@tablation/crew 0.112.0 → 0.114.0

package/dist/cli.js

@@ -3030,7 +3030,9 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "maxPeriscopes",
   "periscopeIdleMinutes",
   "secretStore",
-  "env"
+  "env",
+  "runner",
+  "sandbox"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -11784,7 +11786,13 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/sandbox-image.ts
 var SANDBOX_BASE_IMAGE = "nvcr.io/nvidia/base/ubuntu:24.04";
-var SANDBOX_HARNESS_VERSION = "0.1.6";
+var SANDBOX_OPENSHELL_VERSION = "0.1.6";
+var SANDBOX_CLAUDE_VERSION = "2.1.309";
+var SANDBOX_CLAUDE_DIST = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases";
+var SANDBOX_CLAUDE_SHA256 = {
+  x86_64: { platform: "linux-x64", sha256: "4d704a8aecbe038affa3000f498ae17c1b4f753add8facb8764120affc99b658" },
+  aarch64: { platform: "linux-arm64", sha256: "9796dd26899337f687739a0b39a7353b639f062a3436a7b941fcf19a1b757a9b" }
+};
 var SANDBOX_UID = 1e3;
 var CREW_PREFIX = "/opt/crew";
 var SANDBOX_RETRY_AFTER_MS = 60 * 60 * 1e3;
@@ -11808,15 +11816,28 @@ var CREW_ENV = {
   XDG_CACHE_HOME: `${CREW_PREFIX}/cache`,
   npm_config_cache: `${CREW_PREFIX}/cache/npm`,
   npm_config_store_dir: `${CREW_PREFIX}/pnpm-store`,
-  PNPM_HOME: `${CREW_PREFIX}/pnpm`
+  PNPM_HOME: `${CREW_PREFIX}/pnpm`,
+  // A run cannot reach the download host, so an in-run update attempt is only noise.
+  DISABLE_AUTOUPDATER: "1"
 };
+function claudeInstallCommand() {
+  const cases = Object.entries(SANDBOX_CLAUDE_SHA256).map(([arch, { platform: platform2, sha256: sha2562 }]) => `${arch}) p=${platform2}; sum=${sha2562};;`).join(" ");
+  return [
+    `case "$(uname -m)" in ${cases} *) echo "no pinned Claude Code binary for $(uname -m)" >&2; exit 1;; esac`,
+    `mkdir -p ${CREW_PREFIX}/bin`,
+    `curl -fsSL --retry 3 -o ${CREW_PREFIX}/bin/claude "${SANDBOX_CLAUDE_DIST}/${SANDBOX_CLAUDE_VERSION}/$p/claude"`,
+    `echo "$sum  ${CREW_PREFIX}/bin/claude" | sha256sum -c -`,
+    `chmod 0755 ${CREW_PREFIX}/bin/claude`,
+    `${CREW_PREFIX}/bin/claude --version | grep -F "${SANDBOX_CLAUDE_VERSION}"`
+  ].join("; ");
+}
 function baseLayer() {
   const dockerfile = [
     `FROM ${SANDBOX_BASE_IMAGE}`,
-    `LABEL io.crew.sandbox.layer="base" io.crew.sandbox.harness="${SANDBOX_HARNESS_VERSION}"`,
+    `LABEL io.crew.sandbox.layer="base" io.crew.sandbox.openshell="${SANDBOX_OPENSHELL_VERSION}"`,
     ""
   ].join("\n");
-  return { name: "base", tag: `crew-sandbox-base:${hash({ SANDBOX_BASE_IMAGE, SANDBOX_HARNESS_VERSION })}`, dockerfile, files: {} };
+  return { name: "base", tag: `crew-sandbox-base:${hash({ SANDBOX_BASE_IMAGE, SANDBOX_OPENSHELL_VERSION })}`, dockerfile, files: {} };
 }
 function crewLayer(base) {
   const files = { "credential-helper": CREDENTIAL_HELPER, "mcp.json": MCP_CONFIG };
@@ -11827,10 +11848,11 @@ function crewLayer(base) {
     run2("apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git && rm -rf /var/lib/apt/lists/*"),
     `COPY credential-helper ${CREW_PREFIX}/bin/credential-helper`,
     `COPY mcp.json ${CREW_PREFIX}/mcp/mcp.json`,
+    run2(claudeInstallCommand()),
     run2(`chmod 0755 ${CREW_PREFIX}/bin/credential-helper && git config --system credential.helper ${CREW_PREFIX}/bin/credential-helper`),
     run2(`mkdir -p ${CREW_PREFIX}/cache ${CREW_PREFIX}/pnpm-store ${CREW_PREFIX}/pnpm /sandbox && chown -R ${SANDBOX_UID}:${SANDBOX_UID} ${CREW_PREFIX} /sandbox`),
     `ENV ${env} PATH=${CREW_PREFIX}/pnpm:${CREW_PREFIX}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
-    `LABEL io.crew.sandbox.layer="crew"`,
+    `LABEL io.crew.sandbox.layer="crew" io.crew.sandbox.claude="${SANDBOX_CLAUDE_VERSION}"`,
     ""
   ].join("\n");
   return { name: "crew", tag: `crew-sandbox-crew:${hash({ base: base.tag, dockerfile, files })}`, dockerfile, files };
@@ -11891,7 +11913,7 @@ function planSandbox(repo, decl, warm = {}) {
   const base = baseLayer();
   const crew = crewLayer(base);
   const layer = repoLayer(repo, decl, crew, warm);
-  return { repo, tag: layer.tag, layers: [base, crew, layer] };
+  return { repo, tag: layer.tag, claude: SANDBOX_CLAUDE_VERSION, layers: [base, crew, layer] };
 }
 var sandboxStatePath = (stateDir) => join26(stateDir, "sandbox-images.json");
 function readSandboxState(stateDir) {
@@ -11916,8 +11938,8 @@ function sandboxImageStatus(state, plan) {
     return { status: "failed", detail: `last build of ${plan.tag} failed at ${s.failure.at}; log ${s.failure.logPath}${current ? `; running ${current.tag}` : ""}` };
   }
   if (!current) return { status: "missing", detail: `no image built yet (wants ${plan.tag}); run \`crew sandbox build\`` };
-  if (current.tag !== plan.tag) return { status: "stale", detail: `running ${current.tag}, declaration now builds ${plan.tag}` };
-  return { status: "ok", detail: `${current.tag} built ${current.builtAt}` };
+  if (current.tag !== plan.tag) return { status: "stale", detail: `running ${current.tag} (claude ${current.claude ?? "unknown"}), declaration now builds ${plan.tag} (claude ${plan.claude})` };
+  return { status: "ok", detail: `${current.tag} built ${current.builtAt}, claude ${current.claude ?? "unknown"}` };
 }
 var spawnBuildRunner = (engine = "docker") => (args, logPath) => new Promise((resolve7) => {
   const child = spawn4(engine, args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -11980,7 +12002,7 @@ async function buildSandboxImage(plan, deps) {
       rmSync13(ctx, { recursive: true, force: true });
     }
   }
-  const tags = [{ tag: plan.tag, builtAt: now().toISOString() }, ...entry.tags.filter((t) => t.tag !== plan.tag)];
+  const tags = [{ tag: plan.tag, builtAt: now().toISOString(), claude: plan.claude }, ...entry.tags.filter((t) => t.tag !== plan.tag)];
   const dropped = tags.slice(KEEP_TAGS);
   state[plan.repo] = { tags: tags.slice(0, KEEP_TAGS) };
   writeSandboxState(deps.stateDir, state);
@@ -12144,6 +12166,17 @@ function roleCapWarnings(ship) {
   if (!ship.maxConcurrentAgentsSet) return [];
   return Object.entries(ship.roleConcurrency).filter(([, n]) => (n ?? 0) > ship.maxConcurrentAgents).map(([role, n]) => `ship.roleConcurrency.${role} is ${n}, above ship.maxConcurrentAgents (${ship.maxConcurrentAgents}); the ship-wide cap wins`);
 }
+function managedRuntimeWarnings(kind, ship) {
+  if (kind !== "managed_instance" && kind !== "pooled_instance" && kind !== "pooled") return [];
+  const out = [];
+  const explicit = ship.toolchains ?? [];
+  const effectiveToolchains = explicit.some((t) => t.name === "claude") ? explicit : [{ name: "claude", harness: "claude" }, ...explicit];
+  if ((ship.runner ?? "host") !== "sandbox") out.push(`ship.runner is "${ship.runner ?? "host"}" on a ${kind} ship; a managed ship should run agents in the sandbox (set ship.runner: sandbox)`);
+  for (const t of effectiveToolchains) {
+    if (t.harness === "claude" && t.auth !== "workspace") out.push(`ship.toolchains.${t.name}.auth is "${t.auth ?? "inherit"}" on a ${kind} ship; a managed ship reaches a model only through the workspace endpoint (set auth: workspace)`);
+  }
+  return out;
+}
 
 // src/selftest.ts
 import { spawn as spawn5 } from "child_process";
@@ -13228,7 +13261,7 @@ function matchShipRows(ships, shipName2, machineId) {
 import { spawnSync as spawnSync7 } from "child_process";
 import { existsSync as existsSync28, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "fs";
 import { hostname as hostname2 } from "os";
-import { parseDocument as parseDocument3 } from "yaml";
+import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
 // src/doctor-fix.ts
 import { parseDocument as parseDocument2 } from "yaml";
@@ -13664,6 +13697,15 @@ async function runProvision(o, deps, write, human) {
       emit("connect", `set ship.${key}`, { setting: key });
     }
   }
+  if (o.runner === "host") {
+    emit("connect", "runner: host chosen explicitly (--runner host); not applying the managed sandbox defaults", { setting: "ship.runner", value: "host" });
+    if (deps.setShipSetting("runner", "host")) summary.changed = true;
+  } else if (o.runner === "sandbox" || isManagedShipKind(o.shipKind)) {
+    for (const key of deps.applyManagedDefaults()) {
+      summary.changed = true;
+      emit("connect", `set ${key}`, { setting: key });
+    }
+  }
   for (const host of o.forgeHosts) {
     const token = o.tokens[host];
     const stored = deps.storedToken(host);
@@ -13707,6 +13749,38 @@ async function runProvision(o, deps, write, human) {
   emit("done", summary.state, { summary });
   return { code: PROVISION_EXIT.ok, summary };
 }
+function isManagedShipKind(kind) {
+  return kind === "managed_instance" || kind === "pooled_instance" || kind === "pooled";
+}
+var MANAGED_CACHE_VOLUME = "crew-cache";
+function applyManagedDefaultsToDoc(doc) {
+  const wrote = [];
+  if (doc.getIn(["ship", "runner"]) === void 0) {
+    doc.setIn(["ship", "runner"], "sandbox");
+    wrote.push("ship.runner");
+  }
+  if (doc.getIn(["ship", "sandbox", "cacheVolume"]) === void 0) {
+    doc.setIn(["ship", "sandbox", "cacheVolume"], MANAGED_CACHE_VOLUME);
+    wrote.push("ship.sandbox.cacheVolume");
+  }
+  const existing = doc.getIn(["ship", "toolchains"]);
+  const hasClaude = isMap2(existing) && existing.items.some((i) => (isScalar(i.key) ? i.key.value : i.key) === "claude");
+  if (!hasClaude) {
+    doc.setIn(["ship", "toolchains", "claude", "harness"], "claude");
+    for (const k of ["bin", "model", "maxThinkingTokens"]) {
+      const v = doc.getIn(["ship", "agent", k]);
+      if (v !== void 0) doc.setIn(["ship", "toolchains", "claude", k], v);
+    }
+  }
+  const toolchains = doc.getIn(["ship", "toolchains"]);
+  for (const name of isMap2(toolchains) ? toolchains.items.map((i) => String(isScalar(i.key) ? i.key.value : i.key)) : []) {
+    if (doc.getIn(["ship", "toolchains", name, "harness"]) !== "claude") continue;
+    if (doc.getIn(["ship", "toolchains", name, "auth"]) !== void 0) continue;
+    doc.setIn(["ship", "toolchains", name, "auth"], "workspace");
+    wrote.push(`ship.toolchains.${name}.auth`);
+  }
+  return wrote;
+}
 function envKey(host) {
   return host.toUpperCase().replace(/[^A-Z0-9]/g, "_");
 }
@@ -13758,6 +13832,7 @@ function provisionOptionsFrom(argv2, env) {
     relayHost: one("relay-host"),
     maxConcurrentAgents: Number.isInteger(Number(one("max-concurrent-agents"))) && Number(one("max-concurrent-agents")) > 0 ? Number(one("max-concurrent-agents")) : void 0,
     agentBin: one("agent-bin"),
+    runner: one("runner") === "host" || one("runner") === "sandbox" ? one("runner") : void 0,
     extraPath: one("extra-path"),
     baseUrl: one("base-url"),
     forgeHosts,
@@ -13842,6 +13917,14 @@ function realProvisionDeps(crewHome) {
       writeFileSync21(file, doc.toString());
       return true;
     },
+    applyManagedDefaults() {
+      const file = configFile();
+      if (!file) return [];
+      const doc = parseDocument3(readFileSync27(file, "utf8"));
+      const wrote = applyManagedDefaultsToDoc(doc);
+      if (wrote.length) writeFileSync21(file, doc.toString());
+      return wrote;
+    },
     storedToken(host) {
       const res = spawnCrew(["credential", "get"], { input: `protocol=https
 host=${host}
@@ -19351,7 +19434,7 @@ function renderRepoCheck(r) {
 }
 
 // src/repos-hooks.ts
-import { isMap as isMap2, parseDocument as parseDocument6, YAMLMap } from "yaml";
+import { isMap as isMap3, parseDocument as parseDocument6, YAMLMap } from "yaml";
 function packageManager(f) {
   if (f.exists("pnpm-lock.yaml")) return "pnpm";
   if (f.exists("yarn.lock")) return "yarn";
@@ -19497,9 +19580,9 @@ function planRouteHooks(text2, route2, name, hooks, opts = {}) {
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
   let target = m;
-  if (isMap2(repos)) {
+  if (isMap3(repos)) {
     const entry = repos.get(name, true);
-    if (isMap2(entry)) target = entry;
+    if (isMap3(entry)) target = entry;
     else {
       const created = new YAMLMap();
       created.set("dir", String(repos.get(name)));
@@ -19509,7 +19592,7 @@ function planRouteHooks(text2, route2, name, hooks, opts = {}) {
   }
   const current = target.get("hooks", true);
   let hooksMap;
-  if (isMap2(current)) hooksMap = current;
+  if (isMap3(current)) hooksMap = current;
   else {
     hooksMap = new YAMLMap();
     target.set("hooks", hooksMap);
@@ -19534,13 +19617,13 @@ function clearRouteHooks(text2, route2, name) {
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
   let target = m;
-  if (isMap2(repos)) {
+  if (isMap3(repos)) {
     const entry = repos.get(name, true);
-    if (!isMap2(entry)) return { text: text2, removed: [] };
+    if (!isMap3(entry)) return { text: text2, removed: [] };
     target = entry;
   }
   const current = target.get("hooks", true);
-  if (!isMap2(current)) return { text: text2, removed: [] };
+  if (!isMap3(current)) return { text: text2, removed: [] };
   const removed = current.items.map((i) => String(i.key.value ?? i.key));
   target.delete("hooks");
   return { text: String(doc), removed };
@@ -23861,6 +23944,15 @@ if (command === "passenger-sync-daemon") {
     }
     return { problems, readiness };
   }
+  async function doctorShipKind(route3, ship) {
+    try {
+      const rows = await new Tracker(route3, ship).shipRows();
+      const mine = matchShipRows(rows, ship.name, doctorMachineId(ship.stateDir)).rows;
+      return mine.length === 1 ? mine[0].kind ?? null : null;
+    } catch {
+      return null;
+    }
+  }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
     const unitExists = (p) => existsSync45(p);
@@ -26307,7 +26399,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         let apiKeyFile;
         const apiKeyVar = "CREW_API_KEY";
-        if (firstRunFromFlags && agentBinSearched && !dryRun) {
+        if (firstRunFromFlags && agentBinSearched && !dryRun && !isManagedShipKind(value("ship-kind"))) {
           const msg = `no agent binary: "claude" was not found on PATH or in ${agentBinSearched.join(", ")} \u2014 pass --agent-bin /absolute/path`;
           process.stderr.write(`crew connect: ${msg}
 `);
@@ -26683,7 +26775,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
               for (const t of r.tags) {
                 const ageH = Math.max(0, Math.round((Date.now() - Date.parse(t.builtAt)) / 36e5));
-                process.stdout.write(`  ${t.tag}  built ${t.builtAt} (${ageH}h ago)
+                process.stdout.write(`  ${t.tag}  built ${t.builtAt} (${ageH}h ago), claude ${t.claude ?? "unknown"}
 `);
               }
             }
@@ -28214,6 +28306,9 @@ watermark:  ${state.watermark()}
           }
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
+        if (!flag("offline")) {
+          for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -28452,6 +28547,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "none"}
 `
           );
+          for (const w of managedRuntimeWarnings(row.kind, cfg.ship)) process.stdout.write(`managed runtime:  WARN ${w}
+`);
         }
       }
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.112.0",
+  "version": "0.114.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",