@cabane/companion 0.6.63 → 0.6.65

package/dist/cli.js

@@ -1735,7 +1735,7 @@ function getLogger() {
 }
 
 // src/runtime.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/dashboard/server.ts
 import { dirname as dirname4, join as join7 } from "path";
@@ -2278,6 +2278,9 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
   );
 }
 
+// src/supervisor.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
@@ -2522,12 +2525,20 @@ var CabaneApi = class {
   // `durableActiveRunWrite`). The session-id-only write (first-frame capture) is
   // left best-effort: it's lower-stakes and self-heals on the next turn, so it
   // stays a single-shot PATCH and is deliberately out of CT93's scope.
-  setActiveRun(workspaceId, conversationId, agentId, body) {
+  async setActiveRun(workspaceId, conversationId, agentId, body) {
     const path = `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/active-run`;
     const touchesFlag = Object.prototype.hasOwnProperty.call(body, "activeRunStartedAt");
-    if (touchesFlag && this.opts.outbox) {
+    const startsRun = touchesFlag && body.activeRunStartedAt !== null && body.activeRunStartedAt !== void 0;
+    if (touchesFlag && !startsRun && this.opts.outbox) {
       return this.durableActiveRunWrite(path, conversationId, agentId, body);
     }
+    if (startsRun) {
+      const res = await this.request("PATCH", path, body, {
+        retry: true
+      });
+      this.opts.outbox?.remove(activeRunOutboxKey(conversationId, agentId), ACTIVE_RUN_OUTBOX_SEQ);
+      return res;
+    }
     return this.request("PATCH", path, body);
   }
   // CT93: send-or-enqueue for an active-run flag write, with last-writer-wins
@@ -2586,15 +2597,16 @@ var CabaneApi = class {
   // (transport errors + 5xx), never a 4xx, so no `(turnId, kind)` row is
   // double-posted. The caller threads its turn abort signal so a cancel
   // mid-commit aborts the in-flight POST rather than letting it land.
-  // CT11: `kind` now includes `'stopped'` for the terminal marker the
-  // dispatcher writes when a turn is cancelled — same wire shape as
-  // `progress`/`final`, distinguished only by `kind` so the chat drawer's
-  // turn-group renderer treats it as a closing row. `seq` is the companion's
-  // per-turn monotonic counter, stamped on the row so the merged timeline
-  // orders the commit deterministically against the persisted tool/thinking
-  // rows. Both fields are optional on the wire — an older companion that didn't
-  // mint seq still validates (the server defaults to 0); `stopped` is only
-  // emitted by post-CT11 companions.
+  // CT11: `kind` includes `'stopped'` for the terminal cancel marker — same
+  // wire shape as `progress`/`final`, distinguished only by `kind` so the chat
+  // drawer's turn-group renderer treats it as a closing row. CT1295: this
+  // companion no longer WRITES that kind — the server does, in the transaction
+  // that terminalizes the stopped turn — so the value survives here only as
+  // wire vocabulary the server also speaks. `seq` is the companion's per-turn
+  // monotonic counter, stamped on the row so the merged timeline orders the
+  // commit deterministically against the persisted tool/thinking rows. Both
+  // fields are optional on the wire — an older companion that didn't mint seq
+  // still validates (the server defaults to 0).
   postTurnMessage(workspaceId, conversationId, body, signal) {
     return this.durableCommit(
       "message",
@@ -2819,7 +2831,7 @@ var CursorTracker = class {
 };
 
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
 import { join as join9 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
@@ -2859,6 +2871,7 @@ function hasCompleted(workspaceId, eventId) {
 }
 function markCompleted(workspaceId, eventId) {
   mark("completed", workspaceId, eventId);
+  forgetTurnId(workspaceId, eventId);
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
@@ -2900,6 +2913,56 @@ function bumpResumeAttempt(workspaceId, eventId) {
   );
   return next;
 }
+function turnDir() {
+  return join9(cabaneDir(), "turns");
+}
+function turnPathFor(workspaceId) {
+  return join9(turnDir(), encodeURIComponent(workspaceId));
+}
+var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function readTurnIds(workspaceId) {
+  const out = /* @__PURE__ */ new Map();
+  const path = turnPathFor(workspaceId);
+  if (!existsSync7(path)) return out;
+  try {
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const tab = trimmed.lastIndexOf("	");
+      if (tab <= 0) continue;
+      const id = trimmed.slice(0, tab);
+      const turnId = trimmed.slice(tab + 1);
+      if (id && TURN_ID_RE.test(turnId)) out.set(id, turnId);
+    }
+  } catch {
+    return out;
+  }
+  return out;
+}
+function turnIdForEvent(workspaceId, eventId) {
+  return readTurnIds(workspaceId).get(eventId) ?? null;
+}
+var TURN_ID_OVERFLOW_WARN = 8192;
+function writeTurnIds(workspaceId, turns) {
+  const entries = [...turns.entries()];
+  mkdirSync7(turnDir(), { recursive: true });
+  const path = turnPathFor(workspaceId);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync5(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
+  renameSync3(tmp, path);
+  return entries.length;
+}
+function rememberTurnId(workspaceId, eventId, turnId) {
+  const turns = readTurnIds(workspaceId);
+  if (turns.get(eventId) === turnId) return turns.size;
+  turns.set(eventId, turnId);
+  return writeTurnIds(workspaceId, turns);
+}
+function forgetTurnId(workspaceId, eventId) {
+  const turns = readTurnIds(workspaceId);
+  if (!turns.delete(eventId)) return;
+  writeTurnIds(workspaceId, turns);
+}
 function noResume() {
   return process.env.CABANE_COMPANION_NO_RESUME === "1";
 }
@@ -4317,7 +4380,7 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
   {
     // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result;
     // the adapter stops before the closing reply — no final text, no `result`
-    // event. The host writes the `kind:'stopped'` marker off the signal.
+    // event. CT1295: the server writes the `kind:'stopped'` marker.
     name: "cancel mid-stream",
     request: makeRequest(),
     nativeStream: [
@@ -5438,7 +5501,7 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
   {
     // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
     // adapter stops before the closing reply — no final text, no `result` event.
-    // The host writes the `kind:'stopped'` marker off the signal.
+    // CT1295: the server writes the `kind:'stopped'` marker.
     name: "cancel mid-stream",
     request: makeRequest2(),
     nativeStream: [
@@ -6730,7 +6793,7 @@ var CODEX_CONFORMANCE_FIXTURES = [
   {
     // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
     // adapter stops before the closing reply — no final text, no `result` event.
-    // The host writes the `kind:'stopped'` marker off the signal.
+    // CT1295: the server writes the `kind:'stopped'` marker.
     name: "cancel mid-stream",
     request: makeRequest3(),
     nativeStream: [
@@ -7886,8 +7949,10 @@ var TurnCommitter = class {
   // End-of-turn progress promotion. The held-text flush is now the adapter's
   // job (it emits the closing reply as a `text` event before `result`), so this
   // only asks the pump to promote agent-authored interim text. A wordless turn
-  // stays wordless and the dispatcher closes it with a marker. Guards on the
-  // abort signal, so on cancel no `final` is forced.
+  // stays wordless and the dispatcher closes it with a `silent`/`skipped`
+  // marker (CT1295: a CANCELLED turn is closed by the SERVER's `stopped`
+  // marker, not from this side). Guards on the abort signal, so on cancel no
+  // `final` is forced.
   async finalize(okResult) {
     await this.pump.finalize(okResult);
   }
@@ -8005,7 +8070,6 @@ var TurnCommitter = class {
 var PREPARING_TOOL_NAME = "preparing";
 var PREPARE_FAILED_PREFIX = "**Couldn't prepare your environment.** I wasn't able to provision a working directory for this conversation, so I can't run this turn. The provisioning command reported:";
 var MISSING_SECRET_PREFIX = "**Missing secret on this companion.** This agent's tools need a credential this device hasn't been given, so I can't run this turn safely. Declare it in this companion\u2019s secret store (`~/.cabane/secrets.json`) and try again. Missing:";
-var STOPPED_MARKER_BODY = "(stopped)";
 var RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
 var UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
 var SKIPPED_MARKER_BODY = "(skipped)";
@@ -8040,6 +8104,18 @@ function checkoutState(cwd) {
 function runKey(conversationId, agentId) {
   return `${conversationId}|${agentId}`;
 }
+var LEASE_REFUSALS = /* @__PURE__ */ new Set([
+  "dispatch_not_admitted",
+  "turn_already_ended",
+  "turn_belongs_elsewhere"
+]);
+function leaseRefusal(err) {
+  if (!(err instanceof ApiError)) return null;
+  const body = err.body;
+  const code = typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
+  if (code && LEASE_REFUSALS.has(code)) return code;
+  return null;
+}
 var ERROR_BODY_LOG_CAP = 2e3;
 function describeErrorBody(body) {
   if (body === void 0 || body === null) return void 0;
@@ -8074,6 +8150,16 @@ var Dispatcher = class {
   }
   opts;
   // SJ383: per-(conversation, agent) abort registry.
+  // CT1288: RunKey -> (turnId -> controller). This used to be one controller
+  // per (conversation, agent), which quietly encoded the invariant the whole
+  // task exists to enforce: that a pair can only ever have one live loop. When
+  // that assumption broke, the second `set` EVICTED the first controller and
+  // the first loop became permanently uncancellable — no other code path can
+  // reach into a running turn. So the registry that Stop depends on failed
+  // exactly when Stop was the thing you needed.
+  //
+  // Nesting by turn id costs nothing in the normal single-turn case and makes
+  // `cancel` total: it aborts every loop under the pair, not the newest one.
   aborts;
   // CT1109: pairs already told, in the conversation, that their session state is
   // being refused. The failure repeats every single turn until someone fixes the
@@ -8136,7 +8222,12 @@ var Dispatcher = class {
     this.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
     return { ok: false, durationMs, reason };
   }
-  async handle(payload) {
+  // CT1288: `opts.turnId` is a RESUMED turn id — the id this event already ran
+  // under before the companion died. Passing it makes the replay ask the
+  // mailroom to re-admit the turn it already owns, which the server explicitly
+  // supports ("a replay reports, it never re-points"). Omitted on a fresh
+  // dispatch, where minting below is correct.
+  async handle(payload, opts = {}) {
     const startedAt = Date.now();
     const dispatchId = payload.messageId;
     const workspaceId = this.opts.workspaceId;
@@ -8146,7 +8237,7 @@ var Dispatcher = class {
       agentId: payload.agentId,
       messageId: payload.messageId
     });
-    const turnId = randomUUID();
+    const turnId = opts.turnId ?? randomUUID();
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
@@ -8368,7 +8459,18 @@ ${reason}`,
     };
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
-    this.aborts.set(key, abortController);
+    let pairAborts = this.aborts.get(key);
+    if (!pairAborts) {
+      pairAborts = /* @__PURE__ */ new Map();
+      this.aborts.set(key, pairAborts);
+    }
+    pairAborts.set(turnId, abortController);
+    const releaseAbort = () => {
+      const pair2 = this.aborts.get(key);
+      if (pair2?.get(turnId) !== abortController) return;
+      pair2.delete(turnId);
+      if (pair2.size === 0) this.aborts.delete(key);
+    };
     let timeoutReason = null;
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
@@ -8381,10 +8483,21 @@ ${reason}`,
         turnId
       });
     } catch (err) {
-      turnLog.warn(
-        { err: err instanceof Error ? err.message : String(err) },
-        "dispatcher: active-run flag set failed terminally; proceeding"
+      const refusal = leaseRefusal(err);
+      releaseAbort();
+      if (refusal === "dispatch_not_admitted" || refusal === "turn_already_ended") {
+        turnLog.error(
+          { refusal, turnId },
+          "dispatcher: refused a turn lease; not running the model"
+        );
+        return this.concludeBeforeRun(payload, turnLog, startedAt, `lease_refused: ${refusal}`);
+      }
+      const reason = refusal ? `lease_refused: ${refusal}` : "lease_unconfirmed";
+      turnLog.error(
+        { refusal, turnId, err: err instanceof Error ? err.message : String(err) },
+        "dispatcher: turn lease not confirmed; not running the model"
       );
+      return this.concludeBeforeRun(payload, turnLog, startedAt, reason, reason);
     }
     const sendState = createSendState();
     const skipState = createSkipState();
@@ -8488,6 +8601,7 @@ ${reason}`,
           "dispatcher: runtime-unavailable notice post failed"
         );
       }
+      releaseAbort();
       return this.concludeBeforeRun(
         payload,
         turnLog,
@@ -8788,23 +8902,6 @@ ${reason}`,
           }
         }
       }
-      if (userCancelled) {
-        try {
-          await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
-            body: STOPPED_MARKER_BODY,
-            kind: "stopped",
-            turnId,
-            seq: nextSeq(),
-            // CT113: the stopped marker is still "about" the triggering message.
-            parentMessageId: payload.messageId
-          });
-        } catch (err) {
-          turnLog.warn(
-            { err: err instanceof Error ? err.message : String(err) },
-            "dispatcher: stopped-marker commit failed"
-          );
-        }
-      }
       const body = {
         activeRunStartedAt: null,
         // CT277: the server keys the turn-end metadata UPDATE (ended_at + tokens)
@@ -8887,9 +8984,7 @@ ${reason}`,
           "dispatcher: active-run clear failed terminally; server age-sweep is the backstop"
         );
       }
-      if (this.aborts.get(key) === abortController) {
-        this.aborts.delete(key);
-      }
+      releaseAbort();
     }
     const durationMs = Date.now() - startedAt;
     const finalReplyBody = committer.replyBody;
@@ -8933,11 +9028,13 @@ ${reason}`,
   // THIS companion process. Returns true if an in-flight run was aborted.
   cancel(conversationId, agentId) {
     const key = runKey(conversationId, agentId);
-    const ac = this.aborts.get(key);
-    if (!ac) return false;
-    try {
-      ac.abort();
-    } catch {
+    const pair2 = this.aborts.get(key);
+    if (!pair2 || pair2.size === 0) return false;
+    for (const ac of [...pair2.values()]) {
+      try {
+        ac.abort();
+      } catch {
+      }
     }
     return true;
   }
@@ -9001,7 +9098,7 @@ import {
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   rmSync as rmSync7,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -9033,7 +9130,7 @@ var Outbox = class {
     const tmp = `${target}.${process.pid}.tmp`;
     try {
       writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
-      renameSync3(tmp, target);
+      renameSync4(tmp, target);
     } catch (err) {
       try {
         rmSync7(tmp, { force: true });
@@ -9834,6 +9931,19 @@ var CompanionSupervisor = class {
       type: "device:dispatch_requested",
       ...wire.payload
     };
+    if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
+      this.log.debug(
+        {
+          workspaceId: wr.workspaceId,
+          conversationId: payload.conversationId,
+          agentId: payload.agentId,
+          addressedTo: payload.deviceId
+        },
+        "companion: dispatch addressed to another device; ignoring"
+      );
+      if (ev.id) wr.cursor.settle(ev.id);
+      return;
+    }
     let agent = wr.agents.get(payload.agentId);
     if (!agent) {
       agent = await this.recoverRacedAgent(wr, payload);
@@ -9965,8 +10075,25 @@ var CompanionSupervisor = class {
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    if (ev.id) markDispatched(workspaceId, ev.id);
-    const result = await agent.dispatcher.handle(payload);
+    const resumedTurnId = ev.id ? turnIdForEvent(workspaceId, ev.id) : null;
+    const turnId = resumedTurnId ?? randomUUID2();
+    if (ev.id) {
+      const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
+      if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
+        this.log.error(
+          { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
+          "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
+        );
+      }
+      markDispatched(workspaceId, ev.id);
+    }
+    if (resumedTurnId) {
+      this.log.info(
+        { workspaceId, eventId: ev.id, turnId },
+        "companion: resuming an interrupted turn under its original id"
+      );
+    }
+    const result = await agent.dispatcher.handle(payload, { turnId });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);
@@ -10357,7 +10484,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID2();
+  const instanceId = randomUUID3();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();

package/dist/runtime.js

@@ -1,5 +1,5 @@
 // src/runtime.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/config.ts
 import {
@@ -1698,6 +1698,9 @@ async function verifyRuntime(state, requestImpl = controlRequest) {
   return body.instance_id === state.instanceId ? "ours" : "stale";
 }
 
+// src/supervisor.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
 var ACTIVE_RUN_OUTBOX_SEQ = 0;
@@ -1942,12 +1945,20 @@ var CabaneApi = class {
   // `durableActiveRunWrite`). The session-id-only write (first-frame capture) is
   // left best-effort: it's lower-stakes and self-heals on the next turn, so it
   // stays a single-shot PATCH and is deliberately out of CT93's scope.
-  setActiveRun(workspaceId, conversationId, agentId, body) {
+  async setActiveRun(workspaceId, conversationId, agentId, body) {
     const path = `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/active-run`;
     const touchesFlag = Object.prototype.hasOwnProperty.call(body, "activeRunStartedAt");
-    if (touchesFlag && this.opts.outbox) {
+    const startsRun = touchesFlag && body.activeRunStartedAt !== null && body.activeRunStartedAt !== void 0;
+    if (touchesFlag && !startsRun && this.opts.outbox) {
       return this.durableActiveRunWrite(path, conversationId, agentId, body);
     }
+    if (startsRun) {
+      const res = await this.request("PATCH", path, body, {
+        retry: true
+      });
+      this.opts.outbox?.remove(activeRunOutboxKey(conversationId, agentId), ACTIVE_RUN_OUTBOX_SEQ);
+      return res;
+    }
     return this.request("PATCH", path, body);
   }
   // CT93: send-or-enqueue for an active-run flag write, with last-writer-wins
@@ -2006,15 +2017,16 @@ var CabaneApi = class {
   // (transport errors + 5xx), never a 4xx, so no `(turnId, kind)` row is
   // double-posted. The caller threads its turn abort signal so a cancel
   // mid-commit aborts the in-flight POST rather than letting it land.
-  // CT11: `kind` now includes `'stopped'` for the terminal marker the
-  // dispatcher writes when a turn is cancelled — same wire shape as
-  // `progress`/`final`, distinguished only by `kind` so the chat drawer's
-  // turn-group renderer treats it as a closing row. `seq` is the companion's
-  // per-turn monotonic counter, stamped on the row so the merged timeline
-  // orders the commit deterministically against the persisted tool/thinking
-  // rows. Both fields are optional on the wire — an older companion that didn't
-  // mint seq still validates (the server defaults to 0); `stopped` is only
-  // emitted by post-CT11 companions.
+  // CT11: `kind` includes `'stopped'` for the terminal cancel marker — same
+  // wire shape as `progress`/`final`, distinguished only by `kind` so the chat
+  // drawer's turn-group renderer treats it as a closing row. CT1295: this
+  // companion no longer WRITES that kind — the server does, in the transaction
+  // that terminalizes the stopped turn — so the value survives here only as
+  // wire vocabulary the server also speaks. `seq` is the companion's per-turn
+  // monotonic counter, stamped on the row so the merged timeline orders the
+  // commit deterministically against the persisted tool/thinking rows. Both
+  // fields are optional on the wire — an older companion that didn't mint seq
+  // still validates (the server defaults to 0).
   postTurnMessage(workspaceId, conversationId, body, signal) {
     return this.durableCommit(
       "message",
@@ -2318,7 +2330,7 @@ var CursorTracker = class {
 };
 
 // src/dispatch-dedupe.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
 import { join as join9 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
@@ -2358,6 +2370,7 @@ function hasCompleted(workspaceId, eventId) {
 }
 function markCompleted(workspaceId, eventId) {
   mark("completed", workspaceId, eventId);
+  forgetTurnId(workspaceId, eventId);
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
@@ -2399,6 +2412,56 @@ function bumpResumeAttempt(workspaceId, eventId) {
   );
   return next;
 }
+function turnDir() {
+  return join9(cabaneDir(), "turns");
+}
+function turnPathFor(workspaceId) {
+  return join9(turnDir(), encodeURIComponent(workspaceId));
+}
+var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function readTurnIds(workspaceId) {
+  const out = /* @__PURE__ */ new Map();
+  const path = turnPathFor(workspaceId);
+  if (!existsSync7(path)) return out;
+  try {
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const tab = trimmed.lastIndexOf("	");
+      if (tab <= 0) continue;
+      const id = trimmed.slice(0, tab);
+      const turnId = trimmed.slice(tab + 1);
+      if (id && TURN_ID_RE.test(turnId)) out.set(id, turnId);
+    }
+  } catch {
+    return out;
+  }
+  return out;
+}
+function turnIdForEvent(workspaceId, eventId) {
+  return readTurnIds(workspaceId).get(eventId) ?? null;
+}
+var TURN_ID_OVERFLOW_WARN = 8192;
+function writeTurnIds(workspaceId, turns) {
+  const entries = [...turns.entries()];
+  mkdirSync7(turnDir(), { recursive: true });
+  const path = turnPathFor(workspaceId);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync5(tmp, entries.map(([id, t]) => `${id}	${t}`).join("\n") + "\n", "utf8");
+  renameSync3(tmp, path);
+  return entries.length;
+}
+function rememberTurnId(workspaceId, eventId, turnId) {
+  const turns = readTurnIds(workspaceId);
+  if (turns.get(eventId) === turnId) return turns.size;
+  turns.set(eventId, turnId);
+  return writeTurnIds(workspaceId, turns);
+}
+function forgetTurnId(workspaceId, eventId) {
+  const turns = readTurnIds(workspaceId);
+  if (!turns.delete(eventId)) return;
+  writeTurnIds(workspaceId, turns);
+}
 function noResume() {
   return process.env.CABANE_COMPANION_NO_RESUME === "1";
 }
@@ -3816,7 +3879,7 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
   {
     // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result;
     // the adapter stops before the closing reply — no final text, no `result`
-    // event. The host writes the `kind:'stopped'` marker off the signal.
+    // event. CT1295: the server writes the `kind:'stopped'` marker.
     name: "cancel mid-stream",
     request: makeRequest(),
     nativeStream: [
@@ -4937,7 +5000,7 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
   {
     // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
     // adapter stops before the closing reply — no final text, no `result` event.
-    // The host writes the `kind:'stopped'` marker off the signal.
+    // CT1295: the server writes the `kind:'stopped'` marker.
     name: "cancel mid-stream",
     request: makeRequest2(),
     nativeStream: [
@@ -6229,7 +6292,7 @@ var CODEX_CONFORMANCE_FIXTURES = [
   {
     // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
     // adapter stops before the closing reply — no final text, no `result` event.
-    // The host writes the `kind:'stopped'` marker off the signal.
+    // CT1295: the server writes the `kind:'stopped'` marker.
     name: "cancel mid-stream",
     request: makeRequest3(),
     nativeStream: [
@@ -7385,8 +7448,10 @@ var TurnCommitter = class {
   // End-of-turn progress promotion. The held-text flush is now the adapter's
   // job (it emits the closing reply as a `text` event before `result`), so this
   // only asks the pump to promote agent-authored interim text. A wordless turn
-  // stays wordless and the dispatcher closes it with a marker. Guards on the
-  // abort signal, so on cancel no `final` is forced.
+  // stays wordless and the dispatcher closes it with a `silent`/`skipped`
+  // marker (CT1295: a CANCELLED turn is closed by the SERVER's `stopped`
+  // marker, not from this side). Guards on the abort signal, so on cancel no
+  // `final` is forced.
   async finalize(okResult) {
     await this.pump.finalize(okResult);
   }
@@ -7504,7 +7569,6 @@ var TurnCommitter = class {
 var PREPARING_TOOL_NAME = "preparing";
 var PREPARE_FAILED_PREFIX = "**Couldn't prepare your environment.** I wasn't able to provision a working directory for this conversation, so I can't run this turn. The provisioning command reported:";
 var MISSING_SECRET_PREFIX = "**Missing secret on this companion.** This agent's tools need a credential this device hasn't been given, so I can't run this turn safely. Declare it in this companion\u2019s secret store (`~/.cabane/secrets.json`) and try again. Missing:";
-var STOPPED_MARKER_BODY = "(stopped)";
 var RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
 var UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
 var SKIPPED_MARKER_BODY = "(skipped)";
@@ -7539,6 +7603,18 @@ function checkoutState(cwd) {
 function runKey(conversationId, agentId) {
   return `${conversationId}|${agentId}`;
 }
+var LEASE_REFUSALS = /* @__PURE__ */ new Set([
+  "dispatch_not_admitted",
+  "turn_already_ended",
+  "turn_belongs_elsewhere"
+]);
+function leaseRefusal(err) {
+  if (!(err instanceof ApiError)) return null;
+  const body = err.body;
+  const code = typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
+  if (code && LEASE_REFUSALS.has(code)) return code;
+  return null;
+}
 var ERROR_BODY_LOG_CAP = 2e3;
 function describeErrorBody(body) {
   if (body === void 0 || body === null) return void 0;
@@ -7573,6 +7649,16 @@ var Dispatcher = class {
   }
   opts;
   // SJ383: per-(conversation, agent) abort registry.
+  // CT1288: RunKey -> (turnId -> controller). This used to be one controller
+  // per (conversation, agent), which quietly encoded the invariant the whole
+  // task exists to enforce: that a pair can only ever have one live loop. When
+  // that assumption broke, the second `set` EVICTED the first controller and
+  // the first loop became permanently uncancellable — no other code path can
+  // reach into a running turn. So the registry that Stop depends on failed
+  // exactly when Stop was the thing you needed.
+  //
+  // Nesting by turn id costs nothing in the normal single-turn case and makes
+  // `cancel` total: it aborts every loop under the pair, not the newest one.
   aborts;
   // CT1109: pairs already told, in the conversation, that their session state is
   // being refused. The failure repeats every single turn until someone fixes the
@@ -7635,7 +7721,12 @@ var Dispatcher = class {
     this.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
     return { ok: false, durationMs, reason };
   }
-  async handle(payload) {
+  // CT1288: `opts.turnId` is a RESUMED turn id — the id this event already ran
+  // under before the companion died. Passing it makes the replay ask the
+  // mailroom to re-admit the turn it already owns, which the server explicitly
+  // supports ("a replay reports, it never re-points"). Omitted on a fresh
+  // dispatch, where minting below is correct.
+  async handle(payload, opts = {}) {
     const startedAt = Date.now();
     const dispatchId = payload.messageId;
     const workspaceId = this.opts.workspaceId;
@@ -7645,7 +7736,7 @@ var Dispatcher = class {
       agentId: payload.agentId,
       messageId: payload.messageId
     });
-    const turnId = randomUUID();
+    const turnId = opts.turnId ?? randomUUID();
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
@@ -7867,7 +7958,18 @@ ${reason}`,
     };
     const key = runKey(payload.conversationId, payload.agentId);
     const abortController = new AbortController();
-    this.aborts.set(key, abortController);
+    let pairAborts = this.aborts.get(key);
+    if (!pairAborts) {
+      pairAborts = /* @__PURE__ */ new Map();
+      this.aborts.set(key, pairAborts);
+    }
+    pairAborts.set(turnId, abortController);
+    const releaseAbort = () => {
+      const pair = this.aborts.get(key);
+      if (pair?.get(turnId) !== abortController) return;
+      pair.delete(turnId);
+      if (pair.size === 0) this.aborts.delete(key);
+    };
     let timeoutReason = null;
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
@@ -7880,10 +7982,21 @@ ${reason}`,
         turnId
       });
     } catch (err) {
-      turnLog.warn(
-        { err: err instanceof Error ? err.message : String(err) },
-        "dispatcher: active-run flag set failed terminally; proceeding"
+      const refusal = leaseRefusal(err);
+      releaseAbort();
+      if (refusal === "dispatch_not_admitted" || refusal === "turn_already_ended") {
+        turnLog.error(
+          { refusal, turnId },
+          "dispatcher: refused a turn lease; not running the model"
+        );
+        return this.concludeBeforeRun(payload, turnLog, startedAt, `lease_refused: ${refusal}`);
+      }
+      const reason = refusal ? `lease_refused: ${refusal}` : "lease_unconfirmed";
+      turnLog.error(
+        { refusal, turnId, err: err instanceof Error ? err.message : String(err) },
+        "dispatcher: turn lease not confirmed; not running the model"
       );
+      return this.concludeBeforeRun(payload, turnLog, startedAt, reason, reason);
     }
     const sendState = createSendState();
     const skipState = createSkipState();
@@ -7987,6 +8100,7 @@ ${reason}`,
           "dispatcher: runtime-unavailable notice post failed"
         );
       }
+      releaseAbort();
       return this.concludeBeforeRun(
         payload,
         turnLog,
@@ -8287,23 +8401,6 @@ ${reason}`,
           }
         }
       }
-      if (userCancelled) {
-        try {
-          await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
-            body: STOPPED_MARKER_BODY,
-            kind: "stopped",
-            turnId,
-            seq: nextSeq(),
-            // CT113: the stopped marker is still "about" the triggering message.
-            parentMessageId: payload.messageId
-          });
-        } catch (err) {
-          turnLog.warn(
-            { err: err instanceof Error ? err.message : String(err) },
-            "dispatcher: stopped-marker commit failed"
-          );
-        }
-      }
       const body = {
         activeRunStartedAt: null,
         // CT277: the server keys the turn-end metadata UPDATE (ended_at + tokens)
@@ -8386,9 +8483,7 @@ ${reason}`,
           "dispatcher: active-run clear failed terminally; server age-sweep is the backstop"
         );
       }
-      if (this.aborts.get(key) === abortController) {
-        this.aborts.delete(key);
-      }
+      releaseAbort();
     }
     const durationMs = Date.now() - startedAt;
     const finalReplyBody = committer.replyBody;
@@ -8432,11 +8527,13 @@ ${reason}`,
   // THIS companion process. Returns true if an in-flight run was aborted.
   cancel(conversationId, agentId) {
     const key = runKey(conversationId, agentId);
-    const ac = this.aborts.get(key);
-    if (!ac) return false;
-    try {
-      ac.abort();
-    } catch {
+    const pair = this.aborts.get(key);
+    if (!pair || pair.size === 0) return false;
+    for (const ac of [...pair.values()]) {
+      try {
+        ac.abort();
+      } catch {
+      }
     }
     return true;
   }
@@ -8500,7 +8597,7 @@ import {
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
   readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   rmSync as rmSync7,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -8532,7 +8629,7 @@ var Outbox = class {
     const tmp = `${target}.${process.pid}.tmp`;
     try {
       writeFileSync7(tmp, JSON.stringify(entry) + "\n", "utf8");
-      renameSync3(tmp, target);
+      renameSync4(tmp, target);
     } catch (err) {
       try {
         rmSync7(tmp, { force: true });
@@ -9333,6 +9430,19 @@ var CompanionSupervisor = class {
       type: "device:dispatch_requested",
       ...wire.payload
     };
+    if (this.deviceId && payload.deviceId && payload.deviceId !== this.deviceId) {
+      this.log.debug(
+        {
+          workspaceId: wr.workspaceId,
+          conversationId: payload.conversationId,
+          agentId: payload.agentId,
+          addressedTo: payload.deviceId
+        },
+        "companion: dispatch addressed to another device; ignoring"
+      );
+      if (ev.id) wr.cursor.settle(ev.id);
+      return;
+    }
     let agent = wr.agents.get(payload.agentId);
     if (!agent) {
       agent = await this.recoverRacedAgent(wr, payload);
@@ -9464,8 +9574,25 @@ var CompanionSupervisor = class {
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    if (ev.id) markDispatched(workspaceId, ev.id);
-    const result = await agent.dispatcher.handle(payload);
+    const resumedTurnId = ev.id ? turnIdForEvent(workspaceId, ev.id) : null;
+    const turnId = resumedTurnId ?? randomUUID2();
+    if (ev.id) {
+      const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
+      if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
+        this.log.error(
+          { workspaceId, liveTurnIds, threshold: TURN_ID_OVERFLOW_WARN },
+          "companion: in-flight turn-id map is implausibly large \u2014 completion pruning is likely broken. Keeping every mapping; dropping one would silently lose a resumable turn."
+        );
+      }
+      markDispatched(workspaceId, ev.id);
+    }
+    if (resumedTurnId) {
+      this.log.info(
+        { workspaceId, eventId: ev.id, turnId },
+        "companion: resuming an interrupted turn under its original id"
+      );
+    }
+    const result = await agent.dispatcher.handle(payload, { turnId });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);
@@ -9856,7 +9983,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID2();
+  const instanceId = randomUUID3();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.63",
+  "version": "0.6.65",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",