@cabane/companion 0.6.236 → 0.6.238

package/dist/launch.js

@@ -133,7 +133,7 @@ var companionConfigSchema = z2.object({
   // the rest of the config; `pair` always writes one.
   deviceToken: z2.string().optional(),
   // Identity hints, learned from the device flow and refreshed on the first
-  // assignments pull. Cosmetic — used for `status`/dashboard display only.
+  // assignments pull. Cosmetic — used for `status` display only.
   deviceId: z2.string().optional(),
   deviceLabel: z2.string().optional(),
   // Optional per-agent machine-local overrides (cwd / prepareHook), keyed by
@@ -145,9 +145,8 @@ var companionConfigSchema = z2.object({
   // silent roster: an agent nobody listed gets no hook and no error, and starts
   // in the operator's `$HOME`.
   prepareHook: prepareHookSchema.optional(),
-  // The CLI ignores both dashboard settings. Desktop uses `dashboardPort`;
-  // `autoOpen` remains parseable for older config files but no longer controls
-  // startup. `logLevel` is pino's level, live-editable.
+  // Nothing reads either dashboard setting any more; both stay parseable so an
+  // older config file still loads. `logLevel` is pino's level, live-editable.
   dashboardPort: z2.number().int().min(1).max(65535).optional(),
   autoOpen: z2.boolean().optional(),
   logLevel: z2.enum(["warn", "info", "debug"]).optional(),

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 // src/bundled-binaries.ts
 import { realpathSync as realpathSync3, statSync } from "fs";
 import { createRequire } from "module";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cabane-command.ts
@@ -14,7 +14,13 @@ import { realpathSync } from "fs";
 import { homedir } from "os";
 import { dirname, join, sep } from "path";
 import { fileURLToPath } from "url";
-var INSTALL_SCRIPT_COMMAND = "curl -fsSL https://cabane.ai/install.sh | bash";
+function installScriptCommand(address) {
+  return `curl -fsSL ${address.replace(/\/+$/, "")}/install.sh | bash`;
+}
+function installLineWords(install = companionInstall()) {
+  const line = install === "script" ? "installer line" : "npm line";
+  return `the ${line} from Your settings \u2192 Devices \u2192 Add a device in your Cabane`;
+}
 function companionInstall(execPath = process.execPath, home = homedir()) {
   const real = (path) => {
     try {
@@ -57,6 +63,307 @@ function cabane(rest) {
   return `cabane ${rest}`;
 }
 
+// src/config.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  rmSync,
+  writeFileSync,
+  existsSync as existsSync3
+} from "fs";
+import { homedir as homedir5, userInfo } from "os";
+import { dirname as dirname3, isAbsolute, join as join4 } from "path";
+import { z as z2 } from "zod";
+
+// src/errors.ts
+var CompanionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CompanionError";
+  }
+};
+var ConfigError = class extends CompanionError {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+
+// src/pairing.ts
+function isAllowedBaseUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  if (url.protocol === "http:") {
+    const host = url.hostname.toLowerCase();
+    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  }
+  return false;
+}
+
+// src/prepare-hook.ts
+import { spawn } from "child_process";
+import { z } from "zod";
+var prepareHookSchema = z.object({
+  command: z.string().min(1),
+  args: z.array(z.string()).optional(),
+  // Extra env handed to the hook process itself (merged over process.env).
+  env: z.record(z.string(), z.string()).optional(),
+  // Wall-clock cap for the hook. Provisioning is slow (minutes), so the
+  // default is generous; a hook that hangs past this is killed and the turn
+  // fails with a clear timeout message rather than pinning the companion.
+  timeoutMs: z.number().int().positive().optional()
+}).strict();
+var DEFAULT_TIMEOUT_MS = 10 * 6e4;
+var prepareResultSchema = z.object({
+  cwd: z.string().min(1),
+  env: z.record(z.string(), z.string()).optional()
+});
+
+// src/config.ts
+var HARNESS_RUNTIMES = ["claude-code", "codex", "opencode"];
+var realHomeCache;
+function realAccountHome() {
+  if (realHomeCache === void 0) {
+    try {
+      realHomeCache = userInfo().homedir;
+    } catch {
+      realHomeCache = null;
+    }
+  }
+  return realHomeCache;
+}
+function cabaneDir() {
+  const dir = join4(process.env.CABANE_COMPANION_HOME || homedir5(), ".cabane");
+  if (process.env.VITEST) {
+    const real = realAccountHome();
+    if (real && dir === join4(real, ".cabane")) {
+      throw new Error(
+        `cabaneDir() resolved to the real ${dir} during a test run. Companion tests must swap process.env.HOME to a tmp dir before touching the config dir; this guard prevents wiping the operator's real companion config (see apps/companion/test/setup-home.ts).`
+      );
+    }
+  }
+  return dir;
+}
+function configPath() {
+  return join4(cabaneDir(), "config.json");
+}
+var localAgentConfigSchema = z2.object({
+  cwd: z2.string().optional(),
+  prepareHook: prepareHookSchema.optional(),
+  // The Claude Code auto-memory escape hatch. Auto-memory is forced OFF by
+  // default (memory belongs in the Cabane workspace, and a shared companion
+  // would pool one cwd-keyed memory dir across users). On a companion you run
+  // yourself, `claudeCode: { autoMemory: true }` hands auto-memory back to your
+  // own `~/.claude/settings.json` — Cabane then stops
+  // injecting the off switch and your normal Claude Code memory workflow applies
+  // (the user and project settings load on every Claude Code turn).
+  claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional()
+}).strict();
+var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema);
+function isRootPath(value) {
+  return isAbsolute(value) || value === "~" || value.startsWith("~/");
+}
+var companionConfigSchema = z2.object({
+  // https-enforced (loopback exempt), so a hand-edited config can't put the
+  // device token and prompt on a plaintext channel.
+  baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
+    message: "baseUrl must be https (loopback http is allowed for local dev only)"
+  }),
+  // The `cabdev_` device token plaintext — the companion's one durable credential,
+  // presented as `Authorization: Bearer <token>` on the device-facing pull +
+  // heartbeat endpoints. Optional so `cabane-companion logout` can strip it (a
+  // "paired but logged out" state the supervisor refuses to run) while keeping
+  // the rest of the config; `pair` always writes one.
+  deviceToken: z2.string().optional(),
+  // Identity hints, learned from the device flow and refreshed on the first
+  // assignments pull. Cosmetic — used for `status` display only.
+  deviceId: z2.string().optional(),
+  deviceLabel: z2.string().optional(),
+  // Optional per-agent machine-local overrides (cwd / prepareHook), keyed by
+  // agentId / username / `slug/username`. Hand-added by the operator; the companion
+  // never writes this (it only persists credentials + the device, elsewhere).
+  agents: agentsConfigSchema.optional(),
+  // The DEVICE-LEVEL prepare hook, for every agent assigned here unless its own
+  // `agents` row names one. Per-agent hooks alone make the config a second
+  // silent roster: an agent nobody listed gets no hook and no error, and starts
+  // in the operator's `$HOME`.
+  prepareHook: prepareHookSchema.optional(),
+  // Nothing reads either dashboard setting any more; both stay parseable so an
+  // older config file still loads. `logLevel` is pino's level, live-editable.
+  dashboardPort: z2.number().int().min(1).max(65535).optional(),
+  autoOpen: z2.boolean().optional(),
+  logLevel: z2.enum(["warn", "info", "debug"]).optional(),
+  logFormat: z2.enum(["human", "json"]).optional(),
+  // Where this device's `opencode serve` answers, when it isn't the default
+  // address (`DEFAULT_OPENCODE_SERVER_URL`). Detection probes this one; a serve
+  // that answers is connected. Auth is opencode's own; Cabane never sees
+  // provider keys.
+  opencode: z2.object({
+    serverUrl: z2.string().url()
+  }).strict().optional(),
+  // The one knob on agents: an allowlist. Agents are detected, never offered
+  // (`harness-detect.ts`): whatever is signed in here is connected. Someone with
+  // Codex on the device who doesn't want Cabane to see it lists the ones it may:
+  // `"harnesses": ["claude-code"]`. Absent means all three.
+  harnesses: z2.array(z2.enum(HARNESS_RUNTIMES)).optional(),
+  // Whether this companion keeps itself current: installs the version Cabane names, between
+  // turns, and rolls back one that doesn't come up (`updater.ts`). Absent means never asked,
+  // which `start` offers; off either way until someone says yes.
+  update: z2.object({
+    auto: z2.boolean()
+  }).strict().optional(),
+  // The answer to `start`'s "start at boot?" when it was no, so it isn't asked again.
+  // `cabane service install` still installs it.
+  serviceDeclined: z2.boolean().optional(),
+  // Where agents stand on this device. Every (agent, conversation) pair gets a directory under it,
+  // and an agent with no folder of its own and no prepare hook works there
+  // (`turn-execution.ts`, `prepareEnvironment`). Default `~/.cabane/work`: hidden, so pairing a
+  // laptop creates no new visible folder; set it to make the work visible.
+  root: z2.string().min(1).refine(isRootPath, { message: "must be an absolute path, or start with ~/" }).optional(),
+  // An argv prefix the operator puts in front of every turn's runner: the companion starts
+  // `<prefix…> <its own run-turn command…>` instead of the runner bare. What the prefix does
+  // is the operator's (a container or VM per turn, say); the companion knows nothing of it
+  // beyond handing the runner over, with the turn's inputs in its environment and the
+  // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
+  // what a wrapper can rely on.
+  runner: z2.object({
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
+  }).strict().optional()
+});
+var RETIRED_ROW_KEYS = ["sandbox"];
+var RETIRED_HOOK_KEYS = ["validateCached", "failureReporter"];
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function splitRetired(raw) {
+  const keys = [];
+  const without = (obj, names, path) => {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (names.includes(k)) keys.push(`${path}${k}`);
+      else out[k] = v;
+    }
+    return out;
+  };
+  const hook = (row, path) => isObject(row.prepareHook) ? { ...row, prepareHook: without(row.prepareHook, RETIRED_HOOK_KEYS, `${path}prepareHook.`) } : row;
+  const kept = hook(without(raw, ["runners"], ""), "");
+  if (isObject(kept.agents)) {
+    const agents = {};
+    for (const [key, row] of Object.entries(kept.agents)) {
+      const path = `agents.${key}.`;
+      agents[key] = isObject(row) ? hook(without(row, RETIRED_ROW_KEYS, path), path) : row;
+    }
+    kept.agents = agents;
+  }
+  return { keys, kept };
+}
+function withoutRetiredKeys(raw) {
+  return isObject(raw) ? splitRetired(raw).kept : raw;
+}
+var legacyOfferSchema = z2.object({
+  claudeCode: z2.object({ enabled: z2.boolean().optional() }).passthrough().optional(),
+  codex: z2.object({ enabled: z2.boolean().optional() }).passthrough().optional(),
+  harnessesChosen: z2.boolean().optional(),
+  opencodeDeclined: z2.boolean().optional()
+});
+function migrateHarnessAllowlist(raw) {
+  const legacy = legacyOfferSchema.safeParse(raw);
+  if (!legacy.success || !legacy.data.harnessesChosen) return null;
+  const declined = /* @__PURE__ */ new Set();
+  if (legacy.data.claudeCode?.enabled === false) declined.add("claude-code");
+  if (legacy.data.codex?.enabled === false) declined.add("codex");
+  if (legacy.data.opencodeDeclined === true) declined.add("opencode");
+  if (declined.size === 0) return null;
+  return HARNESS_RUNTIMES.filter((runtime) => !declined.has(runtime));
+}
+function carriesLegacyOffer(raw) {
+  if (!raw || typeof raw !== "object") return false;
+  const obj = raw;
+  return "harnessesChosen" in obj || "opencodeDeclined" in obj || typeof obj.claudeCode === "object" && obj.claudeCode !== null && "enabled" in obj.claudeCode || obj.codex !== void 0;
+}
+function loadConfig() {
+  const path = configPath();
+  if (!existsSync3(path)) return null;
+  let raw;
+  try {
+    raw = readFileSync2(path, "utf8");
+  } catch (err) {
+    throw new ConfigError(
+      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (raw.trim().length === 0) return null;
+  let parsed;
+  try {
+    parsed = withoutRetiredKeys(JSON.parse(raw));
+  } catch (err) {
+    throw new ConfigError(
+      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const result = companionConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const agentIssue = result.error.issues.find((i) => i.path[0] === "agents");
+    if (agentIssue) {
+      throw new ConfigError(
+        `${path}: invalid "agents" config at \`${agentIssue.path.join(".")}\` \u2014 ${agentIssue.message}. Fix the agents block in the config and retry.`
+      );
+    }
+    const rootIssue = result.error.issues.find((i) => i.path[0] === "root");
+    if (rootIssue) {
+      throw new ConfigError(
+        `${path}: invalid "root" \u2014 ${rootIssue.message}. Fix it in the config and retry.`
+      );
+    }
+    throw new ConfigError(
+      `${path} is from an incompatible or older version of the companion, or was hand-edited. Run \`${cabane("setup")}\` to pair again, or \`${cabane("logout --purge")}\` to reset.`
+    );
+  }
+  if (carriesLegacyOffer(parsed)) {
+    const allowlist = migrateHarnessAllowlist(parsed);
+    const migrated = {
+      ...result.data,
+      ...allowlist && !result.data.harnesses ? { harnesses: allowlist } : {}
+    };
+    saveConfig(migrated);
+    return migrated;
+  }
+  return result.data;
+}
+function saveConfig(cfg) {
+  const path = configPath();
+  mkdirSync(dirname3(path), { recursive: true });
+  try {
+    chmodSync(cabaneDir(), 448);
+  } catch {
+  }
+  const tmp = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+    try {
+      chmodSync(tmp, 384);
+    } catch {
+    }
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+
 // src/bundled-binaries.ts
 function nodeResolveSelf(specifier) {
   const here = fileURLToPath3(import.meta.url);
@@ -73,9 +380,9 @@ function nodeResolveSelf(specifier) {
   return walkNodeModules(specifier, here);
 }
 function walkNodeModules(pkg, fromPath) {
-  let dir = dirname3(fromPath);
+  let dir = dirname4(fromPath);
   for (; ; ) {
-    const manifest = join4(dir, "node_modules", pkg, "package.json");
+    const manifest = join5(dir, "node_modules", pkg, "package.json");
     if (nodeIsFile(manifest)) {
       try {
         return realpathSync3(manifest);
@@ -83,7 +390,7 @@ function walkNodeModules(pkg, fromPath) {
         return manifest;
       }
     }
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -145,7 +452,7 @@ function resolveClaude(env) {
     const manifest = env.resolve(`${pkg}/package.json`, sdkEntry);
     if (!manifest) continue;
     sawPackage ??= pkg;
-    const exe = join4(dirname3(manifest), env.platform === "win32" ? "claude.exe" : "claude");
+    const exe = join5(dirname4(manifest), env.platform === "win32" ? "claude.exe" : "claude");
     if (env.isFile(exe)) {
       return { ...base, packageName: pkg, status: "present", path: exe };
     }
@@ -196,13 +503,13 @@ function resolveCodex(env) {
   if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
   const platformManifest = env.resolve(`${pkg}/package.json`, cliManifest);
   if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
-  const packageRoot = join4(dirname3(platformManifest), "vendor", triple);
+  const packageRoot = join5(dirname4(platformManifest), "vendor", triple);
   const exeName = env.platform === "win32" ? "codex.exe" : "codex";
-  const current = join4(packageRoot, "bin", exeName);
-  if (env.isFile(current) && env.isFile(join4(packageRoot, "codex-package.json"))) {
+  const current = join5(packageRoot, "bin", exeName);
+  if (env.isFile(current) && env.isFile(join5(packageRoot, "codex-package.json"))) {
     return { ...base, status: "present", path: current };
   }
-  const legacy = join4(packageRoot, "codex", exeName);
+  const legacy = join5(packageRoot, "codex", exeName);
   if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
   return { ...base, status: "executable_missing", path: null };
 }
@@ -233,15 +540,30 @@ var HARNESS_LABEL = {
 function missingNoun(status) {
   return status === "executable_missing" ? "executable" : "platform package";
 }
-function repairCommands(route = repairRoute(), spell = cabane) {
+function repairCommands(route = repairRoute(), spell = cabane, address = configuredAddress()) {
   if (route === "managed") return [spell("stop"), spell("update")];
-  if (route === "script") return [spell("stop"), INSTALL_SCRIPT_COMMAND];
+  if (route === "script")
+    return [
+      spell("stop"),
+      address ? installScriptCommand(address) : { words: installLineWords("script") }
+    ];
   return ["npm i -g @cabane/companion --include=optional"];
 }
-function repairAction(route = repairRoute(), spell = cabane) {
-  const [first, ...rest] = repairCommands(route, spell);
-  if (rest.length === 0) return `Reinstall with \`${first}\`.`;
-  return `Run \`${first}\`, then \`${rest.join("`, then `")}\`. ${STOP_WARNING}`;
+function configuredAddress() {
+  try {
+    return loadConfig()?.baseUrl ?? null;
+  } catch {
+    return null;
+  }
+}
+function quoteStep(step, quote) {
+  return typeof step === "string" ? quote(step) : step.words;
+}
+var backticks = (command) => `\`${command}\``;
+function repairAction(route = repairRoute(), spell = cabane, address = configuredAddress()) {
+  const [first, ...rest] = repairCommands(route, spell, address);
+  if (rest.length === 0) return `Reinstall with ${quoteStep(first, backticks)}.`;
+  return `Run ${quoteStep(first, backticks)}, then ${rest.map((step) => quoteStep(step, backticks)).join(", then ")}. ${STOP_WARNING}`;
 }
 var STOP_WARNING = "Stopping ends any turn in progress.";
 function installWarning(r) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.236",
+  "version": "0.6.238",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",
@@ -16,8 +16,6 @@
   "main": "./dist/cli.js",
   "exports": {
     ".": "./dist/cli.js",
-    "./runtime": "./dist/runtime.js",
-    "./pairing": "./dist/pairing-config.js",
     "./credential-broker": "./dist/credential-broker.js",
     "./package.json": "./package.json",
     "./*": "./*"