@cabane/companion 0.6.62 → 0.6.64

package/dist/cli.js

@@ -1735,7 +1735,7 @@ function getLogger() {
 }
 
 // src/runtime.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/dashboard/server.ts
 import { dirname as dirname4, join as join7 } from "path";
@@ -2278,6 +2278,9 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
   );
 }
 
+// src/supervisor.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
@@ -2522,12 +2525,20 @@ var CabaneApi = class {
   // `durableActiveRunWrite`). The session-id-only write (first-frame capture) is
   // left best-effort: it's lower-stakes and self-heals on the next turn, so it
   // stays a single-shot PATCH and is deliberately out of CT93's scope.
-  setActiveRun(workspaceId, conversationId, agentId, body) {
+  async setActiveRun(workspaceId, conversationId, agentId, body) {
     const path = `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/active-run`;
     const touchesFlag = Object.prototype.hasOwnProperty.call(body, "activeRunStartedAt");
-    if (touchesFlag && this.opts.outbox) {
+    const startsRun = touchesFlag && body.activeRunStartedAt !== null && body.activeRunStartedAt !== void 0;
+    if (touchesFlag && !startsRun && this.opts.outbox) {
       return this.durableActiveRunWrite(path, conversationId, agentId, body);
     }
+    if (startsRun) {
+      const res = await this.request("PATCH", path, body, {
+        retry: true
+      });
+      this.opts.outbox?.remove(activeRunOutboxKey(conversationId, agentId), ACTIVE_RUN_OUTBOX_SEQ);
+      return res;
+    }
     return this.request("PATCH", path, body);
   }
   // CT93: send-or-enqueue for an active-run flag write, with last-writer-wins
@@ -2819,7 +2830,7 @@ var CursorTracker = class {
 };
 
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
 import { join as join9 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
@@ -2859,6 +2870,7 @@ function hasCompleted(workspaceId, eventId) {
 }
 function markCompleted(workspaceId, eventId) {
   mark("completed", workspaceId, eventId);
+  forgetTurnId(workspaceId, eventId);
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
@@ -2900,6 +2912,56 @@ function bumpResumeAttempt(workspaceId, eventId) {
   );
   return next;
 }
+function turnDir() {
+  return join9(cabaneDir(), "turns");
+}
+function turnPathFor(workspaceId) {
+  return join9(turnDir(), encodeURIComponent(workspaceId));
+}
+var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function readTurnIds(workspaceId) {
+  const out = /* @__PURE__ */ new Map();
+  const path = turnPathFor(workspaceId);
+  if (!existsSync7(path)) return out;
+  try {
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const tab = trimmed.lastIndexOf("	");
+      if (tab <= 0) continue;
+      const id = trimmed.slice(0, tab);
+      const turnId = trimmed.slice(tab + 1);
+      if (id && TURN_ID_RE.test(turnId)) out.set(id, turnId);
+    }
+  } catch {
+    return out;
+  }
+  return out;
+}
+function turnIdForEvent(workspaceId, eventId) {
+  return readTurnIds(workspaceId).get(eventId) ?? null;
+}
+var TURN_ID_OVERFLOW_WARN = 8192;
+function writeTurnIds(workspaceId, turns) {
+  const entries = [...turns.entries()];
+  mkdirSync7(turnDir(), { recursive: true });
+  const path = turnPathFor(workspaceId);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync5(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
+  renameSync3(tmp, path);
+  return entries.length;
+}
+function rememberTurnId(workspaceId, eventId, turnId) {
+  const turns = readTurnIds(workspaceId);
+  if (turns.get(eventId) === turnId) return turns.size;
+  turns.set(eventId, turnId);
+  return writeTurnIds(workspaceId, turns);
+}
+function forgetTurnId(workspaceId, eventId) {
+  const turns = readTurnIds(workspaceId);
+  if (!turns.delete(eventId)) return;
+  writeTurnIds(workspaceId, turns);
+}
 function noResume() {
   return process.env.CABANE_COMPANION_NO_RESUME === "1";
 }
@@ -7173,16 +7235,32 @@ var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
 var CANCEL_WAKE_TOOL = "cancel_wake";
 var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
 function createReplyState() {
-  return { answersMessageId: null };
+  return { answersMessageId: null, order: null };
 }
 function createSendState() {
-  return { agentId: null, message: null };
+  return { agentId: null, message: null, order: null };
+}
+function createTurnControlOrder() {
+  let calls = 0;
+  return {
+    next: () => {
+      calls += 1;
+      return calls;
+    }
+  };
 }
 function createSkipState() {
   return { skipped: false, reason: null };
 }
 function createAskState() {
-  return { targetUserId: null, question: null, headline: null, options: null, questions: null };
+  return {
+    targetUserId: null,
+    question: null,
+    headline: null,
+    options: null,
+    questions: null,
+    order: null
+  };
 }
 function createWakeState() {
   return { afterSeconds: null, at: null, note: null, cancelled: false };
@@ -7212,7 +7290,7 @@ function wakeCommitField(state) {
     }
   };
 }
-function createTurnControlMcpServer(sendState, skipState, askState, subAgentCreate, wakeState, replyState) {
+function createTurnControlMcpServer(sendState, skipState, askState, subAgentCreate, wakeState, replyState, controlOrder) {
   return createSdkMcpServer({
     name: COMPANION_LOCAL_MCP_SERVER,
     version: "0.0.0",
@@ -7229,6 +7307,7 @@ function createTurnControlMcpServer(sendState, skipState, askState, subAgentCrea
         async (args) => {
           sendState.agentId = args.agentId;
           sendState.message = args.message;
+          sendState.order = controlOrder?.next() ?? null;
           return {
             content: [{ type: "text", text: JSON.stringify({ sent: args.agentId }) }]
           };
@@ -7244,6 +7323,7 @@ function createTurnControlMcpServer(sendState, skipState, askState, subAgentCrea
           },
           async (args) => {
             replyState.answersMessageId = args.messageId;
+            replyState.order = controlOrder?.next() ?? null;
             return {
               content: [
                 {
@@ -7326,6 +7406,7 @@ function createTurnControlMcpServer(sendState, skipState, askState, subAgentCrea
               };
             }
             askState.targetUserId = args.targetUserId;
+            askState.order = controlOrder?.next() ?? null;
             if (hasArray) {
               askState.questions = args.questions;
               askState.question = null;
@@ -7889,12 +7970,31 @@ var TurnCommitter = class {
   // a wordless turn has no answer to bind, and the server's mute-settle
   // notice speaks for it.
   turnControlFields(kind) {
-    return {
+    const fields = {
       ...this.answersField(kind),
       ...this.sendField(),
       ...this.askField(),
       ...this.wakeField()
     };
+    return { ...fields, ...this.orderField(fields) };
+  }
+  // CT1281: the order the control tools were CALLED, for the addressed rows the
+  // server writes from this one commit. It reports a position only for an intent
+  // that actually made it into the commit — an ask whose payload was incomplete,
+  // or a self-send the committer stripped, contributes no row and so has no place
+  // in the line. An intent with no recorded call (the runtime's auto-declared
+  // reply) is deliberately absent: the server sorts it last, which is what it is.
+  orderField(fields) {
+    const order = {};
+    const replyOrder = this.deps.replyState.order;
+    if (fields.answersMessageId !== void 0 && replyOrder !== null) order.reply = replyOrder;
+    if (fields.dispatch !== void 0 && this.deps.sendState.order !== null) {
+      order.send = this.deps.sendState.order;
+    }
+    if (fields.ask !== void 0 && this.deps.askState.order !== null) {
+      order.ask = this.deps.askState.order;
+    }
+    return Object.keys(order).length > 0 ? { turnControlOrder: order } : {};
   }
   // The declared reply: explicit `reply_to` first, else the runtime's own
   // declaration for the turn that just answers — see
@@ -8002,6 +8102,18 @@ function checkoutState(cwd) {
 function runKey(conversationId, agentId) {
   return `${conversationId}|${agentId}`;
 }
+var LEASE_REFUSALS = /* @__PURE__ */ new Set([
+  "dispatch_not_admitted",
+  "turn_already_ended",
+  "turn_belongs_elsewhere"
+]);
+function leaseRefusal(err) {
+  if (!(err instanceof ApiError)) return null;
+  const body = err.body;
+  const code = typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
+  if (code && LEASE_REFUSALS.has(code)) return code;
+  return null;
+}
 var ERROR_BODY_LOG_CAP = 2e3;
 function describeErrorBody(body) {
   if (body === void 0 || body === null) return void 0;
@@ -8036,6 +8148,16 @@ var Dispatcher = class {
   }
   opts;
   // SJ383: per-(conversation, agent) abort registry.
+  // CT1288: RunKey -> (turnId -> controller). This used to be one controller
+  // per (conversation, agent), which quietly encoded the invariant the whole
+  // task exists to enforce: that a pair can only ever have one live loop. When
+  // that assumption broke, the second `set` EVICTED the first controller and
+  // the first loop became permanently uncancellable — no other code path can
+  // reach into a running turn. So the registry that Stop depends on failed
+  // exactly when Stop was the thing you needed.
+  //
+  // Nesting by turn id costs nothing in the normal single-turn case and makes
+  // `cancel` total: it aborts every loop under the pair, not the newest one.
   aborts;
   // CT1109: pairs already told, in the conversation, that their session state is
   // being refused. The failure repeats every single turn until someone fixes the
@@ -8098,7 +8220,12 @@ var Dispatcher = class {
     this.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
     return { ok: false, durationMs, reason };
   }
-  async handle(payload) {
+  // CT1288: `opts.turnId` is a RESUMED turn id — the id this event already ran
+  // under before the companion died. Passing it makes the replay ask the
+  // mailroom to re-admit the turn it already owns, which the server explicitly
+  // supports ("a replay reports, it never re-points"). Omitted on a fresh
+  // dispatch, where minting below is correct.
+  async handle(payload, opts = {}) {
     const startedAt = Date.now();
     const dispatchId = payload.messageId;
     const workspaceId = this.opts.workspaceId;
@@ -8108,7 +8235,7 @@ var Dispatcher = class {
       agentId: payload.agentId,
       messageId: payload.messageId
     });
-    const turnId = randomUUID();
+    const turnId = opts.turnId ?? randomUUID();
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
@@ -8330,7 +8457,18 @@ ${reason}`,
     };
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
-    this.aborts.set(key, abortController);
+    let pairAborts = this.aborts.get(key);
+    if (!pairAborts) {
+      pairAborts = /* @__PURE__ */ new Map();
+      this.aborts.set(key, pairAborts);
+    }
+    pairAborts.set(turnId, abortController);
+    const releaseAbort = () => {
+      const pair2 = this.aborts.get(key);
+      if (pair2?.get(turnId) !== abortController) return;
+      pair2.delete(turnId);
+      if (pair2.size === 0) this.aborts.delete(key);
+    };
     let timeoutReason = null;
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
@@ -8343,16 +8481,28 @@ ${reason}`,
         turnId
       });
     } catch (err) {
-      turnLog.warn(
-        { err: err instanceof Error ? err.message : String(err) },
-        "dispatcher: active-run flag set failed terminally; proceeding"
+      const refusal = leaseRefusal(err);
+      releaseAbort();
+      if (refusal === "dispatch_not_admitted" || refusal === "turn_already_ended") {
+        turnLog.error(
+          { refusal, turnId },
+          "dispatcher: refused a turn lease; not running the model"
+        );
+        return this.concludeBeforeRun(payload, turnLog, startedAt, `lease_refused: ${refusal}`);
+      }
+      const reason = refusal ? `lease_refused: ${refusal}` : "lease_unconfirmed";
+      turnLog.error(
+        { refusal, turnId, err: err instanceof Error ? err.message : String(err) },
+        "dispatcher: turn lease not confirmed; not running the model"
       );
+      return this.concludeBeforeRun(payload, turnLog, startedAt, reason, reason);
     }
     const sendState = createSendState();
     const skipState = createSkipState();
     const askState = createAskState();
     const wakeState = createWakeState();
     const replyState = createReplyState();
+    const controlOrder = createTurnControlOrder();
     let spawnedSubAgent = false;
     const subAgentCreate = async (args) => {
       const dispatchTarget = args.agentId ?? payload.agentId;
@@ -8384,7 +8534,8 @@ ${reason}`,
       askState,
       subAgentCreate,
       wakeState,
-      replyState
+      replyState,
+      controlOrder
     );
     const request = buildCompanionTurnRequest({
       turnContext,
@@ -8448,6 +8599,7 @@ ${reason}`,
           "dispatcher: runtime-unavailable notice post failed"
         );
       }
+      releaseAbort();
       return this.concludeBeforeRun(
         payload,
         turnLog,
@@ -8503,11 +8655,12 @@ ${reason}`,
       signal: abortController.signal,
       log: turnLog,
       nextSeq,
-      // The committer reads this at commit to attach the addressed send onto the
-      // turn's `final` row.
+      // The committer reads this at commit to carry the addressed send on the
+      // terminal row; the server writes the send itself as a distinct message.
       sendState,
-      // CT326: likewise the ask payload — attached to the `final` row so the
-      // server creates the `asks` row atomically with the message it rides on.
+      // CT326: likewise the ask payload. CT1281: the server writes the ask as its
+      // own addressed message to the human — which ENQUEUES like any other send —
+      // and creates the `asks` row against that carrier, not against turn speech.
       askState,
       // CT442: likewise the wake payload — attached to the `final` row so the
       // server arms the wake schedule atomically with the reply it rode on.
@@ -8532,6 +8685,7 @@ ${reason}`,
         );
         if (intent.ask) {
           askState.targetUserId = intent.ask.targetUserId;
+          askState.order = intent.askOrder ?? null;
           if (intent.ask.questions && intent.ask.questions.length > 0) {
             askState.questions = intent.ask.questions;
             askState.question = null;
@@ -8560,8 +8714,12 @@ ${reason}`,
         if (intent.sendAgentId && intent.sendBody) {
           sendState.agentId = intent.sendAgentId;
           sendState.message = intent.sendBody;
+          sendState.order = intent.sendOrder ?? null;
+        }
+        if (intent.answersMessageId) {
+          replyState.answersMessageId = intent.answersMessageId;
+          replyState.order = intent.replyOrder ?? null;
         }
-        if (intent.answersMessageId) replyState.answersMessageId = intent.answersMessageId;
         if (intent.skipped) {
           skipState.skipped = true;
           skipState.reason = intent.skipReason;
@@ -8841,9 +8999,7 @@ ${reason}`,
           "dispatcher: active-run clear failed terminally; server age-sweep is the backstop"
         );
       }
-      if (this.aborts.get(key) === abortController) {
-        this.aborts.delete(key);
-      }
+      releaseAbort();
     }
     const durationMs = Date.now() - startedAt;
     const finalReplyBody = committer.replyBody;
@@ -8887,11 +9043,13 @@ ${reason}`,
   // THIS companion process. Returns true if an in-flight run was aborted.
   cancel(conversationId, agentId) {
     const key = runKey(conversationId, agentId);
-    const ac = this.aborts.get(key);
-    if (!ac) return false;
-    try {
-      ac.abort();
-    } catch {
+    const pair2 = this.aborts.get(key);
+    if (!pair2 || pair2.size === 0) return false;
+    for (const ac of [...pair2.values()]) {
+      try {
+        ac.abort();
+      } catch {
+      }
     }
     return true;
   }
@@ -8955,7 +9113,7 @@ import {
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   rmSync as rmSync7,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -8987,7 +9145,7 @@ var Outbox = class {
     const tmp = `${target}.${process.pid}.tmp`;
     try {
       writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
-      renameSync3(tmp, target);
+      renameSync4(tmp, target);
     } catch (err) {
       try {
         rmSync7(tmp, { force: true });
@@ -9788,6 +9946,19 @@ var CompanionSupervisor = class {
       type: "device:dispatch_requested",
       ...wire.payload
     };
+    if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
+      this.log.debug(
+        {
+          workspaceId: wr.workspaceId,
+          conversationId: payload.conversationId,
+          agentId: payload.agentId,
+          addressedTo: payload.deviceId
+        },
+        "companion: dispatch addressed to another device; ignoring"
+      );
+      if (ev.id) wr.cursor.settle(ev.id);
+      return;
+    }
     let agent = wr.agents.get(payload.agentId);
     if (!agent) {
       agent = await this.recoverRacedAgent(wr, payload);
@@ -9919,8 +10090,25 @@ var CompanionSupervisor = class {
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    if (ev.id) markDispatched(workspaceId, ev.id);
-    const result = await agent.dispatcher.handle(payload);
+    const resumedTurnId = ev.id ? turnIdForEvent(workspaceId, ev.id) : null;
+    const turnId = resumedTurnId ?? randomUUID2();
+    if (ev.id) {
+      const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
+      if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
+        this.log.error(
+          { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
+          "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
+        );
+      }
+      markDispatched(workspaceId, ev.id);
+    }
+    if (resumedTurnId) {
+      this.log.info(
+        { workspaceId, eventId: ev.id, turnId },
+        "companion: resuming an interrupted turn under its original id"
+      );
+    }
+    const result = await agent.dispatcher.handle(payload, { turnId });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);
@@ -10311,7 +10499,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID2();
+  const instanceId = randomUUID3();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();

package/dist/runtime.js

@@ -1,5 +1,5 @@
 // src/runtime.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/config.ts
 import {
@@ -1698,6 +1698,9 @@ async function verifyRuntime(state, requestImpl = controlRequest) {
   return body.instance_id === state.instanceId ? "ours" : "stale";
 }
 
+// src/supervisor.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
@@ -1942,12 +1945,20 @@ var CabaneApi = class {
   // `durableActiveRunWrite`). The session-id-only write (first-frame capture) is
   // left best-effort: it's lower-stakes and self-heals on the next turn, so it
   // stays a single-shot PATCH and is deliberately out of CT93's scope.
-  setActiveRun(workspaceId, conversationId, agentId, body) {
+  async setActiveRun(workspaceId, conversationId, agentId, body) {
     const path = `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/active-run`;
     const touchesFlag = Object.prototype.hasOwnProperty.call(body, "activeRunStartedAt");
-    if (touchesFlag && this.opts.outbox) {
+    const startsRun = touchesFlag && body.activeRunStartedAt !== null && body.activeRunStartedAt !== void 0;
+    if (touchesFlag && !startsRun && this.opts.outbox) {
       return this.durableActiveRunWrite(path, conversationId, agentId, body);
     }
+    if (startsRun) {
+      const res = await this.request("PATCH", path, body, {
+        retry: true
+      });
+      this.opts.outbox?.remove(activeRunOutboxKey(conversationId, agentId), ACTIVE_RUN_OUTBOX_SEQ);
+      return res;
+    }
     return this.request("PATCH", path, body);
   }
   // CT93: send-or-enqueue for an active-run flag write, with last-writer-wins
@@ -2318,7 +2329,7 @@ var CursorTracker = class {
 };
 
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
 import { join as join9 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
@@ -2358,6 +2369,7 @@ function hasCompleted(workspaceId, eventId) {
 }
 function markCompleted(workspaceId, eventId) {
   mark("completed", workspaceId, eventId);
+  forgetTurnId(workspaceId, eventId);
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
@@ -2399,6 +2411,56 @@ function bumpResumeAttempt(workspaceId, eventId) {
   );
   return next;
 }
+function turnDir() {
+  return join9(cabaneDir(), "turns");
+}
+function turnPathFor(workspaceId) {
+  return join9(turnDir(), encodeURIComponent(workspaceId));
+}
+var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function readTurnIds(workspaceId) {
+  const out = /* @__PURE__ */ new Map();
+  const path = turnPathFor(workspaceId);
+  if (!existsSync7(path)) return out;
+  try {
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const tab = trimmed.lastIndexOf("	");
+      if (tab <= 0) continue;
+      const id = trimmed.slice(0, tab);
+      const turnId = trimmed.slice(tab + 1);
+      if (id && TURN_ID_RE.test(turnId)) out.set(id, turnId);
+    }
+  } catch {
+    return out;
+  }
+  return out;
+}
+function turnIdForEvent(workspaceId, eventId) {
+  return readTurnIds(workspaceId).get(eventId) ?? null;
+}
+var TURN_ID_OVERFLOW_WARN = 8192;
+function writeTurnIds(workspaceId, turns) {
+  const entries = [...turns.entries()];
+  mkdirSync7(turnDir(), { recursive: true });
+  const path = turnPathFor(workspaceId);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync5(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
+  renameSync3(tmp, path);
+  return entries.length;
+}
+function rememberTurnId(workspaceId, eventId, turnId) {
+  const turns = readTurnIds(workspaceId);
+  if (turns.get(eventId) === turnId) return turns.size;
+  turns.set(eventId, turnId);
+  return writeTurnIds(workspaceId, turns);
+}
+function forgetTurnId(workspaceId, eventId) {
+  const turns = readTurnIds(workspaceId);
+  if (!turns.delete(eventId)) return;
+  writeTurnIds(workspaceId, turns);
+}
 function noResume() {
   return process.env.CABANE_COMPANION_NO_RESUME === "1";
 }
@@ -6672,16 +6734,32 @@ var WAKE_ME_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${WAKE_ME_TOOL}`;
 var CANCEL_WAKE_TOOL = "cancel_wake";
 var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_TOOL}`;
 function createReplyState() {
-  return { answersMessageId: null };
+  return { answersMessageId: null, order: null };
 }
 function createSendState() {
-  return { agentId: null, message: null };
+  return { agentId: null, message: null, order: null };
+}
+function createTurnControlOrder() {
+  let calls = 0;
+  return {
+    next: () => {
+      calls += 1;
+      return calls;
+    }
+  };
 }
 function createSkipState() {
   return { skipped: false, reason: null };
 }
 function createAskState() {
-  return { targetUserId: null, question: null, headline: null, options: null, questions: null };
+  return {
+    targetUserId: null,
+    question: null,
+    headline: null,
+    options: null,
+    questions: null,
+    order: null
+  };
 }
 function createWakeState() {
   return { afterSeconds: null, at: null, note: null, cancelled: false };
@@ -6711,7 +6789,7 @@ function wakeCommitField(state) {
     }
   };
 }
-function createTurnControlMcpServer(sendState, skipState, askState, subAgentCreate, wakeState, replyState) {
+function createTurnControlMcpServer(sendState, skipState, askState, subAgentCreate, wakeState, replyState, controlOrder) {
   return createSdkMcpServer({
     name: COMPANION_LOCAL_MCP_SERVER,
     version: "0.0.0",
@@ -6728,6 +6806,7 @@ function createTurnControlMcpServer(sendState, skipState, askState, subAgentCrea
         async (args) => {
           sendState.agentId = args.agentId;
           sendState.message = args.message;
+          sendState.order = controlOrder?.next() ?? null;
           return {
             content: [{ type: "text", text: JSON.stringify({ sent: args.agentId }) }]
           };
@@ -6743,6 +6822,7 @@ function createTurnControlMcpServer(sendState, skipState, askState, subAgentCrea
           },
           async (args) => {
             replyState.answersMessageId = args.messageId;
+            replyState.order = controlOrder?.next() ?? null;
             return {
               content: [
                 {
@@ -6825,6 +6905,7 @@ function createTurnControlMcpServer(sendState, skipState, askState, subAgentCrea
               };
             }
             askState.targetUserId = args.targetUserId;
+            askState.order = controlOrder?.next() ?? null;
             if (hasArray) {
               askState.questions = args.questions;
               askState.question = null;
@@ -7388,12 +7469,31 @@ var TurnCommitter = class {
   // a wordless turn has no answer to bind, and the server's mute-settle
   // notice speaks for it.
   turnControlFields(kind) {
-    return {
+    const fields = {
       ...this.answersField(kind),
       ...this.sendField(),
       ...this.askField(),
       ...this.wakeField()
     };
+    return { ...fields, ...this.orderField(fields) };
+  }
+  // CT1281: the order the control tools were CALLED, for the addressed rows the
+  // server writes from this one commit. It reports a position only for an intent
+  // that actually made it into the commit — an ask whose payload was incomplete,
+  // or a self-send the committer stripped, contributes no row and so has no place
+  // in the line. An intent with no recorded call (the runtime's auto-declared
+  // reply) is deliberately absent: the server sorts it last, which is what it is.
+  orderField(fields) {
+    const order = {};
+    const replyOrder = this.deps.replyState.order;
+    if (fields.answersMessageId !== void 0 && replyOrder !== null) order.reply = replyOrder;
+    if (fields.dispatch !== void 0 && this.deps.sendState.order !== null) {
+      order.send = this.deps.sendState.order;
+    }
+    if (fields.ask !== void 0 && this.deps.askState.order !== null) {
+      order.ask = this.deps.askState.order;
+    }
+    return Object.keys(order).length > 0 ? { turnControlOrder: order } : {};
   }
   // The declared reply: explicit `reply_to` first, else the runtime's own
   // declaration for the turn that just answers — see
@@ -7501,6 +7601,18 @@ function checkoutState(cwd) {
 function runKey(conversationId, agentId) {
   return `${conversationId}|${agentId}`;
 }
+var LEASE_REFUSALS = /* @__PURE__ */ new Set([
+  "dispatch_not_admitted",
+  "turn_already_ended",
+  "turn_belongs_elsewhere"
+]);
+function leaseRefusal(err) {
+  if (!(err instanceof ApiError)) return null;
+  const body = err.body;
+  const code = typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
+  if (code && LEASE_REFUSALS.has(code)) return code;
+  return null;
+}
 var ERROR_BODY_LOG_CAP = 2e3;
 function describeErrorBody(body) {
   if (body === void 0 || body === null) return void 0;
@@ -7535,6 +7647,16 @@ var Dispatcher = class {
   }
   opts;
   // SJ383: per-(conversation, agent) abort registry.
+  // CT1288: RunKey -> (turnId -> controller). This used to be one controller
+  // per (conversation, agent), which quietly encoded the invariant the whole
+  // task exists to enforce: that a pair can only ever have one live loop. When
+  // that assumption broke, the second `set` EVICTED the first controller and
+  // the first loop became permanently uncancellable — no other code path can
+  // reach into a running turn. So the registry that Stop depends on failed
+  // exactly when Stop was the thing you needed.
+  //
+  // Nesting by turn id costs nothing in the normal single-turn case and makes
+  // `cancel` total: it aborts every loop under the pair, not the newest one.
   aborts;
   // CT1109: pairs already told, in the conversation, that their session state is
   // being refused. The failure repeats every single turn until someone fixes the
@@ -7597,7 +7719,12 @@ var Dispatcher = class {
     this.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
     return { ok: false, durationMs, reason };
   }
-  async handle(payload) {
+  // CT1288: `opts.turnId` is a RESUMED turn id — the id this event already ran
+  // under before the companion died. Passing it makes the replay ask the
+  // mailroom to re-admit the turn it already owns, which the server explicitly
+  // supports ("a replay reports, it never re-points"). Omitted on a fresh
+  // dispatch, where minting below is correct.
+  async handle(payload, opts = {}) {
     const startedAt = Date.now();
     const dispatchId = payload.messageId;
     const workspaceId = this.opts.workspaceId;
@@ -7607,7 +7734,7 @@ var Dispatcher = class {
       agentId: payload.agentId,
       messageId: payload.messageId
     });
-    const turnId = randomUUID();
+    const turnId = opts.turnId ?? randomUUID();
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
@@ -7829,7 +7956,18 @@ ${reason}`,
     };
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
-    this.aborts.set(key, abortController);
+    let pairAborts = this.aborts.get(key);
+    if (!pairAborts) {
+      pairAborts = /* @__PURE__ */ new Map();
+      this.aborts.set(key, pairAborts);
+    }
+    pairAborts.set(turnId, abortController);
+    const releaseAbort = () => {
+      const pair = this.aborts.get(key);
+      if (pair?.get(turnId) !== abortController) return;
+      pair.delete(turnId);
+      if (pair.size === 0) this.aborts.delete(key);
+    };
     let timeoutReason = null;
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
@@ -7842,16 +7980,28 @@ ${reason}`,
         turnId
       });
     } catch (err) {
-      turnLog.warn(
-        { err: err instanceof Error ? err.message : String(err) },
-        "dispatcher: active-run flag set failed terminally; proceeding"
+      const refusal = leaseRefusal(err);
+      releaseAbort();
+      if (refusal === "dispatch_not_admitted" || refusal === "turn_already_ended") {
+        turnLog.error(
+          { refusal, turnId },
+          "dispatcher: refused a turn lease; not running the model"
+        );
+        return this.concludeBeforeRun(payload, turnLog, startedAt, `lease_refused: ${refusal}`);
+      }
+      const reason = refusal ? `lease_refused: ${refusal}` : "lease_unconfirmed";
+      turnLog.error(
+        { refusal, turnId, err: err instanceof Error ? err.message : String(err) },
+        "dispatcher: turn lease not confirmed; not running the model"
       );
+      return this.concludeBeforeRun(payload, turnLog, startedAt, reason, reason);
     }
     const sendState = createSendState();
     const skipState = createSkipState();
     const askState = createAskState();
     const wakeState = createWakeState();
     const replyState = createReplyState();
+    const controlOrder = createTurnControlOrder();
     let spawnedSubAgent = false;
     const subAgentCreate = async (args) => {
       const dispatchTarget = args.agentId ?? payload.agentId;
@@ -7883,7 +8033,8 @@ ${reason}`,
       askState,
       subAgentCreate,
       wakeState,
-      replyState
+      replyState,
+      controlOrder
     );
     const request = buildCompanionTurnRequest({
       turnContext,
@@ -7947,6 +8098,7 @@ ${reason}`,
           "dispatcher: runtime-unavailable notice post failed"
         );
       }
+      releaseAbort();
       return this.concludeBeforeRun(
         payload,
         turnLog,
@@ -8002,11 +8154,12 @@ ${reason}`,
       signal: abortController.signal,
       log: turnLog,
       nextSeq,
-      // The committer reads this at commit to attach the addressed send onto the
-      // turn's `final` row.
+      // The committer reads this at commit to carry the addressed send on the
+      // terminal row; the server writes the send itself as a distinct message.
       sendState,
-      // CT326: likewise the ask payload — attached to the `final` row so the
-      // server creates the `asks` row atomically with the message it rides on.
+      // CT326: likewise the ask payload. CT1281: the server writes the ask as its
+      // own addressed message to the human — which ENQUEUES like any other send —
+      // and creates the `asks` row against that carrier, not against turn speech.
       askState,
       // CT442: likewise the wake payload — attached to the `final` row so the
       // server arms the wake schedule atomically with the reply it rode on.
@@ -8031,6 +8184,7 @@ ${reason}`,
         );
         if (intent.ask) {
           askState.targetUserId = intent.ask.targetUserId;
+          askState.order = intent.askOrder ?? null;
           if (intent.ask.questions && intent.ask.questions.length > 0) {
             askState.questions = intent.ask.questions;
             askState.question = null;
@@ -8059,8 +8213,12 @@ ${reason}`,
         if (intent.sendAgentId && intent.sendBody) {
           sendState.agentId = intent.sendAgentId;
           sendState.message = intent.sendBody;
+          sendState.order = intent.sendOrder ?? null;
+        }
+        if (intent.answersMessageId) {
+          replyState.answersMessageId = intent.answersMessageId;
+          replyState.order = intent.replyOrder ?? null;
         }
-        if (intent.answersMessageId) replyState.answersMessageId = intent.answersMessageId;
         if (intent.skipped) {
           skipState.skipped = true;
           skipState.reason = intent.skipReason;
@@ -8340,9 +8498,7 @@ ${reason}`,
           "dispatcher: active-run clear failed terminally; server age-sweep is the backstop"
         );
       }
-      if (this.aborts.get(key) === abortController) {
-        this.aborts.delete(key);
-      }
+      releaseAbort();
     }
     const durationMs = Date.now() - startedAt;
     const finalReplyBody = committer.replyBody;
@@ -8386,11 +8542,13 @@ ${reason}`,
   // THIS companion process. Returns true if an in-flight run was aborted.
   cancel(conversationId, agentId) {
     const key = runKey(conversationId, agentId);
-    const ac = this.aborts.get(key);
-    if (!ac) return false;
-    try {
-      ac.abort();
-    } catch {
+    const pair = this.aborts.get(key);
+    if (!pair || pair.size === 0) return false;
+    for (const ac of [...pair.values()]) {
+      try {
+        ac.abort();
+      } catch {
+      }
     }
     return true;
   }
@@ -8454,7 +8612,7 @@ import {
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   rmSync as rmSync7,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -8486,7 +8644,7 @@ var Outbox = class {
     const tmp = `${target}.${process.pid}.tmp`;
     try {
       writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
-      renameSync3(tmp, target);
+      renameSync4(tmp, target);
     } catch (err) {
       try {
         rmSync7(tmp, { force: true });
@@ -9287,6 +9445,19 @@ var CompanionSupervisor = class {
       type: "device:dispatch_requested",
       ...wire.payload
     };
+    if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
+      this.log.debug(
+        {
+          workspaceId: wr.workspaceId,
+          conversationId: payload.conversationId,
+          agentId: payload.agentId,
+          addressedTo: payload.deviceId
+        },
+        "companion: dispatch addressed to another device; ignoring"
+      );
+      if (ev.id) wr.cursor.settle(ev.id);
+      return;
+    }
     let agent = wr.agents.get(payload.agentId);
     if (!agent) {
       agent = await this.recoverRacedAgent(wr, payload);
@@ -9418,8 +9589,25 @@ var CompanionSupervisor = class {
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    if (ev.id) markDispatched(workspaceId, ev.id);
-    const result = await agent.dispatcher.handle(payload);
+    const resumedTurnId = ev.id ? turnIdForEvent(workspaceId, ev.id) : null;
+    const turnId = resumedTurnId ?? randomUUID2();
+    if (ev.id) {
+      const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
+      if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
+        this.log.error(
+          { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
+          "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
+        );
+      }
+      markDispatched(workspaceId, ev.id);
+    }
+    if (resumedTurnId) {
+      this.log.info(
+        { workspaceId, eventId: ev.id, turnId },
+        "companion: resuming an interrupted turn under its original id"
+      );
+    }
+    const result = await agent.dispatcher.handle(payload, { turnId });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);
@@ -9810,7 +9998,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID2();
+  const instanceId = randomUUID3();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.62",
+  "version": "0.6.64",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",