@cabane/companion 0.6.213 → 0.6.215

package/README.md

@@ -4,30 +4,46 @@ The Cabane Companion runs your Cabane agents on a device you choose. It receives
 
 It uses **Claude Code**, **Codex** or **OpenCode**. The package includes Claude Code and Codex execution binaries, but setup does not run a vendor CLI installer or sign you in. OpenCode needs its own running server.
 
-Start with [Introduction to the Companion](https://cabane.ai/docs/introduction-to-the-companion), then [Mac setup](https://cabane.ai/docs/mac-setup), [Windows setup](https://cabane.ai/docs/windows-setup) or [Server and VPS setup](https://cabane.ai/docs/server-and-vps-setup). [FAQ and Help](https://cabane.ai/docs/faq-and-help) covers sign-in and troubleshooting. This README is the device-side reference: commands, configuration and local state.
+Start with [Cabane Companion](https://cabane.ai/docs/cabane-companion), then [Mac setup](https://cabane.ai/docs/mac-setup), [Windows setup](https://cabane.ai/docs/windows-setup) or [Server and VPS setup](https://cabane.ai/docs/server-and-vps-setup). [FAQ and Help](https://cabane.ai/docs/faq-and-help) covers sign-in and troubleshooting. This README is the device-side reference: commands, configuration and local state.
 
-Pairing supplies a device token, not your Cabane password or a full-account token. The device token is for this device's assignments and liveness; assigned agents receive workspace-bound credentials. The [trust guide](https://cabane.ai/docs/introduction-to-the-companion) explains the layers, records and access.
+Pairing supplies a device token, not your Cabane password or a full-account token. The device token is for this device's assignments and liveness; assigned agents receive workspace-bound credentials. The [trust guide](https://cabane.ai/docs/cabane-companion) explains the layers, records and access.
 
 ## Install
 
-In a workspace, open **Settings → Devices** and choose **Set up a new device**. The page mints a setup line with a code in it, good for 15 minutes. Paste it in a terminal on the device. One of:
+On the device, in a terminal. One of:
 
 ```sh
-curl -fsSL https://cabane.ai/install.sh | bash -s -- CODE
+curl -fsSL https://cabane.ai/install.sh | bash
 ```
 
 The script brings its own Node (checksum-checked, into `~/.cabane`) and needs no sudo. Or, with Node 22 or newer already there (the only route on Windows):
 
 ```sh
-npm i -g @cabane/companion && cabane setup CODE
+npm i -g @cabane/companion && cabane setup
 ```
 
-`cabane setup CODE` pairs the device to your account and joins it to that workspace. From an interactive terminal, setup starts the Companion in the background, waits for its first check-in and reports the device's state. Without an interactive terminal, setup can stay attached to the running Companion. The same line on a device that is already paired joins it to the workspace and mints nothing.
+`cabane setup` on an unpaired device prints a code and a link:
+
+```
+Pair this device
+Enter this code in Cabane, or press Return to open the page:
+
+  WXYZ-2345
+  https://app.cabane.ai/pair/enter-code?code=WXYZ-2345
+
+⠋ Waiting for you to confirm in Cabane… (the code is good for 15 minutes)
+```
+
+Enter the code in Cabane, signed in as yourself: from your own Settings → Devices → Add a device, from a workspace's Settings → Devices → Set up a new device, or on the page the link opens. Cabane shows which device asked; confirming pairs it to your account and nothing else. A workspace's dialog then adds the device to that workspace; from anywhere else, add it to a workspace from that workspace's Settings → Devices. Pairing from a workspace you're setting up places its default agent on the device once a harness there is usable.
+
+Without a terminal, setup prints the same lines once and waits, so a container's logs carry the code. An expired code is replaced by a fresh one, up to three; Ctrl-C stops cleanly. The link is on the server the device pairs with: pass `--server <url>` for your own Cabane.
+
+From an interactive terminal, setup then starts the Companion in the background, waits for its first check-in and reports the device's state. Without an interactive terminal, setup stays attached to the running Companion.
 
 If no harness is usable, interactive setup asks which one you want to set up. Follow the complete CLI installation and sign-in steps for [Mac setup](https://cabane.ai/docs/mac-setup#2-sign-in), [Windows setup](https://cabane.ai/docs/windows-setup#2-sign-in) or [Server and VPS setup](https://cabane.ai/docs/server-and-vps-setup#2-sign-in-without-a-browser), then check `cabane status`.
 
 ```
-✓ Paired as "maya-mbp" with Acme.
+✓ Paired as "maya-mbp".
   Cabane is running in the background. This device is ready — checked in 2s ago.
 
   Harnesses on this device
@@ -38,7 +54,7 @@ If no harness is usable, interactive setup asks which one you want to set up. Fo
   Status  cabane status     Stop  cabane stop     Log  cabane logs
   Start at login and keep Cabane updating itself:  cabane service install
 
-  In Cabane: https://app.cabane.ai/acme/settings/devices
+  In Cabane: https://app.cabane.ai/settings/devices
 ```
 
 Setup never installs the service. On macOS or Linux, run `cabane service install` when you want the Companion to start at login and keep itself updated; the closing block names it. Native Windows uses the background process and has no service installer.
@@ -51,7 +67,7 @@ The [server guide](https://cabane.ai/docs/server-and-vps-setup) provides a Docke
 
 | Command                              | What it does                                                                                                                                                                                                   |
 | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `setup [CODE]`                       | With a code: pair or join, detect harnesses, start. Without: a re-runnable checklist that reports harnesses and starts what isn't running.                                                                     |
+| `setup`                              | Unpaired: print a code to enter in Cabane, wait for the confirm, then detect harnesses and start. Paired: a re-runnable checklist that reports harnesses and starts what isn't running.                        |
 | `start [--foreground]`               | Start the Companion without prompts. From an interactive terminal, run in the background; noninteractive use may stay attached. Unpaired, it names `setup`. `--foreground` stays attached for your supervisor. |
 | `stop`                               | Stop the Companion cleanly. Ends any turn in progress.                                                                                                                                                         |
 | `status`                             | Version and install, the paired device by its Cabane name, its state in Cabane's words and when it last checked in, each harness's state, where agents work, declared secret names, and local overrides.       |

package/dist/cli.js

@@ -1418,7 +1418,7 @@ function pathForLog(path) {
   const q = path.indexOf("?");
   return q === -1 ? path : path.slice(0, q);
 }
-function sleep(ms, signal) {
+function sleep2(ms, signal) {
   return new Promise((resolve2) => {
     if (signal?.aborted) return resolve2();
     const timer = setTimeout(() => {
@@ -1521,7 +1521,7 @@ var init_api = __esm({
               },
               "companion: API call failed transiently; retrying"
             );
-            await sleep(delayMs, signal);
+            await sleep2(delayMs, signal);
             if (signal?.aborted) throw err;
           }
         }
@@ -7510,7 +7510,7 @@ var init_opencode_lock = __esm({
 });
 
 // src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn3 } from "child_process";
+import { execFile, execFileSync, spawn as spawn4 } from "child_process";
 import { readFileSync as readFileSync6 } from "fs";
 import { promisify as promisify2 } from "util";
 function turnScopeUnit(turnId, attempt) {
@@ -7639,7 +7639,7 @@ function createTurnContainment(turnId, deps = {}) {
       command: options.command
     });
     return asContained(
-      spawn3("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
+      spawn4("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
         ...options.cwd ? { cwd: options.cwd } : {},
         env: options.env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -7647,7 +7647,7 @@ function createTurnContainment(turnId, deps = {}) {
     );
   }
   function spawnInGroup(options) {
-    const child = spawn3(options.command, options.args, {
+    const child = spawn4(options.command, options.args, {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
@@ -7729,7 +7729,7 @@ function createTurnContainment(turnId, deps = {}) {
         } catch {
         }
       }
-      await sleep2(fallbackGraceMs);
+      await sleep3(fallbackGraceMs);
       const afterTerm = processGroupMembers(pgid);
       if (!afterTerm.ok) {
         result.failures.push({
@@ -7792,7 +7792,7 @@ function createTurnContainment(turnId, deps = {}) {
     }
   };
 }
-var execFileAsync, asContained, CONTAINMENT_STOP_GRACE_SEC, FALLBACK_GRACE_MS, CAPABILITY_PROBE_TIMEOUT_MS, OOM_READ_TIMEOUT_MS, sleep2, MANAGER_ENV_KEYS, managerEnvKey;
+var execFileAsync, asContained, CONTAINMENT_STOP_GRACE_SEC, FALLBACK_GRACE_MS, CAPABILITY_PROBE_TIMEOUT_MS, OOM_READ_TIMEOUT_MS, sleep3, MANAGER_ENV_KEYS, managerEnvKey;
 var init_turn_containment = __esm({
   "src/turn-containment.ts"() {
     "use strict";
@@ -7802,7 +7802,7 @@ var init_turn_containment = __esm({
     FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
     CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
     OOM_READ_TIMEOUT_MS = 1500;
-    sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    sleep3 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
     MANAGER_ENV_KEYS = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR", "PATH"];
     managerEnvKey = (env) => MANAGER_ENV_KEYS.map((k) => `${k}=${env[k] ?? ""}`).join("\0");
   }
@@ -11729,7 +11729,6 @@ async function liveCompanionState() {
 // src/commands/setup.ts
 init_cabane_command();
 init_config();
-import { hostname as hostname2 } from "os";
 
 // src/logger.ts
 init_config();
@@ -11904,61 +11903,346 @@ function getLogger() {
   return cached;
 }
 
+// src/pair-flow.ts
+init_cabane_command();
+import { spawn as spawn3 } from "child_process";
+import { hostname } from "os";
+
 // src/enrollment.ts
 init_errors();
-async function claimSetupCode(baseUrl, input) {
+var EnrollmentExpiredError = class extends CompanionError {
+  constructor() {
+    super("this pairing code expired before it was confirmed.");
+    this.name = "EnrollmentExpiredError";
+  }
+};
+var EnrollmentCancelledError = class extends CompanionError {
+  constructor() {
+    super("pairing was cancelled.");
+    this.name = "EnrollmentCancelledError";
+  }
+};
+function trimBase(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+async function postJson(baseUrl, path, body, signal) {
   let res;
   try {
-    res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/device-enrollment/claim`, {
+    res = await fetch(`${trimBase(baseUrl)}${path}`, {
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...input.deviceToken ? { authorization: `Bearer ${input.deviceToken}` } : {}
-      },
-      body: JSON.stringify({
-        userCode: input.userCode,
-        label: input.label,
-        platform: process.platform,
-        arch: process.arch,
-        nodeMajor: Number.parseInt(process.versions.node.split(".")[0], 10)
-      })
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(body),
+      ...signal ? { signal } : {}
     });
   } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
       `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
   }
-  if (res.status === 429)
-    throw new CompanionError(
-      "Too many attempts from this network. Wait a few minutes and paste the setup line again."
-    );
-  if (res.status === 404 && input.deviceToken)
-    throw new CompanionError(
-      "The setup code or saved device credential is unavailable. If this device was removed, run cabane logout, then take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
-    );
-  if (res.status === 404 || res.status === 410)
+  let raw;
+  try {
+    raw = await res.text();
+  } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
-      "That setup code is unavailable. Take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
+      `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
-  if (!res.ok) throw new ApiError(res.status, `Setup failed (${res.status}).`);
-  const body = await res.json();
-  if (!body || typeof body !== "object" || !("baseUrl" in body) || typeof body.baseUrl !== "string" || !("deviceId" in body) || typeof body.deviceId !== "string")
-    throw new CompanionError("Cabane returned an incomplete setup response.");
-  const token = "deviceToken" in body && typeof body.deviceToken === "string" ? body.deviceToken : input.deviceToken;
-  if (!token) throw new CompanionError("Cabane returned no device credential.");
+  }
+  let parsed = void 0;
+  if (raw.length > 0) {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = raw;
+    }
+  }
+  if (res.status >= 400) {
+    if (res.status === 429)
+      throw new CompanionError(
+        "Too many pairing requests from this network. Wait a few minutes and run  cabane setup  again."
+      );
+    if (res.status === 404 && path.endsWith("/code"))
+      throw new CompanionError(
+        `No pairing endpoint at ${baseUrl}. Either that server is too old for this companion, or it isn't a Cabane API origin: the hosted app is https://app.cabane.ai (pass \`--server <url>\` for your own instance).`
+      );
+    const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
+    throw new ApiError(res.status, `${res.status} ${msg}`, parsed);
+  }
+  return parsed;
+}
+function requestEnrollmentCode(baseUrl, opts = {}) {
+  return postJson(
+    baseUrl,
+    "/api/device-enrollment/code",
+    { ...opts.label ? { label: opts.label } : {}, ...hostFacts() },
+    opts.signal
+  );
+}
+function hostFacts() {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "", 10);
   return {
-    baseUrl: body.baseUrl,
-    deviceToken: token,
-    deviceId: body.deviceId,
-    ..."workspace" in body && body.workspace && typeof body.workspace === "object" && "name" in body.workspace && typeof body.workspace.name === "string" && "slug" in body.workspace && typeof body.workspace.slug === "string" ? { workspace: { name: body.workspace.name, slug: body.workspace.slug } } : {},
-    ..."devicesUrl" in body && typeof body.devicesUrl === "string" ? { devicesUrl: body.devicesUrl } : {},
-    ..."deviceLabel" in body && typeof body.deviceLabel === "string" ? { deviceLabel: body.deviceLabel } : {}
+    platform: process.platform,
+    arch: process.arch,
+    ...Number.isInteger(nodeMajor) ? { nodeMajor } : {}
   };
 }
 function deviceLabelFromHostname(hostname3) {
   const trimmed = hostname3.trim().replace(/\.local$/i, "");
   return trimmed.length ? trimmed.slice(0, 120) : void 0;
 }
+function pollOnce(baseUrl, deviceCode, signal) {
+  return postJson(baseUrl, "/api/device-enrollment/poll", { deviceCode }, signal);
+}
+var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+async function awaitEnrollment(baseUrl, code, opts = {}) {
+  const now = opts.now ?? (() => Date.now());
+  const wait = opts.sleepMs ?? sleep;
+  const deadline = now() + code.expiresIn * 1e3;
+  let intervalMs = Math.max(1, code.interval) * 1e3;
+  while (now() < deadline) {
+    await wait(intervalMs);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    const res = await pollOnce(baseUrl, code.deviceCode, opts.signal);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    if (res.status === "complete") {
+      if (!res.deviceToken || !res.baseUrl)
+        throw new CompanionError("Cabane reported the pairing complete but returned no token.");
+      return {
+        baseUrl: res.baseUrl,
+        deviceToken: res.deviceToken,
+        ...res.deviceId ? { deviceId: res.deviceId } : {},
+        ...res.deviceLabel ? { deviceLabel: res.deviceLabel } : {}
+      };
+    }
+    if (res.status === "expired") throw new EnrollmentExpiredError();
+    if (res.status === "slow_down") intervalMs += 1e3;
+  }
+  throw new EnrollmentExpiredError();
+}
+
+// src/terminal-copy.ts
+init_cabane_command();
+var UNPAIRED = `This device isn't paired yet. Run  ${cabane("setup")}  on it.`;
+var lease = DEFAULT_DEVICE_OFFLINE_THRESHOLD_MS;
+function age(at, now) {
+  const seconds = Math.max(0, Math.floor((now - Date.parse(at)) / 1e3));
+  return seconds < 60 ? `${seconds}s` : seconds < 3600 ? `${Math.floor(seconds / 60)}m` : `${Math.floor(seconds / 3600)}h`;
+}
+function deviceLine(f, now = Date.now()) {
+  if (!f.running) return `not running \u2014 start it with  ${cabane("start")}`;
+  if (f.lastHeartbeatRefused)
+    return `refused by the server \u2014 it may be deactivated; see ${f.devicesUrl}`;
+  if (!f.lastHeartbeatAckAt) return "starting \u2014 hasn't checked in yet";
+  const since = age(f.lastHeartbeatAckAt, now);
+  if (now - Date.parse(f.lastHeartbeatAckAt) > lease)
+    return `can't reach the server \u2014 last checked in ${since} ago`;
+  const view = f.lastAcknowledgedDevice;
+  if (!view) return `checked in ${since} ago`;
+  const word = view.state === "online" && view.health ? view.health === "checking" ? "online, checking harnesses\u2026" : DEVICE_HEALTH_LABEL[view.health] : DEVICE_STATE_LABEL[view.state];
+  return `${word.toLowerCase()} \u2014 checked in ${since} ago`;
+}
+function pairingLine(pair) {
+  return `\u2713 Paired as "${pair.deviceLabel ?? "Computer"}".`;
+}
+function pathLines(reload) {
+  return reload ? [`  To use cabane in this window:  ${reload}`, ""] : [];
+}
+function agentLines(detection, opts) {
+  const rows = agentRows(detection, opts);
+  const names = rows.map((row3) => row3.usable ? `\u2713 ${row3.label}` : row3.label);
+  const width = Math.max(...names.map((name) => name.length)) + 3;
+  return rows.map((row3, i) => `${names[i].padEnd(width)}${row3.text}`);
+}
+var modeLines = {
+  background: "Cabane is running in the background",
+  service: "Cabane is running as a service",
+  attached: "Cabane is running in this process",
+  existing: "Cabane was already running"
+};
+function closingBlock(input, now = Date.now()) {
+  const { mode, facts } = input;
+  const device = deviceLine(facts, now);
+  const noAck = !facts.lastHeartbeatAckAt && !facts.lastHeartbeatRefused;
+  const stale = facts.lastHeartbeatAckAt !== null && now - Date.parse(facts.lastHeartbeatAckAt) > lease;
+  const modeLine = modeLines[mode];
+  const sentence = noAck ? `${mode === "background" ? "Cabane started in the background" : modeLine} but hasn't checked in yet.` : `${modeLine}. ${facts.lastHeartbeatRefused || stale ? device[0].toUpperCase() + device.slice(1) : `This device ${device.startsWith("checked in") || device.startsWith("needs attention") ? "" : "is "}${device}`}.`;
+  const lines2 = [`  ${sentence}`, "", ...pathLines(input.reload)];
+  if (noAck || stale || facts.lastHeartbeatRefused) {
+    lines2.push(
+      `  See what it's doing:  ${cabane("status")}${facts.lastHeartbeatRefused ? "" : `     Log:  ${cabane("logs")}`}`
+    );
+  } else {
+    lines2.push("  Harnesses on this device");
+    lines2.push(
+      ...(input.detection ? agentLines(input.detection, { signInHint: true }) : ["Claude Code   checking", "Codex         checking", "OpenCode      checking"]).map((line) => `  ${line}`)
+    );
+    lines2.push(
+      "",
+      `  Status  ${cabane("status")}${mode === "attached" ? "" : `     Stop  ${cabane("stop")}`}     Log  ${cabane("logs")}`
+    );
+    if (!input.service && input.servicePlatform) {
+      lines2.push(
+        `  Start at login and keep Cabane updating itself:  ${cabane("service install")}${input.servicePlatform === "launchd" ? " (macOS will ask you to allow a background item)" : ""}`
+      );
+      lines2.push(
+        `  Updates itself only as a service; to turn that off:  ${cabane("update --auto off")}`
+      );
+    } else if (input.service && input.autoUpdate)
+      lines2.push(`  Updating itself; to turn that off:  ${cabane("update --auto off")}`);
+  }
+  if (input.address) lines2.push("", `  In Cabane: ${input.address}`);
+  if (mode === "attached") lines2.push("", "  Listening for messages\u2026");
+  return lines2;
+}
+function startFailure(message2, reload) {
+  return [
+    ...pathLines(reload),
+    `\u2717 Cabane couldn't start: ${message2}`,
+    "",
+    `  Log:  ${cabane("logs")}     Try again:  ${cabane("start")}`
+  ];
+}
+
+// src/pair-flow.ts
+var MAX_CODES = 3;
+async function pairDevice(opts, deps = {}) {
+  const requestCode = deps.requestCode ?? requestEnrollmentCode;
+  const wait = deps.await ?? awaitEnrollment;
+  const open2 = deps.open ?? openLink;
+  const { ui, interactive } = opts;
+  const label = deviceLabelFromHostname(hostname());
+  const aborter = new AbortController();
+  const onSigint = () => aborter.abort();
+  process.on("SIGINT", onSigint);
+  const spinner = ui.spinner();
+  let current = null;
+  const keys = interactive ? watchReturn({
+    onReturn: () => {
+      if (!current) return;
+      const link = current.verificationUriComplete;
+      void open2(link).then((opened) => {
+        if (!opened)
+          spinner.message(
+            `Couldn't open a browser here. Open this page on any device: ${link}`
+          );
+      });
+    },
+    onInterrupt: () => aborter.abort(),
+    ...deps.input ? { input: deps.input } : {}
+  }) : null;
+  let minutesWaited = 0;
+  let waiting = false;
+  try {
+    for (let attempt = 1; attempt <= MAX_CODES; attempt += 1) {
+      let code;
+      try {
+        code = await requestCode(opts.baseUrl, {
+          ...label ? { label } : {},
+          signal: aborter.signal
+        });
+      } catch (err) {
+        if (!(err instanceof EnrollmentCancelledError)) throw err;
+        ui.cancel(`Pairing cancelled. Run  ${cabane("setup")}  when you're ready.`);
+        process.exitCode = 130;
+        return null;
+      }
+      current = code;
+      const minutes = Math.max(1, Math.round(code.expiresIn / 60));
+      const codeLines = ["", `  ${code.userCode}`, `  ${code.verificationUriComplete}`, ""];
+      if (attempt === 1) {
+        ui.step([
+          "Pair this device",
+          interactive ? "Enter this code in Cabane, or press Return to open the page:" : "Enter this code in Cabane:",
+          ...codeLines
+        ]);
+      } else {
+        ui.step(codeLines.slice(1));
+      }
+      spinner.start(
+        `Waiting for you to confirm in Cabane\u2026 (the code is good for ${minutes} minutes)`
+      );
+      waiting = true;
+      try {
+        const device = await wait(opts.baseUrl, code, { signal: aborter.signal });
+        waiting = false;
+        spinner.stop(pairingLine(device));
+        return device;
+      } catch (err) {
+        waiting = false;
+        if (err instanceof EnrollmentCancelledError) {
+          spinner.stop("Pairing stopped.");
+          ui.cancel(`Pairing cancelled. Run  ${cabane("setup")}  when you're ready.`);
+          process.exitCode = 130;
+          return null;
+        }
+        if (!(err instanceof EnrollmentExpiredError)) {
+          spinner.stop("Pairing stopped.");
+          throw err;
+        }
+        minutesWaited += minutes;
+        if (attempt < MAX_CODES) {
+          spinner.stop("That code expired. Here's a fresh one:");
+          continue;
+        }
+        spinner.stop(
+          `Nothing confirmed in ${minutesWaited} minutes. Run  ${cabane("setup")}  when you're ready.`
+        );
+        process.exitCode = 1;
+        return null;
+      }
+    }
+    return null;
+  } finally {
+    if (waiting) spinner.stop("Pairing stopped.");
+    keys?.release();
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+function watchReturn(handlers) {
+  const input = handlers.input ?? process.stdin;
+  if (!input.isTTY || typeof input.setRawMode !== "function") return { release: () => {
+  } };
+  const wasRaw = input.isRaw;
+  const onData = (chunk) => {
+    const text = chunk.toString();
+    if (text.includes("")) handlers.onInterrupt();
+    else if (text.includes("\r") || text.includes("\n")) handlers.onReturn();
+  };
+  input.setRawMode(true);
+  input.on("data", onData);
+  input.resume();
+  return {
+    release: () => {
+      input.removeListener("data", onData);
+      input.setRawMode(wasRaw);
+      input.pause();
+    }
+  };
+}
+function pageOpener(platform, link) {
+  if (platform === "darwin") return { command: "open", args: [link] };
+  if (platform === "win32") return { command: "cmd", args: ["/c", "start", '""', `"${link}"`] };
+  return { command: "xdg-open", args: [link] };
+}
+function openLink(link) {
+  return new Promise((resolve2) => {
+    const { command, args } = pageOpener(process.platform, link);
+    try {
+      const child = spawn3(command, args, {
+        stdio: "ignore",
+        detached: true,
+        // `cmd` parses its own line: the quoting above is the one it needs, as written.
+        ...process.platform === "win32" ? { windowsVerbatimArguments: true } : {}
+      });
+      child.once("error", () => resolve2(false));
+      child.once("exit", (code) => resolve2(code === 0));
+      child.unref();
+    } catch {
+      resolve2(false);
+    }
+  });
+}
 
 // src/commands/start.ts
 init_cabane_command();
@@ -12501,7 +12785,7 @@ var emptyHeartbeatStatus = () => ({
 
 // src/supervisor.ts
 init_cabane_command();
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
 
 // src/log-copy.ts
 init_failure();
@@ -13541,7 +13825,7 @@ function hostReport() {
 }
 
 // src/providers/local-process.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { constants as constants2 } from "os";
 var DEFAULT_KILL_GRACE_MS = 3e4;
 var DEFAULT_REAP_GRACE_MS = 3e3;
@@ -13552,7 +13836,7 @@ function exitCode(code, signal) {
 }
 function createLocalProcessProvider(opts = {}) {
   const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
-  const spawnFn = opts.spawnFn ?? spawn4;
+  const spawnFn = opts.spawnFn ?? spawn5;
   const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
   const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
   const groupAlive = (pgid) => {
@@ -13928,7 +14212,7 @@ var SseSubscriber = class {
 init_transcript_writer();
 
 // src/updater.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { copyFileSync as copyFileSync2, existsSync as existsSync16, mkdirSync as mkdirSync14, renameSync as renameSync9, rmSync as rmSync10 } from "fs";
 import { dirname as dirname11, join as join26 } from "path";
 
@@ -14143,7 +14427,7 @@ var runProcess = (command, args, opts = {}) => new Promise((resolve2) => {
   let stderr = "";
   let child;
   try {
-    child = spawn5(command, [...args], {
+    child = spawn6(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: opts.env ?? process.env
     });
@@ -14647,7 +14931,7 @@ var CompanionSupervisor = class {
     if (this.stopped) return;
     this.log.info(
       { protocolVersion: TURN_PROTOCOL_VERSION, version: COMPANION_VERSION },
-      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname()}`
+      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname2()}`
     );
     const retired = retiredConfigKeysOnDisk();
     if (retired.length > 0) {
@@ -14682,9 +14966,7 @@ var CompanionSupervisor = class {
     this.detectTimer = setInterval(() => void this.detect(), DETECT_INTERVAL_MS);
     this.detectTimer.unref?.();
     if (!this.deviceApi || !this.config.deviceToken) {
-      this.log.warn(
-        "This device isn't paired. Get a setup line from a workspace's Settings \u2192 Devices."
-      );
+      this.log.warn(`This device isn't paired. Run  ${cabane("setup")}  on it.`);
       return;
     }
     this.deviceSub = new SseSubscriber({
@@ -14695,7 +14977,7 @@ var CompanionSupervisor = class {
       log: this.log,
       lastEventId: null,
       onOpen: () => {
-        this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname()}`);
+        this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`);
         this.deviceConnected = true;
         for (const wr of this.workspaces.values()) {
           this.hub.setConnected(wr.workspaceId, true);
@@ -15928,9 +16210,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn7 }) => {
+  void import("child_process").then(({ spawn: spawn8 }) => {
     try {
-      const child = spawn7(process.execPath, process.argv.slice(1), {
+      const child = spawn8(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -16279,13 +16561,13 @@ async function observeStart(deps = {}) {
   const read2 = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? verifyRuntime;
   const now = deps.now ?? Date.now;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const deadline = now() + 8e3;
   for (; ; ) {
     const state = await read2();
     if (state?.socket && await verify(state) === "ours") return state;
     if (now() >= deadline) return null;
-    await sleep3(Math.min(150, Math.max(0, deadline - now())));
+    await sleep4(Math.min(150, Math.max(0, deadline - now())));
   }
 }
 function markLaunchRequester() {
@@ -16703,7 +16985,7 @@ async function controlService(action, deps) {
 init_cabane_command();
 init_cli_entry();
 init_config();
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import { closeSync as closeSync3, mkdirSync as mkdirSync17, openSync as openSync4 } from "fs";
 init_config();
 async function startDaemon(opts = {}, deps = {}) {
@@ -16785,7 +17067,7 @@ function defaultSpawnDetached(args) {
   mkdirSync17(cabaneDir(), { recursive: true });
   const logFd = openSync4(companionLogPath(), "a");
   try {
-    const child = spawn6(process.execPath, [cliPath, ...args], {
+    const child = spawn7(process.execPath, [cliPath, ...args], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env, CABANE_COMPANION_DAEMON: "1" }
@@ -16803,89 +17085,6 @@ function defaultSpawnDetached(args) {
   }
 }
 
-// src/terminal-copy.ts
-init_cabane_command();
-var UNPAIRED = "This device isn't paired yet. Get a setup line from a workspace's Settings \u2192 Devices and paste it here.";
-var lease = DEFAULT_DEVICE_OFFLINE_THRESHOLD_MS;
-function age(at, now) {
-  const seconds = Math.max(0, Math.floor((now - Date.parse(at)) / 1e3));
-  return seconds < 60 ? `${seconds}s` : seconds < 3600 ? `${Math.floor(seconds / 60)}m` : `${Math.floor(seconds / 3600)}h`;
-}
-function deviceLine(f, now = Date.now()) {
-  if (!f.running) return `not running \u2014 start it with  ${cabane("start")}`;
-  if (f.lastHeartbeatRefused)
-    return `refused by the server \u2014 it may be deactivated; see ${f.devicesUrl}`;
-  if (!f.lastHeartbeatAckAt) return "starting \u2014 hasn't checked in yet";
-  const since = age(f.lastHeartbeatAckAt, now);
-  if (now - Date.parse(f.lastHeartbeatAckAt) > lease)
-    return `can't reach the server \u2014 last checked in ${since} ago`;
-  const view = f.lastAcknowledgedDevice;
-  if (!view) return `checked in ${since} ago`;
-  const word = view.state === "online" && view.health ? view.health === "checking" ? "online, checking harnesses\u2026" : DEVICE_HEALTH_LABEL[view.health] : DEVICE_STATE_LABEL[view.state];
-  return `${word.toLowerCase()} \u2014 checked in ${since} ago`;
-}
-function pairingLine(pair) {
-  return `\u2713 Paired as "${pair.deviceLabel ?? "Computer"}" with ${pair.workspace?.name ?? "the workspace"}.`;
-}
-function pathLines(reload) {
-  return reload ? [`  To use cabane in this window:  ${reload}`, ""] : [];
-}
-function agentLines(detection, opts) {
-  const rows = agentRows(detection, opts);
-  const names = rows.map((row3) => row3.usable ? `\u2713 ${row3.label}` : row3.label);
-  const width = Math.max(...names.map((name) => name.length)) + 3;
-  return rows.map((row3, i) => `${names[i].padEnd(width)}${row3.text}`);
-}
-var modeLines = {
-  background: "Cabane is running in the background",
-  service: "Cabane is running as a service",
-  attached: "Cabane is running in this process",
-  existing: "Cabane was already running"
-};
-function closingBlock(input, now = Date.now()) {
-  const { mode, facts } = input;
-  const device = deviceLine(facts, now);
-  const noAck = !facts.lastHeartbeatAckAt && !facts.lastHeartbeatRefused;
-  const stale = facts.lastHeartbeatAckAt !== null && now - Date.parse(facts.lastHeartbeatAckAt) > lease;
-  const modeLine = modeLines[mode];
-  const sentence = noAck ? `${mode === "background" ? "Cabane started in the background" : modeLine} but hasn't checked in yet.` : `${modeLine}. ${facts.lastHeartbeatRefused || stale ? device[0].toUpperCase() + device.slice(1) : `This device ${device.startsWith("checked in") || device.startsWith("needs attention") ? "" : "is "}${device}`}.`;
-  const lines2 = [`  ${sentence}`, "", ...pathLines(input.reload)];
-  if (noAck || stale || facts.lastHeartbeatRefused) {
-    lines2.push(
-      `  See what it's doing:  ${cabane("status")}${facts.lastHeartbeatRefused ? "" : `     Log:  ${cabane("logs")}`}`
-    );
-  } else {
-    lines2.push("  Harnesses on this device");
-    lines2.push(
-      ...(input.detection ? agentLines(input.detection, { signInHint: true }) : ["Claude Code   checking", "Codex         checking", "OpenCode      checking"]).map((line) => `  ${line}`)
-    );
-    lines2.push(
-      "",
-      `  Status  ${cabane("status")}${mode === "attached" ? "" : `     Stop  ${cabane("stop")}`}     Log  ${cabane("logs")}`
-    );
-    if (!input.service && input.servicePlatform) {
-      lines2.push(
-        `  Start at login and keep Cabane updating itself:  ${cabane("service install")}${input.servicePlatform === "launchd" ? " (macOS will ask you to allow a background item)" : ""}`
-      );
-      lines2.push(
-        `  Updates itself only as a service; to turn that off:  ${cabane("update --auto off")}`
-      );
-    } else if (input.service && input.autoUpdate)
-      lines2.push(`  Updating itself; to turn that off:  ${cabane("update --auto off")}`);
-  }
-  if (input.address) lines2.push("", `  In Cabane: ${input.address}`);
-  if (mode === "attached") lines2.push("", "  Listening for messages\u2026");
-  return lines2;
-}
-function startFailure(message2, reload) {
-  return [
-    ...pathLines(reload),
-    `\u2717 Cabane couldn't start: ${message2}`,
-    "",
-    `  Log:  ${cabane("logs")}     Try again:  ${cabane("start")}`
-  ];
-}
-
 // src/terminal-status.ts
 async function readTerminalStatus(socket, timeoutMs = 1e3) {
   if (!socket) return emptyHeartbeatStatus();
@@ -17024,18 +17223,17 @@ async function startScript(opts, deps) {
       if (service2.state !== "running" || service2.pid !== current.pid) mode = "existing";
     }
   }
-  const personalUrl = `${cfg.baseUrl.replace(/\/$/, "")}/settings/devices`;
-  const address = opts.pairing ? opts.pairing.devicesUrl : personalUrl;
+  const address = `${cfg.baseUrl.replace(/\/$/, "")}/settings/devices`;
   if (!daemon)
     for (const line of closingBlock({
       mode,
-      facts: { ...status2, running: true, devicesUrl: address ?? personalUrl },
+      facts: { ...status2, running: true, devicesUrl: address },
       detection,
       reload: reloadLine(),
       service: installed,
       servicePlatform: servicePlatform(),
       autoUpdate: cfg.update?.auto !== false,
-      ...address ? { address } : {}
+      address
     }))
       write(line);
   if (runtime) {
@@ -17171,22 +17369,22 @@ async function setup(opts = {}, deps = {}) {
   } catch (err) {
     for (const line of pathLines(reloadLine())) write(line);
     write(err instanceof Error ? err.message : String(err));
-    write(
-      "Check the server connection, then take a fresh setup line from the workspace's Settings \u2192 Devices."
-    );
+    write(`Check the server connection, then run  ${cabane("setup")}  again.`);
     process.exitCode = 1;
   } finally {
     setConsoleLogging(true);
   }
 }
 async function setupScript(opts, deps) {
-  const interactive = deps.interactive ?? isInteractive();
-  const paired = isDevicePaired();
-  if (!opts.code && !paired) {
-    write(UNPAIRED);
+  if (opts.code) {
+    write(
+      `Setup codes come from this device now: run  ${cabane("setup")}  and enter the code it shows in Cabane.`
+    );
     process.exitCode = 1;
     return;
   }
+  const interactive = deps.interactive ?? isInteractive();
+  const paired = isDevicePaired();
   const ui = deps.ui ?? (interactive ? terminalUi() : plainUi());
   const running = await (deps.live ?? liveCompanionState)();
   const cfg = safeLoadConfig();
@@ -17197,32 +17395,16 @@ async function setupScript(opts, deps) {
     process.exitCode = 1;
     return;
   }
-  let device;
-  if (opts.code) {
+  let justPaired = false;
+  if (!paired) {
     const baseUrl = resolvePairBaseUrl(opts.server ?? cfg?.baseUrl);
-    if (paired && cfg && new URL(cfg.baseUrl).origin !== new URL(baseUrl).origin) {
-      for (const line of pathLines(reloadLine())) write(line);
-      write(
-        "This device is paired to another Cabane server. Log out before setting it up on a different server."
-      );
-      write(`Run  ${cabane("logout")}  before using the new setup line.`);
-      process.exitCode = 1;
-      return;
-    }
-    device = await (deps.claim ?? claimSetupCode)(baseUrl, {
-      userCode: opts.code,
-      label: deviceLabelFromHostname(hostname2()) ?? "Computer",
-      ...paired && cfg?.deviceToken ? { deviceToken: cfg.deviceToken } : {}
-    });
+    const device = await (deps.pair ?? pairDevice)({ baseUrl, interactive, ui });
+    if (!device) return;
     writePairedConfig(device);
-    write(pairingLine(device));
+    justPaired = true;
   }
   const detection = await start(
-    {
-      ...opts,
-      ...device ? { pairing: device } : {},
-      ...!interactive && device ? { foreground: true } : {}
-    },
+    { ...opts, ...!interactive && justPaired ? { foreground: true } : {} },
     { ...deps, interactive }
   );
   if (interactive && detection && !anyUsable(detection)) {
@@ -17443,7 +17625,7 @@ async function stop(deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? ((s) => verifyRuntime(s));
   const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   const state = readState();
   if (!state) {
@@ -17471,7 +17653,7 @@ async function stop(deps = {}) {
       process.stdout.write("companion: stopped.\n");
       return;
     }
-    await sleep3(POLL_INTERVAL_MS);
+    await sleep4(POLL_INTERVAL_MS);
   }
   process.stdout.write(
     `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
@@ -17497,7 +17679,7 @@ function isAlive(kill, pid) {
 var STARTUP_WAIT_MS = 2e4;
 async function installAndStartService(deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? Date.now;
   const before = await serviceState(deps);
   const running = readState();
@@ -17513,7 +17695,7 @@ async function installAndStartService(deps = {}) {
   while (now() < deadline) {
     const state = readState();
     if (state?.socket) return true;
-    await sleep3(250);
+    await sleep4(250);
   }
   write(
     `${INDENT}The service is installed but Cabane hasn't come up yet. ${cabane("service status")} and ${cabane("logs")} say why.`
@@ -17643,9 +17825,7 @@ async function status(deps = {}) {
     cfg = null;
   }
   if (!cfg || !cfg.deviceToken) {
-    out(
-      "  Not paired yet. Get a setup line from a workspace's Settings \u2192 Devices and paste it here."
-    );
+    out(`  Not paired yet. Run  ${cabane("setup")}  on this device.`);
     for (const line of strays) out(line);
     process.exitCode = 1;
     return;
@@ -18308,7 +18488,7 @@ init_cabane_command();
 rememberInvokedCommand();
 var program = new Command();
 program.name("cabane").description("Run your Cabane agents on this device, with Claude Code, Codex or OpenCode.").version(COMPANION_VERSION);
-program.command("setup [code]").description("set up this device: find your agents, pair it with Cabane, and keep it running.").allowExcessArguments(false).option("--server <url>", "the Cabane instance to pair with (default https://app.cabane.ai)").addOption(
+program.command("setup").argument("[code]", "not taken: run  cabane setup  and enter the code it shows in Cabane").description("set up this device: find your agents, pair it with Cabane, and keep it running.").allowExcessArguments(false).option("--server <url>", "the Cabane instance to pair with (default https://app.cabane.ai)").addOption(
   new Option("--log-level <level>", "info (default), warn, or debug").choices([
     "info",
     "warn",

package/dist/pairing-config.js

@@ -413,55 +413,112 @@ function saveConfig(cfg) {
 }
 
 // src/enrollment.ts
-async function claimSetupCode(baseUrl, input) {
+var EnrollmentExpiredError = class extends CompanionError {
+  constructor() {
+    super("this pairing code expired before it was confirmed.");
+    this.name = "EnrollmentExpiredError";
+  }
+};
+var EnrollmentCancelledError = class extends CompanionError {
+  constructor() {
+    super("pairing was cancelled.");
+    this.name = "EnrollmentCancelledError";
+  }
+};
+function trimBase(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+async function postJson(baseUrl, path, body, signal) {
   let res;
   try {
-    res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/device-enrollment/claim`, {
+    res = await fetch(`${trimBase(baseUrl)}${path}`, {
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...input.deviceToken ? { authorization: `Bearer ${input.deviceToken}` } : {}
-      },
-      body: JSON.stringify({
-        userCode: input.userCode,
-        label: input.label,
-        platform: process.platform,
-        arch: process.arch,
-        nodeMajor: Number.parseInt(process.versions.node.split(".")[0], 10)
-      })
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(body),
+      ...signal ? { signal } : {}
     });
   } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
       `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
   }
-  if (res.status === 429)
-    throw new CompanionError(
-      "Too many attempts from this network. Wait a few minutes and paste the setup line again."
-    );
-  if (res.status === 404 && input.deviceToken)
-    throw new CompanionError(
-      "The setup code or saved device credential is unavailable. If this device was removed, run cabane logout, then take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
-    );
-  if (res.status === 404 || res.status === 410)
+  let raw;
+  try {
+    raw = await res.text();
+  } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
-      "That setup code is unavailable. Take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
+      `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
-  if (!res.ok) throw new ApiError(res.status, `Setup failed (${res.status}).`);
-  const body = await res.json();
-  if (!body || typeof body !== "object" || !("baseUrl" in body) || typeof body.baseUrl !== "string" || !("deviceId" in body) || typeof body.deviceId !== "string")
-    throw new CompanionError("Cabane returned an incomplete setup response.");
-  const token = "deviceToken" in body && typeof body.deviceToken === "string" ? body.deviceToken : input.deviceToken;
-  if (!token) throw new CompanionError("Cabane returned no device credential.");
+  }
+  let parsed = void 0;
+  if (raw.length > 0) {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = raw;
+    }
+  }
+  if (res.status >= 400) {
+    if (res.status === 429)
+      throw new CompanionError(
+        "Too many pairing requests from this network. Wait a few minutes and run  cabane setup  again."
+      );
+    if (res.status === 404 && path.endsWith("/code"))
+      throw new CompanionError(
+        `No pairing endpoint at ${baseUrl}. Either that server is too old for this companion, or it isn't a Cabane API origin: the hosted app is https://app.cabane.ai (pass \`--server <url>\` for your own instance).`
+      );
+    const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
+    throw new ApiError(res.status, `${res.status} ${msg}`, parsed);
+  }
+  return parsed;
+}
+function requestEnrollmentCode(baseUrl, opts = {}) {
+  return postJson(
+    baseUrl,
+    "/api/device-enrollment/code",
+    { ...opts.label ? { label: opts.label } : {}, ...hostFacts() },
+    opts.signal
+  );
+}
+function hostFacts() {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "", 10);
   return {
-    baseUrl: body.baseUrl,
-    deviceToken: token,
-    deviceId: body.deviceId,
-    ..."workspace" in body && body.workspace && typeof body.workspace === "object" && "name" in body.workspace && typeof body.workspace.name === "string" && "slug" in body.workspace && typeof body.workspace.slug === "string" ? { workspace: { name: body.workspace.name, slug: body.workspace.slug } } : {},
-    ..."devicesUrl" in body && typeof body.devicesUrl === "string" ? { devicesUrl: body.devicesUrl } : {},
-    ..."deviceLabel" in body && typeof body.deviceLabel === "string" ? { deviceLabel: body.deviceLabel } : {}
+    platform: process.platform,
+    arch: process.arch,
+    ...Number.isInteger(nodeMajor) ? { nodeMajor } : {}
   };
 }
+function pollOnce(baseUrl, deviceCode, signal) {
+  return postJson(baseUrl, "/api/device-enrollment/poll", { deviceCode }, signal);
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function awaitEnrollment(baseUrl, code, opts = {}) {
+  const now = opts.now ?? (() => Date.now());
+  const wait = opts.sleepMs ?? sleep;
+  const deadline = now() + code.expiresIn * 1e3;
+  let intervalMs = Math.max(1, code.interval) * 1e3;
+  while (now() < deadline) {
+    await wait(intervalMs);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    const res = await pollOnce(baseUrl, code.deviceCode, opts.signal);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    if (res.status === "complete") {
+      if (!res.deviceToken || !res.baseUrl)
+        throw new CompanionError("Cabane reported the pairing complete but returned no token.");
+      return {
+        baseUrl: res.baseUrl,
+        deviceToken: res.deviceToken,
+        ...res.deviceId ? { deviceId: res.deviceId } : {},
+        ...res.deviceLabel ? { deviceLabel: res.deviceLabel } : {}
+      };
+    }
+    if (res.status === "expired") throw new EnrollmentExpiredError();
+    if (res.status === "slow_down") intervalMs += 1e3;
+  }
+  throw new EnrollmentExpiredError();
+}
 
 // src/pairing-config.ts
 var DEFAULT_BASE_URL = "https://app.cabane.ai";
@@ -496,8 +553,11 @@ function isDevicePaired() {
 export {
   ApiError,
   CompanionError,
-  claimSetupCode,
+  EnrollmentCancelledError,
+  EnrollmentExpiredError,
+  awaitEnrollment,
   isDevicePaired,
+  requestEnrollmentCode,
   resolvePairBaseUrl,
   writePairedConfig
 };

package/dist/runtime.js

@@ -10201,9 +10201,7 @@ var CompanionSupervisor = class {
     this.detectTimer = setInterval(() => void this.detect(), DETECT_INTERVAL_MS);
     this.detectTimer.unref?.();
     if (!this.deviceApi || !this.config.deviceToken) {
-      this.log.warn(
-        "This device isn't paired. Get a setup line from a workspace's Settings \u2192 Devices."
-      );
+      this.log.warn(`This device isn't paired. Run  ${cabane("setup")}  on it.`);
       return;
     }
     this.deviceSub = new SseSubscriber({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.213",
+  "version": "0.6.215",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",