@cabane/companion 0.6.89 → 0.6.91

package/dist/runtime.js

@@ -120,7 +120,7 @@ function parsePrepareOutput(stdout) {
   return { cwd: last };
 }
 var runPrepareHook = (hook, input) => {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const timeoutMs = hook.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     let settled = false;
     const finish = (fn) => {
@@ -194,11 +194,11 @@ var runPrepareHook = (hook, input) => {
           return;
         }
         if (input.prepared) {
-          resolve(input.prepared);
+          resolve2(input.prepared);
           return;
         }
         try {
-          resolve(parsePrepareOutput(stdout));
+          resolve2(parsePrepareOutput(stdout));
         } catch (err) {
           reject(err instanceof PrepareHookError ? err : new PrepareHookError(String(err)));
         }
@@ -313,9 +313,10 @@ var companionConfigSchema = z2.object({
   // The change this task exists for: Claude Code used to be the one harness a
   // device exposed with no configuration — a `claude --version` exit-0 was taken as
   // consent — and it is now the third config-driven harness, opted into exactly
-  // like codex. `claude` on PATH is still required (you can't run what isn't
-  // installed), but presence alone no longer exposes anything: the manifest
-  // advertises claude-code only when this block says so AND the binary is there.
+  // like codex. CT1379: the binary that must be there is the Agent SDK's own
+  // bundled executable — the file a turn actually launches — not the user's
+  // `claude` on PATH, which the SDK never runs. The manifest advertises
+  // claude-code only when this block says so AND that binary resolves.
   //
   // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
   // Absent means the config predates this task — a device whose user was never
@@ -335,9 +336,11 @@ var companionConfigSchema = z2.object({
   // not a server address. The operator installs Codex + logs in (`codex login`, or
   // `CODEX_API_KEY` — Cabane never sees the key) and sets `{ "codex": { "enabled":
   // true } }`. Presence of the block enables it (an explicit `enabled: false`
-  // keeps the block but turns it off). Enabling makes the device advertise the
-  // `codex` runtime on its heartbeat manifest AND registers the codex adapter in
-  // the dispatcher. Absent → the device doesn't offer codex, exactly as before.
+  // keeps the block but turns it off). Absent → the device doesn't offer codex.
+  // CT1379: enabling is now half the answer, not all of it — the manifest and the
+  // adapter registry additionally require the SDK's vendored `codex` binary to
+  // resolve, because the enable flag alone advertised a runtime a device with a
+  // half-installed platform package could not start.
   codex: z2.object({
     enabled: z2.boolean().optional()
   }).strict().optional()
@@ -426,15 +429,15 @@ function requireConfig() {
 }
 
 // src/dashboard/server.ts
-import { dirname as dirname3, join as join4 } from "path";
-import { fileURLToPath } from "url";
+import { dirname as dirname4, join as join5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 
 // src/dashboard/routes.ts
 import { openSync, readSync, closeSync, fstatSync, existsSync as existsSync2 } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join3, normalize } from "path";
+import { extname, join as join4, normalize } from "path";
 import { streamSSE } from "hono/streaming";
 
 // src/harness-check.ts
@@ -450,14 +453,14 @@ function parseVersionToken(raw) {
   return m ? m[0] : null;
 }
 function probeCliPresence(command, spawnImpl = spawn2) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     let timer = null;
     const done = (result) => {
       if (!settled) {
         settled = true;
         if (timer) clearTimeout(timer);
-        resolve(result);
+        resolve2(result);
       }
     };
     let child;
@@ -539,6 +542,203 @@ async function safe(fn) {
   }
 }
 
+// src/bundled-binaries.ts
+import { realpathSync, statSync } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath } from "url";
+function nodeResolveSelf(specifier) {
+  const here = fileURLToPath(import.meta.url);
+  if (typeof import.meta.resolve === "function") {
+    try {
+      return fileURLToPath(import.meta.resolve(specifier));
+    } catch {
+    }
+  }
+  try {
+    return createRequire(here).resolve(specifier);
+  } catch {
+  }
+  return walkNodeModules(specifier, here);
+}
+function walkNodeModules(pkg2, fromPath) {
+  let dir2 = dirname2(fromPath);
+  for (; ; ) {
+    const manifest = join2(dir2, "node_modules", pkg2, "package.json");
+    if (nodeIsFile(manifest)) {
+      try {
+        return realpathSync(manifest);
+      } catch {
+        return manifest;
+      }
+    }
+    const parent = dirname2(dir2);
+    if (parent === dir2) return null;
+    dir2 = parent;
+  }
+}
+function nodeResolve(specifier, fromPath) {
+  try {
+    return createRequire(fromPath).resolve(specifier);
+  } catch {
+    return null;
+  }
+}
+function nodeIsFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function detectPreferMusl(platform = process.platform) {
+  if (platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  const header = report?.header;
+  return report != null && header?.glibcVersionRuntime === void 0;
+}
+function defaultResolveEnv() {
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    preferMusl: detectPreferMusl(),
+    // Both resolutions start from this module, which tsup bundles into
+    // `dist/cli.js` and `dist/postinstall.js` — both at the package's `dist/`
+    // root — so one environment serves the runtime checks and the install
+    // verifier alike.
+    resolveSelf: nodeResolveSelf,
+    resolve: nodeResolve,
+    isFile: nodeIsFile
+  };
+}
+var CLAUDE_SDK = "@anthropic-ai/claude-agent-sdk";
+function claudePlatformPackages(platform, arch, preferMusl) {
+  if (platform === "android") return [`${CLAUDE_SDK}-linux-${arch}-android`];
+  if (platform === "linux") {
+    return preferMusl ? [`${CLAUDE_SDK}-linux-${arch}-musl`, `${CLAUDE_SDK}-linux-${arch}`] : [`${CLAUDE_SDK}-linux-${arch}`, `${CLAUDE_SDK}-linux-${arch}-musl`];
+  }
+  return [`${CLAUDE_SDK}-${platform}-${arch}`];
+}
+function resolveClaude(env) {
+  const candidates = claudePlatformPackages(env.platform, env.arch, env.preferMusl);
+  const base = {
+    runtime: "claude-code",
+    packageName: candidates[0] ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  const sdkEntry = env.resolveSelf(CLAUDE_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  let sawPackage = null;
+  for (const pkg2 of candidates) {
+    const manifest = env.resolve(`${pkg2}/package.json`, sdkEntry);
+    if (!manifest) continue;
+    sawPackage ??= pkg2;
+    const exe = join2(dirname2(manifest), env.platform === "win32" ? "claude.exe" : "claude");
+    if (env.isFile(exe)) {
+      return { ...base, packageName: pkg2, status: "present", path: exe };
+    }
+  }
+  return sawPackage ? { ...base, packageName: sawPackage, status: "executable_missing", path: null } : { ...base, status: "platform_package_missing", path: null };
+}
+var CODEX_SDK = "@openai/codex-sdk";
+var CODEX_CLI = "@openai/codex";
+function codexTargetTriple(platform, arch) {
+  if (platform === "linux" || platform === "android") {
+    if (arch === "x64") return "x86_64-unknown-linux-musl";
+    if (arch === "arm64") return "aarch64-unknown-linux-musl";
+    return null;
+  }
+  if (platform === "darwin") {
+    if (arch === "x64") return "x86_64-apple-darwin";
+    if (arch === "arm64") return "aarch64-apple-darwin";
+    return null;
+  }
+  if (platform === "win32") {
+    if (arch === "x64") return "x86_64-pc-windows-msvc";
+    if (arch === "arm64") return "aarch64-pc-windows-msvc";
+    return null;
+  }
+  return null;
+}
+var CODEX_PACKAGE_BY_TRIPLE = {
+  "x86_64-unknown-linux-musl": `${CODEX_CLI}-linux-x64`,
+  "aarch64-unknown-linux-musl": `${CODEX_CLI}-linux-arm64`,
+  "x86_64-apple-darwin": `${CODEX_CLI}-darwin-x64`,
+  "aarch64-apple-darwin": `${CODEX_CLI}-darwin-arm64`,
+  "x86_64-pc-windows-msvc": `${CODEX_CLI}-win32-x64`,
+  "aarch64-pc-windows-msvc": `${CODEX_CLI}-win32-arm64`
+};
+function resolveCodex(env) {
+  const triple = codexTargetTriple(env.platform, env.arch);
+  const pkg2 = triple ? CODEX_PACKAGE_BY_TRIPLE[triple] : void 0;
+  const base = {
+    runtime: "codex",
+    packageName: pkg2 ?? null,
+    platform: env.platform,
+    arch: env.arch
+  };
+  if (!triple || !pkg2) return { ...base, status: "platform_package_missing", path: null };
+  const sdkEntry = env.resolveSelf(CODEX_SDK);
+  if (!sdkEntry) return { ...base, status: "platform_package_missing", path: null };
+  const cliManifest = env.resolve(`${CODEX_CLI}/package.json`, sdkEntry);
+  if (!cliManifest) return { ...base, status: "platform_package_missing", path: null };
+  const platformManifest = env.resolve(`${pkg2}/package.json`, cliManifest);
+  if (!platformManifest) return { ...base, status: "platform_package_missing", path: null };
+  const packageRoot = join2(dirname2(platformManifest), "vendor", triple);
+  const exeName = env.platform === "win32" ? "codex.exe" : "codex";
+  const current = join2(packageRoot, "bin", exeName);
+  if (env.isFile(current) && env.isFile(join2(packageRoot, "codex-package.json"))) {
+    return { ...base, status: "present", path: current };
+  }
+  const legacy = join2(packageRoot, "codex", exeName);
+  if (env.isFile(legacy)) return { ...base, status: "present", path: legacy };
+  return { ...base, status: "executable_missing", path: null };
+}
+function resolveBundledBinary(runtime, env = defaultResolveEnv()) {
+  try {
+    return runtime === "codex" ? resolveCodex(env) : resolveClaude(env);
+  } catch {
+    return {
+      runtime,
+      status: "platform_package_missing",
+      path: null,
+      packageName: null,
+      platform: env.platform,
+      arch: env.arch
+    };
+  }
+}
+var HARNESS_LABEL = {
+  "claude-code": "Claude Code",
+  codex: "Codex"
+};
+var HARNESS_INTENT_WORD = {
+  "claude-code": "connected",
+  codex: "enabled"
+};
+function missingNoun(status) {
+  return status === "executable_missing" ? "executable" : "platform package";
+}
+function repairCommands() {
+  return ["npm i -g @cabane/companion --include=optional"];
+}
+function repairAction() {
+  return `Reinstall with \`${repairCommands()[0]}\`.`;
+}
+function startupWarning(r) {
+  const label = HARNESS_LABEL[r.runtime];
+  return `warning: ${label} is ${HARNESS_INTENT_WORD[r.runtime]}, but @cabane/companion's bundled ${label} ${missingNoun(r.status)} is missing. It will not be offered to Cabane. ${repairAction()} Then restart the companion.`;
+}
+function harnessIssueNote(runtime, status) {
+  const intent = HARNESS_INTENT_WORD[runtime];
+  const capitalized = `${intent[0].toUpperCase()}${intent.slice(1)}`;
+  return `${capitalized}, but @cabane/companion's bundled ${HARNESS_LABEL[runtime]} ${missingNoun(status)} is missing. ${repairAction()} Then restart the companion.`;
+}
+function turnIncompleteCopy(runtime) {
+  return `**This device's ${HARNESS_LABEL[runtime]} runtime is incomplete.** ${repairAction()} Restart it, then try again.`;
+}
+
 // src/manifest.ts
 var DEVICE_MANIFEST = {
   runtimes: [{ name: "claude-code", version: null }],
@@ -550,7 +750,20 @@ function buildCompanionManifest(opts) {
   if (opts.claudeCode) runtimes.push({ name: "claude-code", version: v.claudeCode ?? null });
   if (opts.opencode) runtimes.push({ name: "opencode", version: v.opencode ?? null });
   if (opts.codex) runtimes.push({ name: "codex", version: v.codex ?? null });
-  return { runtimes, capabilities: { ...DEVICE_MANIFEST.capabilities } };
+  return {
+    runtimes,
+    capabilities: { ...DEVICE_MANIFEST.capabilities },
+    runtimeIssues: opts.runtimeIssues ?? []
+  };
+}
+function runtimeIssuesFor(gates) {
+  const issues = [];
+  for (const name of ["claude-code", "codex"]) {
+    const gate = name === "codex" ? gates.codex : gates.claudeCode;
+    if (!gate.intended || gate.bundled === "present") continue;
+    issues.push({ name, reason: gate.bundled });
+  }
+  return issues;
 }
 
 // src/harness-status.ts
@@ -564,11 +777,12 @@ var DEFAULT_OPENCODE_SERVER_URL = "http://127.0.0.1:4096";
 function deriveHarnessSnapshot(signals) {
   const advertised = new Set(
     buildCompanionManifest({
-      // CT1082: connected AND installed — the manifest's own rule, restated here
-      // through the same function rather than re-decided.
-      claudeCode: signals.claudeCodeConnected && signals.claudeOnPath,
+      // CT1082 + CT1379: connected AND the bundled binary the SDK launches is
+      // there — the manifest's own rule, restated here through the same function
+      // rather than re-decided. PATH is deliberately absent from both gates now.
+      claudeCode: signals.claudeCodeConnected && signals.claudeBundled === "present",
       opencode: signals.opencodeConfigured,
-      codex: signals.codexEnabled
+      codex: signals.codexEnabled && signals.codexBundled === "present"
     }).runtimes.map((r) => r.name)
   );
   const harnesses = [
@@ -594,7 +808,7 @@ function deriveClaudeCode(signals, manifestHas) {
       ...base,
       state: "needs_attention",
       version: null,
-      detail: "Connected, but the `claude` CLI isn\u2019t on your PATH. Install it (`npm i -g @anthropic-ai/claude-code`) and sign in, or disconnect it.",
+      detail: harnessIssueNote("claude-code", signals.claudeBundled),
       enable: null
     };
   }
@@ -603,7 +817,11 @@ function deriveClaudeCode(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.claudeVersion,
-      detail: "Claude Code is installed here but not connected yet. Connect it to let Cabane run Claude Code on this device.",
+      // CT1379: connecting records INTENT; it is not the same as becoming
+      // runnable. With the bundled binary missing, a connect succeeds and the
+      // device still advertises nothing — so this says so up front rather than
+      // promising routing it can't deliver.
+      detail: signals.claudeBundled === "present" ? "Claude Code is installed here but not connected yet. Connect it to offer Claude Code from this device." : `Claude Code is installed here but not connected yet \u2014 and @cabane/companion's bundled Claude Code ${missingNoun(signals.claudeBundled)} is missing, so connecting alone won't make it runnable. ${repairAction()}`,
       enable: "claude-code"
     };
   }
@@ -618,20 +836,20 @@ function deriveClaudeCode(signals, manifestHas) {
 function deriveCodex(signals, manifestHas) {
   const base = { runtime: "codex", label: LABELS.codex };
   if (manifestHas) {
-    if (signals.codexOnPath) {
-      return {
-        ...base,
-        state: "exposed",
-        version: signals.codexVersion,
-        detail: "Codex is enabled and exposed to Cabane.",
-        enable: null
-      };
-    }
+    return {
+      ...base,
+      state: "exposed",
+      version: signals.codexVersion,
+      detail: "Codex is enabled and exposed to Cabane.",
+      enable: null
+    };
+  }
+  if (signals.codexEnabled) {
     return {
       ...base,
       state: "needs_attention",
       version: null,
-      detail: "Enabled, but the `codex` CLI isn\u2019t on your PATH. Install it and sign in (`codex login`), or turn Codex off.",
+      detail: harnessIssueNote("codex", signals.codexBundled),
       enable: null
     };
   }
@@ -640,7 +858,9 @@ function deriveCodex(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.codexVersion,
-      detail: "Codex is installed but not exposed yet. Turn it on to let Cabane run Codex here.",
+      // CT1379: same distinction as Claude Code — enabling is intent, not
+      // launchability.
+      detail: signals.codexBundled === "present" ? "Codex is installed but not enabled yet. Turn it on to offer Codex from this device." : `Codex is installed but not enabled yet \u2014 and @cabane/companion's bundled Codex ${missingNoun(signals.codexBundled)} is missing, so enabling alone won't make it runnable. ${repairAction()}`,
       enable: "codex"
     };
   }
@@ -707,6 +927,7 @@ async function resolveOpencodeServerUrl(configuredServerUrl, requestedServerUrl,
 async function probeHarnessSignals(cfg, deps = {}) {
   const probePresence = deps.probePresence ?? probeHarnessPresence;
   const probeOpencode = deps.probeOpencode ?? ((url) => probeOpencodeVersion(url));
+  const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const configuredServerUrl = cfg.opencode?.serverUrl;
   const opencodeProbeUrl = configuredServerUrl ?? DEFAULT_OPENCODE_SERVER_URL;
   const [claudePresence, codexPresence, opencodeVersion] = await Promise.all([
@@ -722,6 +943,11 @@ async function probeHarnessSignals(cfg, deps = {}) {
     // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
     // the manifest gate and the probe above is only a suggestion.
     claudeCodeConnected: isClaudeCodeConnected(cfg),
+    // CT1379: the executable a Claude turn actually launches. Resolved every time
+    // the signals are, so a binary that disappears between beats is caught on the
+    // next one rather than at turn time.
+    claudeBundled: resolveBundled("claude-code").status,
+    codexBundled: resolveBundled("codex").status,
     // A parseable `codex --version` is our presence signal (presence alone never
     // exposes codex; its config flag is the manifest gate either way).
     codexOnPath: codexVersion !== null,
@@ -735,12 +961,12 @@ async function probeHarnessSignals(cfg, deps = {}) {
   };
 }
 function withTimeout(promise, fallback, timeoutMs = PROBE_TIMEOUT_MS) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const done = (v) => {
       if (!settled) {
         settled = true;
-        resolve(v);
+        resolve2(v);
       }
     };
     const timer = setTimeout(() => done(fallback), timeoutMs);
@@ -818,19 +1044,19 @@ function looksUnsupported(output) {
   );
 }
 function runBounded(command, args) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const done = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve(result);
+      resolve2(result);
     };
     let child;
     try {
       child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve({ code: null, output: "", error: "spawn" });
+      resolve2({ code: null, output: "", error: "spawn" });
       return;
     }
     let out = "";
@@ -851,11 +1077,11 @@ function runBounded(command, args) {
 
 // src/logger.ts
 import { createWriteStream, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 import pino from "pino";
 import pretty from "pino-pretty";
 function companionLogPath() {
-  return join2(cabaneDir(), "companion.log");
+  return join3(cabaneDir(), "companion.log");
 }
 var CONSOLE_IGNORE = [
   "pid",
@@ -880,7 +1106,7 @@ var cached = null;
 var consoleLogging = true;
 function createLogger(destinations = {}) {
   const path = companionLogPath();
-  if (!destinations.file) mkdirSync2(dirname2(path), { recursive: true });
+  if (!destinations.file) mkdirSync2(dirname3(path), { recursive: true });
   const streams = [];
   if (process.env.CABANE_COMPANION_DAEMON !== "1") {
     const consoleStream = pretty({
@@ -1156,13 +1382,13 @@ var CONTENT_TYPES = {
 function registerRoutes(app, deps) {
   const { supervisor, hub, staticDir } = deps;
   app.get("/", async (c) => {
-    const html = await readFile(join3(staticDir, "index.html"), "utf8");
+    const html = await readFile(join4(staticDir, "index.html"), "utf8");
     return c.html(html);
   });
   app.get("/static/:file", async (c) => {
     const file = c.req.param("file");
     const safe3 = normalize(file).replace(/^(\.\.[/\\])+/, "");
-    const full = join3(staticDir, safe3);
+    const full = join4(staticDir, safe3);
     if (!full.startsWith(staticDir) || !existsSync2(full)) return c.notFound();
     const body = await readFile(full);
     const type = CONTENT_TYPES[extname(full).toLowerCase()] ?? "application/octet-stream";
@@ -1262,8 +1488,8 @@ function registerRoutes(app, deps) {
       while (!stream.aborted) {
         if (queue.length === 0) {
           await Promise.race([
-            new Promise((resolve) => {
-              wake = resolve;
+            new Promise((resolve2) => {
+              wake = resolve2;
             }),
             stream.sleep(25e3)
           ]);
@@ -1347,8 +1573,8 @@ async function startDashboard(opts) {
       return {
         url,
         port,
-        close: () => new Promise((resolve) => {
-          server.close(() => resolve());
+        close: () => new Promise((resolve2) => {
+          server.close(() => resolve2());
           server.closeAllConnections?.();
         })
       };
@@ -1365,12 +1591,12 @@ async function startDashboard(opts) {
   );
 }
 function listen(app, port) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port }, () => {
       if (!settled) {
         settled = true;
-        resolve(server);
+        resolve2(server);
       }
     });
     server.on("error", (err) => {
@@ -1385,14 +1611,14 @@ function isAddrInUse(err) {
   return Boolean(err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE");
 }
 function resolveStaticDir() {
-  return join4(dirname3(fileURLToPath(import.meta.url)), "static");
+  return join5(dirname4(fileURLToPath2(import.meta.url)), "static");
 }
 
 // src/control-socket.ts
 import { createHash } from "crypto";
 import { chmodSync as chmodSync2, existsSync as existsSync3, rmSync as rmSync2, mkdirSync as mkdirSync3 } from "fs";
 import { createServer, connect } from "net";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var CONTROL_TIMEOUT_MS = 1e3;
 var MAX_UNIX_SOCKET_PATH_BYTES = 103;
 function controlSocketPath() {
@@ -1401,11 +1627,11 @@ function controlSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\cabane-companion-${key}`;
   }
-  const besideRuntime = join5(dir2, "companion.sock");
+  const besideRuntime = join6(dir2, "companion.sock");
   if (Buffer.byteLength(besideRuntime) <= MAX_UNIX_SOCKET_PATH_BYTES) return besideRuntime;
   const filename = `cabane-companion-${key}.sock`;
-  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync3(process.env.XDG_RUNTIME_DIR) ? join5(process.env.XDG_RUNTIME_DIR, filename) : null;
-  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join5("/tmp", filename);
+  const xdgPath = process.env.XDG_RUNTIME_DIR && existsSync3(process.env.XDG_RUNTIME_DIR) ? join6(process.env.XDG_RUNTIME_DIR, filename) : null;
+  return xdgPath && Buffer.byteLength(xdgPath) <= MAX_UNIX_SOCKET_PATH_BYTES ? xdgPath : join6("/tmp", filename);
 }
 async function startControlServer(handlers) {
   const path = controlSocketPath();
@@ -1419,18 +1645,18 @@ async function startControlServer(handlers) {
     void serveConnection(socket, handlers);
   });
   server.unref();
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(path, () => {
       server.removeListener("error", reject);
-      resolve();
+      resolve2();
     });
   });
   if (process.platform !== "win32") {
     try {
       chmodSync2(path, 384);
     } catch (err) {
-      await new Promise((resolve) => server.close(() => resolve()));
+      await new Promise((resolve2) => server.close(() => resolve2()));
       try {
         rmSync2(path, { force: true });
       } catch {
@@ -1442,10 +1668,10 @@ async function startControlServer(handlers) {
   });
   return {
     path,
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve2) => {
       server.close(() => {
         if (process.platform !== "win32") rmSync2(path, { force: true });
-        resolve();
+        resolve2();
       });
     })
   };
@@ -1495,12 +1721,12 @@ function reply(socket, body) {
 async function controlRequest(path, req, timeoutMs = CONTROL_TIMEOUT_MS) {
   const socket = connect(path);
   try {
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => reject(new ControlTimeout()), timeoutMs);
       timer.unref?.();
       socket.once("connect", () => {
         clearTimeout(timer);
-        resolve();
+        resolve2();
       });
       socket.once("error", (err) => {
         clearTimeout(timer);
@@ -1527,7 +1753,7 @@ function isNotListening(err) {
   return code === "ENOENT" || code === "ECONNREFUSED";
 }
 function readLine(socket, timeoutMs) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let buf = "";
     let settled = false;
     const done = (v) => {
@@ -1535,7 +1761,7 @@ function readLine(socket, timeoutMs) {
       settled = true;
       clearTimeout(timer);
       socket.removeListener("data", onData);
-      resolve(v);
+      resolve2(v);
     };
     const timer = setTimeout(() => done(null), timeoutMs);
     timer.unref?.();
@@ -1581,6 +1807,7 @@ async function requireStartConfig(deps = {}) {
 async function warnAboutHarnessReadiness(cfg, deps = {}) {
   const probeClaude = deps.probeClaude ?? claudeOnPath;
   const probeCodex = deps.probeCodex ?? codexOnPath;
+  const resolveBundled = deps.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
   const warn = deps.warn ?? ((message) => process.stderr.write(`${message}
 `));
   const connected = [
@@ -1589,25 +1816,42 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
     ...cfg.opencode ? ["opencode"] : []
   ];
   if (connected.length > 0) {
-    if (isClaudeCodeConnected(cfg) && !await probeClaude()) {
-      warn(
-        "warning: Claude Code is connected on this device but `claude` isn\u2019t on your PATH, so it advertises nothing and a Claude-model agent won\u2019t be routed here. Install it (`npm i -g @anthropic-ai/claude-code`) and log in, or disconnect it."
-      );
+    for (const runtime of ["claude-code", "codex"]) {
+      const intended = runtime === "codex" ? isCodexEnabled(cfg) : isClaudeCodeConnected(cfg);
+      if (!intended) continue;
+      const resolution = resolveBundled(runtime);
+      if (resolution.status !== "present") warn(startupWarning(resolution));
     }
     return;
   }
   const [claudeInstalled, codexInstalled] = await Promise.all([probeClaude(), probeCodex()]);
-  const installed = [
-    ...claudeInstalled ? ["Claude Code"] : [],
-    ...codexInstalled ? ["Codex"] : []
-  ];
-  const connectCommands = [
-    ...claudeInstalled ? ["`cabane-companion connect claude-code`"] : [],
-    ...codexInstalled ? ["`cabane-companion connect codex`"] : []
+  const found = [
+    ...claudeInstalled ? [
+      {
+        label: "Claude Code",
+        command: "`cabane-companion connect claude-code`",
+        bundled: resolveBundled("claude-code").status
+      }
+    ] : [],
+    ...codexInstalled ? [
+      {
+        label: "Codex",
+        command: "`cabane-companion connect codex`",
+        bundled: resolveBundled("codex").status
+      }
+    ] : []
   ];
-  warn(
-    "No harness is connected on this device yet, so no agent turn can run here. " + (installed.length > 0 ? `We found ${installed.join(" and ")} on this machine \u2014 connect ${installed.length > 1 ? "one with " : "it with "}${connectCommands.join(" or ")} and turns start routing here.` : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).")
-  );
+  const runnable = found.filter((h) => h.bundled === "present");
+  const incomplete = found.filter((h) => h.bundled !== "present");
+  const incompleteNote = incomplete.map(
+    (h) => `${h.label} is installed here, but @cabane/companion's bundled ${h.label} ${missingNoun(h.bundled)} is missing, so connecting it alone won't make it runnable.`
+  ).join(" ");
+  const guidance = runnable.length > 0 ? `We found ${runnable.map((h) => h.label).join(" and ")} on this machine \u2014 connect ${runnable.length > 1 ? "one with " : "it with "}${runnable.map((h) => h.command).join(" or ")} and turns start routing here.${incompleteNote ? ` ${incompleteNote} ${repairAction()}` : ""}` : incomplete.length > 0 ? (
+    // Their machine is fine; this companion's install is not. Repair that,
+    // then connect — no "install a harness" they already have.
+    `${incompleteNote} ${repairAction()} Then connect it with ${incomplete.map((h) => h.command).join(" or ")}.`
+  ) : "Install a harness and sign in \u2014 Claude Code (`npm i -g @anthropic-ai/claude-code`), the Codex CLI (`codex login`), or `opencode serve` \u2014 then connect it with `cabane-companion connect <harness>` (pass `--url <url>` for opencode).";
+  warn(`No harness is connected on this device yet, so no agent turn can run here. ${guidance}`);
 }
 
 // src/runtime-file.ts
@@ -1620,10 +1864,10 @@ import {
   openSync as openSync2,
   closeSync as closeSync2
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var PROBE_TIMEOUT_MS2 = 1e3;
 function runtimePath() {
-  return join6(cabaneDir(), "runtime.json");
+  return join7(cabaneDir(), "runtime.json");
 }
 function serialize(state) {
   return JSON.stringify(state, null, 2) + "\n";
@@ -2173,15 +2417,15 @@ function isAbortError(err) {
   return err instanceof Error && err.name === "AbortError";
 }
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) return resolve();
+  return new Promise((resolve2) => {
+    if (signal?.aborted) return resolve2();
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
-      resolve();
+      resolve2();
     };
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -2272,10 +2516,10 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 import { z as z3 } from "zod";
 function credentialsPath() {
-  return join7(cabaneDir(), "credentials.json");
+  return join8(cabaneDir(), "credentials.json");
 }
 var credentialStoreSchema = z3.record(z3.string(), z3.string());
 function load() {
@@ -2297,7 +2541,7 @@ function load() {
 }
 function save(map) {
   const path = credentialsPath();
-  mkdirSync5(dirname4(path), { recursive: true });
+  mkdirSync5(dirname5(path), { recursive: true });
   try {
     chmodSync3(cabaneDir(), 448);
   } catch {
@@ -2343,9 +2587,9 @@ function pruneCredentials(keepAgentIds) {
 
 // src/cursor.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function pathFor(workspaceId) {
-  return join8(cabaneDir(), "cursors", encodeURIComponent(workspaceId));
+  return join9(cabaneDir(), "cursors", encodeURIComponent(workspaceId));
 }
 function readCursor(workspaceId) {
   const path = pathFor(workspaceId);
@@ -2355,7 +2599,7 @@ function readCursor(workspaceId) {
 }
 function writeCursor(workspaceId, eventId) {
   const path = pathFor(workspaceId);
-  mkdirSync6(join8(cabaneDir(), "cursors"), { recursive: true });
+  mkdirSync6(join9(cabaneDir(), "cursors"), { recursive: true });
   writeFileSync4(path, eventId + "\n", "utf8");
 }
 
@@ -2400,13 +2644,13 @@ var CursorTracker = class {
 
 // src/dispatch-dedupe.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, renameSync as renameSync3, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var MAX_IDS = 256;
 function dir(log) {
-  return join9(cabaneDir(), log);
+  return join10(cabaneDir(), log);
 }
 function pathFor2(log, workspaceId) {
-  return join9(dir(log), encodeURIComponent(workspaceId));
+  return join10(dir(log), encodeURIComponent(workspaceId));
 }
 function readIds(log, workspaceId) {
   const path = pathFor2(log, workspaceId);
@@ -2443,10 +2687,10 @@ function markCompleted(workspaceId, eventId) {
 }
 var MAX_RESUME_ATTEMPTS = 3;
 function resumeDir() {
-  return join9(cabaneDir(), "resume-attempts");
+  return join10(cabaneDir(), "resume-attempts");
 }
 function resumePathFor(workspaceId) {
-  return join9(resumeDir(), encodeURIComponent(workspaceId));
+  return join10(resumeDir(), encodeURIComponent(workspaceId));
 }
 function readResumeCounts(workspaceId) {
   const out = /* @__PURE__ */ new Map();
@@ -2482,10 +2726,10 @@ function bumpResumeAttempt(workspaceId, eventId) {
   return next;
 }
 function turnDir() {
-  return join9(cabaneDir(), "turns");
+  return join10(cabaneDir(), "turns");
 }
 function turnPathFor(workspaceId) {
-  return join9(turnDir(), encodeURIComponent(workspaceId));
+  return join10(turnDir(), encodeURIComponent(workspaceId));
 }
 var TURN_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readTurnIds(workspaceId) {
@@ -4860,7 +5104,7 @@ var serverTurnTails = /* @__PURE__ */ new Map();
 async function acquireServerTurnLock(url) {
   const prev = serverTurnTails.get(url) ?? Promise.resolve();
   let release;
-  const done = new Promise((resolve) => release = resolve);
+  const done = new Promise((resolve2) => release = resolve2);
   serverTurnTails.set(url, done);
   await prev.catch(() => {
   });
@@ -7099,8 +7343,8 @@ var ConnectorHealthStore = class {
 };
 
 // src/dispatcher.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join15 } from "path";
 
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
@@ -7462,11 +7706,11 @@ function trimSlash2(s) {
 // src/codex-instructions.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var PREFIX = "cabane-codex-instructions-";
 async function writeCodexInstructionsFile(contents) {
-  const dir2 = await mkdtemp(join10(tmpdir(), PREFIX));
-  const path = join10(dir2, "instructions.md");
+  const dir2 = await mkdtemp(join11(tmpdir(), PREFIX));
+  const path = join11(dir2, "instructions.md");
   await writeFile(path, contents, { encoding: "utf8", mode: 384 });
   return {
     path,
@@ -7476,6 +7720,42 @@ async function writeCodexInstructionsFile(contents) {
   };
 }
 
+// src/api-error-shape.ts
+var LEASE_REFUSALS = /* @__PURE__ */ new Set([
+  "dispatch_not_admitted",
+  "turn_already_ended",
+  "turn_belongs_elsewhere"
+]);
+function apiErrorCode(err) {
+  if (!(err instanceof ApiError)) return null;
+  const body = err.body;
+  return typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
+}
+function leaseRefusal(err) {
+  const code = apiErrorCode(err);
+  if (code && LEASE_REFUSALS.has(code)) return code;
+  return null;
+}
+function isWriteFenceRefusal(err) {
+  return err instanceof ApiError && err.status === 409 && apiErrorCode(err) === "not_running";
+}
+var ERROR_BODY_LOG_CAP = 2e3;
+function describeErrorBody(body) {
+  if (body === void 0 || body === null) return void 0;
+  let text;
+  if (typeof body === "string") {
+    text = body;
+  } else {
+    try {
+      text = JSON.stringify(body);
+    } catch {
+      text = String(body);
+    }
+  }
+  if (text.length === 0) return void 0;
+  return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
+}
+
 // src/turn-seq-floor.ts
 var SeqFloorUnavailable = class extends Error {
   constructor(detail) {
@@ -7511,15 +7791,15 @@ function readOutboxFloor(read, turnId, log) {
 
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function dirFor(workspaceId) {
-  return join11(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
+  return join12(cabaneDir(), "prepared", encodeURIComponent(workspaceId));
 }
 function conversationDir(workspaceId, conversationId) {
-  return join11(dirFor(workspaceId), encodeURIComponent(conversationId));
+  return join12(dirFor(workspaceId), encodeURIComponent(conversationId));
 }
 function pathFor3(workspaceId, conversationId, agentId) {
-  return join11(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
+  return join12(conversationDir(workspaceId, conversationId), `${encodeURIComponent(agentId)}.json`);
 }
 function readPrepared(workspaceId, conversationId, agentId) {
   const path = pathFor3(workspaceId, conversationId, agentId);
@@ -7551,11 +7831,11 @@ function clearPrepared(workspaceId, conversationId, agentId) {
 
 // src/secrets.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { z as z14 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
-  return join12(cabaneDir(), "secrets.json");
+  return join13(cabaneDir(), "secrets.json");
 }
 var secretStoreSchema = z14.record(z14.string(), z14.string());
 function loadSecretStore() {
@@ -7642,9 +7922,9 @@ function resolveMcpSecrets(mcpServers, store) {
 
 // src/transcript-writer.ts
 import { appendFileSync, chmodSync as chmodSync4, copyFileSync, mkdirSync as mkdirSync9, readdirSync, rmSync as rmSync6 } from "fs";
-import { basename, dirname as dirname5, join as join13 } from "path";
+import { basename, dirname as dirname6, join as join14 } from "path";
 function transcriptsDir() {
-  return join13(cabaneDir(), "transcripts");
+  return join14(cabaneDir(), "transcripts");
 }
 var RETAIN = 200;
 var ANOMALY_RETAIN = 50;
@@ -7654,7 +7934,7 @@ var TranscriptWriter = class {
   onWarn;
   constructor(dir2, meta, onWarn) {
     this.onWarn = onWarn;
-    this.path = join13(dir2, fileName(meta));
+    this.path = join14(dir2, fileName(meta));
     try {
       mkdirSync9(dir2, { recursive: true });
       try {
@@ -7683,10 +7963,10 @@ var TranscriptWriter = class {
   preserveAnomaly() {
     if (this.broken) return;
     try {
-      const dir2 = join13(dirname5(this.path), "anomalies");
+      const dir2 = join14(dirname6(this.path), "anomalies");
       mkdirSync9(dir2, { recursive: true, mode: 448 });
       chmodSync4(dir2, 448);
-      const target = join13(dir2, basename(this.path));
+      const target = join14(dir2, basename(this.path));
       copyFileSync(this.path, target);
       chmodSync4(target, 384);
       pruneOld(dir2, ANOMALY_RETAIN);
@@ -7732,7 +8012,7 @@ function pruneOld(dir2, retain) {
   const drop = files.sort().slice(0, files.length - retain);
   for (const f of drop) {
     try {
-      rmSync6(join13(dir2, f), { force: true });
+      rmSync6(join14(dir2, f), { force: true });
     } catch {
     }
   }
@@ -7879,6 +8159,84 @@ var TurnCommitter = class {
   }
 };
 
+// src/turn-runtime-integrity.ts
+function bundledHarnessFor(runtime) {
+  return runtime === "claude-code" || runtime === "codex" ? runtime : null;
+}
+function resolve(ctx, harness) {
+  return (ctx.resolveBundled ?? resolveBundledBinary)(harness);
+}
+async function postIncompleteNotice(ctx, harness, resolution) {
+  try {
+    await ctx.postTurnMessage(ctx.workspaceId, ctx.conversationId, {
+      body: turnIncompleteCopy(harness),
+      kind: "final",
+      turnId: ctx.turnId,
+      parentMessageId: ctx.parentMessageId
+    });
+    return true;
+  } catch (err) {
+    ctx.log.warn(
+      { err: err instanceof Error ? err.message : String(err) },
+      "dispatcher: runtime-incomplete notice post failed"
+    );
+    return false;
+  }
+}
+async function checkBundledBinary(ctx) {
+  const harness = bundledHarnessFor(ctx.runtime);
+  if (!harness) return null;
+  const resolution = resolve(ctx, harness);
+  if (resolution.status === "present") return null;
+  ctx.log.error(
+    {
+      runtime: harness,
+      status: resolution.status,
+      platform: resolution.platform,
+      arch: resolution.arch
+    },
+    "dispatcher: bundled harness binary missing at dispatch"
+  );
+  return {
+    harness,
+    reason: `runtime_incomplete:${harness}`,
+    posted: await postIncompleteNotice(ctx, harness, resolution)
+  };
+}
+async function reclassifyThrow(ctx, opts) {
+  const harness = bundledHarnessFor(ctx.runtime);
+  if (!harness || opts.aborted) return null;
+  const resolution = resolve(ctx, harness);
+  if (resolution.status === "present") return null;
+  ctx.log.error(
+    {
+      runtime: harness,
+      status: resolution.status,
+      platform: resolution.platform,
+      arch: resolution.arch,
+      originalReason: opts.originalReason
+    },
+    "dispatcher: adapter threw and the bundled harness binary is missing \u2014 reporting the incomplete runtime"
+  );
+  return {
+    harness,
+    reason: `runtime_incomplete:${harness}`,
+    posted: await postIncompleteNotice(ctx, harness, resolution)
+  };
+}
+async function guardBundledBinary(ctx, concluded, outcome) {
+  const incomplete = await checkBundledBinary(ctx);
+  if (!incomplete) return;
+  outcome.runtimeIncomplete = incomplete.posted;
+  throw incomplete.posted ? concluded(incomplete.reason) : concluded(incomplete.reason, incomplete.reason);
+}
+async function absorbBundledLoss(ctx, aborted, outcome) {
+  const lost = await reclassifyThrow(ctx, { aborted, originalReason: outcome.resultReason });
+  if (!lost) return false;
+  outcome.resultReason = lost.reason;
+  return lost.posted;
+}
+
 // src/turn-execution.ts
 var PREPARING_TOOL_NAME = "preparing";
 var PREPARE_FAILED_PREFIX = "**Couldn't prepare your environment.** I wasn't able to provision a working directory for this conversation, so I can't run this turn. The provisioning command reported:";
@@ -7891,40 +8249,6 @@ var DEFAULT_PREPARING_ROW_DELAY_MS = 1500;
 var DEFAULT_AGENT_IDLE_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_AGENT_TOTAL_TIMEOUT_MS = 6 * 60 * 6e4;
 var DEFAULT_LEASE_RENEWAL_MS = 3e4;
-var LEASE_REFUSALS = /* @__PURE__ */ new Set([
-  "dispatch_not_admitted",
-  "turn_already_ended",
-  "turn_belongs_elsewhere"
-]);
-function apiErrorCode(err) {
-  if (!(err instanceof ApiError)) return null;
-  const body = err.body;
-  return typeof body === "object" && body !== null && typeof body.error === "string" ? body.error : null;
-}
-function leaseRefusal(err) {
-  const code = apiErrorCode(err);
-  if (code && LEASE_REFUSALS.has(code)) return code;
-  return null;
-}
-function isWriteFenceRefusal(err) {
-  return err instanceof ApiError && err.status === 409 && apiErrorCode(err) === "not_running";
-}
-var ERROR_BODY_LOG_CAP = 2e3;
-function describeErrorBody(body) {
-  if (body === void 0 || body === null) return void 0;
-  let text;
-  if (typeof body === "string") {
-    text = body;
-  } else {
-    try {
-      text = JSON.stringify(body);
-    } catch {
-      text = String(body);
-    }
-  }
-  if (text.length === 0) return void 0;
-  return text.length > ERROR_BODY_LOG_CAP ? `${text.slice(0, ERROR_BODY_LOG_CAP)}\u2026` : text;
-}
 function initialOutcome() {
   return {
     sessionWritten: false,
@@ -7943,7 +8267,8 @@ function initialOutcome() {
     settledDiagnostics: null,
     silentMarkerEmitted: false,
     timeoutReason: null,
-    leaseLost: false
+    leaseLost: false,
+    runtimeIncomplete: false
   };
 }
 var TurnConcluded = class {
@@ -8094,7 +8419,9 @@ var TurnExecution = class {
       activeRunStartedAt: null,
       turnId,
       settledMessageId: payload.messageId,
-      outcome: errorReason ? "failed" : "settled"
+      // CT1379: `runtimeIncomplete` is a real failure that deliberately carries
+      // no `errorReason`, so the inference alone would read it as settled.
+      outcome: errorReason || this.outcome.runtimeIncomplete ? "failed" : "settled"
     };
     if (errorReason) body.errorReason = errorReason.slice(0, 200);
     try {
@@ -8434,8 +8761,21 @@ ${reason}`,
       ...this.opts.local.claudeCode ? { claudeCode: this.opts.local.claudeCode } : {}
     });
   }
+  integrityContext() {
+    return {
+      runtime: this.turnContext.runtime,
+      workspaceId: this.workspaceId,
+      conversationId: this.payload.conversationId,
+      turnId: this.turnId,
+      parentMessageId: this.payload.messageId,
+      log: this.turnLog,
+      postTurnMessage: (workspaceId, conversationId, body) => this.opts.api.postTurnMessage(workspaceId, conversationId, body),
+      ...this.opts.resolveBundled ? { resolveBundled: this.opts.resolveBundled } : {}
+    };
+  }
   async selectAdapter() {
     const { payload, workspaceId, turnId, turnLog } = this;
+    await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
     const onWarn = (msg, meta) => turnLog.warn(meta ?? {}, msg);
     const adapters = [];
     if (this.opts.claudeCodeAvailable?.() ?? true) {
@@ -8444,7 +8784,7 @@ ${reason}`,
     if (this.opts.opencodeServerUrl) {
       adapters.push(createOpencodeAdapter({ serverUrl: this.opts.opencodeServerUrl, onWarn }));
     }
-    if (this.opts.codexEnabled) {
+    if (this.opts.codexAvailable?.() ?? false) {
       adapters.push(
         createCodexAdapter({
           enabled: true,
@@ -8728,6 +9068,11 @@ ${reason}`,
       o.okResult = false;
       o.resultReason = err instanceof Error ? err.message : String(err);
       turnLog.error({ err: o.resultReason }, "dispatcher: SDK query threw");
+      o.runtimeIncomplete = await absorbBundledLoss(
+        this.integrityContext(),
+        abortController.signal.aborted,
+        o
+      );
     } finally {
       this.disarmWatchdogs();
       if (o.leaseLost) {
@@ -8776,13 +9121,13 @@ ${reason}`,
       if (o.turnResolvedConfig && Object.keys(o.turnResolvedConfig).length > 0) {
         body.resolvedConfig = o.turnResolvedConfig;
       }
-      if (!o.okResult && o.resultReason && o.resultReason !== "cancelled" && !userCancelled && !o.leaseLost && !this.skipState.skipped) {
+      if (!o.okResult && o.resultReason && o.resultReason !== "cancelled" && !userCancelled && !o.leaseLost && !o.runtimeIncomplete && !this.skipState.skipped) {
         body.errorReason = o.resultReason.slice(0, 200);
       }
       if (o.okResult) {
         body.lastSeenMessageId = payload.messageId;
       }
-      body.outcome = o.okResult ? "settled" : body.errorReason ? "failed" : "interrupted";
+      body.outcome = o.okResult ? "settled" : body.errorReason || o.runtimeIncomplete ? "failed" : "interrupted";
       if (o.sessionDegraded) {
         body.degraded = true;
       }
@@ -8907,15 +9252,15 @@ function checkoutState(cwd) {
   if (entries.length === 0) {
     return { ok: false, reason: `${cwd} is empty \u2014 a recreated shell, not a prepared directory` };
   }
-  const gitPath = join14(cwd, ".git");
+  const gitPath = join15(cwd, ".git");
   if (!existsSync11(gitPath)) return { ok: true, reason: "usable" };
   let stat;
   try {
-    stat = statSync(gitPath);
+    stat = statSync2(gitPath);
   } catch (error) {
     return { ok: false, reason: `${gitPath} is unreadable (${error.message})` };
   }
-  if (stat.isDirectory() && !existsSync11(join14(gitPath, "HEAD")))
+  if (stat.isDirectory() && !existsSync11(join15(gitPath, "HEAD")))
     return { ok: false, reason: `${gitPath} has no HEAD \u2014 an empty shell, not a checkout` };
   return { ok: true, reason: "usable" };
 }
@@ -9050,7 +9395,7 @@ import {
   rmSync as rmSync7,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var MAX_ENTRIES = 2e3;
 var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var Outbox = class {
@@ -9063,10 +9408,10 @@ var Outbox = class {
   // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
-    return join15(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
+    return join16(cabaneDir(), "outbox", encodeURIComponent(this.workspaceId));
   }
   fileFor(turnId, seq) {
-    return join15(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
+    return join16(this.dir(), `${encodeURIComponent(turnId)}__${seq}.json`);
   }
   // Persist a commit for later draining. Atomic (temp file + rename) so a
   // concurrent `list()` never reads a half-written entry, then enforces the
@@ -9108,7 +9453,7 @@ var Outbox = class {
     const entries = [];
     for (const name of names) {
       if (!name.endsWith(".json")) continue;
-      const full = join15(dir2, name);
+      const full = join16(dir2, name);
       try {
         const parsed = JSON.parse(readFileSync8(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
@@ -9360,12 +9705,12 @@ var SseSubscriber = class {
   }
 };
 function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
 // src/version.ts
-import { createRequire } from "module";
-var pkg = createRequire(import.meta.url)("../package.json");
+import { createRequire as createRequire2 } from "module";
+var pkg = createRequire2(import.meta.url)("../package.json");
 var COMPANION_VERSION = pkg.version;
 
 // src/supervisor.ts
@@ -9387,10 +9732,15 @@ var CompanionSupervisor = class {
   config;
   log;
   hub;
-  // CT309: gates the claude-code runtime in the heartbeat manifest — the boot
-  // probe (exit-0 `claude --version`), used as the fallback until CT586's
-  // per-heartbeat re-probe lands fresh presence in `harnessSignals`.
-  claudeCode;
+  // CT1379: the bundled-executable resolver — the execution-presence half of both
+  // routing gates. Synchronous and cheap (a module resolve plus a stat), so unlike
+  // the CLI probes it needs no boot-frozen fallback: a caller that asks before the
+  // first harness refresh simply resolves now.
+  resolveBundled;
+  // CT1379: the last bundled status LOGGED per harness, so a missing binary is
+  // reported at startup and on each healthy↔missing transition rather than on
+  // every 30s beat (the CT484 latch pattern, per runtime).
+  loggedBundledStatus = /* @__PURE__ */ new Map();
   // CT571: the probed per-harness versions, reported on each heartbeat manifest.
   // CT586: no longer boot-frozen — the per-heartbeat harness re-probe refreshes
   // it, so a harness updated mid-run reports its new version without a restart.
@@ -9434,13 +9784,14 @@ var CompanionSupervisor = class {
     this.config = opts.config;
     this.log = opts.log;
     this.hub = opts.hub;
-    this.claudeCode = opts.claudeCode ?? true;
+    this.resolveBundled = opts.resolveBundled ?? ((runtime) => resolveBundledBinary(runtime));
     this.probePresence = opts.probePresence ?? probeHarnessPresence;
     this.harnessVersions = opts.harnessVersions ?? emptyHarnessVersions();
     this.exitFn = opts.exit ?? ((code) => process.exit(code));
     this.reexecFn = opts.reexec ?? defaultReexec;
     this.dispatcherFactory = opts.dispatcherFactory;
     this.unrunnableRetryDelaysMs = opts.unrunnableRetryDelaysMs ?? DEFAULT_UNRUNNABLE_RETRY_DELAYS_MS;
+    this.latchBootBundledState();
   }
   // Stand up the data plane: pair check, initial assignments pull, then the
   // heartbeat + poll loops. A companion with no device token (logged out) does
@@ -9523,19 +9874,25 @@ var CompanionSupervisor = class {
       const res = await this.deviceApi.heartbeat({
         version: COMPANION_VERSION,
         exposedSecretNames: store.names(),
-        // Report each runtime only when this device can actually run it: CT309
-        // claude-code when `claude` is on PATH, CT270 opencode when the operator
+        // Report each runtime only when this device can actually run it:
+        // CT1379 claude-code and codex when the SDK's own bundled binary is there
+        // and the user asked for the harness, CT270 opencode when the operator
         // configured an `opencode serve`.
         manifest: buildCompanionManifest({
-          // CT1082: connected AND installed. Presence is the live re-probe (CT586),
-          // falling back to the boot probe until the first one lands; consent is the
-          // user's `claudeCode.enabled`. Claude Code no longer rides presence alone.
+          // CT1082/CT1379: connected AND launchable. Execution presence is the
+          // live bundled-binary resolution (refreshed on this beat), consent is
+          // the user's `claudeCode.enabled`. Claude Code rides neither alone.
           claudeCode: this.claudeCodeOffered(),
           opencode: !!this.config.opencode?.serverUrl,
-          // CT481: advertise codex when the operator enabled it (config-gated,
-          // like opencode — the CLI's presence is the operator's responsibility;
-          // a misconfigured device fails the turn loudly, never silently).
-          codex: isCodexEnabled(this.config),
+          // CT481/CT1379: advertise codex when the operator enabled it AND its
+          // vendored binary is there. The enable flag alone used to be enough,
+          // which is how a device with a half-installed 331 MB platform package
+          // advertised a runtime that could not start.
+          codex: this.codexOffered(),
+          // CT1379: and say WHY when an asked-for harness is absent from the list
+          // above. Diagnostic only — the server never routes on it — and always
+          // sent, so an empty array clears a previously reported issue.
+          runtimeIssues: this.runtimeIssues(),
           // CT571/CT586: each runtime's `version` from the latest harness probe
           // (fail-soft to null). Informational only — the server matches on name.
           versions: this.harnessVersions
@@ -9756,18 +10113,103 @@ var CompanionSupervisor = class {
       "companion: stopped agent (unassigned)"
     );
   }
-  // CT833: is Claude Code on this machine right now? Live (the per-beat re-probe),
-  // falling back to the boot probe until the first one lands. Presence ONLY —
-  // CT1082 split presence from exposure, so nothing routes on this directly.
-  claudeCodePresent() {
-    return this.harnessSignals?.claudeOnPath ?? this.claudeCode;
-  }
-  // CT1082: does this device OFFER claude-code — connected by its user and actually
-  // installed? The ONE signal both the heartbeat manifest and the dispatcher's
-  // adapter registry read, so what the device advertises and what it can select
-  // can't disagree (the CT833 invariant, now with consent in front of it).
+  // CT1379: can this machine LAUNCH the harness — is the SDK's own bundled
+  // executable there? Live (the per-beat re-resolve), falling back to resolving
+  // right now before the first refresh lands. Execution presence ONLY; consent is
+  // the caller's half.
+  bundledStatus(runtime) {
+    const cached2 = runtime === "codex" ? this.harnessSignals?.codexBundled : this.harnessSignals?.claudeBundled;
+    return cached2 ?? this.resolveBundled(runtime).status;
+  }
+  // The full resolution rather than just its status — the transition log needs the
+  // platform/architecture and the repair the copy is built from, and re-resolving
+  // is a module lookup plus a stat.
+  bundledResolution(runtime) {
+    return this.resolveBundled(runtime);
+  }
+  // CT1082/CT1379: does this device OFFER claude-code — connected by its user, and
+  // able to start the binary a turn runs? The ONE signal both the heartbeat
+  // manifest and the dispatcher's adapter registry read, so what the device
+  // advertises and what it can select can't disagree (the CT833 invariant, with
+  // consent in front of it and the real executable underneath it).
   claudeCodeOffered() {
-    return isClaudeCodeConnected(this.config) && this.claudeCodePresent();
+    return isClaudeCodeConnected(this.config) && this.bundledStatus("claude-code") === "present";
+  }
+  // CT1379: and the same question for codex, which until now was the enable flag
+  // alone — so an enabled device with no vendored binary advertised a runtime it
+  // could not start. Same shape as Claude Code, same predicate on both sides.
+  codexOffered() {
+    return isCodexEnabled(this.config) && this.bundledStatus("codex") === "present";
+  }
+  // CT1379: the manifest's diagnostic half, derived from the same two facts as the
+  // two predicates above so an issue and an advertisement can never both be made
+  // for one harness.
+  runtimeIssues() {
+    return runtimeIssuesFor({
+      claudeCode: {
+        intended: isClaudeCodeConnected(this.config),
+        bundled: this.bundledStatus("claude-code")
+      },
+      codex: { intended: isCodexEnabled(this.config), bundled: this.bundledStatus("codex") }
+    });
+  }
+  // CT1379: a missing binary is reported ONCE, and again only when the answer
+  // CHANGES — with the runtime, the platform/architecture and the resolution
+  // result, which is enough to find the occurrence in `companion.log` without a
+  // repro and carries nothing that could be a credential or a vendor's output.
+  //
+  // Two things this deliberately does NOT do (Codo's review, blocking finding #2):
+  //
+  //   - It does not re-announce the state the device booted in. `warnAboutHarnessReadiness`
+  //     already said that on stderr at startup, in the specified words, at the one
+  //     moment a person is watching a terminal — and the `--daemon` launcher runs
+  //     that preflight in the FOREGROUND for exactly that reason, because the
+  //     child's output goes to a file. The boot state is latched in the
+  //     constructor, so the first refresh reports nothing new; it lands here as a
+  //     debug record instead, present for diagnosis without competing for
+  //     attention with the warning the operator already read.
+  //   - It does not report a transition in generic prose. A binary that goes
+  //     missing at 3am is the case the operator will actually meet, and a line
+  //     that says only "binary is missing" leaves them with no repair and no
+  //     restart instruction. Transitions carry the specified copy verbatim — the
+  //     same sentence the startup path prints.
+  logBundledTransitions() {
+    for (const runtime of ["claude-code", "codex"]) {
+      const intended = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
+      const resolution = this.bundledResolution(runtime);
+      const status = resolution.status;
+      if (this.loggedBundledStatus.get(runtime) === status) continue;
+      this.loggedBundledStatus.set(runtime, status);
+      const meta = { runtime, platform: resolution.platform, arch: resolution.arch, status };
+      if (status === "present") {
+        const say = intended ? this.log.info : this.log.debug;
+        say.call(this.log, meta, "companion: bundled harness binary is present again");
+        continue;
+      }
+      if (intended) this.log.warn(meta, startupWarning(resolution));
+      else
+        this.log.debug(meta, "companion: bundled harness binary is missing (harness not in use)");
+    }
+  }
+  // CT1379: the boot state, latched so the first refresh reports no news, and
+  // recorded once as evidence. Runs in the constructor — the resolve is a module
+  // lookup plus a stat, so it costs nothing and needs no await.
+  latchBootBundledState() {
+    for (const runtime of ["claude-code", "codex"]) {
+      const resolution = this.resolveBundled(runtime);
+      this.loggedBundledStatus.set(runtime, resolution.status);
+      if (resolution.status === "present") continue;
+      this.log.debug(
+        {
+          runtime,
+          platform: resolution.platform,
+          arch: resolution.arch,
+          status: resolution.status,
+          intended: runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config)
+        },
+        "companion: bundled harness binary missing at startup (warned by the readiness check)"
+      );
+    }
   }
   buildDispatcher(ctx) {
     const local = localAgentConfig(this.config, {
@@ -9791,16 +10233,23 @@ var CompanionSupervisor = class {
       // CT833: register the claude-code adapter only when this device actually
       // offers claude-code — read per turn (not captured here), so a harness
       // installed or connected after boot works on the next turn exactly as it
-      // appears on the next beat. CT1082: "offers" now means connected as well as
-      // installed, so a disconnected harness can't be selected either.
+      // appears on the next beat. CT1082: "offers" means connected as well as
+      // runnable, so a disconnected harness can't be selected either.
+      // CT1379: and the same for the bundled binary — the predicate is shared with
+      // the heartbeat above, so a runtime advertised by one and refused by the
+      // other is not expressible.
       claudeCodeAvailable: () => this.claudeCodeOffered(),
       // CT270: the opencode server URL (operator-configured), when this device
       // offers the opencode runtime. Threaded so an opencode turn selects the
       // opencode adapter; unset leaves the device claude-code-only.
       ...this.config.opencode?.serverUrl ? { opencodeServerUrl: this.config.opencode.serverUrl } : {},
-      // CT481: register the codex adapter when this device offers codex; unset
+      // CT481: register the codex adapter when this device offers codex; a miss
       // leaves an `openai/…` turn to fail loudly (no silent claude-code fallback).
-      ...isCodexEnabled(this.config) ? { codexEnabled: true } : {},
+      // CT1379: read PER TURN, like claude-code above, and off the same predicate
+      // the heartbeat uses — it was captured here at dispatcher-construction time
+      // from the enable flag alone, so a device could register an adapter for a
+      // binary it did not have and keep it registered after the binary came back.
+      codexAvailable: () => this.codexOffered(),
       // CT556: per-turn timeout watchdog windows, from the companion's own env
       // (`AGENT_IDLE_TIMEOUT_MS` / `AGENT_TOTAL_TIMEOUT_MS`). Unset → the
       // dispatcher's baked-in defaults (10 min idle / 6h total).
@@ -10170,9 +10619,13 @@ var CompanionSupervisor = class {
     try {
       const signals = await probeHarnessSignals(this.config, {
         probePresence: this.probePresence,
-        presence
+        presence,
+        // CT1379: the bundled executables are resolved on the same cadence as the
+        // CLI probes, through the supervisor's seam so a test pins the host fact.
+        resolveBundled: this.resolveBundled
       });
       this.harnessSignals = signals;
+      this.logBundledTransitions();
       this.harnessVersions = {
         claudeCode: signals.claudeVersion,
         opencode: signals.opencodeVersion,
@@ -10212,8 +10665,15 @@ var CompanionSupervisor = class {
     return this.config;
   }
   // Friendly enable for the config-driven harnesses — flip the flag the app owns in
-  // `~/.cabane/config.json`, no hand-edited JSON. This is enable/expose ONLY: it
-  // never installs a binary and never drives a login (BYO — Decided).
+  // `~/.cabane/config.json`, no hand-edited JSON. It never installs a binary and
+  // never drives a login (BYO — Decided).
+  //
+  // CT1379: this records INTENT; it does not by itself expose anything. A harness
+  // is advertised only when the user asked for it AND the SDK's own bundled binary
+  // resolves, so a successful enable on a companion whose optional dependency
+  // never installed leaves the device advertising nothing — correctly, and with
+  // the Harnesses surface saying why. Read every "expose" below as "record the
+  // half of the answer the user owns".
   //   - claude-code (CT1082): set `claudeCode.enabled`, after checking `claude` is
   //     on PATH. This is the callable the terminal offer ("We found Claude Code.
   //     Connect it? [Y/n]") and the web pairing flow both wire to.
@@ -10222,9 +10682,10 @@ var CompanionSupervisor = class {
   //   - opencode: set `opencode.serverUrl` — but ONLY after health-probing the URL,
   //     so we never advertise a serve that isn't there. An unreachable URL is a
   //     typed failure the UI shows in place, not a silent bad write.
-  // On success, persist, re-probe, and beat immediately so Cabane starts routing to
-  // the newly-exposed runtime at once. Returns a typed outcome (never throws for a
-  // reachable/valid input).
+  // On success, persist, re-probe, and beat immediately, so a runtime that IS
+  // launchable starts taking turns at once rather than on the next tick — and one
+  // that isn't reports its issue just as promptly. Returns a typed outcome (never
+  // throws for a reachable/valid input).
   async enableHarness(input) {
     let next;
     let checkedPresence = null;
@@ -10322,8 +10783,8 @@ var CompanionSupervisor = class {
 };
 async function waitForBoundedHeartbeat(heartbeat) {
   let timer = null;
-  const timeout = new Promise((resolve) => {
-    timer = setTimeout(resolve, SHUTDOWN_HEARTBEAT_WAIT_MS);
+  const timeout = new Promise((resolve2) => {
+    timer = setTimeout(resolve2, SHUTDOWN_HEARTBEAT_WAIT_MS);
     timer.unref?.();
   });
   try {
@@ -10407,9 +10868,9 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync9, rmSync as rmSync8, writeFileSync as writeFileSync8 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function crashMarkerPath() {
-  return join16(cabaneDir(), "last-error.json");
+  return join17(cabaneDir(), "last-error.json");
 }
 function recordCrash(rec) {
   try {
@@ -10458,8 +10919,8 @@ async function createCompanionRuntime(opts = {}) {
   }
   if (cfg.logLevel) log.level = cfg.logLevel;
   const harnessVersions = await probeHarnessVersions({
-    // CT1082: versions are probed for the runtimes this device OFFERS, and
-    // claude-code is offered only when connected as well as installed.
+    // Connected AND its CLI answered — the two things that make a
+    // `claude --version` probe worth spawning. Not the offer predicate.
     claudeCode: claudeCode && isClaudeCodeConnected(cfg),
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
@@ -10492,7 +10953,6 @@ async function createCompanionRuntime(opts = {}) {
     config: cfg,
     log,
     hub,
-    claudeCode,
     harnessVersions
   });
   await supervisor.start();