@tablation/crew 0.113.0 → 0.115.0

package/dist/cli.js

@@ -45,12 +45,12 @@ function periscopeSummary(cfg) {
   if (routes.length === 0) return `off (no enabled route sets hostPeriscopes: true; ${limits})`;
   return `ON for ${routes.join(", ")} (host ${cfg.ship.previewHost ?? "NOT SET (ship.previewHost)"}, ${limits})`;
 }
-async function previewHostProblem(cfg, resolve7 = (h) => lookup(h)) {
+async function previewHostProblem(cfg, resolve8 = (h) => lookup(h)) {
   if (periscopeRoutes(cfg).length === 0) return void 0;
   const host = cfg.ship.previewHost;
   if (!host) return "ship.previewHost is not set \u2014 a route hosts periscopes, so Passengers have no host to be sent to";
   try {
-    await resolve7(host);
+    await resolve8(host);
   } catch {
     return `ship.previewHost "${host}" does not resolve from this machine`;
   }
@@ -103,15 +103,92 @@ function duplicateLivePeriscopes(rows, tagOf, shipName2, route2) {
   return out;
 }
 
+// src/periscope-pointed.ts
+import { execFileSync } from "child_process";
+import { appendFileSync, existsSync as existsSync2, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, isAbsolute, join, resolve } from "path";
+var POINTED_AT_DIR = ".crew";
+var POINTED_AT_REL = `${POINTED_AT_DIR}/pointed-at.jsonl`;
+var pointedAtFile = (worktree) => join(worktree, POINTED_AT_REL);
+function pointedAtEnv(worktree) {
+  return { CREW_PERISCOPE: "1", CREW_POINTED_AT_FILE: pointedAtFile(worktree) };
+}
+function excludeFile(worktree) {
+  try {
+    const p = execFileSync("git", ["rev-parse", "--git-path", "info/exclude"], {
+      cwd: worktree,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return p ? isAbsolute(p) ? p : resolve(worktree, p) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function prepareDropFile(worktree) {
+  const file = pointedAtFile(worktree);
+  mkdirSync(dirname(file), { recursive: true });
+  if (!existsSync2(file)) writeFileSync(file, "");
+  const ex = excludeFile(worktree);
+  if (ex) {
+    mkdirSync(dirname(ex), { recursive: true });
+    const have = existsSync2(ex) ? readFileSync(ex, "utf8") : "";
+    if (!have.split("\n").some((l) => l.trim() === `${POINTED_AT_DIR}/`)) {
+      appendFileSync(ex, `${have === "" || have.endsWith("\n") ? "" : "\n"}${POINTED_AT_DIR}/
+`);
+    }
+  }
+  return file;
+}
+function parseLine(raw) {
+  let v;
+  try {
+    v = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (!v || typeof v !== "object") return void 0;
+  const o = v;
+  if (typeof o.path !== "string" || o.path === "" || typeof o.line !== "number" || !Number.isInteger(o.line) || o.line < 1) return void 0;
+  if (typeof o.at !== "string") return void 0;
+  const out = { path: o.path, line: o.line, at: o.at };
+  if (typeof o.column === "number") out.column = o.column;
+  if (typeof o.component === "string") out.component = o.component;
+  if (typeof o.url === "string") out.url = o.url;
+  return out;
+}
+function readPointedAt(worktree) {
+  let text2;
+  try {
+    text2 = readFileSync(pointedAtFile(worktree), "utf8");
+  } catch {
+    return null;
+  }
+  const lines2 = text2.split("\n");
+  for (let i = lines2.length - 1; i >= 0; i--) {
+    if (lines2[i].trim() === "") continue;
+    const p = parseLine(lines2[i]);
+    if (p) return p;
+  }
+  return null;
+}
+function dropFileMtime(worktree) {
+  try {
+    return statSync(pointedAtFile(worktree)).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
 // src/periscope-state.ts
-import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { connect } from "net";
-import { join } from "path";
-var dirOf = (stateDir) => join(stateDir, "periscopes");
-var fileOf = (stateDir, ticketRecordId) => join(dirOf(stateDir), `${ticketRecordId}.json`);
+import { join as join2 } from "path";
+var dirOf = (stateDir) => join2(stateDir, "periscopes");
+var fileOf = (stateDir, ticketRecordId) => join2(dirOf(stateDir), `${ticketRecordId}.json`);
 function writePeriscopeSidecar(stateDir, sc) {
-  mkdirSync(dirOf(stateDir), { recursive: true });
-  writeFileSync(fileOf(stateDir, sc.ticketRecordId), `${JSON.stringify(sc, null, 2)}
+  mkdirSync2(dirOf(stateDir), { recursive: true });
+  writeFileSync2(fileOf(stateDir, sc.ticketRecordId), `${JSON.stringify(sc, null, 2)}
 `);
 }
 function removePeriscopeSidecar(stateDir, ticketRecordId) {
@@ -119,12 +196,12 @@ function removePeriscopeSidecar(stateDir, ticketRecordId) {
 }
 function readPeriscopeSidecars(stateDir) {
   const dir = dirOf(stateDir);
-  if (!existsSync2(dir)) return [];
+  if (!existsSync3(dir)) return [];
   const out = [];
   for (const name of readdirSync(dir)) {
     if (!name.endsWith(".json")) continue;
     try {
-      const sc = JSON.parse(readFileSync(join(dir, name), "utf8"));
+      const sc = JSON.parse(readFileSync2(join2(dir, name), "utf8"));
       if (sc && typeof sc.ticketRecordId === "string" && typeof sc.url === "string") out.push(sc);
     } catch {
     }
@@ -140,11 +217,11 @@ function urlPort(url) {
   }
 }
 function portListening(port, timeoutMs = 500) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const s = connect({ port, host: "127.0.0.1" });
     const done = (ok) => {
       s.destroy();
-      resolve7(ok);
+      resolve8(ok);
     };
     s.setTimeout(timeoutMs, () => done(false));
     s.once("connect", () => done(true));
@@ -154,7 +231,7 @@ function portListening(port, timeoutMs = 500) {
 async function periscopesForStatus(stateDir, probe = portListening) {
   return Promise.all(readPeriscopeSidecars(stateDir).map(async (sc) => {
     const port = urlPort(sc.url);
-    return { ...sc, serving: port === void 0 ? false : await probe(port) };
+    return { ...sc, serving: port === void 0 ? false : await probe(port), pointedAt: readPointedAt(sc.worktree) };
   }));
 }
 
@@ -242,23 +319,23 @@ function shellInitScript(shell) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
-import { resolve, dirname as dirname4, isAbsolute, join as join12, basename as basename4 } from "path";
+import { readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
+import { resolve as resolve2, dirname as dirname5, isAbsolute as isAbsolute2, join as join13, basename as basename4 } from "path";
 import { homedir as homedir6, tmpdir } from "os";
 import { parse as parse2 } from "yaml";
 
 // src/events.ts
 import {
-  appendFileSync,
-  mkdirSync as mkdirSync2,
-  existsSync as existsSync3,
-  statSync,
+  appendFileSync as appendFileSync2,
+  mkdirSync as mkdirSync3,
+  existsSync as existsSync4,
+  statSync as statSync2,
   renameSync,
   openSync,
   closeSync,
   rmSync as rmSync2
 } from "fs";
-import { join as join2, dirname } from "path";
+import { join as join3, dirname as dirname2 } from "path";
 function render(e) {
   const scope = e.role ? `${e.step}[${e.role}]` : e.step;
   const ticket = e.ticket ? ` ${e.ticket}` : "";
@@ -270,7 +347,7 @@ var ROTATED_EVENTS_RE = /^events\.\d{8}T\d{6}Z(?:-\d+)?\.jsonl$/;
 var ROTATE_LOCK_STALE_MS = 6e4;
 function rotateEventsFile(file, maxBytes, now = /* @__PURE__ */ new Date()) {
   try {
-    if (!existsSync3(file) || statSync(file).size <= maxBytes) return void 0;
+    if (!existsSync4(file) || statSync2(file).size <= maxBytes) return void 0;
   } catch {
     return void 0;
   }
@@ -280,7 +357,7 @@ function rotateEventsFile(file, maxBytes, now = /* @__PURE__ */ new Date()) {
       closeSync(openSync(lock, "wx"));
     } catch {
       try {
-        if (Date.now() - statSync(lock).mtimeMs < ROTATE_LOCK_STALE_MS) return void 0;
+        if (Date.now() - statSync2(lock).mtimeMs < ROTATE_LOCK_STALE_MS) return void 0;
         rmSync2(lock, { force: true });
         closeSync(openSync(lock, "wx"));
       } catch {
@@ -288,10 +365,10 @@ function rotateEventsFile(file, maxBytes, now = /* @__PURE__ */ new Date()) {
       }
     }
     try {
-      if (statSync(file).size <= maxBytes) return void 0;
+      if (statSync2(file).size <= maxBytes) return void 0;
       const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-      let dest = join2(dirname(file), `events.${stamp}.jsonl`);
-      for (let n = 1; existsSync3(dest); n++) dest = join2(dirname(file), `events.${stamp}-${n}.jsonl`);
+      let dest = join3(dirname2(file), `events.${stamp}.jsonl`);
+      for (let n = 1; existsSync4(dest); n++) dest = join3(dirname2(file), `events.${stamp}-${n}.jsonl`);
       renameSync(file, dest);
       return dest;
     } finally {
@@ -314,7 +391,7 @@ var Emitter = class _Emitter {
     for (const f of [opts.eventFile, opts.logFile]) {
       if (!f) continue;
       try {
-        mkdirSync2(dirname(f), { recursive: true });
+        mkdirSync3(dirname2(f), { recursive: true });
       } catch {
       }
     }
@@ -342,12 +419,12 @@ var Emitter = class _Emitter {
     } catch {
     }
     try {
-      if (this.opts.eventFile) appendFileSync(this.opts.eventFile, `${JSON.stringify(e)}
+      if (this.opts.eventFile) appendFileSync2(this.opts.eventFile, `${JSON.stringify(e)}
 `);
     } catch {
     }
     try {
-      if (this.opts.logFile) appendFileSync(this.opts.logFile, `${line}
+      if (this.opts.logFile) appendFileSync2(this.opts.logFile, `${line}
 `);
     } catch {
     }
@@ -390,18 +467,18 @@ var Emitter = class _Emitter {
     }
   }
 };
-var eventFileFor = (stateDir) => join2(stateDir, "events.jsonl");
+var eventFileFor = (stateDir) => join3(stateDir, "events.jsonl");
 
 // src/pair-install.ts
-import { existsSync as existsSync6, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/adapters/claude.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/stream.ts
 function toolTarget(name, input) {
@@ -460,19 +537,19 @@ function extractResult(line) {
 
 // src/claude-mcp.ts
 import { spawnSync } from "child_process";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/mcp-registrations.ts
 import { createHash } from "crypto";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join3 } from "path";
-var fileFor = (stateDir) => join3(stateDir, "mcp-registrations.json");
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+var fileFor = (stateDir) => join4(stateDir, "mcp-registrations.json");
 var keyFingerprint = (key) => createHash("sha256").update(key).digest("hex").slice(0, 8);
 function readMcpRegistrations(stateDir) {
   try {
-    const j = JSON.parse(readFileSync3(fileFor(stateDir), "utf8"));
+    const j = JSON.parse(readFileSync4(fileFor(stateDir), "utf8"));
     return Array.isArray(j) ? j : [];
   } catch {
     return [];
@@ -480,8 +557,8 @@ function readMcpRegistrations(stateDir) {
 }
 function recordMcpRegistration(stateDir, r, now = /* @__PURE__ */ new Date()) {
   const rest = readMcpRegistrations(stateDir).filter((x) => !(x.harness === r.harness && x.scope === r.scope && x.name === r.name));
-  mkdirSync3(stateDir, { recursive: true });
-  writeFileSync2(fileFor(stateDir), `${JSON.stringify([...rest, { ...r, at: now.toISOString() }], null, 2)}
+  mkdirSync4(stateDir, { recursive: true });
+  writeFileSync3(fileFor(stateDir), `${JSON.stringify([...rest, { ...r, at: now.toISOString() }], null, 2)}
 `, { mode: 384 });
 }
 function findMcpRegistration(stateDir, r) {
@@ -504,7 +581,7 @@ function runClaude(bin, args) {
 }
 function userScopeEntry(home) {
   try {
-    const j = JSON.parse(readFileSync4(join4(home, ".claude.json"), "utf8"));
+    const j = JSON.parse(readFileSync5(join5(home, ".claude.json"), "utf8"));
     return j.mcpServers?.[MCP_SERVER_NAME];
   } catch {
     return void 0;
@@ -588,8 +665,8 @@ function removeClaudeMcp(o) {
 }
 
 // src/launcher.ts
-import { basename, join as join5 } from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
+import { basename, join as join6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 function isOriLauncher(spec) {
   return !!spec.launcher && basename(spec.launcher) === "ori";
@@ -598,7 +675,7 @@ function isOmlxLauncher(spec) {
   return !!spec.launcher && basename(spec.launcher) === "omlx";
 }
 function defaultOmlxBin(home = homedir2()) {
-  return join5(home, ".omlx", "bin", "omlx");
+  return join6(home, ".omlx", "bin", "omlx");
 }
 function launcherExecutable(spec, home) {
   if (!spec.launcher) return void 0;
@@ -651,8 +728,8 @@ function omlxModelPresent(model, dirs) {
   });
 }
 function readOmlxSettings(home = homedir2()) {
-  const p = join5(home, ".omlx", "settings.json");
-  return existsSync4(p) ? parseOmlxSettings(readFileSync5(p, "utf8")) : void 0;
+  const p = join6(home, ".omlx", "settings.json");
+  return existsSync5(p) ? parseOmlxSettings(readFileSync6(p, "utf8")) : void 0;
 }
 
 // src/capability.ts
@@ -716,7 +793,7 @@ function describeClaudeAuth(spec, env = process.env, home = homedir3()) {
   if (spec.auth === "workspace") return `workspace${spec.inference ? ` (${new URL(spec.inference.baseUrl).host})` : " (endpoint resolved per route at run time)"}`;
   let fromSettings;
   try {
-    const parsed = JSON.parse(readFileSync6(join6(home, ".claude", "settings.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync7(join7(home, ".claude", "settings.json"), "utf8"));
     const e = parsed.env ?? {};
     const on = (k) => e[k] !== void 0 && e[k] !== "" && e[k] !== "0";
     if (on("CLAUDE_CODE_USE_VERTEX")) fromSettings = "vertex from ~/.claude/settings.json";
@@ -820,12 +897,12 @@ var claudeAdapter = {
 // src/adapters/codex.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
-import { rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
+import { rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
 
 // src/pair-files.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, rmSync as rmSync3 } from "fs";
-import { dirname as dirname2 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync4, rmSync as rmSync3 } from "fs";
+import { dirname as dirname3 } from "path";
 var PAIR_BLOCK_START = "<!-- crew:pair start -->";
 var PAIR_BLOCK_END = "<!-- crew:pair end -->";
 var PAIR_KEY_VAR = "CREW_API_KEY";
@@ -865,11 +942,11 @@ function removePairBlock(text2) {
   return text2.replace(new RegExp(`\\n*${BLOCK_RE.source}`), "\n").replace(/^\n+/, "").replace(/\n{3,}/g, "\n\n");
 }
 function readIfExists(path) {
-  return existsSync5(path) ? readFileSync7(path, "utf8") : void 0;
+  return existsSync6(path) ? readFileSync8(path, "utf8") : void 0;
 }
 function writeFileMkdir(path, text2) {
-  mkdirSync4(dirname2(path), { recursive: true });
-  writeFileSync3(path, text2);
+  mkdirSync5(dirname3(path), { recursive: true });
+  writeFileSync4(path, text2);
 }
 function installBlockFile(path, harness, dryRun) {
   const before = readIfExists(path) ?? "";
@@ -885,7 +962,7 @@ function removeBlockFile(path, dryRun) {
   if (dryRun) return true;
   const after = removePairBlock(before);
   if (after.trim() === "") rmSync3(path);
-  else writeFileSync3(path, after);
+  else writeFileSync4(path, after);
   return true;
 }
 function blockVerdict(path, harness) {
@@ -1012,8 +1089,8 @@ function codexTable(url) {
   return [`[mcp_servers.${SERVER}]`, `url = ${tomlString(url)}`, `bearer_token_env_var = ${tomlString(PAIR_KEY_VAR)}`];
 }
 var codexPaths = (home) => ({
-  instructions: join7(home, ".codex", "AGENTS.md"),
-  config: join7(home, ".codex", "config.toml")
+  instructions: join8(home, ".codex", "AGENTS.md"),
+  config: join8(home, ".codex", "config.toml")
 });
 function codexMcpState(config, url) {
   const lines2 = config.split("\n");
@@ -1064,7 +1141,7 @@ var codexPair = {
     if (hadMcp && !o.dryRun) {
       const after = removeTomlTable(config, `mcp_servers.${SERVER}`);
       if (after === "") rmSync4(p.config);
-      else writeFileSync4(p.config, after);
+      else writeFileSync5(p.config, after);
     }
     const what = hadBlock && hadMcp ? `the Pair block and ${SERVER} server` : hadBlock ? "the Pair block" : `the ${SERVER} server`;
     return hadBlock || hadMcp ? `pair(codex): ${o.dryRun ? "(dry run) would remove" : "removed"} ${what}${kept}` : `pair(codex): nothing to remove${kept}`;
@@ -1160,8 +1237,8 @@ var codexAdapter = {
 
 // src/pair-install.ts
 var geminiPaths = (home) => ({
-  instructions: join8(home, ".gemini", "GEMINI.md"),
-  config: join8(home, ".gemini", "settings.json")
+  instructions: join9(home, ".gemini", "GEMINI.md"),
+  config: join9(home, ".gemini", "settings.json")
 });
 function readGeminiSettings(path) {
   const text2 = readIfExists(path);
@@ -1249,7 +1326,7 @@ var geminiPair = {
       if (Object.keys(rest).length > 0) next.mcpServers = rest;
       else delete next.mcpServers;
       if (Object.keys(next).length === 0) rmSync5(p.config);
-      else writeFileSync5(p.config, `${JSON.stringify(next, null, 2)}
+      else writeFileSync6(p.config, `${JSON.stringify(next, null, 2)}
 `);
     }
     const what = hadBlock && hadMcp ? `the Pair block and ${SERVER} server` : hadBlock ? "the Pair block" : `the ${SERVER} server`;
@@ -1260,9 +1337,9 @@ var VSCODE_FLAVOURS = ["Code", "Code - Insiders"];
 function vscodeUserDirs(o) {
   const home = o.home ?? homedir5();
   const platform2 = o.platform ?? process.platform;
-  const root = platform2 === "darwin" ? join8(home, "Library", "Application Support") : platform2 === "win32" ? process.env.APPDATA ?? join8(home, "AppData", "Roaming") : join8(home, ".config");
-  const all = VSCODE_FLAVOURS.map((f) => join8(root, f, "User"));
-  const present = all.filter((d) => existsSync6(d));
+  const root = platform2 === "darwin" ? join9(home, "Library", "Application Support") : platform2 === "win32" ? process.env.APPDATA ?? join9(home, "AppData", "Roaming") : join9(home, ".config");
+  const all = VSCODE_FLAVOURS.map((f) => join9(root, f, "User"));
+  const present = all.filter((d) => existsSync7(d));
   return present.length > 0 ? present : [all[0]];
 }
 var COPILOT_FRONTMATTER = '---\napplyTo: "**"\n---\n\n';
@@ -1300,7 +1377,7 @@ function removeCopilotInstructions(path, dryRun) {
   if (dryRun) return true;
   const after = removePairBlock(before);
   if (after.trim() === "" || after.trim() === COPILOT_FRONTMATTER.trim()) rmSync5(path);
-  else writeFileSync5(path, after);
+  else writeFileSync6(path, after);
   return true;
 }
 var copilotPair = {
@@ -1309,8 +1386,8 @@ var copilotPair = {
   installPair(o) {
     const lines2 = [];
     for (const dir of vscodeUserDirs(o)) {
-      const mcpPath = join8(dir, "mcp.json");
-      const instrPath = join8(dir, "prompts", "crew-pair.instructions.md");
+      const mcpPath = join9(dir, "mcp.json");
+      const instrPath = join9(dir, "prompts", "crew-pair.instructions.md");
       const settings = readVscodeMcp(mcpPath);
       if (!settings) {
         lines2.push(`pair(copilot): ${mcpPath} is not a plain JSON object (comments are not supported) \u2014 fix it by hand; nothing was written there`);
@@ -1338,8 +1415,8 @@ var copilotPair = {
   },
   verifyPair(o) {
     const verdicts = vscodeUserDirs(o).map((dir) => {
-      const instrPath = join8(dir, "prompts", "crew-pair.instructions.md");
-      const mcpPath = join8(dir, "mcp.json");
+      const instrPath = join9(dir, "prompts", "crew-pair.instructions.md");
+      const mcpPath = join9(dir, "mcp.json");
       const b = blockVerdict(instrPath, "copilot");
       if (!b.ok) return b;
       const settings = readVscodeMcp(mcpPath);
@@ -1354,8 +1431,8 @@ var copilotPair = {
   removePair(o) {
     const lines2 = [];
     for (const dir of vscodeUserDirs(o)) {
-      const mcpPath = join8(dir, "mcp.json");
-      const hadBlock = removeCopilotInstructions(join8(dir, "prompts", "crew-pair.instructions.md"), o.dryRun);
+      const mcpPath = join9(dir, "mcp.json");
+      const hadBlock = removeCopilotInstructions(join9(dir, "prompts", "crew-pair.instructions.md"), o.dryRun);
       const settings = readVscodeMcp(mcpPath);
       const st = settings ? copilotMcpState(settings, o.url) : { state: "missing" };
       const hadMcp = st.state === "registered";
@@ -1366,7 +1443,7 @@ var copilotPair = {
         if (Object.keys(rest).length > 0) next.servers = rest;
         else delete next.servers;
         if (Object.keys(next).length === 0) rmSync5(mcpPath);
-        else writeFileSync5(mcpPath, `${JSON.stringify(next, null, 2)}
+        else writeFileSync6(mcpPath, `${JSON.stringify(next, null, 2)}
 `);
       }
       const what = hadBlock && hadMcp ? `the Pair instructions and ${SERVER} server` : hadBlock ? "the Pair instructions" : `the ${SERVER} server`;
@@ -1615,9 +1692,9 @@ function resolveSeat(ship, route2, role, persona = {}, repo) {
 }
 
 // src/forges.ts
-import { execFileSync } from "child_process";
-import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync6, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname3, join as join9 } from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import { chmodSync, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync9, rmSync as rmSync6, statSync as statSync3, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname4, join as join10 } from "path";
 var ForgeError = class extends Error {
 };
 var DEFAULT_FORGE_USERNAME = "x-access-token";
@@ -1645,7 +1722,7 @@ function forgeDescriptorFor(host) {
 }
 var DEFAULT_KEYCHAIN_SERVICE = "crew-forge";
 function defaultTokenFilePath(stateDir, host) {
-  return join9(stateDir, "forges", `${host.replace(/[^a-z0-9.-]/gi, "_")}.token`);
+  return join10(stateDir, "forges", `${host.replace(/[^a-z0-9.-]/gi, "_")}.token`);
 }
 var envSource = {
   read: (s, c) => c.env[s.var]?.trim() || null,
@@ -1654,19 +1731,19 @@ var envSource = {
 var fileSource = {
   read(s, c) {
     const path = s.path ?? defaultTokenFilePath(c.stateDir, c.host);
-    if (!existsSync7(path)) return null;
-    const mode = statSync2(path).mode & 511;
+    if (!existsSync8(path)) return null;
+    const mode = statSync3(path).mode & 511;
     if (mode & 63) {
       throw new ForgeError(
         `${path} is mode ${mode.toString(8).padStart(3, "0")}; a forge token file must be owner-only (chmod 600 ${path})`
       );
     }
-    return readFileSync8(path, "utf8").trim() || null;
+    return readFileSync9(path, "utf8").trim() || null;
   },
   write(s, token, c) {
     const path = s.path ?? defaultTokenFilePath(c.stateDir, c.host);
-    mkdirSync5(dirname3(path), { recursive: true, mode: 448 });
-    writeFileSync6(path, `${token}
+    mkdirSync6(dirname4(path), { recursive: true, mode: 448 });
+    writeFileSync7(path, `${token}
 `, { mode: 384 });
     chmodSync(path, 384);
   },
@@ -1680,13 +1757,13 @@ var keychainSource = {
   read(s, c) {
     try {
       if (process.platform === "darwin") {
-        return execFileSync(
+        return execFileSync2(
           "security",
           ["find-generic-password", "-s", keychainService(s), "-a", c.host, "-w"],
           { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
         ).trim() || null;
       }
-      return execFileSync(
+      return execFileSync2(
         "secret-tool",
         ["lookup", "service", keychainService(s), "account", c.host],
         { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
@@ -1699,13 +1776,13 @@ var keychainSource = {
     try {
       if (process.platform === "darwin") {
         const q2 = (v) => `"${v.replace(/(["\\])/g, "\\$1")}"`;
-        execFileSync("security", ["-i"], {
+        execFileSync2("security", ["-i"], {
           input: `add-generic-password -U -s ${q2(keychainService(s))} -a ${q2(c.host)} -w ${q2(token)}
 `,
           stdio: ["pipe", "ignore", "pipe"]
         });
       } else {
-        execFileSync(
+        execFileSync2(
           "secret-tool",
           ["store", "--label", `crew ${c.host}`, "service", keychainService(s), "account", c.host],
           { input: token, stdio: ["pipe", "ignore", "pipe"] }
@@ -1718,9 +1795,9 @@ var keychainSource = {
   erase(s, c) {
     try {
       if (process.platform === "darwin") {
-        execFileSync("security", ["delete-generic-password", "-s", keychainService(s), "-a", c.host], { stdio: "ignore" });
+        execFileSync2("security", ["delete-generic-password", "-s", keychainService(s), "-a", c.host], { stdio: "ignore" });
       } else {
-        execFileSync("secret-tool", ["clear", "service", keychainService(s), "account", c.host], { stdio: "ignore" });
+        execFileSync2("secret-tool", ["clear", "service", keychainService(s), "account", c.host], { stdio: "ignore" });
       }
     } catch {
     }
@@ -1800,10 +1877,10 @@ function answerCredential(action, input, forges, stateDir, env = process.env) {
 password=${token}
 `;
 }
-var missesPath = (stateDir) => join9(stateDir, "forge-misses.json");
+var missesPath = (stateDir) => join10(stateDir, "forge-misses.json");
 function readForgeMisses(stateDir) {
   try {
-    const raw = JSON.parse(readFileSync8(missesPath(stateDir), "utf8"));
+    const raw = JSON.parse(readFileSync9(missesPath(stateDir), "utf8"));
     return Object.entries(raw).filter(([, t]) => typeof t === "string").map(([host, lastMissAt]) => ({ host, lastMissAt })).sort((a, b) => a.host.localeCompare(b.host));
   } catch {
     return [];
@@ -1818,8 +1895,8 @@ function noteForgeMiss(stateDir, host, at) {
       if (!(bare in cur)) return;
       delete cur[bare];
     } else cur[bare] = at;
-    mkdirSync5(stateDir, { recursive: true });
-    writeFileSync6(missesPath(stateDir), JSON.stringify(cur), { mode: 384 });
+    mkdirSync6(stateDir, { recursive: true });
+    writeFileSync7(missesPath(stateDir), JSON.stringify(cur), { mode: 384 });
   } catch {
   }
 }
@@ -1921,8 +1998,8 @@ import { hostFromUrl } from "@tablation/client";
 
 // src/secret-store.ts
 import { createHash as createHash2 } from "crypto";
-import { accessSync, constants, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync7, statSync as statSync3, writeFileSync as writeFileSync7, chmodSync as chmodSync2 } from "fs";
-import { join as join10 } from "path";
+import { accessSync, constants, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync7, statSync as statSync4, writeFileSync as writeFileSync8, chmodSync as chmodSync2 } from "fs";
+import { join as join11 } from "path";
 import { getSessionStore as getOsSessionStore } from "@tablation/client";
 var SECRET_STORE_MODES = ["auto", "os", "file"];
 function isSecretStoreMode(v) {
@@ -1933,7 +2010,7 @@ function configureSecretStore(c) {
   configured = c;
 }
 function keysDir(stateDir) {
-  return join10(stateDir, "keys");
+  return join11(stateDir, "keys");
 }
 function entryName(host, slug2) {
   return `${createHash2("sha256").update(`${host}\0${slug2}`).digest("hex")}.json`;
@@ -1944,34 +2021,34 @@ var FileSessionStore = class {
     this.dir = dir;
   }
   ensureDir() {
-    mkdirSync6(this.dir, { recursive: true, mode: 448 });
-    if ((statSync3(this.dir).mode & 63) !== 0) chmodSync2(this.dir, 448);
+    mkdirSync7(this.dir, { recursive: true, mode: 448 });
+    if ((statSync4(this.dir).mode & 63) !== 0) chmodSync2(this.dir, 448);
   }
   async get(host, slug2) {
-    const file = join10(this.dir, entryName(host, slug2));
-    if (!existsSync8(this.dir)) return void 0;
+    const file = join11(this.dir, entryName(host, slug2));
+    if (!existsSync9(this.dir)) return void 0;
     accessSync(this.dir, constants.R_OK | constants.X_OK);
-    if (!existsSync8(file)) return void 0;
-    return JSON.parse(readFileSync9(file, "utf8"));
+    if (!existsSync9(file)) return void 0;
+    return JSON.parse(readFileSync10(file, "utf8"));
   }
   async set(host, slug2, session) {
     this.ensureDir();
-    const file = join10(this.dir, entryName(host, slug2));
+    const file = join11(this.dir, entryName(host, slug2));
     const tmp = `${file}.${process.pid}.tmp`;
-    writeFileSync7(tmp, JSON.stringify(session), { mode: 384 });
+    writeFileSync8(tmp, JSON.stringify(session), { mode: 384 });
     renameSync2(tmp, file);
   }
   async clear(host, slug2) {
-    if (!existsSync8(this.dir)) return;
-    rmSync7(join10(this.dir, entryName(host, slug2)), { force: true });
+    if (!existsSync9(this.dir)) return;
+    rmSync7(join11(this.dir, entryName(host, slug2)), { force: true });
   }
   /** Whether a key could be written here right now, without leaving anything behind. */
   writable() {
     try {
       this.ensureDir();
       accessSync(this.dir, constants.R_OK | constants.W_OK | constants.X_OK);
-      const probe = join10(this.dir, `.probe.${process.pid}`);
-      writeFileSync7(probe, "", { mode: 384 });
+      const probe = join11(this.dir, `.probe.${process.pid}`);
+      writeFileSync8(probe, "", { mode: 384 });
       rmSync7(probe, { force: true });
       return { ok: true };
     } catch (e) {
@@ -2022,11 +2099,11 @@ function osStoreReachable(env = process.env, platform2 = process.platform, hasBi
   if (platform2 !== "linux") return true;
   if (!hasBinary("secret-tool")) return false;
   if (env.DBUS_SESSION_BUS_ADDRESS) return true;
-  return !!env.XDG_RUNTIME_DIR && existsSync8(join10(env.XDG_RUNTIME_DIR, "bus"));
+  return !!env.XDG_RUNTIME_DIR && existsSync9(join11(env.XDG_RUNTIME_DIR, "bus"));
 }
 function onPath(name) {
   for (const dir of (process.env.PATH ?? "").split(":")) {
-    if (dir && existsSync8(join10(dir, name))) return true;
+    if (dir && existsSync9(join11(dir, name))) return true;
   }
   return false;
 }
@@ -2093,8 +2170,8 @@ function explain(ship, required) {
 }
 
 // src/repo-config.ts
-import { readFileSync as readFileSync10, existsSync as existsSync9 } from "fs";
-import { join as join11, basename as basename3 } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
+import { join as join12, basename as basename3 } from "path";
 import { parse } from "yaml";
 
 // src/sandbox-policy.ts
@@ -2375,8 +2452,8 @@ var MODES = ["local", "integrate", "ci_manual", "ci_auto", "external"];
 var PROVIDERS = ["github", "buildkite", "other", "none"];
 function findRepoConfig(dir) {
   for (const name of REPO_CONFIG_FILENAMES) {
-    const p = join11(dir, name);
-    if (existsSync9(p)) return p;
+    const p = join12(dir, name);
+    if (existsSync10(p)) return p;
   }
   return null;
 }
@@ -2656,7 +2733,7 @@ function parseRepoConfig(text2, file) {
 function loadRepoConfig(dir) {
   const file = findRepoConfig(dir);
   if (!file) return null;
-  return parseRepoConfig(readFileSync10(file, "utf8"), file);
+  return parseRepoConfig(readFileSync11(file, "utf8"), file);
 }
 function hookLabel(cfg, hook2) {
   return cfg.labels[hook2] ?? cfg.hooks[hook2] ?? hook2;
@@ -3030,7 +3107,9 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "maxPeriscopes",
   "periscopeIdleMinutes",
   "secretStore",
-  "env"
+  "env",
+  "runner",
+  "sandbox"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -3176,14 +3255,14 @@ function mergeRouteRelease(route2, override) {
 function expand(p, base) {
   let out = p.startsWith("~") ? p.replace(/^~/, homedir6()) : p;
   out = out.replace(/\$\{?HOME\}?/g, homedir6());
-  return isAbsolute(out) ? out : resolve(base, out);
+  return isAbsolute2(out) ? out : resolve2(base, out);
 }
 function resolvePromptsDir(promptSet, crewHome, base) {
-  if (!promptSet) return join12(crewHome, "prompts", "default");
+  if (!promptSet) return join13(crewHome, "prompts", "default");
   if (promptSet.includes("/") || promptSet.startsWith(".") || promptSet.startsWith("~")) {
     return expand(promptSet, base);
   }
-  return join12(crewHome, "prompts", promptSet);
+  return join13(crewHome, "prompts", promptSet);
 }
 var Missing = class {
   paths = [];
@@ -3207,36 +3286,36 @@ var Missing = class {
 };
 function crewVersion(crewHome) {
   try {
-    const pkg = JSON.parse(readFileSync11(join12(crewHome, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync12(join13(crewHome, "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
 }
 function configSearchPath(crewHome) {
-  if (process.env.CREW_CONFIG) return [resolve(process.env.CREW_CONFIG)];
+  if (process.env.CREW_CONFIG) return [resolve2(process.env.CREW_CONFIG)];
   const xdg = process.env.XDG_CONFIG_HOME;
   return [
-    ...xdg ? [join12(xdg, "crew", "crew.yaml")] : [],
-    join12(homedir6(), ".config", "crew", "crew.yaml"),
-    resolve(crewHome, "crew.yaml")
+    ...xdg ? [join13(xdg, "crew", "crew.yaml")] : [],
+    join13(homedir6(), ".config", "crew", "crew.yaml"),
+    resolve2(crewHome, "crew.yaml")
   ];
 }
 function findConfigFile(crewHome) {
   const candidates2 = configSearchPath(crewHome);
-  return candidates2.find((c) => existsSync10(c)) ?? candidates2[candidates2.length - 1];
+  return candidates2.find((c) => existsSync11(c)) ?? candidates2[candidates2.length - 1];
 }
-var defaultConfigPath = () => join12(process.env.XDG_CONFIG_HOME ?? join12(homedir6(), ".config"), "crew", "crew.yaml");
+var defaultConfigPath = () => join13(process.env.XDG_CONFIG_HOME ?? join13(homedir6(), ".config"), "crew", "crew.yaml");
 function routeSlug(route2) {
   return route2.replace(/\//g, "-");
 }
 function resolvedPathFor(stateDir, route2) {
   const [workspace, project] = splitRoute(route2);
-  return join12(stateDir, "resolved", workspace, `${project}.json`);
+  return join13(stateDir, "resolved", workspace, `${project}.json`);
 }
 function apiKeyPathFor(stateDir, route2) {
   const [workspace, project] = splitRoute(route2);
-  return join12(stateDir, "keys", workspace, `${project}.env`);
+  return join13(stateDir, "keys", workspace, `${project}.env`);
 }
 function splitRoute(route2) {
   const parts = route2.split("/");
@@ -3247,9 +3326,9 @@ function splitRoute(route2) {
 }
 function readResolvedFile(stateDir, route2) {
   const path = resolvedPathFor(stateDir, route2);
-  if (!existsSync10(path)) return void 0;
+  if (!existsSync11(path)) return void 0;
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch (e) {
     throw new ConfigError(`${path}: not valid JSON \u2014 ${e.message}`);
   }
@@ -3310,23 +3389,23 @@ function parseResolved(raw, m, where) {
 }
 function loadConfig(crewHome, configFile, opts = {}) {
   const file = configFile ?? findConfigFile(crewHome);
-  if (opts.text === void 0 && !existsSync10(file)) {
+  if (opts.text === void 0 && !existsSync11(file)) {
     throw new ConfigError(
       `no config found. Looked in:
 ` + configSearchPath(crewHome).map((c) => `  - ${c}`).join("\n") + `
 
 Create the first of those:
-  mkdir -p ${dirname4(defaultConfigPath())} && cp ${join12(crewHome, "crew.example.yaml")} ${defaultConfigPath()}`
+  mkdir -p ${dirname5(defaultConfigPath())} && cp ${join13(crewHome, "crew.example.yaml")} ${defaultConfigPath()}`
     );
   }
   let raw;
   try {
-    raw = parse2(opts.text ?? readFileSync11(file, "utf8"));
+    raw = parse2(opts.text ?? readFileSync12(file, "utf8"));
   } catch (e) {
     throw new ConfigError(`${file}: not valid YAML \u2014 ${e.message}`);
   }
   if (!raw || typeof raw !== "object") throw new ConfigError(`${file} is empty or not a mapping`);
-  const base = dirname4(file);
+  const base = dirname5(file);
   const missing = new Missing();
   rejectUnknownKeys(raw, /* @__PURE__ */ new Set(["ship", "routes"]), "top-level", file);
   const shipRaw = raw.ship ?? {};
@@ -3440,7 +3519,7 @@ Create the first of those:
       useNvm: shipRaw.useNvm !== false,
       nvmSh: shipRaw.nvmSh,
       stateDir,
-      logFile: expand(shipRaw.logFile ?? join12(tmpdir(), "crew.log"), base),
+      logFile: expand(shipRaw.logFile ?? join13(tmpdir(), "crew.log"), base),
       userAgent: shipRaw.userAgent ?? `Mozilla/5.0 CrewAgent/${crewVersion(crewHome)}`,
       maxConcurrentAgents,
       maxConcurrentAgentsSet,
@@ -3620,7 +3699,7 @@ function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, t
   const hasRepos = Object.keys(repoDirs).length > 0;
   const reposBasePath = expand(String(c?.reposBasePath ?? raw.ship?.reposBasePath ?? DEFAULT_REPOS_BASE_PATH), base);
   const dirIsCloneBase = !c?.dir && !hasRepos && !Array.isArray(c?.repos);
-  const dir = c?.dir ? expand(String(c.dir), base) : hasRepos ? Object.values(repoDirs)[0] : dirIsCloneBase ? join12(reposBasePath, splitRoute(route2)[0]) : "";
+  const dir = c?.dir ? expand(String(c.dir), base) : hasRepos ? Object.values(repoDirs)[0] : dirIsCloneBase ? join13(reposBasePath, splitRoute(route2)[0]) : "";
   const weight = c?.weight === void 0 ? void 0 : Number(c.weight);
   if (weight !== void 0 && !(Number.isFinite(weight) && weight > 0)) {
     missing.add(`${where}.weight must be a positive number (got "${c?.weight}")`);
@@ -3669,21 +3748,21 @@ function routeForDir(cfg, dir) {
 }
 function locateDir(cfg, dir, commonDirOf) {
   const within = (base, target2) => {
-    const b = resolve(base);
+    const b = resolve2(base);
     return target2 === b || target2.startsWith(`${b}/`);
   };
   const find = (target2) => {
     for (const route2 of cfg.routes) {
       const repo = reposOf(route2).find((x) => within(x.dir, target2));
-      if (repo) return { route: route2, repo, checkout: resolve(repo.dir) };
+      if (repo) return { route: route2, repo, checkout: resolve2(repo.dir) };
     }
     return void 0;
   };
-  const target = resolve(dir);
+  const target = resolve2(dir);
   const direct = find(target);
   if (direct) return direct;
   const common = commonDirOf?.(target);
-  return common ? find(dirname4(resolve(target, common))) : void 0;
+  return common ? find(dirname5(resolve2(target, common))) : void 0;
 }
 function findRoute(cfg, route2) {
   if (!route2) {
@@ -3718,8 +3797,8 @@ function repoIdForName(r, name) {
 }
 function resolveApiKey(r) {
   if (r.apiKey) return r.apiKey;
-  if (r.apiKeyFile && r.apiKeyVar && existsSync10(r.apiKeyFile)) {
-    for (const line of readFileSync11(r.apiKeyFile, "utf8").split("\n")) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync11(r.apiKeyFile)) {
+    for (const line of readFileSync12(r.apiKeyFile, "utf8").split("\n")) {
       const m = line.match(new RegExp(`^${r.apiKeyVar}=(.*)$`));
       if (m) return (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
     }
@@ -3732,9 +3811,9 @@ function resolveApiKey(r) {
 }
 function credentialSource(r) {
   if (r.apiKey) return KEYCHAIN_ELIGIBLE_ROUTES.has(r) ? "keychain" : "inline";
-  if (r.apiKeyFile && r.apiKeyVar && existsSync10(r.apiKeyFile)) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync11(r.apiKeyFile)) {
     const re = new RegExp(`^${r.apiKeyVar}=`);
-    if (readFileSync11(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
+    if (readFileSync12(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
   }
   return process.env.CREW_API_KEY?.trim() ? "CREW_API_KEY" : "none";
 }
@@ -3790,7 +3869,7 @@ function configuredMembers(rt) {
   return out;
 }
 function defaultRepoDir(basePath, workspace, repoName) {
-  return join12(basePath, workspace, repoName);
+  return join13(basePath, workspace, repoName);
 }
 function reposOf(r) {
   const named = Object.entries(r.repos);
@@ -3829,10 +3908,10 @@ function passengerRepoTargets(r) {
   return reposOf(r).filter((t) => r.repoOverrides[t.name]?.hostPassengers !== false);
 }
 function passengerCheckoutDir(basePath, workspace, repoName) {
-  return join12(basePath, workspace, ".passenger-checkouts", repoName);
+  return join13(basePath, workspace, ".passenger-checkouts", repoName);
 }
 function passengerMirrorArea(ship) {
-  return ship.runner === "sandbox" ? join12(ship.stateDir, "passenger-sources") : void 0;
+  return ship.runner === "sandbox" ? join13(ship.stateDir, "passenger-sources") : void 0;
 }
 function passengerCheckoutTargets(r, mirrorArea) {
   if (!r.hostPassengers) return [];
@@ -3843,7 +3922,7 @@ function passengerCheckoutTargets(r, mirrorArea) {
     const forgeHost = t.forgeHost ?? (id ? r.resolved?.repoForgeHosts?.[id] : void 0);
     return {
       name: t.name,
-      dir: mirrorArea ? join12(mirrorArea, workspace, t.name) : passengerCheckoutDir(r.reposBasePath, workspace, t.name),
+      dir: mirrorArea ? join13(mirrorArea, workspace, t.name) : passengerCheckoutDir(r.reposBasePath, workspace, t.name),
       remote: t.remote ?? (id ? remotes[id] : void 0),
       ...forgeHost ? { forgeHost } : {}
     };
@@ -4121,9 +4200,9 @@ function recoveredFailureHeadlines(o, route2) {
 }
 
 // src/install.ts
-import { dirname as dirname5, join as join13, extname } from "path";
+import { dirname as dirname6, join as join14, extname } from "path";
 import { homedir as homedir7, userInfo } from "os";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync4, writeFileSync as writeFileSync8, unlinkSync, realpathSync } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync12, mkdirSync as mkdirSync8, readdirSync as readdirSync3, readFileSync as readFileSync13, statSync as statSync5, writeFileSync as writeFileSync9, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash3 } from "crypto";
 
@@ -4135,7 +4214,7 @@ function isCompiledBinary(moduleUrl) {
 // src/install.ts
 function crewInvocation(crewHome) {
   if (isCompiledBinary(import.meta.url)) return [process.execPath];
-  return [process.execPath, join13(crewHome, "bin", "crew")];
+  return [process.execPath, join14(crewHome, "bin", "crew")];
 }
 var INTERVAL_SECONDS = 120;
 function labelFor(crewHome, job) {
@@ -4166,29 +4245,29 @@ function schedulerLogFor(crewLog, job) {
   return `${stem}.${suffix}${ext || ".log"}`;
 }
 function pathFor(ship) {
-  const nodeBinDir = dirname5(process.execPath);
+  const nodeBinDir = dirname6(process.execPath);
   const parts = [nodeBinDir];
   if (ship.extraPath) parts.push(ship.extraPath);
   parts.push("/usr/bin", "/bin", "/usr/sbin", "/sbin");
   return parts.join(":");
 }
 function findOnPath(bin, searchPath) {
-  const candidates2 = bin.includes("/") ? [bin] : searchPath.split(":").filter(Boolean).map((dir) => join13(dir, bin));
+  const candidates2 = bin.includes("/") ? [bin] : searchPath.split(":").filter(Boolean).map((dir) => join14(dir, bin));
   for (const candidate of candidates2) {
     try {
       accessSync2(candidate, constants2.X_OK);
-      if (statSync4(candidate).isFile()) return candidate;
+      if (statSync5(candidate).isFile()) return candidate;
     } catch {
     }
   }
   return void 0;
 }
-var COMMON_DOCKER_DIRS = ["/usr/local/bin", "/opt/homebrew/bin", join13(homedir7(), ".docker", "bin")].join(":");
+var COMMON_DOCKER_DIRS = ["/usr/local/bin", "/opt/homebrew/bin", join14(homedir7(), ".docker", "bin")].join(":");
 function dockerPathProblem(ship, shellPath = process.env.PATH ?? "") {
   const schedulerPath = pathFor(ship);
   if (findOnPath("docker", schedulerPath)) return void 0;
   const inShell = findOnPath("docker", shellPath);
-  return inShell ? `\`docker\` is not on the scheduler PATH (${schedulerPath}) but is at ${inShell} in your shell; add ${dirname5(inShell)} to ship.extraPath in crew.yaml and run \`crew install\`` : `\`docker\` is not on the scheduler PATH (${schedulerPath}) or your shell PATH; install Docker, then add its directory to ship.extraPath in crew.yaml and run \`crew install\``;
+  return inShell ? `\`docker\` is not on the scheduler PATH (${schedulerPath}) but is at ${inShell} in your shell; add ${dirname6(inShell)} to ship.extraPath in crew.yaml and run \`crew install\`` : `\`docker\` is not on the scheduler PATH (${schedulerPath}) or your shell PATH; install Docker, then add its directory to ship.extraPath in crew.yaml and run \`crew install\``;
 }
 var USER_INSTALL = { root: false, user: "" };
 function installContext(env = process.env) {
@@ -4198,7 +4277,7 @@ function installContext(env = process.env) {
 }
 var SYSTEM_UNIT_DIR = "/etc/systemd/system";
 function systemUnitPathFor(label, suffix = "service") {
-  return join13(SYSTEM_UNIT_DIR, `${label}.${suffix}`);
+  return join14(SYSTEM_UNIT_DIR, `${label}.${suffix}`);
 }
 function unitEnvironment(ship) {
   return [["PATH", pathFor(ship)], ...Object.entries(ship.env ?? {})];
@@ -4219,7 +4298,7 @@ function xmlEscape(s) {
 }
 function planLaunchd(ship, crewHome, job) {
   const label = labelFor(crewHome, job);
-  const unitPath = join13(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+  const unitPath = join14(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const persistent = job === "run";
@@ -4273,7 +4352,7 @@ ${scheduleKeys}
 }
 function planSystemd(ship, crewHome, job, ctx) {
   const label = labelFor(crewHome, job);
-  const unitDir = ctx.root ? SYSTEM_UNIT_DIR : join13(homedir7(), ".config", "systemd", "user");
+  const unitDir = ctx.root ? SYSTEM_UNIT_DIR : join14(homedir7(), ".config", "systemd", "user");
   const ctl = ctx.root ? ["systemctl"] : ["systemctl", "--user"];
   const userLine = ctx.root && ctx.user && ctx.user !== "root" ? `User=${ctx.user}
 ` : "";
@@ -4282,7 +4361,7 @@ function planSystemd(ship, crewHome, job, ctx) {
     lingerCommand: ["loginctl", "enable-linger", ctx.user],
     lingerHint: `the daemon will stop when ${ctx.user} logs out; run \`sudo loginctl enable-linger ${ctx.user}\` once, or run \`crew install\` as root for a system unit`
   };
-  const servicePath = join13(unitDir, `${label}.service`);
+  const servicePath = join14(unitDir, `${label}.service`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const description = job === "release" ? "Tablation crew \u2014 release" : job === "passengers" ? "Tablation crew \u2014 Host Passengers sync" : "Tablation crew \u2014 persistent supervisor loop";
@@ -4323,7 +4402,7 @@ WantedBy=${wantedBy}
       ...linger
     };
   }
-  const timerPath = join13(unitDir, `${label}.timer`);
+  const timerPath = join14(unitDir, `${label}.timer`);
   const service = `# Written by \`crew install\` \u2014 re-run it rather than hand-editing this file.
 [Unit]
 Description=${description}
@@ -4398,7 +4477,7 @@ function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run", ctx = US
 function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
   const label = labelFor(crewHome, job);
   if (hostShip === "macos") {
-    const unitPath = join13(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = join14(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
     return {
       mechanism: "launchd",
       unitPaths: [unitPath],
@@ -4408,20 +4487,20 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
     };
   }
   if (hostShip === "linux" && hasSystemd) {
-    const system = existsSync11(systemUnitPathFor(label));
-    const unitDir = system ? SYSTEM_UNIT_DIR : join13(homedir7(), ".config", "systemd", "user");
+    const system = existsSync12(systemUnitPathFor(label));
+    const unitDir = system ? SYSTEM_UNIT_DIR : join14(homedir7(), ".config", "systemd", "user");
     const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
     if (job === "run") {
       return {
         mechanism: "systemd",
-        unitPaths: [join13(unitDir, `${label}.service`)],
+        unitPaths: [join14(unitDir, `${label}.service`)],
         crontabLine: null,
         unloadCommands: [[...ctl, "disable", "--now", `${label}.service`]]
       };
     }
     return {
       mechanism: "systemd",
-      unitPaths: [join13(unitDir, `${label}.service`), join13(unitDir, `${label}.timer`)],
+      unitPaths: [join14(unitDir, `${label}.service`), join14(unitDir, `${label}.timer`)],
       crontabLine: null,
       unloadCommands: [[...ctl, "disable", "--now", `${label}.timer`]]
     };
@@ -4439,7 +4518,7 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
 function planDaemonControl(crewHome, hostShip, hasSystemd) {
   const label = labelFor(crewHome, "run");
   if (hostShip === "macos") {
-    const unitPath = join13(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = join14(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
     return {
       mechanism: "launchd",
       startCommand: ["launchctl", "load", unitPath],
@@ -4449,7 +4528,7 @@ function planDaemonControl(crewHome, hostShip, hasSystemd) {
   }
   if (hostShip === "linux" && hasSystemd) {
     const unit = `${label}.service`;
-    const ctl = existsSync11(systemUnitPathFor(label)) ? ["systemctl"] : ["systemctl", "--user"];
+    const ctl = existsSync12(systemUnitPathFor(label)) ? ["systemctl"] : ["systemctl", "--user"];
     return {
       mechanism: "systemd",
       startCommand: [...ctl, "start", unit],
@@ -4481,10 +4560,10 @@ async function applyInstall(plan, crewHome, dryRun, log) {
       log.emit(`would write ${path}`);
       continue;
     }
-    const before = existsSync11(path) ? readFileSync12(path, "utf8") : null;
+    const before = existsSync12(path) ? readFileSync13(path, "utf8") : null;
     if (before !== plan.unitContent[path]) changed2 = true;
-    mkdirSync7(dirname5(path), { recursive: true });
-    writeFileSync8(path, plan.unitContent[path]);
+    mkdirSync8(dirname6(path), { recursive: true });
+    writeFileSync9(path, plan.unitContent[path]);
     log.emit(`wrote ${path}`);
   }
   if (plan.crontabLine) {
@@ -4548,7 +4627,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
     }
   }
   for (const path of plan.unitPaths) {
-    if (!existsSync11(path)) continue;
+    if (!existsSync12(path)) continue;
     if (dryRun) {
       log.emit(`would remove ${path}`);
       continue;
@@ -4567,7 +4646,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
 }
 var CREW_LAUNCHD_PREFIX = "com.tablation.crew";
 function launchAgentsDir() {
-  return join13(homedir7(), "Library", "LaunchAgents");
+  return join14(homedir7(), "Library", "LaunchAgents");
 }
 function xmlUnescape(s) {
   return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
@@ -4584,25 +4663,25 @@ function loadedCrewLabels() {
   return [...parseLaunchctlList(list.stdout ?? "").keys()].filter((l) => l.startsWith(CREW_LAUNCHD_PREFIX));
 }
 function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
-  const files = existsSync11(dir) ? readdirSync3(dir) : [];
+  const files = existsSync12(dir) ? readdirSync3(dir) : [];
   const units = files.filter((f) => f.startsWith(CREW_LAUNCHD_PREFIX) && f.endsWith(".plist")).sort().map((f) => {
-    const plistPath = join13(dir, f);
+    const plistPath = join14(dir, f);
     let program = null;
     try {
-      program = programFromPlist(readFileSync12(plistPath, "utf8"));
+      program = programFromPlist(readFileSync13(plistPath, "utf8"));
     } catch {
     }
     return {
       label: f.slice(0, -".plist".length),
       plistPath,
       program,
-      programExists: program !== null && existsSync11(program)
+      programExists: program !== null && existsSync12(program)
     };
   });
   const seen = new Set(units.map((u) => u.label));
   for (const label of [...loaded].sort()) {
     if (!label.startsWith(CREW_LAUNCHD_PREFIX) || seen.has(label)) continue;
-    units.push({ label, plistPath: join13(dir, `${label}.plist`), program: null, programExists: false, orphan: true });
+    units.push({ label, plistPath: join14(dir, `${label}.plist`), program: null, programExists: false, orphan: true });
   }
   return units;
 }
@@ -4615,9 +4694,9 @@ function removeLaunchdUnit(unit, dryRun, log) {
     log.emit(`would unload and remove ${unit.label}`);
     return;
   }
-  if (existsSync11(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
+  if (existsSync12(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
   spawnSync4("launchctl", ["remove", unit.label], { encoding: "utf8" });
-  if (existsSync11(unit.plistPath)) unlinkSync(unit.plistPath);
+  if (existsSync12(unit.plistPath)) unlinkSync(unit.plistPath);
   log.emit(`removed ${unit.label} (${unit.plistPath})`);
 }
 function clearForeignLaunchdUnits(crewHome, replace, dryRun, log, dir, loaded) {
@@ -4695,24 +4774,24 @@ function detectSystemd() {
 }
 
 // src/ship-attention.ts
-import { existsSync as existsSync13, statfsSync } from "fs";
+import { existsSync as existsSync14, statfsSync } from "fs";
 
 // src/git.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import {
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync8,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync9,
   openSync as openSync2,
   closeSync as closeSync2,
   writeSync,
-  statSync as statSync5,
+  statSync as statSync6,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync13,
-  writeFileSync as writeFileSync9,
+  readFileSync as readFileSync14,
+  writeFileSync as writeFileSync10,
   readdirSync as readdirSync4,
   rmSync as rmSync8
 } from "fs";
-import { dirname as dirname6, basename as basename5, join as join14 } from "path";
+import { dirname as dirname7, basename as basename5, join as join15 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -4720,7 +4799,7 @@ function streamText(x) {
 }
 function gitRaw(cwd, args) {
   try {
-    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync3("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -4729,7 +4808,7 @@ function gitRaw(cwd, args) {
 }
 function git(cwd, args) {
   try {
-    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync3("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -4859,7 +4938,7 @@ function worktreeForNumber(cwd, num) {
   return worktrees(cwd).find((w) => re.test(basename5(w.path))) ?? null;
 }
 var commitBodies = (cwd, range) => gitOk(cwd, ["log", range, "--format=%B"]) ?? "";
-var resolve2 = (cwd, ref) => gitOk(cwd, ["rev-parse", "-q", "--verify", `${ref}^{commit}`]);
+var resolve3 = (cwd, ref) => gitOk(cwd, ["rev-parse", "-q", "--verify", `${ref}^{commit}`]);
 var countCommits = (cwd, range) => Number.parseInt(gitOk(cwd, ["rev-list", "--count", range]) ?? "0", 10);
 function latestReleaseTag(cwd, pattern = "v*", ref = "HEAD") {
   return gitOk(cwd, ["describe", "--tags", "--abbrev=0", "--match", pattern, ref]);
@@ -4868,7 +4947,7 @@ function firstReleaseTagContaining(cwd, sha, pattern = "v*") {
   const out = gitOk(cwd, ["tag", "--contains", sha, "--list", pattern, "--sort=creatordate"]);
   return out?.split("\n").map((l) => l.trim()).find(Boolean) ?? null;
 }
-var tagCommit = (cwd, tag) => resolve2(cwd, tag);
+var tagCommit = (cwd, tag) => resolve3(cwd, tag);
 function createReleaseTag(cwd, tag, sha, message) {
   git(cwd, ["tag", "-a", tag, sha, "-m", message]);
 }
@@ -4900,9 +4979,9 @@ function keyCommitsInRange(cwd, key, range) {
 }
 function patchIdOf(cwd, from, to) {
   try {
-    const diff = execFileSync2("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    const diff = execFileSync3("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (!diff) return null;
-    const out = execFileSync2("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
+    const out = execFileSync3("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
     return out.split(" ")[0]?.trim() || null;
   } catch {
     return null;
@@ -5092,7 +5171,7 @@ function recoverStrandedReleaseCheckouts(cwd) {
     if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
-      const root = dirname6(path);
+      const root = dirname7(path);
       if (basename5(root).startsWith("crew-release-")) rmSync8(root, { recursive: true, force: true });
     }
   }
@@ -5110,11 +5189,11 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
   }
   for (const name of names) {
     if (!name.startsWith("crew-release-")) continue;
-    const root = join14(tmp, name);
+    const root = join15(tmp, name);
     try {
-      const st = statSync5(root);
+      const st = statSync6(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync12(join14(root, "checkout"))) continue;
+      if (existsSync13(join15(root, "checkout"))) continue;
       rmSync8(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
@@ -5166,16 +5245,16 @@ function originUrlOf(dir, remoteName) {
   }
 }
 function ensureRepoCheckout(dir, remote, opts = {}) {
-  if (existsSync12(`${dir}/.git`)) return false;
+  if (existsSync13(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
     );
   }
-  mkdirSync8(dirname6(dir), { recursive: true });
+  mkdirSync9(dirname7(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync3("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -5197,7 +5276,7 @@ function sleepSync(ms3) {
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
-  mkdirSync8(dirname6(lockPath), { recursive: true });
+  mkdirSync9(dirname7(lockPath), { recursive: true });
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -5215,7 +5294,7 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
       const err3 = e;
       if (err3.code !== "EEXIST") throw err3;
       try {
-        if (Date.now() - statSync5(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
+        if (Date.now() - statSync6(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
           try {
             unlinkSync2(lockPath);
           } catch {
@@ -5234,17 +5313,17 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
 function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (!existsSync12(`${dir}/.git`) && githubRemote) {
+    if (!existsSync13(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync12(marker) && readFileSync13(marker, "utf8").split("\n")[0] === url) {
-        return { action: "clone-failed", detail: readFileSync13(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      if (existsSync13(marker) && readFileSync14(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync14(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
         ensureRepoCheckout(dir, githubRemote, clone);
       } catch (e) {
         if (!(e instanceof GitError)) throw e;
-        writeFileSync9(marker, `${url}
+        writeFileSync10(marker, `${url}
 ${e.message}`);
         return { action: "clone-failed", detail: e.message, repeat: false };
       }
@@ -5470,7 +5549,7 @@ function noteHeldWorktree(state, h, nowMs = Date.now()) {
 function reconcileHeldWorktrees(state, repo, log, stillRefused) {
   for (const i of state.shipAttention().previous()) {
     if (i.kind !== "worktree_held" || !i.held || i.held.repo !== repo) continue;
-    const gone = !existsSync13(i.held.path);
+    const gone = !existsSync14(i.held.path);
     if (!gone && !(stillRefused && !stillRefused.has(i.held.path))) continue;
     clearShipAttention(state, i.key);
     log.emit(
@@ -5598,13 +5677,13 @@ function attentionProblems(items, already) {
 // src/sandbox-image.ts
 import { createHash as createHash6 } from "crypto";
 import { spawn as spawn4 } from "child_process";
-import { execFileSync as execFileSync6 } from "child_process";
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync21, renameSync as renameSync3, writeFileSync as writeFileSync15, rmSync as rmSync13 } from "fs";
-import { dirname as dirname10, join as join26 } from "path";
+import { execFileSync as execFileSync7 } from "child_process";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync22, renameSync as renameSync3, writeFileSync as writeFileSync16, rmSync as rmSync13 } from "fs";
+import { dirname as dirname11, join as join27 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import { createHash as createHash5 } from "crypto";
 
 // src/sandbox-cache.ts
@@ -5613,32 +5692,32 @@ import { promisify as promisify2 } from "util";
 
 // src/deprovision-host.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync11 } from "fs";
+import { existsSync as existsSync25, readdirSync as readdirSync11 } from "fs";
 
 // src/interrupted.ts
-import { existsSync as existsSync22, readdirSync as readdirSync9, readFileSync as readFileSync20 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync9, readFileSync as readFileSync21 } from "fs";
+import { join as join25 } from "path";
 
 // src/agent.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { readFileSync as readFileSync19, existsSync as existsSync21, statSync as statSync7, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
+import { readFileSync as readFileSync20, existsSync as existsSync22, statSync as statSync8, mkdirSync as mkdirSync14, writeFileSync as writeFileSync15, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
-import { join as join23, dirname as dirname9, basename as basename9 } from "path";
+import { join as join24, dirname as dirname10, basename as basename9 } from "path";
 import { createHash as createHash4 } from "crypto";
 
 // src/state.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync10, existsSync as existsSync14, mkdirSync as mkdirSync9, rmSync as rmSync9, statSync as statSync6, readdirSync as readdirSync5 } from "fs";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync11, existsSync as existsSync15, mkdirSync as mkdirSync10, rmSync as rmSync9, statSync as statSync7, readdirSync as readdirSync5 } from "fs";
+import { join as join16 } from "path";
 var EPOCH = "1970-01-01T00:00:00.000Z";
 var State = class _State {
   dir;
   constructor(dir) {
     this.dir = dir;
-    mkdirSync9(dir, { recursive: true });
+    mkdirSync10(dir, { recursive: true });
   }
   path(...parts) {
-    return join15(this.dir, ...parts);
+    return join16(this.dir, ...parts);
   }
   /**
    * The timestamp every "new since last poll" check is measured against.
@@ -5649,14 +5728,14 @@ var State = class _State {
    */
   watermark() {
     try {
-      const v = readFileSync14(this.path(".poll-watermark"), "utf8").trim();
+      const v = readFileSync15(this.path(".poll-watermark"), "utf8").trim();
       return v || EPOCH;
     } catch {
       return EPOCH;
     }
   }
   setWatermark(at) {
-    writeFileSync10(this.path(".poll-watermark"), `${at}
+    writeFileSync11(this.path(".poll-watermark"), `${at}
 `);
   }
   /**
@@ -5674,16 +5753,16 @@ var State = class _State {
   }
   /** Whole-crew pause, and the per-role sentinels one level down. */
   isPaused() {
-    return existsSync14(this.path(".crew-paused"));
+    return existsSync15(this.path(".crew-paused"));
   }
   isRolePaused(role) {
-    return existsSync14(this.path(`.role-paused-${role}`));
+    return existsSync15(this.path(`.role-paused-${role}`));
   }
   pausedRoles(roles) {
     return new Set(roles.filter((r) => this.isRolePaused(r)));
   }
   pause(role) {
-    writeFileSync10(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), "");
+    writeFileSync11(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), "");
   }
   resume(role) {
     rmSync9(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), { force: true });
@@ -5694,10 +5773,10 @@ var State = class _State {
    * while agents keep working.
    */
   isReleasePaused() {
-    return existsSync14(this.path(".release-paused"));
+    return existsSync15(this.path(".release-paused"));
   }
   setReleasePaused(paused) {
-    if (paused) writeFileSync10(this.path(".release-paused"), "");
+    if (paused) writeFileSync11(this.path(".release-paused"), "");
     else rmSync9(this.path(".release-paused"), { force: true });
   }
   /**
@@ -5735,7 +5814,7 @@ var State = class _State {
     const name = _State.safe(rawName);
     const file = this.path(`.${name}.lock`);
     try {
-      const existing = Number.parseInt(readFileSync14(file, "utf8").trim(), 10);
+      const existing = Number.parseInt(readFileSync15(file, "utf8").trim(), 10);
       if (Number.isFinite(existing) && existing > 0) {
         try {
           process.kill(existing, 0);
@@ -5745,7 +5824,7 @@ var State = class _State {
       }
     } catch {
     }
-    writeFileSync10(file, `${process.pid}
+    writeFileSync11(file, `${process.pid}
 `);
     return {
       ok: true,
@@ -5773,7 +5852,7 @@ var State = class _State {
       if (!/^\.release-.+\.lock$/.test(n)) continue;
       let pid = 0;
       try {
-        pid = Number.parseInt(readFileSync14(this.path(n), "utf8").trim(), 10);
+        pid = Number.parseInt(readFileSync15(this.path(n), "utf8").trim(), 10);
       } catch {
         continue;
       }
@@ -5859,7 +5938,7 @@ var State = class _State {
   ticketInFlight(recordId) {
     const file = this.path(`.${_State.safe(`crew-ticket-${recordId}`)}.lock`);
     try {
-      const pid = Number.parseInt(readFileSync14(file, "utf8").trim(), 10);
+      const pid = Number.parseInt(readFileSync15(file, "utf8").trim(), 10);
       if (!Number.isFinite(pid) || pid <= 0) return false;
       process.kill(pid, 0);
       return true;
@@ -5893,7 +5972,7 @@ var State = class _State {
     const heldReported = `.release-held-${suffix}`;
     const read = (f) => {
       try {
-        return readFileSync14(this.path(f), "utf8").trim() || null;
+        return readFileSync15(this.path(f), "utf8").trim() || null;
       } catch {
         return null;
       }
@@ -5902,7 +5981,7 @@ var State = class _State {
       blockedCount: () => Number.parseInt(read(blocked) ?? "", 10) || 0,
       noteBlocked: () => {
         const n = (Number.parseInt(read(blocked) ?? "", 10) || 0) + 1;
-        writeFileSync10(this.path(blocked), `${n}
+        writeFileSync11(this.path(blocked), `${n}
 `);
         return n;
       },
@@ -5919,7 +5998,7 @@ var State = class _State {
        */
       deployFailedSha: () => read(failed),
       noteDeployFailed: (sha) => {
-        writeFileSync10(this.path(failed), `${sha}
+        writeFileSync11(this.path(failed), `${sha}
 `);
       },
       clearDeployFailed: () => {
@@ -5933,7 +6012,7 @@ var State = class _State {
       noteTestGateFailed: (sha) => {
         const [prev, n] = (read(gateFailed) ?? "").split(" ");
         const next = prev === sha ? (Number.parseInt(n ?? "", 10) || 0) + 1 : 1;
-        writeFileSync10(this.path(gateFailed), `${sha} ${next}
+        writeFileSync11(this.path(gateFailed), `${sha} ${next}
 `);
         return next;
       },
@@ -5943,13 +6022,13 @@ var State = class _State {
       /** Whether the board was already told about this head's red gate. */
       heldReported: () => {
         try {
-          return readFileSync14(this.path(heldReported), "utf8").replace(/\n$/, "") || null;
+          return readFileSync15(this.path(heldReported), "utf8").replace(/\n$/, "") || null;
         } catch {
           return null;
         }
       },
       noteHeldReported: (signature) => {
-        writeFileSync10(this.path(heldReported), `${signature}
+        writeFileSync11(this.path(heldReported), `${signature}
 `);
       },
       clearHeldReported: () => {
@@ -5957,7 +6036,7 @@ var State = class _State {
       },
       testGateReported: (sha) => read(gateReported) === sha,
       noteTestGateReported: (sha) => {
-        writeFileSync10(this.path(gateReported), `${sha}
+        writeFileSync11(this.path(gateReported), `${sha}
 `);
       }
     };
@@ -5980,7 +6059,7 @@ var State = class _State {
     const ticketStreakFile = `.fairness-ticket-streak-${suffix}`;
     const read = (f) => {
       try {
-        return readFileSync14(this.path(f), "utf8").trim() || null;
+        return readFileSync15(this.path(f), "utf8").trim() || null;
       } catch {
         return null;
       }
@@ -6013,18 +6092,18 @@ var State = class _State {
           clear2();
           return;
         }
-        writeFileSync10(this.path(streakFile), `${this.readInt(streakFile) + 1}
+        writeFileSync11(this.path(streakFile), `${this.readInt(streakFile) + 1}
 `);
         const prior = read(ticketFile);
         if (topTicket && topTicket === prior) {
-          writeFileSync10(this.path(ticketStreakFile), `${this.readInt(ticketStreakFile) + 1}
+          writeFileSync11(this.path(ticketStreakFile), `${this.readInt(ticketStreakFile) + 1}
 `);
         } else if (topTicket) {
-          writeFileSync10(this.path(ticketFile), `${topTicket}
+          writeFileSync11(this.path(ticketFile), `${topTicket}
 `);
-          writeFileSync10(this.path(sinceFile), `${(/* @__PURE__ */ new Date()).toISOString()}
+          writeFileSync11(this.path(sinceFile), `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
-          writeFileSync10(this.path(ticketStreakFile), "1\n");
+          writeFileSync11(this.path(ticketStreakFile), "1\n");
         }
       }
     };
@@ -6045,14 +6124,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync14(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync15(this.path(file), "utf8"));
           return parsed && typeof parsed === "object" ? parsed : {};
         } catch {
           return {};
         }
       },
       persist: (next) => {
-        writeFileSync10(this.path(file), JSON.stringify(next));
+        writeFileSync11(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -6068,14 +6147,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync14(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync15(this.path(file), "utf8"));
           return Array.isArray(parsed) ? parsed.filter((x) => typeof x === "string") : [];
         } catch {
           return [];
         }
       },
       persist: (next) => {
-        writeFileSync10(this.path(file), JSON.stringify(next));
+        writeFileSync11(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -6089,14 +6168,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync14(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync15(this.path(file), "utf8"));
           return Array.isArray(parsed) ? parsed : [];
         } catch {
           return [];
         }
       },
       persist: (next) => {
-        writeFileSync10(this.path(file), JSON.stringify(next));
+        writeFileSync11(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -6109,11 +6188,11 @@ var State = class _State {
     const file = ".release-last-run";
     return {
       touch: () => {
-        writeFileSync10(this.path(file), (/* @__PURE__ */ new Date()).toISOString());
+        writeFileSync11(this.path(file), (/* @__PURE__ */ new Date()).toISOString());
       },
       at: () => {
         try {
-          return statSync6(this.path(file)).mtimeMs;
+          return statSync7(this.path(file)).mtimeMs;
         } catch {
           return null;
         }
@@ -6122,7 +6201,7 @@ var State = class _State {
   }
   readInt(file) {
     try {
-      return Number.parseInt(readFileSync14(this.path(file), "utf8").trim(), 10) || 0;
+      return Number.parseInt(readFileSync15(this.path(file), "utf8").trim(), 10) || 0;
     } catch {
       return 0;
     }
@@ -6663,8 +6742,8 @@ var PERISCOPE_COLUMNS = [
 ];
 
 // src/agent-log.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync6, readFileSync as readFileSync15, rmSync as rmSync10, writeFileSync as writeFileSync11 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync16, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "fs";
+import { join as join17 } from "path";
 
 // src/pending-backoff.ts
 var sleepBackoff = (attempts) => Math.min(6e4 * 2 ** Math.max(0, attempts - 1), 30 * 6e4);
@@ -6836,20 +6915,20 @@ async function addRunToTicket(target, t, recordId, run3) {
     };
   }
 }
-var queueDir = (stateDir) => join16(stateDir, "pending-agent-logs");
+var queueDir = (stateDir) => join17(stateDir, "pending-agent-logs");
 function queueAgentRun(stateDir, name, q2) {
-  mkdirSync10(queueDir(stateDir), { recursive: true });
-  writeFileSync11(join16(queueDir(stateDir), `${name}.json`), JSON.stringify(q2));
+  mkdirSync11(queueDir(stateDir), { recursive: true });
+  writeFileSync12(join17(queueDir(stateDir), `${name}.json`), JSON.stringify(q2));
 }
 async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = queueDir(stateDir);
-  if (!existsSync15(dir)) return 0;
+  if (!existsSync16(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
-    const path = join16(dir, f);
+    const path = join17(dir, f);
     let q2;
     try {
-      q2 = JSON.parse(readFileSync15(path, "utf8"));
+      q2 = JSON.parse(readFileSync16(path, "utf8"));
     } catch {
       continue;
     }
@@ -6878,7 +6957,7 @@ async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__
         continue;
       }
       const attempts = q2.attempts + 1;
-      writeFileSync11(path, JSON.stringify({
+      writeFileSync12(path, JSON.stringify({
         ...q2,
         attempts,
         warned: true,
@@ -6889,20 +6968,20 @@ async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__
   }
   return sent;
 }
-var countersDir = (stateDir) => join16(stateDir, "pending-ticket-counters");
+var countersDir = (stateDir) => join17(stateDir, "pending-ticket-counters");
 function queueTicketCounters(stateDir, name, q2) {
-  mkdirSync10(countersDir(stateDir), { recursive: true });
-  writeFileSync11(join16(countersDir(stateDir), `${name}.json`), JSON.stringify(q2));
+  mkdirSync11(countersDir(stateDir), { recursive: true });
+  writeFileSync12(join17(countersDir(stateDir), `${name}.json`), JSON.stringify(q2));
 }
 async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = countersDir(stateDir);
-  if (!existsSync15(dir)) return 0;
+  if (!existsSync16(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
-    const path = join16(dir, f);
+    const path = join17(dir, f);
     let q2;
     try {
-      q2 = JSON.parse(readFileSync15(path, "utf8"));
+      q2 = JSON.parse(readFileSync16(path, "utf8"));
     } catch {
       continue;
     }
@@ -6921,7 +7000,7 @@ async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /
         continue;
       }
       const attempts = q2.attempts + 1;
-      writeFileSync11(path, JSON.stringify({
+      writeFileSync12(path, JSON.stringify({
         ...q2,
         attempts,
         warned: true,
@@ -7124,8 +7203,8 @@ var HandoffTranscriptTracker = class {
 };
 
 // src/pending-handoff.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, readdirSync as readdirSync7, readFileSync as readFileSync16, rmSync as rmSync11, writeFileSync as writeFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readdirSync as readdirSync7, readFileSync as readFileSync17, rmSync as rmSync11, writeFileSync as writeFileSync13 } from "fs";
+import { join as join20 } from "path";
 
 // src/ticket-branch.ts
 import { basename as basename7 } from "path";
@@ -8291,16 +8370,16 @@ function holdWarnings(tickets, ships, contract, humanHolds, now = Date.now()) {
 }
 
 // src/run-worktree.ts
-import { existsSync as existsSync17 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { dirname as dirname8, join as join19 } from "path";
 
 // src/ports.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync16 } from "fs";
-import { join as join17 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync17 } from "fs";
+import { join as join18 } from "path";
 var run = (cmd, args) => {
   try {
-    return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return "";
   }
@@ -8342,7 +8421,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync16(join17(parent, name, ".git"))) return true;
+    if (existsSync17(join18(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -8425,7 +8504,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const existing = worktreeForNumber(dir, num);
   const located = locateBranchForTicket(dir, cfg, t, role);
   const baseRef = hasRemote ? `${remote}/${base}` : base;
-  if (existing && !existing.prunable && existsSync17(existing.path)) {
+  if (existing && !existing.prunable && existsSync18(existing.path)) {
     const branch = existing.branch;
     if (status(existing.path).length > 0) {
       return { action: opts.resumeInterrupted ? "resume-dirty" : "leave-dirty", path: existing.path, branch };
@@ -8441,7 +8520,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
     if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
     return { action: "recut", path: existing.path, branch, base: baseRef };
   }
-  const path = join18(dirname7(dir), worktreeForTicket(dir, cfg, t, role));
+  const path = join19(dirname8(dir), worktreeForTicket(dir, cfg, t, role));
   if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
     return { action: "cut-remote", path, branch: located.branch };
   }
@@ -8495,7 +8574,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
   if (remoteConfigured(dir, remote) && remoteBranchExists(dir, remote, branch)) return false;
   if (countCommits(dir, `${baseRef}..${branch}`) !== 0) return false;
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (wt && existsSync17(wt.path)) {
+  if (wt && existsSync18(wt.path)) {
     if (status(wt.path).length > 0) return false;
     if (gitOk(dir, ["worktree", "remove", wt.path]) === null) return false;
   }
@@ -8503,7 +8582,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
 }
 async function finishRunWorktree(dir, cfg, branch) {
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (!wt || !existsSync17(wt.path)) return { kind: "none" };
+  if (!wt || !existsSync18(wt.path)) return { kind: "none" };
   if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
   if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
   if (remoteConfigured(dir, cfg.branch.remote) && worktreeHoldsUnpushed(wt.path, cfg.branch.remote)) {
@@ -8515,7 +8594,7 @@ async function finishRunWorktree(dir, cfg, branch) {
     if (pids.length) await killGently(pids);
   }
   gitOk(dir, ["worktree", "remove", wt.path]);
-  return existsSync17(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+  return existsSync18(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
 }
 
 // src/handoff-guard.ts
@@ -8898,20 +8977,20 @@ async function guardRunStrays(route2, ship, tracker, role, workingId, since2, lo
 
 // src/pending-handoff.ts
 var PENDING_MAX_AGE_MS = 48 * 36e5;
-var pendingDirFor = (stateDir) => join19(stateDir, "pending-handoffs");
-var stateDirOfStream = (streamPath) => join19(streamPath, "..", "..");
+var pendingDirFor = (stateDir) => join20(stateDir, "pending-handoffs");
+var stateDirOfStream = (streamPath) => join20(streamPath, "..", "..");
 function writePendingHandoff(stateDir, rec) {
   const dir = pendingDirFor(stateDir);
-  mkdirSync11(dir, { recursive: true });
-  writeFileSync12(join19(dir, `${rec.ticketRecordId}.json`), JSON.stringify(rec, null, 2));
+  mkdirSync12(dir, { recursive: true });
+  writeFileSync13(join20(dir, `${rec.ticketRecordId}.json`), JSON.stringify(rec, null, 2));
 }
 function listPendingHandoffs(stateDir, route2) {
   const dir = pendingDirFor(stateDir);
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const out = [];
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     try {
-      const rec = JSON.parse(readFileSync16(join19(dir, f), "utf8"));
+      const rec = JSON.parse(readFileSync17(join20(dir, f), "utf8"));
       if (rec.version === 1 && rec.ticketRecordId && (!route2 || rec.route === route2)) out.push(rec);
     } catch {
     }
@@ -8919,7 +8998,7 @@ function listPendingHandoffs(stateDir, route2) {
   return out;
 }
 function removePendingHandoff(stateDir, ticketRecordId) {
-  rmSync11(join19(pendingDirFor(stateDir), `${ticketRecordId}.json`), { force: true });
+  rmSync11(join20(pendingDirFor(stateDir), `${ticketRecordId}.json`), { force: true });
 }
 function pendingHandoffFor(stateDir, ticketRecordId) {
   return listPendingHandoffs(stateDir).find((r) => r.ticketRecordId === ticketRecordId);
@@ -9029,8 +9108,8 @@ function expandSkillMarkers(text2, lookup2, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync18, readdirSync as readdirSync8, existsSync as existsSync20 } from "fs";
-import { join as join21 } from "path";
+import { readFileSync as readFileSync19, readdirSync as readdirSync8, existsSync as existsSync21 } from "fs";
+import { join as join22 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError3, TablationApiError as TablationApiError2 } from "@tablation/client";
 
@@ -9046,8 +9125,8 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync17, existsSync as existsSync19 } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync18, existsSync as existsSync20 } from "fs";
+import { join as join21 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError2, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
   dev: "Developer",
@@ -9061,12 +9140,12 @@ var CREW_AGENT_COLUMN = "agent_id";
 var AgentsSyncError = class extends Error {
 };
 function personaDefaultPrompt(promptsDir, role) {
-  const briefPath = join20(promptsDir, "personas", `lane-${role}.md`);
-  if (!existsSync19(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync17(briefPath, "utf8");
-  const commonPath = join20(promptsDir, "personas", "common.md");
-  if (!existsSync19(commonPath)) return readFileSync17(briefPath, "utf8");
-  return `${readFileSync17(commonPath, "utf8")}${readFileSync17(briefPath, "utf8")}`;
+  const briefPath = join21(promptsDir, "personas", `lane-${role}.md`);
+  if (!existsSync20(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync18(briefPath, "utf8");
+  const commonPath = join21(promptsDir, "personas", "common.md");
+  if (!existsSync20(commonPath)) return readFileSync18(briefPath, "utf8");
+  return `${readFileSync18(commonPath, "utf8")}${readFileSync18(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route2, role, opts) {
   const cached = route2.resolved?.agentPersonas?.[role]?.agentId;
@@ -9513,7 +9592,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text2 = readFileSync18(path, "utf8");
+  const text2 = readFileSync19(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text2);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -9526,9 +9605,9 @@ function parseSkillFile(path) {
   return { name: meta.name, description: meta.description, prompt: body, file: path };
 }
 function listLocalSkills(promptsDir) {
-  const dir = join21(promptsDir, "skills");
-  if (!existsSync20(dir)) return [];
-  return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join21(dir, f)));
+  const dir = join22(promptsDir, "skills");
+  if (!existsSync21(dir)) return [];
+  return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join22(dir, f)));
 }
 async function syncSkills(route2, opts) {
   if (!route2.resolved) {
@@ -9712,10 +9791,10 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
 }
 
 // src/runner.ts
-import { spawn as spawn2, execFile, execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync, mkdirSync as mkdirSync12, writeFileSync as writeFileSync13, rmSync as rmSync12 } from "fs";
+import { spawn as spawn2, execFile, execFileSync as execFileSync5 } from "child_process";
+import { mkdtempSync, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, rmSync as rmSync12 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename8, dirname as dirname8, join as join22 } from "path";
+import { basename as basename8, dirname as dirname9, join as join23 } from "path";
 import { promisify } from "util";
 
 // src/run-limit.ts
@@ -9844,8 +9923,8 @@ var SandboxRunner = class {
         throw new Error(`cannot generate the sandbox policy: ${e.message}`);
       }
       policyFile = policyPathFor(plan.streamPath);
-      mkdirSync12(dirname8(policyFile), { recursive: true });
-      writeFileSync13(policyFile, generated.yaml, { mode: 384 });
+      mkdirSync13(dirname9(policyFile), { recursive: true });
+      writeFileSync14(policyFile, generated.yaml, { mode: 384 });
     }
     const create2 = ["sandbox", "create", "--name", name, "--detach"];
     if (policyFile) create2.push("--policy", policyFile);
@@ -9888,10 +9967,10 @@ var SandboxRunner = class {
       const harness = cfg.agentBin ?? basename8(plan.bin);
       const viaUpload = Buffer.byteLength(plan.prompt) > SANDBOX_STDIN_LIMIT;
       if (viaUpload) {
-        const tmp = mkdtempSync(join22(tmpdir2(), "crew-prompt-"));
+        const tmp = mkdtempSync(join23(tmpdir2(), "crew-prompt-"));
         try {
-          const file = join22(tmp, "prompt.txt");
-          writeFileSync13(file, plan.prompt, { mode: 384 });
+          const file = join23(tmp, "prompt.txt");
+          writeFileSync14(file, plan.prompt, { mode: 384 });
           await this.os(["sandbox", "upload", name, file, SANDBOX_PROMPT_PATH]);
         } finally {
           rmSync12(tmp, { recursive: true, force: true });
@@ -9957,7 +10036,7 @@ function describeExecError(e) {
 }
 function gitOrigin(cwd) {
   try {
-    return execFileSync4("git", ["-C", cwd, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync5("git", ["-C", cwd, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return null;
   }
@@ -9968,7 +10047,7 @@ function runnerFor(kind, sandbox) {
 function runnerOfSidecar(sc) {
   return sc.runner === "sandbox" ? new SandboxRunner(sc.sandboxBin ? { bin: sc.sandboxBin } : {}) : new HostRunner();
 }
-function checkSandboxRunner(cfg = {}, run3 = (b, a) => execFileSync4(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 })) {
+function checkSandboxRunner(cfg = {}, run3 = (b, a) => execFileSync5(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 })) {
   const bin = cfg.bin ?? DEFAULT_SANDBOX_CONFIG.bin;
   let version;
   try {
@@ -10035,7 +10114,7 @@ var ALLOWANCE_REFUSAL_MARKER = "AI_ALLOWANCE_EXCEEDED";
 function streamShowsAllowanceRefusal(streamPath) {
   let raw;
   try {
-    raw = readFileSync19(streamPath, "utf8");
+    raw = readFileSync20(streamPath, "utf8");
   } catch {
     return false;
   }
@@ -10058,26 +10137,26 @@ function streamShowsAllowanceRefusal(streamPath) {
   }
   return false;
 }
-var digestPathFor = (stateDir, routeLabel, role, runId) => join23(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
+var digestPathFor = (stateDir, routeLabel, role, runId) => join24(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
 function planAgentRun(o) {
-  const briefPath = join23(o.route.promptsDir, "personas", `lane-${o.role}.md`);
-  if (!existsSync21(briefPath)) {
+  const briefPath = join24(o.route.promptsDir, "personas", `lane-${o.role}.md`);
+  if (!existsSync22(briefPath)) {
     throw new AgentError(`no brief at ${briefPath} \u2014 refusing to run an unscoped session`);
   }
-  const commonPath = join23(o.route.promptsDir, "personas", "common.md");
-  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync21(commonPath);
+  const commonPath = join24(o.route.promptsDir, "personas", "common.md");
+  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync22(commonPath);
   const now = o.now ?? (() => Date.now());
   const routeLabel = routeSlug(o.route.route);
   const ownDigest = o.runId ? digestPathFor(o.stateDir, routeLabel, o.role, o.runId) : void 0;
-  const digestPath2 = ownDigest && existsSync21(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
+  const digestPath2 = ownDigest && existsSync22(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
   let digest;
   let ageSeconds;
-  if (existsSync21(digestPath2)) {
-    ageSeconds = Math.floor((now() - statSync7(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync19(digestPath2, "utf8");
+  if (existsSync22(digestPath2)) {
+    ageSeconds = Math.floor((now() - statSync8(digestPath2).mtimeMs) / 1e3);
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync20(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync19(commonPath, "utf8") : "";
-  const brief = readFileSync19(briefPath, "utf8");
+  const common = usesCommon ? readFileSync20(commonPath, "utf8") : "";
+  const brief = readFileSync20(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = appendAdditions(o.divergedPrompt ?? brief, o.personaAdditions);
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -10100,7 +10179,7 @@ function planAgentRun(o) {
     digest
   });
   const promptSha = createHash4("sha256").update(expanded.text).digest("hex");
-  const streamsDir = join23(o.stateDir, "streams");
+  const streamsDir = join24(o.stateDir, "streams");
   const base = `${routeLabel}-${o.role}-${o.cycle}${o.runId ? `-${o.runId}` : ""}`;
   const seat = resolveSeat(o.ship, o.route, o.role, o.agentPersona ?? (o.agentModel ? { model: o.agentModel } : {}), o.repo);
   const { model } = seat;
@@ -10190,8 +10269,8 @@ function planAgentRun(o) {
     digestAttached: digest !== void 0,
     digestAgeSeconds: ageSeconds,
     model,
-    streamPath: join23(streamsDir, `${base}.jsonl`),
-    eventsPath: join23(streamsDir, `${base}.events.jsonl`),
+    streamPath: join24(streamsDir, `${base}.jsonl`),
+    eventsPath: join24(streamsDir, `${base}.events.jsonl`),
     ticket: o.ticket,
     ticketRecordId: o.ticketRecordId ?? null,
     repo: o.repo ?? null,
@@ -10222,7 +10301,7 @@ function describePlan(p) {
 var pidPathFor = (streamPath) => `${streamPath}.pid`;
 function readRunSidecar(streamPath) {
   try {
-    const sc = JSON.parse(readFileSync19(pidPathFor(streamPath), "utf8"));
+    const sc = JSON.parse(readFileSync20(pidPathFor(streamPath), "utf8"));
     return typeof sc.pid === "number" && typeof sc.spawnedAt === "string" && typeof sc.role === "string" ? sc : null;
   } catch {
     return null;
@@ -10269,7 +10348,7 @@ async function killForDeadline(kill, pid, emit, role, ticket, spawnedAt, limitMi
 var withoutKey = ({ apiKey: _apiKey, ...rest }) => rest;
 function openSink(path) {
   try {
-    mkdirSync13(dirname9(path), { recursive: true });
+    mkdirSync14(dirname10(path), { recursive: true });
     return createWriteStream(path, { flags: "a" });
   } catch {
     return void 0;
@@ -10451,7 +10530,7 @@ var RunObserver = class {
 };
 function writeRunMeta(id, startedAt, liveTicket, extra) {
   try {
-    writeFileSync14(`${id.streamPath}.meta.json`, JSON.stringify({
+    writeFileSync15(`${id.streamPath}.meta.json`, JSON.stringify({
       route: id.route,
       role: id.role,
       hint: id.ticket,
@@ -10611,7 +10690,7 @@ function spawnAgent(plan, emit, hintMoved) {
   const id = identityOf(plan, adapter.harness);
   let streamFd;
   try {
-    mkdirSync13(dirname9(plan.streamPath), { recursive: true });
+    mkdirSync14(dirname10(plan.streamPath), { recursive: true });
     streamFd = openSync3(plan.streamPath, "a");
   } catch (e) {
     void endSink(eventsSink);
@@ -10643,7 +10722,7 @@ function spawnAgent(plan, emit, hintMoved) {
   closeSync3(streamFd);
   return supervise(begun);
   function supervise({ child, handle, promptDelivered }) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       const spawnedAt = (/* @__PURE__ */ new Date()).toISOString();
       const deadline = deadlineFor(spawnedAt, plan.maxRunMinutes);
       if (child.pid !== void 0) {
@@ -10669,7 +10748,7 @@ function spawnAgent(plan, emit, hintMoved) {
           promptSha: plan.promptSha
         };
         try {
-          writeFileSync14(pidPathFor(plan.streamPath), JSON.stringify(sidecar));
+          writeFileSync15(pidPathFor(plan.streamPath), JSON.stringify(sidecar));
         } catch {
         }
       }
@@ -10713,7 +10792,7 @@ function spawnAgent(plan, emit, hintMoved) {
           plan.agentLog?.apiKey,
           hintMoved
         );
-        resolve7({ code: code ?? 1, ms: ms3, ...handoffPending ? { handoffPending } : {}, ...killed ? { killed } : {} });
+        resolve8({ code: code ?? 1, ms: ms3, ...handoffPending ? { handoffPending } : {}, ...killed ? { killed } : {} });
       });
       child.stdin?.on("error", (err3) => {
         emit.warn(`agent closed stdin before the prompt was delivered: ${err3.message}`, { step: "agent" });
@@ -10783,21 +10862,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync22(path)) return false;
+  if (!existsSync23(path)) return false;
   try {
-    return JSON.parse(readFileSync20(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync21(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join24(o.stateDir, "streams");
-  if (!existsSync22(dir)) return [];
+  const dir = join25(o.stateDir, "streams");
+  if (!existsSync23(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync9(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join24(dir, name);
+    const streamPath = join25(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -10850,15 +10929,15 @@ async function reconcileRuns(o) {
 }
 
 // src/live-runs.ts
-import { existsSync as existsSync23, readdirSync as readdirSync10, statSync as statSync8 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync10, statSync as statSync9 } from "fs";
+import { join as join26 } from "path";
 function liveRuns(stateDir, isAlive = runIsAlive) {
-  const dir = join25(stateDir, "streams");
-  if (!existsSync23(dir)) return [];
+  const dir = join26(stateDir, "streams");
+  if (!existsSync24(dir)) return [];
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join25(dir, name);
+    const streamPath = join26(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || !isAlive(sidecar)) continue;
@@ -10868,15 +10947,15 @@ function liveRuns(stateDir, isAlive = runIsAlive) {
 }
 function runActivity(stateDir, isAlive = runIsAlive) {
   const activeRuns = liveRuns(stateDir, isAlive).length;
-  const dir = join25(stateDir, "streams");
+  const dir = join26(stateDir, "streams");
   let newest = 0;
-  if (existsSync23(dir)) {
+  if (existsSync24(dir)) {
     for (const name of readdirSync10(dir)) {
       if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-      const streamPath = join25(dir, name);
+      const streamPath = join26(dir, name);
       if (!runFinished(streamPath)) continue;
       try {
-        newest = Math.max(newest, statSync8(`${streamPath}.meta.json`).mtimeMs);
+        newest = Math.max(newest, statSync9(`${streamPath}.meta.json`).mtimeMs);
       } catch {
       }
     }
@@ -11244,7 +11323,7 @@ function realDeprovisionDeps(cfg, emit, crewHome, getStore) {
     if (host === "windows") return [];
     const ctx = installContext();
     const systemd = detectSystemd();
-    return ["run", "release", "passengers"].flatMap((job) => planInstall(cfg.ship, crewHome, host, systemd, job, ctx).unitPaths).filter((p) => existsSync24(p));
+    return ["run", "release", "passengers"].flatMap((job) => planInstall(cfg.ship, crewHome, host, systemd, job, ctx).unitPaths).filter((p) => existsSync25(p));
   };
   return {
     liveRuns: () => liveRuns(stateDir).map((r) => ({ role: r.role, route: r.route, pid: r.pid, ticketRecordId: r.ticketRecordId ?? void 0, streamPath: r.streamPath })),
@@ -11305,7 +11384,7 @@ function realDeprovisionDeps(cfg, emit, crewHome, getStore) {
     },
     remaining() {
       const left = [];
-      if (existsSync24(cfg.configFile)) left.push(`config ${cfg.configFile}`);
+      if (existsSync25(cfg.configFile)) left.push(`config ${cfg.configFile}`);
       for (const h of forgeHosts()) if (hasForgeToken(cfg.ship.forges, h, stateDir)) left.push(`forge token for ${h}`);
       try {
         for (const k of readdirSync11(keysDir(stateDir))) left.push(`seat key ${k}`);
@@ -11580,7 +11659,7 @@ function makeCachePass(o) {
 // src/passenger-containers.ts
 var realExec2 = (cmd, args, opts) => {
   try {
-    return execFileSync5(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
+    return execFileSync6(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -11860,7 +11939,7 @@ var WARM_MAX_BYTES = 64 * 1024 * 1024;
 var globToRegExp = (glob) => new RegExp(`^${glob.split("*").map((p) => p.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*")}$`);
 function readWarmFiles(dir, ref, patterns) {
   if (patterns.length === 0) return {};
-  const git2 = (args) => execFileSync6("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: WARM_MAX_BYTES, stdio: ["ignore", "pipe", "pipe"] });
+  const git2 = (args) => execFileSync7("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: WARM_MAX_BYTES, stdio: ["ignore", "pipe", "pipe"] });
   const all = git2(["ls-tree", "-r", "--name-only", ref]).split("\n").filter(Boolean);
   const res = patterns.map(globToRegExp);
   const out = {};
@@ -11913,19 +11992,19 @@ function planSandbox(repo, decl, warm = {}) {
   const layer = repoLayer(repo, decl, crew, warm);
   return { repo, tag: layer.tag, claude: SANDBOX_CLAUDE_VERSION, layers: [base, crew, layer] };
 }
-var sandboxStatePath = (stateDir) => join26(stateDir, "sandbox-images.json");
+var sandboxStatePath = (stateDir) => join27(stateDir, "sandbox-images.json");
 function readSandboxState(stateDir) {
   try {
-    const v = JSON.parse(readFileSync21(sandboxStatePath(stateDir), "utf8"));
+    const v = JSON.parse(readFileSync22(sandboxStatePath(stateDir), "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : {};
   } catch {
     return {};
   }
 }
 function writeSandboxState(stateDir, state) {
-  mkdirSync14(stateDir, { recursive: true });
+  mkdirSync15(stateDir, { recursive: true });
   const file = sandboxStatePath(stateDir);
-  writeFileSync15(`${file}.tmp`, `${JSON.stringify(state, null, 2)}
+  writeFileSync16(`${file}.tmp`, `${JSON.stringify(state, null, 2)}
 `);
   renameSync3(`${file}.tmp`, file);
 }
@@ -11939,15 +12018,15 @@ function sandboxImageStatus(state, plan) {
   if (current.tag !== plan.tag) return { status: "stale", detail: `running ${current.tag} (claude ${current.claude ?? "unknown"}), declaration now builds ${plan.tag} (claude ${plan.claude})` };
   return { status: "ok", detail: `${current.tag} built ${current.builtAt}, claude ${current.claude ?? "unknown"}` };
 }
-var spawnBuildRunner = (engine = "docker") => (args, logPath) => new Promise((resolve7) => {
+var spawnBuildRunner = (engine = "docker") => (args, logPath) => new Promise((resolve8) => {
   const child = spawn4(engine, args, { stdio: ["ignore", "pipe", "pipe"] });
   const chunks = [];
   child.stdout.on("data", (d) => chunks.push(d));
   child.stderr.on("data", (d) => chunks.push(d));
   const done = (code, extra = "") => {
-    writeFileSync15(logPath, `$ ${engine} ${args.join(" ")}
+    writeFileSync16(logPath, `$ ${engine} ${args.join(" ")}
 ${Buffer.concat(chunks).toString("utf8")}${extra}`, { flag: "a" });
-    resolve7(code);
+    resolve8(code);
   };
   child.on("error", (e) => done(127, `${e.message}
 `));
@@ -11967,7 +12046,7 @@ var engineRemoveImage = (engine = "docker", exec = realExec2) => (tag) => {
   } catch {
   }
 };
-var sandboxLogDir = (stateDir) => join26(stateDir, "sandbox-logs");
+var sandboxLogDir = (stateDir) => join27(stateDir, "sandbox-logs");
 async function buildSandboxImage(plan, deps) {
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const state = readSandboxState(deps.stateDir);
@@ -11976,20 +12055,20 @@ async function buildSandboxImage(plan, deps) {
     return { kind: "reused", tag: plan.tag };
   }
   const logDir = sandboxLogDir(deps.stateDir);
-  mkdirSync14(logDir, { recursive: true });
-  const logPath = join26(logDir, `${slug(plan.repo)}-${now().toISOString().replace(/[:.]/g, "-")}.log`);
+  mkdirSync15(logDir, { recursive: true });
+  const logPath = join27(logDir, `${slug(plan.repo)}-${now().toISOString().replace(/[:.]/g, "-")}.log`);
   const builtLayers = [];
   for (const layer of plan.layers) {
     if (deps.hasImage(layer.tag)) continue;
-    const ctx = join26(tmpdir3(), `crew-sandbox-${hash([layer.tag, process.pid, Date.now()])}`);
-    mkdirSync14(ctx, { recursive: true });
+    const ctx = join27(tmpdir3(), `crew-sandbox-${hash([layer.tag, process.pid, Date.now()])}`);
+    mkdirSync15(ctx, { recursive: true });
     try {
-      writeFileSync15(join26(ctx, "Dockerfile"), layer.dockerfile);
+      writeFileSync16(join27(ctx, "Dockerfile"), layer.dockerfile);
       for (const [name, content] of Object.entries(layer.files)) {
-        mkdirSync14(dirname10(join26(ctx, name)), { recursive: true });
-        writeFileSync15(join26(ctx, name), content);
+        mkdirSync15(dirname11(join27(ctx, name)), { recursive: true });
+        writeFileSync16(join27(ctx, name), content);
       }
-      const code = await deps.run(["build", "--tag", layer.tag, "--file", join26(ctx, "Dockerfile"), ctx], logPath);
+      const code = await deps.run(["build", "--tag", layer.tag, "--file", join27(ctx, "Dockerfile"), ctx], logPath);
       if (code !== 0) {
         state[plan.repo] = { ...entry, failure: { tag: plan.tag, at: now().toISOString(), logPath } };
         writeSandboxState(deps.stateDir, state);
@@ -12042,10 +12121,10 @@ async function sandboxBuildTick(repos, deps, force = false) {
 }
 
 // src/doctor-checks.ts
-import { execFileSync as execFileSync7 } from "child_process";
+import { execFileSync as execFileSync8 } from "child_process";
 var PROBE_BRANCH = "crew-probe-branch";
 var realGit = (cwd, args, env) => {
-  execFileSync7("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
+  execFileSync8("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
 };
 function isSshRemote(url) {
   return /^ssh:\/\//.test(url) || /^[\w.-]+@[\w.-]+:/.test(url);
@@ -12125,10 +12204,10 @@ function formatPushAuth(repo, r) {
   return `${label}FAILED \u2014 ${r.detail}; ${r.hint}
 `;
 }
-async function settleRepos(items, nameOf, resolve7) {
+async function settleRepos(items, nameOf, resolve8) {
   const out = await Promise.all(items.map(async (t) => {
     try {
-      return { ok: true, value: await resolve7(t) };
+      return { ok: true, value: await resolve8(t) };
     } catch (e) {
       return { ok: false, repo: nameOf(t), detail: e.message };
     }
@@ -12164,17 +12243,28 @@ function roleCapWarnings(ship) {
   if (!ship.maxConcurrentAgentsSet) return [];
   return Object.entries(ship.roleConcurrency).filter(([, n]) => (n ?? 0) > ship.maxConcurrentAgents).map(([role, n]) => `ship.roleConcurrency.${role} is ${n}, above ship.maxConcurrentAgents (${ship.maxConcurrentAgents}); the ship-wide cap wins`);
 }
+function managedRuntimeWarnings(kind, ship) {
+  if (kind !== "managed_instance" && kind !== "pooled_instance" && kind !== "pooled") return [];
+  const out = [];
+  const explicit = ship.toolchains ?? [];
+  const effectiveToolchains = explicit.some((t) => t.name === "claude") ? explicit : [{ name: "claude", harness: "claude" }, ...explicit];
+  if ((ship.runner ?? "host") !== "sandbox") out.push(`ship.runner is "${ship.runner ?? "host"}" on a ${kind} ship; a managed ship should run agents in the sandbox (set ship.runner: sandbox)`);
+  for (const t of effectiveToolchains) {
+    if (t.harness === "claude" && t.auth !== "workspace") out.push(`ship.toolchains.${t.name}.auth is "${t.auth ?? "inherit"}" on a ${kind} ship; a managed ship reaches a model only through the workspace endpoint (set auth: workspace)`);
+  }
+  return out;
+}
 
 // src/selftest.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync2, readFileSync as readFileSync22, rmSync as rmSync14, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync2, readFileSync as readFileSync23, rmSync as rmSync14, writeFileSync as writeFileSync17 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var SELFTEST_TIMEOUT_MS = 12e4;
 var KEY_VAR = "CREW_API_KEY";
 var SELFTEST_PROMPT = "This is a read-only connectivity check. Use the tracker MCP tool to read this workspace (the workspaces find-one tool, using the workspace id below) and reply with the workspace's name alone, on one line. Do not write anything, do not create files, and do not use any other tool.\n\nWorkspace id: ";
 var realDeps = {
-  run: (o) => new Promise((resolve7) => {
+  run: (o) => new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -12182,7 +12272,7 @@ var realDeps = {
     const done = (r) => {
       if (!settled) {
         settled = true;
-        resolve7(r);
+        resolve8(r);
       }
     };
     const child = spawn5(o.bin, o.args, { cwd: o.cwd, env: o.env, stdio: ["pipe", "pipe", "pipe"], detached: true });
@@ -12330,7 +12420,7 @@ async function runSelftest(i, deps = realDeps) {
     ...adapter.runEnv(spec),
     [KEY_VAR]: i.apiKey
   };
-  const cwd = mkdtempSync2(join27(tmpdir4(), "crew-selftest-"));
+  const cwd = mkdtempSync2(join28(tmpdir4(), "crew-selftest-"));
   try {
     const run3 = await deps.run({
       bin: invocation.bin,
@@ -12363,11 +12453,11 @@ function formatResult(r) {
   const secs = `${(r.ms / 1e3).toFixed(1)}s`;
   return r.ok ? `${r.toolchain}: PASS ${r.detail} (${secs}${tok})` : `${r.toolchain}: FAIL ${r.failure} \u2014 ${r.detail} (${secs})`;
 }
-var fileFor2 = (stateDir) => join27(stateDir, "selftest.json");
+var fileFor2 = (stateDir) => join28(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync25(p) ? JSON.parse(readFileSync22(p, "utf8")) : {};
+    return existsSync26(p) ? JSON.parse(readFileSync23(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -12375,8 +12465,8 @@ function readSelftest(stateDir) {
 function recordSelftest(stateDir, results) {
   const all = readSelftest(stateDir);
   for (const r of results) all[r.toolchain] = r;
-  mkdirSync15(stateDir, { recursive: true });
-  writeFileSync16(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
+  mkdirSync16(stateDir, { recursive: true });
+  writeFileSync17(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
 `);
 }
 function doctorSelftestLines(stored, toolchains) {
@@ -12388,7 +12478,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve6, dirname as dirname28, join as join49, basename as basename16 } from "path";
+import { resolve as resolve7, dirname as dirname29, join as join50, basename as basename16 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname4, homedir as homedir11 } from "os";
 import { spawnSync as spawnSync10 } from "child_process";
@@ -12585,14 +12675,14 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/connect-resume.ts
-import { mkdirSync as mkdirSync16, readFileSync as readFileSync23, rmSync as rmSync15, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname11, join as join28 } from "path";
+import { mkdirSync as mkdirSync17, readFileSync as readFileSync24, rmSync as rmSync15, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname12, join as join29 } from "path";
 function lastSessionFile(stateDir) {
-  return join28(stateDir, "connect-session.json");
+  return join29(stateDir, "connect-session.json");
 }
 function readPointers(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync23(lastSessionFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync24(lastSessionFile(stateDir), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const out = {};
     for (const [host, v] of Object.entries(parsed)) {
@@ -12606,8 +12696,8 @@ function readPointers(stateDir) {
 }
 function writePointers(stateDir, pointers) {
   const file = lastSessionFile(stateDir);
-  mkdirSync16(dirname11(file), { recursive: true });
-  writeFileSync17(file, `${JSON.stringify(pointers, null, 2)}
+  mkdirSync17(dirname12(file), { recursive: true });
+  writeFileSync18(file, `${JSON.stringify(pointers, null, 2)}
 `, { mode: 384 });
 }
 function rememberSession(stateDir, host, workspaceSlug) {
@@ -12692,15 +12782,15 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync17, readFileSync as readFileSync24, readdirSync as readdirSync12, rmSync as rmSync16, statSync as statSync9, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname12, join as join29 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync18, readFileSync as readFileSync25, readdirSync as readdirSync12, rmSync as rmSync16, statSync as statSync10, writeFileSync as writeFileSync19 } from "fs";
+import { dirname as dirname13, join as join30 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
-  return join29(stateDir, "cloned-checkouts.json");
+  return join30(stateDir, "cloned-checkouts.json");
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync24(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync25(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -12710,8 +12800,8 @@ function recordClonedCheckout(stateDir, dir) {
   const known = readClonedCheckouts(stateDir);
   if (known.includes(dir)) return;
   const file = clonedCheckoutsFile(stateDir);
-  mkdirSync17(dirname12(file), { recursive: true });
-  writeFileSync18(file, `${JSON.stringify([...known, dir], null, 2)}
+  mkdirSync18(dirname13(file), { recursive: true });
+  writeFileSync19(file, `${JSON.stringify([...known, dir], null, 2)}
 `);
 }
 var mark = (dryRun) => dryRun ? "would-remove" : "removed";
@@ -12765,7 +12855,7 @@ async function runReset(o, fx) {
   }
   if (o.beforeState) steps.push(...await o.beforeState());
   steps.push(...o.wipeState ? wipeStateDir(o.stateDir, o.dryRun) : removeState(o.stateDir, o.dryRun));
-  if (existsSync26(o.configFile)) {
+  if (existsSync27(o.configFile)) {
     if (!o.dryRun) rmSync16(o.configFile, { force: true });
     steps.push({ step: "config", target: o.configFile, action: mark(o.dryRun) });
   } else {
@@ -12774,7 +12864,7 @@ async function runReset(o, fx) {
   return steps;
 }
 function removeCheckout(dir, dryRun, fx) {
-  if (!existsSync26(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
+  if (!existsSync27(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
   const { dirty, linkedWorktrees } = fx.inspectCheckout(dir);
   if (dirty.length) {
     return { step: "checkout", target: dir, action: "kept", detail: `has uncommitted changes (${dirty.length} path${dirty.length === 1 ? "" : "s"}: ${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? ", \u2026" : ""})` };
@@ -12787,15 +12877,15 @@ function removeCheckout(dir, dryRun, fx) {
 }
 function removeState(stateDir, dryRun) {
   const out = [];
-  const targets = [join29(stateDir, "resolved"), join29(stateDir, "keys"), clonedCheckoutsFile(stateDir), join29(stateDir, "connect-session.json"), join29(stateDir, "reload-requested"), join29(stateDir, "daemon.started")];
+  const targets = [join30(stateDir, "resolved"), join30(stateDir, "keys"), clonedCheckoutsFile(stateDir), join30(stateDir, "connect-session.json"), join30(stateDir, "reload-requested"), join30(stateDir, "daemon.started")];
   try {
     for (const name of readdirSync12(stateDir)) {
-      if (name.startsWith(".") && statSync9(join29(stateDir, name)).isFile()) targets.push(join29(stateDir, name));
+      if (name.startsWith(".") && statSync10(join30(stateDir, name)).isFile()) targets.push(join30(stateDir, name));
     }
   } catch {
   }
   for (const t of targets) {
-    if (!existsSync26(t)) continue;
+    if (!existsSync27(t)) continue;
     if (!dryRun) rmSync16(t, { recursive: true, force: true });
     out.push({ step: "state", target: t, action: mark(dryRun) });
   }
@@ -12810,7 +12900,7 @@ function wipeStateDir(stateDir, dryRun) {
     return [{ step: "state", target: stateDir, action: "absent", detail: "no state directory" }];
   }
   if (!names.length) return [{ step: "state", target: stateDir, action: "absent", detail: "already empty" }];
-  if (!dryRun) for (const n of names) rmSync16(join29(stateDir, n), { recursive: true, force: true });
+  if (!dryRun) for (const n of names) rmSync16(join30(stateDir, n), { recursive: true, force: true });
   return [{ step: "state", target: stateDir, action: mark(dryRun), detail: `${names.length} entr${names.length === 1 ? "y" : "ies"}` }];
 }
 function describeResetStep(s) {
@@ -12891,9 +12981,9 @@ async function runDeprovision(o, fx, deps) {
 }
 
 // src/pool-member.ts
-import { mkdirSync as mkdirSync18, readFileSync as readFileSync25, renameSync as renameSync4, writeFileSync as writeFileSync19 } from "fs";
+import { mkdirSync as mkdirSync19, readFileSync as readFileSync26, renameSync as renameSync4, writeFileSync as writeFileSync20 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname13, join as join30 } from "path";
+import { dirname as dirname14, join as join31 } from "path";
 var POOL_EXIT = { ok: 0, failed: 1, credential: 2 };
 function backoffMs(attempt) {
   return Math.min(6e4, 5e3 * 2 ** Math.max(0, attempt));
@@ -13124,22 +13214,22 @@ async function runPoolMember(deps) {
   }
 }
 function defaultMemberDir(env = process.env) {
-  return env.CREW_POOL_DIR ?? join30(env.XDG_STATE_HOME ?? join30(homedir8(), ".local", "state"), "crew-pool-member");
+  return env.CREW_POOL_DIR ?? join31(env.XDG_STATE_HOME ?? join31(homedir8(), ".local", "state"), "crew-pool-member");
 }
 function fileMemberStore(dir) {
-  const file = join30(dir, "member.json");
+  const file = join31(dir, "member.json");
   return {
     read() {
       try {
-        return JSON.parse(readFileSync25(file, "utf8"));
+        return JSON.parse(readFileSync26(file, "utf8"));
       } catch {
         return {};
       }
     },
     write(f) {
-      mkdirSync18(dirname13(file), { recursive: true, mode: 448 });
+      mkdirSync19(dirname14(file), { recursive: true, mode: 448 });
       const tmp = `${file}.tmp`;
-      writeFileSync19(tmp, `${JSON.stringify(f)}
+      writeFileSync20(tmp, `${JSON.stringify(f)}
 `, { mode: 384 });
       renameSync4(tmp, file);
     }
@@ -13191,30 +13281,30 @@ function hostArchitecture(arch = process.arch) {
 
 // src/pool-member-host.ts
 import "child_process";
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 import { hostname as hostname3 } from "os";
 
 // src/machine-id.ts
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync9 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync19, readFileSync as readFileSync26, writeFileSync as writeFileSync20 } from "fs";
-import { dirname as dirname14, join as join31 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync20, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "fs";
+import { dirname as dirname15, join as join32 } from "path";
 function machineIdPathFor(stateDir) {
-  return join31(stateDir, "machine-id");
+  return join32(stateDir, "machine-id");
 }
 var sha256 = (s) => createHash7("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
-      const out = execFileSync8("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      const out = execFileSync9("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync27(p)) {
-        const id = readFileSync26(p, "utf8").trim();
+      if (existsSync28(p)) {
+        const id = readFileSync27(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -13225,15 +13315,15 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync27(path)) {
-    const cached = readFileSync26(path, "utf8").trim();
+  if (existsSync28(path)) {
+    const cached = readFileSync27(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync19(dirname14(path), { recursive: true });
-  writeFileSync20(path, `${hashed}
+  mkdirSync20(dirname15(path), { recursive: true });
+  writeFileSync21(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -13246,16 +13336,16 @@ function matchShipRows(ships, shipName2, machineId) {
 
 // src/provision.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync28, writeFileSync as writeFileSync22 } from "fs";
 import { hostname as hostname2 } from "os";
-import { parseDocument as parseDocument3 } from "yaml";
+import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
 // src/doctor-fix.ts
 import { parseDocument as parseDocument2 } from "yaml";
 
 // src/repos-cmd.ts
 import { homedir as homedir9 } from "os";
-import { basename as basename10, join as join32, resolve as resolve3 } from "path";
+import { basename as basename10, join as join33, resolve as resolve4 } from "path";
 import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -13302,7 +13392,7 @@ function parseAddArgs(args, routes, isDir) {
 }
 function expandDir(p, base) {
   const home = p === "~" ? homedir9() : p.startsWith("~/") ? `${homedir9()}/${p.slice(2)}` : p;
-  return resolve3(base, home);
+  return resolve4(base, home);
 }
 function routeMapOf(doc, route2) {
   const routes = doc.get("routes", true);
@@ -13533,7 +13623,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join32(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join33(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
   const forgeHost = i.resolved?.repoForgeHosts?.[id];
   return { ...add, remote, target, ...forgeHost ? { forgeHost } : {} };
@@ -13684,6 +13774,15 @@ async function runProvision(o, deps, write, human) {
       emit("connect", `set ship.${key}`, { setting: key });
     }
   }
+  if (o.runner === "host") {
+    emit("connect", "runner: host chosen explicitly (--runner host); not applying the managed sandbox defaults", { setting: "ship.runner", value: "host" });
+    if (deps.setShipSetting("runner", "host")) summary.changed = true;
+  } else if (o.runner === "sandbox" || isManagedShipKind(o.shipKind)) {
+    for (const key of deps.applyManagedDefaults()) {
+      summary.changed = true;
+      emit("connect", `set ${key}`, { setting: key });
+    }
+  }
   for (const host of o.forgeHosts) {
     const token = o.tokens[host];
     const stored = deps.storedToken(host);
@@ -13727,6 +13826,38 @@ async function runProvision(o, deps, write, human) {
   emit("done", summary.state, { summary });
   return { code: PROVISION_EXIT.ok, summary };
 }
+function isManagedShipKind(kind) {
+  return kind === "managed_instance" || kind === "pooled_instance" || kind === "pooled";
+}
+var MANAGED_CACHE_VOLUME = "crew-cache";
+function applyManagedDefaultsToDoc(doc) {
+  const wrote = [];
+  if (doc.getIn(["ship", "runner"]) === void 0) {
+    doc.setIn(["ship", "runner"], "sandbox");
+    wrote.push("ship.runner");
+  }
+  if (doc.getIn(["ship", "sandbox", "cacheVolume"]) === void 0) {
+    doc.setIn(["ship", "sandbox", "cacheVolume"], MANAGED_CACHE_VOLUME);
+    wrote.push("ship.sandbox.cacheVolume");
+  }
+  const existing = doc.getIn(["ship", "toolchains"]);
+  const hasClaude = isMap2(existing) && existing.items.some((i) => (isScalar(i.key) ? i.key.value : i.key) === "claude");
+  if (!hasClaude) {
+    doc.setIn(["ship", "toolchains", "claude", "harness"], "claude");
+    for (const k of ["bin", "model", "maxThinkingTokens"]) {
+      const v = doc.getIn(["ship", "agent", k]);
+      if (v !== void 0) doc.setIn(["ship", "toolchains", "claude", k], v);
+    }
+  }
+  const toolchains = doc.getIn(["ship", "toolchains"]);
+  for (const name of isMap2(toolchains) ? toolchains.items.map((i) => String(isScalar(i.key) ? i.key.value : i.key)) : []) {
+    if (doc.getIn(["ship", "toolchains", name, "harness"]) !== "claude") continue;
+    if (doc.getIn(["ship", "toolchains", name, "auth"]) !== void 0) continue;
+    doc.setIn(["ship", "toolchains", name, "auth"], "workspace");
+    wrote.push(`ship.toolchains.${name}.auth`);
+  }
+  return wrote;
+}
 function envKey(host) {
   return host.toUpperCase().replace(/[^A-Z0-9]/g, "_");
 }
@@ -13778,6 +13909,7 @@ function provisionOptionsFrom(argv2, env) {
     relayHost: one("relay-host"),
     maxConcurrentAgents: Number.isInteger(Number(one("max-concurrent-agents"))) && Number(one("max-concurrent-agents")) > 0 ? Number(one("max-concurrent-agents")) : void 0,
     agentBin: one("agent-bin"),
+    runner: one("runner") === "host" || one("runner") === "sandbox" ? one("runner") : void 0,
     extraPath: one("extra-path"),
     baseUrl: one("base-url"),
     forgeHosts,
@@ -13798,7 +13930,7 @@ function realProvisionDeps(crewHome) {
   };
   const configFile = () => {
     const f = findConfigFile(crewHome);
-    return existsSync28(f) ? f : null;
+    return existsSync29(f) ? f : null;
   };
   return {
     crew: spawnCrew,
@@ -13806,13 +13938,13 @@ function realProvisionDeps(crewHome) {
     enableRoute(route2) {
       const file = configFile();
       if (!file) return false;
-      const text2 = readFileSync27(file, "utf8");
+      const text2 = readFileSync28(file, "utf8");
       const doc = parseDocument3(text2);
       const routes = doc.get("routes");
       const entry = routes?.items?.find((r) => r.get("route") === route2);
       if (!entry) throw new Error(`route ${route2} is not in ${file}`);
       if (entry.get("enabled") === true) return false;
-      writeFileSync21(file, planEnable(text2, route2));
+      writeFileSync22(file, planEnable(text2, route2));
       return true;
     },
     installState() {
@@ -13832,14 +13964,14 @@ function realProvisionDeps(crewHome) {
           continue;
         }
         for (const p of plan.unitPaths) {
-          if (!existsSync28(p) || readFileSync27(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+          if (!existsSync29(p) || readFileSync28(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
         }
       }
       const label = labelFor(crewHome, "run");
       let running = false;
       let lingering = true;
       if (mechanism === "systemd") {
-        const system = ctx.root || existsSync28(systemUnitPathFor(label));
+        const system = ctx.root || existsSync29(systemUnitPathFor(label));
         const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
         running = spawnSync7(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
         if (!system) {
@@ -13856,12 +13988,20 @@ function realProvisionDeps(crewHome) {
     setShipSetting(key, value2) {
       const file = configFile();
       if (!file) return false;
-      const doc = parseDocument3(readFileSync27(file, "utf8"));
+      const doc = parseDocument3(readFileSync28(file, "utf8"));
       if (doc.getIn(["ship", key]) === value2) return false;
       doc.setIn(["ship", key], value2);
-      writeFileSync21(file, doc.toString());
+      writeFileSync22(file, doc.toString());
       return true;
     },
+    applyManagedDefaults() {
+      const file = configFile();
+      if (!file) return [];
+      const doc = parseDocument3(readFileSync28(file, "utf8"));
+      const wrote = applyManagedDefaultsToDoc(doc);
+      if (wrote.length) writeFileSync22(file, doc.toString());
+      return wrote;
+    },
     storedToken(host) {
       const res = spawnCrew(["credential", "get"], { input: `protocol=https
 host=${host}
@@ -13876,9 +14016,9 @@ host=${host}
 
 // src/tunnel.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync29, mkdirSync as mkdirSync20, readFileSync as readFileSync28, writeFileSync as writeFileSync22, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync21, readFileSync as readFileSync29, writeFileSync as writeFileSync23, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
 import { randomInt } from "crypto";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn6(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -13950,21 +14090,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join33(stateDir, "passengers", `${workspaceId}.json`);
+  return join34(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync29(path)) return void 0;
+  if (!existsSync30(path)) return void 0;
   try {
-    return JSON.parse(readFileSync28(path, "utf8"));
+    return JSON.parse(readFileSync29(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync20(join33(stateDir, "passengers"), { recursive: true });
-  writeFileSync22(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync21(join34(stateDir, "passengers"), { recursive: true });
+  writeFileSync23(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -14066,8 +14206,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join33(stateDir, "passengers");
-  if (!existsSync29(dir)) return [];
+  const dir = join34(stateDir, "passengers");
+  if (!existsSync30(dir)) return [];
   return readdirSync13(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -14092,7 +14232,7 @@ function realPoolMemberDeps(o) {
       crewVersion: crewVersion(o.crewHome),
       hostname: hostname3()
     },
-    hasShipConfig: () => existsSync30(findConfigFile(o.crewHome)),
+    hasShipConfig: () => existsSync31(findConfigFile(o.crewHome)),
     async provision(lease, instanceClass, shipKind) {
       const hosts = lease.forges.map((f) => f.host.toLowerCase());
       const lines2 = [];
@@ -14968,8 +15108,8 @@ ${waiting.map((t) => `| ${displayKey2(t)} | ${t.status} | ${blockers(t, i)} |`).
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync23 } from "fs";
-import { join as join34 } from "path";
+import { writeFileSync as writeFileSync24 } from "fs";
+import { join as join35 } from "path";
 
 // src/stalled.ts
 var STALLED_AFTER_CYCLES = 30;
@@ -15276,7 +15416,7 @@ async function decideCycle(o) {
   }
   return decision;
 }
-var digestPath = (stateDir, route2, role, runId) => join34(stateDir, `digest-${route2}-${role}${runId ? `-${runId}` : ""}.md`);
+var digestPath = (stateDir, route2, role, runId) => join35(stateDir, `digest-${route2}-${role}${runId ? `-${runId}` : ""}.md`);
 function otherRunsRemoved(tickets, own) {
   if (!own) return tickets;
   return tickets.filter((t) => t.id === own.ticket.id || !own.inFlight(t.id));
@@ -15354,7 +15494,7 @@ function writeDigest(o, d, role, stateDir, runId, own) {
 
 ${body}` : body;
     const path = digestPath(stateDir, routeSlug(o.route.route), role, runId);
-    writeFileSync23(path, text2);
+    writeFileSync24(path, text2);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text2)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text2) }
     });
@@ -15462,8 +15602,8 @@ async function resolveOne(tracker, t, seat, approvedStatus, buildingStatus, affi
 }
 
 // src/repo-refresh.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync21, readFileSync as readFileSync29, writeFileSync as writeFileSync24 } from "fs";
-import { dirname as dirname16 } from "path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync30, writeFileSync as writeFileSync25 } from "fs";
+import { dirname as dirname17 } from "path";
 var REFRESH_COOLDOWN_MS = 2 * 6e4;
 var UNSERVABLE_PASSES_BEFORE_ATTENTION = 3;
 var lastAsked = /* @__PURE__ */ new Map();
@@ -15492,11 +15632,11 @@ function applyRepoRows(resolved, rows) {
 }
 function persistRepoRows(stateDir, routeName, rows) {
   const path = resolvedPathFor(stateDir, routeName);
-  if (!existsSync31(path)) return;
-  const raw = JSON.parse(readFileSync29(path, "utf8"));
+  if (!existsSync32(path)) return;
+  const raw = JSON.parse(readFileSync30(path, "utf8"));
   applyRepoRows(raw, rows);
-  mkdirSync21(dirname16(path), { recursive: true });
-  writeFileSync24(path, `${JSON.stringify(raw, null, 2)}
+  mkdirSync22(dirname17(path), { recursive: true });
+  writeFileSync25(path, `${JSON.stringify(raw, null, 2)}
 `);
 }
 async function refreshUnknownRepos(o) {
@@ -15946,13 +16086,13 @@ Ship ${shipName2} found: ${problem}. The release refuses to squash a ref nobody
 var localRefSkipReported = (ticket, problem, events) => events.some((e) => e.record_id === ticket.id && e.event_type === "local_ref_skip" && (e.message ?? "").includes(problem));
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname17, join as join35 } from "path";
-import { accessSync as accessSync3, constants as constants3, existsSync as existsSync32, mkdirSync as mkdirSync22, writeFileSync as writeFileSync25 } from "fs";
+import { delimiter, dirname as dirname18, join as join36 } from "path";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync33, mkdirSync as mkdirSync23, writeFileSync as writeFileSync26 } from "fs";
 import { stringify as stringify3 } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync32;
+  const exists = opts.configExists ?? existsSync33;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -15969,7 +16109,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join35(dir, name);
+    const candidate = join36(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -15995,9 +16135,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname17(env.nodePath);
+  const nodeDir = dirname18(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname17(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname18(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -16008,7 +16148,7 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname17(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname18(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
@@ -16030,9 +16170,9 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text2) {
-  mkdirSync22(dirname17(path), { recursive: true });
+  mkdirSync23(dirname18(path), { recursive: true });
   try {
-    writeFileSync25(path, text2, { mode: 384, flag: "wx" });
+    writeFileSync26(path, text2, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -16066,7 +16206,7 @@ Wrote ${o.configPath}.
 // src/connect-json.ts
 import { accessSync as accessSync4, constants as constants4 } from "fs";
 import { homedir as homedir10 } from "os";
-import { dirname as dirname18, join as join36 } from "path";
+import { dirname as dirname19, join as join37 } from "path";
 import { delimiter as delimiter2 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json2, write) {
@@ -16105,12 +16245,12 @@ function agentBinSearchDirs(home, pathEnv, extraPath) {
   const dirs = [
     ...pathEnv.split(delimiter2),
     ...(extraPath ?? "").split(delimiter2),
-    join36(home, ".local/bin"),
-    join36(home, ".claude/local"),
+    join37(home, ".local/bin"),
+    join37(home, ".claude/local"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    join36(home, ".npm-global/bin"),
-    join36(home, ".volta/bin")
+    join37(home, ".npm-global/bin"),
+    join37(home, ".volta/bin")
   ];
   return [...new Set(dirs.filter(Boolean))];
 }
@@ -16132,7 +16272,7 @@ function flagWizardAnswers(f, env) {
   const agentBin = f.agentBin ?? found?.bin;
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
   const dockerPath = f.hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = f.extraPath ?? deriveExtraPath([dirname18(env.nodePath), pnpmPath ? dirname18(pnpmPath) : void 0, dockerPath ? dirname18(dockerPath) : void 0]);
+  const extraPath = f.extraPath ?? deriveExtraPath([dirname19(env.nodePath), pnpmPath ? dirname19(pnpmPath) : void 0, dockerPath ? dirname19(dockerPath) : void 0]);
   return {
     answers: {
       name: f.shipName?.trim() || env.hostname,
@@ -16146,8 +16286,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync26, existsSync as existsSync33, copyFileSync, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync17 } from "fs";
-import { dirname as dirname19, join as join37 } from "path";
+import { readFileSync as readFileSync31, writeFileSync as writeFileSync27, existsSync as existsSync34, copyFileSync, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync3, rmSync as rmSync17 } from "fs";
+import { dirname as dirname20, join as join38 } from "path";
 import { tmpdir as tmpdir5 } from "os";
 
 // src/release.ts
@@ -16366,7 +16506,7 @@ function decideRelease(cwd, tickets, contract, opts = {}) {
   const block = opts.guard === false ? null : checkGuards(cwd, base);
   const lastTag = latestReleaseTag(cwd, pattern, ref);
   const lastReleased = lastTag ? tagCommit(cwd, lastTag) : null;
-  const head = resolve2(cwd, ref) ?? "";
+  const head = resolve3(cwd, ref) ?? "";
   const merges = block ? [] : planMerge(cwd, tickets, contract, lastReleased, opts.branchFor ?? ((t) => branchForIssue(cwd, t.issue_id)), opts.ref ?? base, opts.blockerInfo, ref);
   const unreleasedCommits = lastReleased ? countCommits(cwd, `${lastReleased}..${ref}`) : 0;
   const unreleasedWork = lastReleased ? (gitOk(cwd, ["log", "--format=%s", `${lastReleased}..${ref}`]) ?? "").split("\n").filter((l) => l && !RELEASE_COMMIT_SUBJECT.test(l)).length : 0;
@@ -16546,8 +16686,8 @@ function movedPast(r, t, branch, pushedAs) {
   if (!r.columns.verifiedSha) return null;
   const verified = columnValue(t, r.contract.columns.verifiedSha);
   if (!verified) return null;
-  const head = resolve2(r.cwd, branch);
-  const remoteHead = resolve2(r.cwd, `${r.repo.branch.remote}/${pushedAs}`);
+  const head = resolve3(r.cwd, branch);
+  const remoteHead = resolve3(r.cwd, `${r.repo.branch.remote}/${pushedAs}`);
   if (remoteHead && !isAncestor(r.cwd, remoteHead, verified) && remoteHead !== head) {
     return { ticket: t, verified, head: remoteHead, branch: pushedAs };
   }
@@ -16570,7 +16710,7 @@ async function runReview(r, verified, reviewing) {
       out.requeues.push(moved);
       continue;
     }
-    const head = resolve2(r.cwd, branch);
+    const head = resolve3(r.cwd, branch);
     if (!head) continue;
     if (r.dryRun) {
       r.emit.emit(`would push ${branch} to ${remote}/${pushedAs} for review`, { ticket: ticket.issue_id });
@@ -16888,13 +17028,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join37(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join38(o.cwd, f));
   const first = files[0];
-  if (!existsSync33(first)) {
+  if (!existsSync34(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync30(first, "utf8")).version;
+  const current = JSON.parse(readFileSync31(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -16907,27 +17047,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync30(f, "utf8");
+    const src = readFileSync31(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync26(f, out);
+    writeFileSync27(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join37(o.cwd, file);
+  const path = join38(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync33(path) ? readFileSync30(path, "utf8") : "# Changelog\n";
-  writeFileSync26(path, insertChangelogSection(existing, section));
+  const existing = existsSync34(path) ? readFileSync31(path, "utf8") : "# Changelog\n";
+  writeFileSync27(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -17020,8 +17160,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run3 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync3(join37(tmpdir5(), "crew-release-"));
-  const dir = join37(root, "checkout");
+  const root = mkdtempSync3(join38(tmpdir5(), "crew-release-"));
+  const dir = join38(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -17031,10 +17171,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join37(o.cwd, f);
-    if (!existsSync33(src)) continue;
-    mkdirSync23(dirname19(join37(dir, f)), { recursive: true });
-    copyFileSync(src, join37(dir, f));
+    const src = join38(o.cwd, f);
+    if (!existsSync34(src)) continue;
+    mkdirSync24(dirname20(join38(dir, f)), { recursive: true });
+    copyFileSync(src, join38(dir, f));
   }
   return { dir, branch, close };
 }
@@ -17457,7 +17597,7 @@ async function mergeAndRelease(o, decision, fresh, releaseBranch, isolated = fal
           branches: merged.filter((c) => c.branch).map((c) => ({
             key: c.ticket.issue_tag ?? c.ticket.issue_id,
             branch: c.branch,
-            tip: resolve2(o.cwd, c.branch) ?? ""
+            tip: resolve3(o.cwd, c.branch) ?? ""
           }))
         };
         const hookFailure2 = {
@@ -17520,7 +17660,7 @@ async function mergeAndRelease(o, decision, fresh, releaseBranch, isolated = fal
   if (releaseBranch && !o.dryRun) {
     const { remote, base } = o.repo.branch;
     if (fetchRemote(o.cwd, remote) && remoteBranchExists(o.cwd, remote, base)) {
-      const moved = resolve2(o.cwd, `${remote}/${base}`);
+      const moved = resolve3(o.cwd, `${remote}/${base}`);
       if (moved && !isAncestor(o.cwd, moved, "HEAD")) {
         o.emit.warn(`${remote}/${base} moved during the release \u2014 discarding it; the tickets stay verified and the next cycle retries`);
         return { merged, conflicts, unbuildable, version, deployed: false, decision, stopped: "base branch moved during release" };
@@ -18013,7 +18153,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync34, statSync as statSync10, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync35, statSync as statSync11, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -18114,8 +18254,8 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync34(file)) return { events: [], offset: from };
-  const size = statSync10(file).size;
+  if (!existsSync35(file)) return { events: [], offset: from };
+  const size = statSync11(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
   const fd = openSync4(file, "r");
@@ -18357,8 +18497,8 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync24, readFileSync as readFileSync31, renameSync as renameSync5, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname20 } from "path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync32, renameSync as renameSync5, writeFileSync as writeFileSync28 } from "fs";
+import { dirname as dirname21 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
 };
@@ -18419,34 +18559,34 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync35(resolvedFile)) return void 0;
+  if (!existsSync36(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync31(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync32(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync35(resolvedFile)) return;
+  if (!existsSync36(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync31(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync32(resolvedFile, "utf8"));
   } catch {
     return;
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync24(dirname20(resolvedFile), { recursive: true });
+  mkdirSync25(dirname21(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync27(tmp, `${JSON.stringify(raw, null, 2)}
+  writeFileSync28(tmp, `${JSON.stringify(raw, null, 2)}
 `);
   renameSync5(tmp, resolvedFile);
 }
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync31(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync32(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -18470,8 +18610,8 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text2 = readFileSync31(i.configFile, "utf8");
-    writeFileSync27(i.configFile, setShipNameInYaml(text2, result.name));
+    const text2 = readFileSync32(i.configFile, "utf8");
+    writeFileSync28(i.configFile, setShipNameInYaml(text2, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
       i.emit?.warn(
@@ -19130,8 +19270,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync32, writeFileSync as writeFileSync28 } from "fs";
-import { dirname as dirname21 } from "path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync33, writeFileSync as writeFileSync29 } from "fs";
+import { dirname as dirname22 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -19164,12 +19304,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync36(resolvedPath) ? JSON.parse(readFileSync32(resolvedPath, "utf8")) : {};
+    const raw = existsSync37(resolvedPath) ? JSON.parse(readFileSync33(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync25(dirname21(resolvedPath), { recursive: true });
-    writeFileSync28(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync26(dirname22(resolvedPath), { recursive: true });
+    writeFileSync29(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -19273,7 +19413,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
 
 // src/repos-check.ts
 import { spawnSync as spawnSync9 } from "child_process";
-import { readFileSync as readFileSync33 } from "fs";
+import { readFileSync as readFileSync34 } from "fs";
 import { basename as basename11 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
 function checkHookSyntax(script, shell) {
@@ -19314,7 +19454,7 @@ function checkRepoSpec(dir, opts = {}) {
   }
   let parsed;
   try {
-    parsed = parseRepoConfig(readFileSync33(file, "utf8"), file);
+    parsed = parseRepoConfig(readFileSync34(file, "utf8"), file);
   } catch (e) {
     if (!(e instanceof RepoConfigError)) throw e;
     return { ...empty, file, error: e.message, exitCode: 1 };
@@ -19371,7 +19511,7 @@ function renderRepoCheck(r) {
 }
 
 // src/repos-hooks.ts
-import { isMap as isMap2, parseDocument as parseDocument6, YAMLMap } from "yaml";
+import { isMap as isMap3, parseDocument as parseDocument6, YAMLMap } from "yaml";
 function packageManager(f) {
   if (f.exists("pnpm-lock.yaml")) return "pnpm";
   if (f.exists("yarn.lock")) return "yarn";
@@ -19517,9 +19657,9 @@ function planRouteHooks(text2, route2, name, hooks, opts = {}) {
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
   let target = m;
-  if (isMap2(repos)) {
+  if (isMap3(repos)) {
     const entry = repos.get(name, true);
-    if (isMap2(entry)) target = entry;
+    if (isMap3(entry)) target = entry;
     else {
       const created = new YAMLMap();
       created.set("dir", String(repos.get(name)));
@@ -19529,7 +19669,7 @@ function planRouteHooks(text2, route2, name, hooks, opts = {}) {
   }
   const current = target.get("hooks", true);
   let hooksMap;
-  if (isMap2(current)) hooksMap = current;
+  if (isMap3(current)) hooksMap = current;
   else {
     hooksMap = new YAMLMap();
     target.set("hooks", hooksMap);
@@ -19554,13 +19694,13 @@ function clearRouteHooks(text2, route2, name) {
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
   let target = m;
-  if (isMap2(repos)) {
+  if (isMap3(repos)) {
     const entry = repos.get(name, true);
-    if (!isMap2(entry)) return { text: text2, removed: [] };
+    if (!isMap3(entry)) return { text: text2, removed: [] };
     target = entry;
   }
   const current = target.get("hooks", true);
-  if (!isMap2(current)) return { text: text2, removed: [] };
+  if (!isMap3(current)) return { text: text2, removed: [] };
   const removed = current.items.map((i) => String(i.key.value ?? i.key));
   target.delete("hooks");
   return { text: String(doc), removed };
@@ -19593,9 +19733,9 @@ function existingRepoConfig(f) {
 }
 
 // src/repos-hooks-agent.ts
-import { spawn as spawn7, execFileSync as execFileSync9 } from "child_process";
+import { spawn as spawn7, execFileSync as execFileSync10 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { isAbsolute as isAbsolute2, relative } from "path";
+import { isAbsolute as isAbsolute3, relative } from "path";
 var AgentSuggestError = class extends Error {
   reason;
   constructor(reason, message) {
@@ -19664,7 +19804,7 @@ function parseAgentStream(out, dir) {
     if (ev?.type === "assistant" && Array.isArray(ev.message?.content)) {
       for (const b of ev.message.content) {
         const p = b?.type === "tool_use" && b.name === "Read" ? b.input?.file_path : void 0;
-        if (typeof p === "string") files.add(isAbsolute2(p) ? relative(base, p) : p);
+        if (typeof p === "string") files.add(isAbsolute3(p) ? relative(base, p) : p);
       }
     } else if (ev?.type === "result") {
       text2 = typeof ev.result === "string" ? ev.result : "";
@@ -19696,7 +19836,7 @@ function classifyFailure(o) {
 }
 function porcelain(dir) {
   try {
-    return execFileSync9("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
+    return execFileSync10("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
   } catch {
     return void 0;
   }
@@ -19711,7 +19851,7 @@ async function runAgentSuggest(o) {
   const before = porcelain(o.dir);
   const timeout = AbortSignal.timeout(o.timeoutMs ?? DEFAULT_TIMEOUT_MS);
   const signal = o.signal ? AbortSignal.any([o.signal, timeout]) : timeout;
-  const run3 = await new Promise((resolve7) => {
+  const run3 = await new Promise((resolve8) => {
     let out = "";
     let err3 = "";
     const child = spawn7(bin, args, { cwd: o.dir, env, detached: true, stdio: ["pipe", "pipe", "pipe"] });
@@ -19720,7 +19860,7 @@ async function runAgentSuggest(o) {
       if (settled) return;
       settled = true;
       signal.removeEventListener("abort", onAbort);
-      resolve7(r);
+      resolve8(r);
     };
     const onAbort = () => {
       try {
@@ -19765,7 +19905,7 @@ ${run3.err}` });
 }
 
 // src/sample-ticket.ts
-import { basename as basename12, dirname as dirname22, join as join38 } from "path";
+import { basename as basename12, dirname as dirname23, join as join39 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -19788,8 +19928,8 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join38(dirname22(existing[0]), SAMPLE_REPO);
-  return join38(reposBase, workspace, SAMPLE_REPO);
+  if (existing.length > 0) return join39(dirname23(existing[0]), SAMPLE_REPO);
+  return join39(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
 function sampleDescription() {
@@ -19833,8 +19973,8 @@ function planSampleTicket(i) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync37, readFileSync as readFileSync34, readdirSync as readdirSync14 } from "fs";
-import { basename as basename13, dirname as dirname23, join as join39, resolve as resolve4 } from "path";
+import { existsSync as existsSync38, readFileSync as readFileSync35, readdirSync as readdirSync14 } from "fs";
+import { basename as basename13, dirname as dirname24, join as join40, resolve as resolve5 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -19898,9 +20038,9 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname23(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname24(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename13(target.dir.replace(/[/\\]+$/, ""))}-`;
-  const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
+  const registered = new Set(worktrees(target.dir).map((w) => resolve5(w.path)));
   let names;
   try {
     names = readdirSync14(parent);
@@ -19911,8 +20051,8 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join39(parent, name);
-    if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
+    const path = join40(parent, name);
+    if (m && !registered.has(resolve5(path))) out.push({ path, number: m[1] });
   }
   return out;
 }
@@ -19946,7 +20086,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync37(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync38(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -19954,7 +20094,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync37(a.path)) {
+    if (!dryRun && existsSync38(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -19965,7 +20105,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync37(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync38(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -20014,7 +20154,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync34(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync35(resolve5(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -20119,16 +20259,16 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync38, readdirSync as readdirSync15, rmSync as rmSync18, statSync as statSync11 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync39, readdirSync as readdirSync15, rmSync as rmSync18, statSync as statSync12 } from "fs";
+import { join as join41 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join40(stateDir, "streams");
-  if (!existsSync38(dir)) return [];
+  const dir = join41(stateDir, "streams");
+  if (!existsSync39(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync15(dir).map((name) => join40(dir, name)).filter((path) => {
+  return readdirSync15(dir).map((name) => join41(dir, name)).filter((path) => {
     try {
-      return statSync11(path).mtimeMs < cutoff;
+      return statSync12(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -20152,11 +20292,11 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync38(stateDir)) return [];
+  if (!existsSync39(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync15(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join40(stateDir, name)).filter((path) => {
+  return readdirSync15(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join41(stateDir, name)).filter((path) => {
     try {
-      return statSync11(path).mtimeMs < cutoff;
+      return statSync12(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -20164,12 +20304,12 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync40, existsSync as existsSync45, mkdirSync as mkdirSync32, writeFileSync as writeFileSync33, rmSync as rmSync23, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync15, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync41, existsSync as existsSync46, mkdirSync as mkdirSync33, writeFileSync as writeFileSync34, rmSync as rmSync23, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync26, readFileSync as readFileSync35, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
-import { join as join41 } from "path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync27, readFileSync as readFileSync36, rmSync as rmSync19, writeFileSync as writeFileSync30 } from "fs";
+import { join as join42 } from "path";
 var PeriscopeError = class extends Error {
 };
 var LivePeriscopeError = class extends PeriscopeError {
@@ -20179,22 +20319,22 @@ var LivePeriscopeError = class extends PeriscopeError {
     this.data = { refused: "live_periscope_exists", ...live };
   }
 };
-var priorDir = (stateDir) => join41(stateDir, "periscope-priors");
-var priorPath = (stateDir, ticketRecordId) => join41(priorDir(stateDir), `${ticketRecordId}.json`);
+var priorDir = (stateDir) => join42(stateDir, "periscope-priors");
+var priorPath = (stateDir, ticketRecordId) => join42(priorDir(stateDir), `${ticketRecordId}.json`);
 function removePeriscopePrior(stateDir, ticketRecordId) {
   rmSync19(priorPath(stateDir, ticketRecordId), { force: true });
 }
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
-    mkdirSync26(priorDir(stateDir), { recursive: true });
-    writeFileSync29(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
+    mkdirSync27(priorDir(stateDir), { recursive: true });
+    writeFileSync30(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
 }
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync39(p) ? JSON.parse(readFileSync35(p, "utf8")) : void 0;
+    return existsSync40(p) ? JSON.parse(readFileSync36(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -20356,7 +20496,12 @@ ${tail(iso.output)}`);
   const handoff = await d.runHook("handoff", wt.path, env);
   if (handoff && handoff.code !== 0) return abandon(`handoff failed (exit ${handoff.code})
 ${tail(handoff.output)}`);
-  const preview = await d.runHook("preview", wt.path, { ...env, CREW_PREVIEW_HOST: d.host });
+  try {
+    d.prepareDropFile(wt.path);
+  } catch (e) {
+    return abandon(`preparing the drop file failed: ${e.message}`);
+  }
+  const preview = await d.runHook("preview", wt.path, { ...env, CREW_PREVIEW_HOST: d.host, ...pointedAtEnv(wt.path) });
   if (!preview || preview.code !== 0) {
     return abandon(`preview exited ${preview?.code ?? "without running"}
 ${tail(preview?.output ?? "")}`);
@@ -20571,7 +20716,8 @@ async function runPeriscopeResume(d, number) {
 ${tail2(iso.output)}`);
     if (iso) Object.assign(env, parseEnvLines(iso.output));
   }
-  const preview = await d.runHook("preview", row.worktree, { ...env, CREW_PREVIEW_HOST: row.host || "localhost" });
+  d.prepareDropFile?.(row.worktree);
+  const preview = await d.runHook("preview", row.worktree, { ...env, CREW_PREVIEW_HOST: row.host || "localhost", ...pointedAtEnv(row.worktree) });
   if (!preview || preview.code !== 0) {
     throw new PeriscopeError(`preview exited ${preview?.code ?? "without running"}
 ${tail2(preview?.output ?? "")}`);
@@ -20591,14 +20737,19 @@ ${tail2(preview.output)}`);
 }
 
 // src/periscope-idle.ts
-import { execFileSync as execFileSync10 } from "child_process";
-import { statSync as statSync12 } from "fs";
-import { join as join42 } from "path";
+import { execFileSync as execFileSync11 } from "child_process";
+import { statSync as statSync13 } from "fs";
+import { join as join43 } from "path";
 var MAX_SCANNED_FILES = 2e4;
 function newestWorktreeMtime(root) {
+  const a = newestTrackedMtime(root);
+  const b = dropFileMtime(root);
+  return a === null ? b : b === null ? a : Math.max(a, b);
+}
+function newestTrackedMtime(root) {
   let listing;
   try {
-    listing = execFileSync10("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    listing = execFileSync11("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       cwd: root,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -20613,7 +20764,7 @@ function newestWorktreeMtime(root) {
     if (!rel) continue;
     if (++scanned > MAX_SCANNED_FILES) break;
     try {
-      const m = statSync12(join42(root, rel)).mtimeMs;
+      const m = statSync13(join43(root, rel)).mtimeMs;
       if (newest === null || m > newest) newest = m;
     } catch {
     }
@@ -20688,21 +20839,21 @@ async function runPeriscopeIdlePass(d) {
 import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync11 } from "child_process";
-import { existsSync as existsSync40, mkdirSync as mkdirSync27, readFileSync as readFileSync36, chmodSync as chmodSync3 } from "fs";
-import { dirname as dirname24, join as join43 } from "path";
+import { execFileSync as execFileSync12 } from "child_process";
+import { existsSync as existsSync41, mkdirSync as mkdirSync28, readFileSync as readFileSync37, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname25, join as join44 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join43(stateDir, "ssh", "id_ed25519");
+  return join44(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync40(privateKeyPath)) {
-    mkdirSync27(dirname24(privateKeyPath), { recursive: true });
+  if (!existsSync41(privateKeyPath)) {
+    mkdirSync28(dirname25(privateKeyPath), { recursive: true });
     try {
-      execFileSync11("ssh-keygen", [
+      execFileSync12("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -20720,15 +20871,15 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync40(publicKeyPath)) {
+  if (!existsSync41(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync36(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync37(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync11("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync12("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -20887,12 +21038,12 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn8 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync41, mkdirSync as mkdirSync29, readFileSync as readFileSync37, writeFileSync as writeFileSync30, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
-import { join as join44 } from "path";
+import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync31, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { join as join45 } from "path";
 
 // src/passenger-mirror.ts
-import { mkdirSync as mkdirSync28 } from "fs";
-import { dirname as dirname25 } from "path";
+import { mkdirSync as mkdirSync29 } from "fs";
+import { dirname as dirname26 } from "path";
 function mirrorRepoOf(spec) {
   const fromOrigin = spec.originUrl ? parseRemote(spec.originUrl) : null;
   if (fromOrigin) return fromOrigin;
@@ -20910,9 +21061,9 @@ async function materializeMirrorCheckouts(specs, cacheFor = (s) => new SandboxCa
       continue;
     }
     try {
-      const parent = dirname25(spec.dir);
-      mkdirSync28(parent, { recursive: true });
-      mkdirSync28(spec.dir, { recursive: true });
+      const parent = dirname26(spec.dir);
+      mkdirSync29(parent, { recursive: true });
+      mkdirSync29(spec.dir, { recursive: true });
       const r = await cacheFor(spec).materialize(repo, spec.base, parent, spec.name);
       out.push({ ...base, action: r.changed ? "updated" : "unchanged", detail: r.tip });
     } catch (e) {
@@ -21018,21 +21169,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join44(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join45(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync41(path)) return void 0;
+  if (!existsSync42(path)) return void 0;
   try {
-    return JSON.parse(readFileSync37(path, "utf8"));
+    return JSON.parse(readFileSync38(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync29(join44(stateDir, "passengers"), { recursive: true });
-  writeFileSync30(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync30(join45(stateDir, "passengers"), { recursive: true });
+  writeFileSync31(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -21052,8 +21203,8 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join44(stateDir, "passengers");
-  if (!existsSync41(dir)) return [];
+  const dir = join45(stateDir, "passengers");
+  if (!existsSync42(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync16(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -21141,14 +21292,14 @@ function describeCause(err3) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, readdirSync as readdirSync17, rmSync as rmSync20, statSync as statSync13, writeFileSync as writeFileSync31 } from "fs";
-import { join as join45 } from "path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync39, readdirSync as readdirSync17, rmSync as rmSync20, statSync as statSync14, writeFileSync as writeFileSync32 } from "fs";
+import { join as join46 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
 var ALLOWANCE_PAUSE_MS = 5 * 60 * 1e3;
 var RELOAD_WARN_MS = 10 * 60 * 1e3;
-var defaultSleep = (ms3) => new Promise((resolve7) => setTimeout(resolve7, ms3));
+var defaultSleep = (ms3) => new Promise((resolve8) => setTimeout(resolve8, ms3));
 async function runDaemonLoop(o) {
   const floor = o.floorMs ?? DEFAULT_FLOOR_MS;
   const ceiling = o.ceilingMs ?? DEFAULT_CEILING_MS;
@@ -21222,7 +21373,7 @@ async function runDaemonLoop(o) {
 function latestMtime(path) {
   let stat2;
   try {
-    stat2 = statSync13(path);
+    stat2 = statSync14(path);
   } catch {
     return 0;
   }
@@ -21230,7 +21381,7 @@ function latestMtime(path) {
   if (!stat2.isDirectory()) return 0;
   let latest = stat2.mtimeMs;
   for (const entry of readdirSync17(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join45(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join46(path, entry.name)));
   }
   return latest;
 }
@@ -21239,30 +21390,30 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync42(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync43(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join45(stateDir, "reload-requested");
+  return join46(stateDir, "reload-requested");
 }
 function readReloadRequestedAt(stateDir) {
   try {
-    return statSync13(reloadSentinelFor(stateDir)).mtimeMs;
+    return statSync14(reloadSentinelFor(stateDir)).mtimeMs;
   } catch {
     return null;
   }
 }
 function daemonStampFor(stateDir) {
-  return join45(stateDir, "daemon.started");
+  return join46(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync30(stateDir, { recursive: true });
+  mkdirSync31(stateDir, { recursive: true });
   rmSync20(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync31(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync32(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync38(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync39(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -21271,7 +21422,7 @@ function readDaemonStarted(stateDir) {
 function configChangedAfter(files, startedAt) {
   for (const f of files) {
     try {
-      if (statSync13(f).mtimeMs > startedAt) return f;
+      if (statSync14(f).mtimeMs > startedAt) return f;
     } catch {
     }
   }
@@ -21434,8 +21585,8 @@ async function runOnePassUnguarded(o) {
       }
       let settle = () => {
       };
-      const settled = new Promise((resolve7) => {
-        settle = resolve7;
+      const settled = new Promise((resolve8) => {
+        settle = resolve8;
       });
       const ready = (tookTicket2) => settle(tookTicket2);
       const run3 = spawn11(role, decision, ctx, { ready }).then(() => {
@@ -21695,7 +21846,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
         ship.name,
         (t) => {
           const d = dirForRepo(route2, t.repo_id);
-          return d ? originBranchSha(d, t, resolve2) : null;
+          return d ? originBranchSha(d, t, resolve3) : null;
         }
       );
       if (!result.ticket) {
@@ -21828,18 +21979,18 @@ import { createHash as createHash10 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync5,
-  existsSync as existsSync43,
+  existsSync as existsSync44,
   fstatSync,
   openSync as openSync5,
   readSync as readSync3,
   readdirSync as readdirSync18,
   rmSync as rmSync21,
-  statSync as statSync14,
+  statSync as statSync15,
   watch
 } from "fs";
 import { createConnection } from "net";
 import { createServer } from "http";
-import { basename as basename14, dirname as dirname26, join as join46 } from "path";
+import { basename as basename14, dirname as dirname27, join as join47 } from "path";
 import { execFile as execFile3, spawn as spawn10 } from "child_process";
 
 // src/periscope-control.ts
@@ -21890,7 +22041,7 @@ function lastJsonLine(stdout) {
   }
   return null;
 }
-function parseLine(line) {
+function parseLine2(line) {
   try {
     const v = JSON.parse(line);
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
@@ -21918,7 +22069,7 @@ async function execute(h, args, streaming, after) {
     body: null,
     stream: async (write) => {
       const r = await h.run(args, (line) => {
-        const ev = parseLine(line);
+        const ev = parseLine2(line);
         if (ev) write(ev);
       });
       const f = await finish(r);
@@ -22033,7 +22184,7 @@ async function handlePeriscopes(h, q2) {
   ], q2.wantsStream, h.mcp ? async (done) => ({ ...done, ...await h.mcp.onUp(picked, done) }) : void 0);
 }
 function runCrew(args, onLine, timeoutMs = 20 * 6e4) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = spawn9(process.execPath, [process.argv[1] ?? "", ...args], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -22055,12 +22206,12 @@ function runCrew(args, onLine, timeoutMs = 20 * 6e4) {
     const t = setTimeout(() => child.kill("SIGTERM"), timeoutMs);
     child.on("error", (e) => {
       clearTimeout(t);
-      resolve7({ code: 127, stdout, stderr: `${stderr}${e.message}
+      resolve8({ code: 127, stdout, stderr: `${stderr}${e.message}
 ` });
     });
     child.on("close", (code) => {
       clearTimeout(t);
-      resolve7({ code: code ?? 1, stdout, stderr });
+      resolve8({ code: code ?? 1, stdout, stderr });
     });
   });
 }
@@ -22068,7 +22219,7 @@ function runCrew(args, onLine, timeoutMs = 20 * 6e4) {
 // src/control-api.ts
 var PAUSABLE = ["dev", "design", "qa"];
 var CONTROL_SOCKET_NAME = "control.sock";
-var controlSocketFor = (stateDir) => join46(stateDir, CONTROL_SOCKET_NAME);
+var controlSocketFor = (stateDir) => join47(stateDir, CONTROL_SOCKET_NAME);
 var MAX_SOCKET_PATH = 100;
 var MAX_TAIL_BYTES = 1024 * 1024;
 var MAX_WAIT_SECONDS = 30;
@@ -22155,7 +22306,7 @@ function candidates(live, rotated) {
   const out = [live];
   if (!rotated) return out;
   try {
-    for (const n of readdirSync18(dirname26(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join46(dirname26(live), n));
+    for (const n of readdirSync18(dirname27(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join47(dirname27(live), n));
   } catch {
   }
   return out;
@@ -22178,7 +22329,7 @@ function readRange(path, from, max) {
   }
 }
 function lastLines2(path, n) {
-  const st = statSync14(path);
+  const st = statSync15(path);
   const cursorAt = (off) => encodeCursor({ dev: st.dev, ino: st.ino, off });
   if (n <= 0 || st.size === 0) return { lines: [], cursor: cursorAt(st.size), reset: false };
   let start = st.size;
@@ -22199,7 +22350,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync43(live)) {
+  if (!existsSync44(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -22212,7 +22363,7 @@ function readTail(live, opts) {
   } else {
     const found = candidates(live, opts.rotated ?? false).find((p) => {
       try {
-        const s = statSync14(p);
+        const s = statSync15(p);
         return s.ino === cur.ino && s.dev === cur.dev;
       } catch {
         return false;
@@ -22223,7 +22374,7 @@ function readTail(live, opts) {
       off = cur.off;
     } else reset = true;
   }
-  let size = statSync14(path).size;
+  let size = statSync15(path).size;
   if (off > size) {
     off = 0;
     reset = true;
@@ -22231,12 +22382,12 @@ function readTail(live, opts) {
   if (off >= size && path !== live) {
     path = live;
     off = 0;
-    size = statSync14(path).size;
+    size = statSync15(path).size;
   }
   const { text: text2 } = readRange(path, off, max);
   const cut = text2.lastIndexOf("\n");
   const whole = cut < 0 ? "" : text2.slice(0, cut + 1);
-  const st = statSync14(path);
+  const st = statSync15(path);
   return {
     lines: whole.split("\n").filter((l) => l.length),
     cursor: encodeCursor({ dev: st.dev, ino: st.ino, off: off + Buffer.byteLength(whole) }),
@@ -22244,7 +22395,7 @@ function readTail(live, opts) {
   };
 }
 function waitForChange(dir, ms3, signal) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let w;
     const done = () => {
       clearTimeout(t);
@@ -22254,7 +22405,7 @@ function waitForChange(dir, ms3, signal) {
         w?.close();
       } catch {
       }
-      resolve7();
+      resolve8();
     };
     const t = setTimeout(done, ms3);
     const poll = setInterval(done, 500);
@@ -22315,7 +22466,7 @@ async function tailReply(path, q2, rotated, abort) {
   const deadline = Date.now() + Math.min(wait, MAX_WAIT_SECONDS) * 1e3;
   let r = readTail(path, { after, tail: tail3, rotated });
   while (after && !r.lines.length && !r.reset && Date.now() < deadline && !abort.aborted) {
-    await waitForChange(dirname26(path), deadline - Date.now(), abort);
+    await waitForChange(dirname27(path), deadline - Date.now(), abort);
     r = readTail(path, { after: r.cursor, rotated });
   }
   return reply2(200, r);
@@ -22355,8 +22506,8 @@ async function route(deps, method, url, req, abort) {
   if (p.startsWith("/streams/") && get2) {
     const run3 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run3) || run3.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run3)) return err2(400, "not a run name");
-    const file = join46(deps.stateDir, "streams", run3.endsWith(".jsonl") ? run3 : `${run3}.jsonl`);
-    if (!existsSync43(file)) return err2(404, "no such run");
+    const file = join47(deps.stateDir, "streams", run3.endsWith(".jsonl") ? run3 : `${run3}.jsonl`);
+    if (!existsSync44(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -22400,14 +22551,14 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync43(path)) return false;
-  return new Promise((resolve7) => {
+  if (!existsSync44(path)) return false;
+  return new Promise((resolve8) => {
     const c = createConnection(path);
     c.once("connect", () => {
       c.destroy();
-      resolve7(false);
+      resolve8(false);
     });
-    c.once("error", () => resolve7(true));
+    c.once("error", () => resolve8(true));
   });
 }
 async function startControlServer(deps) {
@@ -22419,7 +22570,7 @@ async function startControlServer(deps) {
     return null;
   }
   if (await socketIsStale(path)) rmSync21(path, { force: true });
-  else if (existsSync43(path)) {
+  else if (existsSync44(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -22449,10 +22600,10 @@ async function startControlServer(deps) {
       }
     })();
   });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     server.once("error", (e) => {
       log(`control API not started: ${e.message}`);
-      resolve7(null);
+      resolve8(null);
     });
     server.listen(path, () => {
       try {
@@ -22460,7 +22611,7 @@ async function startControlServer(deps) {
       } catch {
       }
       server.on("error", (e) => log(`control API error: ${e.message}`));
-      resolve7({
+      resolve8({
         server,
         path,
         close: () => new Promise((done) => {
@@ -22491,13 +22642,13 @@ function schedulerHandler(control, run3 = runDetached) {
   };
 }
 function crewJson(args, timeoutMs = 6e4) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     execFile3(process.execPath, [process.argv[1] ?? "", ...args], { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 }, (_e, stdout) => {
       try {
         const v = JSON.parse(String(stdout));
-        resolve7(v && typeof v === "object" && !Array.isArray(v) ? v : null);
+        resolve8(v && typeof v === "object" && !Array.isArray(v) ? v : null);
       } catch {
-        resolve7(null);
+        resolve8(null);
       }
     });
   });
@@ -22505,31 +22656,31 @@ function crewJson(args, timeoutMs = 6e4) {
 
 // src/periscope-mcp.ts
 import { lstat, mkdir, readdir, readFile, readlink, realpath, rm, stat, writeFile } from "fs/promises";
-import { basename as basename15, dirname as dirname27, isAbsolute as isAbsolute3, join as join48, relative as relative2, resolve as resolve5, sep } from "path";
+import { basename as basename15, dirname as dirname28, isAbsolute as isAbsolute4, join as join49, relative as relative2, resolve as resolve6, sep } from "path";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync44, mkdirSync as mkdirSync31, readdirSync as readdirSync19, readFileSync as readFileSync39, rmSync as rmSync22, writeFileSync as writeFileSync32 } from "fs";
-import { join as join47 } from "path";
-var secretDir = (stateDir) => join47(stateDir, "periscope-mcp");
-var secretFile = (stateDir, id) => join47(secretDir(stateDir), `${id}.json`);
-var endpointDir = (stateDir) => join47(stateDir, "periscope-endpoints");
-var endpointFile = (stateDir, id) => join47(endpointDir(stateDir), `${id}.json`);
+import { chmodSync as chmodSync5, existsSync as existsSync45, mkdirSync as mkdirSync32, readdirSync as readdirSync19, readFileSync as readFileSync40, rmSync as rmSync22, writeFileSync as writeFileSync33 } from "fs";
+import { join as join48 } from "path";
+var secretDir = (stateDir) => join48(stateDir, "periscope-mcp");
+var secretFile = (stateDir, id) => join48(secretDir(stateDir), `${id}.json`);
+var endpointDir = (stateDir) => join48(stateDir, "periscope-endpoints");
+var endpointFile = (stateDir, id) => join48(endpointDir(stateDir), `${id}.json`);
 function mintPeriscopeSecret(stateDir, ticketRecordId) {
-  mkdirSync31(secretDir(stateDir), { recursive: true, mode: 448 });
+  mkdirSync32(secretDir(stateDir), { recursive: true, mode: 448 });
   const secret = randomBytes3(32).toString("base64url");
   const file = secretFile(stateDir, ticketRecordId);
-  writeFileSync32(file, `${JSON.stringify({ secret })}
+  writeFileSync33(file, `${JSON.stringify({ secret })}
 `, { mode: 384 });
   chmodSync5(file, 384);
   return secret;
 }
 function readPeriscopeSecret(stateDir, ticketRecordId) {
   try {
-    const v = JSON.parse(readFileSync39(secretFile(stateDir, ticketRecordId), "utf8"));
+    const v = JSON.parse(readFileSync40(secretFile(stateDir, ticketRecordId), "utf8"));
     return typeof v.secret === "string" && v.secret ? v.secret : void 0;
   } catch {
     return void 0;
@@ -22540,14 +22691,14 @@ function removePeriscopeSecret(stateDir, ticketRecordId) {
 }
 function readPeriscopeEndpoint(stateDir, ticketRecordId) {
   try {
-    return JSON.parse(readFileSync39(endpointFile(stateDir, ticketRecordId), "utf8"));
+    return JSON.parse(readFileSync40(endpointFile(stateDir, ticketRecordId), "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePeriscopeEndpoint(stateDir, rec) {
-  mkdirSync31(endpointDir(stateDir), { recursive: true });
-  writeFileSync32(endpointFile(stateDir, rec.ticketRecordId), `${JSON.stringify(rec, null, 2)}
+  mkdirSync32(endpointDir(stateDir), { recursive: true });
+  writeFileSync33(endpointFile(stateDir, rec.ticketRecordId), `${JSON.stringify(rec, null, 2)}
 `);
 }
 function removePeriscopeEndpointRecord(stateDir, ticketRecordId) {
@@ -22555,7 +22706,7 @@ function removePeriscopeEndpointRecord(stateDir, ticketRecordId) {
 }
 function listPeriscopeEndpoints(stateDir) {
   const dir = endpointDir(stateDir);
-  if (!existsSync44(dir)) return [];
+  if (!existsSync45(dir)) return [];
   const out = [];
   for (const name of readdirSync19(dir)) {
     if (!name.endsWith(".json")) continue;
@@ -22624,7 +22775,7 @@ var PathRefusal = class extends Error {
 };
 var isInside = (root, p) => {
   const rel = relative2(root, p);
-  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute3(rel);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute4(rel);
 };
 async function realAncestor(p) {
   let cur = p;
@@ -22643,10 +22794,10 @@ async function realAncestor(p) {
     }
     if (isLink) {
       if (++hops > 40) throw new PathRefusal(`too many symbolic links resolving ${p}`);
-      cur = resolve5(dirname27(cur), await readlink(cur));
+      cur = resolve6(dirname28(cur), await readlink(cur));
       continue;
     }
-    const parent = dirname27(cur);
+    const parent = dirname28(cur);
     if (parent === cur) throw new PathRefusal(`cannot resolve ${p}`);
     tail3.push(basename15(cur));
     cur = parent;
@@ -22656,15 +22807,15 @@ async function resolveInWorktree(root, requested) {
   if (!requested || requested.includes("\0")) throw new PathRefusal("path is required");
   const realRoot = await realpath(root);
   let abs;
-  if (isAbsolute3(requested)) {
-    abs = resolve5(requested);
-    if (isInside(root, abs)) abs = join48(realRoot, relative2(root, abs));
+  if (isAbsolute4(requested)) {
+    abs = resolve6(requested);
+    if (isInside(root, abs)) abs = join49(realRoot, relative2(root, abs));
   } else {
-    abs = resolve5(realRoot, requested);
+    abs = resolve6(realRoot, requested);
   }
   if (!isInside(realRoot, abs)) throw new PathRefusal(`${requested} is outside this periscope's worktree`);
   const { real, rest } = await realAncestor(abs);
-  const final = rest ? join48(real, rest) : real;
+  const final = rest ? join49(real, rest) : real;
   if (!isInside(realRoot, final)) throw new PathRefusal(`${requested} is outside this periscope's worktree`);
   if (relative2(realRoot, final).split(sep).includes(".git")) throw new PathRefusal(".git is not reachable from a periscope");
   return final;
@@ -22699,7 +22850,7 @@ async function hookEnv(d, sc, name) {
       if (iso && iso.code === 0) Object.assign(env, parseEnvLines(iso.output));
     }
   }
-  if (name === "preview") env.CREW_PREVIEW_HOST = sc.host || "localhost";
+  if (name === "preview") Object.assign(env, { CREW_PREVIEW_HOST: sc.host || "localhost" }, pointedAtEnv(sc.worktree));
   return env;
 }
 function createPeriscopeMcpServer(d, sc) {
@@ -22732,7 +22883,7 @@ function createPeriscopeMcpServer(d, sc) {
     const entries = (await readdir(abs, { withFileTypes: true })).filter((e) => e.name !== ".git");
     const lines2 = await Promise.all(entries.map(async (e) => {
       if (e.isDirectory()) return `[DIR]  ${e.name}`;
-      const size = (await lstat(join48(abs, e.name))).size;
+      const size = (await lstat(join49(abs, e.name))).size;
       return `[FILE] ${e.name} (${size} bytes)`;
     }));
     return text(lines2.join("\n") || "(empty)");
@@ -22757,7 +22908,7 @@ function createPeriscopeMcpServer(d, sc) {
     if (Buffer.byteLength(content) > MAX_WRITE_BYTES) return text(`content exceeds ${MAX_WRITE_BYTES} bytes`, true);
     const abs = await inTree(path);
     if (abs === await realpath(root)) return text("path must name a file", true);
-    await mkdir(dirname27(abs), { recursive: true });
+    await mkdir(dirname28(abs), { recursive: true });
     await inTree(path);
     await writeFile(abs, content);
     return text(`Wrote ${Buffer.byteLength(content)} bytes to ${await rel(abs)}`);
@@ -22797,8 +22948,8 @@ function createPeriscopeMcpServer(d, sc) {
     inputSchema: { path: z.string() },
     annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
   }, async ({ path }) => {
-    const parent = await inTree(dirname27(path) === "" ? "." : dirname27(path));
-    const abs = join48(parent, basename15(path));
+    const parent = await inTree(dirname28(path) === "" ? "." : dirname28(path));
+    const abs = join49(parent, basename15(path));
     if (basename15(path) === ".git" || abs === parent) return text("path must name a file", true);
     const st = await lstat(abs).catch(() => void 0);
     if (!st) return text(`${path} does not exist`, true);
@@ -22919,7 +23070,7 @@ function findPeriscope(sidecars, segment) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname28(process.execPath) : resolve6(dirname28(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname29(process.execPath) : resolve7(dirname29(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -23287,7 +23438,7 @@ if (command === "provision") {
   process.exit(outcome.code);
 }
 if (command === "pool-member") {
-  const pool = poolConfigFrom(argv, process.env, () => readFileSync40(0, "utf8"));
+  const pool = poolConfigFrom(argv, process.env, () => readFileSync41(0, "utf8"));
   if (typeof pool === "string") {
     process.stderr.write(`crew pool-member: ${pool}
 `);
@@ -23515,7 +23666,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "deprovision" || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset") || command === "deprovision";
-      if (configless && !existsSync45(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync46(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -23530,7 +23681,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   if (command === "credential") {
-    const r = runCredential(positional[1], readFileSync40(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    const r = runCredential(positional[1], readFileSync41(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
     process.stdout.write(r.out);
     process.stderr.write(r.err);
     process.exit(r.code);
@@ -23542,9 +23693,9 @@ if (command === "passenger-sync-daemon") {
         forges: cfg.ship.forges,
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
-        readFile: (p) => readFileSync40(p, "utf8"),
-        writeFile: (p, t) => writeFileSync33(p, t),
-        stdin: () => readFileSync40(0, "utf8"),
+        readFile: (p) => readFileSync41(p, "utf8"),
+        writeFile: (p, t) => writeFileSync34(p, t),
+        stdin: () => readFileSync41(0, "utf8"),
         env: process.env
       }
     );
@@ -23837,8 +23988,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join49(homedir11(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync45(staleTimer)) {
+      const staleTimer = join50(homedir11(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync46(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -23865,7 +24016,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync45(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync46(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -23881,9 +24032,18 @@ if (command === "passenger-sync-daemon") {
     }
     return { problems, readiness };
   }
+  async function doctorShipKind(route3, ship) {
+    try {
+      const rows = await new Tracker(route3, ship).shipRows();
+      const mine = matchShipRows(rows, ship.name, doctorMachineId(ship.stateDir)).rows;
+      return mine.length === 1 ? mine[0].kind ?? null : null;
+    } catch {
+      return null;
+    }
+  }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync45(p);
+    const unitExists = (p) => existsSync46(p);
     const crontab = o.host === "linux" ? spawnSync10("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -23900,7 +24060,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync33(cfg.configFile, planEnable(readFileSync40(cfg.configFile, "utf8"), a.route));
+          writeFileSync34(cfg.configFile, planEnable(readFileSync41(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -24641,7 +24801,7 @@ ${cu.tail.trimEnd()}
               cfg.ship.name,
               (t) => {
                 const d = dirForRepo(w.route, t.repo_id);
-                return d ? originBranchSha(d, t, resolve2) : null;
+                return d ? originBranchSha(d, t, resolve3) : null;
               }
             );
             if (!result.ticket) {
@@ -24853,7 +25013,7 @@ ${cu.tail.trimEnd()}
               cfg.ship.name,
               (t) => {
                 const d = dirForRepo(route2, t.repo_id);
-                return d ? originBranchSha(d, t, resolve2) : null;
+                return d ? originBranchSha(d, t, resolve3) : null;
               }
             );
             if (!result.ticket) {
@@ -25039,7 +25199,7 @@ ${cu.tail.trimEnd()}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join49(CREW_HOME, "src"), join49(CREW_HOME, "dist"), join49(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join50(CREW_HOME, "src"), join50(CREW_HOME, "dist"), join50(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -25344,10 +25504,10 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync45(resolvedPath) ? JSON.parse(readFileSync40(resolvedPath, "utf8")) : {};
+        const raw = existsSync46(resolvedPath) ? JSON.parse(readFileSync41(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync32(dirOf2(resolvedPath), { recursive: true });
-        writeFileSync33(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync33(dirOf2(resolvedPath), { recursive: true });
+        writeFileSync34(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -25370,7 +25530,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync33(cfg.configFile, setShipNameInYaml(readFileSync40(cfg.configFile, "utf8"), newName));
+      writeFileSync34(cfg.configFile, setShipNameInYaml(readFileSync41(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -25417,14 +25577,14 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync40(cfg.configFile, "utf8");
+      const configText = readFileSync41(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
           const found = cfg.routes.find((r) => r.route === routeArg);
           if (!found) throw new ReposError(`no route "${routeArg}" in the config (have: ${cfg.routes.map((r) => r.route).join(", ") || "none"})`);
           const named2 = value("route") ? void 0 : positional[3];
-          const dir = named2 ? repoDirOf(configText, dirname28(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
+          const dir = named2 ? repoDirOf(configText, dirname29(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
           const target = reposOf(found).find((t) => resolvePath(t.dir) === dir || t.name === named2);
           const o = target ? found.repoOverrides[target.name] : void 0;
           runReposCheck(dir, {
@@ -25447,9 +25607,9 @@ ${cu.tail.trimEnd()}
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname28(cfg.configFile), a.route, a.name);
-          if (!existsSync45(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync45(resolvePath(dir, r)), list: (r) => {
+          const dir = repoDirOf(configText, dirname29(cfg.configFile), a.route, a.name);
+          if (!existsSync46(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync46(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync20(resolvePath(dir, r));
             } catch {
@@ -25457,7 +25617,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync40(resolvePath(dir, r), "utf8");
+              return readFileSync41(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -25499,19 +25659,19 @@ ${cu.tail.trimEnd()}
           let cleared;
           if (clear2) {
             const plan = clearRouteHooks(configText, a.route, a.name);
-            if (plan.removed.length > 0) writeFileSync33(cfg.configFile, plan.text);
+            if (plan.removed.length > 0) writeFileSync34(cfg.configFile, plan.text);
             cleared = { file: cfg.configFile, removed: plan.removed };
           }
           if (write && suggestion.source === null && recipeIds.length === 0 && hookSpecs.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, picked.hooks, { replace: flag("replace") });
-            writeFileSync33(cfg.configFile, plan.text);
+            writeFileSync34(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept, replaced: plan.replaced };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync33(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            writeFileSync34(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [], replaced: [] };
           }
           if (flag("json")) {
@@ -25567,7 +25727,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync45(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync46(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -25597,7 +25757,7 @@ ${cu.tail.trimEnd()}
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       if (sub === "list" || sub === "add") {
         const liveRoute = cfg.routes.find((r) => r.route === routeName);
-        if (liveRoute?.resolved?.reposModelId && existsSync45(resolvedFile) && !dryRun) {
+        if (liveRoute?.resolved?.reposModelId && existsSync46(resolvedFile) && !dryRun) {
           try {
             await hydrateApiKeys([liveRoute]);
             persistRepoRows(cfg.ship.stateDir, liveRoute.route, await new Tracker(liveRoute, cfg.ship).repoRowsForMap());
@@ -25606,16 +25766,16 @@ ${cu.tail.trimEnd()}
         }
       }
       let resolvedRemotes;
-      if (existsSync45(resolvedFile)) {
+      if (existsSync46(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync40(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync41(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text2 = configText;
-      const base = dirname28(cfg.configFile);
-      const isCheckout = (d) => existsSync45(`${d}/.git`);
+      const base = dirname29(cfg.configFile);
+      const isCheckout = (d) => existsSync46(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -25625,11 +25785,11 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync45(d),
+              exists: (d) => existsSync46(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
-                  return Object.keys(parseRepoConfig(readFileSync40(resolvePath(d, f), "utf8"), f).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync41(resolvePath(d, f), "utf8"), f).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -25646,7 +25806,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync45(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync46(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -25658,9 +25818,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text: text2, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync45(plan2.target) && (existsSync45(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
+          if (existsSync46(plan2.target) && (existsSync46(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync45(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync46(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -25678,14 +25838,14 @@ ${cu.tail.trimEnd()}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync33(cfg.configFile, plan2.text);
+          writeFileSync34(cfg.configFile, plan2.text);
           if (plan2.droppedDir) process.stderr.write(`crew repos: dropped dir: ${plan2.droppedDir} from route ${routeName} \u2014 it is not a checkout (the clone base); checkouts now live under repos:
 `);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir11()));
-        const top = existsSync45(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync46(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -25737,15 +25897,15 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync45(resolvedFile)) {
-            const raw = JSON.parse(readFileSync40(resolvedFile, "utf8"));
+          if (existsSync46(resolvedFile)) {
+            const raw = JSON.parse(readFileSync41(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync33(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync34(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync33(cfg.configFile, plan.text);
+        writeFileSync34(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -26114,7 +26274,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync33(cfg.configFile, setShipNameInYaml(readFileSync40(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync34(cfg.configFile, setShipNameInYaml(readFileSync41(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -26157,10 +26317,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync45(resolvedPath);
+        const hadPreviousFile = existsSync46(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync40(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync41(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -26290,10 +26450,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync32(dirname28(resolvedPath), { recursive: true });
+          mkdirSync33(dirname29(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync33(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync34(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync6(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -26327,7 +26487,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         let apiKeyFile;
         const apiKeyVar = "CREW_API_KEY";
-        if (firstRunFromFlags && agentBinSearched && !dryRun) {
+        if (firstRunFromFlags && agentBinSearched && !dryRun && !isManagedShipKind(value("ship-kind"))) {
           const msg = `no agent binary: "claude" was not found on PATH or in ${agentBinSearched.join(", ")} \u2014 pass --agent-bin /absolute/path`;
           process.stderr.write(`crew connect: ${msg}
 `);
@@ -26339,8 +26499,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync32(dirname28(apiKeyFile), { recursive: true });
-            writeFileSync33(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync33(dirname29(apiKeyFile), { recursive: true });
+            writeFileSync34(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -27067,7 +27227,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           };
           if (subP === "list") {
             const entries = periscopeListEntries(
-              (await Promise.all(routesP.map(gather))).flat(),
+              (await Promise.all(routesP.map(gather))).flat().map((r) => ({ ...r, pointedAt: readPointedAt(r.worktree) })),
               /* @__PURE__ */ new Date(),
               (r) => pidsInWorktree(r.worktree, Number(r.number)).length > 0
             );
@@ -27215,7 +27375,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync45(p),
+            worktreeExists: (p) => existsSync46(p),
+            prepareDropFile,
             caps: periscopeCaps(cfg.ship),
             runHook: async (name, cwd, env) => {
               const script = hit?.repo.config.hooks[name];
@@ -27309,10 +27470,10 @@ ${where.join("\n")}`);
           },
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
-              const src = join49(repoP.dir, f);
-              if (!existsSync45(src)) continue;
-              mkdirSync32(dirOf2(join49(path, f)), { recursive: true });
-              copyFileSync2(src, join49(path, f));
+              const src = join50(repoP.dir, f);
+              if (!existsSync46(src)) continue;
+              mkdirSync33(dirOf2(join50(path, f)), { recursive: true });
+              copyFileSync2(src, join50(path, f));
             }
             const setup = repoP.config.hooks.setup;
             return setup ? runScript(setup, { cwd: path, shell: shellP, onLine: (l) => {
@@ -27324,6 +27485,7 @@ ${where.join("\n")}`);
             return script ? runScript(script, { cwd, env, shell: shellP, timeoutMs: name === "preview" ? 18e4 : void 0 }) : null;
           },
           createRow: (fields) => trackerP.createPeriscope(fields),
+          prepareDropFile,
           recordLocal: (sc) => {
             writePeriscopeSidecar(cfg.ship.stateDir, { ...sc, route: routeP.route });
             if (flag("serve-mcp")) mintPeriscopeSecret(cfg.ship.stateDir, sc.ticketRecordId);
@@ -27607,7 +27769,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync40(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync41(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -27660,8 +27822,8 @@ ${where.join("\n")}`);
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync32(cfg.ship.stateDir, { recursive: true });
-      writeFileSync33(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync33(cfg.ship.stateDir, { recursive: true });
+      writeFileSync34(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write(
         "crew reload: requested \u2014 the daemon relaunches with the new config once its running agents end (it starts no new work meanwhile); if it is busy, `crew reload --now` forces the relaunch and interrupts them\n"
@@ -27726,7 +27888,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text2 = readFileSync40(cfg.ship.logFile, "utf8").split("\n");
+        const text2 = readFileSync41(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text2.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -27749,8 +27911,8 @@ ${where.join("\n")}`);
       };
       if (!route2.resolved) fail(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
-      const configText = readFileSync40(cfg.configFile, "utf8");
-      const cfgBase = dirname28(cfg.configFile);
+      const configText = readFileSync41(cfg.configFile, "utf8");
+      const cfgBase = dirname29(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route2.route);
@@ -27778,7 +27940,7 @@ ${where.join("\n")}`);
         }
         if (configured2.some((r) => r.dir === dir)) {
           try {
-            writeFileSync33(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
+            writeFileSync34(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -27786,29 +27948,29 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync45(resolvedFile)) {
-            const raw = JSON.parse(readFileSync40(resolvedFile, "utf8"));
+          if (existsSync46(resolvedFile)) {
+            const raw = JSON.parse(readFileSync41(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync33(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync34(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync45(join49(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync23(dir, { recursive: true, force: true });
+        if (existsSync46(join50(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync23(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync45(join49(dir, ".git"));
-      if (existsSync45(dir) && fresh && readdirSync20(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync46(join50(dir, ".git"));
+      if (existsSync46(dir) && fresh && readdirSync20(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync32(dir, { recursive: true });
-        writeFileSync33(join49(dir, "README.md"), SAMPLE_README);
-        writeFileSync33(join49(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync33(dir, { recursive: true });
+        writeFileSync34(join50(dir, "README.md"), SAMPLE_README);
+        writeFileSync34(join50(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync10("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -27826,17 +27988,17 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync45(resolvedFile)) {
-          const raw = JSON.parse(readFileSync40(resolvedFile, "utf8"));
+        if (existsSync46(resolvedFile)) {
+          const raw = JSON.parse(readFileSync41(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync33(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync34(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured2.some((r) => r.dir === dir)) {
         try {
-          writeFileSync33(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync34(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -28182,7 +28344,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync45(r.dir)) {
+            if (existsSync46(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -28234,6 +28396,9 @@ watermark:  ${state.watermark()}
           }
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
+        if (!flag("offline")) {
+          for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -28268,7 +28433,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync45(evFile) ? statSync15(evFile).size : 0;
+        const evSize = existsSync46(evFile) ? statSync16(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -28279,7 +28444,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run", installContext());
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync40(p, "utf8");
+            return readFileSync41(p, "utf8");
           } catch {
             return null;
           }
@@ -28302,7 +28467,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const changed2 = configChangedAfter(daemonConfigPaths(cfg), daemonStartedAt);
         if (changed2) {
           process.stdout.write(
-            `daemon config:     WARN ${changed2} changed at ${new Date(statSync15(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
+            `daemon config:     WARN ${changed2} changed at ${new Date(statSync16(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
 `
           );
         }
@@ -28472,6 +28637,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "none"}
 `
           );
+          for (const w of managedRuntimeWarnings(row.kind, cfg.ship)) process.stdout.write(`managed runtime:  WARN ${w}
+`);
         }
       }
       {