@cabane/companion 0.6.214 → 0.6.216

package/dist/cli.js

@@ -778,7 +778,10 @@ var init_config = __esm({
       // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
       // what a wrapper can rely on.
       runner: z2.object({
-        command: z2.array(z2.string().min(1)).min(1)
+        command: z2.array(z2.string().min(1)).min(1),
+        // The external wrapper supplies only broker placeholders and removes
+        // credential mounts. Do not hand provider logins to that runner on stdin.
+        brokeredCredentials: z2.boolean().optional()
       }).strict().optional()
     });
     RETIRED_ROW_KEYS = ["sandbox"];
@@ -1418,7 +1421,7 @@ function pathForLog(path) {
   const q = path.indexOf("?");
   return q === -1 ? path : path.slice(0, q);
 }
-function sleep(ms, signal) {
+function sleep2(ms, signal) {
   return new Promise((resolve2) => {
     if (signal?.aborted) return resolve2();
     const timer = setTimeout(() => {
@@ -1521,7 +1524,7 @@ var init_api = __esm({
               },
               "companion: API call failed transiently; retrying"
             );
-            await sleep(delayMs, signal);
+            await sleep2(delayMs, signal);
             if (signal?.aborted) throw err;
           }
         }
@@ -7510,7 +7513,7 @@ var init_opencode_lock = __esm({
 });
 
 // src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn3 } from "child_process";
+import { execFile, execFileSync, spawn as spawn4 } from "child_process";
 import { readFileSync as readFileSync6 } from "fs";
 import { promisify as promisify2 } from "util";
 function turnScopeUnit(turnId, attempt) {
@@ -7639,7 +7642,7 @@ function createTurnContainment(turnId, deps = {}) {
       command: options.command
     });
     return asContained(
-      spawn3("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
+      spawn4("systemd-run", [...scopeArgs(unit), options.command, ...options.args], {
         ...options.cwd ? { cwd: options.cwd } : {},
         env: options.env,
         stdio: ["pipe", "pipe", "pipe"]
@@ -7647,7 +7650,7 @@ function createTurnContainment(turnId, deps = {}) {
     );
   }
   function spawnInGroup(options) {
-    const child = spawn3(options.command, options.args, {
+    const child = spawn4(options.command, options.args, {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
@@ -7729,7 +7732,7 @@ function createTurnContainment(turnId, deps = {}) {
         } catch {
         }
       }
-      await sleep2(fallbackGraceMs);
+      await sleep3(fallbackGraceMs);
       const afterTerm = processGroupMembers(pgid);
       if (!afterTerm.ok) {
         result.failures.push({
@@ -7792,7 +7795,7 @@ function createTurnContainment(turnId, deps = {}) {
     }
   };
 }
-var execFileAsync, asContained, CONTAINMENT_STOP_GRACE_SEC, FALLBACK_GRACE_MS, CAPABILITY_PROBE_TIMEOUT_MS, OOM_READ_TIMEOUT_MS, sleep2, MANAGER_ENV_KEYS, managerEnvKey;
+var execFileAsync, asContained, CONTAINMENT_STOP_GRACE_SEC, FALLBACK_GRACE_MS, CAPABILITY_PROBE_TIMEOUT_MS, OOM_READ_TIMEOUT_MS, sleep3, MANAGER_ENV_KEYS, managerEnvKey;
 var init_turn_containment = __esm({
   "src/turn-containment.ts"() {
     "use strict";
@@ -7802,7 +7805,7 @@ var init_turn_containment = __esm({
     FALLBACK_GRACE_MS = CONTAINMENT_STOP_GRACE_SEC * 1e3;
     CAPABILITY_PROBE_TIMEOUT_MS = 4e3;
     OOM_READ_TIMEOUT_MS = 1500;
-    sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    sleep3 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
     MANAGER_ENV_KEYS = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR", "PATH"];
     managerEnvKey = (env) => MANAGER_ENV_KEYS.map((k) => `${k}=${env[k] ?? ""}`).join("\0");
   }
@@ -8464,7 +8467,7 @@ var init_build_options = __esm({
 import { readFile as readFile2 } from "fs/promises";
 import { homedir as homedir7 } from "os";
 import { join as join16 } from "path";
-import { parse } from "smol-toml";
+import { parse as parse2 } from "smol-toml";
 function codexConfigPath(env = process.env, home = homedir7()) {
   return join16(env.CODEX_HOME || join16(home, ".codex"), "config.toml");
 }
@@ -8479,7 +8482,7 @@ async function readCodexConfigSetsSandboxMode(path = codexConfigPath()) {
 }
 function configSetsSandboxMode(text) {
   try {
-    return parse(text).sandbox_mode !== void 0;
+    return parse2(text).sandbox_mode !== void 0;
   } catch {
     return false;
   }
@@ -11729,7 +11732,6 @@ async function liveCompanionState() {
 // src/commands/setup.ts
 init_cabane_command();
 init_config();
-import { hostname as hostname2 } from "os";
 
 // src/logger.ts
 init_config();
@@ -11904,61 +11906,346 @@ function getLogger() {
   return cached;
 }
 
+// src/pair-flow.ts
+init_cabane_command();
+import { spawn as spawn3 } from "child_process";
+import { hostname } from "os";
+
 // src/enrollment.ts
 init_errors();
-async function claimSetupCode(baseUrl, input) {
+var EnrollmentExpiredError = class extends CompanionError {
+  constructor() {
+    super("this pairing code expired before it was confirmed.");
+    this.name = "EnrollmentExpiredError";
+  }
+};
+var EnrollmentCancelledError = class extends CompanionError {
+  constructor() {
+    super("pairing was cancelled.");
+    this.name = "EnrollmentCancelledError";
+  }
+};
+function trimBase(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+async function postJson(baseUrl, path, body, signal) {
   let res;
   try {
-    res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/device-enrollment/claim`, {
+    res = await fetch(`${trimBase(baseUrl)}${path}`, {
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...input.deviceToken ? { authorization: `Bearer ${input.deviceToken}` } : {}
-      },
-      body: JSON.stringify({
-        userCode: input.userCode,
-        label: input.label,
-        platform: process.platform,
-        arch: process.arch,
-        nodeMajor: Number.parseInt(process.versions.node.split(".")[0], 10)
-      })
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(body),
+      ...signal ? { signal } : {}
     });
   } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
       `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
   }
-  if (res.status === 429)
-    throw new CompanionError(
-      "Too many attempts from this network. Wait a few minutes and paste the setup line again."
-    );
-  if (res.status === 404 && input.deviceToken)
-    throw new CompanionError(
-      "The setup code or saved device credential is unavailable. If this device was removed, run cabane logout, then take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
-    );
-  if (res.status === 404 || res.status === 410)
+  let raw;
+  try {
+    raw = await res.text();
+  } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
-      "That setup code is unavailable. Take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
+      `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
-  if (!res.ok) throw new ApiError(res.status, `Setup failed (${res.status}).`);
-  const body = await res.json();
-  if (!body || typeof body !== "object" || !("baseUrl" in body) || typeof body.baseUrl !== "string" || !("deviceId" in body) || typeof body.deviceId !== "string")
-    throw new CompanionError("Cabane returned an incomplete setup response.");
-  const token = "deviceToken" in body && typeof body.deviceToken === "string" ? body.deviceToken : input.deviceToken;
-  if (!token) throw new CompanionError("Cabane returned no device credential.");
+  }
+  let parsed = void 0;
+  if (raw.length > 0) {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = raw;
+    }
+  }
+  if (res.status >= 400) {
+    if (res.status === 429)
+      throw new CompanionError(
+        "Too many pairing requests from this network. Wait a few minutes and run  cabane setup  again."
+      );
+    if (res.status === 404 && path.endsWith("/code"))
+      throw new CompanionError(
+        `No pairing endpoint at ${baseUrl}. Either that server is too old for this companion, or it isn't a Cabane API origin: the hosted app is https://app.cabane.ai (pass \`--server <url>\` for your own instance).`
+      );
+    const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
+    throw new ApiError(res.status, `${res.status} ${msg}`, parsed);
+  }
+  return parsed;
+}
+function requestEnrollmentCode(baseUrl, opts = {}) {
+  return postJson(
+    baseUrl,
+    "/api/device-enrollment/code",
+    { ...opts.label ? { label: opts.label } : {}, ...hostFacts() },
+    opts.signal
+  );
+}
+function hostFacts() {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "", 10);
   return {
-    baseUrl: body.baseUrl,
-    deviceToken: token,
-    deviceId: body.deviceId,
-    ..."workspace" in body && body.workspace && typeof body.workspace === "object" && "name" in body.workspace && typeof body.workspace.name === "string" && "slug" in body.workspace && typeof body.workspace.slug === "string" ? { workspace: { name: body.workspace.name, slug: body.workspace.slug } } : {},
-    ..."devicesUrl" in body && typeof body.devicesUrl === "string" ? { devicesUrl: body.devicesUrl } : {},
-    ..."deviceLabel" in body && typeof body.deviceLabel === "string" ? { deviceLabel: body.deviceLabel } : {}
+    platform: process.platform,
+    arch: process.arch,
+    ...Number.isInteger(nodeMajor) ? { nodeMajor } : {}
   };
 }
 function deviceLabelFromHostname(hostname3) {
   const trimmed = hostname3.trim().replace(/\.local$/i, "");
   return trimmed.length ? trimmed.slice(0, 120) : void 0;
 }
+function pollOnce(baseUrl, deviceCode, signal) {
+  return postJson(baseUrl, "/api/device-enrollment/poll", { deviceCode }, signal);
+}
+var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+async function awaitEnrollment(baseUrl, code, opts = {}) {
+  const now = opts.now ?? (() => Date.now());
+  const wait = opts.sleepMs ?? sleep;
+  const deadline = now() + code.expiresIn * 1e3;
+  let intervalMs = Math.max(1, code.interval) * 1e3;
+  while (now() < deadline) {
+    await wait(intervalMs);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    const res = await pollOnce(baseUrl, code.deviceCode, opts.signal);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    if (res.status === "complete") {
+      if (!res.deviceToken || !res.baseUrl)
+        throw new CompanionError("Cabane reported the pairing complete but returned no token.");
+      return {
+        baseUrl: res.baseUrl,
+        deviceToken: res.deviceToken,
+        ...res.deviceId ? { deviceId: res.deviceId } : {},
+        ...res.deviceLabel ? { deviceLabel: res.deviceLabel } : {}
+      };
+    }
+    if (res.status === "expired") throw new EnrollmentExpiredError();
+    if (res.status === "slow_down") intervalMs += 1e3;
+  }
+  throw new EnrollmentExpiredError();
+}
+
+// src/terminal-copy.ts
+init_cabane_command();
+var UNPAIRED = `This device isn't paired yet. Run  ${cabane("setup")}  on it.`;
+var lease = DEFAULT_DEVICE_OFFLINE_THRESHOLD_MS;
+function age(at, now) {
+  const seconds = Math.max(0, Math.floor((now - Date.parse(at)) / 1e3));
+  return seconds < 60 ? `${seconds}s` : seconds < 3600 ? `${Math.floor(seconds / 60)}m` : `${Math.floor(seconds / 3600)}h`;
+}
+function deviceLine(f, now = Date.now()) {
+  if (!f.running) return `not running \u2014 start it with  ${cabane("start")}`;
+  if (f.lastHeartbeatRefused)
+    return `refused by the server \u2014 it may be deactivated; see ${f.devicesUrl}`;
+  if (!f.lastHeartbeatAckAt) return "starting \u2014 hasn't checked in yet";
+  const since = age(f.lastHeartbeatAckAt, now);
+  if (now - Date.parse(f.lastHeartbeatAckAt) > lease)
+    return `can't reach the server \u2014 last checked in ${since} ago`;
+  const view = f.lastAcknowledgedDevice;
+  if (!view) return `checked in ${since} ago`;
+  const word = view.state === "online" && view.health ? view.health === "checking" ? "online, checking harnesses\u2026" : DEVICE_HEALTH_LABEL[view.health] : DEVICE_STATE_LABEL[view.state];
+  return `${word.toLowerCase()} \u2014 checked in ${since} ago`;
+}
+function pairingLine(pair) {
+  return `\u2713 Paired as "${pair.deviceLabel ?? "Computer"}".`;
+}
+function pathLines(reload) {
+  return reload ? [`  To use cabane in this window:  ${reload}`, ""] : [];
+}
+function agentLines(detection, opts) {
+  const rows = agentRows(detection, opts);
+  const names = rows.map((row3) => row3.usable ? `\u2713 ${row3.label}` : row3.label);
+  const width = Math.max(...names.map((name) => name.length)) + 3;
+  return rows.map((row3, i) => `${names[i].padEnd(width)}${row3.text}`);
+}
+var modeLines = {
+  background: "Cabane is running in the background",
+  service: "Cabane is running as a service",
+  attached: "Cabane is running in this process",
+  existing: "Cabane was already running"
+};
+function closingBlock(input, now = Date.now()) {
+  const { mode, facts } = input;
+  const device = deviceLine(facts, now);
+  const noAck = !facts.lastHeartbeatAckAt && !facts.lastHeartbeatRefused;
+  const stale = facts.lastHeartbeatAckAt !== null && now - Date.parse(facts.lastHeartbeatAckAt) > lease;
+  const modeLine = modeLines[mode];
+  const sentence = noAck ? `${mode === "background" ? "Cabane started in the background" : modeLine} but hasn't checked in yet.` : `${modeLine}. ${facts.lastHeartbeatRefused || stale ? device[0].toUpperCase() + device.slice(1) : `This device ${device.startsWith("checked in") || device.startsWith("needs attention") ? "" : "is "}${device}`}.`;
+  const lines2 = [`  ${sentence}`, "", ...pathLines(input.reload)];
+  if (noAck || stale || facts.lastHeartbeatRefused) {
+    lines2.push(
+      `  See what it's doing:  ${cabane("status")}${facts.lastHeartbeatRefused ? "" : `     Log:  ${cabane("logs")}`}`
+    );
+  } else {
+    lines2.push("  Harnesses on this device");
+    lines2.push(
+      ...(input.detection ? agentLines(input.detection, { signInHint: true }) : ["Claude Code   checking", "Codex         checking", "OpenCode      checking"]).map((line) => `  ${line}`)
+    );
+    lines2.push(
+      "",
+      `  Status  ${cabane("status")}${mode === "attached" ? "" : `     Stop  ${cabane("stop")}`}     Log  ${cabane("logs")}`
+    );
+    if (!input.service && input.servicePlatform) {
+      lines2.push(
+        `  Start at login and keep Cabane updating itself:  ${cabane("service install")}${input.servicePlatform === "launchd" ? " (macOS will ask you to allow a background item)" : ""}`
+      );
+      lines2.push(
+        `  Updates itself only as a service; to turn that off:  ${cabane("update --auto off")}`
+      );
+    } else if (input.service && input.autoUpdate)
+      lines2.push(`  Updating itself; to turn that off:  ${cabane("update --auto off")}`);
+  }
+  if (input.address) lines2.push("", `  In Cabane: ${input.address}`);
+  if (mode === "attached") lines2.push("", "  Listening for messages\u2026");
+  return lines2;
+}
+function startFailure(message2, reload) {
+  return [
+    ...pathLines(reload),
+    `\u2717 Cabane couldn't start: ${message2}`,
+    "",
+    `  Log:  ${cabane("logs")}     Try again:  ${cabane("start")}`
+  ];
+}
+
+// src/pair-flow.ts
+var MAX_CODES = 3;
+async function pairDevice(opts, deps = {}) {
+  const requestCode = deps.requestCode ?? requestEnrollmentCode;
+  const wait = deps.await ?? awaitEnrollment;
+  const open2 = deps.open ?? openLink;
+  const { ui, interactive } = opts;
+  const label = deviceLabelFromHostname(hostname());
+  const aborter = new AbortController();
+  const onSigint = () => aborter.abort();
+  process.on("SIGINT", onSigint);
+  const spinner = ui.spinner();
+  let current = null;
+  const keys = interactive ? watchReturn({
+    onReturn: () => {
+      if (!current) return;
+      const link = current.verificationUriComplete;
+      void open2(link).then((opened) => {
+        if (!opened)
+          spinner.message(
+            `Couldn't open a browser here. Open this page on any device: ${link}`
+          );
+      });
+    },
+    onInterrupt: () => aborter.abort(),
+    ...deps.input ? { input: deps.input } : {}
+  }) : null;
+  let minutesWaited = 0;
+  let waiting = false;
+  try {
+    for (let attempt = 1; attempt <= MAX_CODES; attempt += 1) {
+      let code;
+      try {
+        code = await requestCode(opts.baseUrl, {
+          ...label ? { label } : {},
+          signal: aborter.signal
+        });
+      } catch (err) {
+        if (!(err instanceof EnrollmentCancelledError)) throw err;
+        ui.cancel(`Pairing cancelled. Run  ${cabane("setup")}  when you're ready.`);
+        process.exitCode = 130;
+        return null;
+      }
+      current = code;
+      const minutes = Math.max(1, Math.round(code.expiresIn / 60));
+      const codeLines = ["", `  ${code.userCode}`, `  ${code.verificationUriComplete}`, ""];
+      if (attempt === 1) {
+        ui.step([
+          "Pair this device",
+          interactive ? "Enter this code in Cabane, or press Return to open the page:" : "Enter this code in Cabane:",
+          ...codeLines
+        ]);
+      } else {
+        ui.step(codeLines.slice(1));
+      }
+      spinner.start(
+        `Waiting for you to confirm in Cabane\u2026 (the code is good for ${minutes} minutes)`
+      );
+      waiting = true;
+      try {
+        const device = await wait(opts.baseUrl, code, { signal: aborter.signal });
+        waiting = false;
+        spinner.stop(pairingLine(device));
+        return device;
+      } catch (err) {
+        waiting = false;
+        if (err instanceof EnrollmentCancelledError) {
+          spinner.stop("Pairing stopped.");
+          ui.cancel(`Pairing cancelled. Run  ${cabane("setup")}  when you're ready.`);
+          process.exitCode = 130;
+          return null;
+        }
+        if (!(err instanceof EnrollmentExpiredError)) {
+          spinner.stop("Pairing stopped.");
+          throw err;
+        }
+        minutesWaited += minutes;
+        if (attempt < MAX_CODES) {
+          spinner.stop("That code expired. Here's a fresh one:");
+          continue;
+        }
+        spinner.stop(
+          `Nothing confirmed in ${minutesWaited} minutes. Run  ${cabane("setup")}  when you're ready.`
+        );
+        process.exitCode = 1;
+        return null;
+      }
+    }
+    return null;
+  } finally {
+    if (waiting) spinner.stop("Pairing stopped.");
+    keys?.release();
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+function watchReturn(handlers) {
+  const input = handlers.input ?? process.stdin;
+  if (!input.isTTY || typeof input.setRawMode !== "function") return { release: () => {
+  } };
+  const wasRaw = input.isRaw;
+  const onData = (chunk) => {
+    const text = chunk.toString();
+    if (text.includes("")) handlers.onInterrupt();
+    else if (text.includes("\r") || text.includes("\n")) handlers.onReturn();
+  };
+  input.setRawMode(true);
+  input.on("data", onData);
+  input.resume();
+  return {
+    release: () => {
+      input.removeListener("data", onData);
+      input.setRawMode(wasRaw);
+      input.pause();
+    }
+  };
+}
+function pageOpener(platform, link) {
+  if (platform === "darwin") return { command: "open", args: [link] };
+  if (platform === "win32") return { command: "cmd", args: ["/c", "start", '""', `"${link}"`] };
+  return { command: "xdg-open", args: [link] };
+}
+function openLink(link) {
+  return new Promise((resolve2) => {
+    const { command, args } = pageOpener(process.platform, link);
+    try {
+      const child = spawn3(command, args, {
+        stdio: "ignore",
+        detached: true,
+        // `cmd` parses its own line: the quoting above is the one it needs, as written.
+        ...process.platform === "win32" ? { windowsVerbatimArguments: true } : {}
+      });
+      child.once("error", () => resolve2(false));
+      child.once("exit", (code) => resolve2(code === 0));
+      child.unref();
+    } catch {
+      resolve2(false);
+    }
+  });
+}
 
 // src/commands/start.ts
 init_cabane_command();
@@ -12501,7 +12788,7 @@ var emptyHeartbeatStatus = () => ({
 
 // src/supervisor.ts
 init_cabane_command();
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
 
 // src/log-copy.ts
 init_failure();
@@ -12971,6 +13258,32 @@ init_boot_id();
 init_turn_containment();
 init_protocol();
 import { createInterface } from "readline";
+
+// src/credential-broker/client-config.ts
+import { parse, stringify } from "smol-toml";
+var BROKERED_CREDENTIAL_NAMES = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+  "CLAUDE_CODE_SESSION_ACCESS_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+  "CLAUDE_CODE_HOST_CREDS_FILE",
+  "CODEX_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENAI_ACCESS_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN",
+  "GITHUB_ENTERPRISE_TOKEN"
+]);
+function withoutBrokeredCredentials(values) {
+  return Object.fromEntries(
+    Object.entries(values).filter(([name]) => !BROKERED_CREDENTIAL_NAMES.has(name))
+  );
+}
+
+// src/runner/launch.ts
 function gzipBodiesSignal() {
   let on = false;
   const listeners = /* @__PURE__ */ new Set();
@@ -13233,12 +13546,22 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   }
   try {
     const wrapped = launch.wrapped === true;
-    const env = runnerExecEnv(launch.env ?? process.env, wrapped);
-    const grants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    if (launch.brokeredCredentials && !wrapped)
+      throw new Error("credential broker requires a wrapped runner");
+    const inherited = runnerExecEnv(launch.env ?? process.env, wrapped);
+    const env = launch.brokeredCredentials ? withoutBrokeredCredentials(inherited) : inherited;
+    const directGrants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    const grants = launch.brokeredCredentials ? Object.fromEntries(
+      Object.entries(directGrants).map(([key, values]) => [
+        key,
+        withoutBrokeredCredentials(values)
+      ])
+    ) : directGrants;
+    const secrets = wrapped ? launch.secrets?.() ?? {} : void 0;
     const input = {
       baseUrl: opts.baseUrl,
       credential: minted.credential,
-      ...wrapped ? { secrets: launch.secrets?.() ?? {} } : {},
+      ...secrets ? { secrets: launch.brokeredCredentials ? withoutBrokeredCredentials(secrets) : secrets } : {},
       ...Object.keys(grants).length > 0 ? { grants } : {},
       dispatch: payload,
       turnId,
@@ -13541,7 +13864,7 @@ function hostReport() {
 }
 
 // src/providers/local-process.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { constants as constants2 } from "os";
 var DEFAULT_KILL_GRACE_MS = 3e4;
 var DEFAULT_REAP_GRACE_MS = 3e3;
@@ -13552,7 +13875,7 @@ function exitCode(code, signal) {
 }
 function createLocalProcessProvider(opts = {}) {
   const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
-  const spawnFn = opts.spawnFn ?? spawn4;
+  const spawnFn = opts.spawnFn ?? spawn5;
   const reapGraceMs = opts.reapGraceMs ?? DEFAULT_REAP_GRACE_MS;
   const killFn = opts.killFn ?? ((pid, signal) => process.kill(pid, signal));
   const groupAlive = (pgid) => {
@@ -13928,7 +14251,7 @@ var SseSubscriber = class {
 init_transcript_writer();
 
 // src/updater.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { copyFileSync as copyFileSync2, existsSync as existsSync16, mkdirSync as mkdirSync14, renameSync as renameSync9, rmSync as rmSync10 } from "fs";
 import { dirname as dirname11, join as join26 } from "path";
 
@@ -14143,7 +14466,7 @@ var runProcess = (command, args, opts = {}) => new Promise((resolve2) => {
   let stderr = "";
   let child;
   try {
-    child = spawn5(command, [...args], {
+    child = spawn6(command, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       env: opts.env ?? process.env
     });
@@ -14647,7 +14970,7 @@ var CompanionSupervisor = class {
     if (this.stopped) return;
     this.log.info(
       { protocolVersion: TURN_PROTOCOL_VERSION, version: COMPANION_VERSION },
-      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname()}`
+      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname2()}`
     );
     const retired = retiredConfigKeysOnDisk();
     if (retired.length > 0) {
@@ -14682,9 +15005,7 @@ var CompanionSupervisor = class {
     this.detectTimer = setInterval(() => void this.detect(), DETECT_INTERVAL_MS);
     this.detectTimer.unref?.();
     if (!this.deviceApi || !this.config.deviceToken) {
-      this.log.warn(
-        "This device isn't paired. Get a setup line from a workspace's Settings \u2192 Devices."
-      );
+      this.log.warn(`This device isn't paired. Run  ${cabane("setup")}  on it.`);
       return;
     }
     this.deviceSub = new SseSubscriber({
@@ -14695,7 +15016,7 @@ var CompanionSupervisor = class {
       log: this.log,
       lastEventId: null,
       onOpen: () => {
-        this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname()}`);
+        this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`);
         this.deviceConnected = true;
         for (const wr of this.workspaces.values()) {
           this.hub.setConnected(wr.workspaceId, true);
@@ -15244,6 +15565,7 @@ var CompanionSupervisor = class {
         ),
         ...this.config.runner?.command ? {
           wrapped: true,
+          brokeredCredentials: this.config.runner.brokeredCredentials,
           secrets: () => loadSecretValuesTolerant(
             (m) => this.log.warn({ err: m }, "Could not read the secrets file for a wrapped turn.")
           )
@@ -15928,9 +16250,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn7 }) => {
+  void import("child_process").then(({ spawn: spawn8 }) => {
     try {
-      const child = spawn7(process.execPath, process.argv.slice(1), {
+      const child = spawn8(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -16279,13 +16601,13 @@ async function observeStart(deps = {}) {
   const read2 = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? verifyRuntime;
   const now = deps.now ?? Date.now;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const deadline = now() + 8e3;
   for (; ; ) {
     const state = await read2();
     if (state?.socket && await verify(state) === "ours") return state;
     if (now() >= deadline) return null;
-    await sleep3(Math.min(150, Math.max(0, deadline - now())));
+    await sleep4(Math.min(150, Math.max(0, deadline - now())));
   }
 }
 function markLaunchRequester() {
@@ -16703,7 +17025,7 @@ async function controlService(action, deps) {
 init_cabane_command();
 init_cli_entry();
 init_config();
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import { closeSync as closeSync3, mkdirSync as mkdirSync17, openSync as openSync4 } from "fs";
 init_config();
 async function startDaemon(opts = {}, deps = {}) {
@@ -16785,7 +17107,7 @@ function defaultSpawnDetached(args) {
   mkdirSync17(cabaneDir(), { recursive: true });
   const logFd = openSync4(companionLogPath(), "a");
   try {
-    const child = spawn6(process.execPath, [cliPath, ...args], {
+    const child = spawn7(process.execPath, [cliPath, ...args], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env, CABANE_COMPANION_DAEMON: "1" }
@@ -16803,89 +17125,6 @@ function defaultSpawnDetached(args) {
   }
 }
 
-// src/terminal-copy.ts
-init_cabane_command();
-var UNPAIRED = "This device isn't paired yet. Get a setup line from a workspace's Settings \u2192 Devices and paste it here.";
-var lease = DEFAULT_DEVICE_OFFLINE_THRESHOLD_MS;
-function age(at, now) {
-  const seconds = Math.max(0, Math.floor((now - Date.parse(at)) / 1e3));
-  return seconds < 60 ? `${seconds}s` : seconds < 3600 ? `${Math.floor(seconds / 60)}m` : `${Math.floor(seconds / 3600)}h`;
-}
-function deviceLine(f, now = Date.now()) {
-  if (!f.running) return `not running \u2014 start it with  ${cabane("start")}`;
-  if (f.lastHeartbeatRefused)
-    return `refused by the server \u2014 it may be deactivated; see ${f.devicesUrl}`;
-  if (!f.lastHeartbeatAckAt) return "starting \u2014 hasn't checked in yet";
-  const since = age(f.lastHeartbeatAckAt, now);
-  if (now - Date.parse(f.lastHeartbeatAckAt) > lease)
-    return `can't reach the server \u2014 last checked in ${since} ago`;
-  const view = f.lastAcknowledgedDevice;
-  if (!view) return `checked in ${since} ago`;
-  const word = view.state === "online" && view.health ? view.health === "checking" ? "online, checking harnesses\u2026" : DEVICE_HEALTH_LABEL[view.health] : DEVICE_STATE_LABEL[view.state];
-  return `${word.toLowerCase()} \u2014 checked in ${since} ago`;
-}
-function pairingLine(pair) {
-  return `\u2713 Paired as "${pair.deviceLabel ?? "Computer"}" with ${pair.workspace?.name ?? "the workspace"}.`;
-}
-function pathLines(reload) {
-  return reload ? [`  To use cabane in this window:  ${reload}`, ""] : [];
-}
-function agentLines(detection, opts) {
-  const rows = agentRows(detection, opts);
-  const names = rows.map((row3) => row3.usable ? `\u2713 ${row3.label}` : row3.label);
-  const width = Math.max(...names.map((name) => name.length)) + 3;
-  return rows.map((row3, i) => `${names[i].padEnd(width)}${row3.text}`);
-}
-var modeLines = {
-  background: "Cabane is running in the background",
-  service: "Cabane is running as a service",
-  attached: "Cabane is running in this process",
-  existing: "Cabane was already running"
-};
-function closingBlock(input, now = Date.now()) {
-  const { mode, facts } = input;
-  const device = deviceLine(facts, now);
-  const noAck = !facts.lastHeartbeatAckAt && !facts.lastHeartbeatRefused;
-  const stale = facts.lastHeartbeatAckAt !== null && now - Date.parse(facts.lastHeartbeatAckAt) > lease;
-  const modeLine = modeLines[mode];
-  const sentence = noAck ? `${mode === "background" ? "Cabane started in the background" : modeLine} but hasn't checked in yet.` : `${modeLine}. ${facts.lastHeartbeatRefused || stale ? device[0].toUpperCase() + device.slice(1) : `This device ${device.startsWith("checked in") || device.startsWith("needs attention") ? "" : "is "}${device}`}.`;
-  const lines2 = [`  ${sentence}`, "", ...pathLines(input.reload)];
-  if (noAck || stale || facts.lastHeartbeatRefused) {
-    lines2.push(
-      `  See what it's doing:  ${cabane("status")}${facts.lastHeartbeatRefused ? "" : `     Log:  ${cabane("logs")}`}`
-    );
-  } else {
-    lines2.push("  Harnesses on this device");
-    lines2.push(
-      ...(input.detection ? agentLines(input.detection, { signInHint: true }) : ["Claude Code   checking", "Codex         checking", "OpenCode      checking"]).map((line) => `  ${line}`)
-    );
-    lines2.push(
-      "",
-      `  Status  ${cabane("status")}${mode === "attached" ? "" : `     Stop  ${cabane("stop")}`}     Log  ${cabane("logs")}`
-    );
-    if (!input.service && input.servicePlatform) {
-      lines2.push(
-        `  Start at login and keep Cabane updating itself:  ${cabane("service install")}${input.servicePlatform === "launchd" ? " (macOS will ask you to allow a background item)" : ""}`
-      );
-      lines2.push(
-        `  Updates itself only as a service; to turn that off:  ${cabane("update --auto off")}`
-      );
-    } else if (input.service && input.autoUpdate)
-      lines2.push(`  Updating itself; to turn that off:  ${cabane("update --auto off")}`);
-  }
-  if (input.address) lines2.push("", `  In Cabane: ${input.address}`);
-  if (mode === "attached") lines2.push("", "  Listening for messages\u2026");
-  return lines2;
-}
-function startFailure(message2, reload) {
-  return [
-    ...pathLines(reload),
-    `\u2717 Cabane couldn't start: ${message2}`,
-    "",
-    `  Log:  ${cabane("logs")}     Try again:  ${cabane("start")}`
-  ];
-}
-
 // src/terminal-status.ts
 async function readTerminalStatus(socket, timeoutMs = 1e3) {
   if (!socket) return emptyHeartbeatStatus();
@@ -17024,18 +17263,17 @@ async function startScript(opts, deps) {
       if (service2.state !== "running" || service2.pid !== current.pid) mode = "existing";
     }
   }
-  const personalUrl = `${cfg.baseUrl.replace(/\/$/, "")}/settings/devices`;
-  const address = opts.pairing ? opts.pairing.devicesUrl : personalUrl;
+  const address = `${cfg.baseUrl.replace(/\/$/, "")}/settings/devices`;
   if (!daemon)
     for (const line of closingBlock({
       mode,
-      facts: { ...status2, running: true, devicesUrl: address ?? personalUrl },
+      facts: { ...status2, running: true, devicesUrl: address },
       detection,
       reload: reloadLine(),
       service: installed,
       servicePlatform: servicePlatform(),
       autoUpdate: cfg.update?.auto !== false,
-      ...address ? { address } : {}
+      address
     }))
       write(line);
   if (runtime) {
@@ -17171,22 +17409,22 @@ async function setup(opts = {}, deps = {}) {
   } catch (err) {
     for (const line of pathLines(reloadLine())) write(line);
     write(err instanceof Error ? err.message : String(err));
-    write(
-      "Check the server connection, then take a fresh setup line from the workspace's Settings \u2192 Devices."
-    );
+    write(`Check the server connection, then run  ${cabane("setup")}  again.`);
     process.exitCode = 1;
   } finally {
     setConsoleLogging(true);
   }
 }
 async function setupScript(opts, deps) {
-  const interactive = deps.interactive ?? isInteractive();
-  const paired = isDevicePaired();
-  if (!opts.code && !paired) {
-    write(UNPAIRED);
+  if (opts.code) {
+    write(
+      `Setup codes come from this device now: run  ${cabane("setup")}  and enter the code it shows in Cabane.`
+    );
     process.exitCode = 1;
     return;
   }
+  const interactive = deps.interactive ?? isInteractive();
+  const paired = isDevicePaired();
   const ui = deps.ui ?? (interactive ? terminalUi() : plainUi());
   const running = await (deps.live ?? liveCompanionState)();
   const cfg = safeLoadConfig();
@@ -17197,32 +17435,16 @@ async function setupScript(opts, deps) {
     process.exitCode = 1;
     return;
   }
-  let device;
-  if (opts.code) {
+  let justPaired = false;
+  if (!paired) {
     const baseUrl = resolvePairBaseUrl(opts.server ?? cfg?.baseUrl);
-    if (paired && cfg && new URL(cfg.baseUrl).origin !== new URL(baseUrl).origin) {
-      for (const line of pathLines(reloadLine())) write(line);
-      write(
-        "This device is paired to another Cabane server. Log out before setting it up on a different server."
-      );
-      write(`Run  ${cabane("logout")}  before using the new setup line.`);
-      process.exitCode = 1;
-      return;
-    }
-    device = await (deps.claim ?? claimSetupCode)(baseUrl, {
-      userCode: opts.code,
-      label: deviceLabelFromHostname(hostname2()) ?? "Computer",
-      ...paired && cfg?.deviceToken ? { deviceToken: cfg.deviceToken } : {}
-    });
+    const device = await (deps.pair ?? pairDevice)({ baseUrl, interactive, ui });
+    if (!device) return;
     writePairedConfig(device);
-    write(pairingLine(device));
+    justPaired = true;
   }
   const detection = await start(
-    {
-      ...opts,
-      ...device ? { pairing: device } : {},
-      ...!interactive && device ? { foreground: true } : {}
-    },
+    { ...opts, ...!interactive && justPaired ? { foreground: true } : {} },
     { ...deps, interactive }
   );
   if (interactive && detection && !anyUsable(detection)) {
@@ -17443,7 +17665,7 @@ async function stop(deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
   const verify = deps.verify ?? ((s) => verifyRuntime(s));
   const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   const state = readState();
   if (!state) {
@@ -17471,7 +17693,7 @@ async function stop(deps = {}) {
       process.stdout.write("companion: stopped.\n");
       return;
     }
-    await sleep3(POLL_INTERVAL_MS);
+    await sleep4(POLL_INTERVAL_MS);
   }
   process.stdout.write(
     `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
@@ -17497,7 +17719,7 @@ function isAlive(kill, pid) {
 var STARTUP_WAIT_MS = 2e4;
 async function installAndStartService(deps = {}) {
   const readState = deps.readState ?? readLiveRuntimeState;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? Date.now;
   const before = await serviceState(deps);
   const running = readState();
@@ -17513,7 +17735,7 @@ async function installAndStartService(deps = {}) {
   while (now() < deadline) {
     const state = readState();
     if (state?.socket) return true;
-    await sleep3(250);
+    await sleep4(250);
   }
   write(
     `${INDENT}The service is installed but Cabane hasn't come up yet. ${cabane("service status")} and ${cabane("logs")} say why.`
@@ -17643,9 +17865,7 @@ async function status(deps = {}) {
     cfg = null;
   }
   if (!cfg || !cfg.deviceToken) {
-    out(
-      "  Not paired yet. Get a setup line from a workspace's Settings \u2192 Devices and paste it here."
-    );
+    out(`  Not paired yet. Run  ${cabane("setup")}  on this device.`);
     for (const line of strays) out(line);
     process.exitCode = 1;
     return;
@@ -18308,7 +18528,7 @@ init_cabane_command();
 rememberInvokedCommand();
 var program = new Command();
 program.name("cabane").description("Run your Cabane agents on this device, with Claude Code, Codex or OpenCode.").version(COMPANION_VERSION);
-program.command("setup [code]").description("set up this device: find your agents, pair it with Cabane, and keep it running.").allowExcessArguments(false).option("--server <url>", "the Cabane instance to pair with (default https://app.cabane.ai)").addOption(
+program.command("setup").argument("[code]", "not taken: run  cabane setup  and enter the code it shows in Cabane").description("set up this device: find your agents, pair it with Cabane, and keep it running.").allowExcessArguments(false).option("--server <url>", "the Cabane instance to pair with (default https://app.cabane.ai)").addOption(
   new Option("--log-level <level>", "info (default), warn, or debug").choices([
     "info",
     "warn",