@cabane/companion 0.6.20 → 0.6.22

package/dist/cli.js

@@ -295,6 +295,26 @@ var companionConfigSchema = z2.object({
   opencode: z2.object({
     serverUrl: z2.string().url()
   }).strict().optional(),
+  // CT1082: the Claude Code runtime, when the user connected it on this machine.
+  // The change this task exists for: Claude Code used to be the one harness a
+  // device exposed with no configuration — a `claude --version` exit-0 was taken as
+  // consent — and it is now the third config-driven harness, opted into exactly
+  // like codex. `claude` on PATH is still required (you can't run what isn't
+  // installed), but presence alone no longer exposes anything: the manifest
+  // advertises claude-code only when this block says so AND the binary is there.
+  //
+  // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
+  // Absent means the config predates this task — a device whose user was never
+  // asked — and the migration grandfathers it on first start. So every config
+  // written from here on carries the block explicitly, including a freshly-paired
+  // one, which starts at `enabled: false`: a new device is connected to nothing
+  // until its user says otherwise.
+  //
+  // Not to be confused with the per-agent `agents.<key>.claudeCode.autoMemory`
+  // above — that's one agent's memory switch, this is the device's connected set.
+  claudeCode: z2.object({
+    enabled: z2.boolean().optional()
+  }).strict().optional(),
   // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
   // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
   // the `@openai/codex-sdk` spawns per turn — so the config is just an opt-in flag,
@@ -311,6 +331,13 @@ var companionConfigSchema = z2.object({
 function isCodexEnabled(cfg) {
   return !!cfg.codex && cfg.codex.enabled !== false;
 }
+function isClaudeCodeConnected(cfg) {
+  return !!cfg.claudeCode && cfg.claudeCode.enabled !== false;
+}
+function migrateConnectedHarnesses(cfg, claudeOnPath2) {
+  if (cfg.claudeCode !== void 0) return null;
+  return { ...cfg, claudeCode: { enabled: claudeOnPath2 } };
+}
 function localAgentConfig(cfg, agent) {
   const map = cfg.agents ?? {};
   return map[agent.agentId] ?? map[agent.agentUsername] ?? map[`${agent.workspaceSlug}/${agent.agentUsername}`] ?? {};
@@ -352,31 +379,38 @@ function loadConfig() {
 function loadConfigTolerant() {
   const path = configPath();
   const empty = {};
-  if (!existsSync(path)) return { local: empty, note: null };
+  const fresh = { local: empty, note: null, hadPriorConfig: false };
+  if (!existsSync(path)) return fresh;
   let raw;
   try {
     raw = readFileSync(path, "utf8");
   } catch {
-    return { local: empty, note: null };
+    return fresh;
   }
-  if (raw.trim().length === 0) return { local: empty, note: null };
+  if (raw.trim().length === 0) return fresh;
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { local: empty, note: `${path} was unreadable (invalid JSON) and has been reset.` };
+    return {
+      local: empty,
+      note: `${path} was unreadable (invalid JSON) and has been reset.`,
+      hadPriorConfig: true
+    };
   }
   const strict = companionConfigSchema.safeParse(parsed);
   if (strict.success) {
-    const { agents: agents2, dashboardPort, autoOpen, logLevel } = strict.data;
+    const { agents: agents2, dashboardPort, autoOpen, logLevel, claudeCode: claudeCode2 } = strict.data;
     return {
       local: {
         ...agents2 !== void 0 ? { agents: agents2 } : {},
         ...dashboardPort !== void 0 ? { dashboardPort } : {},
         ...autoOpen !== void 0 ? { autoOpen } : {},
-        ...logLevel !== void 0 ? { logLevel } : {}
+        ...logLevel !== void 0 ? { logLevel } : {},
+        ...claudeCode2 !== void 0 ? { claudeCode: claudeCode2 } : {}
       },
-      note: null
+      note: null,
+      hadPriorConfig: true
     };
   }
   const obj = parsed && typeof parsed === "object" ? parsed : {};
@@ -388,9 +422,12 @@ function loadConfigTolerant() {
   if (obj.logLevel === "warn" || obj.logLevel === "info" || obj.logLevel === "debug") {
     local.logLevel = obj.logLevel;
   }
+  const claudeCode = companionConfigSchema.shape.claudeCode.safeParse(obj.claudeCode);
+  if (claudeCode.success && claudeCode.data !== void 0) local.claudeCode = claudeCode.data;
   return {
     local,
-    note: `the existing ${path} was from an older or incompatible companion; re-pairing rewrote it.`
+    note: `the existing ${path} was from an older or incompatible companion; re-pairing rewrote it.`,
+    hadPriorConfig: true
   };
 }
 function saveConfig(cfg) {
@@ -592,26 +629,43 @@ async function codexOnPath() {
   ]);
   return version !== null;
 }
-async function ensureRuntimeAvailable(cfg, deps = {}) {
+async function requireStartConfig(deps = {}) {
+  const requireCfg = deps.requireCfg ?? requireConfig;
+  const probeClaude = deps.probeClaude ?? claudeOnPath;
+  const save2 = deps.save ?? saveConfig;
+  const cfg = requireCfg();
+  const claudeOnPathResult = await probeClaude();
+  const migrated = migrateConnectedHarnesses(cfg, claudeOnPathResult);
+  if (!migrated) return { cfg, claudeOnPath: claudeOnPathResult };
+  save2(migrated);
+  deps.onMigrated?.(migrated, claudeOnPathResult);
+  return { cfg: migrated, claudeOnPath: claudeOnPathResult };
+}
+async function warnAboutHarnessReadiness(cfg, deps = {}) {
   const probeClaude = deps.probeClaude ?? claudeOnPath;
   const probeCodex = deps.probeCodex ?? codexOnPath;
   const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
 `));
-  if (await probeClaude()) return;
-  const alternates = [
-    ...cfg.opencode ? ["opencode"] : [],
-    ...isCodexEnabled(cfg) ? ["codex"] : []
+  const connected = [
+    ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
+    ...isCodexEnabled(cfg) ? ["Codex"] : [],
+    ...cfg.opencode ? ["opencode"] : []
   ];
-  if (alternates.length > 0) {
-    const exposed = alternates.join(" + ");
-    warn(
-      `warning: Claude Code isn\u2019t on your PATH, so this device exposes ${exposed} only \u2014 it advertises nothing else, so a Claude-model agent won\u2019t be routed here. Assign it agents on models ${exposed} can run, or install Claude Code (\`npm i -g @anthropic-ai/claude-code\`) and log in if you want this device to run Claude models too.`
-    );
+  if (connected.length > 0) {
+    if (isClaudeCodeConnected(cfg) && !await probeClaude()) {
+      warn(
+        "warning: Claude Code is connected on this device but `claude` isn\u2019t on your PATH, so it advertises nothing and a Claude-model agent won\u2019t be routed here. Install it (`npm i -g @anthropic-ai/claude-code`) and log in, or disconnect it."
+      );
+    }
     return;
   }
-  const installedButUnexposed = await probeCodex() ? 'Codex is installed on this machine but not exposed \u2014 enable it with `{ "codex": { "enabled": true } }` in ~/.cabane/config.json. Otherwise, expose a harness:\n' : "Expose at least one:\n";
-  throw new CompanionError(
-    "This device exposes no harness, so no agent turn can run here. " + installedButUnexposed + '  \u2022 Claude Code \u2014 install it (`npm i -g @anthropic-ai/claude-code`) and log in (`claude`, then follow the prompts); it\u2019s exposed automatically once `claude` is on your PATH.\n  \u2022 Codex \u2014 install the Codex CLI and log in (`codex login`), then add `{ "codex": { "enabled": true } }` to ~/.cabane/config.json.\n  \u2022 opencode \u2014 run `opencode serve --port 4096`, then add `{ "opencode": { "serverUrl": "http://127.0.0.1:4096" } }` to ~/.cabane/config.json.\nThen run `cabane-companion start` again (see the companion README).'
+  const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
+  const installed = [
+    ...claudeInstalled ? ["Claude Code"] : [],
+    ...codexInstalled ? ["Codex"] : []
+  ];
+  warn(
+    "No harness is connected on this device yet, so no agent turn can run here. " + (installed.length > 0 ? `We found ${installed.join(" and ")} on this machine \u2014 connect ${installed.length > 1 ? "one" : "it"} in the Companion dashboard (or in cabane, Settings \u2192 Devices) and turns start routing here.` : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it in the Companion dashboard.")
   );
 }
 
@@ -709,15 +763,28 @@ function trimSlash(s) {
 var STARTUP_TIMEOUT_MS = 8e3;
 var POLL_INTERVAL_MS = 150;
 async function startDaemon(opts = {}, deps = {}) {
-  const ensureRuntime = deps.ensureRuntime ?? ensureRuntimeAvailable;
-  const requireCfg = deps.requireCfg ?? requireConfig;
+  const ensureRuntime = deps.ensureRuntime ?? warnAboutHarnessReadiness;
   const readState = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? ((s) => verifyRuntime(s));
   const spawnDetached = deps.spawnDetached ?? defaultSpawnDetached;
   const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
-  const cfg = requireCfg();
-  await ensureRuntime(cfg);
+  const { cfg, claudeOnPath: claudeOnPath2 } = await requireStartConfig({
+    // Unset → `requireStartConfig`'s own `requireConfig`, the real one.
+    ...deps.requireCfg ? { requireCfg: deps.requireCfg } : {},
+    ...deps.probeClaude ? { probeClaude: deps.probeClaude } : {},
+    ...deps.save ? { save: deps.save } : {},
+    // The child won't log it (the block is written by then), and this process owns
+    // the user's terminal — so the one-time record is one line, here.
+    onMigrated: (_migrated, onPath) => {
+      if (onPath) {
+        process.stdout.write(
+          "Carried Claude Code over as a connected harness on this device \u2014 connectors are chosen now, not detected.\n"
+        );
+      }
+    }
+  });
+  await ensureRuntime(cfg, { probeClaude: async () => claudeOnPath2 });
   const existing = readState();
   if (existing) {
     if (await verify(existing) !== "stale") {
@@ -992,8 +1059,16 @@ function resolvePairBaseUrl(server) {
   return raw;
 }
 function writePairedConfig(paired) {
-  const { local, note } = loadConfigTolerant();
+  const { local, note, hadPriorConfig } = loadConfigTolerant();
   const config = {
+    // CT1082: a device pairs connected to NOTHING — `claudeCode: { enabled: false }`
+    // written explicitly, not left absent, because absence is exactly what marks a
+    // pre-CT1082 config for the grandfathering migration. Omit it and a brand-new
+    // device gets auto-connected on its first start by the behaviour this task
+    // removes; stamp it on a RE-pair and an upgrading user's working device gets
+    // disconnected instead. So it's written only when there was no config here
+    // before. `local` spreads after, so a re-pair keeps the answer already given.
+    ...hadPriorConfig ? {} : { claudeCode: { enabled: false } },
     ...local,
     baseUrl: paired.baseUrl,
     deviceToken: paired.deviceToken,
@@ -1390,6 +1465,11 @@ function registerRoutes(app, deps) {
   app.post("/api/harnesses/enable", async (c) => {
     const body = await readJson(c);
     const runtime = body.runtime;
+    if (runtime === "claude-code") {
+      const result = await supervisor.enableHarness({ runtime: "claude-code" });
+      if (!result.ok) return c.json({ error: result.error }, 400);
+      return c.json({ ok: true, status: hub.statusJson() });
+    }
     if (runtime === "codex") {
       const result = await supervisor.enableHarness({ runtime: "codex" });
       if (!result.ok) return c.json({ error: result.error }, 400);
@@ -6754,10 +6834,11 @@ function describeSubAgentError(status2, body) {
 var Dispatcher = class {
   constructor(opts) {
     this.opts = opts;
+    this.aborts = opts.aborts ?? /* @__PURE__ */ new Map();
   }
   opts;
   // SJ383: per-(conversation, agent) abort registry.
-  aborts = /* @__PURE__ */ new Map();
+  aborts;
   notifyStart(info) {
     try {
       this.opts.observer?.onStart(info);
@@ -7671,7 +7752,9 @@ var LABELS = {
 function deriveHarnessSnapshot(signals) {
   const advertised = new Set(
     buildCompanionManifest({
-      claudeCode: signals.claudeOnPath,
+      // CT1082: connected AND installed — the manifest's own rule, restated here
+      // through the same function rather than re-decided.
+      claudeCode: signals.claudeCodeConnected && signals.claudeOnPath,
       opencode: signals.opencodeConfigured,
       codex: signals.codexEnabled
     }).runtimes.map((r) => r.name)
@@ -7684,20 +7767,40 @@ function deriveHarnessSnapshot(signals) {
   return { harnesses, anyExposed: harnesses.some((h) => h.state === "exposed") };
 }
 function deriveClaudeCode(signals, manifestHas) {
-  const base = { runtime: "claude-code", label: LABELS["claude-code"], enable: null };
+  const base = { runtime: "claude-code", label: LABELS["claude-code"] };
   if (manifestHas) {
     return {
       ...base,
       state: "exposed",
       version: signals.claudeVersion,
-      detail: "Claude Code is installed and exposed to Cabane."
+      detail: "Claude Code is connected and exposed to Cabane.",
+      enable: null
+    };
+  }
+  if (signals.claudeCodeConnected) {
+    return {
+      ...base,
+      state: "needs_attention",
+      version: null,
+      detail: "Connected, but the `claude` CLI isn\u2019t on your PATH. Install it (`npm i -g @anthropic-ai/claude-code`) and sign in, or disconnect it.",
+      enable: null
+    };
+  }
+  if (signals.claudeOnPath) {
+    return {
+      ...base,
+      state: "detected_not_exposed",
+      version: signals.claudeVersion,
+      detail: "Claude Code is installed here but not connected yet. Connect it to let Cabane run Claude Code on this device.",
+      enable: "claude-code"
     };
   }
   return {
     ...base,
     state: "not_detected",
     version: null,
-    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then it appears here."
+    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then connect it here.",
+    enable: null
   };
 }
 function deriveCodex(signals, manifestHas) {
@@ -7765,6 +7868,9 @@ function deriveOpencode(signals, manifestHas) {
     enable: "opencode"
   };
 }
+function detectedRuntimesFor(snapshot) {
+  return snapshot.harnesses.filter((h) => h.state === "detected_not_exposed").map((h) => ({ runtime: h.runtime, version: h.version }));
+}
 var PROBE_TIMEOUT_MS2 = 4e3;
 async function probeHarnessSignals(cfg, deps = {}) {
   const probeClaudePresence = deps.probeClaudePresence ?? claudeOnPath;
@@ -7781,6 +7887,9 @@ async function probeHarnessSignals(cfg, deps = {}) {
   return {
     claudeOnPath: claudeOnPathResult,
     claudeVersion,
+    // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
+    // the manifest gate and the probe above is only a suggestion.
+    claudeCodeConnected: isClaudeCodeConnected(cfg),
     // A parseable `codex --version` is our presence signal (presence alone never
     // exposes codex; its config flag is the manifest gate either way).
     codexOnPath: codexVersion !== null,
@@ -8189,6 +8298,10 @@ var CompanionSupervisor = class {
   // can never disagree with what the manifest advertises. Null until the first
   // probe (the heartbeat then falls back to the boot `claudeCode`).
   harnessSignals = null;
+  // CT1082: the fresh PATH probe the claude-code connect vets with. Deliberately
+  // NOT the cached beat signal — someone connecting right after installing Claude
+  // Code shouldn't be refused by a snapshot up to a heartbeat old.
+  probeClaudePresence;
   exitFn;
   reexecFn;
   dispatcherFactory;
@@ -8219,6 +8332,7 @@ var CompanionSupervisor = class {
     this.log = opts.log;
     this.hub = opts.hub;
     this.claudeCode = opts.claudeCode ?? true;
+    this.probeClaudePresence = opts.probeClaudePresence ?? claudeOnPath;
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
@@ -8281,11 +8395,10 @@ var CompanionSupervisor = class {
         // claude-code when `claude` is on PATH, CT270 opencode when the operator
         // configured an `opencode serve`.
         manifest: buildCompanionManifest({
-          // CT586: prefer the live re-probe's presence; fall back to the boot probe
-          // until the first re-probe lands. Same exit-0 `claude --version` signal
-          // either way, so the manifest's claude-code advertising is unchanged in
-          // meaning — just refreshed on the beat instead of frozen at boot.
-          claudeCode: this.claudeCodePresent(),
+          // CT1082: connected AND installed. Presence is the live re-probe (CT586),
+          // falling back to the boot probe until the first one lands; consent is the
+          // user's `claudeCode.enabled`. Claude Code no longer rides presence alone.
+          claudeCode: this.claudeCodeOffered(),
           opencode: !!this.config.opencode?.serverUrl,
           // CT481: advertise codex when the operator enabled it (config-gated,
           // like opencode — the CLI's presence is the operator's responsibility;
@@ -8303,7 +8416,13 @@ var CompanionSupervisor = class {
         // CT584: include enumerated models only when the probe SUCCEEDED (non-null).
         // A null (probe failed / no opencode) omits the field, and the server then
         // leaves this device's stored availability untouched.
-        ...opencodeModels !== null ? { models: opencodeModels } : {}
+        ...opencodeModels !== null ? { models: opencodeModels } : {},
+        // CT1082: what this machine has that the user hasn't connected, so the web
+        // UI can offer it without a companion round-trip. Sent only once a probe has
+        // actually landed (`harnessSignals` non-null) — an absent field means "we
+        // didn't look this beat" and leaves the server's stored suggestion alone,
+        // the same fail-soft contract `models` keeps.
+        ...this.harnessSignals ? { detectedRuntimes: detectedRuntimesFor(deriveHarnessSnapshot(this.harnessSignals)) } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
@@ -8469,6 +8588,7 @@ var CompanionSupervisor = class {
       outbox,
       log: this.log
     });
+    const aborts = /* @__PURE__ */ new Map();
     const dispatcher = this.buildDispatcher({
       api,
       baseUrl: this.config.baseUrl,
@@ -8477,7 +8597,8 @@ var CompanionSupervisor = class {
       agentId: it.agentId,
       agentUsername: it.agentUsername,
       credential,
-      runConfig
+      runConfig,
+      aborts
     });
     const drain2 = this.makeDrain(api, it.agentId);
     wr.agents.set(it.agentId, {
@@ -8487,6 +8608,7 @@ var CompanionSupervisor = class {
       credential,
       runConfig,
       api,
+      aborts,
       dispatcher,
       cancelDrain: drain2.cancel,
       kickDrain: drain2.kick
@@ -8508,15 +8630,26 @@ var CompanionSupervisor = class {
       "companion: stopped agent (unassigned)"
     );
   }
-  // CT833: is Claude Code on this machine right now? The ONE signal both the
-  // heartbeat manifest and the dispatcher's adapter registry read, so what the
-  // device advertises and what it can actually select can't disagree. Live (the
-  // per-beat re-probe), falling back to the boot probe until the first one lands.
+  // CT833: is Claude Code on this machine right now? Live (the per-beat re-probe),
+  // falling back to the boot probe until the first one lands. Presence ONLY —
+  // CT1082 split presence from exposure, so nothing routes on this directly.
   claudeCodePresent() {
     return this.harnessSignals?.claudeOnPath ?? this.claudeCode;
   }
+  // CT1082: does this device OFFER claude-code — connected by its user and actually
+  // installed? The ONE signal both the heartbeat manifest and the dispatcher's
+  // adapter registry read, so what the device advertises and what it can select
+  // can't disagree (the CT833 invariant, now with consent in front of it).
+  claudeCodeOffered() {
+    return isClaudeCodeConnected(this.config) && this.claudeCodePresent();
+  }
   buildDispatcher(ctx) {
-    if (this.dispatcherFactory) return this.dispatcherFactory(ctx);
+    const local = localAgentConfig(this.config, {
+      agentId: ctx.agentId,
+      agentUsername: ctx.agentUsername,
+      workspaceSlug: ctx.workspaceSlug
+    });
+    if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
     return new Dispatcher({
       api: ctx.api,
       baseUrl: ctx.baseUrl,
@@ -8525,17 +8658,16 @@ var CompanionSupervisor = class {
       agentId: ctx.agentId,
       agentUsername: ctx.agentUsername,
       credential: ctx.credential,
-      local: localAgentConfig(this.config, {
-        agentId: ctx.agentId,
-        agentUsername: ctx.agentUsername,
-        workspaceSlug: ctx.workspaceSlug
-      }),
+      local,
+      aborts: ctx.aborts,
       runConfig: ctx.runConfig,
       log: this.log,
-      // CT833: register the claude-code adapter only when `claude` is actually on
-      // this machine — read per turn (not captured here), so a harness installed
-      // after boot works on the next turn exactly as it appears on the next beat.
-      claudeCodeAvailable: () => this.claudeCodePresent(),
+      // CT833: register the claude-code adapter only when this device actually
+      // offers claude-code — read per turn (not captured here), so a harness
+      // installed or connected after boot works on the next turn exactly as it
+      // appears on the next beat. CT1082: "offers" now means connected as well as
+      // installed, so a disconnected harness can't be selected either.
+      claudeCodeAvailable: () => this.claudeCodeOffered(),
       // CT270: the opencode server URL (operator-configured), when this device
       // offers the opencode runtime. Threaded so an opencode turn selects the
       // opencode adapter; unset leaves the device claude-code-only.
@@ -8797,6 +8929,7 @@ var CompanionSupervisor = class {
     if (!next) return;
     this.config = next;
     this.log.level = next.logLevel ?? "debug";
+    this.rebuildDispatchers();
     void this.refreshAssignments();
   }
   // The dashboard "refresh assignments" control — an immediate pull.
@@ -8841,9 +8974,12 @@ var CompanionSupervisor = class {
   async recheckHarnesses() {
     await this.refreshHarnessStatuses();
   }
-  // Friendly enable for the two config-driven harnesses — flip the flag the app
-  // owns in `~/.cabane/config.json`, no hand-edited JSON. This is enable/expose
-  // ONLY: it never installs a binary and never drives a login (BYO — Decided).
+  // Friendly enable for the config-driven harnesses — flip the flag the app owns in
+  // `~/.cabane/config.json`, no hand-edited JSON. This is enable/expose ONLY: it
+  // never installs a binary and never drives a login (BYO — Decided).
+  //   - claude-code (CT1082): set `claudeCode.enabled`, after checking `claude` is
+  //     on PATH. This is the callable the terminal offer ("We found Claude Code.
+  //     Connect it? [Y/n]") and the web pairing flow both wire to.
   //   - codex: set `codex.enabled` (the CLI + `codex login` remain the user's).
   //   - opencode: set `opencode.serverUrl` — but ONLY after health-probing the URL,
   //     so we never advertise a serve that isn't there. An unreachable URL is a
@@ -8853,7 +8989,15 @@ var CompanionSupervisor = class {
   // reachable/valid input).
   async enableHarness(input) {
     let next;
-    if (input.runtime === "codex") {
+    if (input.runtime === "claude-code") {
+      if (!await this.probeClaudePresence()) {
+        return {
+          ok: false,
+          error: "Couldn\u2019t find `claude` on this machine\u2019s PATH. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in, then connect it."
+        };
+      }
+      next = { ...this.config, claudeCode: { enabled: true } };
+    } else if (input.runtime === "codex") {
       next = { ...this.config, codex: { enabled: true } };
     } else {
       const serverUrl = input.serverUrl.trim();
@@ -8883,8 +9027,8 @@ var CompanionSupervisor = class {
   }
   // Re-create every running agent's Dispatcher from the CURRENT config, keeping
   // the runner (its api/outbox/chains/SSE) intact. Used after a runtime-enabling
-  // config change so the adapter registry — rebuilt per turn from the dispatcher's
-  // constructor opts — picks up the new opencode/codex adapter.
+  // config change so constructor-captured options — per-agent cwd/prepareHook and
+  // the adapter registry — pick up their new values without an app restart.
   rebuildDispatchers() {
     for (const wr of this.workspaces.values()) {
       for (const runner of wr.agents.values()) {
@@ -8896,7 +9040,8 @@ var CompanionSupervisor = class {
           agentId: runner.agentId,
           agentUsername: runner.username,
           credential: runner.credential,
-          runConfig: runner.runConfig
+          runConfig: runner.runConfig,
+          aborts: runner.aborts
         });
       }
     }
@@ -9055,13 +9200,17 @@ function clearCrash() {
 async function createCompanionRuntime(opts = {}) {
   const log = getLogger();
   installProcessSafetyNet(log);
-  const probeClaude = opts.probeClaude ?? claudeOnPath;
   let cfg;
   let claudeCode;
   try {
-    cfg = requireConfig();
-    claudeCode = await probeClaude();
-    await ensureRuntimeAvailable(cfg, { probeClaude: async () => claudeCode });
+    ({ cfg, claudeOnPath: claudeCode } = await requireStartConfig({
+      ...opts.probeClaude ? { probeClaude: opts.probeClaude } : {},
+      onMigrated: (migrated, onPath) => log.info(
+        { claudeCode: isClaudeCodeConnected(migrated) },
+        onPath ? "companion: carried Claude Code over as a connected harness on this device (connectors are now chosen, not detected)" : "companion: no Claude Code on PATH, so this device starts with it disconnected (connectors are now chosen, not detected)"
+      )
+    }));
+    await warnAboutHarnessReadiness(cfg, { probeClaude: async () => claudeCode });
   } catch (err) {
     recordCrash({
       reason: err instanceof Error ? err.message : String(err),
@@ -9073,7 +9222,9 @@ async function createCompanionRuntime(opts = {}) {
   }
   if (cfg.logLevel) log.level = cfg.logLevel;
   const harnessVersions = await probeHarnessVersions({
-    claudeCode,
+    // CT1082: versions are probed for the runtimes this device OFFERS, and
+    // claude-code is offered only when connected as well as installed.
+    claudeCode: claudeCode && isClaudeCodeConnected(cfg),
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });

package/dist/pairing-config.js

@@ -161,6 +161,26 @@ var companionConfigSchema = z2.object({
   opencode: z2.object({
     serverUrl: z2.string().url()
   }).strict().optional(),
+  // CT1082: the Claude Code runtime, when the user connected it on this machine.
+  // The change this task exists for: Claude Code used to be the one harness a
+  // device exposed with no configuration — a `claude --version` exit-0 was taken as
+  // consent — and it is now the third config-driven harness, opted into exactly
+  // like codex. `claude` on PATH is still required (you can't run what isn't
+  // installed), but presence alone no longer exposes anything: the manifest
+  // advertises claude-code only when this block says so AND the binary is there.
+  //
+  // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
+  // Absent means the config predates this task — a device whose user was never
+  // asked — and the migration grandfathers it on first start. So every config
+  // written from here on carries the block explicitly, including a freshly-paired
+  // one, which starts at `enabled: false`: a new device is connected to nothing
+  // until its user says otherwise.
+  //
+  // Not to be confused with the per-agent `agents.<key>.claudeCode.autoMemory`
+  // above — that's one agent's memory switch, this is the device's connected set.
+  claudeCode: z2.object({
+    enabled: z2.boolean().optional()
+  }).strict().optional(),
   // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
   // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
   // the `@openai/codex-sdk` spawns per turn — so the config is just an opt-in flag,
@@ -211,31 +231,38 @@ function loadConfig() {
 function loadConfigTolerant() {
   const path = configPath();
   const empty = {};
-  if (!existsSync(path)) return { local: empty, note: null };
+  const fresh = { local: empty, note: null, hadPriorConfig: false };
+  if (!existsSync(path)) return fresh;
   let raw;
   try {
     raw = readFileSync(path, "utf8");
   } catch {
-    return { local: empty, note: null };
+    return fresh;
   }
-  if (raw.trim().length === 0) return { local: empty, note: null };
+  if (raw.trim().length === 0) return fresh;
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { local: empty, note: `${path} was unreadable (invalid JSON) and has been reset.` };
+    return {
+      local: empty,
+      note: `${path} was unreadable (invalid JSON) and has been reset.`,
+      hadPriorConfig: true
+    };
   }
   const strict = companionConfigSchema.safeParse(parsed);
   if (strict.success) {
-    const { agents: agents2, dashboardPort, autoOpen, logLevel } = strict.data;
+    const { agents: agents2, dashboardPort, autoOpen, logLevel, claudeCode: claudeCode2 } = strict.data;
     return {
       local: {
         ...agents2 !== void 0 ? { agents: agents2 } : {},
         ...dashboardPort !== void 0 ? { dashboardPort } : {},
         ...autoOpen !== void 0 ? { autoOpen } : {},
-        ...logLevel !== void 0 ? { logLevel } : {}
+        ...logLevel !== void 0 ? { logLevel } : {},
+        ...claudeCode2 !== void 0 ? { claudeCode: claudeCode2 } : {}
       },
-      note: null
+      note: null,
+      hadPriorConfig: true
     };
   }
   const obj = parsed && typeof parsed === "object" ? parsed : {};
@@ -247,9 +274,12 @@ function loadConfigTolerant() {
   if (obj.logLevel === "warn" || obj.logLevel === "info" || obj.logLevel === "debug") {
     local.logLevel = obj.logLevel;
   }
+  const claudeCode = companionConfigSchema.shape.claudeCode.safeParse(obj.claudeCode);
+  if (claudeCode.success && claudeCode.data !== void 0) local.claudeCode = claudeCode.data;
   return {
     local,
-    note: `the existing ${path} was from an older or incompatible companion; re-pairing rewrote it.`
+    note: `the existing ${path} was from an older or incompatible companion; re-pairing rewrote it.`,
+    hadPriorConfig: true
   };
 }
 function saveConfig(cfg) {
@@ -375,8 +405,16 @@ function resolvePairBaseUrl(server) {
   return raw;
 }
 function writePairedConfig(paired) {
-  const { local, note } = loadConfigTolerant();
+  const { local, note, hadPriorConfig } = loadConfigTolerant();
   const config = {
+    // CT1082: a device pairs connected to NOTHING — `claudeCode: { enabled: false }`
+    // written explicitly, not left absent, because absence is exactly what marks a
+    // pre-CT1082 config for the grandfathering migration. Omit it and a brand-new
+    // device gets auto-connected on its first start by the behaviour this task
+    // removes; stamp it on a RE-pair and an upgrading user's working device gets
+    // disconnected instead. So it's written only when there was no config here
+    // before. `local` spreads after, so a re-pair keeps the answer already given.
+    ...hadPriorConfig ? {} : { claudeCode: { enabled: false } },
     ...local,
     baseUrl: paired.baseUrl,
     deviceToken: paired.deviceToken,

package/dist/runtime.js

@@ -288,6 +288,26 @@ var companionConfigSchema = z2.object({
   opencode: z2.object({
     serverUrl: z2.string().url()
   }).strict().optional(),
+  // CT1082: the Claude Code runtime, when the user connected it on this machine.
+  // The change this task exists for: Claude Code used to be the one harness a
+  // device exposed with no configuration — a `claude --version` exit-0 was taken as
+  // consent — and it is now the third config-driven harness, opted into exactly
+  // like codex. `claude` on PATH is still required (you can't run what isn't
+  // installed), but presence alone no longer exposes anything: the manifest
+  // advertises claude-code only when this block says so AND the binary is there.
+  //
+  // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
+  // Absent means the config predates this task — a device whose user was never
+  // asked — and the migration grandfathers it on first start. So every config
+  // written from here on carries the block explicitly, including a freshly-paired
+  // one, which starts at `enabled: false`: a new device is connected to nothing
+  // until its user says otherwise.
+  //
+  // Not to be confused with the per-agent `agents.<key>.claudeCode.autoMemory`
+  // above — that's one agent's memory switch, this is the device's connected set.
+  claudeCode: z2.object({
+    enabled: z2.boolean().optional()
+  }).strict().optional(),
   // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
   // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
   // the `@openai/codex-sdk` spawns per turn — so the config is just an opt-in flag,
@@ -304,6 +324,13 @@ var companionConfigSchema = z2.object({
 function isCodexEnabled(cfg) {
   return !!cfg.codex && cfg.codex.enabled !== false;
 }
+function isClaudeCodeConnected(cfg) {
+  return !!cfg.claudeCode && cfg.claudeCode.enabled !== false;
+}
+function migrateConnectedHarnesses(cfg, claudeOnPath2) {
+  if (cfg.claudeCode !== void 0) return null;
+  return { ...cfg, claudeCode: { enabled: claudeOnPath2 } };
+}
 function localAgentConfig(cfg, agent) {
   const map = cfg.agents ?? {};
   return map[agent.agentId] ?? map[agent.agentUsername] ?? map[`${agent.workspaceSlug}/${agent.agentUsername}`] ?? {};
@@ -739,6 +766,11 @@ function registerRoutes(app, deps) {
   app.post("/api/harnesses/enable", async (c) => {
     const body = await readJson(c);
     const runtime = body.runtime;
+    if (runtime === "claude-code") {
+      const result = await supervisor.enableHarness({ runtime: "claude-code" });
+      if (!result.ok) return c.json({ error: result.error }, 400);
+      return c.json({ ok: true, status: hub.statusJson() });
+    }
     if (runtime === "codex") {
       const result = await supervisor.enableHarness({ runtime: "codex" });
       if (!result.ok) return c.json({ error: result.error }, 400);
@@ -1012,26 +1044,43 @@ async function codexOnPath() {
   ]);
   return version !== null;
 }
-async function ensureRuntimeAvailable(cfg, deps = {}) {
+async function requireStartConfig(deps = {}) {
+  const requireCfg = deps.requireCfg ?? requireConfig;
+  const probeClaude = deps.probeClaude ?? claudeOnPath;
+  const save2 = deps.save ?? saveConfig;
+  const cfg = requireCfg();
+  const claudeOnPathResult = await probeClaude();
+  const migrated = migrateConnectedHarnesses(cfg, claudeOnPathResult);
+  if (!migrated) return { cfg, claudeOnPath: claudeOnPathResult };
+  save2(migrated);
+  deps.onMigrated?.(migrated, claudeOnPathResult);
+  return { cfg: migrated, claudeOnPath: claudeOnPathResult };
+}
+async function warnAboutHarnessReadiness(cfg, deps = {}) {
   const probeClaude = deps.probeClaude ?? claudeOnPath;
   const probeCodex = deps.probeCodex ?? codexOnPath;
   const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
 `));
-  if (await probeClaude()) return;
-  const alternates = [
-    ...cfg.opencode ? ["opencode"] : [],
-    ...isCodexEnabled(cfg) ? ["codex"] : []
+  const connected = [
+    ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
+    ...isCodexEnabled(cfg) ? ["Codex"] : [],
+    ...cfg.opencode ? ["opencode"] : []
   ];
-  if (alternates.length > 0) {
-    const exposed = alternates.join(" + ");
-    warn(
-      `warning: Claude Code isn\u2019t on your PATH, so this device exposes ${exposed} only \u2014 it advertises nothing else, so a Claude-model agent won\u2019t be routed here. Assign it agents on models ${exposed} can run, or install Claude Code (\`npm i -g @anthropic-ai/claude-code\`) and log in if you want this device to run Claude models too.`
-    );
+  if (connected.length > 0) {
+    if (isClaudeCodeConnected(cfg) && !await probeClaude()) {
+      warn(
+        "warning: Claude Code is connected on this device but `claude` isn\u2019t on your PATH, so it advertises nothing and a Claude-model agent won\u2019t be routed here. Install it (`npm i -g @anthropic-ai/claude-code`) and log in, or disconnect it."
+      );
+    }
     return;
   }
-  const installedButUnexposed = await probeCodex() ? 'Codex is installed on this machine but not exposed \u2014 enable it with `{ "codex": { "enabled": true } }` in ~/.cabane/config.json. Otherwise, expose a harness:\n' : "Expose at least one:\n";
-  throw new CompanionError(
-    "This device exposes no harness, so no agent turn can run here. " + installedButUnexposed + '  \u2022 Claude Code \u2014 install it (`npm i -g @anthropic-ai/claude-code`) and log in (`claude`, then follow the prompts); it\u2019s exposed automatically once `claude` is on your PATH.\n  \u2022 Codex \u2014 install the Codex CLI and log in (`codex login`), then add `{ "codex": { "enabled": true } }` to ~/.cabane/config.json.\n  \u2022 opencode \u2014 run `opencode serve --port 4096`, then add `{ "opencode": { "serverUrl": "http://127.0.0.1:4096" } }` to ~/.cabane/config.json.\nThen run `cabane-companion start` again (see the companion README).'
+  const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
+  const installed = [
+    ...claudeInstalled ? ["Claude Code"] : [],
+    ...codexInstalled ? ["Codex"] : []
+  ];
+  warn(
+    "No harness is connected on this device yet, so no agent turn can run here. " + (installed.length > 0 ? `We found ${installed.join(" and ")} on this machine \u2014 connect ${installed.length > 1 ? "one" : "it"} in the Companion dashboard (or in cabane, Settings \u2192 Devices) and turns start routing here.` : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it in the Companion dashboard.")
   );
 }
 
@@ -6407,10 +6456,11 @@ function describeSubAgentError(status, body) {
 var Dispatcher = class {
   constructor(opts) {
     this.opts = opts;
+    this.aborts = opts.aborts ?? /* @__PURE__ */ new Map();
   }
   opts;
   // SJ383: per-(conversation, agent) abort registry.
-  aborts = /* @__PURE__ */ new Map();
+  aborts;
   notifyStart(info) {
     try {
       this.opts.observer?.onStart(info);
@@ -7324,7 +7374,9 @@ var LABELS = {
 function deriveHarnessSnapshot(signals) {
   const advertised = new Set(
     buildCompanionManifest({
-      claudeCode: signals.claudeOnPath,
+      // CT1082: connected AND installed — the manifest's own rule, restated here
+      // through the same function rather than re-decided.
+      claudeCode: signals.claudeCodeConnected && signals.claudeOnPath,
       opencode: signals.opencodeConfigured,
       codex: signals.codexEnabled
     }).runtimes.map((r) => r.name)
@@ -7337,20 +7389,40 @@ function deriveHarnessSnapshot(signals) {
   return { harnesses, anyExposed: harnesses.some((h) => h.state === "exposed") };
 }
 function deriveClaudeCode(signals, manifestHas) {
-  const base = { runtime: "claude-code", label: LABELS["claude-code"], enable: null };
+  const base = { runtime: "claude-code", label: LABELS["claude-code"] };
   if (manifestHas) {
     return {
       ...base,
       state: "exposed",
       version: signals.claudeVersion,
-      detail: "Claude Code is installed and exposed to Cabane."
+      detail: "Claude Code is connected and exposed to Cabane.",
+      enable: null
+    };
+  }
+  if (signals.claudeCodeConnected) {
+    return {
+      ...base,
+      state: "needs_attention",
+      version: null,
+      detail: "Connected, but the `claude` CLI isn\u2019t on your PATH. Install it (`npm i -g @anthropic-ai/claude-code`) and sign in, or disconnect it.",
+      enable: null
+    };
+  }
+  if (signals.claudeOnPath) {
+    return {
+      ...base,
+      state: "detected_not_exposed",
+      version: signals.claudeVersion,
+      detail: "Claude Code is installed here but not connected yet. Connect it to let Cabane run Claude Code on this device.",
+      enable: "claude-code"
     };
   }
   return {
     ...base,
     state: "not_detected",
     version: null,
-    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then it appears here."
+    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then connect it here.",
+    enable: null
   };
 }
 function deriveCodex(signals, manifestHas) {
@@ -7418,6 +7490,9 @@ function deriveOpencode(signals, manifestHas) {
     enable: "opencode"
   };
 }
+function detectedRuntimesFor(snapshot) {
+  return snapshot.harnesses.filter((h) => h.state === "detected_not_exposed").map((h) => ({ runtime: h.runtime, version: h.version }));
+}
 var PROBE_TIMEOUT_MS2 = 4e3;
 async function probeHarnessSignals(cfg, deps = {}) {
   const probeClaudePresence = deps.probeClaudePresence ?? claudeOnPath;
@@ -7434,6 +7509,9 @@ async function probeHarnessSignals(cfg, deps = {}) {
   return {
     claudeOnPath: claudeOnPathResult,
     claudeVersion,
+    // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
+    // the manifest gate and the probe above is only a suggestion.
+    claudeCodeConnected: isClaudeCodeConnected(cfg),
     // A parseable `codex --version` is our presence signal (presence alone never
     // exposes codex; its config flag is the manifest gate either way).
     codexOnPath: codexVersion !== null,
@@ -7842,6 +7920,10 @@ var CompanionSupervisor = class {
   // can never disagree with what the manifest advertises. Null until the first
   // probe (the heartbeat then falls back to the boot `claudeCode`).
   harnessSignals = null;
+  // CT1082: the fresh PATH probe the claude-code connect vets with. Deliberately
+  // NOT the cached beat signal — someone connecting right after installing Claude
+  // Code shouldn't be refused by a snapshot up to a heartbeat old.
+  probeClaudePresence;
   exitFn;
   reexecFn;
   dispatcherFactory;
@@ -7872,6 +7954,7 @@ var CompanionSupervisor = class {
     this.log = opts.log;
     this.hub = opts.hub;
     this.claudeCode = opts.claudeCode ?? true;
+    this.probeClaudePresence = opts.probeClaudePresence ?? claudeOnPath;
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
@@ -7934,11 +8017,10 @@ var CompanionSupervisor = class {
         // claude-code when `claude` is on PATH, CT270 opencode when the operator
         // configured an `opencode serve`.
         manifest: buildCompanionManifest({
-          // CT586: prefer the live re-probe's presence; fall back to the boot probe
-          // until the first re-probe lands. Same exit-0 `claude --version` signal
-          // either way, so the manifest's claude-code advertising is unchanged in
-          // meaning — just refreshed on the beat instead of frozen at boot.
-          claudeCode: this.claudeCodePresent(),
+          // CT1082: connected AND installed. Presence is the live re-probe (CT586),
+          // falling back to the boot probe until the first one lands; consent is the
+          // user's `claudeCode.enabled`. Claude Code no longer rides presence alone.
+          claudeCode: this.claudeCodeOffered(),
           opencode: !!this.config.opencode?.serverUrl,
           // CT481: advertise codex when the operator enabled it (config-gated,
           // like opencode — the CLI's presence is the operator's responsibility;
@@ -7956,7 +8038,13 @@ var CompanionSupervisor = class {
         // CT584: include enumerated models only when the probe SUCCEEDED (non-null).
         // A null (probe failed / no opencode) omits the field, and the server then
         // leaves this device's stored availability untouched.
-        ...opencodeModels !== null ? { models: opencodeModels } : {}
+        ...opencodeModels !== null ? { models: opencodeModels } : {},
+        // CT1082: what this machine has that the user hasn't connected, so the web
+        // UI can offer it without a companion round-trip. Sent only once a probe has
+        // actually landed (`harnessSignals` non-null) — an absent field means "we
+        // didn't look this beat" and leaves the server's stored suggestion alone,
+        // the same fail-soft contract `models` keeps.
+        ...this.harnessSignals ? { detectedRuntimes: detectedRuntimesFor(deriveHarnessSnapshot(this.harnessSignals)) } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
@@ -8122,6 +8210,7 @@ var CompanionSupervisor = class {
       outbox,
       log: this.log
     });
+    const aborts = /* @__PURE__ */ new Map();
     const dispatcher = this.buildDispatcher({
       api,
       baseUrl: this.config.baseUrl,
@@ -8130,7 +8219,8 @@ var CompanionSupervisor = class {
       agentId: it.agentId,
       agentUsername: it.agentUsername,
       credential,
-      runConfig
+      runConfig,
+      aborts
     });
     const drain2 = this.makeDrain(api, it.agentId);
     wr.agents.set(it.agentId, {
@@ -8140,6 +8230,7 @@ var CompanionSupervisor = class {
       credential,
       runConfig,
       api,
+      aborts,
       dispatcher,
       cancelDrain: drain2.cancel,
       kickDrain: drain2.kick
@@ -8161,15 +8252,26 @@ var CompanionSupervisor = class {
       "companion: stopped agent (unassigned)"
     );
   }
-  // CT833: is Claude Code on this machine right now? The ONE signal both the
-  // heartbeat manifest and the dispatcher's adapter registry read, so what the
-  // device advertises and what it can actually select can't disagree. Live (the
-  // per-beat re-probe), falling back to the boot probe until the first one lands.
+  // CT833: is Claude Code on this machine right now? Live (the per-beat re-probe),
+  // falling back to the boot probe until the first one lands. Presence ONLY —
+  // CT1082 split presence from exposure, so nothing routes on this directly.
   claudeCodePresent() {
     return this.harnessSignals?.claudeOnPath ?? this.claudeCode;
   }
+  // CT1082: does this device OFFER claude-code — connected by its user and actually
+  // installed? The ONE signal both the heartbeat manifest and the dispatcher's
+  // adapter registry read, so what the device advertises and what it can select
+  // can't disagree (the CT833 invariant, now with consent in front of it).
+  claudeCodeOffered() {
+    return isClaudeCodeConnected(this.config) && this.claudeCodePresent();
+  }
   buildDispatcher(ctx) {
-    if (this.dispatcherFactory) return this.dispatcherFactory(ctx);
+    const local = localAgentConfig(this.config, {
+      agentId: ctx.agentId,
+      agentUsername: ctx.agentUsername,
+      workspaceSlug: ctx.workspaceSlug
+    });
+    if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
     return new Dispatcher({
       api: ctx.api,
       baseUrl: ctx.baseUrl,
@@ -8178,17 +8280,16 @@ var CompanionSupervisor = class {
       agentId: ctx.agentId,
       agentUsername: ctx.agentUsername,
       credential: ctx.credential,
-      local: localAgentConfig(this.config, {
-        agentId: ctx.agentId,
-        agentUsername: ctx.agentUsername,
-        workspaceSlug: ctx.workspaceSlug
-      }),
+      local,
+      aborts: ctx.aborts,
       runConfig: ctx.runConfig,
       log: this.log,
-      // CT833: register the claude-code adapter only when `claude` is actually on
-      // this machine — read per turn (not captured here), so a harness installed
-      // after boot works on the next turn exactly as it appears on the next beat.
-      claudeCodeAvailable: () => this.claudeCodePresent(),
+      // CT833: register the claude-code adapter only when this device actually
+      // offers claude-code — read per turn (not captured here), so a harness
+      // installed or connected after boot works on the next turn exactly as it
+      // appears on the next beat. CT1082: "offers" now means connected as well as
+      // installed, so a disconnected harness can't be selected either.
+      claudeCodeAvailable: () => this.claudeCodeOffered(),
       // CT270: the opencode server URL (operator-configured), when this device
       // offers the opencode runtime. Threaded so an opencode turn selects the
       // opencode adapter; unset leaves the device claude-code-only.
@@ -8450,6 +8551,7 @@ var CompanionSupervisor = class {
     if (!next) return;
     this.config = next;
     this.log.level = next.logLevel ?? "debug";
+    this.rebuildDispatchers();
     void this.refreshAssignments();
   }
   // The dashboard "refresh assignments" control — an immediate pull.
@@ -8494,9 +8596,12 @@ var CompanionSupervisor = class {
   async recheckHarnesses() {
     await this.refreshHarnessStatuses();
   }
-  // Friendly enable for the two config-driven harnesses — flip the flag the app
-  // owns in `~/.cabane/config.json`, no hand-edited JSON. This is enable/expose
-  // ONLY: it never installs a binary and never drives a login (BYO — Decided).
+  // Friendly enable for the config-driven harnesses — flip the flag the app owns in
+  // `~/.cabane/config.json`, no hand-edited JSON. This is enable/expose ONLY: it
+  // never installs a binary and never drives a login (BYO — Decided).
+  //   - claude-code (CT1082): set `claudeCode.enabled`, after checking `claude` is
+  //     on PATH. This is the callable the terminal offer ("We found Claude Code.
+  //     Connect it? [Y/n]") and the web pairing flow both wire to.
   //   - codex: set `codex.enabled` (the CLI + `codex login` remain the user's).
   //   - opencode: set `opencode.serverUrl` — but ONLY after health-probing the URL,
   //     so we never advertise a serve that isn't there. An unreachable URL is a
@@ -8506,7 +8611,15 @@ var CompanionSupervisor = class {
   // reachable/valid input).
   async enableHarness(input) {
     let next;
-    if (input.runtime === "codex") {
+    if (input.runtime === "claude-code") {
+      if (!await this.probeClaudePresence()) {
+        return {
+          ok: false,
+          error: "Couldn\u2019t find `claude` on this machine\u2019s PATH. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in, then connect it."
+        };
+      }
+      next = { ...this.config, claudeCode: { enabled: true } };
+    } else if (input.runtime === "codex") {
       next = { ...this.config, codex: { enabled: true } };
     } else {
       const serverUrl = input.serverUrl.trim();
@@ -8536,8 +8649,8 @@ var CompanionSupervisor = class {
   }
   // Re-create every running agent's Dispatcher from the CURRENT config, keeping
   // the runner (its api/outbox/chains/SSE) intact. Used after a runtime-enabling
-  // config change so the adapter registry — rebuilt per turn from the dispatcher's
-  // constructor opts — picks up the new opencode/codex adapter.
+  // config change so constructor-captured options — per-agent cwd/prepareHook and
+  // the adapter registry — pick up their new values without an app restart.
   rebuildDispatchers() {
     for (const wr of this.workspaces.values()) {
       for (const runner of wr.agents.values()) {
@@ -8549,7 +8662,8 @@ var CompanionSupervisor = class {
           agentId: runner.agentId,
           agentUsername: runner.username,
           credential: runner.credential,
-          runConfig: runner.runConfig
+          runConfig: runner.runConfig,
+          aborts: runner.aborts
         });
       }
     }
@@ -8708,13 +8822,17 @@ function clearCrash() {
 async function createCompanionRuntime(opts = {}) {
   const log = getLogger();
   installProcessSafetyNet(log);
-  const probeClaude = opts.probeClaude ?? claudeOnPath;
   let cfg;
   let claudeCode;
   try {
-    cfg = requireConfig();
-    claudeCode = await probeClaude();
-    await ensureRuntimeAvailable(cfg, { probeClaude: async () => claudeCode });
+    ({ cfg, claudeOnPath: claudeCode } = await requireStartConfig({
+      ...opts.probeClaude ? { probeClaude: opts.probeClaude } : {},
+      onMigrated: (migrated, onPath) => log.info(
+        { claudeCode: isClaudeCodeConnected(migrated) },
+        onPath ? "companion: carried Claude Code over as a connected harness on this device (connectors are now chosen, not detected)" : "companion: no Claude Code on PATH, so this device starts with it disconnected (connectors are now chosen, not detected)"
+      )
+    }));
+    await warnAboutHarnessReadiness(cfg, { probeClaude: async () => claudeCode });
   } catch (err) {
     recordCrash({
       reason: err instanceof Error ? err.message : String(err),
@@ -8726,7 +8844,9 @@ async function createCompanionRuntime(opts = {}) {
   }
   if (cfg.logLevel) log.level = cfg.logLevel;
   const harnessVersions = await probeHarnessVersions({
-    claudeCode,
+    // CT1082: versions are probed for the runtimes this device OFFERS, and
+    // claude-code is offered only when connected as well as installed.
+    claudeCode: claudeCode && isClaudeCodeConnected(cfg),
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });

package/dist/static/app.js

@@ -137,9 +137,17 @@ function renderHarnesses() {
 
     if (h.detail) li.append(el('p', 'harness-detail', h.detail));
 
-    // Friendly enable — never install, never login (BYO). Codex is a one-click
-    // flag flip; opencode takes a URL we validate is reachable before writing.
-    if (h.enable === 'codex') {
+    // Friendly enable — never install, never login (BYO). Claude Code and Codex are
+    // one-click flag flips; opencode takes a URL we validate is reachable before
+    // writing. CT1082: Claude Code is connectable here too — it used to be exposed
+    // the moment it was installed, with nothing to click.
+    if (h.enable === 'claude-code') {
+      const btn = el('button', 'primary small', 'Connect Claude Code');
+      btn.addEventListener('click', () => void enableHarness({ runtime: 'claude-code' }, btn));
+      const wrap = el('div', 'harness-enable');
+      wrap.append(btn);
+      li.append(wrap);
+    } else if (h.enable === 'codex') {
       const btn = el('button', 'primary small', 'Use Codex');
       btn.addEventListener('click', () => void enableHarness({ runtime: 'codex' }, btn));
       const wrap = el('div', 'harness-enable');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.20",
+  "version": "0.6.22",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",