@cabane/companion 0.6.88 → 0.6.90

package/dist/cli.js

@@ -128,7 +128,7 @@ function parsePrepareOutput(stdout) {
   return { cwd: last };
 }
 var runPrepareHook = (hook, input) => {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const timeoutMs = hook.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     let settled = false;
     const finish = (fn) => {
@@ -202,11 +202,11 @@ var runPrepareHook = (hook, input) => {
           return;
         }
         if (input.prepared) {
-          resolve(input.prepared);
+          resolve2(input.prepared);
           return;
         }
         try {
-          resolve(parsePrepareOutput(stdout));
+          resolve2(parsePrepareOutput(stdout));
         } catch (err) {
           reject(err instanceof PrepareHookError ? err : new PrepareHookError(String(err)));
         }
@@ -321,9 +321,10 @@ var companionConfigSchema = z2.object({
   // The change this task exists for: Claude Code used to be the one harness a
   // device exposed with no configuration — a `claude --version` exit-0 was taken as
   // consent — and it is now the third config-driven harness, opted into exactly
-  // like codex. `claude` on PATH is still required (you can't run what isn't
-  // installed), but presence alone no longer exposes anything: the manifest
-  // advertises claude-code only when this block says so AND the binary is there.
+  // like codex. CT1379: the binary that must be there is the Agent SDK's own
+  // bundled executable — the file a turn actually launches — not the user's
+  // `claude` on PATH, which the SDK never runs. The manifest advertises
+  // claude-code only when this block says so AND that binary resolves.
   //
   // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
   // Absent means the config predates this task — a device whose user was never
@@ -343,9 +344,11 @@ var companionConfigSchema = z2.object({
   // not a server address. The operator installs Codex + logs in (`codex login`, or
   // `CODEX_API_KEY` — Cabane never sees the key) and sets `{ "codex": { "enabled":
   // true } }`. Presence of the block enables it (an explicit `enabled: false`
-  // keeps the block but turns it off). Enabling makes the device advertise the
-  // `codex` runtime on its heartbeat manifest AND registers the codex adapter in
-  // the dispatcher. Absent → the device doesn't offer codex, exactly as before.
+  // keeps the block but turns it off). Absent → the device doesn't offer codex.
+  // CT1379: enabling is now half the answer, not all of it — the manifest and the
+  // adapter registry additionally require the SDK's vendored `codex` binary to
+  // resolve, because the enable flag alone advertised a runtime a device with a
+  // half-installed platform package could not start.
   codex: z2.object({
     enabled: z2.boolean().optional()
   }).strict().optional()
@@ -523,18 +526,18 @@ async function startControlServer(handlers) {
     void serveConnection(socket, handlers);
   });
   server.unref();
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(path, () => {
       server.removeListener("error", reject);
-      resolve();
+      resolve2();
     });
   });
   if (process.platform !== "win32") {
     try {
       chmodSync2(path, 384);
     } catch (err) {
-      await new Promise((resolve) => server.close(() => resolve()));
+      await new Promise((resolve2) => server.close(() => resolve2()));
       try {
         rmSync2(path, { force: true });
       } catch {
@@ -546,10 +549,10 @@ async function startControlServer(handlers) {
   });
   return {
     path,
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve2) => {
       server.close(() => {
         if (process.platform !== "win32") rmSync2(path, { force: true });
-        resolve();
+        resolve2();
       });
     })
   };
@@ -599,12 +602,12 @@ function reply(socket, body) {
 async function controlRequest(path, req, timeoutMs = CONTROL_TIMEOUT_MS) {
   const socket = connect(path);
   try {
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => reject(new ControlTimeout()), timeoutMs);
       timer.unref?.();
       socket.once("connect", () => {
         clearTimeout(timer);
-        resolve();
+        resolve2();
       });
       socket.once("error", (err) => {
         clearTimeout(timer);
@@ -631,7 +634,7 @@ function isNotListening(err) {
   return code === "ENOENT" || code === "ECONNREFUSED";
 }
 function readLine(socket, timeoutMs) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let buf = "";
     let settled = false;
     const done = (v) => {
@@ -639,7 +642,7 @@ function readLine(socket, timeoutMs) {
       settled = true;
       clearTimeout(timer);
       socket.removeListener("data", onData);
-      resolve(v);
+      resolve2(v);
     };
     const timer = setTimeout(() => done(null), timeoutMs);
     timer.unref?.();
@@ -676,14 +679,14 @@ function parseVersionToken(raw) {
   return m ? m[0] : null;
 }
 function probeCliPresence(command, spawnImpl = spawn2) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     let timer = null;
     const done = (result) => {
       if (!settled) {
         settled = true;
         if (timer) clearTimeout(timer);
-        resolve(result);
+        resolve2(result);
       }
     };
     let child;
@@ -765,6 +768,203 @@ async function safe(fn) {
   }
 }
 
+// src/bundled-binaries.ts
+import { realpathSync, statSync } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname2, join as join3 } from "path";
+import { fileURLToPath } from "url";
+function nodeResolveSelf(specifier) {
+  const here = fileURLToPath(import.meta.url);
+  if (typeof import.meta.resolve === "function") {
+    try {
+      return fileURLToPath(import.meta.resolve(specifier));
+    } catch {
+    }
+  }
+  try {
+    return createRequire(here).resolve(specifier);
+  } catch {
+  }
+  return walkNodeModules(specifier, here);
+}
+function walkNodeModules(pkg2, fromPath) {
+  let dir2 = dirname2(fromPath);
+  for (; ; ) {
+    const manifest = join3(dir2, "node_modules", pkg2, "package.json");
+    if (nodeIsFile(manifest)) {
+      try {
+        return realpathSync(manifest);
+      } catch {
+        return manifest;
+      }
+    }
+    const parent = dirname2(dir2);
+    if (parent === dir2) return null;
+    dir2 = parent;
+  }
+}
+function nodeResolve(specifier, fromPath) {
+  try {
+    return createRequire(fromPath).resolve(specifier);
+  } catch {
+    return null;
+  }
+}
+function nodeIsFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function detectPreferMusl(platform = process.platform) {
+  if (platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  const header = report?.header;
+  return report != null && header?.glibcVersionRuntime === void 0;
+}
+function defaultResolveEnv() {
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    preferMusl: detectPreferMusl(),
+    // Both resolutions start from this module, which tsup bundles into
+    // `dist/cli.js` and `dist/postinstall.js` — both at the package's `dist/`
+    // root — so one environment serves the runtime checks and the install
+    // verifier alike.
+    resolveSelf: nodeResolveSelf,
+    resolve: nodeResolve,
+    isFile: nodeIsFile
+  };
+}
+var CLAUDE_SDK = "@anthropic-ai/claude-agent-sdk";
+function claudePlatformPackages(platform, arch, preferMusl) {
+  if (platform === "android") return [`${CLAUDE_SDK}-linux-${arch}-android`];
+  if (platform === "linux") {
+    return preferMusl ? [`${CLAUDE_SDK}-linux-${arch}-musl`, `${CLAUDE_SDK}-linux-${arch}`] : [`${CLAUDE_SDK}-linux-${arch}`, `${CLAUDE_SDK}-linux-${arch}-musl`];
+  }
+  return [`${CLAUDE_SDK}-${platform}-${arch}`];
+}
+function resolveClaude(env) {
+  const candidates = claudePlatformPackages(env.platform, env.arch, env.preferMusl);
+  const base = {
+    runtime: "claude-code",
+    packageName: candidates[0] ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  const sdkEntry = env.resolveSelf(CLAUDE_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  let sawPackage = null;
+  for (const pkg2 of candidates) {
+    const manifest = env.resolve(`${pkg2}/package.json`, sdkEntry);
+    if (!manifest) continue;
+    sawPackage ??= pkg2;
+    const exe = join3(dirname2(manifest), env.platform === "win32" ? "claude.exe" : "claude");
+    if (env.isFile(exe)) {
+      return { ...base, packageName: pkg2, status: "present", path: exe };
+    }
+  }
+  return sawPackage ? { ...base, packageName: sawPackage, status: "executable_missing", path: null } : { ...base, status: "platform_package_missing", path: null };
+}
+var CODEX_SDK = "@openai/codex-sdk";
+var CODEX_CLI = "@openai/codex";
+function codexTargetTriple(platform, arch) {
+  if (platform === "linux" || platform === "android") {
+    if (arch === "x64") return "x86_64-unknown-linux-musl";
+    if (arch === "arm64") return "aarch64-unknown-linux-musl";
+    return null;
+  }
+  if (platform === "darwin") {
+    if (arch === "x64") return "x86_64-apple-darwin";
+    if (arch === "arm64") return "aarch64-apple-darwin";
+    return null;
+  }
+  if (platform === "win32") {
+    if (arch === "x64") return "x86_64-pc-windows-msvc";
+    if (arch === "arm64") return "aarch64-pc-windows-msvc";
+    return null;
+  }
+  return null;
+}
+var CODEX_PACKAGE_BY_TRIPLE = {
+  "x86_64-unknown-linux-musl": `${CODEX_CLI}-linux-x64`,
+  "aarch64-unknown-linux-musl": `${CODEX_CLI}-linux-arm64`,
+  "x86_64-apple-darwin": `${CODEX_CLI}-darwin-x64`,
+  "aarch64-apple-darwin": `${CODEX_CLI}-darwin-arm64`,
+  "x86_64-pc-windows-msvc": `${CODEX_CLI}-win32-x64`,
+  "aarch64-pc-windows-msvc": `${CODEX_CLI}-win32-arm64`
+};
+function resolveCodex(env) {
+  const triple = codexTargetTriple(env.platform, env.arch);
+  const pkg2 = triple ? CODEX_PACKAGE_BY_TRIPLE[triple] : void 0;
+  const base = {
+    runtime: "codex",
+    packageName: pkg2 ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  if (!triple || !pkg2) return { ...base, status: "platform_package_missing", path: null };
+  const sdkEntry = env.resolveSelf(CODEX_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  const cliManifest = env.resolve(`${CODEX_CLI}/package.json`, sdkEntry);
+  if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
+  const platformManifest = env.resolve(`${pkg2}/package.json`, cliManifest);
+  if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
+  const packageRoot = join3(dirname2(platformManifest), "vendor", triple);
+  const exeName = env.platform === "win32" ? "codex.exe" : "codex";
+  const current = join3(packageRoot, "bin", exeName);
+  if (env.isFile(current) && env.isFile(join3(packageRoot, "codex-package.json"))) {
+    return { ...base, status: "present", path: current };
+  }
+  const legacy = join3(packageRoot, "codex", exeName);
+  if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
+  return { ...base, status: "executable_missing", path: null };
+}
+function resolveBundledBinary(runtime, env = defaultResolveEnv()) {
+  try {
+    return runtime === "codex" ? resolveCodex(env) : resolveClaude(env);
+  } catch {
+    return {
+      runtime,
+      status: "platform_package_missing",
+      path: null,
+      packageName: null,
+      platform: env.platform,
+      arch: env.arch
+    };
+  }
+}
+var HARNESS_LABEL = {
+  "claude-code": "Claude Code",
+  codex: "Codex"
+};
+var HARNESS_INTENT_WORD = {
+  "claude-code": "connected",
+  codex: "enabled"
+};
+function missingNoun(status2) {
+  return status2 === "executable_missing" ? "executable" : "platform package";
+}
+function repairCommands() {
+  return ["npm i -g @cabane/companion --include=optional"];
+}
+function repairAction() {
+  return `Reinstall with \`${repairCommands()[0]}\`.`;
+}
+function startupWarning(r) {
+  const label = HARNESS_LABEL[r.runtime];
+  return `warning: ${label} is ${HARNESS_INTENT_WORD[r.runtime]}, but @cabane/companion's bundled ${label} ${missingNoun(r.status)} is missing. It will not be offered to Cabane. ${repairAction()} Then restart the companion.`;
+}
+function harnessIssueNote(runtime, status2) {
+  const intent = HARNESS_INTENT_WORD[runtime];
+  const capitalized = `${intent[0].toUpperCase()}${intent.slice(1)}`;
+  return `${capitalized}, but @cabane/companion's bundled ${HARNESS_LABEL[runtime]} ${missingNoun(status2)} is missing. ${repairAction()} Then restart the companion.`;
+}
+function turnIncompleteCopy(runtime) {
+  return `**This device's ${HARNESS_LABEL[runtime]} runtime is incomplete.** ${repairAction()} Restart it, then try again.`;
+}
+
 // src/manifest.ts
 var DEVICE_MANIFEST = {
   runtimes: [{ name: "claude-code", version: null }],
@@ -776,7 +976,20 @@ function buildCompanionManifest(opts) {
   if (opts.claudeCode) runtimes.push({ name: "claude-code", version: v.claudeCode ?? null });
   if (opts.opencode) runtimes.push({ name: "opencode", version: v.opencode ?? null });
   if (opts.codex) runtimes.push({ name: "codex", version: v.codex ?? null });
-  return { runtimes, capabilities: { ...DEVICE_MANIFEST.capabilities } };
+  return {
+    runtimes,
+    capabilities: { ...DEVICE_MANIFEST.capabilities },
+    runtimeIssues: opts.runtimeIssues ?? []
+  };
+}
+function runtimeIssuesFor(gates) {
+  const issues = [];
+  for (const name of ["claude-code", "codex"]) {
+    const gate = name === "codex" ? gates.codex : gates.claudeCode;
+    if (!gate.intended || gate.bundled === "present") continue;
+    issues.push({ name, reason: gate.bundled });
+  }
+  return issues;
 }
 
 // src/harness-status.ts
@@ -798,11 +1011,12 @@ function parseHarnessRuntime(raw) {
 function deriveHarnessSnapshot(signals) {
   const advertised = new Set(
     buildCompanionManifest({
-      // CT1082: connected AND installed — the manifest's own rule, restated here
-      // through the same function rather than re-decided.
-      claudeCode: signals.claudeCodeConnected && signals.claudeOnPath,
+      // CT1082 + CT1379: connected AND the bundled binary the SDK launches is
+      // there — the manifest's own rule, restated here through the same function
+      // rather than re-decided. PATH is deliberately absent from both gates now.
+      claudeCode: signals.claudeCodeConnected && signals.claudeBundled === "present",
       opencode: signals.opencodeConfigured,
-      codex: signals.codexEnabled
+      codex: signals.codexEnabled && signals.codexBundled === "present"
     }).runtimes.map((r) => r.name)
   );
   const harnesses = [
@@ -828,7 +1042,7 @@ function deriveClaudeCode(signals, manifestHas) {
       ...base,
       state: "needs_attention",
       version: null,
-      detail: "Connected, but the `claude` CLI isn\u2019t on your PATH. Install it (`npm i -g @anthropic-ai/claude-code`) and sign in, or disconnect it.",
+      detail: harnessIssueNote("claude-code", signals.claudeBundled),
       enable: null
     };
   }
@@ -837,7 +1051,11 @@ function deriveClaudeCode(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.claudeVersion,
-      detail: "Claude Code is installed here but not connected yet. Connect it to let Cabane run Claude Code on this device.",
+      // CT1379: connecting records INTENT; it is not the same as becoming
+      // runnable. With the bundled binary missing, a connect succeeds and the
+      // device still advertises nothing — so this says so up front rather than
+      // promising routing it can't deliver.
+      detail: signals.claudeBundled === "present" ? "Claude Code is installed here but not connected yet. Connect it to offer Claude Code from this device." : `Claude Code is installed here but not connected yet \u2014 and @cabane/companion's bundled Claude Code ${missingNoun(signals.claudeBundled)} is missing, so connecting alone won't make it runnable. ${repairAction()}`,
       enable: "claude-code"
     };
   }
@@ -852,20 +1070,20 @@ function deriveClaudeCode(signals, manifestHas) {
 function deriveCodex(signals, manifestHas) {
   const base = { runtime: "codex", label: LABELS.codex };
   if (manifestHas) {
-    if (signals.codexOnPath) {
-      return {
-        ...base,
-        state: "exposed",
-        version: signals.codexVersion,
-        detail: "Codex is enabled and exposed to Cabane.",
-        enable: null
-      };
-    }
+    return {
+      ...base,
+      state: "exposed",
+      version: signals.codexVersion,
+      detail: "Codex is enabled and exposed to Cabane.",
+      enable: null
+    };
+  }
+  if (signals.codexEnabled) {
     return {
       ...base,
       state: "needs_attention",
       version: null,
-      detail: "Enabled, but the `codex` CLI isn\u2019t on your PATH. Install it and sign in (`codex login`), or turn Codex off.",
+      detail: harnessIssueNote("codex", signals.codexBundled),
       enable: null
     };
   }
@@ -874,7 +1092,9 @@ function deriveCodex(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.codexVersion,
-      detail: "Codex is installed but not exposed yet. Turn it on to let Cabane run Codex here.",
+      // CT1379: same distinction as Claude Code — enabling is intent, not
+      // launchability.
+      detail: signals.codexBundled === "present" ? "Codex is installed but not enabled yet. Turn it on to offer Codex from this device." : `Codex is installed but not enabled yet \u2014 and @cabane/companion's bundled Codex ${missingNoun(signals.codexBundled)} is missing, so enabling alone won't make it runnable. ${repairAction()}`,
       enable: "codex"
     };
   }
@@ -941,6 +1161,7 @@ async function resolveOpencodeServerUrl(configuredServerUrl, requestedServerUrl,
 async function probeHarnessSignals(cfg, deps = {}) {
   const probePresence = deps.probePresence ?? probeHarnessPresence;
   const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
+  const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const configuredServerUrl = cfg.opencode?.serverUrl;
   const opencodeProbeUrl = configuredServerUrl ?? DEFAULT_OPENCODE_SERVER_URL;
   const [claudePresence, codexPresence, opencodeVersion] = await Promise.all([
@@ -956,6 +1177,11 @@ async function probeHarnessSignals(cfg, deps = {}) {
     // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
     // the manifest gate and the probe above is only a suggestion.
     claudeCodeConnected: isClaudeCodeConnected(cfg),
+    // CT1379: the executable a Claude turn actually launches. Resolved every time
+    // the signals are, so a binary that disappears between beats is caught on the
+    // next one rather than at turn time.
+    claudeBundled: resolveBundled("claude-code").status,
+    codexBundled: resolveBundled("codex").status,
     // A parseable `codex --version` is our presence signal (presence alone never
     // exposes codex; its config flag is the manifest gate either way).
     codexOnPath: codexVersion !== null,
@@ -969,12 +1195,12 @@ async function probeHarnessSignals(cfg, deps = {}) {
   };
 }
 function withTimeout(promise, fallback, timeoutMs = PROBE_TIMEOUT_MS) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const done = (v) => {
       if (!settled) {
         settled = true;
-        resolve(v);
+        resolve2(v);
       }
     };
     const timer = setTimeout(() => done(fallback), timeoutMs);
@@ -1052,19 +1278,19 @@ function looksUnsupported(output) {
   );
 }
 function runBounded(command, args) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const done = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve(result);
+      resolve2(result);
     };
     let child;
     try {
       child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve({ code: null, output: "", error: "spawn" });
+      resolve2({ code: null, output: "", error: "spawn" });
       return;
     }
     let out = "";
@@ -1093,10 +1319,10 @@ import {
   openSync,
   closeSync
 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var PROBE_TIMEOUT_MS2 = 1e3;
 function runtimePath() {
-  return join3(cabaneDir(), "runtime.json");
+  return join4(cabaneDir(), "runtime.json");
 }
 function serialize(state) {
   return JSON.stringify(state, null, 2) + "\n";
@@ -1255,8 +1481,8 @@ var Spinner = class {
 async function confirm(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = await new Promise((resolve) => {
-      rl.question(`${INDENT}${question} [Y/n] `, resolve);
+    const answer = await new Promise((resolve2) => {
+      rl.question(`${INDENT}${question} [Y/n] `, resolve2);
     });
     return !/^n(o)?$/i.test(answer.trim());
   } finally {
@@ -1378,10 +1604,10 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { z as z3 } from "zod";
 function credentialsPath() {
-  return join4(cabaneDir(), "credentials.json");
+  return join5(cabaneDir(), "credentials.json");
 }
 var credentialStoreSchema = z3.record(z3.string(), z3.string());
 function load() {
@@ -1403,7 +1629,7 @@ function load() {
 }
 function save(map) {
   const path = credentialsPath();
-  mkdirSync4(dirname2(path), { recursive: true });
+  mkdirSync4(dirname3(path), { recursive: true });
   try {
     chmodSync3(cabaneDir(), 448);
   } catch {
@@ -1548,7 +1774,7 @@ function deviceLabelFromHostname(hostname3) {
 function pollOnce(baseUrl, deviceCode) {
   return postJson(baseUrl, "/api/device-enrollment/poll", { deviceCode });
 }
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
 async function runDeviceFlow(baseUrl, print, opts = {}) {
   if (opts.signal?.aborted) throw new EnrollmentCancelledError();
   const code = await requestEnrollmentCode(baseUrl, {
@@ -1674,11 +1900,11 @@ import { hostname as hostname2 } from "os";
 
 // src/logger.ts
 import { createWriteStream, mkdirSync as mkdirSync5 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import pino from "pino";
 import pretty from "pino-pretty";
 function companionLogPath() {
-  return join5(cabaneDir(), "companion.log");
+  return join6(cabaneDir(), "companion.log");
 }
 var CONSOLE_IGNORE = [
   "pid",
@@ -1706,7 +1932,7 @@ function setConsoleLogging(enabled) {
 }
 function createLogger(destinations = {}) {
   const path = companionLogPath();
-  if (!destinations.file) mkdirSync5(dirname3(path), { recursive: true });
+  if (!destinations.file) mkdirSync5(dirname4(path), { recursive: true });
   const streams = [];
   if (process.env.CABANE_COMPANION_DAEMON !== "1") {
     const consoleStream = pretty({
@@ -1740,15 +1966,15 @@ function getLogger() {
 import { randomUUID as randomUUID4 } from "crypto";
 
 // src/dashboard/server.ts
-import { dirname as dirname4, join as join7 } from "path";
-import { fileURLToPath } from "url";
+import { dirname as dirname5, join as join8 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 
 // src/dashboard/routes.ts
 import { openSync as openSync2, readSync, closeSync as closeSync2, fstatSync, existsSync as existsSync5 } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join6, normalize } from "path";
+import { extname, join as join7, normalize } from "path";
 import { streamSSE } from "hono/streaming";
 
 // src/state.ts
@@ -1997,13 +2223,13 @@ var CONTENT_TYPES = {
 function registerRoutes(app, deps) {
   const { supervisor, hub, staticDir } = deps;
   app.get("/", async (c) => {
-    const html = await readFile(join6(staticDir, "index.html"), "utf8");
+    const html = await readFile(join7(staticDir, "index.html"), "utf8");
     return c.html(html);
   });
   app.get("/static/:file", async (c) => {
     const file = c.req.param("file");
     const safe3 = normalize(file).replace(/^(\.\.[/\\])+/, "");
-    const full = join6(staticDir, safe3);
+    const full = join7(staticDir, safe3);
     if (!full.startsWith(staticDir) || !existsSync5(full)) return c.notFound();
     const body = await readFile(full);
     const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
@@ -2103,8 +2329,8 @@ function registerRoutes(app, deps) {
       while (!stream.aborted) {
         if (queue.length === 0) {
           await Promise.race([
-            new Promise((resolve) => {
-              wake = resolve;
+            new Promise((resolve2) => {
+              wake = resolve2;
             }),
             stream.sleep(25e3)
           ]);
@@ -2188,8 +2414,8 @@ async function startDashboard(opts) {
       return {
         url,
         port,
-        close: () => new Promise((resolve) => {
-          server.close(() => resolve());
+        close: () => new Promise((resolve2) => {
+          server.close(() => resolve2());
           server.closeAllConnections?.();
         })
       };
@@ -2206,12 +2432,12 @@ async function startDashboard(opts) {
   );
 }
 function listen(app, port) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port }, () => {
       if (!settled) {
         settled = true;
-        resolve(server);
+        resolve2(server);
       }
     });
     server.on("error", (err) => {
@@ -2226,7 +2452,7 @@ function isAddrInUse(err) {
   return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
 }
 function resolveStaticDir() {
-  return join7(dirname4(fileURLToPath(import.meta.url)), "static");
+  return join8(dirname5(fileURLToPath2(import.meta.url)), "static");
 }
 
 // src/prereqs.ts
@@ -2251,6 +2477,7 @@ async function requireStartConfig(deps = {}) {
 async function warnAboutHarnessReadiness(cfg, deps = {}) {
   const probeClaude = deps.probeClaude ?? claudeOnPath;
   const probeCodex = deps.probeCodex ?? codexOnPath;
+  const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
 `));
   const connected = [
@@ -2259,25 +2486,42 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
     ...cfg.opencode ? ["opencode"] : []
   ];
   if (connected.length > 0) {
-    if (isClaudeCodeConnected(cfg) && !await probeClaude()) {
-      warn(
-        "warning: Claude Code is connected on this device but `claude` isn\u2019t on your PATH, so it advertises nothing and a Claude-model agent won\u2019t be routed here. Install it (`npm i -g @anthropic-ai/claude-code`) and log in, or disconnect it."
-      );
+    for (const runtime of ["claude-code", "codex"]) {
+      const intended = runtime === "codex" ? isCodexEnabled(cfg) : isClaudeCodeConnected(cfg);
+      if (!intended) continue;
+      const resolution = resolveBundled(runtime);
+      if (resolution.status !== "present") warn(startupWarning(resolution));
     }
     return;
   }
   const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
-  const installed = [
-    ...claudeInstalled ? ["Claude Code"] : [],
-    ...codexInstalled ? ["Codex"] : []
-  ];
-  const connectCommands = [
-    ...claudeInstalled ? ["`cabane-companion connect claude-code`"] : [],
-    ...codexInstalled ? ["`cabane-companion connect codex`"] : []
+  const found = [
+    ...claudeInstalled ? [
+      {
+        label: "Claude Code",
+        command: "`cabane-companion connect claude-code`",
+        bundled: resolveBundled("claude-code").status
+      }
+    ] : [],
+    ...codexInstalled ? [
+      {
+        label: "Codex",
+        command: "`cabane-companion connect codex`",
+        bundled: resolveBundled("codex").status
+      }
+    ] : []
   ];
-  warn(
-    "No harness is connected on this device yet, so no agent turn can run here. " + (installed.length > 0 ? `We found ${installed.join(" and ")} on this machine \u2014 connect ${installed.length > 1 ? "one with " : "it with "}${connectCommands.join(" or ")} and turns start routing here.` : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).")
-  );
+  const runnable = found.filter((h) => h.bundled === "present");
+  const incomplete = found.filter((h) => h.bundled !== "present");
+  const incompleteNote = incomplete.map(
+    (h) => `${h.label} is installed here, but @cabane/companion's bundled ${h.label} ${missingNoun(h.bundled)} is missing, so connecting it alone won't make it runnable.`
+  ).join(" ");
+  const guidance = runnable.length > 0 ? `We found ${runnable.map((h) => h.label).join(" and ")} on this machine \u2014 connect ${runnable.length > 1 ? "one with " : "it with "}${runnable.map((h) => h.command).join(" or ")} and turns start routing here.${incompleteNote ? ` ${incompleteNote} ${repairAction()}` : ""}` : incomplete.length > 0 ? (
+    // Their machine is fine; this companion's install is not. Repair that,
+    // then connect — no "install a harness" they already have.
+    `${incompleteNote} ${repairAction()} Then connect it with ${incomplete.map((h) => h.command).join(" or ")}.`
+  ) : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).";
+  warn(`No harness is connected on this device yet, so no agent turn can run here. ${guidance}`);
 }
 
 // src/supervisor.ts
@@ -2457,10 +2701,22 @@ var CabaneApi = class {
   // token whose turn has ended. The dispatcher mints it before this call and
   // reuses the same value on its active-run PATCH, so the token's turn id and the
   // pair's `active_turn_id` agree.
-  getTurnContext(conversationId, messageId2, turnId) {
-    const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "");
+  // CT1380: `resumed` says this dispatch is a REPLAY of an interrupted turn, so
+  // the server should hand back `turnSeqFloor` — the turn's committed seq
+  // high-water mark. Only the supervisor knows (it minted the id or recovered
+  // it), so it is passed down rather than inferred here. It gates the COST of
+  // the aggregate, never the tenancy scoping, which the route applies
+  // unconditionally.
+  getTurnContext(conversationId, messageId2, turnId, resumed) {
+    const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "");
     return this.request("GET", `/api/agent/turn-context?${q}`);
   }
+  // CT1380: the local half of a resumed turn's seq floor (see
+  // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
+  // test has no durable queue, so nothing can be hiding in it.
+  outboxMaxSeqForTurn(turnId) {
+    return this.opts.outbox?.maxSeqForTurn(turnId) ?? 0;
+  }
   // CT714: read a turn's recorded turn-control intent. An EXTERNAL adapter
   // (Codex / opencode) records `reply_to` / `skip_turn` into `turn_intents`
   // server-side (the URL MCP surface) rather than the dispatcher's in-memory
@@ -2743,15 +2999,15 @@ function isAbortError(err) {
   return err instanceof Error && err.name === "AbortError";
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) return resolve();
+  return new Promise((resolve2) => {
+    if (signal?.aborted) return resolve2();
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
-      resolve();
+      resolve2();
     };
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -2834,9 +3090,9 @@ function errorMessage2(status2, body) {
 
 // src/cursor.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function pathFor(workspaceId) {
-  return join8(cabaneDir(), "cursors", encodeURIComponent(workspaceId));
+  return join9(cabaneDir(), "cursors", encodeURIComponent(workspaceId));
 }
 function readCursor(workspaceId) {
   const path = pathFor(workspaceId);
@@ -2846,7 +3102,7 @@ function readCursor(workspaceId) {
 }
 function writeCursor(workspaceId, eventId) {
   const path = pathFor(workspaceId);
-  mkdirSync6(join8(cabaneDir(), "cursors"), { recursive: true });
+  mkdirSync6(join9(cabaneDir(), "cursors"), { recursive: true });
   writeFileSync4(path, eventId + "\n", "utf8");
 }
 
@@ -2891,13 +3147,13 @@ var CursorTracker = class {
 
 // src/dispatch-dedupe.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
-  return join9(cabaneDir(), log);
+  return join10(cabaneDir(), log);
 }
 function pathFor2(log, workspaceId) {
-  return join9(dir(log), encodeURIComponent(workspaceId));
+  return join10(dir(log), encodeURIComponent(workspaceId));
 }
 function readIds(log, workspaceId) {
   const path = pathFor2(log, workspaceId);
@@ -2934,10 +3190,10 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join9(cabaneDir(), "resume-attempts");
+  return join10(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join9(resumeDir(), encodeURIComponent(workspaceId));
+  return join10(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
@@ -2973,10 +3229,10 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join9(cabaneDir(), "turns");
+  return join10(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join9(turnDir(), encodeURIComponent(workspaceId));
+  return join10(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
@@ -5351,7 +5607,7 @@ var serverTurnTails = /* @__PURE__ */ new Map();
 async function acquireServerTurnLock(url) {
   const prev = serverTurnTails.get(url) ?? Promise.resolve();
   let release;
-  const done = new Promise((resolve) => release = resolve);
+  const done = new Promise((resolve2) => release = resolve2);
   serverTurnTails.set(url, done);
   await prev.catch(() => {
   });
@@ -7590,8 +7846,8 @@ var ConnectorHealthStore = class {
 };
 
 // src/dispatcher.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join15 } from "path";
 
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
@@ -7953,11 +8209,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join10(tmpdir(), PREFIX));
-  const path = join10(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
+  const path = join11(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -7967,17 +8223,86 @@ async function writeCodexInstructionsFile(contents) {
   };
 }
 
+// src/api-error-shape.ts
+var LEASE_REFUSALS = /* @__PURE__ */ new Set([
+  "dispatch_not_admitted",
+  "turn_already_ended",
+  "turn_belongs_elsewhere"
+]);
+function apiErrorCode(err) {
+  if (!(err instanceof ApiError)) return null;
+  const body = err.body;
+  return typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
+}
+function leaseRefusal(err) {
+  const code = apiErrorCode(err);
+  if (code && LEASE_REFUSALS.has(code)) return code;
+  return null;
+}
+function isWriteFenceRefusal(err) {
+  return err instanceof ApiError && err.status === 409 && apiErrorCode(err) === "not_running";
+}
+var ERROR_BODY_LOG_CAP = 2e3;
+function describeErrorBody(body) {
+  if (body === void 0 || body === null) return void 0;
+  let text;
+  if (typeof body === "string") {
+    text = body;
+  } else {
+    try {
+      text = JSON.stringify(body);
+    } catch {
+      text = String(body);
+    }
+  }
+  if (text.length === 0) return void 0;
+  return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
+}
+
+// src/turn-seq-floor.ts
+var SeqFloorUnavailable = class extends Error {
+  constructor(detail) {
+    super(`seq_floor_unavailable: ${detail}`);
+    this.detail = detail;
+    this.name = "SeqFloorUnavailable";
+  }
+  detail;
+};
+function resolveSeqFloor(sources, ctx) {
+  const { serverFloor, outboxFloor } = sources;
+  if (serverFloor === void 0) {
+    throw new SeqFloorUnavailable("server sent no committed floor for a resumed turn");
+  }
+  const floor = Math.max(serverFloor, outboxFloor);
+  ctx.log.info(
+    { turnId: ctx.turnId, floor, outboxFloor, serverFloor },
+    "companion: resumed turn \u2014 seq counter seeded above its committed high-water mark"
+  );
+  return floor;
+}
+function readOutboxFloor(read, turnId, log) {
+  try {
+    return read(turnId);
+  } catch (err) {
+    log.error(
+      { turnId, err: err instanceof Error ? err.message : String(err) },
+      "companion: the on-disk outbox floor is unreadable; refusing to resume"
+    );
+    throw new SeqFloorUnavailable("outbox unreadable");
+  }
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function dirFor(workspaceId) {
-  return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join11(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join11(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor3(workspaceId, conversationId, agentId);
@@ -8009,11 +8334,11 @@ function clearPrepared(workspaceId, conversationId, agentId) {
 
 // src/secrets.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { z as z14 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join12(cabaneDir(), "secrets.json");
+  return join13(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z14.record(z14.string(), z14.string());
 function loadSecretStore() {
@@ -8100,9 +8425,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname5, join as join13 } from "path";
+import { basename, dirname as dirname6, join as join14 } from "path";
 function transcriptsDir() {
-  return join13(cabaneDir(), "transcripts");
+  return join14(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var ANOMALY_RETAIN = 50;
@@ -8112,7 +8437,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join13(dir2, fileName(meta));
+    this.path = join14(dir2, fileName(meta));
     try {
       mkdirSync9(dir2, { recursive: true });
       try {
@@ -8141,10 +8466,10 @@ var TranscriptWriter = class {
   preserveAnomaly() {
     if (this.broken) return;
     try {
-      const dir2 = join13(dirname5(this.path), "anomalies");
+      const dir2 = join14(dirname6(this.path), "anomalies");
       mkdirSync9(dir2, { recursive: true, mode: 448 });
       chmodSync4(dir2, 448);
-      const target = join13(dir2, basename(this.path));
+      const target = join14(dir2, basename(this.path));
       copyFileSync(this.path, target);
       chmodSync4(target, 384);
       pruneOld(dir2, ANOMALY_RETAIN);
@@ -8190,7 +8515,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync6(join13(dir2, f), { force: true });
+      rmSync6(join14(dir2, f), { force: true });
     } catch {
     }
   }
@@ -8337,6 +8662,84 @@ var TurnCommitter = class {
   }
 };
 
+// src/turn-runtime-integrity.ts
+function bundledHarnessFor(runtime) {
+  return runtime === "claude-code" || runtime === "codex" ? runtime : null;
+}
+function resolve(ctx, harness) {
+  return (ctx.resolveBundled ?? resolveBundledBinary)(harness);
+}
+async function postIncompleteNotice(ctx, harness, resolution) {
+  try {
+    await ctx.postTurnMessage(ctx.workspaceId, ctx.conversationId, {
+      body: turnIncompleteCopy(harness),
+      kind: "final",
+      turnId: ctx.turnId,
+      parentMessageId: ctx.parentMessageId
+    });
+    return true;
+  } catch (err) {
+    ctx.log.warn(
+      { err: err instanceof Error ? err.message : String(err) },
+      "dispatcher: runtime-incomplete notice post failed"
+    );
+    return false;
+  }
+}
+async function checkBundledBinary(ctx) {
+  const harness = bundledHarnessFor(ctx.runtime);
+  if (!harness) return null;
+  const resolution = resolve(ctx, harness);
+  if (resolution.status === "present") return null;
+  ctx.log.error(
+    {
+      runtime: harness,
+      status: resolution.status,
+      platform: resolution.platform,
+      arch: resolution.arch
+    },
+    "dispatcher: bundled harness binary missing at dispatch"
+  );
+  return {
+    harness,
+    reason: `runtime_incomplete:${harness}`,
+    posted: await postIncompleteNotice(ctx, harness, resolution)
+  };
+}
+async function reclassifyThrow(ctx, opts) {
+  const harness = bundledHarnessFor(ctx.runtime);
+  if (!harness || opts.aborted) return null;
+  const resolution = resolve(ctx, harness);
+  if (resolution.status === "present") return null;
+  ctx.log.error(
+    {
+      runtime: harness,
+      status: resolution.status,
+      platform: resolution.platform,
+      arch: resolution.arch,
+      originalReason: opts.originalReason
+    },
+    "dispatcher: adapter threw and the bundled harness binary is missing \u2014 reporting the incomplete runtime"
+  );
+  return {
+    harness,
+    reason: `runtime_incomplete:${harness}`,
+    posted: await postIncompleteNotice(ctx, harness, resolution)
+  };
+}
+async function guardBundledBinary(ctx, concluded, outcome) {
+  const incomplete = await checkBundledBinary(ctx);
+  if (!incomplete) return;
+  outcome.runtimeIncomplete = incomplete.posted;
+  throw incomplete.posted ? concluded(incomplete.reason) : concluded(incomplete.reason, incomplete.reason);
+}
+async function absorbBundledLoss(ctx, aborted, outcome) {
+  const lost = await reclassifyThrow(ctx, { aborted, originalReason: outcome.resultReason });
+  if (!lost) return false;
+  outcome.resultReason = lost.reason;
+  return lost.posted;
+}
+
 // src/turn-execution.ts
 var PREPARING_TOOL_NAME = "preparing";
 var PREPARE_FAILED_PREFIX = "**Couldn't prepare your environment.** I wasn't able to provision a working directory for this conversation, so I can't run this turn. The provisioning command reported:";
@@ -8349,40 +8752,6 @@ var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_AGENT_TOTAL_TIMEOUT_MS = 6 * 60 * 6e4;
 var DEFAULT_LEASE_RENEWAL_MS = 3e4;
-var LEASE_REFUSALS = /* @__PURE__ */ new Set([
-  "dispatch_not_admitted",
-  "turn_already_ended",
-  "turn_belongs_elsewhere"
-]);
-function apiErrorCode(err) {
-  if (!(err instanceof ApiError)) return null;
-  const body = err.body;
-  return typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
-}
-function leaseRefusal(err) {
-  const code = apiErrorCode(err);
-  if (code && LEASE_REFUSALS.has(code)) return code;
-  return null;
-}
-function isWriteFenceRefusal(err) {
-  return err instanceof ApiError && err.status === 409 && apiErrorCode(err) === "not_running";
-}
-var ERROR_BODY_LOG_CAP = 2e3;
-function describeErrorBody(body) {
-  if (body === void 0 || body === null) return void 0;
-  let text;
-  if (typeof body === "string") {
-    text = body;
-  } else {
-    try {
-      text = JSON.stringify(body);
-    } catch {
-      text = String(body);
-    }
-  }
-  if (text.length === 0) return void 0;
-  return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
-}
 function initialOutcome() {
   return {
     sessionWritten: false,
@@ -8401,7 +8770,8 @@ function initialOutcome() {
     settledDiagnostics: null,
     silentMarkerEmitted: false,
     timeoutReason: null,
-    leaseLost: false
+    leaseLost: false,
+    runtimeIncomplete: false
   };
 }
 var TurnConcluded = class {
@@ -8417,6 +8787,7 @@ var TurnExecution = class {
     this.opts = opts;
     this.supervisor = supervisor;
     this.payload = payload;
+    this.resumed = handleOpts.resumed === true;
     this.dispatchId = payload.messageId;
     this.workspaceId = opts.workspaceId;
     this.turnLog = opts.log.child({
@@ -8439,7 +8810,13 @@ var TurnExecution = class {
   outcome = initialOutcome();
   seqCounter = 0;
   // CT11: per-turn monotonic counter mirroring the in-process dispatcher's.
+  //
+  // CT1380: 0 for a NEW turn only — a resume is seeded in `fetchContext` first.
   nextSeq = () => ++this.seqCounter;
+  // CT1380: a REPLAY, told to us by the supervisor — not derivable here, since
+  // `turnId` is set on every dispatch. `resumedFromSeq` is what it seeded from.
+  resumed;
+  resumedFromSeq;
   turnContext;
   resolvedMcpServers;
   effectiveCwd;
@@ -8485,6 +8862,10 @@ var TurnExecution = class {
       await this.acquireLease();
       await this.selectAdapter();
     } catch (err) {
+      if (err instanceof SeqFloorUnavailable) {
+        this.supervisor.releaseAbort(this.turnId, this.abortController);
+        return this.concludeBeforeRun(err.message, err.message);
+      }
       if (err instanceof TurnConcluded) {
         this.supervisor.releaseAbort(this.turnId, this.abortController);
         return this.admitted ? this.concludeAdmittedRun(err.reason, err.errorReason) : this.concludeBeforeRun(err.reason, err.errorReason);
@@ -8541,7 +8922,9 @@ var TurnExecution = class {
       activeRunStartedAt: null,
       turnId,
       settledMessageId: payload.messageId,
-      outcome: errorReason ? "failed" : "settled"
+      // CT1379: `runtimeIncomplete` is a real failure that deliberately carries
+      // no `errorReason`, so the inference alone would read it as settled.
+      outcome: errorReason || this.outcome.runtimeIncomplete ? "failed" : "settled"
     };
     if (errorReason) body.errorReason = errorReason.slice(0, 200);
     try {
@@ -8563,12 +8946,14 @@ var TurnExecution = class {
   }
   async fetchContext() {
     const { payload, turnId, turnLog } = this;
+    const outboxFloor = this.resumed ? readOutboxFloor((id) => this.opts.api.outboxMaxSeqForTurn(id), turnId, turnLog) : 0;
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
         payload.conversationId,
         payload.messageId,
-        turnId
+        turnId,
+        this.resumed
       );
     } catch (err) {
       const status2 = err instanceof ApiError ? err.status : 0;
@@ -8585,6 +8970,11 @@ var TurnExecution = class {
       throw this.concluded(fetchReason, fetchReason);
     }
     this.turnContext = turnContext;
+    if (this.resumed) {
+      const sources = { serverFloor: turnContext.turnSeqFloor, outboxFloor };
+      this.resumedFromSeq = resolveSeqFloor(sources, { turnId, log: turnLog });
+      this.seqCounter = Math.max(this.seqCounter, this.resumedFromSeq);
+    }
   }
   gateTrigger() {
     const { payload, turnLog } = this;
@@ -8815,6 +9205,8 @@ ${reason}`,
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        // CT1380: the durable record that this turn resumed, and from where.
+        ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT33: hand the server this turn's id so the new-run chokepoint's
         // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
         // already emitted a "preparing" activity row for this turn above (it
@@ -8872,8 +9264,21 @@ ${reason}`,
       ...this.opts.local.claudeCode ? { claudeCode: this.opts.local.claudeCode } : {}
     });
   }
+  integrityContext() {
+    return {
+      runtime: this.turnContext.runtime,
+      workspaceId: this.workspaceId,
+      conversationId: this.payload.conversationId,
+      turnId: this.turnId,
+      parentMessageId: this.payload.messageId,
+      log: this.turnLog,
+      postTurnMessage: (workspaceId, conversationId, body) => this.opts.api.postTurnMessage(workspaceId, conversationId, body),
+      ...this.opts.resolveBundled ? { resolveBundled: this.opts.resolveBundled } : {}
+    };
+  }
   async selectAdapter() {
     const { payload, workspaceId, turnId, turnLog } = this;
+    await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
     const onWarn = (msg, meta) => turnLog.warn(meta ?? {}, msg);
     const adapters = [];
     if (this.opts.claudeCodeAvailable?.() ?? true) {
@@ -8882,7 +9287,7 @@ ${reason}`,
     if (this.opts.opencodeServerUrl) {
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
-    if (this.opts.codexEnabled) {
+    if (this.opts.codexAvailable?.() ?? false) {
       adapters.push(
         createCodexAdapter({
           enabled: true,
@@ -9166,6 +9571,11 @@ ${reason}`,
       o.okResult = false;
       o.resultReason = err instanceof Error ? err.message : String(err);
       turnLog.error({ err: o.resultReason }, "dispatcher: SDK query threw");
+      o.runtimeIncomplete = await absorbBundledLoss(
+        this.integrityContext(),
+        abortController.signal.aborted,
+        o
+      );
     } finally {
       this.disarmWatchdogs();
       if (o.leaseLost) {
@@ -9214,13 +9624,13 @@ ${reason}`,
       if (o.turnResolvedConfig && Object.keys(o.turnResolvedConfig).length > 0) {
         body.resolvedConfig = o.turnResolvedConfig;
       }
-      if (!o.okResult && o.resultReason && o.resultReason !== "cancelled" && !userCancelled && !o.leaseLost && !this.skipState.skipped) {
+      if (!o.okResult && o.resultReason && o.resultReason !== "cancelled" && !userCancelled && !o.leaseLost && !o.runtimeIncomplete && !this.skipState.skipped) {
         body.errorReason = o.resultReason.slice(0, 200);
       }
       if (o.okResult) {
         body.lastSeenMessageId = payload.messageId;
       }
-      body.outcome = o.okResult ? "settled" : body.errorReason ? "failed" : "interrupted";
+      body.outcome = o.okResult ? "settled" : body.errorReason || o.runtimeIncomplete ? "failed" : "interrupted";
       if (o.sessionDegraded) {
         body.degraded = true;
       }
@@ -9345,15 +9755,15 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join14(cwd, ".git");
+  const gitPath = join15(cwd, ".git");
   if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
-    stat = statSync(gitPath);
+    stat = statSync2(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync11(join14(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync11(join15(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -9488,7 +9898,7 @@ import {
   rmSync as rmSync7,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -9501,10 +9911,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join15(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join16(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join15(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -9546,7 +9956,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join15(dir2, name);
+      const full = join16(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -9563,6 +9973,35 @@ var Outbox = class {
     );
     return entries;
   }
+  // CT1380: the highest `seq` this turn has queued but not yet delivered — the
+  // half of a resumed turn's seq floor the SERVER CANNOT SEE. A commit that
+  // failed transiently before the crash is sitting in this directory with its
+  // seq already spent, and the restart's drain is fire-and-forget
+  // (`drain.kick()`, never awaited), so `maxSeqForTurn` on the server can report
+  // below it and the resumed run would mint that number a second time.
+  //
+  // Reads the directory rather than `list()` because only the filename matters:
+  // `<turnId>__<seq>.json` carries both halves of the key, so a corrupt body
+  // can't hide a spent seq from the floor. Returns 0 for a turn with nothing
+  // queued, which is the overwhelmingly common case.
+  // THROWS rather than returning 0 when the directory exists but cannot be
+  // read. 0 is a claim ("this turn has nothing queued"), and an unreadable
+  // directory cannot support it — a queued entry holding seq N would be
+  // invisible and the resumed run would mint N again. A missing directory is
+  // different: it is positive evidence that nothing was ever queued here.
+  maxSeqForTurn(turnId) {
+    const dir2 = this.dir();
+    if (!existsSync12(dir2)) return 0;
+    const names = readdirSync3(dir2);
+    const prefix = `${encodeURIComponent(turnId)}__`;
+    let max = 0;
+    for (const name of names) {
+      if (!name.startsWith(prefix) || !name.endsWith(".json")) continue;
+      const seq = Number(name.slice(prefix.length, -".json".length));
+      if (Number.isInteger(seq) && seq > max) max = seq;
+    }
+    return max;
+  }
   // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
   remove(turnId, seq) {
     try {
@@ -9769,12 +10208,12 @@ var SseSubscriber = class {
   }
 };
 function sleep3(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
 // src/version.ts
-import { createRequire } from "module";
-var pkg = createRequire(import.meta.url)("../package.json");
+import { createRequire as createRequire2 } from "module";
+var pkg = createRequire2(import.meta.url)("../package.json");
 var COMPANION_VERSION = pkg.version;
 
 // src/supervisor.ts
@@ -9796,10 +10235,15 @@ var CompanionSupervisor = class {
   config;
   log;
   hub;
-  // CT309: gates the claude-code runtime in the heartbeat manifest — the boot
-  // probe (exit-0 `claude --version`), used as the fallback until CT586's
-  // per-heartbeat re-probe lands fresh presence in `harnessSignals`.
-  claudeCode;
+  // CT1379: the bundled-executable resolver — the execution-presence half of both
+  // routing gates. Synchronous and cheap (a module resolve plus a stat), so unlike
+  // the CLI probes it needs no boot-frozen fallback: a caller that asks before the
+  // first harness refresh simply resolves now.
+  resolveBundled;
+  // CT1379: the last bundled status LOGGED per harness, so a missing binary is
+  // reported at startup and on each healthy↔missing transition rather than on
+  // every 30s beat (the CT484 latch pattern, per runtime).
+  loggedBundledStatus = /* @__PURE__ */ new Map();
   // CT571: the probed per-harness versions, reported on each heartbeat manifest.
   // CT586: no longer boot-frozen — the per-heartbeat harness re-probe refreshes
   // it, so a harness updated mid-run reports its new version without a restart.
@@ -9843,13 +10287,14 @@ var CompanionSupervisor = class {
     this.config = opts.config;
     this.log = opts.log;
     this.hub = opts.hub;
-    this.claudeCode = opts.claudeCode ?? true;
+    this.resolveBundled = opts.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
     this.probePresence = opts.probePresence ?? probeHarnessPresence;
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
     this.dispatcherFactory = opts.dispatcherFactory;
     this.unrunnableRetryDelaysMs = opts.unrunnableRetryDelaysMs ?? DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS;
+    this.latchBootBundledState();
   }
   // Stand up the data plane: pair check, initial assignments pull, then the
   // heartbeat + poll loops. A companion with no device token (logged out) does
@@ -9932,19 +10377,25 @@ var CompanionSupervisor = class {
       const res = await this.deviceApi.heartbeat({
         version: COMPANION_VERSION,
         exposedSecretNames: store.names(),
-        // Report each runtime only when this device can actually run it: CT309
-        // claude-code when `claude` is on PATH, CT270 opencode when the operator
+        // Report each runtime only when this device can actually run it:
+        // CT1379 claude-code and codex when the SDK's own bundled binary is there
+        // and the user asked for the harness, CT270 opencode when the operator
         // configured an `opencode serve`.
         manifest: buildCompanionManifest({
-          // CT1082: connected AND installed. Presence is the live re-probe (CT586),
-          // falling back to the boot probe until the first one lands; consent is the
-          // user's `claudeCode.enabled`. Claude Code no longer rides presence alone.
+          // CT1082/CT1379: connected AND launchable. Execution presence is the
+          // live bundled-binary resolution (refreshed on this beat), consent is
+          // the user's `claudeCode.enabled`. Claude Code rides neither alone.
           claudeCode: this.claudeCodeOffered(),
           opencode: !!this.config.opencode?.serverUrl,
-          // CT481: advertise codex when the operator enabled it (config-gated,
-          // like opencode — the CLI's presence is the operator's responsibility;
-          // a misconfigured device fails the turn loudly, never silently).
-          codex: isCodexEnabled(this.config),
+          // CT481/CT1379: advertise codex when the operator enabled it AND its
+          // vendored binary is there. The enable flag alone used to be enough,
+          // which is how a device with a half-installed 331 MB platform package
+          // advertised a runtime that could not start.
+          codex: this.codexOffered(),
+          // CT1379: and say WHY when an asked-for harness is absent from the list
+          // above. Diagnostic only — the server never routes on it — and always
+          // sent, so an empty array clears a previously reported issue.
+          runtimeIssues: this.runtimeIssues(),
           // CT571/CT586: each runtime's `version` from the latest harness probe
           // (fail-soft to null). Informational only — the server matches on name.
           versions: this.harnessVersions
@@ -10165,18 +10616,103 @@ var CompanionSupervisor = class {
       "companion: stopped agent (unassigned)"
     );
   }
-  // CT833: is Claude Code on this machine right now? Live (the per-beat re-probe),
-  // falling back to the boot probe until the first one lands. Presence ONLY —
-  // CT1082 split presence from exposure, so nothing routes on this directly.
-  claudeCodePresent() {
-    return this.harnessSignals?.claudeOnPath ?? this.claudeCode;
-  }
-  // CT1082: does this device OFFER claude-code — connected by its user and actually
-  // installed? The ONE signal both the heartbeat manifest and the dispatcher's
-  // adapter registry read, so what the device advertises and what it can select
-  // can't disagree (the CT833 invariant, now with consent in front of it).
+  // CT1379: can this machine LAUNCH the harness — is the SDK's own bundled
+  // executable there? Live (the per-beat re-resolve), falling back to resolving
+  // right now before the first refresh lands. Execution presence ONLY; consent is
+  // the caller's half.
+  bundledStatus(runtime) {
+    const cached2 = runtime === "codex" ? this.harnessSignals?.codexBundled : this.harnessSignals?.claudeBundled;
+    return cached2 ?? this.resolveBundled(runtime).status;
+  }
+  // The full resolution rather than just its status — the transition log needs the
+  // platform/architecture and the repair the copy is built from, and re-resolving
+  // is a module lookup plus a stat.
+  bundledResolution(runtime) {
+    return this.resolveBundled(runtime);
+  }
+  // CT1082/CT1379: does this device OFFER claude-code — connected by its user, and
+  // able to start the binary a turn runs? The ONE signal both the heartbeat
+  // manifest and the dispatcher's adapter registry read, so what the device
+  // advertises and what it can select can't disagree (the CT833 invariant, with
+  // consent in front of it and the real executable underneath it).
   claudeCodeOffered() {
-    return isClaudeCodeConnected(this.config) && this.claudeCodePresent();
+    return isClaudeCodeConnected(this.config) && this.bundledStatus("claude-code") === "present";
+  }
+  // CT1379: and the same question for codex, which until now was the enable flag
+  // alone — so an enabled device with no vendored binary advertised a runtime it
+  // could not start. Same shape as Claude Code, same predicate on both sides.
+  codexOffered() {
+    return isCodexEnabled(this.config) && this.bundledStatus("codex") === "present";
+  }
+  // CT1379: the manifest's diagnostic half, derived from the same two facts as the
+  // two predicates above so an issue and an advertisement can never both be made
+  // for one harness.
+  runtimeIssues() {
+    return runtimeIssuesFor({
+      claudeCode: {
+        intended: isClaudeCodeConnected(this.config),
+        bundled: this.bundledStatus("claude-code")
+      },
+      codex: { intended: isCodexEnabled(this.config), bundled: this.bundledStatus("codex") }
+    });
+  }
+  // CT1379: a missing binary is reported ONCE, and again only when the answer
+  // CHANGES — with the runtime, the platform/architecture and the resolution
+  // result, which is enough to find the occurrence in `companion.log` without a
+  // repro and carries nothing that could be a credential or a vendor's output.
+  //
+  // Two things this deliberately does NOT do (Codo's review, blocking finding #2):
+  //
+  //   - It does not re-announce the state the device booted in. `warnAboutHarnessReadiness`
+  //     already said that on stderr at startup, in the specified words, at the one
+  //     moment a person is watching a terminal — and the `--daemon` launcher runs
+  //     that preflight in the FOREGROUND for exactly that reason, because the
+  //     child's output goes to a file. The boot state is latched in the
+  //     constructor, so the first refresh reports nothing new; it lands here as a
+  //     debug record instead, present for diagnosis without competing for
+  //     attention with the warning the operator already read.
+  //   - It does not report a transition in generic prose. A binary that goes
+  //     missing at 3am is the case the operator will actually meet, and a line
+  //     that says only "binary is missing" leaves them with no repair and no
+  //     restart instruction. Transitions carry the specified copy verbatim — the
+  //     same sentence the startup path prints.
+  logBundledTransitions() {
+    for (const runtime of ["claude-code", "codex"]) {
+      const intended = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
+      const resolution = this.bundledResolution(runtime);
+      const status2 = resolution.status;
+      if (this.loggedBundledStatus.get(runtime) === status2) continue;
+      this.loggedBundledStatus.set(runtime, status2);
+      const meta = { runtime, platform: resolution.platform, arch: resolution.arch, status: status2 };
+      if (status2 === "present") {
+        const say = intended ? this.log.info : this.log.debug;
+        say.call(this.log, meta, "companion: bundled harness binary is present again");
+        continue;
+      }
+      if (intended) this.log.warn(meta, startupWarning(resolution));
+      else
+        this.log.debug(meta, "companion: bundled harness binary is missing (harness not in use)");
+    }
+  }
+  // CT1379: the boot state, latched so the first refresh reports no news, and
+  // recorded once as evidence. Runs in the constructor — the resolve is a module
+  // lookup plus a stat, so it costs nothing and needs no await.
+  latchBootBundledState() {
+    for (const runtime of ["claude-code", "codex"]) {
+      const resolution = this.resolveBundled(runtime);
+      this.loggedBundledStatus.set(runtime, resolution.status);
+      if (resolution.status === "present") continue;
+      this.log.debug(
+        {
+          runtime,
+          platform: resolution.platform,
+          arch: resolution.arch,
+          status: resolution.status,
+          intended: runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config)
+        },
+        "companion: bundled harness binary missing at startup (warned by the readiness check)"
+      );
+    }
   }
   buildDispatcher(ctx) {
     const local = localAgentConfig(this.config, {
@@ -10200,16 +10736,23 @@ var CompanionSupervisor = class {
       // CT833: register the claude-code adapter only when this device actually
       // offers claude-code — read per turn (not captured here), so a harness
       // installed or connected after boot works on the next turn exactly as it
-      // appears on the next beat. CT1082: "offers" now means connected as well as
-      // installed, so a disconnected harness can't be selected either.
+      // appears on the next beat. CT1082: "offers" means connected as well as
+      // runnable, so a disconnected harness can't be selected either.
+      // CT1379: and the same for the bundled binary — the predicate is shared with
+      // the heartbeat above, so a runtime advertised by one and refused by the
+      // other is not expressible.
       claudeCodeAvailable: () => this.claudeCodeOffered(),
       // CT270: the opencode server URL (operator-configured), when this device
       // offers the opencode runtime. Threaded so an opencode turn selects the
       // opencode adapter; unset leaves the device claude-code-only.
       ...this.config.opencode?.serverUrl ? { opencodeServerUrl: this.config.opencode.serverUrl } : {},
-      // CT481: register the codex adapter when this device offers codex; unset
+      // CT481: register the codex adapter when this device offers codex; a miss
       // leaves an `openai/…` turn to fail loudly (no silent claude-code fallback).
-      ...isCodexEnabled(this.config) ? { codexEnabled: true } : {},
+      // CT1379: read PER TURN, like claude-code above, and off the same predicate
+      // the heartbeat uses — it was captured here at dispatcher-construction time
+      // from the enable flag alone, so a device could register an adapter for a
+      // binary it did not have and keep it registered after the binary came back.
+      codexAvailable: () => this.codexOffered(),
       // CT556: per-turn timeout watchdog windows, from the companion's own env
       // (`AGENT_IDLE_TIMEOUT_MS` / `AGENT_TOTAL_TIMEOUT_MS`). Unset → the
       // dispatcher's baked-in defaults (10 min idle / 6h total).
@@ -10479,7 +11022,10 @@ var CompanionSupervisor = class {
         "companion: resuming an interrupted turn under its original id"
       );
     }
-    const result = await agent.dispatcher.handle(payload, { turnId });
+    const result = await agent.dispatcher.handle(payload, {
+      turnId,
+      resumed: resumedTurnId !== null
+    });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);
@@ -10576,9 +11122,13 @@ var CompanionSupervisor = class {
     try {
       const signals = await probeHarnessSignals(this.config, {
         probePresence: this.probePresence,
-        presence
+        presence,
+        // CT1379: the bundled executables are resolved on the same cadence as the
+        // CLI probes, through the supervisor's seam so a test pins the host fact.
+        resolveBundled: this.resolveBundled
       });
       this.harnessSignals = signals;
+      this.logBundledTransitions();
       this.harnessVersions = {
         claudeCode: signals.claudeVersion,
         opencode: signals.opencodeVersion,
@@ -10618,8 +11168,15 @@ var CompanionSupervisor = class {
     return this.config;
   }
   // Friendly enable for the config-driven harnesses — flip the flag the app owns in
-  // `~/.cabane/config.json`, no hand-edited JSON. This is enable/expose ONLY: it
-  // never installs a binary and never drives a login (BYO — Decided).
+  // `~/.cabane/config.json`, no hand-edited JSON. It never installs a binary and
+  // never drives a login (BYO — Decided).
+  //
+  // CT1379: this records INTENT; it does not by itself expose anything. A harness
+  // is advertised only when the user asked for it AND the SDK's own bundled binary
+  // resolves, so a successful enable on a companion whose optional dependency
+  // never installed leaves the device advertising nothing — correctly, and with
+  // the Harnesses surface saying why. Read every "expose" below as "record the
+  // half of the answer the user owns".
   //   - claude-code (CT1082): set `claudeCode.enabled`, after checking `claude` is
   //     on PATH. This is the callable the terminal offer ("We found Claude Code.
   //     Connect it? [Y/n]") and the web pairing flow both wire to.
@@ -10628,9 +11185,10 @@ var CompanionSupervisor = class {
   //   - opencode: set `opencode.serverUrl` — but ONLY after health-probing the URL,
   //     so we never advertise a serve that isn't there. An unreachable URL is a
   //     typed failure the UI shows in place, not a silent bad write.
-  // On success, persist, re-probe, and beat immediately so Cabane starts routing to
-  // the newly-exposed runtime at once. Returns a typed outcome (never throws for a
-  // reachable/valid input).
+  // On success, persist, re-probe, and beat immediately, so a runtime that IS
+  // launchable starts taking turns at once rather than on the next tick — and one
+  // that isn't reports its issue just as promptly. Returns a typed outcome (never
+  // throws for a reachable/valid input).
   async enableHarness(input) {
     let next;
     let checkedPresence = null;
@@ -10728,8 +11286,8 @@ var CompanionSupervisor = class {
 };
 async function waitForBoundedHeartbeat(heartbeat) {
   let timer = null;
-  const timeout = new Promise((resolve) => {
-    timer = setTimeout(resolve, SHUTDOWN_HEARTBEAT_WAIT_MS);
+  const timeout = new Promise((resolve2) => {
+    timer = setTimeout(resolve2, SHUTDOWN_HEARTBEAT_WAIT_MS);
     timer.unref?.();
   });
   try {
@@ -10813,9 +11371,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync8, writeFileSync as writeFileSync8 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function crashMarkerPath() {
-  return join16(cabaneDir(), "last-error.json");
+  return join17(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec2) {
   try {
@@ -10864,8 +11422,8 @@ async function createCompanionRuntime(opts = {}) {
   }
   if (cfg.logLevel) log.level = cfg.logLevel;
   const harnessVersions = await probeHarnessVersions({
-    // CT1082: versions are probed for the runtimes this device OFFERS, and
-    // claude-code is offered only when connected as well as installed.
+    // Connected AND its CLI answered — the two things that make a
+    // `claude --version` probe worth spawning. Not the offer predicate.
     claudeCode: claudeCode && isClaudeCodeConnected(cfg),
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
@@ -10898,7 +11456,6 @@ async function createCompanionRuntime(opts = {}) {
     config: cfg,
     log,
     hub,
-    claudeCode,
     harnessVersions
   });
   await supervisor.start();
@@ -11003,11 +11560,11 @@ import { closeSync as closeSync3, mkdirSync as mkdirSync12, openSync as openSync
 
 // src/cli-entry.ts
 import { existsSync as existsSync14 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath as fileURLToPath3 } from "url";
 var RELATIVE_CANDIDATES = ["./cli.js", "../dist/cli.js", "../cli.js"];
 function companionCliEntry(deps = {}) {
   const exists = deps.exists ?? existsSync14;
-  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath2(new URL(rel, import.meta.url)));
+  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath3(new URL(rel, import.meta.url)));
   for (const candidate of candidates) {
     if (exists(candidate)) return candidate;
   }
@@ -11354,7 +11911,7 @@ async function handOffToBackground(runtime, ctx) {
   }
 }
 async function runAttached(runtime) {
-  await new Promise((resolve) => {
+  await new Promise((resolve2) => {
     let shuttingDown = false;
     const shutdown = async (signal) => {
       if (shuttingDown) {
@@ -11375,7 +11932,7 @@ companion: received ${signal}, shutting down\u2026
       forceExit.unref?.();
       await runtime.stop();
       clearTimeout(forceExit);
-      resolve();
+      resolve2();
       process.exit(0);
     };
     process.on("SIGINT", () => void shutdown("SIGINT"));
@@ -11523,7 +12080,7 @@ function isAlive(kill, pid) {
 
 // src/commands/transcript.ts
 import { existsSync as existsSync15, readFileSync as readFileSync10, readdirSync as readdirSync5 } from "fs";
-import { isAbsolute, join as join17 } from "path";
+import { isAbsolute, join as join18 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
   if (opts.follow) {
@@ -11540,7 +12097,7 @@ async function transcript(opts = {}) {
       process.stdout.write(emptyMessage(dir2));
       return;
     }
-    process.stdout.write(renderFile(join17(dir2, newest)) + "\n");
+    process.stdout.write(renderFile(join18(dir2, newest)) + "\n");
     return;
   }
   printList(dir2);
@@ -11623,7 +12180,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync10(join17(dir2, f), "utf8"),
+    read: (f) => readFileSync10(join18(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -11632,14 +12189,14 @@ async function followTranscripts(dir2) {
   process.stdout.write(`following ${dir2} \u2014 Ctrl-C to stop.
 
 `);
-  await new Promise((resolve) => {
+  await new Promise((resolve2) => {
     const timer = setInterval(() => follower.tick(), FOLLOW_POLL_MS);
     const stop2 = () => {
       clearInterval(timer);
       process.removeListener("SIGINT", stop2);
       process.removeListener("SIGTERM", stop2);
       process.stdout.write("\n");
-      resolve();
+      resolve2();
     };
     process.once("SIGINT", stop2);
     process.once("SIGTERM", stop2);
@@ -11663,7 +12220,7 @@ function printList(dir2) {
 
 `);
   for (const f of files.slice(0, 20)) {
-    const { meta, outcome } = peek(join17(dir2, f));
+    const { meta, outcome } = peek(join18(dir2, f));
     const when = fmtTime(rec(meta)?.ts);
     const ws = str2(rec(meta)?.workspaceSlug);
     const o = rec(outcome);
@@ -11700,10 +12257,10 @@ function resolveTarget(dir2, target) {
     if (existsSync15(target)) return target;
     throw new CompanionError(`no transcript at ${target}.`);
   }
-  const exact = join17(dir2, target);
+  const exact = join18(dir2, target);
   if (existsSync15(exact)) return exact;
   const matches = listFiles(dir2).filter((f) => f.includes(target));
-  if (matches.length === 1) return join17(dir2, matches[0]);
+  if (matches.length === 1) return join18(dir2, matches[0]);
   if (matches.length === 0) {
     throw new CompanionError(
       `no transcript matching "${target}" in ${dir2}. Run \`cabane-companion transcript\` to list them.`