@tablation/crew 0.102.0 → 0.103.0

package/dist/cli.js

@@ -12387,7 +12387,17 @@ async function runProvision(o, deps, write, human) {
     emit("problem", message, data);
     return { code, summary: { ...summary, ok: false, state: "failed" } };
   };
-  if (!o.key) return fail(PROVISION_EXIT.problem, "no connect key: pass --key or set CREW_CONNECT_KEY", { stage: "input" });
+  const keyFor = (route2) => {
+    const ws = route2.split("/")[0].toLowerCase();
+    const hit = Object.entries(o.keys ?? {}).find(([k, v]) => k.toLowerCase() === ws && v);
+    return hit?.[1] || o.key || void 0;
+  };
+  for (const route2 of o.routes) {
+    if (!keyFor(route2)) {
+      return fail(PROVISION_EXIT.problem, `no connect key for ${route2}: pass --key or set CREW_CONNECT_KEY_${envKey(route2.split("/")[0])} or CREW_CONNECT_KEY`, { stage: "input" });
+    }
+  }
+  if (o.routes.length === 0 && !o.key) return fail(PROVISION_EXIT.problem, "no connect key: pass --key or set CREW_CONNECT_KEY", { stage: "input" });
   if (o.routes.length === 0) {
     return fail(PROVISION_EXIT.problem, "no routes to serve: pass --route WORKSPACE[/PROJECT] (repeatable) or set CREW_PROVISION_ROUTES", { stage: "input" });
   }
@@ -12413,7 +12423,7 @@ async function runProvision(o, deps, write, human) {
       ...o.dryRun ? ["--dry-run"] : [],
       ...o.choices.flatMap((c) => ["--choose", c])
     ];
-    const res = deps.crew(args, { env: { CREW_CONNECT_KEY: o.key } });
+    const res = deps.crew(args, { env: { CREW_CONNECT_KEY: keyFor(route2) } });
     const events = parseEvents(res.stdout);
     for (const e of events) if (o.json) write(`${JSON.stringify({ ...e, phase: "connect" })}
 `);
@@ -12503,6 +12513,15 @@ function tokensFromEnv(hosts, env) {
   }
   return out;
 }
+function keysFromEnv(routes, env) {
+  const out = {};
+  for (const r of routes) {
+    const ws = r.split("/")[0];
+    const v = env[`CREW_CONNECT_KEY_${envKey(ws)}`]?.trim();
+    if (v) out[ws] = v;
+  }
+  return out;
+}
 function repeated(argv2, name) {
   const out = [];
   for (let i = 0; i < argv2.length; i++) {
@@ -12523,9 +12542,11 @@ function provisionOptionsFrom(argv2, env) {
   const forgeFlags = repeated(argv2, "forge-host");
   const tokenAvailable = !!env.CREW_FORGE_TOKEN?.trim() || Object.keys(env).some((k) => k.startsWith("CREW_FORGE_TOKEN_") && env[k]?.trim());
   const forgeHosts = (forgeFlags.length ? forgeFlags : tokenAvailable ? splitList(env.CREW_FORGE_HOSTS ?? "github.com") : []).map((h) => h.toLowerCase());
+  const routeList = routes.length ? routes : splitList(env.CREW_PROVISION_ROUTES);
   return {
     key: one("key") ?? env.CREW_CONNECT_KEY,
-    routes: routes.length ? routes : splitList(env.CREW_PROVISION_ROUTES),
+    keys: keysFromEnv(routeList, env),
+    routes: routeList,
     shipName: one("ship-name") ?? env.CREW_SHIP_NAME,
     shipKind: one("ship-kind"),
     instanceClass: one("instance-class"),
@@ -12546,6 +12567,7 @@ function realProvisionDeps(crewHome) {
     const [bin, ...pre] = crewInvocation(crewHome);
     const env = { ...process.env, ...o.env };
     delete env.CREW_FORGE_TOKEN;
+    for (const k of Object.keys(env)) if (k.startsWith("CREW_CONNECT_KEY_")) delete env[k];
     const res = spawnSync7(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
     return { status: res.status ?? 1, stdout: res.stdout ?? "", stderr: `${res.stderr ?? ""}${res.error ? String(res.error) : ""}` };
   };
@@ -12851,6 +12873,7 @@ function realPoolMemberDeps(o) {
       const lines2 = [];
       const outcome = await runProvision({
         key: lease.connectKey,
+        keys: Object.fromEntries((lease.connectKeys ?? []).map((k) => [k.workspace, k.key])),
         routes: lease.routes.map((r) => `${r.workspace}/${r.project}`),
         shipName: lease.shipName,
         shipKind,
@@ -19493,6 +19516,8 @@ async function call(api, method, url, body) {
 }
 function bodyFor(d, forPatch) {
   const body = { label: d.label, url: d.url };
+  if (d.controlUrl !== void 0) body.controlUrl = d.controlUrl;
+  if (d.discoverable !== void 0) body.discoverable = d.discoverable;
   if (d.mcpSecret) body.authorizationHeader = `Bearer ${d.mcpSecret}`;
   else if (forPatch) body.authorizationHeader = null;
   return body;
@@ -19541,15 +19566,17 @@ async function probeEndpointAccess(api, workspaceId) {
   }
 }
 var REGISTER_MCP_ENDPOINTS_HINT = "give this key's role the REGISTER_MCP_ENDPOINTS capability, e.g. via the group that holds the Crew project role";
-function registrationKey(url, mcpSecret) {
+function registrationKey(url, mcpSecret, controlUrl) {
   return createHash8("sha256").update(`${url}
-${mcpSecret ?? ""}`).digest("hex").slice(0, 16);
+${mcpSecret ?? ""}
+${controlUrl ?? ""}`).digest("hex").slice(0, 16);
 }
 async function reconcileEndpoint(workspaceId, d) {
   const st = readPersistedTunnel(d.stateDir, workspaceId);
   if (!st || st.status !== "connected" || !st.slug) return;
   const url = d.urlFor(st.slug);
-  const key = registrationKey(url, st.mcpSecret);
+  const controlUrl = st.controlSocket && d.controlUrlFor ? d.controlUrlFor(st.slug) : null;
+  const key = registrationKey(url, st.mcpSecret, controlUrl);
   if (st.endpointId && st.registeredKey === key) return;
   const api = d.apiFor(workspaceId);
   if (!api) {
@@ -19559,7 +19586,8 @@ async function reconcileEndpoint(workspaceId, d) {
   const out = await registerEndpoint(api, workspaceId, st.endpointId, {
     label: `Ship: ${d.shipName}`,
     url,
-    mcpSecret: st.mcpSecret
+    mcpSecret: st.mcpSecret,
+    controlUrl
   });
   if (out.kind === "ok") {
     updatePersistedTunnel(d.stateDir, workspaceId, { endpointId: out.endpointId, registeredKey: key });
@@ -21232,7 +21260,8 @@ async function registerPeriscopeEndpoint(d, p) {
   const out = await registerEndpoint(api, p.workspaceId, stored?.endpointId, {
     label: `Periscope: ${d.shipName} ${p.ticket}`,
     url,
-    mcpSecret: secret
+    mcpSecret: secret,
+    discoverable: false
   });
   if (out.kind !== "ok") {
     return { ok: false, message: out.kind === "forbidden" ? "registering the endpoint was refused (403): the route key lacks REGISTER_MCP_ENDPOINTS" : out.message };
@@ -22047,6 +22076,7 @@ if (command === "passenger-sync-daemon") {
       shipName: cfg.ship.name,
       apiFor: endpointApiFor(routes),
       urlFor: (slug) => publicUrlFor(slug, relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain),
+      controlUrlFor: (slug) => `${relayBaseUrlFor(slug, relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain)}/control`,
       warn: (m) => emit.warn(m, { step: "passengers" })
     };
   }, releaseRefused = function() {
@@ -27122,6 +27152,9 @@ ${foreign.join("\n")}
               `                   ${r.route} url: ${slug ? publicUrlFor(slug, cfg.ship.relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain) : "not minted yet (first tunnel cycle creates it)"}
 `
             );
+            const controlUrl = slug && readPersistedTunnel(cfg.ship.stateDir, ws)?.controlSocket ? `${relayBaseUrlFor(slug, cfg.ship.relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain)}/control` : void 0;
+            process.stdout.write(`                   ${r.route} control url: ${controlUrl ?? "none (the tunnel carries passengers only)"}
+`);
             const api = endpointApiFor([r])(ws);
             if (!api) continue;
             const probe = await probeEndpointAccess(api, ws);
@@ -27140,7 +27173,7 @@ ${foreign.join("\n")}
       }
       for (const e of listPeriscopeEndpoints(cfg.ship.stateDir)) {
         const secret = readPeriscopeSecret(cfg.ship.stateDir, e.ticketRecordId) ? "live" : "ended, awaiting removal";
-        process.stdout.write(`periscope mcp:     ${e.ticket} ${e.route} ${e.url} (${secret})
+        process.stdout.write(`periscope mcp:     ${e.ticket} ${e.route} ${e.url} (${secret}, attached only)
 `);
       }
       if (cfg.ship.relayHost && !flag("offline")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.102.0",
+  "version": "0.103.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",