number().int().nonnegative(),
+    text: z7.number().int().nonnegative(),
+    runtime_notice: z7.number().int().nonnegative(),
+    thinking: z7.number().int().nonnegative(),
+    tool: z7.number().int().nonnegative(),
+    result: z7.number().int().nonnegative()
   }),
-  runtimeResultKind: z8.enum(turnRuntimeResultKinds).nullable(),
-  finalSource: z8.enum(turnFinalSources),
-  mcpInventory: z8.object({
-    initReceived: z8.boolean(),
-    servers: z8.array(z8.object({ name: z8.string(), status: z8.string() })),
-    toolCount: z8.number().int().nonnegative()
+  runtimeResultKind: z7.enum(turnRuntimeResultKinds).nullable(),
+  finalSource: z7.enum(turnFinalSources),
+  mcpInventory: z7.object({
+    initReceived: z7.boolean(),
+    servers: z7.array(z7.object({ name: z7.string(), status: z7.string() })),
+    toolCount: z7.number().int().nonnegative()
   }).optional()
 });
 
 // packages/agent-runtime/src/turn-request.ts
-import { z as z9 } from "zod";
-var contentBlockSchema = z9.discriminatedUnion("type", [
-  z9.object({ type: z9.literal("text"), text: z9.string() }),
-  z9.object({
-    type: z9.literal("image"),
-    source: z9.object({ type: z9.literal("url"), url: z9.string() })
+import { z as z8 } from "zod";
+var contentBlockSchema = z8.discriminatedUnion("type", [
+  z8.object({ type: z8.literal("text"), text: z8.string() }),
+  z8.object({
+    type: z8.literal("image"),
+    source: z8.object({ type: z8.literal("url"), url: z8.string() })
   }),
-  z9.object({
-    type: z9.literal("document"),
-    source: z9.object({ type: z9.literal("url"), url: z9.string() })
+  z8.object({
+    type: z8.literal("document"),
+    source: z8.object({ type: z8.literal("url"), url: z8.string() })
   })
 ]);
-var effortLevelSchema = z9.enum(["low", "medium", "high", "xhigh", "max"]);
-var resolvedRunConfigSchema = z9.object({
-  model: z9.string().nullable(),
+var effortLevelSchema = z8.enum(["low", "medium", "high", "xhigh", "max"]);
+var resolvedRunConfigSchema = z8.object({
+  model: z8.string().nullable(),
   effort: effortLevelSchema.optional(),
-  runtimeOptions: z9.record(z9.string(), z9.unknown()).optional()
+  runtimeOptions: z8.record(z8.string(), z8.unknown()).optional()
 });
-var resolvedMcpServerSchema = z9.union([
-  z9.object({
-    type: z9.literal("stdio").optional(),
-    command: z9.string(),
-    args: z9.array(z9.string()).optional(),
-    env: z9.record(z9.string(), z9.string()).optional(),
-    envFromEnv: z9.record(z9.string(), z9.string()).optional()
+var resolvedMcpServerSchema = z8.union([
+  z8.object({
+    type: z8.literal("stdio").optional(),
+    command: z8.string(),
+    args: z8.array(z8.string()).optional(),
+    env: z8.record(z8.string(), z8.string()).optional(),
+    envFromEnv: z8.record(z8.string(), z8.string()).optional()
   }),
-  z9.object({
-    type: z9.literal("http"),
-    url: z9.string(),
-    headers: z9.record(z9.string(), z9.string()).optional(),
-    headersFromEnv: z9.record(z9.string(), z9.string()).optional()
+  z8.object({
+    type: z8.literal("http"),
+    url: z8.string(),
+    headers: z8.record(z8.string(), z8.string()).optional(),
+    headersFromEnv: z8.record(z8.string(), z8.string()).optional()
   }),
-  z9.object({
-    type: z9.literal("sse"),
-    url: z9.string(),
-    headers: z9.record(z9.string(), z9.string()).optional(),
-    headersFromEnv: z9.record(z9.string(), z9.string()).optional()
+  z8.object({
+    type: z8.literal("sse"),
+    url: z8.string(),
+    headers: z8.record(z8.string(), z8.string()).optional(),
+    headersFromEnv: z8.record(z8.string(), z8.string()).optional()
   })
 ]);
-var resolvedMcpServersSchema = z9.record(z9.string(), resolvedMcpServerSchema);
-var hostInjectedServersSchema = z9.record(z9.string(), z9.unknown());
-var turnRequestSchema = z9.object({
+var resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
+var hostInjectedServersSchema = z8.record(z8.string(), z8.unknown());
+var turnRequestSchema = z8.object({
   // Server-composed standing instructions: the core segment (body, tool naming, identity, agent
   // charter) and, after it, the conversation segment (workspace and room charters, skill indexes,
   // roster). One string to the adapter, current as of this dispatch.
-  systemPrompt: z9.string(),
+  systemPrompt: z8.string(),
   // The same text as its two ordered segments, so an adapter that writes standing text into the
   // conversation (Codex's input preamble) can tell which half changed. `systemPrompt` is
   // `joinStanding(standing)`. Optional: absent from an API older than the split, where
   // `systemPrompt` is the core alone and the conversation material rides `prompt`.
-  standing: z9.object({ core: z9.string(), conversation: z9.string() }).optional(),
+  standing: z8.object({ core: z8.string(), conversation: z8.string() }).optional(),
   // Server-composed per-turn user text (anchor reminder + the triggering message).
-  prompt: z9.string(),
+  prompt: z8.string(),
   // The multi-block user-message body (text + vision).
-  content: z9.array(contentBlockSchema),
+  content: z8.array(contentBlockSchema),
   // Portable-or-dialect run-config (above).
   config: resolvedRunConfigSchema,
-  // Abstract capability grants; the adapter maps them to tool names.
-  policy: hostPolicySchema,
   // Prior opaque session state, or null for a fresh session.
-  session: z9.string().nullable(),
+  session: z8.string().nullable(),
   // The cabane control-plane coordinates for this turn's MCP + post-back.
-  cabane: z9.object({
-    mcpUrl: z9.string(),
-    bearer: z9.string(),
-    activeConversationId: z9.string(),
+  cabane: z8.object({
+    mcpUrl: z8.string(),
+    bearer: z8.string(),
+    activeConversationId: z8.string(),
     // Scoped turn-control MCP URL. Codex and opencode mount it as `cabane_companion` with the bearer
     // and active-conversation header, for ask, withdraw_ask, wake_me, cancel_wake and skip_turn.
     // Claude Code mounts the companion's in-process instance instead. Optional; the companion
     // populates it.
-    turnControlUrl: z9.string().optional(),
+    turnControlUrl: z8.string().optional(),
     // Workspace coordinate retained for envelope compatibility. Current
     // adapters use MCP, whose workspace operations take workspaceId explicitly.
     // The companion supplies this field; it is not required by those adapters.
-    workspaceId: z9.string().optional()
+    workspaceId: z8.string().optional()
   }),
   // Machine-local resolution (host-filled): the checkout cwd, extra env from a
   // prepare hook, and the resolved user MCP servers.
-  local: z9.object({
-    cwd: z9.string().optional(),
-    env: z9.record(z9.string(), z9.string()).optional(),
+  local: z8.object({
+    cwd: z8.string().optional(),
+    env: z8.record(z8.string(), z8.string()).optional(),
     mcpServers: resolvedMcpServersSchema.optional(),
     // The values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` → complete header value). The
     // adapter merges them into the harness process's environment and nowhere else; the host never
     // merges them into its own. Absent when no server references one.
-    secretEnv: z9.record(z9.string(), z9.string()).optional(),
+    secretEnv: z8.record(z8.string(), z8.string()).optional(),
     // Machine-local claude-code knobs for an operator running their own companion — the auto-memory
     // escape hatch. `autoMemory: true` opts back into Claude Code's auto-memory (governed by the
     // operator's `.claude/settings.json`); absent/false keeps the adapter's force-off default
     // (`buildClaudeCodeOptions`).
-    claudeCode: z9.object({ autoMemory: z9.boolean().optional() }).optional()
+    claudeCode: z8.object({ autoMemory: z8.boolean().optional() }).optional(),
+    // Machine-local Codex facts the host read before the turn. `configSetsSandboxMode`: the
+    // person's own Codex `config.toml` names a `sandbox_mode`, so the adapter passes no sandbox
+    // flag and the file governs (`codexSandboxMode`). Absent/false → `danger-full-access`.
+    codex: z8.object({ configSetsSandboxMode: z8.boolean().optional() }).optional()
   }),
   // Host-owned injected servers (host-filled).
-  extra: z9.object({
+  extra: z8.object({
     mcpServers: hostInjectedServersSchema
   })
 });
@@ -2919,12 +2894,12 @@ function standingSegments(req) {
 }
 
 // packages/agent-runtime/src/conformance.ts
-import { z as z10 } from "zod";
-var conformanceFixtureSchema = z10.object({
-  name: z10.string(),
+import { z as z9 } from "zod";
+var conformanceFixtureSchema = z9.object({
+  name: z9.string(),
   request: turnRequestSchema,
-  nativeStream: z10.array(z10.unknown()),
-  expected: z10.array(turnEventSchema)
+  nativeStream: z9.array(z9.unknown()),
+  expected: z9.array(turnEventSchema)
 });
 
 // packages/agent-runtime/src/transcript.ts
@@ -3189,24 +3164,7 @@ function envResolvedFrom(server, secretEnv) {
 }
 
 // packages/agent-runtime/src/claude-code/policy.ts
-import { z as z11 } from "zod";
-var HOST_FS_TOOLS = [
-  // shell + local filesystem
-  "Bash",
-  "Read",
-  "Write",
-  "Edit",
-  "Glob",
-  "Grep",
-  // notebook tools (host-fs, Jupyter) — same host reach as Read/Write/Edit
-  "NotebookEdit",
-  "NotebookRead",
-  // git-worktree manipulation on the host checkout
-  "EnterWorktree",
-  "ExitWorktree",
-  // host code execution
-  "REPL"
-];
+import { z as z10 } from "zod";
 var SUBAGENT_TOOLS = ["Task", "Agent"];
 var UNSUPPORTED_TOOLS = ["AskUserQuestion"];
 var STRANDING_TOOLS = [
@@ -3228,29 +3186,23 @@ var STRANDING_TOOLS = [
   "Workflow"
 ];
 var DEFAULT_WEB_TOOLS = ["WebSearch", "WebFetch"];
-function disallowedToolsFor(policy) {
-  const tools = [...UNSUPPORTED_TOOLS, ...STRANDING_TOOLS];
-  if (!policy.subagents) tools.unshift(...SUBAGENT_TOOLS);
-  if (!policy.hostFs) tools.unshift(...HOST_FS_TOOLS);
-  return tools;
-}
 function withThinkingSummaries(thinking) {
   if (!thinking) return { type: "adaptive", display: "summarized" };
   if (thinking.type === "disabled") return thinking;
   return { display: "summarized", ...thinking };
 }
-var claudeCodeDialectSchema = z11.object({
-  thinking: z11.discriminatedUnion("type", [
-    z11.object({
-      type: z11.literal("adaptive"),
-      display: z11.enum(["summarized", "omitted"]).optional()
+var claudeCodeDialectSchema = z10.object({
+  thinking: z10.discriminatedUnion("type", [
+    z10.object({
+      type: z10.literal("adaptive"),
+      display: z10.enum(["summarized", "omitted"]).optional()
     }),
-    z11.object({
-      type: z11.literal("enabled"),
-      budgetTokens: z11.number().int().positive().optional(),
-      display: z11.enum(["summarized", "omitted"]).optional()
+    z10.object({
+      type: z10.literal("enabled"),
+      budgetTokens: z10.number().int().positive().optional(),
+      display: z10.enum(["summarized", "omitted"]).optional()
     }),
-    z11.object({ type: z11.literal("disabled") })
+    z10.object({ type: z10.literal("disabled") })
   ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
@@ -3313,13 +3265,13 @@ async function preToolUseHook(input) {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
       permissionDecision: "allow",
-      permissionDecisionReason: "coding mode: headless never-prompt (CT680)",
+      permissionDecisionReason: "headless never-prompt (CT680)",
       updatedInput: toolInput
     }
   };
 }
 function buildClaudeCodeOptions(req, augment) {
-  const { policy, config } = req;
+  const { config } = req;
   const cwd = req.local.cwd;
   const userServers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
@@ -3352,15 +3304,10 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
-  const allowedTools = dedupe([
-    cabaneGlob,
-    ...extraServerGlobs,
-    ...policy.web ? DEFAULT_WEB_TOOLS : []
-  ]);
-  const disallowedTools = dedupe([...disallowedToolsFor(policy)]);
+  const allowedTools = dedupe([cabaneGlob, ...extraServerGlobs, ...DEFAULT_WEB_TOOLS]);
+  const disallowedTools = dedupe([...UNSUPPORTED_TOOLS, ...STRANDING_TOOLS]);
   const resumeDecision = decideResume(req.session, cwd);
   const resume = "resume" in resumeDecision ? resumeDecision.resume : null;
   const freshReason = "fresh" in resumeDecision ? resumeDecision.reason : void 0;
@@ -3378,9 +3325,7 @@ function buildClaudeCodeOptions(req, augment) {
     // (`runtimeOptions['claude-code']`).
     thinking: withThinkingSummaries(readThinking(config.runtimeOptions)),
     ...config.effort ? { effort: config.effort } : {},
-    // Never merge arbitrary user `~/.claude` config; without `strictMcpConfig` the
-    // user's existing `cabane` MCP registration could shadow ours.
-    settingSources: [],
+    // Without `strictMcpConfig` the user's existing `cabane` MCP registration could shadow ours.
     strictMcpConfig: true,
     // Auto-memory off unless the operator opted back in (see above).
     ...devControlsAutoMemory ? {} : { settings: { autoMemoryEnabled: false } },
@@ -3416,31 +3361,19 @@ function buildClaudeCodeOptions(req, augment) {
     },
     ...resume ? { resume } : {}
   };
-  let options;
-  if (useCodingPreset) {
-    options = {
-      ...base,
-      systemPrompt: {
-        type: "preset",
-        preset: "claude_code",
-        append: req.systemPrompt,
-        snapshot: false
-      },
-      settingSources: ["user", "project"],
-      allowedTools,
-      disallowedTools,
-      hooks: { PreToolUse: [{ hooks: [preToolUseHook] }] }
-    };
-  } else {
-    options = {
-      ...base,
-      systemPrompt: { type: "custom", prompt: req.systemPrompt, snapshot: false },
-      allowedTools,
-      disallowedTools,
-      permissionMode: "bypassPermissions",
-      allowDangerouslySkipPermissions: true
-    };
-  }
+  const options = {
+    ...base,
+    systemPrompt: {
+      type: "preset",
+      preset: "claude_code",
+      append: req.systemPrompt,
+      snapshot: false
+    },
+    settingSources: ["user", "project"],
+    allowedTools,
+    disallowedTools,
+    hooks: { PreToolUse: [{ hooks: [preToolUseHook] }] }
+  };
   return { options: augment ? augment(options, req) : options, resume, freshReason };
 }
 function dedupe(xs) {
@@ -3920,15 +3853,6 @@ var claudeCodeAdapter = createClaudeCodeAdapter();
 
 // packages/agent-runtime/src/claude-code/conformance.ts
 var ABORT_SENTINEL = { __abortHere: true };
-var CABANE_POLICY = {
-  hostFs: false,
-  web: true,
-  browser: false,
-  userMcp: false,
-  subagents: false,
-  scheduling: "never",
-  uiPrompts: "never"
-};
 var CWD = "/env/here";
 var HEALTHY_MCP_INVENTORY = {
   initReceived: true,
@@ -3942,7 +3866,6 @@ function makeRequest(overrides2 = {}) {
     content: [{ type: "text", text: "hi there" }],
     // The adapter rejects a null model, so the fixture carries a real bare SDK id.
     config: { model: "claude-opus-4-8" },
-    policy: CABANE_POLICY,
     session: null,
     cabane: { mcpUrl: "https://cabane.test/api/mcp", bearer: "tok", activeConversationId: "conv" },
     local: { cwd: CWD },
@@ -4689,35 +4612,17 @@ function sealHeld(held, terminal) {
 }
 
 // packages/agent-runtime/src/opencode/policy.ts
-import { z as z12 } from "zod";
-var OPENCODE_HOST_TOOLS = [
-  "bash",
-  "edit",
-  "write",
-  "read",
-  "grep",
-  "glob",
-  "list",
-  "patch"
-];
-var OPENCODE_WEB_TOOLS = ["webfetch"];
-var OPENCODE_SUBAGENT_TOOLS = ["task"];
+import { z as z11 } from "zod";
 var OPENCODE_SCHEDULING_TOOLS = [];
 var OPENCODE_UI_PROMPT_TOOLS = ["question"];
-function opencodeToolPolicy(policy) {
+function opencodeTools() {
   const tools = {};
-  const deny = (names) => {
-    for (const n of names) tools[n] = false;
-  };
-  if (!policy.hostFs) deny(OPENCODE_HOST_TOOLS);
-  if (!policy.subagents) deny(OPENCODE_SUBAGENT_TOOLS);
-  if (!policy.web) deny(OPENCODE_WEB_TOOLS);
-  deny(OPENCODE_SCHEDULING_TOOLS);
-  deny(OPENCODE_UI_PROMPT_TOOLS);
-  return { tools, allowAllHostTools: policy.hostFs };
-}
-var opencodeDialectSchema = z12.object({
-  agent: z12.string().min(1).optional()
+  for (const name of [...OPENCODE_SCHEDULING_TOOLS, ...OPENCODE_UI_PROMPT_TOOLS])
+    tools[name] = false;
+  return tools;
+}
+var opencodeDialectSchema = z11.object({
+  agent: z11.string().min(1).optional()
 }).loose();
 function readOpencodeDialect(runtimeOptions) {
   const parsed = opencodeDialectSchema.safeParse(runtimeOptions?.["opencode"] ?? {});
@@ -4736,18 +4641,16 @@ var CABANE_MCP_SERVER2 = "cabane";
 var TURN_CONTROL_MCP_SERVER = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER2 = "x-cabane-active-conversation";
 function buildRunSpec(req, resumeSessionId) {
-  const { policy, config } = req;
+  const { config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readOpencodeDialect(config.runtimeOptions);
-  const { tools, allowAllHostTools } = opencodeToolPolicy(policy);
   return {
     resumeSessionId,
     directory,
     model: config.model ? parseOpencodeModel(config.model) : null,
     systemPrompt: req.systemPrompt,
     parts: buildParts(req),
-    tools,
-    allowAllHostTools,
+    tools: opencodeTools(),
     ...dialect.agent ? { agent: dialect.agent } : {},
     mcp: buildMcp(req),
     // Every server this turn installs with a credential resolved into it: a remote one's
@@ -4879,11 +4782,12 @@ function createHttpOpencodeTransport(opts) {
   const doFetch = opts.fetchImpl ?? fetch;
   return {
     async run(spec, signal) {
+      const url = scopedUrl(base, spec.directory);
       const release = await acquireServerTurnLock(base);
       if (signal.aborted) release();
       else signal.addEventListener("abort", release, { once: true });
       try {
-        const eventRes = await doFetch(`${base}/event`, {
+        const eventRes = await doFetch(url("/event"), {
           headers: { accept: "text/event-stream" },
           signal
         });
@@ -4893,7 +4797,7 @@ function createHttpOpencodeTransport(opts) {
         let sessionId = spec.resumeSessionId;
         let created = false;
         if (!sessionId) {
-          const res = await doFetch(`${base}/session`, {
+          const res = await doFetch(url("/session"), {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: JSON.stringify({ body: {} }),
@@ -4905,9 +4809,9 @@ function createHttpOpencodeTransport(opts) {
           sessionId = json.id;
           created = true;
         }
-        await installMcp(doFetch, base, spec, signal);
+        await installMcp(doFetch, url, spec, signal);
         const promptRes = await doFetch(
-          `${base}/session/${encodeURIComponent(sessionId)}/prompt_async`,
+          url(`/session/${encodeURIComponent(sessionId)}/prompt_async`),
           {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -4926,7 +4830,7 @@ function createHttpOpencodeTransport(opts) {
         }
         const sid = sessionId;
         const onAbort = () => {
-          void doFetch(`${base}/session/${encodeURIComponent(sid)}/abort`, {
+          void doFetch(url(`/session/${encodeURIComponent(sid)}/abort`), {
             method: "POST"
           }).catch(() => {
           });
@@ -4938,7 +4842,13 @@ function createHttpOpencodeTransport(opts) {
           created,
           directory: spec.directory,
           // The lock is released when this stream finishes draining.
-          events: releaseAfter(parseSseStream(eventRes.body, sessionId, signal), release)
+          events: releaseAfter(
+            approvePermissions(
+              parseSseStream(eventRes.body, sessionId, signal),
+              (ev) => replyToPermission(doFetch, url, ev, signal)
+            ),
+            release
+          )
         };
       } catch (err) {
         release();
@@ -4959,16 +4869,16 @@ var SCRUBBED_MCP_CONFIG = {
   url: "http://127.0.0.1:9/cabane-removed",
   enabled: false
 };
-async function installMcp(doFetch, base, spec, signal) {
+async function installMcp(doFetch, url, spec, signal) {
   const [live, configured] = await Promise.all([
-    getJson(doFetch, `${base}/mcp`, signal),
-    getJson(doFetch, `${base}/config`, signal)
+    getJson(doFetch, url("/mcp"), signal),
+    getJson(doFetch, url("/config"), signal)
   ]);
   const operatorOwned = new Set(Object.keys(asRecord2(asRecord2(configured).mcp)));
   const stale = Object.keys(asRecord2(live)).filter(
     (name) => !(name in spec.mcp) && !operatorOwned.has(name)
   );
-  await Promise.all(stale.map((name) => postMcp(doFetch, base, name, SCRUBBED_MCP_CONFIG, signal)));
+  await Promise.all(stale.map((name) => postMcp(doFetch, url, name, SCRUBBED_MCP_CONFIG, signal)));
   const shadowing = (spec.credentialServers ?? []).filter((name) => operatorOwned.has(name));
   if (shadowing.length > 0) {
     throw new Error(
@@ -4976,11 +4886,11 @@ async function installMcp(doFetch, base, spec, signal) {
     );
   }
   await Promise.all(
-    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, base, name, config, signal))
+    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, url, name, config, signal))
   );
 }
-async function postMcp(doFetch, base, name, config, signal) {
-  const res = await doFetch(`${base}/mcp`, {
+async function postMcp(doFetch, url, name, config, signal) {
+  const res = await doFetch(url("/mcp"), {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({ name, config }),
@@ -5044,6 +4954,33 @@ function belongsToSession(ev, sessionId) {
   if (typeof infoSid === "string") return infoSid === sessionId;
   return true;
 }
+async function* approvePermissions(events, reply2) {
+  for await (const ev of events) {
+    if (ev.type === "permission.asked" || ev.type === "permission.v2.asked") await reply2(ev);
+    yield ev;
+  }
+}
+async function replyToPermission(doFetch, url, ev, signal) {
+  const props = asRecord2(ev.properties);
+  const id = typeof props.id === "string" ? props.id : null;
+  const sessionId = typeof props.sessionID === "string" ? props.sessionID : null;
+  if (!id) throw new Error(`opencode: ${ev.type} carried no request id`);
+  const target = ev.type === "permission.v2.asked" && sessionId ? url(
+    `/api/session/${encodeURIComponent(sessionId)}/permission/${encodeURIComponent(id)}/reply`,
+    { unscoped: true }
+  ) : url(`/permission/${encodeURIComponent(id)}/reply`);
+  const res = await doFetch(target, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ reply: "once" }),
+    signal
+  });
+  if (!res.ok) throw new Error(`opencode: permission reply failed (HTTP ${res.status})`);
+}
+function scopedUrl(base, directory) {
+  const scope = directory ? `directory=${encodeURIComponent(directory)}` : "";
+  return (path, opts) => scope && !opts?.unscoped ? `${base}${path}${path.includes("?") ? "&" : "?"}${scope}` : base + path;
+}
 function trimSlash(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
@@ -5106,15 +5043,6 @@ var opencodeAdapter = createOpencodeAdapter();
 var ABORT_SENTINEL2 = { __abortHere: true };
 var NEW_SESSION_ID = "sess_new";
 var BOUNDED_NOTICE = "You've hit your usage limit \xB7 ".padEnd(200, "x");
-var COMPANION_POLICY = {
-  hostFs: false,
-  web: true,
-  browser: true,
-  userMcp: true,
-  subagents: false,
-  scheduling: "never",
-  uiPrompts: "never"
-};
 var DIR = "/env/here";
 function makeRequest2(overrides2 = {}) {
   return {
@@ -5122,7 +5050,6 @@ function makeRequest2(overrides2 = {}) {
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
     config: { model: "deepseek/deepseek-chat" },
-    policy: COMPANION_POLICY,
     session: null,
     cabane: { mcpUrl: "https://cabane.test/api/mcp", bearer: "tok", activeConversationId: "conv" },
     local: { cwd: DIR },
@@ -5928,27 +5855,13 @@ function sealHeld2(held, terminal) {
 }
 
 // packages/agent-runtime/src/codex/policy.ts
-import { z as z13 } from "zod";
-function codexToolPolicy(policy) {
-  return policy.hostFs ? {
-    sandboxMode: "danger-full-access",
-    // Headless: nothing to approve, because nothing is denied.
-    approvalPolicy: "never",
-    // Full access means the command network is open regardless of the grant —
-    // recorded as `true` so the value never claims a restriction that isn't
-    // enforced.
-    networkAccessEnabled: true
-  } : {
-    sandboxMode: "read-only",
-    // Headless: the sandbox is the boundary; never pause for a human.
-    approvalPolicy: "never",
-    // Retained in the policy value for symmetry; read-only ignores it.
-    networkAccessEnabled: policy.web
-  };
+import { z as z12 } from "zod";
+function codexSandboxMode(local) {
+  return local.codex?.configSetsSandboxMode ? null : "danger-full-access";
 }
 var CODEX_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
-var codexDialectSchema = z13.object({
-  modelReasoningEffort: z13.enum(CODEX_REASONING_EFFORTS).optional()
+var codexDialectSchema = z12.object({
+  modelReasoningEffort: z12.enum(CODEX_REASONING_EFFORTS).optional()
 }).loose();
 function readCodexDialect(runtimeOptions) {
   const parsed = codexDialectSchema.safeParse(runtimeOptions?.["codex"] ?? {});
@@ -5972,14 +5885,12 @@ var ENV_ENVELOPE_KEYS = [
   "CABANE_PLAYGROUND_BIN",
   "CABANE_CONVERSATION_ID",
   "CABANE_AGENT_ID",
-  "CABANE_CONVERSATION_TITLE",
-  "CABANE_HOST_ACCESS"
+  "CABANE_CONVERSATION_TITLE"
 ];
-function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadStanding = null, imagePaths = []) {
-  const { policy, config } = req;
+function buildRunSpec2(req, resumeThreadId, threadStanding = null, imagePaths = []) {
+  const { config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
-  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   const segments = standingSegments(req);
   const conversationText = segments.conversation.trim();
@@ -5989,25 +5900,24 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadStand
   };
   const resumed = resumeThreadId !== null;
   const held = resumed ? threadStanding : null;
-  const viaInput = baseInstructionsFile === null;
   const preamble = {
-    core: viaInput && (held?.core ?? null) !== fingerprints.core,
+    core: (held?.core ?? null) !== fingerprints.core,
     // Compared both ways: a held segment that is now empty differs from it, and nothing held
     // equals nothing to send.
-    conversation: viaInput && (held?.conversation ?? null) !== fingerprints.conversation
+    conversation: (held?.conversation ?? null) !== fingerprints.conversation
   };
   return {
     resumeThreadId,
     directory,
     model,
-    policy: codexToolPolicy(policy),
+    sandboxMode: codexSandboxMode(req.local),
+    approvalPolicy: "never",
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    baseInstructionsFile,
     input: withImages(buildInput(req, segments, preamble, resumed), imagePaths),
     preamble,
     fingerprints,
-    config: buildConfig(req, baseInstructionsFile),
+    config: buildConfig(req),
     secretEnv: codexSecretEnv(req)
   };
 }
@@ -6052,7 +5962,7 @@ function withImages(text, imagePaths) {
     ...imagePaths.map((path) => ({ type: "local_image", path }))
   ];
 }
-function buildConfig(req, baseInstructionsFile) {
+function buildConfig(req) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -6118,9 +6028,6 @@ function buildConfig(req, baseInstructionsFile) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
-    // The no-host-access prompt replacement — Cabane's composed prompt becomes Codex's base
-    // instructions, and Codex's environment preamble goes with the harness prompt it belonged to.
-    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
 }
@@ -6196,10 +6103,10 @@ function buildConfigOverrides(config) {
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
-    sandboxMode: spec.policy.sandboxMode,
+    ...spec.sandboxMode ? { sandboxMode: spec.sandboxMode } : {},
     workingDirectory: spec.directory,
     skipGitRepoCheck: spec.skipGitRepoCheck,
-    approvalPolicy: spec.policy.approvalPolicy,
+    approvalPolicy: spec.approvalPolicy,
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
@@ -6295,23 +6202,6 @@ function createCodexAdapter(deps = {}) {
           );
         }
       }
-      let instructions = null;
-      if (!req.policy.hostFs) {
-        if (!deps.writeInstructionsFile) {
-          deps.onWarn?.(
-            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
-          );
-        } else {
-          try {
-            instructions = await deps.writeInstructionsFile(req.systemPrompt);
-          } catch (err) {
-            deps.onWarn?.(
-              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
-              { err: err instanceof Error ? err.message : String(err) }
-            );
-          }
-        }
-      }
       let images = null;
       try {
         const imageUrls = req.content.flatMap((b) => b.type === "image" ? [b.source.url] : []);
@@ -6335,13 +6225,7 @@ function createCodexAdapter(deps = {}) {
           }
           if (signal.aborted) return;
         }
-        const spec = buildRunSpec2(
-          req,
-          resumeThreadId,
-          instructions?.path ?? null,
-          threadStanding,
-          images?.paths ?? []
-        );
+        const spec = buildRunSpec2(req, resumeThreadId, threadStanding, images?.paths ?? []);
         if (spec.model === null) {
           deps.onWarn?.("Codex is using its default model because no model was resolved", {
             model: req.config.model
@@ -6383,15 +6267,6 @@ function createCodexAdapter(deps = {}) {
             });
           }
         }
-        if (instructions) {
-          try {
-            await instructions.cleanup();
-          } catch (err) {
-            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
-              err: err instanceof Error ? err.message : String(err)
-            });
-          }
-        }
       }
     }
   };
@@ -6402,15 +6277,6 @@ var codexAdapter = createCodexAdapter();
 var ABORT_SENTINEL3 = { __abortHere: true };
 var NEW_THREAD_ID = "th_new";
 var BOUNDED_NOTICE2 = "You've hit your usage limit \xB7 ".padEnd(200, "x");
-var COMPANION_POLICY2 = {
-  hostFs: false,
-  web: true,
-  browser: true,
-  userMcp: true,
-  subagents: false,
-  scheduling: "never",
-  uiPrompts: "never"
-};
 var DIR2 = "/env/here";
 var PROMPT = "system";
 function makeRequest3(overrides2 = {}) {
@@ -6422,7 +6288,6 @@ function makeRequest3(overrides2 = {}) {
     // Behavioural fixtures use the model-less token (no `resolvedModel` emitted); a dedicated capture
     // fixture sets a real model and effort.
     config: { model: null },
-    policy: COMPANION_POLICY2,
     session: null,
     cabane: { mcpUrl: "https://cabane.test/api/mcp", bearer: "tok", activeConversationId: "conv" },
     local: { cwd: DIR2 },
@@ -7454,52 +7319,47 @@ function classifyStopError(message) {
 }
 
 // src/runner/protocol.ts
-import { z as z15 } from "zod";
+import { z as z14 } from "zod";
 
 // src/run-config.ts
-import { z as z14 } from "zod";
-var mcpStdioServerSchema = z14.object({
-  type: z14.literal("stdio").optional(),
-  command: z14.string().min(1),
-  args: z14.array(z14.string()).optional(),
-  env: z14.record(z14.string(), z14.string()).optional(),
+import { z as z13 } from "zod";
+var mcpStdioServerSchema = z13.object({
+  type: z13.literal("stdio").optional(),
+  command: z13.string().min(1),
+  args: z13.array(z13.string()).optional(),
+  env: z13.record(z13.string(), z13.string()).optional(),
   // Variable → the name of a `secretEnv` entry holding its value. Set by the server on a
   // room's shared browser, whose connect URL is a credential.
-  envFromEnv: z14.record(z14.string(), z14.string()).optional()
+  envFromEnv: z13.record(z13.string(), z13.string()).optional()
 });
-var mcpHttpServerSchema = z14.object({
-  type: z14.literal("http"),
-  url: z14.string().url(),
-  headers: z14.record(z14.string(), z14.string()).optional(),
+var mcpHttpServerSchema = z13.object({
+  type: z13.literal("http"),
+  url: z13.string().url(),
+  headers: z13.record(z13.string(), z13.string()).optional(),
   // Header → the name of a `secretEnv` entry holding its value. Set by
   // the server on a room connection's entry, and by `resolveMcpSecrets` on a
   // header whose `${VAR}` it resolved.
-  headersFromEnv: z14.record(z14.string(), z14.string()).optional()
+  headersFromEnv: z13.record(z13.string(), z13.string()).optional()
 });
-var mcpSseServerSchema = z14.object({
-  type: z14.literal("sse"),
-  url: z14.string().url(),
-  headers: z14.record(z14.string(), z14.string()).optional(),
+var mcpSseServerSchema = z13.object({
+  type: z13.literal("sse"),
+  url: z13.string().url(),
+  headers: z13.record(z13.string(), z13.string()).optional(),
   // Header → the name of a `secretEnv` entry holding its value. Set by
   // the server on a room connection's entry, and by `resolveMcpSecrets` on a
   // header whose `${VAR}` it resolved.
-  headersFromEnv: z14.record(z14.string(), z14.string()).optional()
+  headersFromEnv: z13.record(z13.string(), z13.string()).optional()
 });
-var mcpServerDefSchema = z14.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-var thinkingConfigSchema = z14.discriminatedUnion("type", [
-  z14.object({ type: z14.literal("adaptive") }),
-  z14.object({ type: z14.literal("enabled"), budgetTokens: z14.number().int().positive().optional() }),
-  z14.object({ type: z14.literal("disabled") })
+var mcpServerDefSchema = z13.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+var thinkingConfigSchema = z13.discriminatedUnion("type", [
+  z13.object({ type: z13.literal("adaptive") }),
+  z13.object({ type: z13.literal("enabled"), budgetTokens: z13.number().int().positive().optional() }),
+  z13.object({ type: z13.literal("disabled") })
 ]);
-var effortSchema = z14.enum(["low", "medium", "high", "xhigh", "max"]);
-var runConfigSchema = z14.object({
-  // `true` grants the host filesystem/shell; absent is the locked surface. Kept
-  // in lockstep with `@cabane/shared`'s
-  // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
-  // stripped, so an older companion riding a newer server never rejects the config).
-  hostAccess: z14.boolean().optional(),
-  mcpServers: z14.record(z14.string(), mcpServerDefSchema).optional(),
-  model: z14.string().min(1).optional(),
+var effortSchema = z13.enum(["low", "medium", "high", "xhigh", "max"]);
+var runConfigSchema = z13.object({
+  mcpServers: z13.record(z13.string(), mcpServerDefSchema).optional(),
+  model: z13.string().min(1).optional(),
   thinking: thinkingConfigSchema.optional(),
   effort: effortSchema.optional()
 });
@@ -7527,56 +7387,56 @@ var RUNNER_ENV = {
   // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
   spec: "CABANE_RUNNER_SPEC"
 };
-var runtimeHealthSchema = z15.object({
-  quotaState: z15.enum(["ok", "limited", "auth_expired", "unknown"]),
-  limitedUntil: z15.string().nullable(),
-  lastError: z15.string().nullable()
+var runtimeHealthSchema = z14.object({
+  quotaState: z14.enum(["ok", "limited", "auth_expired", "unknown"]),
+  limitedUntil: z14.string().nullable(),
+  lastError: z14.string().nullable()
 });
-var runnerSpecSchema = z15.object({
-  deviceId: z15.string().optional(),
+var runnerSpecSchema = z14.object({
+  deviceId: z14.string().optional(),
   // The launcher's boot id: the one its heartbeat carries, so a runner's lease
   // matches the device that holds it.
-  bootId: z15.string(),
-  workspaceId: z15.string(),
-  workspaceSlug: z15.string(),
-  agentId: z15.string(),
-  agentUsername: z15.string(),
-  agentName: z15.string(),
+  bootId: z14.string(),
+  workspaceId: z14.string(),
+  workspaceSlug: z14.string(),
+  agentId: z14.string(),
+  agentUsername: z14.string(),
+  agentName: z14.string(),
   local: localAgentConfigSchema,
   runConfig: runConfigSchema,
   // The device's `root`, resolved by the launcher: the pair directory the turn
   // stands in when nothing else names one lives under it (`work-dir.ts`).
-  workRoot: z15.string(),
-  opencodeServerUrl: z15.string().optional(),
-  claudeCodeAvailable: z15.boolean(),
-  codexAvailable: z15.boolean(),
-  idleTimeoutMs: z15.number().int().positive().optional(),
-  totalTimeoutMs: z15.number().int().positive().optional(),
-  leaseRenewalMs: z15.number().int().positive().optional(),
-  preparingRowDelayMs: z15.number().int().nonnegative().optional(),
+  workRoot: z14.string(),
+  opencodeServerUrl: z14.string().optional(),
+  claudeCodeAvailable: z14.boolean(),
+  codexAvailable: z14.boolean(),
+  idleTimeoutMs: z14.number().int().positive().optional(),
+  totalTimeoutMs: z14.number().int().positive().optional(),
+  leaseRenewalMs: z14.number().int().positive().optional(),
+  preparingRowDelayMs: z14.number().int().nonnegative().optional(),
   // Whether the turn writes a transcript, into the device's own directory
   // (`transcriptsDir()`).
-  transcripts: z15.boolean(),
-  logLevel: z15.string(),
+  transcripts: z14.boolean(),
+  logLevel: z14.string(),
   // The launcher's connector-health observations, by runtime, as of the start.
-  connectorHealth: z15.record(z15.string(), runtimeHealthSchema),
+  connectorHealth: z14.record(z14.string(), runtimeHealthSchema),
   // True when this (conversation, agent) pair was already told its session
   // could not be saved: the notice is once per pair, not once per process.
-  sessionWriteNoticeClaimed: z15.boolean(),
+  sessionWriteNoticeClaimed: z14.boolean(),
   // The runner's identity, minted with its credential. The start
   // PATCH carries it so the lease knows which runner holds the span.
-  runnerId: z15.string()
+  runnerId: z14.string()
 });
-var dispatchSchema = z15.object({
-  type: z15.literal("device:dispatch_requested"),
-  agentId: z15.string(),
-  deviceId: z15.string(),
-  conversationId: z15.string(),
-  messageId: z15.string(),
-  episode: z15.number().int().optional()
+var dispatchSchema = z14.object({
+  type: z14.literal("device:dispatch_requested"),
+  agentId: z14.string(),
+  deviceId: z14.string(),
+  conversationId: z14.string(),
+  messageId: z14.string(),
+  episode: z14.number().int().optional()
 });
-var credentialsSchema = z15.object({
-  credential: z15.string().startsWith("cabrn_")
+var credentialsSchema = z14.object({
+  credential: z14.string().startsWith("cabrn_")
 });
 function runnerEnv(input) {
   return {
@@ -7965,7 +7825,7 @@ import { join as join13 } from "path";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z16 } from "zod";
+import { z as z15 } from "zod";
 var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
 var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
 var ASK_TOOL = "ask";
@@ -7977,20 +7837,21 @@ var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
 var CANCEL_WAKE_TOOL = "cancel_wake";
 var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
 
-// src/codex-instructions.ts
-import { mkdtemp, rm, writeFile } from "fs/promises";
-import { tmpdir } from "os";
+// src/codex-config.ts
+import { readFile as readFile2 } from "fs/promises";
+import { homedir as homedir6 } from "os";
 import { join as join14 } from "path";
+import { parse } from "smol-toml";
 
 // src/codex-images.ts
-import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
 import { join as join15 } from "path";
 
 // src/codex-compactions.ts
 import { createReadStream } from "fs";
 import { readdir } from "fs/promises";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { join as join16 } from "path";
 import { createInterface as createInterface2 } from "readline";
 
@@ -8005,12 +7866,12 @@ import { join as join17 } from "path";
 // src/secrets.ts
 import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { join as join18 } from "path";
-import { z as z17 } from "zod";
+import { z as z16 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
   return join18(cabaneDir(), "secrets.json");
 }
-var secretStoreSchema = z17.record(z17.string(), z17.string());
+var secretStoreSchema = z16.record(z16.string(), z16.string());
 function loadSecretStore() {
   const path = secretsPath();
   if (!existsSync10(path)) return makeStore({});
@@ -8361,7 +8222,7 @@ var DeviceLocks = class {
 // src/manifest.ts
 var DEVICE_MANIFEST = {
   runtimes: [{ name: "claude-code", version: null }],
-  capabilities: { hostFs: true, browser: true, userMcp: true }
+  capabilities: { browser: true, userMcp: true }
 };
 function buildCompanionManifest(opts) {
   const v = opts.versions ?? {};
@@ -8465,7 +8326,7 @@ function emptyHarnessVersions() {
 }
 
 // src/harness-copy.ts
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { join as join21 } from "path";
 var HARNESS_LABELS = {
   "claude-code": "Claude Code",
@@ -8480,7 +8341,7 @@ function failureText(runtime, reason) {
     case "spawn":
       return `Couldn't check whether ${label} is signed in: Cabane's bundled ${label} wouldn't start. Repair it with  ${repairSteps()}  and try again.${spaced(repairCost())}`;
     case "config":
-      return `Couldn't check whether ${label} is signed in: its configuration file didn't load${runtime === "codex" ? ` (${tildePath(join21(homedir7(), ".codex", "config.toml"))})` : ""}. Fix it, then try again.`;
+      return `Couldn't check whether ${label} is signed in: its configuration file didn't load${runtime === "codex" ? ` (${tildePath(join21(homedir8(), ".codex", "config.toml"))})` : ""}. Fix it, then try again.`;
     case "unreadable":
       return `Couldn't check whether ${label} is signed in: it answered in a way Cabane couldn't read. Try again, and if it keeps happening, update Cabane.`;
   }
@@ -9227,27 +9088,27 @@ function compareVersions(a, b) {
 // src/update-state.ts
 import { mkdirSync as mkdirSync13, readFileSync as readFileSync13, renameSync as renameSync8, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname10, join as join25 } from "path";
-import { z as z18 } from "zod";
-var resultSchema = z18.object({
-  kind: z18.enum(["updated", "rolled_back", "failed"]),
-  from: z18.string(),
-  to: z18.string(),
-  at: z18.string(),
-  reason: z18.string().optional()
+import { z as z17 } from "zod";
+var resultSchema = z17.object({
+  kind: z17.enum(["updated", "rolled_back", "failed"]),
+  from: z17.string(),
+  to: z17.string(),
+  at: z17.string(),
+  reason: z17.string().optional()
 });
-var pendingSchema = z18.object({
-  from: z18.string(),
+var pendingSchema = z17.object({
+  from: z17.string(),
   // The package root `current` pointed at before the swap, so a rollback can point it back.
-  fromRoot: z18.string(),
-  to: z18.string(),
-  at: z18.string(),
-  boots: z18.number().int().nonnegative()
+  fromRoot: z17.string(),
+  to: z17.string(),
+  at: z17.string(),
+  boots: z17.number().int().nonnegative()
 });
-var stateSchema = z18.object({
-  server: z18.object({ latest: z18.string(), minimum: z18.string(), at: z18.string() }).optional(),
+var stateSchema = z17.object({
+  server: z17.object({ latest: z17.string(), minimum: z17.string(), at: z17.string() }).optional(),
   pending: pendingSchema.optional(),
   lastResult: resultSchema.optional(),
-  failed: z18.object({ version: z18.string(), attempts: z18.number().int(), at: z18.string() }).optional()
+  failed: z17.object({ version: z17.string(), attempts: z17.number().int(), at: z17.string() }).optional()
 });
 function updateStatePath(dir2 = cabaneDir()) {
   return join25(dir2, "update.json");
@@ -10143,7 +10004,6 @@ var CompanionSupervisor = class {
           agentId: it.agentId,
           username: it.agentUsername,
           displayName: it.agentDisplayName,
-          mode: runConfig.hostAccess ? "full" : "none",
           hasCredential: false,
           missingSecrets: missing
         });
@@ -10163,7 +10023,6 @@ var CompanionSupervisor = class {
         agentId: it.agentId,
         username: it.agentUsername,
         displayName: it.agentDisplayName,
-        mode: runConfig.hostAccess ? "full" : "none",
         hasCredential: true,
         missingSecrets: missing
       });