@cabane/companion 0.6.3 → 0.6.5

package/README.md

@@ -52,7 +52,7 @@ On your machine, start the short-code pairing flow:
 
 ```sh
 cabane-companion pair
-# Enter this code at https://cabane.ai/settings/companions
+# Enter this code at https://app.cabane.ai/settings/companions
 #
 #     ABCD-EFGH
 #

package/dist/cli.js

@@ -900,7 +900,7 @@ async function postJson(baseUrl, path3, body) {
   if (res.status >= 400) {
     if (res.status === 404 && path3.endsWith("/code")) {
       throw new CompanionError(
-        `this cabane server (${baseUrl}) doesn't support device-flow pairing yet. Update the server to a version that supports \`cabane-companion pair\`.`
+        `no device-flow pairing endpoint at ${baseUrl}. Either that server predates \`cabane-companion pair\`, or it isn't a Cabane API origin \u2014 the hosted app is https://app.cabane.ai (pass \`--server <url>\` for your own instance).`
       );
     }
     const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
@@ -959,7 +959,7 @@ async function runDeviceFlow(baseUrl, print, opts = {}) {
 }
 
 // src/pairing-config.ts
-var DEFAULT_BASE_URL = "https://cabane.ai";
+var DEFAULT_BASE_URL = "https://app.cabane.ai";
 function resolvePairBaseUrl(server) {
   const raw = (server ?? process.env.CABANE_BASE_URL ?? DEFAULT_BASE_URL).trim();
   if (!isAllowedBaseUrl(raw)) {
@@ -4980,6 +4980,7 @@ function buildConfig(req) {
   }
   const policy = codexToolPolicy(req.policy);
   const tmpDir = req.local.env?.TMPDIR;
+  const gateLockDir = req.local.env?.CABANE_GATE_LOCK_DIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
@@ -4997,7 +4998,9 @@ function buildConfig(req) {
         [policy.permissionProfile]: {
           filesystem: {
             ":root": "read",
-            ":workspace_roots": { ".": "write", ".git": "write" }
+            ":workspace_roots": { ".": "write", ".git": "write" },
+            // The one absolute-path grant — see the CT612-fallout note above.
+            ...gateLockDir ? { [gateLockDir]: "write" } : {}
           },
           network: { enabled: policy.networkAccessEnabled, mode: "full" }
         }
@@ -7254,6 +7257,9 @@ ${reason}`,
         );
       }
     }
+    if (turnContext.runtime === "codex" && process.env.CABANE_GATE_LOCK_DIR) {
+      turnEnv = { ...turnEnv, CABANE_GATE_LOCK_DIR: process.env.CABANE_GATE_LOCK_DIR };
+    }
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);
@@ -9815,7 +9821,7 @@ program.name("cabane-companion").description(
 ).version(COMPANION_VERSION);
 program.command("pair").description(
   "pair this device with cabane \u2014 shows a short code you confirm in Settings \u2192 Devices."
-).allowExcessArguments(false).option("--server <url>", "the cabane instance to pair with (default https://cabane.ai)").action(async (opts) => {
+).allowExcessArguments(false).option("--server <url>", "the cabane instance to pair with (default https://app.cabane.ai)").action(async (opts) => {
   await pair({
     ...opts.server !== void 0 ? { server: opts.server } : {}
   });

package/dist/pairing-config.js

@@ -292,7 +292,7 @@ async function postJson(baseUrl, path, body) {
   if (res.status >= 400) {
     if (res.status === 404 && path.endsWith("/code")) {
       throw new CompanionError(
-        `this cabane server (${baseUrl}) doesn't support device-flow pairing yet. Update the server to a version that supports \`cabane-companion pair\`.`
+        `no device-flow pairing endpoint at ${baseUrl}. Either that server predates \`cabane-companion pair\`, or it isn't a Cabane API origin \u2014 the hosted app is https://app.cabane.ai (pass \`--server <url>\` for your own instance).`
       );
     }
     const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
@@ -351,7 +351,7 @@ async function runDeviceFlow(baseUrl, print, opts = {}) {
 }
 
 // src/pairing-config.ts
-var DEFAULT_BASE_URL = "https://cabane.ai";
+var DEFAULT_BASE_URL = "https://app.cabane.ai";
 function resolvePairBaseUrl(server) {
   const raw = (server ?? process.env.CABANE_BASE_URL ?? DEFAULT_BASE_URL).trim();
   if (!isAllowedBaseUrl(raw)) {

package/dist/runtime.js

@@ -4633,6 +4633,7 @@ function buildConfig(req) {
   }
   const policy = codexToolPolicy(req.policy);
   const tmpDir = req.local.env?.TMPDIR;
+  const gateLockDir = req.local.env?.CABANE_GATE_LOCK_DIR;
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
@@ -4650,7 +4651,9 @@ function buildConfig(req) {
         [policy.permissionProfile]: {
           filesystem: {
             ":root": "read",
-            ":workspace_roots": { ".": "write", ".git": "write" }
+            ":workspace_roots": { ".": "write", ".git": "write" },
+            // The one absolute-path grant — see the CT612-fallout note above.
+            ...gateLockDir ? { [gateLockDir]: "write" } : {}
           },
           network: { enabled: policy.networkAccessEnabled, mode: "full" }
         }
@@ -6907,6 +6910,9 @@ ${reason}`,
         );
       }
     }
+    if (turnContext.runtime === "codex" && process.env.CABANE_GATE_LOCK_DIR) {
+      turnEnv = { ...turnEnv, CABANE_GATE_LOCK_DIR: process.env.CABANE_GATE_LOCK_DIR };
+    }
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
     this.aborts.set(key, abortController);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",