@cabane/companion 0.6.7 → 0.6.8

package/dist/cli.js

@@ -2902,8 +2902,7 @@ var claudeCodeDialectSchema = z9.object({
       display: z9.enum(["summarized", "omitted"]).optional()
     }),
     z9.object({ type: z9.literal("disabled") })
-  ]).optional(),
-  hostAccess: z9.boolean().optional()
+  ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2981,8 +2980,7 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
+  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
@@ -4898,10 +4896,11 @@ function parseCodexModel(model) {
 var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
-function buildRunSpec2(req, resumeThreadId) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
+  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   if (model === null) {
     console.warn(
@@ -4915,19 +4914,21 @@ function buildRunSpec2(req, resumeThreadId) {
     policy: codexToolPolicy(policy),
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    input: buildInput(req),
-    config: buildConfig(req)
+    baseInstructionsFile,
+    input: buildInput(req, baseInstructionsFile !== null),
+    config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req) {
+function buildInput(req, promptRidesInstructionsFile) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
+  if (promptRidesInstructionsFile) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
 ${body}` : body;
 }
-function buildConfig(req) {
+function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -4985,6 +4986,10 @@ function buildConfig(req) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
+    // becomes Codex's base instructions, and Codex's own environment preamble goes
+    // with the harness prompt it belonged to.
+    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
@@ -5603,19 +5608,48 @@ function createCodexAdapter(deps = {}) {
         );
       }
       const degraded = "fresh" in decision && decision.reason !== void 0 && decision.reason !== "no_session";
-      const spec = buildRunSpec2(req, resumeThreadId);
-      const result = await transport.run(spec, signal);
-      if (signal.aborted) return;
-      yield* decodeCodexStream(result.events, {
-        signal,
-        cwd: req.local.cwd,
-        resumedThreadId: resumeThreadId,
-        degraded,
-        // CT601: Codex reports no model in-stream, so record what the thread was
-        // started with (null on the default token). Same for the reasoning effort.
-        resolvedModel: spec.model,
-        resolvedReasoningEffort: spec.modelReasoningEffort ?? null
-      });
+      let instructions = null;
+      if (!req.policy.hostFs) {
+        if (!deps.writeInstructionsFile) {
+          deps.onWarn?.(
+            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
+          );
+        } else {
+          try {
+            instructions = await deps.writeInstructionsFile(req.systemPrompt);
+          } catch (err) {
+            deps.onWarn?.(
+              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
+              { err: err instanceof Error ? err.message : String(err) }
+            );
+          }
+        }
+      }
+      try {
+        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const result = await transport.run(spec, signal);
+        if (signal.aborted) return;
+        yield* decodeCodexStream(result.events, {
+          signal,
+          cwd: req.local.cwd,
+          resumedThreadId: resumeThreadId,
+          degraded,
+          // CT601: Codex reports no model in-stream, so record what the thread was
+          // started with (null on the default token). Same for the reasoning effort.
+          resolvedModel: spec.model,
+          resolvedReasoningEffort: spec.modelReasoningEffort ?? null
+        });
+      } finally {
+        if (instructions) {
+          try {
+            await instructions.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
     }
   };
 }
@@ -6223,7 +6257,7 @@ var ConnectorHealthStore = class {
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync10 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/summon.ts
 import { z as z12 } from "zod";
@@ -6502,17 +6536,34 @@ function trimSlash3(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
 
+// src/codex-instructions.ts
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+var PREFIX = "cabane-codex-instructions-";
+async function writeCodexInstructionsFile(contents) {
+  const dir2 = await mkdtemp(join9(tmpdir(), PREFIX));
+  const path3 = join9(dir2, "instructions.md");
+  await writeFile(path3, contents, { encoding: "utf8", mode: 384 });
+  return {
+    path: path3,
+    cleanup: async () => {
+      await rm(dir2, { recursive: true, force: true });
+    }
+  };
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function dirFor(workspaceId) {
-  return join9(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join10(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join10(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join10(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path3 = pathFor3(workspaceId, conversationId, agentId);
@@ -6541,11 +6592,11 @@ function writePrepared(workspaceId, conversationId, agentId, result) {
 
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join11(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
@@ -6632,9 +6683,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync3, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function transcriptsDir() {
-  return join11(cabaneDir(), "transcripts");
+  return join12(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var TranscriptWriter = class {
@@ -6643,7 +6694,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join11(dir2, fileName(meta));
+    this.path = join12(dir2, fileName(meta));
     try {
       mkdirSync9(dir2, { recursive: true });
       try {
@@ -6702,7 +6753,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync4(join11(dir2, f), { force: true });
+      rmSync4(join12(dir2, f), { force: true });
     } catch {
     }
   }
@@ -7247,7 +7298,7 @@ ${reason}`,
     }
     let turnEnv = hookEnv;
     if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
       try {
         mkdirSync10(tmpDir, { recursive: true });
         turnEnv = { ...hookEnv, TMPDIR: tmpDir };
@@ -7346,7 +7397,13 @@ ${reason}`,
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
     if (this.opts.codexEnabled) {
-      adapters.push(createCodexAdapter({ enabled: true, onWarn }));
+      adapters.push(
+        createCodexAdapter({
+          enabled: true,
+          onWarn,
+          writeInstructionsFile: writeCodexInstructionsFile
+        })
+      );
     }
     const registry = createAdapterRegistry(adapters);
     let adapter;
@@ -7389,10 +7446,10 @@ ${reason}`,
       );
       if (effectiveCwd) {
         try {
-          const diagnosticDir = join12(effectiveCwd, ".git", "cabane");
+          const diagnosticDir = join13(effectiveCwd, ".git", "cabane");
           mkdirSync10(diagnosticDir, { recursive: true });
           appendFileSync2(
-            join12(diagnosticDir, "readiness.jsonl"),
+            join13(diagnosticDir, "readiness.jsonl"),
             `${JSON.stringify({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               taskId: hookEnv.CABANE_TASK_ID,
@@ -7976,7 +8033,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -7989,10 +8046,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join13(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join14(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join13(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join14(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -8034,7 +8091,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join13(dir2, name);
+      const full = join14(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -9141,9 +9198,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function crashMarkerPath() {
-  return join14(cabaneDir(), "last-error.json");
+  return join15(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
@@ -9497,7 +9554,7 @@ function isAlive(kill, pid) {
 
 // src/commands/transcript.ts
 import { existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync4 } from "fs";
-import { isAbsolute, join as join15 } from "path";
+import { isAbsolute, join as join16 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -9514,7 +9571,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join15(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join16(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -9597,7 +9654,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync10(join15(dir2, f), "utf8"),
+    read: (f) => readFileSync10(join16(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -9637,7 +9694,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join15(dir2, f));
+    const { meta, outcome } = peek(join16(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -9674,10 +9731,10 @@ function resolveTarget(dir2, target) {
     if (existsSync12(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join15(dir2, target);
+  const exact = join16(dir2, target);
   if (existsSync12(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join15(dir2, matches[0]);
+  if (matches.length === 1) return join16(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`cabane-companion transcript\` to list them.`

package/dist/runtime.js

@@ -2555,8 +2555,7 @@ var claudeCodeDialectSchema = z9.object({
       display: z9.enum(["summarized", "omitted"]).optional()
     }),
     z9.object({ type: z9.literal("disabled") })
-  ]).optional(),
-  hostAccess: z9.boolean().optional()
+  ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2634,8 +2633,7 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
+  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
@@ -4551,10 +4549,11 @@ function parseCodexModel(model) {
 var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
-function buildRunSpec2(req, resumeThreadId) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
+  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   if (model === null) {
     console.warn(
@@ -4568,19 +4567,21 @@ function buildRunSpec2(req, resumeThreadId) {
     policy: codexToolPolicy(policy),
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    input: buildInput(req),
-    config: buildConfig(req)
+    baseInstructionsFile,
+    input: buildInput(req, baseInstructionsFile !== null),
+    config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req) {
+function buildInput(req, promptRidesInstructionsFile) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
+  if (promptRidesInstructionsFile) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
 ${body}` : body;
 }
-function buildConfig(req) {
+function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -4638,6 +4639,10 @@ function buildConfig(req) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
+    // becomes Codex's base instructions, and Codex's own environment preamble goes
+    // with the harness prompt it belonged to.
+    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
@@ -5256,19 +5261,48 @@ function createCodexAdapter(deps = {}) {
         );
       }
       const degraded = "fresh" in decision && decision.reason !== void 0 && decision.reason !== "no_session";
-      const spec = buildRunSpec2(req, resumeThreadId);
-      const result = await transport.run(spec, signal);
-      if (signal.aborted) return;
-      yield* decodeCodexStream(result.events, {
-        signal,
-        cwd: req.local.cwd,
-        resumedThreadId: resumeThreadId,
-        degraded,
-        // CT601: Codex reports no model in-stream, so record what the thread was
-        // started with (null on the default token). Same for the reasoning effort.
-        resolvedModel: spec.model,
-        resolvedReasoningEffort: spec.modelReasoningEffort ?? null
-      });
+      let instructions = null;
+      if (!req.policy.hostFs) {
+        if (!deps.writeInstructionsFile) {
+          deps.onWarn?.(
+            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
+          );
+        } else {
+          try {
+            instructions = await deps.writeInstructionsFile(req.systemPrompt);
+          } catch (err) {
+            deps.onWarn?.(
+              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
+              { err: err instanceof Error ? err.message : String(err) }
+            );
+          }
+        }
+      }
+      try {
+        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const result = await transport.run(spec, signal);
+        if (signal.aborted) return;
+        yield* decodeCodexStream(result.events, {
+          signal,
+          cwd: req.local.cwd,
+          resumedThreadId: resumeThreadId,
+          degraded,
+          // CT601: Codex reports no model in-stream, so record what the thread was
+          // started with (null on the default token). Same for the reasoning effort.
+          resolvedModel: spec.model,
+          resolvedReasoningEffort: spec.modelReasoningEffort ?? null
+        });
+      } finally {
+        if (instructions) {
+          try {
+            await instructions.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
     }
   };
 }
@@ -5876,7 +5910,7 @@ var ConnectorHealthStore = class {
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync9 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/summon.ts
 import { z as z12 } from "zod";
@@ -6155,17 +6189,34 @@ function trimSlash3(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
 
+// src/codex-instructions.ts
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+var PREFIX = "cabane-codex-instructions-";
+async function writeCodexInstructionsFile(contents) {
+  const dir2 = await mkdtemp(join9(tmpdir(), PREFIX));
+  const path3 = join9(dir2, "instructions.md");
+  await writeFile(path3, contents, { encoding: "utf8", mode: 384 });
+  return {
+    path: path3,
+    cleanup: async () => {
+      await rm(dir2, { recursive: true, force: true });
+    }
+  };
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function dirFor(workspaceId) {
-  return join9(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join10(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join10(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join10(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path3 = pathFor3(workspaceId, conversationId, agentId);
@@ -6194,11 +6245,11 @@ function writePrepared(workspaceId, conversationId, agentId, result) {
 
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join11(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
@@ -6285,9 +6336,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync3, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function transcriptsDir() {
-  return join11(cabaneDir(), "transcripts");
+  return join12(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var TranscriptWriter = class {
@@ -6296,7 +6347,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join11(dir2, fileName(meta));
+    this.path = join12(dir2, fileName(meta));
     try {
       mkdirSync8(dir2, { recursive: true });
       try {
@@ -6355,7 +6406,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync4(join11(dir2, f), { force: true });
+      rmSync4(join12(dir2, f), { force: true });
     } catch {
     }
   }
@@ -6900,7 +6951,7 @@ ${reason}`,
     }
     let turnEnv = hookEnv;
     if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
       try {
         mkdirSync9(tmpDir, { recursive: true });
         turnEnv = { ...hookEnv, TMPDIR: tmpDir };
@@ -6999,7 +7050,13 @@ ${reason}`,
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
     if (this.opts.codexEnabled) {
-      adapters.push(createCodexAdapter({ enabled: true, onWarn }));
+      adapters.push(
+        createCodexAdapter({
+          enabled: true,
+          onWarn,
+          writeInstructionsFile: writeCodexInstructionsFile
+        })
+      );
     }
     const registry = createAdapterRegistry(adapters);
     let adapter;
@@ -7042,10 +7099,10 @@ ${reason}`,
       );
       if (effectiveCwd) {
         try {
-          const diagnosticDir = join12(effectiveCwd, ".git", "cabane");
+          const diagnosticDir = join13(effectiveCwd, ".git", "cabane");
           mkdirSync9(diagnosticDir, { recursive: true });
           appendFileSync2(
-            join12(diagnosticDir, "readiness.jsonl"),
+            join13(diagnosticDir, "readiness.jsonl"),
             `${JSON.stringify({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               taskId: hookEnv.CABANE_TASK_ID,
@@ -7629,7 +7686,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -7642,10 +7699,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join13(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join14(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join13(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join14(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -7687,7 +7744,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join13(dir2, name);
+      const full = join14(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -8794,9 +8851,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function crashMarkerPath() {
-  return join14(cabaneDir(), "last-error.json");
+  return join15(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",