@cabane/companion 0.6.6 → 0.6.8

package/dist/cli.js

@@ -2902,8 +2902,7 @@ var claudeCodeDialectSchema = z9.object({
       display: z9.enum(["summarized", "omitted"]).optional()
     }),
     z9.object({ type: z9.literal("disabled") })
-  ]).optional(),
-  hostAccess: z9.boolean().optional()
+  ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2981,8 +2980,7 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
+  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
@@ -4898,10 +4896,11 @@ function parseCodexModel(model) {
 var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
-function buildRunSpec2(req, resumeThreadId) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
+  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   if (model === null) {
     console.warn(
@@ -4915,19 +4914,21 @@ function buildRunSpec2(req, resumeThreadId) {
     policy: codexToolPolicy(policy),
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    input: buildInput(req),
-    config: buildConfig(req)
+    baseInstructionsFile,
+    input: buildInput(req, baseInstructionsFile !== null),
+    config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req) {
+function buildInput(req, promptRidesInstructionsFile) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
+  if (promptRidesInstructionsFile) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
 ${body}` : body;
 }
-function buildConfig(req) {
+function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -4985,6 +4986,10 @@ function buildConfig(req) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
+    // becomes Codex's base instructions, and Codex's own environment preamble goes
+    // with the harness prompt it belonged to.
+    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
@@ -5603,19 +5608,48 @@ function createCodexAdapter(deps = {}) {
         );
       }
       const degraded = "fresh" in decision && decision.reason !== void 0 && decision.reason !== "no_session";
-      const spec = buildRunSpec2(req, resumeThreadId);
-      const result = await transport.run(spec, signal);
-      if (signal.aborted) return;
-      yield* decodeCodexStream(result.events, {
-        signal,
-        cwd: req.local.cwd,
-        resumedThreadId: resumeThreadId,
-        degraded,
-        // CT601: Codex reports no model in-stream, so record what the thread was
-        // started with (null on the default token). Same for the reasoning effort.
-        resolvedModel: spec.model,
-        resolvedReasoningEffort: spec.modelReasoningEffort ?? null
-      });
+      let instructions = null;
+      if (!req.policy.hostFs) {
+        if (!deps.writeInstructionsFile) {
+          deps.onWarn?.(
+            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
+          );
+        } else {
+          try {
+            instructions = await deps.writeInstructionsFile(req.systemPrompt);
+          } catch (err) {
+            deps.onWarn?.(
+              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
+              { err: err instanceof Error ? err.message : String(err) }
+            );
+          }
+        }
+      }
+      try {
+        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const result = await transport.run(spec, signal);
+        if (signal.aborted) return;
+        yield* decodeCodexStream(result.events, {
+          signal,
+          cwd: req.local.cwd,
+          resumedThreadId: resumeThreadId,
+          degraded,
+          // CT601: Codex reports no model in-stream, so record what the thread was
+          // started with (null on the default token). Same for the reasoning effort.
+          resolvedModel: spec.model,
+          resolvedReasoningEffort: spec.modelReasoningEffort ?? null
+        });
+      } finally {
+        if (instructions) {
+          try {
+            await instructions.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
     }
   };
 }
@@ -6223,7 +6257,7 @@ var ConnectorHealthStore = class {
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync10 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/summon.ts
 import { z as z12 } from "zod";
@@ -6290,7 +6324,7 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
       ...askState ? [
         tool(
           ASK_TOOL,
-          "Ask a HUMAN a structured question (or a short LIST of them) you need answered to continue, then END your turn \u2014 don't wait for the reply. Use it when you genuinely can't proceed without a person's input (a decision only they can make, a missing fact, a go/no-go). Pass `targetUserId` (a workspace member's user id \u2014 get it from `mcp__cabane__list_members`). Two forms: a SINGLE question \u2014 a `headline` (the actual question as one clear, capitalized sentence ending in `?`, \"Do we go to prod?\") plus a short `question` body for the framing the headline can't hold \u2014 OR, when a plan ends with SEVERAL bounded decisions at once (\"three calls before I build: A? B? C?\"), a `questions` array of 1\u20135 items, each `{ headline, body?, options? }`. **Prefer the list over cramming the extra decisions into prose or dropping them** \u2014 end the turn with one ask carrying every question, never pick one and bury the rest. Each question keeps the same form rules: a one-sentence `headline`, a short `body` frame (NOT a report \u2014 your status, links, and detail go in your REPLY, and the body renders inline markdown only: links/emphasis/inline code, no bulleted lists or headings), and 2\u20134 `options` when the answer is a bounded choice \u2014 for a yes/no go-ahead always pass them, so it's one click, not a typed reply. An option can be a short button label OR a sentence that carries its own context; short/binary sets render as inline buttons, long ones stack full-width. Provide EITHER `question` (single) or `questions` (array), never both. The ask is recorded as a first-class attention item aimed at that person; your final reply carries the surrounding CONTEXT (what you found, why you're stuck), the ask carries the QUESTION(S). An open ask marks you as blocked until EVERY question is answered, so raise one only when you truly can't proceed \u2014 never ceremonially. One ask per turn (last call wins). After asking, stop \u2014 when the person replies addressed to you, the ask resolves and you resume; other people's or agents' messages may wake you but leave it open. Targets a human only; to hand work to another AGENT use summon/dispatch instead.",
+          "Ask a HUMAN a structured question (or a short LIST of them) you need answered to continue, then END your turn \u2014 don't wait for the reply. Use it when you genuinely can't proceed without a person's input (a decision only they can make, a missing fact). Pass `targetUserId` (a workspace member's user id \u2014 get it from `mcp__cabane__list_members`). Two forms: a SINGLE question \u2014 a `headline` (the actual question as one clear, capitalized sentence ending in `?`, \"Do we go to prod?\") plus a short `question` body for the framing the headline can't hold \u2014 OR, when a plan ends with SEVERAL bounded decisions at once, a `questions` array of 1\u20135 items, each `{ headline, body?, options? }`. **Prefer the list over cramming the extra decisions into prose or dropping them** \u2014 end the turn with one ask carrying every question, never pick one and bury the rest. Each question keeps the same form rules: a one-sentence `headline`, a short `body` frame (NOT a report \u2014 your status, links, and detail go in your REPLY, and the body renders inline markdown only: links/emphasis/inline code, no bulleted lists or headings), and 2\u20134 `options` when the answer is a bounded choice \u2014 for a yes/no go-ahead always pass them, so it's one click, not a typed reply. An option can be a short button label or a whole sentence. Provide EITHER `question` (single) or `questions` (array), never both. The ask is a first-class attention item aimed at that person; your final reply carries the surrounding CONTEXT (what you found, why you're stuck), the ask carries the QUESTION(S). An open ask marks you as blocked until EVERY question is answered, so raise one only when you truly can't proceed \u2014 never ceremonially. One ask per turn (last call wins). After asking, stop \u2014 when the person replies addressed to you, the ask resolves and you resume; other people's or agents' messages may wake you but leave it open. Targets a human only; to hand work to another AGENT use summon/dispatch instead.",
           {
             targetUserId: z12.string().uuid().describe("The workspace member (human) to ask \u2014 a user id from `list_members`."),
             question: z12.string().min(1).max(400).optional().describe(
@@ -6397,7 +6431,7 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
       ...wakeState ? [
         tool(
           WAKE_ME_TOOL,
-          'Wake yourself later \u2014 end this turn now and be re-dispatched at a time you pick, with a note you write to yourself. Use it for "wait until X": when the thing you need hasn\'t happened yet (a conversation isn\'t done, a PR isn\'t merged, a human hasn\'t answered), arm a wake, end your turn, and you\'re woken later to CHECK \u2014 read the workspace, and either act or re-arm. This is the loop behind "check back in five minutes", "keep checking until {condition}", and a scheduled re-try ("re-send once that agent\'s limit resets"). Ground the delay before you arm it. Almost every wake is short \u2014 seconds to a couple of hours \u2014 waiting on a condition you can name: a session limit resetting, a PR merging, a deploy landing, a throttled dispatch to re-send. Reach past a few hours only when (a) a human asked for that timing, or (b) the wait is pinned to a real external event you can name \u2014 a report that only runs Mondays, a scheduled appointment, a known reset time. A speculative far-future check-in you invented yourself \u2014 "in two weeks I\'ll see whether this feature is used" \u2014 is the one thing not to arm: if no one asked and you can\'t name both what clears the wait and why it takes that long, don\'t arm it \u2014 finish now, or raise an `ask`. Pass EXACTLY ONE of `afterSeconds` (a relative delay \u2014 `300` for five minutes) or `at` (an absolute ISO-8601 timestamp WITH a zone, e.g. `2026-07-16T09:00:00-07:00` \u2014 YOU compute it from a phrase like "tomorrow morning"; the system never parses natural-language time). `note` is a message to your future self \u2014 it becomes the body of the wake message that re-dispatches you, so write the condition to re-check ("check whether CT441 merged yet"). The wake is armed when your turn SETTLES, not now, so the delay counts from the turn ending; one wake per turn (last call wins). This is the sanctioned way to schedule your own continuation \u2014 the ONLY one; never reach for a host cron/scheduler. Guardrails: at least 60s out, at most 14 days; widen the interval as a loop ages (5m \u2192 15m \u2192 1h\u2026) rather than hammering; after many consecutive re-arms with no other activity you\'ll be steered to raise an `ask` to the human instead. If a wake can\'t be armed you\'re re-dispatched with a note explaining why \u2014 never a silent drop.',
+          "Wake yourself later \u2014 end this turn now and be re-dispatched at a time you pick, with a note you write to yourself. Use it for \"wait until X\": when the thing you need hasn't happened yet (a PR isn't merged, a human hasn't answered), arm a wake, end your turn, and you're woken later to CHECK \u2014 read the workspace, and either act or re-arm. Ground the delay before you arm it. Almost every wake is short \u2014 seconds to a couple of hours \u2014 waiting on a condition you can name: a session limit resetting, a PR merging. Reach past a few hours only when (a) a human asked for that timing, or (b) the wait is pinned to a real external event you can name \u2014 a report that only runs Mondays, a known reset time. A speculative far-future check-in you invented yourself is the one thing not to arm: if no one asked and you can't name both what clears the wait and why it takes that long, don't arm it \u2014 finish now, or raise an `ask`. Pass EXACTLY ONE of `afterSeconds` (a relative delay \u2014 `300` for five minutes) or `at` (an absolute ISO-8601 timestamp WITH a zone, e.g. `2026-07-16T09:00:00-07:00` \u2014 YOU compute it from a phrase like \"tomorrow morning\"; the system never parses natural-language time). `note` is a message to your future self \u2014 it becomes the body of the wake message that re-dispatches you, so write the condition to re-check (\"check whether CT441 merged yet\"). The wake is armed when your turn SETTLES, not now, so the delay counts from the turn ending; one wake per turn (last call wins). This is the sanctioned way to schedule your own continuation \u2014 the ONLY one; never reach for a host cron/scheduler. Guardrails: at least 60s out, at most 14 days; widen the interval as a loop ages (5m \u2192 15m \u2192 1h\u2026) rather than hammering; after many consecutive re-arms with no other activity you'll be steered to raise an `ask` to the human instead. If a wake can't be armed you're re-dispatched with a note explaining why \u2014 never a silent drop.",
           {
             afterSeconds: z12.number().int().positive().optional().describe(
               "Relative delay in seconds from when this turn ends (e.g. 300 = five minutes). Provide EITHER this or `at`, not both. Floor 60s, horizon 14 days \u2014 enforced server-side."
@@ -6502,17 +6536,34 @@ function trimSlash3(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
 
+// src/codex-instructions.ts
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+var PREFIX = "cabane-codex-instructions-";
+async function writeCodexInstructionsFile(contents) {
+  const dir2 = await mkdtemp(join9(tmpdir(), PREFIX));
+  const path3 = join9(dir2, "instructions.md");
+  await writeFile(path3, contents, { encoding: "utf8", mode: 384 });
+  return {
+    path: path3,
+    cleanup: async () => {
+      await rm(dir2, { recursive: true, force: true });
+    }
+  };
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function dirFor(workspaceId) {
-  return join9(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join10(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join10(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join10(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path3 = pathFor3(workspaceId, conversationId, agentId);
@@ -6541,11 +6592,11 @@ function writePrepared(workspaceId, conversationId, agentId, result) {
 
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join11(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
@@ -6632,9 +6683,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync3, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function transcriptsDir() {
-  return join11(cabaneDir(), "transcripts");
+  return join12(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var TranscriptWriter = class {
@@ -6643,7 +6694,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join11(dir2, fileName(meta));
+    this.path = join12(dir2, fileName(meta));
     try {
       mkdirSync9(dir2, { recursive: true });
       try {
@@ -6702,7 +6753,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync4(join11(dir2, f), { force: true });
+      rmSync4(join12(dir2, f), { force: true });
     } catch {
     }
   }
@@ -7247,7 +7298,7 @@ ${reason}`,
     }
     let turnEnv = hookEnv;
     if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
       try {
         mkdirSync10(tmpDir, { recursive: true });
         turnEnv = { ...hookEnv, TMPDIR: tmpDir };
@@ -7346,7 +7397,13 @@ ${reason}`,
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
     if (this.opts.codexEnabled) {
-      adapters.push(createCodexAdapter({ enabled: true, onWarn }));
+      adapters.push(
+        createCodexAdapter({
+          enabled: true,
+          onWarn,
+          writeInstructionsFile: writeCodexInstructionsFile
+        })
+      );
     }
     const registry = createAdapterRegistry(adapters);
     let adapter;
@@ -7389,10 +7446,10 @@ ${reason}`,
       );
       if (effectiveCwd) {
         try {
-          const diagnosticDir = join12(effectiveCwd, ".git", "cabane");
+          const diagnosticDir = join13(effectiveCwd, ".git", "cabane");
           mkdirSync10(diagnosticDir, { recursive: true });
           appendFileSync2(
-            join12(diagnosticDir, "readiness.jsonl"),
+            join13(diagnosticDir, "readiness.jsonl"),
             `${JSON.stringify({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               taskId: hookEnv.CABANE_TASK_ID,
@@ -7976,7 +8033,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -7989,10 +8046,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join13(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join14(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join13(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join14(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -8034,7 +8091,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join13(dir2, name);
+      const full = join14(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -9141,9 +9198,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function crashMarkerPath() {
-  return join14(cabaneDir(), "last-error.json");
+  return join15(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
@@ -9497,7 +9554,7 @@ function isAlive(kill, pid) {
 
 // src/commands/transcript.ts
 import { existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync4 } from "fs";
-import { isAbsolute, join as join15 } from "path";
+import { isAbsolute, join as join16 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -9514,7 +9571,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join15(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join16(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -9597,7 +9654,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync10(join15(dir2, f), "utf8"),
+    read: (f) => readFileSync10(join16(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -9637,7 +9694,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join15(dir2, f));
+    const { meta, outcome } = peek(join16(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -9674,10 +9731,10 @@ function resolveTarget(dir2, target) {
     if (existsSync12(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join15(dir2, target);
+  const exact = join16(dir2, target);
   if (existsSync12(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join15(dir2, matches[0]);
+  if (matches.length === 1) return join16(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`cabane-companion transcript\` to list them.`

package/dist/runtime.js

@@ -2555,8 +2555,7 @@ var claudeCodeDialectSchema = z9.object({
       display: z9.enum(["summarized", "omitted"]).optional()
     }),
     z9.object({ type: z9.literal("disabled") })
-  ]).optional(),
-  hostAccess: z9.boolean().optional()
+  ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2634,8 +2633,7 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
+  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
@@ -4551,10 +4549,11 @@ function parseCodexModel(model) {
 var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
-function buildRunSpec2(req, resumeThreadId) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
+  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   if (model === null) {
     console.warn(
@@ -4568,19 +4567,21 @@ function buildRunSpec2(req, resumeThreadId) {
     policy: codexToolPolicy(policy),
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    input: buildInput(req),
-    config: buildConfig(req)
+    baseInstructionsFile,
+    input: buildInput(req, baseInstructionsFile !== null),
+    config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req) {
+function buildInput(req, promptRidesInstructionsFile) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
+  if (promptRidesInstructionsFile) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
 ${body}` : body;
 }
-function buildConfig(req) {
+function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -4638,6 +4639,10 @@ function buildConfig(req) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
+    // becomes Codex's base instructions, and Codex's own environment preamble goes
+    // with the harness prompt it belonged to.
+    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
@@ -5256,19 +5261,48 @@ function createCodexAdapter(deps = {}) {
         );
       }
       const degraded = "fresh" in decision && decision.reason !== void 0 && decision.reason !== "no_session";
-      const spec = buildRunSpec2(req, resumeThreadId);
-      const result = await transport.run(spec, signal);
-      if (signal.aborted) return;
-      yield* decodeCodexStream(result.events, {
-        signal,
-        cwd: req.local.cwd,
-        resumedThreadId: resumeThreadId,
-        degraded,
-        // CT601: Codex reports no model in-stream, so record what the thread was
-        // started with (null on the default token). Same for the reasoning effort.
-        resolvedModel: spec.model,
-        resolvedReasoningEffort: spec.modelReasoningEffort ?? null
-      });
+      let instructions = null;
+      if (!req.policy.hostFs) {
+        if (!deps.writeInstructionsFile) {
+          deps.onWarn?.(
+            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
+          );
+        } else {
+          try {
+            instructions = await deps.writeInstructionsFile(req.systemPrompt);
+          } catch (err) {
+            deps.onWarn?.(
+              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
+              { err: err instanceof Error ? err.message : String(err) }
+            );
+          }
+        }
+      }
+      try {
+        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const result = await transport.run(spec, signal);
+        if (signal.aborted) return;
+        yield* decodeCodexStream(result.events, {
+          signal,
+          cwd: req.local.cwd,
+          resumedThreadId: resumeThreadId,
+          degraded,
+          // CT601: Codex reports no model in-stream, so record what the thread was
+          // started with (null on the default token). Same for the reasoning effort.
+          resolvedModel: spec.model,
+          resolvedReasoningEffort: spec.modelReasoningEffort ?? null
+        });
+      } finally {
+        if (instructions) {
+          try {
+            await instructions.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
     }
   };
 }
@@ -5876,7 +5910,7 @@ var ConnectorHealthStore = class {
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync9 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/summon.ts
 import { z as z12 } from "zod";
@@ -5943,7 +5977,7 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
       ...askState ? [
         tool(
           ASK_TOOL,
-          "Ask a HUMAN a structured question (or a short LIST of them) you need answered to continue, then END your turn \u2014 don't wait for the reply. Use it when you genuinely can't proceed without a person's input (a decision only they can make, a missing fact, a go/no-go). Pass `targetUserId` (a workspace member's user id \u2014 get it from `mcp__cabane__list_members`). Two forms: a SINGLE question \u2014 a `headline` (the actual question as one clear, capitalized sentence ending in `?`, \"Do we go to prod?\") plus a short `question` body for the framing the headline can't hold \u2014 OR, when a plan ends with SEVERAL bounded decisions at once (\"three calls before I build: A? B? C?\"), a `questions` array of 1\u20135 items, each `{ headline, body?, options? }`. **Prefer the list over cramming the extra decisions into prose or dropping them** \u2014 end the turn with one ask carrying every question, never pick one and bury the rest. Each question keeps the same form rules: a one-sentence `headline`, a short `body` frame (NOT a report \u2014 your status, links, and detail go in your REPLY, and the body renders inline markdown only: links/emphasis/inline code, no bulleted lists or headings), and 2\u20134 `options` when the answer is a bounded choice \u2014 for a yes/no go-ahead always pass them, so it's one click, not a typed reply. An option can be a short button label OR a sentence that carries its own context; short/binary sets render as inline buttons, long ones stack full-width. Provide EITHER `question` (single) or `questions` (array), never both. The ask is recorded as a first-class attention item aimed at that person; your final reply carries the surrounding CONTEXT (what you found, why you're stuck), the ask carries the QUESTION(S). An open ask marks you as blocked until EVERY question is answered, so raise one only when you truly can't proceed \u2014 never ceremonially. One ask per turn (last call wins). After asking, stop \u2014 when the person replies addressed to you, the ask resolves and you resume; other people's or agents' messages may wake you but leave it open. Targets a human only; to hand work to another AGENT use summon/dispatch instead.",
+          "Ask a HUMAN a structured question (or a short LIST of them) you need answered to continue, then END your turn \u2014 don't wait for the reply. Use it when you genuinely can't proceed without a person's input (a decision only they can make, a missing fact). Pass `targetUserId` (a workspace member's user id \u2014 get it from `mcp__cabane__list_members`). Two forms: a SINGLE question \u2014 a `headline` (the actual question as one clear, capitalized sentence ending in `?`, \"Do we go to prod?\") plus a short `question` body for the framing the headline can't hold \u2014 OR, when a plan ends with SEVERAL bounded decisions at once, a `questions` array of 1\u20135 items, each `{ headline, body?, options? }`. **Prefer the list over cramming the extra decisions into prose or dropping them** \u2014 end the turn with one ask carrying every question, never pick one and bury the rest. Each question keeps the same form rules: a one-sentence `headline`, a short `body` frame (NOT a report \u2014 your status, links, and detail go in your REPLY, and the body renders inline markdown only: links/emphasis/inline code, no bulleted lists or headings), and 2\u20134 `options` when the answer is a bounded choice \u2014 for a yes/no go-ahead always pass them, so it's one click, not a typed reply. An option can be a short button label or a whole sentence. Provide EITHER `question` (single) or `questions` (array), never both. The ask is a first-class attention item aimed at that person; your final reply carries the surrounding CONTEXT (what you found, why you're stuck), the ask carries the QUESTION(S). An open ask marks you as blocked until EVERY question is answered, so raise one only when you truly can't proceed \u2014 never ceremonially. One ask per turn (last call wins). After asking, stop \u2014 when the person replies addressed to you, the ask resolves and you resume; other people's or agents' messages may wake you but leave it open. Targets a human only; to hand work to another AGENT use summon/dispatch instead.",
           {
             targetUserId: z12.string().uuid().describe("The workspace member (human) to ask \u2014 a user id from `list_members`."),
             question: z12.string().min(1).max(400).optional().describe(
@@ -6050,7 +6084,7 @@ function createSummonMcpServer(summonState, skipState, askState, subAgentCreate,
       ...wakeState ? [
         tool(
           WAKE_ME_TOOL,
-          'Wake yourself later \u2014 end this turn now and be re-dispatched at a time you pick, with a note you write to yourself. Use it for "wait until X": when the thing you need hasn\'t happened yet (a conversation isn\'t done, a PR isn\'t merged, a human hasn\'t answered), arm a wake, end your turn, and you\'re woken later to CHECK \u2014 read the workspace, and either act or re-arm. This is the loop behind "check back in five minutes", "keep checking until {condition}", and a scheduled re-try ("re-send once that agent\'s limit resets"). Ground the delay before you arm it. Almost every wake is short \u2014 seconds to a couple of hours \u2014 waiting on a condition you can name: a session limit resetting, a PR merging, a deploy landing, a throttled dispatch to re-send. Reach past a few hours only when (a) a human asked for that timing, or (b) the wait is pinned to a real external event you can name \u2014 a report that only runs Mondays, a scheduled appointment, a known reset time. A speculative far-future check-in you invented yourself \u2014 "in two weeks I\'ll see whether this feature is used" \u2014 is the one thing not to arm: if no one asked and you can\'t name both what clears the wait and why it takes that long, don\'t arm it \u2014 finish now, or raise an `ask`. Pass EXACTLY ONE of `afterSeconds` (a relative delay \u2014 `300` for five minutes) or `at` (an absolute ISO-8601 timestamp WITH a zone, e.g. `2026-07-16T09:00:00-07:00` \u2014 YOU compute it from a phrase like "tomorrow morning"; the system never parses natural-language time). `note` is a message to your future self \u2014 it becomes the body of the wake message that re-dispatches you, so write the condition to re-check ("check whether CT441 merged yet"). The wake is armed when your turn SETTLES, not now, so the delay counts from the turn ending; one wake per turn (last call wins). This is the sanctioned way to schedule your own continuation \u2014 the ONLY one; never reach for a host cron/scheduler. Guardrails: at least 60s out, at most 14 days; widen the interval as a loop ages (5m \u2192 15m \u2192 1h\u2026) rather than hammering; after many consecutive re-arms with no other activity you\'ll be steered to raise an `ask` to the human instead. If a wake can\'t be armed you\'re re-dispatched with a note explaining why \u2014 never a silent drop.',
+          "Wake yourself later \u2014 end this turn now and be re-dispatched at a time you pick, with a note you write to yourself. Use it for \"wait until X\": when the thing you need hasn't happened yet (a PR isn't merged, a human hasn't answered), arm a wake, end your turn, and you're woken later to CHECK \u2014 read the workspace, and either act or re-arm. Ground the delay before you arm it. Almost every wake is short \u2014 seconds to a couple of hours \u2014 waiting on a condition you can name: a session limit resetting, a PR merging. Reach past a few hours only when (a) a human asked for that timing, or (b) the wait is pinned to a real external event you can name \u2014 a report that only runs Mondays, a known reset time. A speculative far-future check-in you invented yourself is the one thing not to arm: if no one asked and you can't name both what clears the wait and why it takes that long, don't arm it \u2014 finish now, or raise an `ask`. Pass EXACTLY ONE of `afterSeconds` (a relative delay \u2014 `300` for five minutes) or `at` (an absolute ISO-8601 timestamp WITH a zone, e.g. `2026-07-16T09:00:00-07:00` \u2014 YOU compute it from a phrase like \"tomorrow morning\"; the system never parses natural-language time). `note` is a message to your future self \u2014 it becomes the body of the wake message that re-dispatches you, so write the condition to re-check (\"check whether CT441 merged yet\"). The wake is armed when your turn SETTLES, not now, so the delay counts from the turn ending; one wake per turn (last call wins). This is the sanctioned way to schedule your own continuation \u2014 the ONLY one; never reach for a host cron/scheduler. Guardrails: at least 60s out, at most 14 days; widen the interval as a loop ages (5m \u2192 15m \u2192 1h\u2026) rather than hammering; after many consecutive re-arms with no other activity you'll be steered to raise an `ask` to the human instead. If a wake can't be armed you're re-dispatched with a note explaining why \u2014 never a silent drop.",
           {
             afterSeconds: z12.number().int().positive().optional().describe(
               "Relative delay in seconds from when this turn ends (e.g. 300 = five minutes). Provide EITHER this or `at`, not both. Floor 60s, horizon 14 days \u2014 enforced server-side."
@@ -6155,17 +6189,34 @@ function trimSlash3(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
 
+// src/codex-instructions.ts
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+var PREFIX = "cabane-codex-instructions-";
+async function writeCodexInstructionsFile(contents) {
+  const dir2 = await mkdtemp(join9(tmpdir(), PREFIX));
+  const path3 = join9(dir2, "instructions.md");
+  await writeFile(path3, contents, { encoding: "utf8", mode: 384 });
+  return {
+    path: path3,
+    cleanup: async () => {
+      await rm(dir2, { recursive: true, force: true });
+    }
+  };
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function dirFor(workspaceId) {
-  return join9(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join10(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join10(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join10(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path3 = pathFor3(workspaceId, conversationId, agentId);
@@ -6194,11 +6245,11 @@ function writePrepared(workspaceId, conversationId, agentId, result) {
 
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join11(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
@@ -6285,9 +6336,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync3, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function transcriptsDir() {
-  return join11(cabaneDir(), "transcripts");
+  return join12(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var TranscriptWriter = class {
@@ -6296,7 +6347,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join11(dir2, fileName(meta));
+    this.path = join12(dir2, fileName(meta));
     try {
       mkdirSync8(dir2, { recursive: true });
       try {
@@ -6355,7 +6406,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync4(join11(dir2, f), { force: true });
+      rmSync4(join12(dir2, f), { force: true });
     } catch {
     }
   }
@@ -6900,7 +6951,7 @@ ${reason}`,
     }
     let turnEnv = hookEnv;
     if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
       try {
         mkdirSync9(tmpDir, { recursive: true });
         turnEnv = { ...hookEnv, TMPDIR: tmpDir };
@@ -6999,7 +7050,13 @@ ${reason}`,
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
     if (this.opts.codexEnabled) {
-      adapters.push(createCodexAdapter({ enabled: true, onWarn }));
+      adapters.push(
+        createCodexAdapter({
+          enabled: true,
+          onWarn,
+          writeInstructionsFile: writeCodexInstructionsFile
+        })
+      );
     }
     const registry = createAdapterRegistry(adapters);
     let adapter;
@@ -7042,10 +7099,10 @@ ${reason}`,
       );
       if (effectiveCwd) {
         try {
-          const diagnosticDir = join12(effectiveCwd, ".git", "cabane");
+          const diagnosticDir = join13(effectiveCwd, ".git", "cabane");
           mkdirSync9(diagnosticDir, { recursive: true });
           appendFileSync2(
-            join12(diagnosticDir, "readiness.jsonl"),
+            join13(diagnosticDir, "readiness.jsonl"),
             `${JSON.stringify({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               taskId: hookEnv.CABANE_TASK_ID,
@@ -7629,7 +7686,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -7642,10 +7699,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join13(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join14(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join13(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join14(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -7687,7 +7744,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join13(dir2, name);
+      const full = join14(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -8794,9 +8851,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function crashMarkerPath() {
-  return join14(cabaneDir(), "last-error.json");
+  return join15(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",