@cabane/companion 0.6.49 → 0.6.51

package/dist/runtime.js

@@ -434,1158 +434,1178 @@ import { readFile } from "fs/promises";
 import { extname, join as join3, normalize } from "path";
 import { streamSSE } from "hono/streaming";
 
-// src/logger.ts
-import { createWriteStream, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import pino from "pino";
-import pretty from "pino-pretty";
-function companionLogPath() {
-  return join2(cabaneDir(), "companion.log");
-}
-var CONSOLE_IGNORE = [
-  "pid",
-  "hostname",
-  "workspaceId",
-  "conversationId",
-  "agentId",
-  "messageId",
-  "sessionId",
-  "companionId"
-].join(",");
-function consoleShortId(log) {
-  const id = log.conversationId ?? log.workspaceId;
-  return typeof id === "string" && id.length > 0 ? id.slice(0, 8) : null;
-}
-function consoleMessageFormat(log, messageKey) {
-  const short = consoleShortId(log);
-  const msg = String(log[messageKey] ?? "");
-  return short ? `${short} ${msg}` : msg;
+// src/harness-check.ts
+import { spawn as spawn3 } from "child_process";
+
+// src/harness-versions.ts
+import { spawn as spawn2 } from "child_process";
+var EMPTY = { claudeCode: null, opencode: null, codex: null };
+var CLI_PROBE_TIMEOUT_MS = 4e3;
+function parseVersionToken(raw) {
+  if (!raw) return null;
+  const m = raw.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
+  return m ? m[0] : null;
 }
-var cached = null;
-var consoleLogging = true;
-function createLogger(destinations = {}) {
-  const path = companionLogPath();
-  if (!destinations.file) mkdirSync2(dirname2(path), { recursive: true });
-  const streams = [];
-  if (process.env.CABANE_COMPANION_DAEMON !== "1") {
-    const consoleStream = pretty({
-      colorize: true,
-      ignore: CONSOLE_IGNORE,
-      messageFormat: (log, messageKey) => consoleMessageFormat(log, messageKey),
-      ...destinations.console ? { destination: destinations.console } : {}
-    });
-    streams.push({
-      level: "info",
-      stream: {
-        write(chunk) {
-          if (consoleLogging) consoleStream.write(chunk);
-        }
+function probeCliPresence(command, spawnImpl = spawn2) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer = null;
+    const done = (result) => {
+      if (!settled) {
+        settled = true;
+        if (timer) clearTimeout(timer);
+        resolve(result);
       }
+    };
+    let child;
+    try {
+      child = spawnImpl(command, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      done({ status: "absent" });
+      return;
+    }
+    let out = "";
+    child.stdout?.on("data", (chunk) => {
+      if (out.length < 4096) out += chunk.toString();
+    });
+    timer = setTimeout(() => {
+      child.kill?.("SIGKILL");
+      done({ status: "unusable" });
+    }, CLI_PROBE_TIMEOUT_MS);
+    timer.unref?.();
+    child.once("error", () => done({ status: "absent" }));
+    child.once("exit", (code) => {
+      const version = code === 0 ? parseVersionToken(out) : null;
+      done(version ? { status: "present", version } : { status: "unusable" });
     });
-  }
-  streams.push({
-    level: "debug",
-    stream: destinations.file ?? createWriteStream(path, { flags: "a" })
   });
-  return pino({ level: "debug" }, pino.multistream(streams));
-}
-function getLogger() {
-  if (cached) return cached;
-  cached = createLogger();
-  return cached;
 }
-
-// src/state.ts
-import { EventEmitter } from "events";
-function dispatchToWire(r) {
-  return {
-    id: r.id,
-    timestamp: r.timestamp,
-    workspace_slug: r.workspaceSlug,
-    ...r.agentUsername ? { agent_username: r.agentUsername } : {},
-    message: r.message,
-    status: r.status,
-    ...r.durationMs !== void 0 ? { duration_ms: r.durationMs } : {},
-    ...r.error ? { error: r.error } : {},
-    ...r.reply ? { reply: r.reply } : {}
-  };
+function probeHarnessPresence(runtime, spawnImpl = spawn2) {
+  return probeCliPresence(runtime === "codex" ? "codex" : "claude", spawnImpl);
 }
-var MAX_DISPATCHES = 50;
-function today() {
-  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+async function probeCliVersion(command, spawnImpl = spawn2) {
+  const result = await probeCliPresence(command, spawnImpl);
+  return result.status === "present" ? result.version : null;
 }
-var CompanionStateHub = class {
-  constructor(opts) {
-    this.opts = opts;
-    this.emitter.setMaxListeners(0);
+async function probeOpencodeVersion(serverUrl, fetchImpl = fetch) {
+  try {
+    const base = serverUrl.endsWith("/") ? serverUrl.slice(0, -1) : serverUrl;
+    const res = await fetchImpl(`${base}/global/health`, {
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    return extractOpencodeVersion(await res.json());
+  } catch {
+    return null;
   }
-  opts;
-  emitter = new EventEmitter();
-  workspaces = /* @__PURE__ */ new Map();
-  dispatches = [];
-  dashboardUrl = null;
-  deviceId = null;
-  deviceLabel = null;
-  deviceError = null;
-  // CT586: the latest harness snapshot the supervisor probed, or null before the
-  // first probe (see CompanionStatusJson.harnesses).
-  harnesses = null;
-  // ---- subscription (SSE) ----
-  on(listener) {
-    this.emitter.on("event", listener);
-    return () => this.emitter.off("event", listener);
+}
+function extractOpencodeVersion(json) {
+  if (!json || typeof json !== "object") return null;
+  const obj = json;
+  const candidates = [obj.version];
+  for (const v of Object.values(obj)) {
+    if (v && typeof v === "object") candidates.push(v.version);
   }
-  emit(type, data) {
-    this.emitter.emit("event", { type, data });
+  for (const c of candidates) {
+    if (typeof c === "string") {
+      const parsed = parseVersionToken(c);
+      if (parsed) return parsed;
+    }
   }
-  // ---- device ----
-  setDevice(info) {
-    if (info.deviceId !== void 0) this.deviceId = info.deviceId;
-    if (info.deviceLabel !== void 0) this.deviceLabel = info.deviceLabel;
-    this.emitStatus();
+  return null;
+}
+async function probeHarnessVersions(opts, deps = {}) {
+  const probeClaudeCode = deps.probeClaudeCode ?? (() => probeCliVersion("claude"));
+  const probeCodex = deps.probeCodex ?? (() => probeCliVersion("codex"));
+  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
+  const [claudeCode, codex, opencode] = await Promise.all([
+    opts.claudeCode ? safe(probeClaudeCode) : Promise.resolve(null),
+    opts.codex ? safe(probeCodex) : Promise.resolve(null),
+    opts.opencodeServerUrl ? safe(() => probeOpencode(opts.opencodeServerUrl)) : Promise.resolve(null)
+  ]);
+  return { claudeCode, opencode, codex };
+}
+function emptyHarnessVersions() {
+  return { ...EMPTY };
+}
+async function safe(fn) {
+  try {
+    return await fn();
+  } catch {
+    return null;
   }
-  setDeviceError(message) {
-    if (this.deviceError === message) return;
-    this.deviceError = message;
-    this.emitStatus();
+}
+
+// src/manifest.ts
+var DEVICE_MANIFEST = {
+  runtimes: [{ name: "claude-code", version: null }],
+  capabilities: { hostFs: true, browser: true, userMcp: true }
+};
+function buildCompanionManifest(opts) {
+  const v = opts.versions ?? {};
+  const runtimes = [];
+  if (opts.claudeCode) runtimes.push({ name: "claude-code", version: v.claudeCode ?? null });
+  if (opts.opencode) runtimes.push({ name: "opencode", version: v.opencode ?? null });
+  if (opts.codex) runtimes.push({ name: "codex", version: v.codex ?? null });
+  return { runtimes, capabilities: { ...DEVICE_MANIFEST.capabilities } };
+}
+
+// src/harness-status.ts
+var HARNESS_LABELS = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  opencode: "OpenCode"
+};
+var LABELS = HARNESS_LABELS;
+var DEFAULT_OPENCODE_SERVER_URL = "http://127.0.0.1:4096";
+function deriveHarnessSnapshot(signals) {
+  const advertised = new Set(
+    buildCompanionManifest({
+      // CT1082: connected AND installed — the manifest's own rule, restated here
+      // through the same function rather than re-decided.
+      claudeCode: signals.claudeCodeConnected && signals.claudeOnPath,
+      opencode: signals.opencodeConfigured,
+      codex: signals.codexEnabled
+    }).runtimes.map((r) => r.name)
+  );
+  const harnesses = [
+    deriveClaudeCode(signals, advertised.has("claude-code")),
+    deriveCodex(signals, advertised.has("codex")),
+    deriveOpencode(signals, advertised.has("opencode"))
+  ];
+  return { harnesses, anyExposed: harnesses.some((h) => h.state === "exposed") };
+}
+function deriveClaudeCode(signals, manifestHas) {
+  const base = { runtime: "claude-code", label: LABELS["claude-code"] };
+  if (manifestHas) {
+    return {
+      ...base,
+      state: "exposed",
+      version: signals.claudeVersion,
+      detail: "Claude Code is connected and exposed to Cabane.",
+      enable: null
+    };
   }
-  clearDeviceError() {
-    if (this.deviceError === null) return;
-    this.deviceError = null;
-    this.emitStatus();
+  if (signals.claudeCodeConnected) {
+    return {
+      ...base,
+      state: "needs_attention",
+      version: null,
+      detail: "Connected, but the `claude` CLI isn\u2019t on your PATH. Install it (`npm i -g @anthropic-ai/claude-code`) and sign in, or disconnect it.",
+      enable: null
+    };
   }
-  // ---- harnesses (CT586) ----
-  // Replace the harness snapshot and push a status change (so the SSE feed flips
-  // the Companion's Harnesses surface live). The supervisor calls this on each
-  // heartbeat-cadence probe and on an on-demand recheck.
-  setHarnesses(harnesses) {
-    this.harnesses = harnesses;
-    this.emitStatus();
+  if (signals.claudeOnPath) {
+    return {
+      ...base,
+      state: "detected_not_exposed",
+      version: signals.claudeVersion,
+      detail: "Claude Code is installed here but not connected yet. Connect it to let Cabane run Claude Code on this device.",
+      enable: "claude-code"
+    };
   }
-  // ---- workspace lifecycle ----
-  registerWorkspace(ws) {
-    const existing = this.workspaces.get(ws.workspaceId);
-    if (existing) {
-      existing.slug = ws.slug;
-      existing.name = ws.name;
-      return;
+  return {
+    ...base,
+    state: "not_detected",
+    version: null,
+    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then connect it here.",
+    enable: null
+  };
+}
+function deriveCodex(signals, manifestHas) {
+  const base = { runtime: "codex", label: LABELS.codex };
+  if (manifestHas) {
+    if (signals.codexOnPath) {
+      return {
+        ...base,
+        state: "exposed",
+        version: signals.codexVersion,
+        detail: "Codex is enabled and exposed to Cabane.",
+        enable: null
+      };
     }
-    this.workspaces.set(ws.workspaceId, {
-      workspaceId: ws.workspaceId,
-      slug: ws.slug,
-      name: ws.name,
-      connected: false,
-      authFailed: false,
-      lastEventAt: null,
-      dispatchCountToday: 0,
-      countDate: today(),
-      agents: /* @__PURE__ */ new Map()
-    });
-    this.emitStatus();
-  }
-  removeWorkspace(workspaceId) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws) return;
-    this.workspaces.delete(workspaceId);
-    this.emit("workspace:disconnected", { slug: ws.slug });
-    this.emitStatus();
-  }
-  setConnected(workspaceId, connected) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws || ws.connected === connected) return;
-    ws.connected = connected;
-    if (connected) ws.authFailed = false;
-    this.emitStatus();
-  }
-  setAuthFailed(workspaceId) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws) return;
-    if (ws.authFailed && !ws.connected) return;
-    ws.authFailed = true;
-    ws.connected = false;
-    this.emitStatus();
-  }
-  recordEvent(workspaceId) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws) return;
-    ws.lastEventAt = (/* @__PURE__ */ new Date()).toISOString();
-  }
-  // ---- agents ----
-  // Upsert one assigned agent's observable state (called on each reconcile).
-  setAgent(workspaceId, agent) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws) return;
-    ws.agents.set(agent.agentId, agent);
-    this.emitStatus();
-  }
-  removeAgent(workspaceId, agentId) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws) return;
-    if (ws.agents.delete(agentId)) this.emitStatus();
-  }
-  // ---- dispatch feed ----
-  // A DispatchObserver bound to one (workspace, agent), handed to that agent's
-  // Dispatcher by the supervisor.
-  observerFor(workspaceId, agentId, slug) {
-    const username = () => this.workspaces.get(workspaceId)?.agents.get(agentId)?.username ?? "";
     return {
-      onStart: (info) => this.dispatchStarted(workspaceId, slug, username(), info),
-      onEnd: (info) => this.dispatchEnded(slug, username(), info)
-    };
-  }
-  bumpCount(workspaceId) {
-    const ws = this.workspaces.get(workspaceId);
-    if (!ws) return;
-    const day = today();
-    if (ws.countDate !== day) {
-      ws.countDate = day;
-      ws.dispatchCountToday = 0;
-    }
-    ws.dispatchCountToday += 1;
-  }
-  dispatchStarted(workspaceId, slug, agentUsername, info) {
-    this.bumpCount(workspaceId);
-    const record = {
-      id: info.id,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      workspaceSlug: slug,
-      ...agentUsername ? { agentUsername } : {},
-      message: info.message,
-      status: "running"
+      ...base,
+      state: "needs_attention",
+      version: null,
+      detail: "Enabled, but the `codex` CLI isn\u2019t on your PATH. Install it and sign in (`codex login`), or turn Codex off.",
+      enable: null
     };
-    this.upsertDispatch(record);
-    this.emit("dispatch:started", dispatchToWire(record));
-    this.emitStatus();
   }
-  dispatchEnded(slug, agentUsername, info) {
-    const existing = this.dispatches.find((d) => d.id === info.id);
-    const record = {
-      id: info.id,
-      timestamp: existing?.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-      workspaceSlug: existing?.workspaceSlug ?? slug,
-      ...existing?.agentUsername ?? agentUsername ? { agentUsername: existing?.agentUsername ?? agentUsername } : {},
-      message: existing?.message ?? "",
-      status: info.ok ? "replied" : "error",
-      durationMs: info.durationMs,
-      ...info.reason ? { error: info.reason } : {},
-      ...info.reply ? { reply: info.reply } : {}
+  if (signals.codexOnPath) {
+    return {
+      ...base,
+      state: "detected_not_exposed",
+      version: signals.codexVersion,
+      detail: "Codex is installed but not exposed yet. Turn it on to let Cabane run Codex here.",
+      enable: "codex"
     };
-    this.upsertDispatch(record);
-    this.emit(info.ok ? "dispatch:completed" : "dispatch:error", dispatchToWire(record));
   }
-  upsertDispatch(record) {
-    const idx = this.dispatches.findIndex((d) => d.id === record.id);
-    if (idx >= 0) {
-      this.dispatches[idx] = record;
-      return;
+  return {
+    ...base,
+    state: "not_detected",
+    version: null,
+    detail: "Not detected. Install the Codex CLI and sign in (`codex login`), then enable it here.",
+    enable: null
+  };
+}
+function deriveOpencode(signals, manifestHas) {
+  const base = { runtime: "opencode", label: LABELS.opencode };
+  if (manifestHas) {
+    if (signals.opencodeReachable) {
+      return {
+        ...base,
+        state: "exposed",
+        version: signals.opencodeVersion,
+        detail: "An opencode server is reachable and exposed to Cabane.",
+        enable: null
+      };
     }
-    this.dispatches.unshift(record);
-    if (this.dispatches.length > MAX_DISPATCHES) this.dispatches.length = MAX_DISPATCHES;
-  }
-  // ---- snapshots for the HTTP routes ----
-  setDashboardUrl(url) {
-    this.dashboardUrl = url;
-  }
-  recentDispatches(limit = 20) {
-    return this.dispatches.slice(0, Math.max(0, limit));
-  }
-  statusJson() {
-    const list = [...this.workspaces.values()].sort((a, b) => a.name.localeCompare(b.name));
-    const lastOverall = list.reduce((acc, ws) => {
-      if (!ws.lastEventAt) return acc;
-      if (!acc || ws.lastEventAt > acc) return ws.lastEventAt;
-      return acc;
-    }, null);
     return {
-      cabane_url: this.opts.baseUrl,
-      device_id: this.deviceId,
-      device_label: this.deviceLabel,
-      device_error: this.deviceError,
-      connected: list.some((ws) => ws.connected),
-      workspaces: list.map((ws) => ({
-        slug: ws.slug,
-        name: ws.name,
-        last_event_at: ws.lastEventAt,
-        dispatch_count_today: ws.dispatchCountToday,
-        connected: ws.connected,
-        auth_failed: ws.authFailed,
-        agents: [...ws.agents.values()].sort((a, b) => a.username.localeCompare(b.username)).map((a) => ({
-          agent_id: a.agentId,
-          username: a.username,
-          display_name: a.displayName,
-          mode: a.mode,
-          has_credential: a.hasCredential,
-          missing_secrets: a.missingSecrets
-        }))
-      })),
-      last_event_at_overall: lastOverall,
-      dashboard_url: this.dashboardUrl,
-      companion_version: this.opts.companionVersion,
-      instance_id: this.opts.instanceId ?? null,
-      harnesses: this.harnesses
+      ...base,
+      state: "needs_attention",
+      version: null,
+      detail: "Configured, but the opencode server isn\u2019t answering. Start `opencode serve` and check the URL.",
+      enable: null
     };
   }
-  emitStatus() {
-    this.emit("status:changed", this.statusJson());
+  if (signals.opencodeReachable && signals.opencodeDetectedUrl) {
+    return {
+      ...base,
+      state: "detected_not_exposed",
+      version: signals.opencodeVersion,
+      detail: signals.opencodeDetectedUrl,
+      enable: "opencode"
+    };
   }
-};
-
-// src/dashboard/routes.ts
-var CONTENT_TYPES = {
-  ".html": "text/html; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".ico": "image/x-icon"
-};
-function registerRoutes(app, deps) {
-  const { supervisor, hub, staticDir } = deps;
-  app.get("/", async (c) => {
-    const html = await readFile(join3(staticDir, "index.html"), "utf8");
-    return c.html(html);
-  });
-  app.get("/static/:file", async (c) => {
-    const file = c.req.param("file");
-    const safe3 = normalize(file).replace(/^(\.\.[/\\])+/, "");
-    const full = join3(staticDir, safe3);
-    if (!full.startsWith(staticDir) || !existsSync2(full)) return c.notFound();
-    const body = await readFile(full);
-    const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
-    c.header("content-type", type);
-    return c.body(body);
-  });
-  app.get("/api/status", (c) => c.json(hub.statusJson()));
-  app.get("/api/dispatches", (c) => {
-    const limit = clampLimit(c.req.query("limit"), 20);
-    return c.json({ dispatches: hub.recentDispatches(limit).map(dispatchToWire) });
-  });
-  app.get("/api/logs", async (c) => {
-    const lines = clampLimit(c.req.query("lines"), 200, 1e3);
-    return c.json({ lines: tailFile(companionLogPath(), lines) });
-  });
-  app.post("/api/settings", async (c) => {
-    const body = await readJson(c);
-    const patch = {};
-    if (body.logLevel === "warn" || body.logLevel === "info" || body.logLevel === "debug") {
-      patch.logLevel = body.logLevel;
-    }
-    if (typeof body.autoOpen === "boolean") patch.autoOpen = body.autoOpen;
-    supervisor.applySettings(patch);
-    return c.json({ ok: true, status: hub.statusJson() });
-  });
-  app.post("/api/control", async (c) => {
-    const body = await readJson(c);
-    const action = body.action;
-    if (action === "stop") {
-      setTimeout(() => void supervisor.requestStop(), 50);
-      return c.json({ ok: true, action: "stop" });
-    }
-    if (action === "restart") {
-      setTimeout(() => supervisor.requestRestart(), 50);
-      return c.json({ ok: true, action: "restart" });
-    }
-    if (action === "reload-config") {
-      supervisor.reloadConfig();
-      return c.json({ ok: true, action: "reload-config" });
-    }
-    if (action === "refresh") {
-      supervisor.refresh();
-      return c.json({ ok: true, action: "refresh" });
-    }
-    return c.json({ error: `unknown action "${String(action)}"` }, 400);
-  });
-  app.post("/api/harnesses/recheck", async (c) => {
-    await supervisor.recheckHarnesses();
-    return c.json({ ok: true, status: hub.statusJson() });
-  });
-  app.post("/api/harnesses/enable", async (c) => {
-    const body = await readJson(c);
-    const runtime = body.runtime;
-    if (runtime === "claude-code") {
-      const result = await supervisor.enableHarness({ runtime: "claude-code" });
-      if (!result.ok) return c.json({ error: result.error }, 400);
-      return c.json({ ok: true, status: hub.statusJson() });
-    }
-    if (runtime === "codex") {
-      const result = await supervisor.enableHarness({ runtime: "codex" });
-      if (!result.ok) return c.json({ error: result.error }, 400);
-      return c.json({ ok: true, status: hub.statusJson() });
-    }
-    if (runtime === "opencode") {
-      if (typeof body.serverUrl !== "string" || body.serverUrl.trim() === "") {
-        return c.json({ error: "An opencode server URL is required." }, 400);
-      }
-      const result = await supervisor.enableHarness({
-        runtime: "opencode",
-        serverUrl: body.serverUrl
-      });
-      if (!result.ok) return c.json({ error: result.error }, 400);
-      return c.json({ ok: true, status: hub.statusJson() });
-    }
-    return c.json({ error: `can't enable "${String(runtime)}" from the app` }, 400);
-  });
-  app.get(
-    "/api/events",
-    (c) => streamSSE(c, async (stream) => {
-      await stream.writeSSE({ event: "status:changed", data: JSON.stringify(hub.statusJson()) });
-      const queue = [];
-      let wake = null;
-      const unsubscribe = hub.on((ev) => {
-        queue.push(ev);
-        wake?.();
-      });
-      stream.onAbort(() => {
-        unsubscribe();
-        wake?.();
-      });
-      while (!stream.aborted) {
-        if (queue.length === 0) {
-          await Promise.race([
-            new Promise((resolve) => {
-              wake = resolve;
-            }),
-            stream.sleep(25e3)
-          ]);
-          wake = null;
-        }
-        if (stream.aborted) break;
-        if (queue.length === 0) {
-          await stream.writeSSE({ event: "ping", data: "" });
-          continue;
-        }
-        const ev = queue.shift();
-        await stream.writeSSE({ event: ev.type, data: JSON.stringify(ev.data) });
-      }
-      unsubscribe();
-    })
-  );
-}
-async function readJson(c) {
-  try {
-    const parsed = await c.req.json();
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function clampLimit(raw, fallback, max = 200) {
-  if (!raw) return fallback;
-  const n = Number(raw);
-  if (!Number.isFinite(n) || n <= 0) return fallback;
-  return Math.min(Math.floor(n), max);
+  return {
+    ...base,
+    state: "not_detected",
+    version: null,
+    detail: "Not detected. Run `opencode serve` and add its URL here to expose opencode.",
+    enable: "opencode"
+  };
 }
-function tailFile(path, lines) {
-  if (!existsSync2(path)) return [];
-  const MAX_BYTES = 256 * 1024;
-  let fd;
-  try {
-    fd = openSync(path, "r");
-    const size = fstatSync(fd).size;
-    const start = Math.max(0, size - MAX_BYTES);
-    const len = size - start;
-    if (len <= 0) return [];
-    const buf = Buffer.alloc(len);
-    readSync(fd, buf, 0, len, start);
-    const text = buf.toString("utf8");
-    const all = text.split("\n");
-    if (start > 0 && all.length > 0) all.shift();
-    return all.filter((l) => l.length > 0).slice(-lines);
-  } catch {
-    return [];
-  } finally {
-    if (fd !== void 0) closeSync(fd);
-  }
+var PROBE_TIMEOUT_MS = 4e3;
+var DEFAULT_OPENCODE_PROBE_TIMEOUT_MS = 1e3;
+function probeDefaultOpencodeVersion(probeOpencode = (url) => probeOpencodeVersion(url)) {
+  return withTimeout(
+    probeOpencode(DEFAULT_OPENCODE_SERVER_URL),
+    null,
+    DEFAULT_OPENCODE_PROBE_TIMEOUT_MS
+  );
 }
-
-// src/dashboard/server.ts
-var DEFAULT_PORT = 7474;
-var PORT_FALLBACK_SPAN = 10;
-function buildDashboardApp(deps) {
-  const app = new Hono();
-  app.onError((err, c) => {
-    if (err instanceof ApiError) {
-      const status = err.status >= 400 && err.status < 600 ? err.status : 502;
-      return c.json({ error: err.message }, status);
-    }
-    if (err instanceof CompanionError) {
-      return c.json({ error: err.message }, 400);
-    }
-    return c.json({ error: err instanceof Error ? err.message : "internal error" }, 500);
-  });
-  registerRoutes(app, { ...deps, staticDir: resolveStaticDir() });
-  return app;
+async function resolveOpencodeServerUrl(configuredServerUrl, requestedServerUrl, probeDefault = probeDefaultOpencodeVersion) {
+  const requested = requestedServerUrl?.trim();
+  if (requested) return requested;
+  if (configuredServerUrl) return configuredServerUrl;
+  return await probeDefault() !== null ? DEFAULT_OPENCODE_SERVER_URL : null;
 }
-async function startDashboard(opts) {
-  const app = buildDashboardApp({ supervisor: opts.supervisor, hub: opts.hub });
-  const preferred = opts.port ?? DEFAULT_PORT;
-  let lastErr;
-  for (let port = preferred; port < preferred + PORT_FALLBACK_SPAN; port++) {
-    try {
-      const server = await listen(app, port);
-      const url = `http://127.0.0.1:${port}`;
-      return {
-        url,
-        port,
-        close: () => new Promise((resolve) => {
-          server.close(() => resolve());
-          server.closeAllConnections?.();
-        })
-      };
-    } catch (err) {
-      if (isAddrInUse(err)) {
-        lastErr = err;
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new CompanionError(
-    `couldn't bind the dashboard to any port in ${preferred}\u2013${preferred + PORT_FALLBACK_SPAN - 1} (all in use). Free one up or pass --port. (last error: ${lastErr instanceof Error ? lastErr.message : String(lastErr)})`
-  );
+async function probeHarnessSignals(cfg, deps = {}) {
+  const probePresence = deps.probePresence ?? probeHarnessPresence;
+  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
+  const configuredServerUrl = cfg.opencode?.serverUrl;
+  const opencodeProbeUrl = configuredServerUrl ?? DEFAULT_OPENCODE_SERVER_URL;
+  const [claudePresence, codexPresence, opencodeVersion] = await Promise.all([
+    deps.presence?.["claude-code"] ?? withTimeout(probePresence("claude-code"), { status: "absent" }),
+    deps.presence?.codex ?? withTimeout(probePresence("codex"), { status: "absent" }),
+    configuredServerUrl ? withTimeout(probeOpencode(opencodeProbeUrl), null) : probeDefaultOpencodeVersion(probeOpencode)
+  ]);
+  const claudeVersion = claudePresence.status === "present" ? claudePresence.version : null;
+  const codexVersion = codexPresence.status === "present" ? codexPresence.version : null;
+  return {
+    claudeOnPath: claudePresence.status === "present",
+    claudeVersion,
+    // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
+    // the manifest gate and the probe above is only a suggestion.
+    claudeCodeConnected: isClaudeCodeConnected(cfg),
+    // A parseable `codex --version` is our presence signal (presence alone never
+    // exposes codex; its config flag is the manifest gate either way).
+    codexOnPath: codexVersion !== null,
+    codexVersion,
+    codexEnabled: isCodexEnabled(cfg),
+    opencodeConfigured: !!configuredServerUrl,
+    // A version came back ⟺ the serve answered its health endpoint (CT584).
+    opencodeReachable: opencodeVersion !== null,
+    opencodeVersion,
+    opencodeDetectedUrl: opencodeVersion !== null ? opencodeProbeUrl : null
+  };
 }
-function listen(app, port) {
-  return new Promise((resolve, reject) => {
+function withTimeout(promise, fallback, timeoutMs = PROBE_TIMEOUT_MS) {
+  return new Promise((resolve) => {
     let settled = false;
-    const server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port }, () => {
+    const done = (v) => {
       if (!settled) {
         settled = true;
-        resolve(server);
+        resolve(v);
       }
-    });
-    server.on("error", (err) => {
-      if (!settled) {
-        settled = true;
-        reject(err);
+    };
+    const timer = setTimeout(() => done(fallback), timeoutMs);
+    timer.unref?.();
+    promise.then(
+      (v) => {
+        clearTimeout(timer);
+        done(v);
+      },
+      () => {
+        clearTimeout(timer);
+        done(fallback);
       }
-    });
+    );
   });
 }
-function isAddrInUse(err) {
-  return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
-}
-function resolveStaticDir() {
-  return join4(dirname3(fileURLToPath(import.meta.url)), "static");
-}
 
-// src/control-socket.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync3, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
-import { createServer, connect } from "net";
-import { join as join5 } from "path";
-var CONTROL_TIMEOUT_MS = 1e3;
-function controlSocketPath() {
-  const dir2 = cabaneDir();
-  if (process.platform === "win32") {
-    const key = createHash("sha256").update(dir2).digest("hex").slice(0, 16);
-    return `\\\\.\\pipe\\cabane-companion-${key}`;
-  }
-  return join5(dir2, "companion.sock");
-}
-async function startControlServer(handlers) {
-  const path = controlSocketPath();
-  mkdirSync3(cabaneDir(), { recursive: true });
-  if (process.platform !== "win32" && existsSync3(path)) {
-    const alive = await ping(path);
-    if (alive) throw new Error(`another companion is already listening on ${path}`);
-    rmSync2(path, { force: true });
-  }
-  const server = createServer((socket) => {
-    void serveConnection(socket, handlers);
-  });
-  server.unref();
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(path, () => {
-      server.removeListener("error", reject);
-      resolve();
-    });
-  });
-  server.on("error", () => {
-  });
-  return {
-    path,
-    close: () => new Promise((resolve) => {
-      server.close(() => {
-        if (process.platform !== "win32") rmSync2(path, { force: true });
-        resolve();
-      });
-    })
-  };
-}
-async function serveConnection(socket, handlers) {
-  socket.on("error", () => socket.destroy());
-  const line = await readLine(socket, CONTROL_TIMEOUT_MS * 5);
-  if (line === null) {
-    socket.destroy();
-    return;
-  }
-  let req;
-  try {
-    req = JSON.parse(line);
-  } catch {
-    reply(socket, { error: "malformed request" });
-    return;
-  }
+// src/harness-check.ts
+var CHECK_TIMEOUT_MS = 4e3;
+async function shakeOutHarness(runtime, cfg, deps = {}) {
+  const run = deps.run ?? runBounded;
+  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
   try {
-    if (req.cmd === "status") {
-      reply(socket, handlers.status());
-      return;
-    }
-    if (req.cmd === "connect") {
-      const result = await handlers.connect(req.runtime, req.serverUrl);
-      reply(socket, result);
-      return;
+    if (runtime === "opencode") {
+      const url = cfg.opencode?.serverUrl;
+      if (!url) return "absent";
+      return await probeOpencode(url) !== null ? "ok" : "failed";
     }
-    if (req.cmd === "stop") {
-      reply(socket, { ok: true });
-      setTimeout(() => handlers.stop(), 50).unref?.();
-      return;
+    const { auth } = runtime === "codex" ? {
+      auth: ["codex", ["login", "status"]]
+    } : {
+      auth: ["claude", ["auth", "status"]]
+    };
+    const presence = deps.presence ?? await (deps.probePresence ?? probeHarnessPresence)(runtime);
+    if (presence.status !== "present") return presence.status;
+    const authRun = await run(auth[0], [...auth[1]]);
+    if (authRun.code === 0) return "ok";
+    if (looksUnsupported(authRun.output)) {
+      return "unverified";
     }
-    reply(socket, { error: `unknown command "${String(req.cmd)}"` });
-  } catch (err) {
-    reply(socket, { error: err instanceof Error ? err.message : String(err) });
-  }
-}
-function reply(socket, body) {
-  try {
-    socket.end(`${JSON.stringify(body)}
-`);
+    return "failed";
   } catch {
-    socket.destroy();
+    return "unverified";
   }
 }
-async function controlRequest(path, req, timeoutMs = CONTROL_TIMEOUT_MS) {
-  const socket = connect(path);
-  try {
-    await new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new ControlTimeout()), timeoutMs);
-      timer.unref?.();
-      socket.once("connect", () => {
-        clearTimeout(timer);
-        resolve();
-      });
-      socket.once("error", (err) => {
-        clearTimeout(timer);
-        reject(err);
-      });
-    });
-    socket.write(`${JSON.stringify(req)}
-`);
-    const line = await readLine(socket, timeoutMs);
-    if (line === null) throw new ControlTimeout();
-    return JSON.parse(line);
-  } finally {
-    socket.destroy();
+function connectedLine(runtime, verdict) {
+  if (verdict === "absent" || verdict === "unusable") {
+    throw new Error("an unavailable harness cannot be connected");
   }
+  const label = HARNESS_LABELS[runtime];
+  if (verdict !== "failed") return `${label} connected.`;
+  return `${label} connected \u2014 ${FAILED_SUFFIX[runtime]}`;
 }
-var ControlTimeout = class extends Error {
-  constructor() {
-    super("the companion did not answer its control socket in time");
-    this.name = "ControlTimeout";
-  }
+var FAILED_SUFFIX = {
+  "claude-code": "it doesn\u2019t look signed in yet. Run `claude` once and sign in, then it\u2019s ready.",
+  codex: "it doesn\u2019t look signed in yet. Run `codex login` once, then it\u2019s ready.",
+  opencode: "its server isn\u2019t answering. Start `opencode serve`, then it\u2019s ready."
 };
-function isNotListening(err) {
-  const code = err?.code;
-  return code === "ENOENT" || code === "ECONNREFUSED";
+function presenceReason(runtime, status) {
+  if (runtime === "opencode") {
+    return "No opencode server is configured \u2014 run `opencode serve` and connect with `--url`.";
+  }
+  const label = HARNESS_LABELS[runtime];
+  return status === "absent" ? `${label} isn't installed on this machine.` : `${label} is installed here but didn't report a version Cabane can read.`;
 }
-function readLine(socket, timeoutMs) {
+var CLI_PRESENCE_ACTION = "Install it and run this again.";
+var DASHBOARD_PRESENCE_ACTION = "Install it, then refresh.";
+function presenceRefusal(runtime, status, action) {
+  const reason = presenceReason(runtime, status);
+  return runtime === "opencode" ? reason : `${reason} ${action}`;
+}
+function looksUnsupported(output) {
+  return /unrecognized|unknown (sub)?command|unexpected argument|invalid (sub)?command|no such (sub)?command|usage:|did you mean/i.test(
+    output
+  );
+}
+function runBounded(command, args) {
   return new Promise((resolve) => {
-    let buf = "";
     let settled = false;
-    const done = (v) => {
+    const done = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      socket.removeListener("data", onData);
-      resolve(v);
-    };
-    const timer = setTimeout(() => done(null), timeoutMs);
-    timer.unref?.();
-    const onData = (chunk) => {
-      buf += chunk.toString("utf8");
-      const nl = buf.indexOf("\n");
-      if (nl >= 0) done(buf.slice(0, nl));
-      else if (buf.length > 1e6) done(null);
-    };
-    socket.on("data", onData);
-    socket.once("close", () => done(null));
-    socket.once("error", () => done(null));
-  });
-}
-async function ping(path) {
-  try {
-    await controlRequest(path, { cmd: "status" });
-    return true;
-  } catch (err) {
-    return !isNotListening(err);
-  }
-}
-
-// src/harness-check.ts
-import { spawn as spawn4 } from "child_process";
-
-// src/harness-versions.ts
-import { spawn as spawn2 } from "child_process";
-var EMPTY = { claudeCode: null, opencode: null, codex: null };
-function parseVersionToken(raw) {
-  if (!raw) return null;
-  const m = raw.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
-  return m ? m[0] : null;
-}
-async function probeCliVersion(command, spawnImpl = spawn2) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (v) => {
-      if (!settled) {
-        settled = true;
-        resolve(v);
-      }
+      resolve(result);
     };
     let child;
     try {
-      child = spawnImpl(command, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
+      child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      done(null);
+      resolve({ code: null, output: "", error: "spawn" });
       return;
     }
     let out = "";
-    child.stdout?.on("data", (chunk) => {
+    const capture = (chunk) => {
       if (out.length < 4096) out += chunk.toString();
-    });
-    child.once("error", () => done(null));
-    child.once("exit", (code) => done(code === 0 ? parseVersionToken(out) : null));
+    };
+    child.stdout?.on("data", capture);
+    child.stderr?.on("data", capture);
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      done({ code: null, output: out, error: "timeout" });
+    }, CHECK_TIMEOUT_MS);
+    timer.unref?.();
+    child.once("error", () => done({ code: null, output: out, error: "spawn" }));
+    child.once("exit", (code) => done({ code, output: out }));
   });
 }
-async function probeOpencodeVersion(serverUrl, fetchImpl = fetch) {
-  try {
-    const base = serverUrl.endsWith("/") ? serverUrl.slice(0, -1) : serverUrl;
-    const res = await fetchImpl(`${base}/global/health`, {
-      headers: { accept: "application/json" }
-    });
-    if (!res.ok) return null;
-    return extractOpencodeVersion(await res.json());
-  } catch {
-    return null;
-  }
+
+// src/logger.ts
+import { createWriteStream, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import pino from "pino";
+import pretty from "pino-pretty";
+function companionLogPath() {
+  return join2(cabaneDir(), "companion.log");
 }
-function extractOpencodeVersion(json) {
-  if (!json || typeof json !== "object") return null;
-  const obj = json;
-  const candidates = [obj.version];
-  for (const v of Object.values(obj)) {
-    if (v && typeof v === "object") candidates.push(v.version);
-  }
-  for (const c of candidates) {
-    if (typeof c === "string") {
-      const parsed = parseVersionToken(c);
-      if (parsed) return parsed;
-    }
-  }
-  return null;
+var CONSOLE_IGNORE = [
+  "pid",
+  "hostname",
+  "workspaceId",
+  "conversationId",
+  "agentId",
+  "messageId",
+  "sessionId",
+  "companionId"
+].join(",");
+function consoleShortId(log) {
+  const id = log.conversationId ?? log.workspaceId;
+  return typeof id === "string" && id.length > 0 ? id.slice(0, 8) : null;
 }
-async function probeHarnessVersions(opts, deps = {}) {
-  const probeClaudeCode = deps.probeClaudeCode ?? (() => probeCliVersion("claude"));
-  const probeCodex = deps.probeCodex ?? (() => probeCliVersion("codex"));
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
-  const [claudeCode, codex, opencode] = await Promise.all([
-    opts.claudeCode ? safe(probeClaudeCode) : Promise.resolve(null),
-    opts.codex ? safe(probeCodex) : Promise.resolve(null),
-    opts.opencodeServerUrl ? safe(() => probeOpencode(opts.opencodeServerUrl)) : Promise.resolve(null)
-  ]);
-  return { claudeCode, opencode, codex };
+function consoleMessageFormat(log, messageKey) {
+  const short = consoleShortId(log);
+  const msg = String(log[messageKey] ?? "");
+  return short ? `${short} ${msg}` : msg;
 }
-function emptyHarnessVersions() {
-  return { ...EMPTY };
-}
-async function safe(fn) {
-  try {
-    return await fn();
-  } catch {
-    return null;
-  }
-}
-
-// src/manifest.ts
-var DEVICE_MANIFEST = {
-  runtimes: [{ name: "claude-code", version: null }],
-  capabilities: { hostFs: true, browser: true, userMcp: true }
-};
-function buildCompanionManifest(opts) {
-  const v = opts.versions ?? {};
-  const runtimes = [];
-  if (opts.claudeCode) runtimes.push({ name: "claude-code", version: v.claudeCode ?? null });
-  if (opts.opencode) runtimes.push({ name: "opencode", version: v.opencode ?? null });
-  if (opts.codex) runtimes.push({ name: "codex", version: v.codex ?? null });
-  return { runtimes, capabilities: { ...DEVICE_MANIFEST.capabilities } };
-}
-
-// src/prereqs.ts
-import { spawn as spawn3 } from "child_process";
-async function claudeOnPath() {
-  return new Promise((resolve) => {
-    let settled = false;
-    const child = spawn3("claude", ["--version"], { stdio: "ignore" });
-    child.once("error", () => {
-      if (!settled) {
-        settled = true;
-        resolve(false);
-      }
+var cached = null;
+var consoleLogging = true;
+function createLogger(destinations = {}) {
+  const path = companionLogPath();
+  if (!destinations.file) mkdirSync2(dirname2(path), { recursive: true });
+  const streams = [];
+  if (process.env.CABANE_COMPANION_DAEMON !== "1") {
+    const consoleStream = pretty({
+      colorize: true,
+      ignore: CONSOLE_IGNORE,
+      messageFormat: (log, messageKey) => consoleMessageFormat(log, messageKey),
+      ...destinations.console ? { destination: destinations.console } : {}
     });
-    child.once("exit", (code) => {
-      if (!settled) {
-        settled = true;
-        resolve(code === 0);
+    streams.push({
+      level: "info",
+      stream: {
+        write(chunk) {
+          if (consoleLogging) consoleStream.write(chunk);
+        }
       }
     });
+  }
+  streams.push({
+    level: "debug",
+    stream: destinations.file ?? createWriteStream(path, { flags: "a" })
   });
+  return pino({ level: "debug" }, pino.multistream(streams));
 }
-var CODEX_PROBE_TIMEOUT_MS = 4e3;
-async function codexOnPath() {
-  const version = await Promise.race([
-    probeCliVersion("codex"),
-    new Promise((resolve) => {
-      const timer = setTimeout(() => resolve(null), CODEX_PROBE_TIMEOUT_MS);
-      timer.unref?.();
-    })
-  ]);
-  return version !== null;
+function getLogger() {
+  if (cached) return cached;
+  cached = createLogger();
+  return cached;
 }
-async function requireStartConfig(deps = {}) {
-  const requireCfg = deps.requireCfg ?? requireConfig;
-  const probeClaude = deps.probeClaude ?? claudeOnPath;
-  const save2 = deps.save ?? saveConfig;
-  const cfg = requireCfg();
-  const claudeOnPathResult = await probeClaude();
-  const migrated = migrateConnectedHarnesses(cfg, claudeOnPathResult);
-  if (!migrated) return { cfg, claudeOnPath: claudeOnPathResult };
-  save2(migrated);
-  deps.onMigrated?.(migrated, claudeOnPathResult);
-  return { cfg: migrated, claudeOnPath: claudeOnPathResult };
+
+// src/state.ts
+import { EventEmitter } from "events";
+function dispatchToWire(r) {
+  return {
+    id: r.id,
+    timestamp: r.timestamp,
+    workspace_slug: r.workspaceSlug,
+    ...r.agentUsername ? { agent_username: r.agentUsername } : {},
+    message: r.message,
+    status: r.status,
+    ...r.durationMs !== void 0 ? { duration_ms: r.durationMs } : {},
+    ...r.error ? { error: r.error } : {},
+    ...r.reply ? { reply: r.reply } : {}
+  };
 }
-async function warnAboutHarnessReadiness(cfg, deps = {}) {
-  const probeClaude = deps.probeClaude ?? claudeOnPath;
-  const probeCodex = deps.probeCodex ?? codexOnPath;
-  const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
-`));
-  const connected = [
-    ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
-    ...isCodexEnabled(cfg) ? ["Codex"] : [],
-    ...cfg.opencode ? ["opencode"] : []
-  ];
-  if (connected.length > 0) {
-    if (isClaudeCodeConnected(cfg) && !await probeClaude()) {
-      warn(
-        "warning: Claude Code is connected on this device but `claude` isn\u2019t on your PATH, so it advertises nothing and a Claude-model agent won\u2019t be routed here. Install it (`npm i -g @anthropic-ai/claude-code`) and log in, or disconnect it."
-      );
+var MAX_DISPATCHES = 50;
+function today() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+var CompanionStateHub = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.emitter.setMaxListeners(0);
+  }
+  opts;
+  emitter = new EventEmitter();
+  workspaces = /* @__PURE__ */ new Map();
+  dispatches = [];
+  dashboardUrl = null;
+  deviceId = null;
+  deviceLabel = null;
+  deviceError = null;
+  // CT586: the latest harness snapshot the supervisor probed, or null before the
+  // first probe (see CompanionStatusJson.harnesses).
+  harnesses = null;
+  // ---- subscription (SSE) ----
+  on(listener) {
+    this.emitter.on("event", listener);
+    return () => this.emitter.off("event", listener);
+  }
+  emit(type, data) {
+    this.emitter.emit("event", { type, data });
+  }
+  // ---- device ----
+  setDevice(info) {
+    if (info.deviceId !== void 0) this.deviceId = info.deviceId;
+    if (info.deviceLabel !== void 0) this.deviceLabel = info.deviceLabel;
+    this.emitStatus();
+  }
+  setDeviceError(message) {
+    if (this.deviceError === message) return;
+    this.deviceError = message;
+    this.emitStatus();
+  }
+  clearDeviceError() {
+    if (this.deviceError === null) return;
+    this.deviceError = null;
+    this.emitStatus();
+  }
+  // ---- harnesses (CT586) ----
+  // Replace the harness snapshot and push a status change (so the SSE feed flips
+  // the Companion's Harnesses surface live). The supervisor calls this on each
+  // heartbeat-cadence probe and on an on-demand recheck.
+  setHarnesses(harnesses) {
+    this.harnesses = harnesses;
+    this.emitStatus();
+  }
+  // ---- workspace lifecycle ----
+  registerWorkspace(ws) {
+    const existing = this.workspaces.get(ws.workspaceId);
+    if (existing) {
+      existing.slug = ws.slug;
+      existing.name = ws.name;
+      return;
     }
-    return;
+    this.workspaces.set(ws.workspaceId, {
+      workspaceId: ws.workspaceId,
+      slug: ws.slug,
+      name: ws.name,
+      connected: false,
+      authFailed: false,
+      lastEventAt: null,
+      dispatchCountToday: 0,
+      countDate: today(),
+      agents: /* @__PURE__ */ new Map()
+    });
+    this.emitStatus();
   }
-  const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
-  const installed = [
-    ...claudeInstalled ? ["Claude Code"] : [],
-    ...codexInstalled ? ["Codex"] : []
-  ];
-  const connectCommands = [
-    ...claudeInstalled ? ["`cabane-companion connect claude-code`"] : [],
-    ...codexInstalled ? ["`cabane-companion connect codex`"] : []
-  ];
-  warn(
-    "No harness is connected on this device yet, so no agent turn can run here. " + (installed.length > 0 ? `We found ${installed.join(" and ")} on this machine \u2014 connect ${installed.length > 1 ? "one with " : "it with "}${connectCommands.join(" or ")} and turns start routing here.` : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).")
-  );
-}
-
-// src/harness-status.ts
-var HARNESS_LABELS = {
-  "claude-code": "Claude Code",
-  codex: "Codex",
-  opencode: "OpenCode"
-};
-var LABELS = HARNESS_LABELS;
-var DEFAULT_OPENCODE_SERVER_URL = "http://127.0.0.1:4096";
-function deriveHarnessSnapshot(signals) {
-  const advertised = new Set(
-    buildCompanionManifest({
-      // CT1082: connected AND installed — the manifest's own rule, restated here
-      // through the same function rather than re-decided.
-      claudeCode: signals.claudeCodeConnected && signals.claudeOnPath,
-      opencode: signals.opencodeConfigured,
-      codex: signals.codexEnabled
-    }).runtimes.map((r) => r.name)
-  );
-  const harnesses = [
-    deriveClaudeCode(signals, advertised.has("claude-code")),
-    deriveCodex(signals, advertised.has("codex")),
-    deriveOpencode(signals, advertised.has("opencode"))
-  ];
-  return { harnesses, anyExposed: harnesses.some((h) => h.state === "exposed") };
-}
-function deriveClaudeCode(signals, manifestHas) {
-  const base = { runtime: "claude-code", label: LABELS["claude-code"] };
-  if (manifestHas) {
+  removeWorkspace(workspaceId) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws) return;
+    this.workspaces.delete(workspaceId);
+    this.emit("workspace:disconnected", { slug: ws.slug });
+    this.emitStatus();
+  }
+  setConnected(workspaceId, connected) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws || ws.connected === connected) return;
+    ws.connected = connected;
+    if (connected) ws.authFailed = false;
+    this.emitStatus();
+  }
+  setAuthFailed(workspaceId) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws) return;
+    if (ws.authFailed && !ws.connected) return;
+    ws.authFailed = true;
+    ws.connected = false;
+    this.emitStatus();
+  }
+  recordEvent(workspaceId) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws) return;
+    ws.lastEventAt = (/* @__PURE__ */ new Date()).toISOString();
+  }
+  // ---- agents ----
+  // Upsert one assigned agent's observable state (called on each reconcile).
+  setAgent(workspaceId, agent) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws) return;
+    ws.agents.set(agent.agentId, agent);
+    this.emitStatus();
+  }
+  removeAgent(workspaceId, agentId) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws) return;
+    if (ws.agents.delete(agentId)) this.emitStatus();
+  }
+  // ---- dispatch feed ----
+  // A DispatchObserver bound to one (workspace, agent), handed to that agent's
+  // Dispatcher by the supervisor.
+  observerFor(workspaceId, agentId, slug) {
+    const username = () => this.workspaces.get(workspaceId)?.agents.get(agentId)?.username ?? "";
     return {
-      ...base,
-      state: "exposed",
-      version: signals.claudeVersion,
-      detail: "Claude Code is connected and exposed to Cabane.",
-      enable: null
+      onStart: (info) => this.dispatchStarted(workspaceId, slug, username(), info),
+      onEnd: (info) => this.dispatchEnded(slug, username(), info)
     };
   }
-  if (signals.claudeCodeConnected) {
+  bumpCount(workspaceId) {
+    const ws = this.workspaces.get(workspaceId);
+    if (!ws) return;
+    const day = today();
+    if (ws.countDate !== day) {
+      ws.countDate = day;
+      ws.dispatchCountToday = 0;
+    }
+    ws.dispatchCountToday += 1;
+  }
+  dispatchStarted(workspaceId, slug, agentUsername, info) {
+    this.bumpCount(workspaceId);
+    const record = {
+      id: info.id,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      workspaceSlug: slug,
+      ...agentUsername ? { agentUsername } : {},
+      message: info.message,
+      status: "running"
+    };
+    this.upsertDispatch(record);
+    this.emit("dispatch:started", dispatchToWire(record));
+    this.emitStatus();
+  }
+  dispatchEnded(slug, agentUsername, info) {
+    const existing = this.dispatches.find((d) => d.id === info.id);
+    const record = {
+      id: info.id,
+      timestamp: existing?.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+      workspaceSlug: existing?.workspaceSlug ?? slug,
+      ...existing?.agentUsername ?? agentUsername ? { agentUsername: existing?.agentUsername ?? agentUsername } : {},
+      message: existing?.message ?? "",
+      status: info.ok ? "replied" : "error",
+      durationMs: info.durationMs,
+      ...info.reason ? { error: info.reason } : {},
+      ...info.reply ? { reply: info.reply } : {}
+    };
+    this.upsertDispatch(record);
+    this.emit(info.ok ? "dispatch:completed" : "dispatch:error", dispatchToWire(record));
+  }
+  upsertDispatch(record) {
+    const idx = this.dispatches.findIndex((d) => d.id === record.id);
+    if (idx >= 0) {
+      this.dispatches[idx] = record;
+      return;
+    }
+    this.dispatches.unshift(record);
+    if (this.dispatches.length > MAX_DISPATCHES) this.dispatches.length = MAX_DISPATCHES;
+  }
+  // ---- snapshots for the HTTP routes ----
+  setDashboardUrl(url) {
+    this.dashboardUrl = url;
+  }
+  recentDispatches(limit = 20) {
+    return this.dispatches.slice(0, Math.max(0, limit));
+  }
+  statusJson() {
+    const list = [...this.workspaces.values()].sort((a, b) => a.name.localeCompare(b.name));
+    const lastOverall = list.reduce((acc, ws) => {
+      if (!ws.lastEventAt) return acc;
+      if (!acc || ws.lastEventAt > acc) return ws.lastEventAt;
+      return acc;
+    }, null);
     return {
-      ...base,
-      state: "needs_attention",
-      version: null,
-      detail: "Connected, but the `claude` CLI isn\u2019t on your PATH. Install it (`npm i -g @anthropic-ai/claude-code`) and sign in, or disconnect it.",
-      enable: null
+      cabane_url: this.opts.baseUrl,
+      device_id: this.deviceId,
+      device_label: this.deviceLabel,
+      device_error: this.deviceError,
+      connected: list.some((ws) => ws.connected),
+      workspaces: list.map((ws) => ({
+        slug: ws.slug,
+        name: ws.name,
+        last_event_at: ws.lastEventAt,
+        dispatch_count_today: ws.dispatchCountToday,
+        connected: ws.connected,
+        auth_failed: ws.authFailed,
+        agents: [...ws.agents.values()].sort((a, b) => a.username.localeCompare(b.username)).map((a) => ({
+          agent_id: a.agentId,
+          username: a.username,
+          display_name: a.displayName,
+          mode: a.mode,
+          has_credential: a.hasCredential,
+          missing_secrets: a.missingSecrets
+        }))
+      })),
+      last_event_at_overall: lastOverall,
+      dashboard_url: this.dashboardUrl,
+      companion_version: this.opts.companionVersion,
+      instance_id: this.opts.instanceId ?? null,
+      harnesses: this.harnesses
     };
   }
-  if (signals.claudeOnPath) {
-    return {
-      ...base,
-      state: "detected_not_exposed",
-      version: signals.claudeVersion,
-      detail: "Claude Code is installed here but not connected yet. Connect it to let Cabane run Claude Code on this device.",
-      enable: "claude-code"
-    };
+  emitStatus() {
+    this.emit("status:changed", this.statusJson());
+  }
+};
+
+// src/dashboard/routes.ts
+var CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon"
+};
+function registerRoutes(app, deps) {
+  const { supervisor, hub, staticDir } = deps;
+  app.get("/", async (c) => {
+    const html = await readFile(join3(staticDir, "index.html"), "utf8");
+    return c.html(html);
+  });
+  app.get("/static/:file", async (c) => {
+    const file = c.req.param("file");
+    const safe3 = normalize(file).replace(/^(\.\.[/\\])+/, "");
+    const full = join3(staticDir, safe3);
+    if (!full.startsWith(staticDir) || !existsSync2(full)) return c.notFound();
+    const body = await readFile(full);
+    const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
+    c.header("content-type", type);
+    return c.body(body);
+  });
+  app.get("/api/status", (c) => c.json(hub.statusJson()));
+  app.get("/api/dispatches", (c) => {
+    const limit = clampLimit(c.req.query("limit"), 20);
+    return c.json({ dispatches: hub.recentDispatches(limit).map(dispatchToWire) });
+  });
+  app.get("/api/logs", async (c) => {
+    const lines = clampLimit(c.req.query("lines"), 200, 1e3);
+    return c.json({ lines: tailFile(companionLogPath(), lines) });
+  });
+  app.post("/api/settings", async (c) => {
+    const body = await readJson(c);
+    const patch = {};
+    if (body.logLevel === "warn" || body.logLevel === "info" || body.logLevel === "debug") {
+      patch.logLevel = body.logLevel;
+    }
+    if (typeof body.autoOpen === "boolean") patch.autoOpen = body.autoOpen;
+    supervisor.applySettings(patch);
+    return c.json({ ok: true, status: hub.statusJson() });
+  });
+  app.post("/api/control", async (c) => {
+    const body = await readJson(c);
+    const action = body.action;
+    if (action === "stop") {
+      setTimeout(() => void supervisor.requestStop(), 50);
+      return c.json({ ok: true, action: "stop" });
+    }
+    if (action === "restart") {
+      setTimeout(() => supervisor.requestRestart(), 50);
+      return c.json({ ok: true, action: "restart" });
+    }
+    if (action === "reload-config") {
+      supervisor.reloadConfig();
+      return c.json({ ok: true, action: "reload-config" });
+    }
+    if (action === "refresh") {
+      supervisor.refresh();
+      return c.json({ ok: true, action: "refresh" });
+    }
+    return c.json({ error: `unknown action "${String(action)}"` }, 400);
+  });
+  app.post("/api/harnesses/recheck", async (c) => {
+    await supervisor.recheckHarnesses();
+    return c.json({ ok: true, status: hub.statusJson() });
+  });
+  app.post("/api/harnesses/enable", async (c) => {
+    const body = await readJson(c);
+    const runtime = body.runtime;
+    if (runtime === "claude-code") {
+      const result = await supervisor.enableHarness({ runtime: "claude-code" });
+      if (!result.ok) {
+        const error = result.presence ? `${result.error} ${DASHBOARD_PRESENCE_ACTION}` : result.error;
+        return c.json({ error }, 400);
+      }
+      return c.json({ ok: true, status: hub.statusJson() });
+    }
+    if (runtime === "codex") {
+      const result = await supervisor.enableHarness({ runtime: "codex" });
+      if (!result.ok) {
+        const error = result.presence ? `${result.error} ${DASHBOARD_PRESENCE_ACTION}` : result.error;
+        return c.json({ error }, 400);
+      }
+      return c.json({ ok: true, status: hub.statusJson() });
+    }
+    if (runtime === "opencode") {
+      if (typeof body.serverUrl !== "string" || body.serverUrl.trim() === "") {
+        return c.json({ error: "An opencode server URL is required." }, 400);
+      }
+      const result = await supervisor.enableHarness({
+        runtime: "opencode",
+        serverUrl: body.serverUrl
+      });
+      if (!result.ok) return c.json({ error: result.error }, 400);
+      return c.json({ ok: true, status: hub.statusJson() });
+    }
+    return c.json({ error: `can't enable "${String(runtime)}" from the app` }, 400);
+  });
+  app.get(
+    "/api/events",
+    (c) => streamSSE(c, async (stream) => {
+      await stream.writeSSE({ event: "status:changed", data: JSON.stringify(hub.statusJson()) });
+      const queue = [];
+      let wake = null;
+      const unsubscribe = hub.on((ev) => {
+        queue.push(ev);
+        wake?.();
+      });
+      stream.onAbort(() => {
+        unsubscribe();
+        wake?.();
+      });
+      while (!stream.aborted) {
+        if (queue.length === 0) {
+          await Promise.race([
+            new Promise((resolve) => {
+              wake = resolve;
+            }),
+            stream.sleep(25e3)
+          ]);
+          wake = null;
+        }
+        if (stream.aborted) break;
+        if (queue.length === 0) {
+          await stream.writeSSE({ event: "ping", data: "" });
+          continue;
+        }
+        const ev = queue.shift();
+        await stream.writeSSE({ event: ev.type, data: JSON.stringify(ev.data) });
+      }
+      unsubscribe();
+    })
+  );
+}
+async function readJson(c) {
+  try {
+    const parsed = await c.req.json();
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function clampLimit(raw, fallback, max = 200) {
+  if (!raw) return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return fallback;
+  return Math.min(Math.floor(n), max);
+}
+function tailFile(path, lines) {
+  if (!existsSync2(path)) return [];
+  const MAX_BYTES = 256 * 1024;
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const size = fstatSync(fd).size;
+    const start = Math.max(0, size - MAX_BYTES);
+    const len = size - start;
+    if (len <= 0) return [];
+    const buf = Buffer.alloc(len);
+    readSync(fd, buf, 0, len, start);
+    const text = buf.toString("utf8");
+    const all = text.split("\n");
+    if (start > 0 && all.length > 0) all.shift();
+    return all.filter((l) => l.length > 0).slice(-lines);
+  } catch {
+    return [];
+  } finally {
+    if (fd !== void 0) closeSync(fd);
   }
-  return {
-    ...base,
-    state: "not_detected",
-    version: null,
-    detail: "Not detected. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in with `claude`, then connect it here.",
-    enable: null
-  };
 }
-function deriveCodex(signals, manifestHas) {
-  const base = { runtime: "codex", label: LABELS.codex };
-  if (manifestHas) {
-    if (signals.codexOnPath) {
-      return {
-        ...base,
-        state: "exposed",
-        version: signals.codexVersion,
-        detail: "Codex is enabled and exposed to Cabane.",
-        enable: null
-      };
+
+// src/dashboard/server.ts
+var DEFAULT_PORT = 7474;
+var PORT_FALLBACK_SPAN = 10;
+function buildDashboardApp(deps) {
+  const app = new Hono();
+  app.onError((err, c) => {
+    if (err instanceof ApiError) {
+      const status = err.status >= 400 && err.status < 600 ? err.status : 502;
+      return c.json({ error: err.message }, status);
     }
-    return {
-      ...base,
-      state: "needs_attention",
-      version: null,
-      detail: "Enabled, but the `codex` CLI isn\u2019t on your PATH. Install it and sign in (`codex login`), or turn Codex off.",
-      enable: null
-    };
-  }
-  if (signals.codexOnPath) {
-    return {
-      ...base,
-      state: "detected_not_exposed",
-      version: signals.codexVersion,
-      detail: "Codex is installed but not exposed yet. Turn it on to let Cabane run Codex here.",
-      enable: "codex"
-    };
-  }
-  return {
-    ...base,
-    state: "not_detected",
-    version: null,
-    detail: "Not detected. Install the Codex CLI and sign in (`codex login`), then enable it here.",
-    enable: null
-  };
+    if (err instanceof CompanionError) {
+      return c.json({ error: err.message }, 400);
+    }
+    return c.json({ error: err instanceof Error ? err.message : "internal error" }, 500);
+  });
+  registerRoutes(app, { ...deps, staticDir: resolveStaticDir() });
+  return app;
 }
-function deriveOpencode(signals, manifestHas) {
-  const base = { runtime: "opencode", label: LABELS.opencode };
-  if (manifestHas) {
-    if (signals.opencodeReachable) {
+async function startDashboard(opts) {
+  const app = buildDashboardApp({ supervisor: opts.supervisor, hub: opts.hub });
+  const preferred = opts.port ?? DEFAULT_PORT;
+  let lastErr;
+  for (let port = preferred; port < preferred + PORT_FALLBACK_SPAN; port++) {
+    try {
+      const server = await listen(app, port);
+      const url = `http://127.0.0.1:${port}`;
       return {
-        ...base,
-        state: "exposed",
-        version: signals.opencodeVersion,
-        detail: "An opencode server is reachable and exposed to Cabane.",
-        enable: null
+        url,
+        port,
+        close: () => new Promise((resolve) => {
+          server.close(() => resolve());
+          server.closeAllConnections?.();
+        })
       };
+    } catch (err) {
+      if (isAddrInUse(err)) {
+        lastErr = err;
+        continue;
+      }
+      throw err;
     }
-    return {
-      ...base,
-      state: "needs_attention",
-      version: null,
-      detail: "Configured, but the opencode server isn\u2019t answering. Start `opencode serve` and check the URL.",
-      enable: null
-    };
-  }
-  if (signals.opencodeReachable && signals.opencodeDetectedUrl) {
-    return {
-      ...base,
-      state: "detected_not_exposed",
-      version: signals.opencodeVersion,
-      detail: signals.opencodeDetectedUrl,
-      enable: "opencode"
-    };
   }
-  return {
-    ...base,
-    state: "not_detected",
-    version: null,
-    detail: "Not detected. Run `opencode serve` and add its URL here to expose opencode.",
-    enable: "opencode"
-  };
-}
-var PROBE_TIMEOUT_MS = 4e3;
-var DEFAULT_OPENCODE_PROBE_TIMEOUT_MS = 1e3;
-function probeDefaultOpencodeVersion(probeOpencode = (url) => probeOpencodeVersion(url)) {
-  return withTimeout(
-    probeOpencode(DEFAULT_OPENCODE_SERVER_URL),
-    null,
-    DEFAULT_OPENCODE_PROBE_TIMEOUT_MS
+  throw new CompanionError(
+    `couldn't bind the dashboard to any port in ${preferred}\u2013${preferred + PORT_FALLBACK_SPAN - 1} (all in use). Free one up or pass --port. (last error: ${lastErr instanceof Error ? lastErr.message : String(lastErr)})`
   );
 }
-async function resolveOpencodeServerUrl(configuredServerUrl, requestedServerUrl, probeDefault = probeDefaultOpencodeVersion) {
-  const requested = requestedServerUrl?.trim();
-  if (requested) return requested;
-  if (configuredServerUrl) return configuredServerUrl;
-  return await probeDefault() !== null ? DEFAULT_OPENCODE_SERVER_URL : null;
-}
-async function probeHarnessSignals(cfg, deps = {}) {
-  const probeClaudePresence = deps.probeClaudePresence ?? claudeOnPath;
-  const probeClaudeVersion = deps.probeClaudeVersion ?? (() => probeCliVersion("claude"));
-  const probeCodexVersion = deps.probeCodexVersion ?? (() => probeCliVersion("codex"));
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
-  const configuredServerUrl = cfg.opencode?.serverUrl;
-  const opencodeProbeUrl = configuredServerUrl ?? DEFAULT_OPENCODE_SERVER_URL;
-  const [claudeOnPathResult, claudeVersion, codexVersion, opencodeVersion] = await Promise.all([
-    withTimeout(probeClaudePresence(), false),
-    withTimeout(probeClaudeVersion(), null),
-    withTimeout(probeCodexVersion(), null),
-    configuredServerUrl ? withTimeout(probeOpencode(opencodeProbeUrl), null) : probeDefaultOpencodeVersion(probeOpencode)
-  ]);
-  return {
-    claudeOnPath: claudeOnPathResult,
-    claudeVersion,
-    // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
-    // the manifest gate and the probe above is only a suggestion.
-    claudeCodeConnected: isClaudeCodeConnected(cfg),
-    // A parseable `codex --version` is our presence signal (presence alone never
-    // exposes codex; its config flag is the manifest gate either way).
-    codexOnPath: codexVersion !== null,
-    codexVersion,
-    codexEnabled: isCodexEnabled(cfg),
-    opencodeConfigured: !!configuredServerUrl,
-    // A version came back ⟺ the serve answered its health endpoint (CT584).
-    opencodeReachable: opencodeVersion !== null,
-    opencodeVersion,
-    opencodeDetectedUrl: opencodeVersion !== null ? opencodeProbeUrl : null
-  };
-}
-function withTimeout(promise, fallback, timeoutMs = PROBE_TIMEOUT_MS) {
-  return new Promise((resolve) => {
+function listen(app, port) {
+  return new Promise((resolve, reject) => {
     let settled = false;
-    const done = (v) => {
+    const server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port }, () => {
       if (!settled) {
         settled = true;
-        resolve(v);
+        resolve(server);
       }
-    };
-    const timer = setTimeout(() => done(fallback), timeoutMs);
-    timer.unref?.();
-    promise.then(
-      (v) => {
-        clearTimeout(timer);
-        done(v);
-      },
-      () => {
-        clearTimeout(timer);
-        done(fallback);
+    });
+    server.on("error", (err) => {
+      if (!settled) {
+        settled = true;
+        reject(err);
+      }
+    });
+  });
+}
+function isAddrInUse(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
+}
+function resolveStaticDir() {
+  return join4(dirname3(fileURLToPath(import.meta.url)), "static");
+}
+
+// src/control-socket.ts
+import { createHash } from "crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync3, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
+import { createServer, connect } from "net";
+import { join as join5 } from "path";
+var CONTROL_TIMEOUT_MS = 1e3;
+var MAX_UNIX_SOCKET_PATH_BYTES = 103;
+function controlSocketPath() {
+  const dir2 = cabaneDir();
+  const key = createHash("sha256").update(dir2).digest("hex").slice(0, 16);
+  if (process.platform === "win32") {
+    return `\\\\.\\pipe\\cabane-companion-${key}`;
+  }
+  const besideRuntime = join5(dir2, "companion.sock");
+  if (Buffer.byteLength(besideRuntime) <= MAX_UNIX_SOCKET_PATH_BYTES) return besideRuntime;
+  const filename = `cabane-companion-${key}.sock`;
+  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync3(process.env.XDG_RUNTIME_DIR) ? join5(process.env.XDG_RUNTIME_DIR, filename) : null;
+  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join5("/tmp", filename);
+}
+async function startControlServer(handlers) {
+  const path = controlSocketPath();
+  mkdirSync3(cabaneDir(), { recursive: true });
+  if (process.platform !== "win32" && existsSync3(path)) {
+    const alive = await ping(path);
+    if (alive) throw new Error(`another companion is already listening on ${path}`);
+    rmSync2(path, { force: true });
+  }
+  const server = createServer((socket) => {
+    void serveConnection(socket, handlers);
+  });
+  server.unref();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(path, () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  if (process.platform !== "win32") {
+    try {
+      chmodSync2(path, 384);
+    } catch (err) {
+      await new Promise((resolve) => server.close(() => resolve()));
+      try {
+        rmSync2(path, { force: true });
+      } catch {
       }
-    );
+      throw err;
+    }
+  }
+  server.on("error", () => {
   });
+  return {
+    path,
+    close: () => new Promise((resolve) => {
+      server.close(() => {
+        if (process.platform !== "win32") rmSync2(path, { force: true });
+        resolve();
+      });
+    })
+  };
 }
-
-// src/harness-check.ts
-var CHECK_TIMEOUT_MS = 4e3;
-async function shakeOutHarness(runtime, cfg, deps = {}) {
-  const run = deps.run ?? runBounded;
-  const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
+async function serveConnection(socket, handlers) {
+  socket.on("error", () => socket.destroy());
+  const line = await readLine(socket, CONTROL_TIMEOUT_MS * 5);
+  if (line === null) {
+    socket.destroy();
+    return;
+  }
+  let req;
   try {
-    if (runtime === "opencode") {
-      const url = cfg.opencode?.serverUrl;
-      if (!url) return "absent";
-      return await probeOpencode(url) !== null ? "ok" : "failed";
+    req = JSON.parse(line);
+  } catch {
+    reply(socket, { error: "malformed request" });
+    return;
+  }
+  try {
+    if (req.cmd === "status") {
+      reply(socket, handlers.status());
+      return;
     }
-    const { auth, presence } = runtime === "codex" ? {
-      auth: ["codex", ["login", "status"]],
-      presence: ["codex", ["--version"]]
-    } : {
-      auth: ["claude", ["auth", "status"]],
-      presence: ["claude", ["--version"]]
-    };
-    const presenceRun = await run(presence[0], [...presence[1]]);
-    if (presenceRun.error === "spawn") return "absent";
-    if (presenceRun.code !== 0) return "unverified";
-    const authRun = await run(auth[0], [...auth[1]]);
-    if (authRun.code === 0) return "ok";
-    if (looksUnsupported(authRun.output)) {
-      return "unverified";
+    if (req.cmd === "connect") {
+      const result = await handlers.connect(req.runtime, req.serverUrl);
+      reply(socket, result);
+      return;
     }
-    return "failed";
-  } catch {
-    return "unverified";
+    if (req.cmd === "stop") {
+      reply(socket, { ok: true });
+      setTimeout(() => handlers.stop(), 50).unref?.();
+      return;
+    }
+    reply(socket, { error: `unknown command "${String(req.cmd)}"` });
+  } catch (err) {
+    reply(socket, { error: err instanceof Error ? err.message : String(err) });
   }
 }
-function connectedLine(runtime, verdict) {
-  if (verdict === "absent") throw new Error("an absent harness cannot be connected");
-  const label = HARNESS_LABELS[runtime];
-  if (verdict !== "failed") return `${label} connected.`;
-  return `${label} connected \u2014 ${FAILED_SUFFIX[runtime]}`;
+function reply(socket, body) {
+  try {
+    socket.end(`${JSON.stringify(body)}
+`);
+  } catch {
+    socket.destroy();
+  }
 }
-var FAILED_SUFFIX = {
-  "claude-code": "it doesn\u2019t look signed in yet. Run `claude` once and sign in, then it\u2019s ready.",
-  codex: "it doesn\u2019t look signed in yet. Run `codex login` once, then it\u2019s ready.",
-  opencode: "its server isn\u2019t answering. Start `opencode serve`, then it\u2019s ready."
-};
-function absentLine(runtime) {
-  if (runtime === "opencode") {
-    return "No opencode server is configured \u2014 run `opencode serve` and connect with `--url`.";
+async function controlRequest(path, req, timeoutMs = CONTROL_TIMEOUT_MS) {
+  const socket = connect(path);
+  try {
+    await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new ControlTimeout()), timeoutMs);
+      timer.unref?.();
+      socket.once("connect", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+      socket.once("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+    });
+    socket.write(`${JSON.stringify(req)}
+`);
+    const line = await readLine(socket, timeoutMs);
+    if (line === null) throw new ControlTimeout();
+    return JSON.parse(line);
+  } finally {
+    socket.destroy();
   }
-  const label = HARNESS_LABELS[runtime];
-  const login = runtime === "codex" ? "`codex login`" : "`claude`";
-  return `${label} isn\u2019t installed on this machine \u2014 install it and sign in (${login}), then run this again.`;
 }
-function looksUnsupported(output) {
-  return /unrecognized|unknown (sub)?command|unexpected argument|invalid (sub)?command|no such (sub)?command|usage:|did you mean/i.test(
-    output
-  );
+var ControlTimeout = class extends Error {
+  constructor() {
+    super("the companion did not answer its control socket in time");
+    this.name = "ControlTimeout";
+  }
+};
+function isNotListening(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ECONNREFUSED";
 }
-function runBounded(command, args) {
+function readLine(socket, timeoutMs) {
   return new Promise((resolve) => {
+    let buf = "";
     let settled = false;
-    const done = (result) => {
+    const done = (v) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve(result);
-    };
-    let child;
-    try {
-      child = spawn4(command, args, { stdio: ["ignore", "pipe", "pipe"] });
-    } catch {
-      resolve({ code: null, output: "", error: "spawn" });
-      return;
-    }
-    let out = "";
-    const capture = (chunk) => {
-      if (out.length < 4096) out += chunk.toString();
+      socket.removeListener("data", onData);
+      resolve(v);
     };
-    child.stdout?.on("data", capture);
-    child.stderr?.on("data", capture);
-    const timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      done({ code: null, output: out, error: "timeout" });
-    }, CHECK_TIMEOUT_MS);
+    const timer = setTimeout(() => done(null), timeoutMs);
     timer.unref?.();
-    child.once("error", () => done({ code: null, output: out, error: "spawn" }));
-    child.once("exit", (code) => done({ code, output: out }));
+    const onData = (chunk) => {
+      buf += chunk.toString("utf8");
+      const nl = buf.indexOf("\n");
+      if (nl >= 0) done(buf.slice(0, nl));
+      else if (buf.length > 1e6) done(null);
+    };
+    socket.on("data", onData);
+    socket.once("close", () => done(null));
+    socket.once("error", () => done(null));
   });
 }
+async function ping(path) {
+  try {
+    await controlRequest(path, { cmd: "status" });
+    return true;
+  } catch (err) {
+    return !isNotListening(err);
+  }
+}
+
+// src/prereqs.ts
+async function claudeOnPath() {
+  return (await probeHarnessPresence("claude-code")).status === "present";
+}
+async function codexOnPath() {
+  return (await probeHarnessPresence("codex")).status === "present";
+}
+async function requireStartConfig(deps = {}) {
+  const requireCfg = deps.requireCfg ?? requireConfig;
+  const probeClaude = deps.probeClaude ?? claudeOnPath;
+  const save2 = deps.save ?? saveConfig;
+  const cfg = requireCfg();
+  const claudeOnPathResult = await probeClaude();
+  const migrated = migrateConnectedHarnesses(cfg, claudeOnPathResult);
+  if (!migrated) return { cfg, claudeOnPath: claudeOnPathResult };
+  save2(migrated);
+  deps.onMigrated?.(migrated, claudeOnPathResult);
+  return { cfg: migrated, claudeOnPath: claudeOnPathResult };
+}
+async function warnAboutHarnessReadiness(cfg, deps = {}) {
+  const probeClaude = deps.probeClaude ?? claudeOnPath;
+  const probeCodex = deps.probeCodex ?? codexOnPath;
+  const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
+`));
+  const connected = [
+    ...isClaudeCodeConnected(cfg) ? ["Claude Code"] : [],
+    ...isCodexEnabled(cfg) ? ["Codex"] : [],
+    ...cfg.opencode ? ["opencode"] : []
+  ];
+  if (connected.length > 0) {
+    if (isClaudeCodeConnected(cfg) && !await probeClaude()) {
+      warn(
+        "warning: Claude Code is connected on this device but `claude` isn\u2019t on your PATH, so it advertises nothing and a Claude-model agent won\u2019t be routed here. Install it (`npm i -g @anthropic-ai/claude-code`) and log in, or disconnect it."
+      );
+    }
+    return;
+  }
+  const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
+  const installed = [
+    ...claudeInstalled ? ["Claude Code"] : [],
+    ...codexInstalled ? ["Codex"] : []
+  ];
+  const connectCommands = [
+    ...claudeInstalled ? ["`cabane-companion connect claude-code`"] : [],
+    ...codexInstalled ? ["`cabane-companion connect codex`"] : []
+  ];
+  warn(
+    "No harness is connected on this device yet, so no agent turn can run here. " + (installed.length > 0 ? `We found ${installed.join(" and ")} on this machine \u2014 connect ${installed.length > 1 ? "one with " : "it with "}${connectCommands.join(" or ")} and turns start routing here.` : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).")
+  );
+}
 
 // src/runtime-file.ts
 import {
@@ -2159,7 +2179,7 @@ function errorMessage2(status, body) {
 
 // src/credentials.ts
 import {
-  chmodSync as chmodSync2,
+  chmodSync as chmodSync3,
   existsSync as existsSync5,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync3,
@@ -2194,14 +2214,14 @@ function save(map) {
   const path = credentialsPath();
   mkdirSync5(dirname4(path), { recursive: true });
   try {
-    chmodSync2(cabaneDir(), 448);
+    chmodSync3(cabaneDir(), 448);
   } catch {
   }
   const tmp = `${path}.${process.pid}.tmp`;
   try {
     writeFileSync3(tmp, JSON.stringify(map, null, 2) + "\n", { mode: 384 });
     try {
-      chmodSync2(tmp, 384);
+      chmodSync3(tmp, 384);
     } catch {
     }
     renameSync2(tmp, path);
@@ -6684,7 +6704,7 @@ function resolveMcpSecrets(mcpServers, store) {
 }
 
 // src/transcript-writer.ts
-import { appendFileSync, chmodSync as chmodSync3, copyFileSync, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync6 } from "fs";
+import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync6 } from "fs";
 import { basename, dirname as dirname5, join as join13 } from "path";
 function transcriptsDir() {
   return join13(cabaneDir(), "transcripts");
@@ -6701,7 +6721,7 @@ var TranscriptWriter = class {
     try {
       mkdirSync9(dir2, { recursive: true });
       try {
-        chmodSync3(dir2, 448);
+        chmodSync4(dir2, 448);
       } catch {
       }
       pruneOld(dir2, RETAIN);
@@ -6728,10 +6748,10 @@ var TranscriptWriter = class {
     try {
       const dir2 = join13(dirname5(this.path), "anomalies");
       mkdirSync9(dir2, { recursive: true, mode: 448 });
-      chmodSync3(dir2, 448);
+      chmodSync4(dir2, 448);
       const target = join13(dir2, basename(this.path));
       copyFileSync(this.path, target);
-      chmodSync3(target, 384);
+      chmodSync4(target, 384);
       pruneOld(dir2, ANOMALY_RETAIN);
     } catch (err) {
       this.fail(err);
@@ -8573,11 +8593,9 @@ var CompanionSupervisor = class {
   // can never disagree with what the manifest advertises. Null until the first
   // probe (the heartbeat then falls back to the boot `claudeCode`).
   harnessSignals = null;
-  // CT1082: the fresh PATH probe the claude-code connect vets with. Deliberately
-  // NOT the cached beat signal — someone connecting right after installing Claude
-  // Code shouldn't be refused by a snapshot up to a heartbeat old.
-  probeClaudePresence;
-  probeCodexPresence;
+  // Fresh per attempt, never the cached heartbeat signal: installing a harness
+  // between attempts must be observed immediately.
+  probePresence;
   exitFn;
   reexecFn;
   dispatcherFactory;
@@ -8609,8 +8627,7 @@ var CompanionSupervisor = class {
     this.log = opts.log;
     this.hub = opts.hub;
     this.claudeCode = opts.claudeCode ?? true;
-    this.probeClaudePresence = opts.probeClaudePresence ?? claudeOnPath;
-    this.probeCodexPresence = opts.probeCodexPresence ?? codexOnPath;
+    this.probePresence = opts.probePresence ?? probeHarnessPresence;
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
@@ -9308,10 +9325,11 @@ var CompanionSupervisor = class {
   // over SSE). Fail-soft by construction — `probeHarnessSignals` never throws — but
   // wrapped anyway so a harness refresh can never take a heartbeat down. Called on
   // the heartbeat cadence (fresh presence for the manifest + UI) and on demand.
-  async refreshHarnessStatuses() {
+  async refreshHarnessStatuses(presence = {}) {
     try {
       const signals = await probeHarnessSignals(this.config, {
-        probeClaudePresence: this.probeClaudePresence
+        probePresence: this.probePresence,
+        presence
       });
       this.harnessSignals = signals;
       this.harnessVersions = {
@@ -9368,18 +9386,24 @@ var CompanionSupervisor = class {
   // reachable/valid input).
   async enableHarness(input) {
     let next;
+    let checkedPresence = null;
     if (input.runtime === "claude-code") {
-      if (!await this.probeClaudePresence()) {
+      const presence = input.presence ?? await this.probePresence("claude-code");
+      if (presence.status !== "present") {
         return {
           ok: false,
-          error: "Couldn\u2019t find `claude` on this machine\u2019s PATH. Install Claude Code (`npm i -g @anthropic-ai/claude-code`) and sign in, then connect it."
+          error: presenceReason("claude-code", presence.status),
+          presence: true
         };
       }
+      checkedPresence = { runtime: "claude-code", result: presence };
       next = { ...this.config, claudeCode: { enabled: true } };
     } else if (input.runtime === "codex") {
-      if (!await this.probeCodexPresence()) {
-        return { ok: false, error: absentLine("codex") };
+      const presence = input.presence ?? await this.probePresence("codex");
+      if (presence.status !== "present") {
+        return { ok: false, error: presenceReason("codex", presence.status), presence: true };
       }
+      checkedPresence = { runtime: "codex", result: presence };
       next = { ...this.config, codex: { enabled: true } };
     } else {
       const serverUrl = input.serverUrl.trim();
@@ -9403,7 +9427,9 @@ var CompanionSupervisor = class {
     this.config = next;
     saveConfig(next);
     this.rebuildDispatchers();
-    await this.refreshHarnessStatuses();
+    await this.refreshHarnessStatuses(
+      checkedPresence ? { [checkedPresence.runtime]: checkedPresence.result } : {}
+    );
     this.kickHeartbeat();
     return { ok: true };
   }
@@ -9467,9 +9493,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn5 }) => {
+  void import("child_process").then(({ spawn: spawn4 }) => {
     try {
-      const child = spawn5(process.execPath, process.argv.slice(1), {
+      const child = spawn4(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -9610,7 +9636,8 @@ async function createCompanionRuntime(opts = {}) {
   if (!claim.acquired) {
     return { ok: false, reason: "already-running", existing: claim.existing ?? null };
   }
-  process.on("exit", () => clearRuntimeStateIfOurs(instanceId));
+  const clearRuntimeOnExit = () => clearRuntimeStateIfOurs(instanceId);
+  process.on("exit", clearRuntimeOnExit);
   const hub = new CompanionStateHub({
     // CT29: one device, one base URL — the cabane instance this device is paired
     // with. The dashboard's connection line shows it.
@@ -9632,49 +9659,73 @@ async function createCompanionRuntime(opts = {}) {
     const currentConfig = supervisor.currentConfig();
     const resolvedServerUrl = runtime === "opencode" ? await resolveOpencodeServerUrl(currentConfig.opencode?.serverUrl, serverUrl) : null;
     const candidate = runtime === "opencode" ? { ...currentConfig, opencode: { serverUrl: resolvedServerUrl ?? "" } } : currentConfig;
-    const verdict = await shakeOutHarness(runtime, candidate);
-    if (verdict === "absent") return { ok: false, error: absentLine(runtime) };
+    const presence = runtime === "opencode" ? void 0 : await probeHarnessPresence(runtime);
+    const verdict = await shakeOutHarness(runtime, candidate, {
+      ...presence ? { presence } : {}
+    });
+    if (verdict === "absent" || verdict === "unusable") {
+      return { ok: false, error: presenceRefusal(runtime, verdict, CLI_PRESENCE_ACTION) };
+    }
     const result = await supervisor.enableHarness(
-      runtime === "opencode" ? { runtime: "opencode", serverUrl: resolvedServerUrl ?? "" } : { runtime }
+      runtime === "opencode" ? { runtime: "opencode", serverUrl: resolvedServerUrl ?? "" } : { runtime, presence }
     );
     if (!result.ok) return { ok: false, error: result.error };
     return { ok: true, message: connectedLine(runtime, verdict) };
   };
-  const control = await startControlServer({
-    status: () => hub.statusJson(),
-    connect: async (runtime, serverUrl) => {
-      const result = await connectHarness(runtime, serverUrl);
-      return result.ok ? { ok: true, message: result.message } : { ok: false, message: result.error };
-    },
-    stop: () => void supervisor.requestStop()
-  });
+  let control = null;
   let dashboard = null;
-  if (opts.dashboard) {
-    const preferredPort = opts.port ?? cfg.dashboardPort;
-    dashboard = await startDashboard({
-      supervisor,
-      hub,
-      ...preferredPort !== void 0 ? { port: preferredPort } : {}
+  try {
+    control = await startControlServer({
+      status: () => hub.statusJson(),
+      connect: async (runtime, serverUrl) => {
+        const result = await connectHarness(runtime, serverUrl);
+        return result.ok ? { ok: true, message: result.message } : { ok: false, message: result.error };
+      },
+      stop: () => void supervisor.requestStop()
+    });
+    if (opts.dashboard) {
+      const preferredPort = opts.port ?? cfg.dashboardPort;
+      dashboard = await startDashboard({
+        supervisor,
+        hub,
+        ...preferredPort !== void 0 ? { port: preferredPort } : {}
+      });
+      hub.setDashboardUrl(dashboard.url);
+    }
+    writeRuntimeState({
+      pid: process.pid,
+      socket: control.path,
+      ...dashboard ? { url: dashboard.url, port: dashboard.port } : {},
+      startedAt,
+      // SJ495: the daemon launcher sets this env on the detached child, so the
+      // marker records whether this companion is backgrounded (foreground start
+      // leaves it unset → false).
+      daemon: process.env.CABANE_COMPANION_DAEMON === "1",
+      instanceId
+    });
+    clearCrash();
+  } catch (err) {
+    clearRuntimeStateIfOurs(instanceId);
+    process.removeListener("exit", clearRuntimeOnExit);
+    await Promise.allSettled([
+      supervisor.shutdown(),
+      ...control ? [control.close()] : [],
+      ...dashboard ? [dashboard.close()] : []
+    ]);
+    recordCrash({
+      reason: err instanceof Error ? err.message : String(err),
+      ...errorCode(err) ? { code: errorCode(err) } : {},
+      origin: "startup",
+      at: (/* @__PURE__ */ new Date()).toISOString()
     });
-    hub.setDashboardUrl(dashboard.url);
+    throw err;
   }
-  writeRuntimeState({
-    pid: process.pid,
-    socket: control.path,
-    ...dashboard ? { url: dashboard.url, port: dashboard.port } : {},
-    startedAt,
-    // SJ495: the daemon launcher sets this env on the detached child, so the
-    // marker records whether this companion is backgrounded (foreground start
-    // leaves it unset → false).
-    daemon: process.env.CABANE_COMPANION_DAEMON === "1",
-    instanceId
-  });
-  clearCrash();
   let stopped = false;
   const stop = async () => {
     if (stopped) return;
     stopped = true;
     clearRuntimeStateIfOurs(instanceId);
+    process.removeListener("exit", clearRuntimeOnExit);
     try {
       await supervisor.shutdown();
       await closeSurfaces(control, dashboard);