@cabane/companion 0.6.7 → 0.6.9

package/dist/cli.js

@@ -79,7 +79,20 @@ var prepareHookSchema = z.object({
   // Wall-clock cap for the hook. Provisioning is slow (minutes), so the
   // default is generous; a hook that hangs past this is killed and the turn
   // fails with a clear timeout message rather than pinning the companion.
-  timeoutMs: z.number().int().positive().optional()
+  timeoutMs: z.number().int().positive().optional(),
+  // CT943: re-invoke the hook on turns where a prepared result already exists,
+  // in VALIDATE mode — the cached result is handed back as `prepared` and the
+  // hook's stdout is ignored, so the cwd provably cannot move. Its only power
+  // is to exit non-zero and fail the turn.
+  //
+  // Why it exists: the hook runs exactly once per (conversation, agent), so a
+  // later message asking for a different environment can't be honoured. Without
+  // this, it is silently ignored — the host knows and says nothing, which is
+  // the worst available outcome. An opt-in hook can now refuse it out loud.
+  //
+  // Default OFF, and deliberately: an operator hook that provisions
+  // unconditionally must not start running on every turn because it upgraded.
+  validateCached: z.boolean().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var prepareResultSchema = z.object({
@@ -143,7 +156,12 @@ var runPrepareHook = (hook, input) => {
           // CT317: newline-joined — workspace paths never contain a newline, so a
           // hook splits on `\n` unambiguously. Empty string when none.
           CABANE_TRIGGER_ENTRY_PATHS: input.triggerEntryPaths.join("\n"),
-          CABANE_CONVERSATION_TITLE: input.title ?? ""
+          CABANE_CONVERSATION_TITLE: input.title ?? "",
+          // CT943: the dispatching message's text, and — in validate mode only —
+          // the prepared result the hook is being asked to check this dispatch
+          // against. Both empty/absent on an ordinary first run.
+          CABANE_TRIGGER_MESSAGE: input.messageBody ?? "",
+          ...input.prepared ? { CABANE_PREPARED: JSON.stringify(input.prepared) } : {}
         }
       });
     } catch (err) {
@@ -181,6 +199,10 @@ var runPrepareHook = (hook, input) => {
           );
           return;
         }
+        if (input.prepared) {
+          resolve(input.prepared);
+          return;
+        }
         try {
           resolve(parsePrepareOutput(stdout));
         } catch (err) {
@@ -2902,8 +2924,7 @@ var claudeCodeDialectSchema = z9.object({
       display: z9.enum(["summarized", "omitted"]).optional()
     }),
     z9.object({ type: z9.literal("disabled") })
-  ]).optional(),
-  hostAccess: z9.boolean().optional()
+  ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2981,8 +3002,7 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
+  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
@@ -3859,7 +3879,7 @@ var OPENCODE_HOST_TOOLS = [
 var OPENCODE_WEB_TOOLS = ["webfetch"];
 var OPENCODE_SUBAGENT_TOOLS = ["task"];
 var OPENCODE_SCHEDULING_TOOLS = [];
-var OPENCODE_UI_PROMPT_TOOLS = [];
+var OPENCODE_UI_PROMPT_TOOLS = ["question"];
 function opencodeToolPolicy(policy) {
   const tools = {};
   const deny = (names) => {
@@ -4898,10 +4918,11 @@ function parseCodexModel(model) {
 var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
-function buildRunSpec2(req, resumeThreadId) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
+  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   if (model === null) {
     console.warn(
@@ -4915,19 +4936,21 @@ function buildRunSpec2(req, resumeThreadId) {
     policy: codexToolPolicy(policy),
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    input: buildInput(req),
-    config: buildConfig(req)
+    baseInstructionsFile,
+    input: buildInput(req, baseInstructionsFile !== null),
+    config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req) {
+function buildInput(req, promptRidesInstructionsFile) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
+  if (promptRidesInstructionsFile) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
 ${body}` : body;
 }
-function buildConfig(req) {
+function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -4985,6 +5008,10 @@ function buildConfig(req) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
+    // becomes Codex's base instructions, and Codex's own environment preamble goes
+    // with the harness prompt it belonged to.
+    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
@@ -5603,19 +5630,48 @@ function createCodexAdapter(deps = {}) {
         );
       }
       const degraded = "fresh" in decision && decision.reason !== void 0 && decision.reason !== "no_session";
-      const spec = buildRunSpec2(req, resumeThreadId);
-      const result = await transport.run(spec, signal);
-      if (signal.aborted) return;
-      yield* decodeCodexStream(result.events, {
-        signal,
-        cwd: req.local.cwd,
-        resumedThreadId: resumeThreadId,
-        degraded,
-        // CT601: Codex reports no model in-stream, so record what the thread was
-        // started with (null on the default token). Same for the reasoning effort.
-        resolvedModel: spec.model,
-        resolvedReasoningEffort: spec.modelReasoningEffort ?? null
-      });
+      let instructions = null;
+      if (!req.policy.hostFs) {
+        if (!deps.writeInstructionsFile) {
+          deps.onWarn?.(
+            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
+          );
+        } else {
+          try {
+            instructions = await deps.writeInstructionsFile(req.systemPrompt);
+          } catch (err) {
+            deps.onWarn?.(
+              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
+              { err: err instanceof Error ? err.message : String(err) }
+            );
+          }
+        }
+      }
+      try {
+        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const result = await transport.run(spec, signal);
+        if (signal.aborted) return;
+        yield* decodeCodexStream(result.events, {
+          signal,
+          cwd: req.local.cwd,
+          resumedThreadId: resumeThreadId,
+          degraded,
+          // CT601: Codex reports no model in-stream, so record what the thread was
+          // started with (null on the default token). Same for the reasoning effort.
+          resolvedModel: spec.model,
+          resolvedReasoningEffort: spec.modelReasoningEffort ?? null
+        });
+      } finally {
+        if (instructions) {
+          try {
+            await instructions.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
     }
   };
 }
@@ -6223,7 +6279,7 @@ var ConnectorHealthStore = class {
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync10 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/summon.ts
 import { z as z12 } from "zod";
@@ -6502,17 +6558,34 @@ function trimSlash3(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
 
+// src/codex-instructions.ts
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+var PREFIX = "cabane-codex-instructions-";
+async function writeCodexInstructionsFile(contents) {
+  const dir2 = await mkdtemp(join9(tmpdir(), PREFIX));
+  const path3 = join9(dir2, "instructions.md");
+  await writeFile(path3, contents, { encoding: "utf8", mode: 384 });
+  return {
+    path: path3,
+    cleanup: async () => {
+      await rm(dir2, { recursive: true, force: true });
+    }
+  };
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function dirFor(workspaceId) {
-  return join9(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join10(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join10(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join10(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path3 = pathFor3(workspaceId, conversationId, agentId);
@@ -6541,11 +6614,11 @@ function writePrepared(workspaceId, conversationId, agentId, result) {
 
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join11(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
@@ -6632,9 +6705,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync3, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function transcriptsDir() {
-  return join11(cabaneDir(), "transcripts");
+  return join12(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var TranscriptWriter = class {
@@ -6643,7 +6716,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join11(dir2, fileName(meta));
+    this.path = join12(dir2, fileName(meta));
     try {
       mkdirSync9(dir2, { recursive: true });
       try {
@@ -6702,7 +6775,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync4(join11(dir2, f), { force: true });
+      rmSync4(join12(dir2, f), { force: true });
     } catch {
     }
   }
@@ -7174,6 +7247,41 @@ var Dispatcher = class {
       if (cached2) {
         effectiveCwd = cached2.cwd;
         hookEnv = cached2.env;
+        if (prepareHook.validateCached) {
+          const runHook = this.opts.prepareHookRunner ?? runPrepareHook;
+          try {
+            await runHook(prepareHook, {
+              workspaceId,
+              conversationId: payload.conversationId,
+              agentId: payload.agentId,
+              agentUsername: this.opts.agentUsername,
+              runtime: turnContext.runtime,
+              triggerEntryPaths: turnContext.conversation.triggerEntryPaths ?? [],
+              title: turnContext.conversation.title,
+              messageBody: message.body,
+              prepared: cached2
+            });
+          } catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            turnLog.error({ err: reason }, "dispatcher: prepare hook rejected a prepared turn");
+            try {
+              await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
+                body: `${PREPARE_FAILED_PREFIX}
+
+${reason}`,
+                kind: "final",
+                turnId,
+                parentMessageId: payload.messageId
+              });
+            } catch (postErr) {
+              turnLog.warn(
+                { err: postErr instanceof Error ? postErr.message : String(postErr) },
+                "dispatcher: prepare-rejection post failed"
+              );
+            }
+            return this.concludeBeforeRun(payload, turnLog, startedAt, `prepare_failed: ${reason}`);
+          }
+        }
       } else {
         const delayMs = this.opts.preparingRowDelayMs ?? DEFAULT_PREPARING_ROW_DELAY_MS;
         let preparingStarted = false;
@@ -7212,7 +7320,12 @@ var Dispatcher = class {
             // tasker prepare hook keys its per-task env off. Defaults to `[]` for
             // an older API. The conversation anchor is gone (CT319).
             triggerEntryPaths: turnContext.conversation.triggerEntryPaths ?? [],
-            title: turnContext.conversation.title
+            title: turnContext.conversation.title,
+            // CT943: the dispatching message's text — where an `env:` directive
+            // rides. The server has always sent the trigger body on the turn
+            // context (for the live feed); this is the first thing to read it as
+            // an INPUT, so a dispatch can ask for its environment in words.
+            messageBody: message.body
           });
           clearTimeout(preparingTimer);
           if (preparingStarted) reportPreparing("done");
@@ -7247,7 +7360,7 @@ ${reason}`,
     }
     let turnEnv = hookEnv;
     if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
       try {
         mkdirSync10(tmpDir, { recursive: true });
         turnEnv = { ...hookEnv, TMPDIR: tmpDir };
@@ -7346,7 +7459,13 @@ ${reason}`,
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
     if (this.opts.codexEnabled) {
-      adapters.push(createCodexAdapter({ enabled: true, onWarn }));
+      adapters.push(
+        createCodexAdapter({
+          enabled: true,
+          onWarn,
+          writeInstructionsFile: writeCodexInstructionsFile
+        })
+      );
     }
     const registry = createAdapterRegistry(adapters);
     let adapter;
@@ -7389,10 +7508,10 @@ ${reason}`,
       );
       if (effectiveCwd) {
         try {
-          const diagnosticDir = join12(effectiveCwd, ".git", "cabane");
+          const diagnosticDir = join13(effectiveCwd, ".git", "cabane");
           mkdirSync10(diagnosticDir, { recursive: true });
           appendFileSync2(
-            join12(diagnosticDir, "readiness.jsonl"),
+            join13(diagnosticDir, "readiness.jsonl"),
             `${JSON.stringify({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               taskId: hookEnv.CABANE_TASK_ID,
@@ -7976,7 +8095,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -7989,10 +8108,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join13(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join14(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join13(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join14(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -8034,7 +8153,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join13(dir2, name);
+      const full = join14(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -9141,9 +9260,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function crashMarkerPath() {
-  return join14(cabaneDir(), "last-error.json");
+  return join15(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
@@ -9497,7 +9616,7 @@ function isAlive(kill, pid) {
 
 // src/commands/transcript.ts
 import { existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync4 } from "fs";
-import { isAbsolute, join as join15 } from "path";
+import { isAbsolute, join as join16 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -9514,7 +9633,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join15(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join16(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -9597,7 +9716,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync10(join15(dir2, f), "utf8"),
+    read: (f) => readFileSync10(join16(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -9637,7 +9756,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join15(dir2, f));
+    const { meta, outcome } = peek(join16(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -9674,10 +9793,10 @@ function resolveTarget(dir2, target) {
     if (existsSync12(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join15(dir2, target);
+  const exact = join16(dir2, target);
   if (existsSync12(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join15(dir2, matches[0]);
+  if (matches.length === 1) return join16(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`cabane-companion transcript\` to list them.`

package/dist/pairing-config.js

@@ -63,7 +63,20 @@ var prepareHookSchema = z.object({
   // Wall-clock cap for the hook. Provisioning is slow (minutes), so the
   // default is generous; a hook that hangs past this is killed and the turn
   // fails with a clear timeout message rather than pinning the companion.
-  timeoutMs: z.number().int().positive().optional()
+  timeoutMs: z.number().int().positive().optional(),
+  // CT943: re-invoke the hook on turns where a prepared result already exists,
+  // in VALIDATE mode — the cached result is handed back as `prepared` and the
+  // hook's stdout is ignored, so the cwd provably cannot move. Its only power
+  // is to exit non-zero and fail the turn.
+  //
+  // Why it exists: the hook runs exactly once per (conversation, agent), so a
+  // later message asking for a different environment can't be honoured. Without
+  // this, it is silently ignored — the host knows and says nothing, which is
+  // the worst available outcome. An opt-in hook can now refuse it out loud.
+  //
+  // Default OFF, and deliberately: an operator hook that provisions
+  // unconditionally must not start running on every turn because it upgraded.
+  validateCached: z.boolean().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var prepareResultSchema = z.object({

package/dist/runtime.js

@@ -72,7 +72,20 @@ var prepareHookSchema = z.object({
   // Wall-clock cap for the hook. Provisioning is slow (minutes), so the
   // default is generous; a hook that hangs past this is killed and the turn
   // fails with a clear timeout message rather than pinning the companion.
-  timeoutMs: z.number().int().positive().optional()
+  timeoutMs: z.number().int().positive().optional(),
+  // CT943: re-invoke the hook on turns where a prepared result already exists,
+  // in VALIDATE mode — the cached result is handed back as `prepared` and the
+  // hook's stdout is ignored, so the cwd provably cannot move. Its only power
+  // is to exit non-zero and fail the turn.
+  //
+  // Why it exists: the hook runs exactly once per (conversation, agent), so a
+  // later message asking for a different environment can't be honoured. Without
+  // this, it is silently ignored — the host knows and says nothing, which is
+  // the worst available outcome. An opt-in hook can now refuse it out loud.
+  //
+  // Default OFF, and deliberately: an operator hook that provisions
+  // unconditionally must not start running on every turn because it upgraded.
+  validateCached: z.boolean().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var prepareResultSchema = z.object({
@@ -136,7 +149,12 @@ var runPrepareHook = (hook, input) => {
           // CT317: newline-joined — workspace paths never contain a newline, so a
           // hook splits on `\n` unambiguously. Empty string when none.
           CABANE_TRIGGER_ENTRY_PATHS: input.triggerEntryPaths.join("\n"),
-          CABANE_CONVERSATION_TITLE: input.title ?? ""
+          CABANE_CONVERSATION_TITLE: input.title ?? "",
+          // CT943: the dispatching message's text, and — in validate mode only —
+          // the prepared result the hook is being asked to check this dispatch
+          // against. Both empty/absent on an ordinary first run.
+          CABANE_TRIGGER_MESSAGE: input.messageBody ?? "",
+          ...input.prepared ? { CABANE_PREPARED: JSON.stringify(input.prepared) } : {}
         }
       });
     } catch (err) {
@@ -174,6 +192,10 @@ var runPrepareHook = (hook, input) => {
           );
           return;
         }
+        if (input.prepared) {
+          resolve(input.prepared);
+          return;
+        }
         try {
           resolve(parsePrepareOutput(stdout));
         } catch (err) {
@@ -2555,8 +2577,7 @@ var claudeCodeDialectSchema = z9.object({
       display: z9.enum(["summarized", "omitted"]).optional()
     }),
     z9.object({ type: z9.literal("disabled") })
-  ]).optional(),
-  hostAccess: z9.boolean().optional()
+  ]).optional()
 }).loose();
 function readThinking(runtimeOptions) {
   const dialect = runtimeOptions?.["claude-code"];
@@ -2634,8 +2655,7 @@ function buildClaudeCodeOptions(req, augment) {
       alwaysLoad: true
     };
   }
-  const dialect = claudeCodeDialectSchema.safeParse(config.runtimeOptions?.["claude-code"] ?? {});
-  const useCodingPreset = dialect.success ? dialect.data.hostAccess ?? false : false;
+  const useCodingPreset = policy.hostFs;
   const cabaneGlob = `mcp__${CABANE_MCP_SERVER}__*`;
   const extraServerGlobs = Object.keys(req.extra.mcpServers).map((name) => `mcp__${name}__*`);
   const allowedTools = dedupe([
@@ -3512,7 +3532,7 @@ var OPENCODE_HOST_TOOLS = [
 var OPENCODE_WEB_TOOLS = ["webfetch"];
 var OPENCODE_SUBAGENT_TOOLS = ["task"];
 var OPENCODE_SCHEDULING_TOOLS = [];
-var OPENCODE_UI_PROMPT_TOOLS = [];
+var OPENCODE_UI_PROMPT_TOOLS = ["question"];
 function opencodeToolPolicy(policy) {
   const tools = {};
   const deny = (names) => {
@@ -4551,10 +4571,11 @@ function parseCodexModel(model) {
 var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
-function buildRunSpec2(req, resumeThreadId) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
+  const baseInstructionsFile = !policy.hostFs && instructionsFile ? instructionsFile : null;
   const model = config.model ? parseCodexModel(config.model) : null;
   if (model === null) {
     console.warn(
@@ -4568,19 +4589,21 @@ function buildRunSpec2(req, resumeThreadId) {
     policy: codexToolPolicy(policy),
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
-    input: buildInput(req),
-    config: buildConfig(req)
+    baseInstructionsFile,
+    input: buildInput(req, baseInstructionsFile !== null),
+    config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req) {
+function buildInput(req, promptRidesInstructionsFile) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
+  if (promptRidesInstructionsFile) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
 ${body}` : body;
 }
-function buildConfig(req) {
+function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
@@ -4638,6 +4661,10 @@ function buildConfig(req) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
+    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
+    // becomes Codex's base instructions, and Codex's own environment preamble goes
+    // with the harness prompt it belonged to.
+    ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...tmpDir ? { shell_environment_policy: { set: { TMPDIR: tmpDir } } } : {},
     ...policy.permissionProfile ? {
       // CT733: named permission profiles are Codex's split-filesystem path.
@@ -5256,19 +5283,48 @@ function createCodexAdapter(deps = {}) {
         );
       }
       const degraded = "fresh" in decision && decision.reason !== void 0 && decision.reason !== "no_session";
-      const spec = buildRunSpec2(req, resumeThreadId);
-      const result = await transport.run(spec, signal);
-      if (signal.aborted) return;
-      yield* decodeCodexStream(result.events, {
-        signal,
-        cwd: req.local.cwd,
-        resumedThreadId: resumeThreadId,
-        degraded,
-        // CT601: Codex reports no model in-stream, so record what the thread was
-        // started with (null on the default token). Same for the reasoning effort.
-        resolvedModel: spec.model,
-        resolvedReasoningEffort: spec.modelReasoningEffort ?? null
-      });
+      let instructions = null;
+      if (!req.policy.hostFs) {
+        if (!deps.writeInstructionsFile) {
+          deps.onWarn?.(
+            "codex adapter: no instructions-file writer wired on this host \u2014 the composed prompt rides as the input preamble, so Codex keeps its own base instructions (CT871)"
+          );
+        } else {
+          try {
+            instructions = await deps.writeInstructionsFile(req.systemPrompt);
+          } catch (err) {
+            deps.onWarn?.(
+              "codex adapter: failed to write the per-turn instructions file \u2014 falling back to the input preamble (CT871)",
+              { err: err instanceof Error ? err.message : String(err) }
+            );
+          }
+        }
+      }
+      try {
+        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const result = await transport.run(spec, signal);
+        if (signal.aborted) return;
+        yield* decodeCodexStream(result.events, {
+          signal,
+          cwd: req.local.cwd,
+          resumedThreadId: resumeThreadId,
+          degraded,
+          // CT601: Codex reports no model in-stream, so record what the thread was
+          // started with (null on the default token). Same for the reasoning effort.
+          resolvedModel: spec.model,
+          resolvedReasoningEffort: spec.modelReasoningEffort ?? null
+        });
+      } finally {
+        if (instructions) {
+          try {
+            await instructions.cleanup();
+          } catch (err) {
+            deps.onWarn?.("codex adapter: instructions-file cleanup failed (CT871)", {
+              err: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+      }
     }
   };
 }
@@ -5876,7 +5932,7 @@ var ConnectorHealthStore = class {
 // src/dispatcher.ts
 import { randomUUID } from "crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync9 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/summon.ts
 import { z as z12 } from "zod";
@@ -6155,17 +6211,34 @@ function trimSlash3(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
 
+// src/codex-instructions.ts
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+var PREFIX = "cabane-codex-instructions-";
+async function writeCodexInstructionsFile(contents) {
+  const dir2 = await mkdtemp(join9(tmpdir(), PREFIX));
+  const path3 = join9(dir2, "instructions.md");
+  await writeFile(path3, contents, { encoding: "utf8", mode: 384 });
+  return {
+    path: path3,
+    cleanup: async () => {
+      await rm(dir2, { recursive: true, force: true });
+    }
+  };
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function dirFor(workspaceId) {
-  return join9(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join10(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join9(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join10(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join9(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join10(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path3 = pathFor3(workspaceId, conversationId, agentId);
@@ -6194,11 +6267,11 @@ function writePrepared(workspaceId, conversationId, agentId, result) {
 
 // src/secrets.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { z as z13 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join10(cabaneDir(), "secrets.json");
+  return join11(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z13.record(z13.string(), z13.string());
 function loadSecretStore() {
@@ -6285,9 +6358,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync3, mkdirSync as mkdirSync8, readdirSync, rmSync as rmSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function transcriptsDir() {
-  return join11(cabaneDir(), "transcripts");
+  return join12(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var TranscriptWriter = class {
@@ -6296,7 +6369,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join11(dir2, fileName(meta));
+    this.path = join12(dir2, fileName(meta));
     try {
       mkdirSync8(dir2, { recursive: true });
       try {
@@ -6355,7 +6428,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync4(join11(dir2, f), { force: true });
+      rmSync4(join12(dir2, f), { force: true });
     } catch {
     }
   }
@@ -6827,6 +6900,41 @@ var Dispatcher = class {
       if (cached2) {
         effectiveCwd = cached2.cwd;
         hookEnv = cached2.env;
+        if (prepareHook.validateCached) {
+          const runHook = this.opts.prepareHookRunner ?? runPrepareHook;
+          try {
+            await runHook(prepareHook, {
+              workspaceId,
+              conversationId: payload.conversationId,
+              agentId: payload.agentId,
+              agentUsername: this.opts.agentUsername,
+              runtime: turnContext.runtime,
+              triggerEntryPaths: turnContext.conversation.triggerEntryPaths ?? [],
+              title: turnContext.conversation.title,
+              messageBody: message.body,
+              prepared: cached2
+            });
+          } catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            turnLog.error({ err: reason }, "dispatcher: prepare hook rejected a prepared turn");
+            try {
+              await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
+                body: `${PREPARE_FAILED_PREFIX}
+
+${reason}`,
+                kind: "final",
+                turnId,
+                parentMessageId: payload.messageId
+              });
+            } catch (postErr) {
+              turnLog.warn(
+                { err: postErr instanceof Error ? postErr.message : String(postErr) },
+                "dispatcher: prepare-rejection post failed"
+              );
+            }
+            return this.concludeBeforeRun(payload, turnLog, startedAt, `prepare_failed: ${reason}`);
+          }
+        }
       } else {
         const delayMs = this.opts.preparingRowDelayMs ?? DEFAULT_PREPARING_ROW_DELAY_MS;
         let preparingStarted = false;
@@ -6865,7 +6973,12 @@ var Dispatcher = class {
             // tasker prepare hook keys its per-task env off. Defaults to `[]` for
             // an older API. The conversation anchor is gone (CT319).
             triggerEntryPaths: turnContext.conversation.triggerEntryPaths ?? [],
-            title: turnContext.conversation.title
+            title: turnContext.conversation.title,
+            // CT943: the dispatching message's text — where an `env:` directive
+            // rides. The server has always sent the trigger body on the turn
+            // context (for the live feed); this is the first thing to read it as
+            // an INPUT, so a dispatch can ask for its environment in words.
+            messageBody: message.body
           });
           clearTimeout(preparingTimer);
           if (preparingStarted) reportPreparing("done");
@@ -6900,7 +7013,7 @@ ${reason}`,
     }
     let turnEnv = hookEnv;
     if (effectiveCwd && turnContext.runtime === "codex") {
-      const tmpDir = join12(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
+      const tmpDir = join13(effectiveCwd, "node_modules", ".cache", "cabane-tmp", turnId);
       try {
         mkdirSync9(tmpDir, { recursive: true });
         turnEnv = { ...hookEnv, TMPDIR: tmpDir };
@@ -6999,7 +7112,13 @@ ${reason}`,
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
     if (this.opts.codexEnabled) {
-      adapters.push(createCodexAdapter({ enabled: true, onWarn }));
+      adapters.push(
+        createCodexAdapter({
+          enabled: true,
+          onWarn,
+          writeInstructionsFile: writeCodexInstructionsFile
+        })
+      );
     }
     const registry = createAdapterRegistry(adapters);
     let adapter;
@@ -7042,10 +7161,10 @@ ${reason}`,
       );
       if (effectiveCwd) {
         try {
-          const diagnosticDir = join12(effectiveCwd, ".git", "cabane");
+          const diagnosticDir = join13(effectiveCwd, ".git", "cabane");
           mkdirSync9(diagnosticDir, { recursive: true });
           appendFileSync2(
-            join12(diagnosticDir, "readiness.jsonl"),
+            join13(diagnosticDir, "readiness.jsonl"),
             `${JSON.stringify({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               taskId: hookEnv.CABANE_TASK_ID,
@@ -7629,7 +7748,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -7642,10 +7761,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join13(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join14(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join13(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join14(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -7687,7 +7806,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join13(dir2, name);
+      const full = join14(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -8794,9 +8913,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function crashMarkerPath() {
-  return join14(cabaneDir(), "last-error.json");
+  return join15(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",