@tablation/crew 0.113.0 → 0.114.0

package/dist/cli.js

@@ -3030,7 +3030,9 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "maxPeriscopes",
   "periscopeIdleMinutes",
   "secretStore",
-  "env"
+  "env",
+  "runner",
+  "sandbox"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -12164,6 +12166,17 @@ function roleCapWarnings(ship) {
   if (!ship.maxConcurrentAgentsSet) return [];
   return Object.entries(ship.roleConcurrency).filter(([, n]) => (n ?? 0) > ship.maxConcurrentAgents).map(([role, n]) => `ship.roleConcurrency.${role} is ${n}, above ship.maxConcurrentAgents (${ship.maxConcurrentAgents}); the ship-wide cap wins`);
 }
+function managedRuntimeWarnings(kind, ship) {
+  if (kind !== "managed_instance" && kind !== "pooled_instance" && kind !== "pooled") return [];
+  const out = [];
+  const explicit = ship.toolchains ?? [];
+  const effectiveToolchains = explicit.some((t) => t.name === "claude") ? explicit : [{ name: "claude", harness: "claude" }, ...explicit];
+  if ((ship.runner ?? "host") !== "sandbox") out.push(`ship.runner is "${ship.runner ?? "host"}" on a ${kind} ship; a managed ship should run agents in the sandbox (set ship.runner: sandbox)`);
+  for (const t of effectiveToolchains) {
+    if (t.harness === "claude" && t.auth !== "workspace") out.push(`ship.toolchains.${t.name}.auth is "${t.auth ?? "inherit"}" on a ${kind} ship; a managed ship reaches a model only through the workspace endpoint (set auth: workspace)`);
+  }
+  return out;
+}
 
 // src/selftest.ts
 import { spawn as spawn5 } from "child_process";
@@ -13248,7 +13261,7 @@ function matchShipRows(ships, shipName2, machineId) {
 import { spawnSync as spawnSync7 } from "child_process";
 import { existsSync as existsSync28, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "fs";
 import { hostname as hostname2 } from "os";
-import { parseDocument as parseDocument3 } from "yaml";
+import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
 // src/doctor-fix.ts
 import { parseDocument as parseDocument2 } from "yaml";
@@ -13684,6 +13697,15 @@ async function runProvision(o, deps, write, human) {
       emit("connect", `set ship.${key}`, { setting: key });
     }
   }
+  if (o.runner === "host") {
+    emit("connect", "runner: host chosen explicitly (--runner host); not applying the managed sandbox defaults", { setting: "ship.runner", value: "host" });
+    if (deps.setShipSetting("runner", "host")) summary.changed = true;
+  } else if (o.runner === "sandbox" || isManagedShipKind(o.shipKind)) {
+    for (const key of deps.applyManagedDefaults()) {
+      summary.changed = true;
+      emit("connect", `set ${key}`, { setting: key });
+    }
+  }
   for (const host of o.forgeHosts) {
     const token = o.tokens[host];
     const stored = deps.storedToken(host);
@@ -13727,6 +13749,38 @@ async function runProvision(o, deps, write, human) {
   emit("done", summary.state, { summary });
   return { code: PROVISION_EXIT.ok, summary };
 }
+function isManagedShipKind(kind) {
+  return kind === "managed_instance" || kind === "pooled_instance" || kind === "pooled";
+}
+var MANAGED_CACHE_VOLUME = "crew-cache";
+function applyManagedDefaultsToDoc(doc) {
+  const wrote = [];
+  if (doc.getIn(["ship", "runner"]) === void 0) {
+    doc.setIn(["ship", "runner"], "sandbox");
+    wrote.push("ship.runner");
+  }
+  if (doc.getIn(["ship", "sandbox", "cacheVolume"]) === void 0) {
+    doc.setIn(["ship", "sandbox", "cacheVolume"], MANAGED_CACHE_VOLUME);
+    wrote.push("ship.sandbox.cacheVolume");
+  }
+  const existing = doc.getIn(["ship", "toolchains"]);
+  const hasClaude = isMap2(existing) && existing.items.some((i) => (isScalar(i.key) ? i.key.value : i.key) === "claude");
+  if (!hasClaude) {
+    doc.setIn(["ship", "toolchains", "claude", "harness"], "claude");
+    for (const k of ["bin", "model", "maxThinkingTokens"]) {
+      const v = doc.getIn(["ship", "agent", k]);
+      if (v !== void 0) doc.setIn(["ship", "toolchains", "claude", k], v);
+    }
+  }
+  const toolchains = doc.getIn(["ship", "toolchains"]);
+  for (const name of isMap2(toolchains) ? toolchains.items.map((i) => String(isScalar(i.key) ? i.key.value : i.key)) : []) {
+    if (doc.getIn(["ship", "toolchains", name, "harness"]) !== "claude") continue;
+    if (doc.getIn(["ship", "toolchains", name, "auth"]) !== void 0) continue;
+    doc.setIn(["ship", "toolchains", name, "auth"], "workspace");
+    wrote.push(`ship.toolchains.${name}.auth`);
+  }
+  return wrote;
+}
 function envKey(host) {
   return host.toUpperCase().replace(/[^A-Z0-9]/g, "_");
 }
@@ -13778,6 +13832,7 @@ function provisionOptionsFrom(argv2, env) {
     relayHost: one("relay-host"),
     maxConcurrentAgents: Number.isInteger(Number(one("max-concurrent-agents"))) && Number(one("max-concurrent-agents")) > 0 ? Number(one("max-concurrent-agents")) : void 0,
     agentBin: one("agent-bin"),
+    runner: one("runner") === "host" || one("runner") === "sandbox" ? one("runner") : void 0,
     extraPath: one("extra-path"),
     baseUrl: one("base-url"),
     forgeHosts,
@@ -13862,6 +13917,14 @@ function realProvisionDeps(crewHome) {
       writeFileSync21(file, doc.toString());
       return true;
     },
+    applyManagedDefaults() {
+      const file = configFile();
+      if (!file) return [];
+      const doc = parseDocument3(readFileSync27(file, "utf8"));
+      const wrote = applyManagedDefaultsToDoc(doc);
+      if (wrote.length) writeFileSync21(file, doc.toString());
+      return wrote;
+    },
     storedToken(host) {
       const res = spawnCrew(["credential", "get"], { input: `protocol=https
 host=${host}
@@ -19371,7 +19434,7 @@ function renderRepoCheck(r) {
 }
 
 // src/repos-hooks.ts
-import { isMap as isMap2, parseDocument as parseDocument6, YAMLMap } from "yaml";
+import { isMap as isMap3, parseDocument as parseDocument6, YAMLMap } from "yaml";
 function packageManager(f) {
   if (f.exists("pnpm-lock.yaml")) return "pnpm";
   if (f.exists("yarn.lock")) return "yarn";
@@ -19517,9 +19580,9 @@ function planRouteHooks(text2, route2, name, hooks, opts = {}) {
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
   let target = m;
-  if (isMap2(repos)) {
+  if (isMap3(repos)) {
     const entry = repos.get(name, true);
-    if (isMap2(entry)) target = entry;
+    if (isMap3(entry)) target = entry;
     else {
       const created = new YAMLMap();
       created.set("dir", String(repos.get(name)));
@@ -19529,7 +19592,7 @@ function planRouteHooks(text2, route2, name, hooks, opts = {}) {
   }
   const current = target.get("hooks", true);
   let hooksMap;
-  if (isMap2(current)) hooksMap = current;
+  if (isMap3(current)) hooksMap = current;
   else {
     hooksMap = new YAMLMap();
     target.set("hooks", hooksMap);
@@ -19554,13 +19617,13 @@ function clearRouteHooks(text2, route2, name) {
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
   let target = m;
-  if (isMap2(repos)) {
+  if (isMap3(repos)) {
     const entry = repos.get(name, true);
-    if (!isMap2(entry)) return { text: text2, removed: [] };
+    if (!isMap3(entry)) return { text: text2, removed: [] };
     target = entry;
   }
   const current = target.get("hooks", true);
-  if (!isMap2(current)) return { text: text2, removed: [] };
+  if (!isMap3(current)) return { text: text2, removed: [] };
   const removed = current.items.map((i) => String(i.key.value ?? i.key));
   target.delete("hooks");
   return { text: String(doc), removed };
@@ -23881,6 +23944,15 @@ if (command === "passenger-sync-daemon") {
     }
     return { problems, readiness };
   }
+  async function doctorShipKind(route3, ship) {
+    try {
+      const rows = await new Tracker(route3, ship).shipRows();
+      const mine = matchShipRows(rows, ship.name, doctorMachineId(ship.stateDir)).rows;
+      return mine.length === 1 ? mine[0].kind ?? null : null;
+    } catch {
+      return null;
+    }
+  }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
     const unitExists = (p) => existsSync45(p);
@@ -26327,7 +26399,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         let apiKeyFile;
         const apiKeyVar = "CREW_API_KEY";
-        if (firstRunFromFlags && agentBinSearched && !dryRun) {
+        if (firstRunFromFlags && agentBinSearched && !dryRun && !isManagedShipKind(value("ship-kind"))) {
           const msg = `no agent binary: "claude" was not found on PATH or in ${agentBinSearched.join(", ")} \u2014 pass --agent-bin /absolute/path`;
           process.stderr.write(`crew connect: ${msg}
 `);
@@ -28234,6 +28306,9 @@ watermark:  ${state.watermark()}
           }
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
+        if (!flag("offline")) {
+          for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -28472,6 +28547,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "none"}
 `
           );
+          for (const w of managedRuntimeWarnings(row.kind, cfg.ship)) process.stdout.write(`managed runtime:  WARN ${w}
+`);
         }
       }
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.113.0",
+  "version": "0.114.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",