@cabane/companion 0.6.191 → 0.6.193

package/dist/runtime.js

@@ -7296,8 +7296,8 @@ var ConnectorHealthStore = class {
 
 // src/dispatcher.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
+import { join as join21 } from "path";
 
 // src/runner/launch.ts
 import { createInterface } from "readline";
@@ -7487,7 +7487,8 @@ var dispatchSchema = z14.object({
 });
 var credentialsSchema = z14.object({
   credential: z14.string().startsWith("cabrn_"),
-  secrets: z14.record(z14.string(), z14.string()).optional()
+  secrets: z14.record(z14.string(), z14.string()).optional(),
+  grants: z14.record(z14.string(), z14.record(z14.string(), z14.string())).optional()
 });
 function runnerEnv(input) {
   return {
@@ -7501,7 +7502,8 @@ function runnerEnv(input) {
 function runnerStdin(input) {
   return `${JSON.stringify({
     credential: input.credential,
-    ...input.secrets ? { secrets: input.secrets } : {}
+    ...input.secrets ? { secrets: input.secrets } : {},
+    ...input.grants ? { grants: input.grants } : {}
   })}
 `;
 }
@@ -7659,7 +7661,12 @@ async function mintForRunner(opts, payload, handleOpts, signal, log) {
       // The one turn the credential will operate: this run's.
       turnId: handleOpts.turnId
     });
-    return { ok: true, credential: minted.credential, runnerId: minted.runnerId };
+    return {
+      ok: true,
+      credential: minted.credential,
+      runnerId: minted.runnerId,
+      deviceGrants: minted.deviceGrants ?? []
+    };
   } catch (err) {
     if (signal.aborted) return { ok: false, reason: "cancelled" };
     const status = err instanceof ApiError ? err.status : 0;
@@ -7754,10 +7761,12 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   try {
     const boxed = launch.boxed === true;
     const env = runnerExecEnv(launch.env ?? process.env, boxed);
+    const grants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
     const input = {
       baseUrl: opts.baseUrl,
       credential: minted.credential,
       ...boxed ? { secrets: launch.secrets?.() ?? {} } : {},
+      ...Object.keys(grants).length > 0 ? { grants } : {},
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
@@ -7894,13 +7903,72 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync9 } from "fs";
 
+// src/grants.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join13 } from "path";
+import { z as z15 } from "zod";
+var VARIABLE_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
+function allowedGrantVariable(name) {
+  return name.length <= 100 && VARIABLE_NAME_RE.test(name) && !name.startsWith("CABANE_");
+}
+function environmentSafe(value) {
+  return !value.includes("\0");
+}
+function grantsPath() {
+  return join13(cabaneDir(), "grants.json");
+}
+var grantsFileSchema = z15.record(z15.string(), z15.record(z15.string(), z15.string()));
+function readGrants(keys, report) {
+  if (keys.length === 0) return {};
+  const file = loadGrantsFile(report);
+  const out = {};
+  for (const key of keys) {
+    if (!allowedGrantVariable(key) || !Object.hasOwn(file, key)) continue;
+    const entry = {};
+    for (const [variable, value] of Object.entries(file[key])) {
+      if (allowedGrantVariable(variable) && environmentSafe(value)) entry[variable] = value;
+      else report.refusedVariable(key, variable);
+    }
+    out[key] = entry;
+  }
+  return out;
+}
+function loadGrantsFile(report) {
+  const path = grantsPath();
+  if (!existsSync9(path)) return {};
+  let raw;
+  try {
+    raw = readFileSync7(path, "utf8");
+  } catch (err) {
+    const code = err.code ?? "unknown error";
+    report.unreadable(`couldn't read ${path}: ${code}`);
+    return {};
+  }
+  if (raw.trim().length === 0) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    report.unreadable(`${path} is not valid JSON.`);
+    return {};
+  }
+  const result = grantsFileSchema.safeParse(parsed);
+  if (!result.success) {
+    report.unreadable(
+      `${path} must map a secret's variable name to an object of "VARIABLE": "value" pairs (e.g. { "HAS_PROD_ACCESS": { "RENDER_API_KEY": "rnd_\u2026" } }).`
+    );
+    return {};
+  }
+  return result.data;
+}
+
 // src/work-dir.ts
 import { statSync as statSync3 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
 var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
 var ASK_TOOL = "ask";
@@ -7915,19 +7983,19 @@ var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_T
 // src/codex-config.ts
 import { readFile as readFile2 } from "fs/promises";
 import { homedir as homedir6 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import { parse } from "smol-toml";
 
 // src/codex-images.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/codex-compactions.ts
 import { createReadStream } from "fs";
 import { readdir } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { createInterface as createInterface2 } from "readline";
 
 // src/prepare-failure.ts
@@ -7935,24 +8003,24 @@ import { spawn as spawn3 } from "child_process";
 import { hostname } from "os";
 
 // src/prepared.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
-import { join as join17 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
+import { join as join18 } from "path";
 
 // src/secrets.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join18 } from "path";
-import { z as z16 } from "zod";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { join as join19 } from "path";
+import { z as z17 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join18(cabaneDir(), "secrets.json");
+  return join19(cabaneDir(), "secrets.json");
 }
-var secretStoreSchema = z16.record(z16.string(), z16.string());
+var secretStoreSchema = z17.record(z17.string(), z17.string());
 function loadSecretValues() {
   const path = secretsPath();
-  if (!existsSync10(path)) return {};
+  if (!existsSync11(path)) return {};
   let raw;
   try {
-    raw = readFileSync8(path, "utf8");
+    raw = readFileSync9(path, "utf8");
   } catch (err) {
     throw new ConfigError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -8134,9 +8202,9 @@ function runBounded(path, args, env) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename as basename3, dirname as dirname7, join as join19 } from "path";
+import { basename as basename3, dirname as dirname7, join as join20 } from "path";
 function transcriptsDir() {
-  return join19(cabaneDir(), "transcripts");
+  return join20(cabaneDir(), "transcripts");
 }
 
 // src/turn-execution.ts
@@ -8239,7 +8307,7 @@ var Dispatcher = class {
 };
 
 // src/host-report.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
 import { userInfo as userInfo2 } from "os";
 function inContainer(signals) {
   if (signals.dockerenv) return true;
@@ -8250,11 +8318,11 @@ function inContainer(signals) {
 function readContainerSignals() {
   let cgroup = null;
   try {
-    cgroup = readFileSync9("/proc/1/cgroup", "utf8");
+    cgroup = readFileSync10("/proc/1/cgroup", "utf8");
   } catch {
     cgroup = null;
   }
-  return { dockerenv: existsSync12("/.dockerenv"), cgroup, env: process.env };
+  return { dockerenv: existsSync13("/.dockerenv"), cgroup, env: process.env };
 }
 function osUser() {
   try {
@@ -8491,7 +8559,7 @@ function checkReason(check) {
 
 // src/harness-copy.ts
 import { homedir as homedir8 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var HARNESS_LABELS = {
   "claude-code": "Claude Code",
   codex: "Codex",
@@ -8505,7 +8573,7 @@ function failureText(runtime, reason) {
     case "spawn":
       return `Couldn't check whether ${label} is signed in: Cabane's bundled ${label} wouldn't start. Repair it with  ${repairSteps()}  and try again.${spaced(repairCost())}`;
     case "config":
-      return `Couldn't check whether ${label} is signed in: its configuration file didn't load${runtime === "codex" ? ` (${tildePath(join21(homedir8(), ".codex", "config.toml"))})` : ""}. Fix it, then try again.`;
+      return `Couldn't check whether ${label} is signed in: its configuration file didn't load${runtime === "codex" ? ` (${tildePath(join22(homedir8(), ".codex", "config.toml"))})` : ""}. Fix it, then try again.`;
     case "unreadable":
       return `Couldn't check whether ${label} is signed in: it answered in a way Cabane couldn't read. Try again, and if it keeps happening, update Cabane.`;
   }
@@ -8762,15 +8830,15 @@ var DispatchClaims = class {
 
 // src/outbox.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync5,
   rmSync as rmSync7,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -8783,10 +8851,10 @@ var Outbox = class {
   // Resolved lazily (per call) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join22(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join23(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join22(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join23(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -8818,7 +8886,7 @@ var Outbox = class {
   // wedging the drain.
   list() {
     const dir2 = this.dir();
-    if (!existsSync13(dir2)) return [];
+    if (!existsSync14(dir2)) return [];
     let names;
     try {
       names = readdirSync3(dir2);
@@ -8828,9 +8896,9 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join22(dir2, name);
+      const full = join23(dir2, name);
       try {
-        const parsed = JSON.parse(readFileSync10(full, "utf8"));
+        const parsed = JSON.parse(readFileSync11(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
           entries.push(parsed);
         } else {
@@ -8864,7 +8932,7 @@ var Outbox = class {
   // different: it is positive evidence that nothing was ever queued here.
   maxSeqForTurn(turnId) {
     const dir2 = this.dir();
-    if (!existsSync13(dir2)) return 0;
+    if (!existsSync14(dir2)) return 0;
     const names = readdirSync3(dir2);
     const prefix = `${encodeURIComponent(turnId)}__`;
     let max = 0;
@@ -8884,7 +8952,7 @@ var Outbox = class {
   }
   size() {
     const dir2 = this.dir();
-    if (!existsSync13(dir2)) return 0;
+    if (!existsSync14(dir2)) return 0;
     try {
       return readdirSync3(dir2).filter((n) => n.endsWith(".json")).length;
     } catch {
@@ -9051,20 +9119,20 @@ var SseSubscriber = class {
 
 // src/updater.ts
 import { spawn as spawn6 } from "child_process";
-import { copyFileSync as copyFileSync2, existsSync as existsSync15, mkdirSync as mkdirSync14, renameSync as renameSync9, rmSync as rmSync10 } from "fs";
-import { dirname as dirname11, join as join26 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync16, mkdirSync as mkdirSync14, renameSync as renameSync9, rmSync as rmSync10 } from "fs";
+import { dirname as dirname11, join as join27 } from "path";
 
 // src/boot-rule.ts
 import {
   mkdirSync as mkdirSync11,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   realpathSync as realpathSync4,
   renameSync as renameSync6,
   rmSync as rmSync8,
   symlinkSync,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname8, join as join23 } from "path";
+import { dirname as dirname8, join as join24 } from "path";
 var UNCONFIRMED_WINDOW_MS = 10 * 6e4;
 var MAX_STAGE_ATTEMPTS = 3;
 function superseded(pending, ...running) {
@@ -9087,36 +9155,36 @@ function rolledBackState(state, pending, reason, now) {
 
 // src/install-layout.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   lstatSync,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   readdirSync as readdirSync4,
   realpathSync as realpathSync5,
   renameSync as renameSync7,
   rmSync as rmSync9,
   symlinkSync as symlinkSync2
 } from "fs";
-import { dirname as dirname9, join as join24 } from "path";
+import { dirname as dirname9, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function versionsDir() {
-  return join24(cabaneDir(), "versions");
+  return join25(cabaneDir(), "versions");
 }
 function currentLink() {
-  return join24(cabaneDir(), "current");
+  return join25(cabaneDir(), "current");
 }
 function bootGuardPath() {
-  return join24(cabaneDir(), "boot-guard.mjs");
+  return join25(cabaneDir(), "boot-guard.mjs");
 }
 function versionPackageRoot(version) {
-  return join24(versionsDir(), version, "node_modules", "@cabane", "companion");
+  return join25(versionsDir(), version, "node_modules", "@cabane", "companion");
 }
 function ownPackageRoot(moduleUrl = import.meta.url) {
   return dirname9(dirname9(fileURLToPath5(moduleUrl)));
 }
 function packageVersion(root) {
   try {
-    const pkg2 = JSON.parse(readFileSync12(join24(root, "package.json"), "utf8"));
+    const pkg2 = JSON.parse(readFileSync13(join25(root, "package.json"), "utf8"));
     return typeof pkg2.version === "string" ? pkg2.version : null;
   } catch {
     return null;
@@ -9125,7 +9193,7 @@ function packageVersion(root) {
 function currentRoot() {
   try {
     const root = realpathSync5(currentLink());
-    return existsSync14(join24(root, "dist", "cli.js")) ? root : null;
+    return existsSync15(join25(root, "dist", "cli.js")) ? root : null;
   } catch {
     return null;
   }
@@ -9144,11 +9212,11 @@ function pointCurrentAt(root) {
 }
 function pruneVersions(keep) {
   const dir2 = versionsDir();
-  if (!existsSync14(dir2)) return [];
+  if (!existsSync15(dir2)) return [];
   const removed = [];
   for (const name of readdirSync4(dir2)) {
     if (keep.includes(name)) continue;
-    rmSync9(join24(dir2, name), { recursive: true, force: true });
+    rmSync9(join25(dir2, name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -9166,36 +9234,36 @@ function compareVersions(a, b) {
 }
 
 // src/update-state.ts
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync13, renameSync as renameSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname10, join as join25 } from "path";
-import { z as z17 } from "zod";
-var resultSchema = z17.object({
-  kind: z17.enum(["updated", "rolled_back", "failed"]),
-  from: z17.string(),
-  to: z17.string(),
-  at: z17.string(),
-  reason: z17.string().optional()
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync14, renameSync as renameSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname10, join as join26 } from "path";
+import { z as z18 } from "zod";
+var resultSchema = z18.object({
+  kind: z18.enum(["updated", "rolled_back", "failed"]),
+  from: z18.string(),
+  to: z18.string(),
+  at: z18.string(),
+  reason: z18.string().optional()
 });
-var pendingSchema = z17.object({
-  from: z17.string(),
+var pendingSchema = z18.object({
+  from: z18.string(),
   // The package root `current` pointed at before the swap, so a rollback can point it back.
-  fromRoot: z17.string(),
-  to: z17.string(),
-  at: z17.string(),
-  boots: z17.number().int().nonnegative()
+  fromRoot: z18.string(),
+  to: z18.string(),
+  at: z18.string(),
+  boots: z18.number().int().nonnegative()
 });
-var stateSchema = z17.object({
-  server: z17.object({ latest: z17.string(), minimum: z17.string(), at: z17.string() }).optional(),
+var stateSchema = z18.object({
+  server: z18.object({ latest: z18.string(), minimum: z18.string(), at: z18.string() }).optional(),
   pending: pendingSchema.optional(),
   lastResult: resultSchema.optional(),
-  failed: z17.object({ version: z17.string(), attempts: z17.number().int(), at: z17.string() }).optional()
+  failed: z18.object({ version: z18.string(), attempts: z18.number().int(), at: z18.string() }).optional()
 });
 function updateStatePath(dir2 = cabaneDir()) {
-  return join25(dir2, "update.json");
+  return join26(dir2, "update.json");
 }
 function readUpdateState(path = updateStatePath()) {
   try {
-    const parsed = stateSchema.safeParse(JSON.parse(readFileSync13(path, "utf8")));
+    const parsed = stateSchema.safeParse(JSON.parse(readFileSync14(path, "utf8")));
     return parsed.success ? parsed.data : {};
   } catch {
     return {};
@@ -9236,12 +9304,12 @@ function versionToStage(input) {
   return latest;
 }
 function rollBack(pending, reason, now = /* @__PURE__ */ new Date()) {
-  if (existsSync15(pending.fromRoot)) pointCurrentAt(pending.fromRoot);
+  if (existsSync16(pending.fromRoot)) pointCurrentAt(pending.fromRoot);
   return updateUpdateState((state) => rolledBackState(state, pending, reason, now));
 }
 function writeBootGuard(root = ownPackageRoot()) {
-  const built = join26(root, "dist", "boot-guard.js");
-  if (!existsSync15(built)) return false;
+  const built = join27(root, "dist", "boot-guard.js");
+  if (!existsSync16(built)) return false;
   const target = bootGuardPath();
   mkdirSync14(dirname11(target), { recursive: true });
   const tmp = `${target}.${process.pid}.tmp`;
@@ -9280,17 +9348,17 @@ var runProcess = (command, args, opts = {}) => new Promise((resolve) => {
 async function stageVersion(version, harnesses, deps = {}) {
   const run = deps.run ?? runProcess;
   const node = deps.execPath ?? process.execPath;
-  const target = join26(versionsDir(), version);
+  const target = join27(versionsDir(), version);
   const placed = versionPackageRoot(version);
-  if (existsSync15(placed)) {
+  if (existsSync16(placed)) {
     if (!await verifyInstall(placed, version, harnesses, { run, execPath: node }))
       return { ok: true, root: placed };
   }
-  const npm = join26(dirname11(node), "npm");
-  if (!existsSync15(npm))
+  const npm = join27(dirname11(node), "npm");
+  if (!existsSync16(npm))
     return { ok: false, reason: `there is no npm beside Node at ${dirname11(node)}` };
   mkdirSync14(versionsDir(), { recursive: true });
-  const staging = join26(versionsDir(), `.${version}.staging-${process.pid}`);
+  const staging = join27(versionsDir(), `.${version}.staging-${process.pid}`);
   rmSync10(staging, { recursive: true, force: true });
   const installed = await run(
     npm,
@@ -9319,7 +9387,7 @@ async function stageVersion(version, harnesses, deps = {}) {
       return { ok: false, reason: `version ${version} isn't published yet`, unpublished: true };
     return { ok: false, reason: `npm couldn't install it: ${lastLine(installed.stderr)}` };
   }
-  const root = join26(staging, "node_modules", "@cabane", "companion");
+  const root = join27(staging, "node_modules", "@cabane", "companion");
   const verdict = await verifyInstall(root, version, harnesses, { run, execPath: node });
   if (verdict) {
     rmSync10(staging, { recursive: true, force: true });
@@ -9331,7 +9399,7 @@ async function stageVersion(version, harnesses, deps = {}) {
 }
 async function verifyInstall(root, version, harnesses, deps) {
   if (packageVersion(root) !== version) return `the installed package isn't version ${version}`;
-  const answered = await deps.run(deps.execPath, [join26(root, "dist", "bin.js"), "--version"], {
+  const answered = await deps.run(deps.execPath, [join27(root, "dist", "bin.js"), "--version"], {
     timeoutMs: 6e4,
     env: { ...process.env, CABANE_LAUNCH_SELF: "1" }
   });
@@ -9339,7 +9407,7 @@ async function verifyInstall(root, version, harnesses, deps) {
     return `it doesn't start: ${lastLine(answered.stderr) || "no version printed"}`;
   }
   if (harnesses.length === 0) return null;
-  const probed = await deps.run(deps.execPath, [join26(root, "dist", "postinstall.js"), "--json"], {
+  const probed = await deps.run(deps.execPath, [join27(root, "dist", "postinstall.js"), "--json"], {
     timeoutMs: 6e4
   });
   let resolutions = {};
@@ -10335,6 +10403,14 @@ var CompanionSupervisor = class {
             (m) => this.log.warn({ err: m }, "Could not read the secrets file for a boxed turn.")
           )
         } : {},
+        // Read per dispatch, for the secret variables its mint named and no others.
+        grants: (keys) => readGrants(keys, {
+          refusedVariable: (key, variable) => this.log.warn(
+            { key, variable },
+            "Skipped a variable in ~/.cabane/grants.json: its name must use capital letters, digits and underscores, not starting with CABANE_, and its value cannot contain a NUL character."
+          ),
+          unreadable: (message) => this.log.warn({ err: message }, "Could not read the grants file.")
+        }),
         ...this.runnerEnv ? { env: this.runnerEnv } : {},
         reportRunnerGone: (report) => this.reportRunnerGone(report),
         connectorHealth: this.connectorHealth,
@@ -11026,10 +11102,10 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync15, readFileSync as readFileSync14, rmSync as rmSync11, writeFileSync as writeFileSync9 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync15, readFileSync as readFileSync15, rmSync as rmSync11, writeFileSync as writeFileSync9 } from "fs";
+import { join as join28 } from "path";
 function crashMarkerPath() {
-  return join27(cabaneDir(), "last-error.json");
+  return join28(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
@@ -11041,15 +11117,15 @@ function recordCrash(rec) {
 function clearCrash() {
   try {
     const path = crashMarkerPath();
-    if (existsSync16(path)) rmSync11(path, { force: true });
+    if (existsSync17(path)) rmSync11(path, { force: true });
   } catch {
   }
 }
 
 // src/stray-companion.ts
 import { spawnSync } from "child_process";
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join28 } from "path";
+import { readFileSync as readFileSync16 } from "fs";
+import { join as join29 } from "path";
 var COMPANION_ENTRY = /@cabane\/companion\/|cabane-companion|(^|[\s/])cabane\s|\.cabane\/(versions|current|boot-guard)/;
 var START = /\sstart(\s|$)/;
 function companionStarts(psOutput) {
@@ -11066,7 +11142,7 @@ function companionStarts(psOutput) {
 }
 function stateDirOf(env) {
   const home = env.CABANE_COMPANION_HOME || env.HOME;
-  return home ? join28(home, ".cabane") : null;
+  return home ? join29(home, ".cabane") : null;
 }
 function envFromPsE(output, command) {
   const line = output.replace(/\n$/, "");
@@ -11081,7 +11157,7 @@ function envFromPsE(output, command) {
 function envFromProc(pid) {
   try {
     const env = {};
-    for (const entry of readFileSync15(`/proc/${pid}/environ`, "utf8").split("\0")) {
+    for (const entry of readFileSync16(`/proc/${pid}/environ`, "utf8").split("\0")) {
       const eq = entry.indexOf("=");
       if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.191",
+  "version": "0.6.193",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",
@@ -30,9 +30,9 @@
     "prepublishOnly": "pnpm build"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.296",
+    "@anthropic-ai/claude-agent-sdk": "0.3.303",
     "@clack/prompts": "1.8.1",
-    "@openai/codex-sdk": "0.162.1",
+    "@openai/codex-sdk": "0.163.0",
     "@hono/node-server": "1.19.14",
     "commander": "12.1.0",
     "eventsource-parser": "3.0.8",