@tablation/crew 0.100.3 → 0.101.0

package/dist/cli.js

@@ -19973,6 +19973,7 @@ async function execute(h, args, streaming, after) {
 var isPeriscopePath = (p) => p === "/periscopes" || p.startsWith("/periscopes/");
 async function handlePeriscopes(h, q) {
   if (!h || !h.routes.some((r) => r.hostPeriscopes)) return err(404, "not found");
+  if (!q.token) return err(401, "a bearer token is required");
   const down = /^\/periscopes\/([^/]+)\/down$/.exec(q.path);
   const isUp = q.path === "/periscopes" && q.method === "POST";
   const isList = q.path === "/periscopes" && q.method === "GET";
@@ -19989,6 +19990,7 @@ async function handlePeriscopes(h, q) {
     const named = q.query.get("route") ?? void 0;
     const candidates2 = named === void 0 ? h.routes.filter((r) => r.hostPeriscopes) : [pickRoute(h, named)];
     const rows = [];
+    const hosting = [];
     for (const c of candidates2) {
       if ("status" in c) return c;
       const denied2 = await member(c.workspaceId);
@@ -20001,12 +20003,21 @@ async function handlePeriscopes(h, q) {
       if (r.code !== 0) return err(failureStatus(r), cliMessage(r));
       try {
         const list = JSON.parse(r.stdout);
-        if (Array.isArray(list)) for (const e of list) rows.push({ route: c.route, ...e });
+        const mine = Array.isArray(list) ? list : [];
+        for (const e of mine) rows.push({ route: c.route, ...e });
+        hosting.push({
+          route: c.route,
+          workspaceId: c.workspaceId,
+          previewHostSet: !!h.previewHost,
+          maxPeriscopes: h.maxPeriscopes,
+          live: mine.length,
+          repos: h.previewRepos?.(c.route) ?? []
+        });
       } catch {
         return err(502, "the list command did not answer JSON");
       }
     }
-    return reply(200, { periscopes: rows });
+    return reply(200, { periscopes: rows, hosting });
   }
   const b = q.body;
   if (!b) return err(400, "body must be a small JSON object");
@@ -20136,6 +20147,7 @@ var ControlAuth = class {
   async verifyIn(token, workspaceId) {
     if (!token) return "unauthorized";
     for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
+    for (const k of this.o.workspaceSecrets?.(workspaceId) ?? []) if (k && secretsMatch(token, k)) return "ok";
     const now = (this.o.now ?? Date.now)();
     const id = `${workspaceId}:${createHash9("sha256").update(token).digest("hex")}`;
     const hit = this.cache.get(id);
@@ -20465,6 +20477,9 @@ async function startControlServer(deps) {
           if (!deps.periscopeMcp) return send(res, err2(404, "not found"));
           return await deps.periscopeMcp(req, res, decodeURIComponent(mcp[1]));
         }
+        if (isPeriscopePath(new URL(req.url ?? "/", "http://ship").pathname.replace(/\/+$/, "") || "/")) {
+          return await send(res, await route(deps, req.method ?? "GET", new URL(req.url ?? "/", "http://ship"), req, abort.signal));
+        }
         const m = /^Bearer (.+)$/.exec(req.headers.authorization ?? "");
         const verdict = await deps.auth.verify(m?.[1]?.trim() ?? "");
         if (verdict === "unauthorized") return send(res, err2(401, "invalid or revoked key"));
@@ -22979,6 +22994,10 @@ ${cu.tail.trimEnd()}
             return [];
           }
         }),
+        workspaceSecrets: (ws) => {
+          const sec = readPersistedTunnel(cfg.ship.stateDir, ws)?.mcpSecret;
+          return sec ? [sec] : [];
+        },
         userAgent: cfg.ship.userAgent
       });
       const controlServer = await startControlServer({
@@ -22992,6 +23011,17 @@ ${cu.tail.trimEnd()}
           maxPeriscopes: cfg.ship.maxPeriscopes,
           run: runCrew,
           verifyIn: (token, ws) => controlAuth.verifyIn(token, ws),
+          previewRepos: (routeName) => {
+            const r = controlRoutes.find((x) => x.route === routeName);
+            if (!r) return [];
+            return reposOf(r).filter((t) => {
+              try {
+                return !!loadRepoConfig(t.dir)?.hooks.preview;
+              } catch {
+                return false;
+              }
+            }).map((t) => t.name);
+          },
           mcp: {
             onUp: async (r, done) => {
               const id = typeof done.ticketRecordId === "string" ? done.ticketRecordId : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.100.3",
+  "version": "0.101.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",