@tablation/crew 0.118.0 → 0.119.0

package/dist/cli.js

@@ -2547,7 +2547,8 @@ var TOP_LEVEL = /* @__PURE__ */ new Set([
   "hooks",
   "labels",
   "release",
-  "sandbox"
+  "sandbox",
+  "periscope"
 ]);
 var BRANCH_KEYS = /* @__PURE__ */ new Set(["base", "name", "push", "remote", "lowercase"]);
 var PLACEHOLDER = /\{(key|number|slug|role|prefix|tag|issue)\}/g;
@@ -2668,6 +2669,7 @@ function parseRepoConfig(text2, file) {
   rejectUnknown(raw.release?.isolateFailures, ISOLATE_KEYS, "release.isolateFailures", file);
   rejectUnknown(raw.branch, BRANCH_KEYS, "branch", file);
   rejectUnknown(raw.worktrees, /* @__PURE__ */ new Set(["copy", "prefix", "name"]), "worktrees", file);
+  rejectUnknown(raw.periscope, /* @__PURE__ */ new Set(["inspector"]), "periscope", file);
   rejectUnknown(raw.docs, /* @__PURE__ */ new Set(["triagePolicy", "designGuide"]), "docs", file);
   rejectUnknown(raw.sandbox, /* @__PURE__ */ new Set(["image", "packages", "setup", "warm", "hosts", "toolchains"]), "sandbox", file);
   const sandboxNetwork = parseSandboxNetwork(raw.sandbox, file, (m) => new RepoConfigError(m));
@@ -2851,10 +2853,15 @@ function parseRepoConfig(text2, file) {
   if (versionFiles.length === 0) {
     throw new RepoConfigError(`${file}: release.versionFiles cannot be empty`);
   }
+  const inspectorRaw = raw.periscope?.inspector;
+  if (inspectorRaw !== void 0 && inspectorRaw !== "proxy" && inspectorRaw !== "repo") {
+    throw new RepoConfigError(`${file}: periscope.inspector must be "proxy" or "repo"`);
+  }
   return {
     version: SPEC_VERSION,
     branch,
     worktrees: worktrees2,
+    ...inspectorRaw ? { periscope: { inspector: inspectorRaw } } : {},
     docs,
     ...sandbox ? { sandbox } : {},
     platform: platform2,
@@ -8698,12 +8705,14 @@ function listeners() {
   return out;
 }
 var pidsOnPort = (port) => listeners().filter((l) => l.port === port).map((l) => l.pid);
-var DEFAULT_PORTS = { backendBase: 3e4, frontendBase: 4e4, span: 1e3 };
+var DEFAULT_PORTS = { backendBase: 3e4, frontendBase: 4e4, proxyBase: 5e4, span: 1e3 };
 function ticketForPort(port, s = DEFAULT_PORTS) {
   if (port >= s.backendBase && port < s.backendBase + s.span) return { n: port - s.backendBase, role: "backend" };
   if (port >= s.frontendBase && port < s.frontendBase + s.span) return { n: port - s.frontendBase, role: "frontend" };
+  if (s.proxyBase !== void 0 && port >= s.proxyBase && port < s.proxyBase + s.span) return { n: port - s.proxyBase, role: "proxy" };
   return null;
 }
+var proxyPortFor = (n, s = DEFAULT_PORTS) => (s.proxyBase ?? DEFAULT_PORTS.proxyBase) + n;
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
     if (existsSync18(join19(parent, name, ".git"))) return true;
@@ -8739,7 +8748,7 @@ async function killGently(pids, graceMs = 2e3) {
 }
 function pidsInWorktree(path, n, s = DEFAULT_PORTS) {
   const pids = /* @__PURE__ */ new Set();
-  for (const port of [s.backendBase + n, s.frontendBase + n]) for (const p of pidsOnPort(port)) pids.add(p);
+  for (const port of [s.backendBase + n, s.frontendBase + n, ...s.proxyBase !== void 0 ? [s.proxyBase + n] : []]) for (const p of pidsOnPort(port)) pids.add(p);
   const matched = run("pgrep", ["-f", `${path}/`]);
   for (const line of matched.split("\n")) {
     const pid = Number(line.trim());
@@ -12773,7 +12782,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve7, dirname as dirname30, join as join51, basename as basename16 } from "path";
+import { resolve as resolve7, dirname as dirname31, join as join51, basename as basename16 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname4, homedir as homedir11 } from "os";
 import { spawnSync as spawnSync10 } from "child_process";
@@ -20424,7 +20433,7 @@ function warnOrphanedWorktreeDirs(paths, log, held) {
 }
 async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin", base, held) {
   const refused = [];
-  const refuse = (a, reason, detail) => {
+  const refuse2 = (a, reason, detail) => {
     refused.push(a.path);
     const when = held ? noteHeldWorktree(held.state, { repo: held.repo, path: a.path, ticket: a.ticket.issue_id, status: a.ticket.status, reason }) : "first";
     if (when) {
@@ -20452,12 +20461,12 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
       } catch {
       }
       if (dirty) {
-        refuse(a, "uncommitted changes", "it has uncommitted changes");
+        refuse2(a, "uncommitted changes", "it has uncommitted changes");
         continue;
       }
     }
     if (!dryRun && a.requirePushed && a.branch && existsSync39(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
-      refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
+      refuse2(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
     const n = Number(a.ticket.issue_id.replace(/^\D+/, ""));
@@ -20481,7 +20490,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
     try {
       git(cwd, ["worktree", "remove", "--force", a.path]);
     } catch (e) {
-      refuse(a, "removal failed", `could not remove it: ${e.message}`);
+      refuse2(a, "removal failed", `could not remove it: ${e.message}`);
       continue;
     }
     if (!a.keepBranch && a.branch) {
@@ -20655,7 +20664,7 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync42, existsSync as existsSync47, mkdirSync as mkdirSync34, writeFileSync as writeFileSync35, rmSync as rmSync23, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync42, existsSync as existsSync47, mkdirSync as mkdirSync35, writeFileSync as writeFileSync35, rmSync as rmSync23, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
@@ -20861,9 +20870,18 @@ ${tail(handoff.output)}`);
     return abandon(`preview exited ${preview?.code ?? "without running"}
 ${tail(preview?.output ?? "")}`);
   }
-  const url = previewUrlFrom(preview.output);
-  if (!url) return abandon(`preview printed no URL as its last line
+  const previewUrl = previewUrlFrom(preview.output);
+  if (!previewUrl) return abandon(`preview printed no URL as its last line
 ${tail(preview.output)}`);
+  let url = previewUrl;
+  if (d.startProxy) {
+    try {
+      url = await d.startProxy(wt.path, previewUrl, /(\d+)$/.exec(draft.issueId)?.[1] ?? "0");
+    } catch (e) {
+      return abandon(`starting the periscope proxy failed: ${e.message}`);
+    }
+    d.say("proxy", `proxy at ${url} in front of ${previewUrl}`, { url, previewUrl });
+  }
   d.say("preview", `preview at ${url}`, { url });
   const intel = await probeIntel(
     { runHook: (e) => d.runHook("intel", wt.path, e) },
@@ -21052,10 +21070,17 @@ ${section}`;
   forgetLocal(d, row.ticketRecordId);
   return { ticket: row.ticket, mode: "keep", outcome: "done", state: "kept", sha: pushed.sha, ...existing ? { existing: true, ...prior ? { status: prior.status } : {} } : {} };
 }
+function isProxyUrl(url, number) {
+  try {
+    return Number(new URL(url).port) === proxyPortFor(Number(number));
+  } catch {
+    return false;
+  }
+}
 function periscopeListEntries(rows, now, isListening) {
   return rows.filter((r) => r.state === "live").map((r) => {
     const at = r.lastActivityAt ? new Date(r.lastActivityAt).getTime() : NaN;
-    return { ...r, idleMinutes: Number.isNaN(at) ? null : Math.max(0, Math.floor((now.getTime() - at) / 6e4)), listening: isListening(r) };
+    return { ...r, idleMinutes: Number.isNaN(at) ? null : Math.max(0, Math.floor((now.getTime() - at) / 6e4)), listening: isListening(r), proxied: isProxyUrl(r.url, r.number) };
   });
 }
 function formatPeriscopeList(entries) {
@@ -21064,7 +21089,7 @@ function formatPeriscopeList(entries) {
     e.ticket,
     e.repo,
     e.worktree,
-    e.url,
+    e.proxied ? `${e.url} (proxy)` : e.url,
     e.state,
     e.idleMinutes === null ? "idle ?" : `idle ${e.idleMinutes} min`,
     e.listening ? "listening" : "not listening"
@@ -21096,9 +21121,16 @@ ${tail2(iso.output)}`);
     throw new PeriscopeError(`preview exited ${preview?.code ?? "without running"}
 ${tail2(preview?.output ?? "")}`);
   }
-  const url = previewUrlFrom(preview.output);
+  let url = previewUrlFrom(preview.output);
   if (!url) throw new PeriscopeError(`preview printed no URL as its last line
 ${tail2(preview.output)}`);
+  if (d.startProxy) {
+    try {
+      url = await d.startProxy(row.worktree, url, /(\d+)$/.exec(tag)?.[1] ?? "0");
+    } catch (e) {
+      throw new PeriscopeError(`starting the periscope proxy failed: ${e.message}`);
+    }
+  }
   const now = d.now();
   await d.update(row.id, {
     url,
@@ -21634,6 +21666,388 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
   return endpoints;
 }
 
+// src/periscope-proxy.ts
+import { spawn as spawn9 } from "child_process";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync32 } from "fs";
+import { createServer, request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { connect as netConnect } from "net";
+import { connect as tlsConnect } from "tls";
+import { dirname as dirname28, isAbsolute as isAbsolute4 } from "path";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "zlib";
+
+// src/periscope-inspector.ts
+var INSPECTOR_ROUTE = "/__periscope/inspector.js";
+var POINTED_ROUTE = "/__periscope/pointed";
+var INSPECTOR_SOURCE = `
+const ROUTE = ${JSON.stringify(POINTED_ROUTE)};
+let armed = false;
+let off = false;
+let current = null;
+let toast = null;
+const outline = document.createElement('div');
+const label = document.createElement('div');
+Object.assign(outline.style, { position: 'fixed', zIndex: '2147483646', pointerEvents: 'none', outline: '2px solid #e11d8f', outlineOffset: '-1px', display: 'none' });
+Object.assign(label.style, { position: 'fixed', zIndex: '2147483647', pointerEvents: 'none', font: '11px/1.3 ui-monospace, monospace', background: '#1f1f23', color: '#fff', padding: '2px 6px', borderRadius: '3px', display: 'none', maxWidth: '60vw', whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' });
+document.documentElement.append(outline, label);
+
+function componentName(el) {
+  const key = Object.keys(el).find((k) => k.startsWith('__reactFiber$'));
+  let fiber = key ? el[key] : null;
+  while (fiber) {
+    const t = fiber.type;
+    if (typeof t === 'function' || (t && typeof t === 'object')) {
+      const n = (typeof t === 'function' ? t.displayName || t.name : t.displayName || (t.render && (t.render.displayName || t.render.name)) || (t.type && (t.type.displayName || t.type.name)));
+      if (n) return n;
+    }
+    fiber = fiber.return;
+  }
+  return undefined;
+}
+
+function hide() {
+  current = null;
+  outline.style.display = 'none';
+  label.style.display = 'none';
+}
+
+function sync() {
+  if (!armed || off) { hide(); document.documentElement.style.cursor = ''; return; }
+  document.documentElement.style.cursor = 'crosshair';
+}
+
+function show(el) {
+  current = el;
+  const r = el.getBoundingClientRect();
+  Object.assign(outline.style, { display: 'block', left: r.left + 'px', top: r.top + 'px', width: r.width + 'px', height: r.height + 'px' });
+  label.textContent = el.getAttribute('data-source') + (componentName(el) ? '  <' + componentName(el) + '>' : '');
+  label.style.display = 'block';
+  label.style.left = Math.max(0, r.left) + 'px';
+  label.style.top = (r.top > 20 ? r.top - 20 : r.bottom + 2) + 'px';
+}
+
+function flash(text) {
+  if (toast) toast.remove();
+  toast = document.createElement('div');
+  toast.textContent = text;
+  Object.assign(toast.style, { position: 'fixed', zIndex: '2147483647', right: '12px', bottom: '12px', font: '12px ui-monospace, monospace', background: '#1f1f23', color: '#fff', padding: '6px 10px', borderRadius: '4px', pointerEvents: 'none' });
+  document.documentElement.append(toast);
+  setTimeout(() => { if (toast) { toast.remove(); toast = null; } }, 1500);
+}
+
+window.addEventListener('keydown', (e) => {
+  if (e.key === 'Alt') { armed = true; off = false; sync(); }
+  else if (e.key === 'Escape' && armed) { off = true; sync(); }
+}, true);
+window.addEventListener('keyup', (e) => { if (e.key === 'Alt') { armed = false; off = false; sync(); } }, true);
+window.addEventListener('blur', () => { armed = false; off = false; sync(); });
+
+window.addEventListener('mousemove', (e) => {
+  if (!armed || off) return;
+  const target = e.target instanceof Element ? e.target.closest('[data-source]') : null;
+  if (target) show(target); else hide();
+}, true);
+
+window.addEventListener('click', (e) => {
+  if (!armed || off || !current) return;
+  e.preventDefault();
+  e.stopPropagation();
+  const src = current.getAttribute('data-source');
+  const i = src.lastIndexOf(':');
+  const entry = { path: src.slice(0, i), line: Number(src.slice(i + 1)), component: componentName(current), url: location.href };
+  fetch(ROUTE, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(entry) })
+    .then((r) => { if (!r.ok) throw new Error(String(r.status)); })
+    .catch(() => flash('point failed'));
+  if (navigator.clipboard) navigator.clipboard.writeText(src).catch(() => {});
+  flash('pointed at ' + src);
+}, true);
+`;
+
+// src/periscope-proxy.ts
+var MAX_BODY_BYTES = 8 * 1024;
+var SCRIPT_TAG = `<script type="module" src="${INSPECTOR_ROUTE}"></script>`;
+function parsePointedBody(raw) {
+  let body;
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!body || typeof body !== "object") return null;
+  const b = body;
+  const p = b.path;
+  const line = b.line;
+  if (typeof p !== "string" || p.length === 0 || p.length > 500) return null;
+  if (isAbsolute4(p) || p.split(/[\\/]/).includes("..")) return null;
+  if (typeof line !== "number" || !Number.isInteger(line) || line < 1) return null;
+  const entry = { path: p, line };
+  if (typeof b.column === "number" && Number.isInteger(b.column) && b.column >= 0) entry.column = b.column;
+  if (typeof b.component === "string" && b.component.length <= 200) entry.component = b.component;
+  if (typeof b.url === "string") entry.url = b.url.slice(0, 2e3);
+  return entry;
+}
+function appendPointed(file, entry, now = /* @__PURE__ */ new Date()) {
+  mkdirSync32(dirname28(file), { recursive: true });
+  appendFileSync3(file, `${JSON.stringify({ ...entry, at: now.toISOString() })}
+`);
+}
+var CSP_DIRECTIVES = /* @__PURE__ */ new Set(["default-src", "script-src", "script-src-elem", "connect-src"]);
+function relaxCsp(policy) {
+  return policy.split(";").map((part) => {
+    const tokens = part.trim().split(/\s+/).filter(Boolean);
+    const name = tokens[0]?.toLowerCase();
+    if (!name || !CSP_DIRECTIVES.has(name)) return part.trim();
+    const sources = tokens.slice(1).filter((t) => t.toLowerCase() !== "'none'");
+    if (!sources.some((t) => t.toLowerCase() === "'self'")) sources.push("'self'");
+    return [tokens[0], ...sources].join(" ");
+  }).filter(Boolean).join("; ");
+}
+function injectScript(html) {
+  const i = html.search(/<\/body\s*>(?![\s\S]*<\/body\s*>)/i);
+  return i === -1 ? html + SCRIPT_TAG : html.slice(0, i) + SCRIPT_TAG + html.slice(i);
+}
+function decode(body, encoding) {
+  switch ((encoding ?? "").toLowerCase().trim()) {
+    case "":
+    case "identity":
+      return body;
+    case "gzip":
+    case "x-gzip":
+      return gunzipSync(body);
+    case "deflate":
+      return inflateSync(body);
+    case "br":
+      return brotliDecompressSync(body);
+    default:
+      return void 0;
+  }
+}
+function forwardHeaders(req, target) {
+  const h = { ...req.headers, host: target.host };
+  if (typeof h.origin === "string") h.origin = target.origin;
+  if (typeof h.referer === "string") {
+    try {
+      const r = new URL(h.referer);
+      h.referer = `${target.origin}${r.pathname}${r.search}`;
+    } catch {
+    }
+  }
+  return h;
+}
+function refuse(res, status2, headers = {}) {
+  res.writeHead(status2, headers);
+  res.end();
+}
+function handlePointed(req, res, o) {
+  if (req.method !== "POST") return refuse(res, 405, { Allow: "POST" });
+  const chunks = [];
+  let size = 0;
+  let aborted = false;
+  req.on("data", (c) => {
+    size += c.length;
+    if (size > MAX_BODY_BYTES) {
+      aborted = true;
+      refuse(res, 413);
+      req.destroy();
+      return;
+    }
+    chunks.push(c);
+  });
+  req.on("end", () => {
+    if (aborted) return;
+    const entry = parsePointedBody(Buffer.concat(chunks).toString("utf8"));
+    if (!entry) return refuse(res, 400);
+    try {
+      appendPointed(o.dropFile, entry, o.now?.());
+      refuse(res, 204);
+    } catch {
+      refuse(res, 500);
+    }
+  });
+}
+function proxyRequest(req, res, o) {
+  const { target } = o;
+  const secure = target.protocol === "https:";
+  const upstream = (secure ? httpsRequest : httpRequest)({
+    hostname: target.hostname,
+    port: target.port || (secure ? 443 : 80),
+    method: req.method,
+    path: req.url,
+    headers: forwardHeaders(req, target)
+  }, (up) => {
+    const headers = { ...up.headers };
+    if (typeof headers.location === "string" && headers.location.startsWith(target.origin)) {
+      headers.location = headers.location.slice(target.origin.length) || "/";
+    }
+    const csp = headers["content-security-policy"];
+    if (o.inject && typeof csp === "string") headers["content-security-policy"] = relaxCsp(csp);
+    const isHtml = /^text\/html\b/i.test(String(up.headers["content-type"] ?? ""));
+    if (!o.inject || !isHtml || req.method === "HEAD") {
+      res.writeHead(up.statusCode ?? 502, headers);
+      up.pipe(res);
+      return;
+    }
+    const chunks = [];
+    up.on("data", (c) => chunks.push(c));
+    up.on("end", () => {
+      let html;
+      try {
+        html = decode(Buffer.concat(chunks), String(up.headers["content-encoding"] ?? ""));
+      } catch {
+        html = void 0;
+      }
+      if (!html) {
+        res.writeHead(up.statusCode ?? 502, headers);
+        res.end(Buffer.concat(chunks));
+        return;
+      }
+      const out = Buffer.from(injectScript(html.toString("utf8")), "utf8");
+      delete headers["content-encoding"];
+      delete headers.etag;
+      delete headers["transfer-encoding"];
+      headers["content-length"] = String(out.length);
+      res.writeHead(up.statusCode ?? 502, headers);
+      res.end(out);
+    });
+    up.on("error", () => res.destroy());
+  });
+  upstream.on("error", (e) => {
+    if (res.headersSent) {
+      res.destroy();
+      return;
+    }
+    res.writeHead(502, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end(`periscope proxy: ${target.origin} is not answering (${e.message})
+`);
+  });
+  req.pipe(upstream);
+}
+function proxyUpgrade(req, client2, head, o) {
+  const { target } = o;
+  const secure = target.protocol === "https:";
+  const port = Number(target.port) || (secure ? 443 : 80);
+  const up = secure ? tlsConnect({ host: target.hostname, port, servername: target.hostname }) : netConnect({ host: target.hostname, port });
+  up.on("error", () => client2.destroy());
+  client2.on("error", () => up.destroy());
+  const hangUp = () => {
+    up.destroy();
+    client2.destroy();
+  };
+  client2.on("end", hangUp);
+  client2.on("close", hangUp);
+  up.on("end", hangUp);
+  up.on("close", hangUp);
+  up.on(secure ? "secureConnect" : "connect", () => {
+    const headers = forwardHeaders(req, target);
+    const lines2 = [`${req.method} ${req.url} HTTP/${req.httpVersion}`];
+    for (const [k, v] of Object.entries(headers)) {
+      if (v === void 0) continue;
+      for (const one of Array.isArray(v) ? v : [v]) lines2.push(`${k}: ${one}`);
+    }
+    up.write(`${lines2.join("\r\n")}\r
+\r
+`);
+    if (head.length) up.write(head);
+    up.pipe(client2);
+    client2.pipe(up);
+  });
+}
+function createPeriscopeProxy(o) {
+  const server = createServer(async (req, res) => {
+    try {
+      if (o.requestFilter && !await o.requestFilter(req, res)) return;
+      const path = (req.url ?? "/").split("?")[0];
+      if (o.inject && path === INSPECTOR_ROUTE && (req.method === "GET" || req.method === "HEAD")) {
+        res.writeHead(200, { "Content-Type": "text/javascript; charset=utf-8", "Cache-Control": "no-store" });
+        res.end(req.method === "HEAD" ? void 0 : INSPECTOR_SOURCE);
+        return;
+      }
+      if (o.inject && path === POINTED_ROUTE) return handlePointed(req, res, o);
+      proxyRequest(req, res, o);
+    } catch {
+      if (!res.headersSent) refuse(res, 500);
+      else res.destroy();
+    }
+  });
+  server.on("upgrade", async (req, socket, head) => {
+    try {
+      if (o.requestFilter && !await o.requestFilter(req, socket)) return;
+      proxyUpgrade(req, socket, head, o);
+    } catch {
+      socket.destroy();
+    }
+  });
+  return server;
+}
+function proxyEnv(l) {
+  return {
+    CREW_PROXY_TARGET: l.target,
+    CREW_PROXY_HOST: l.host,
+    CREW_PROXY_PORT: String(l.port),
+    CREW_PROXY_INJECT: l.inject ? "1" : "0"
+  };
+}
+function proxiedUrl(previewUrl, host, port) {
+  const u = new URL(previewUrl);
+  return `http://${host.includes(":") ? `[${host}]` : host}:${port}${u.pathname === "/" && !u.search ? "/" : u.pathname}${u.search}`;
+}
+function runProxyFromEnv(dropFile, env = process.env) {
+  const target = env.CREW_PROXY_TARGET;
+  const port = Number(env.CREW_PROXY_PORT);
+  if (!target || !Number.isInteger(port) || port <= 0) throw new Error("periscope-proxy: CREW_PROXY_TARGET and CREW_PROXY_PORT are required");
+  const server = createPeriscopeProxy({ target: new URL(target), dropFile, inject: env.CREW_PROXY_INJECT !== "0" });
+  server.on("error", (e) => {
+    process.stderr.write(`periscope-proxy: ${e.message}
+`);
+    process.exit(1);
+  });
+  server.listen(port, env.CREW_PROXY_HOST || "localhost");
+  return server;
+}
+function accepts(host, port, timeoutMs = 500) {
+  return new Promise((resolve8) => {
+    const s = netConnect({ host, port });
+    const done = (ok) => {
+      s.destroy();
+      resolve8(ok);
+    };
+    s.setTimeout(timeoutMs, () => done(false));
+    s.once("connect", () => done(true));
+    s.once("error", () => done(false));
+  });
+}
+async function launchProxy(invocation, worktree, previewUrl, number, o) {
+  const port = proxyPortFor(number);
+  const stale = pidsOnPort(port);
+  if (stale.length) await killGently(stale);
+  const launch = { worktree, target: previewUrl, host: o.host, port, inject: o.inject };
+  const [cmd, ...args] = invocation;
+  const child = spawn9(cmd, [...args, "periscope-proxy", pointedAtFile(worktree)], {
+    detached: true,
+    stdio: "ignore",
+    cwd: worktree,
+    env: { ...process.env, ...proxyEnv(launch) }
+  });
+  child.unref();
+  let exited = false;
+  child.on("exit", () => {
+    exited = true;
+  });
+  const deadline = Date.now() + (o.waitMs ?? 1e4);
+  while (Date.now() < deadline) {
+    if (exited) throw new Error(`the proxy process exited before listening on ${o.host}:${port}`);
+    if (await accepts(o.host, port)) return proxiedUrl(previewUrl, o.host, port);
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  if (child.pid) {
+    try {
+      process.kill(child.pid, "SIGTERM");
+    } catch {
+    }
+  }
+  throw new Error(`the proxy did not start listening on ${o.host}:${port}`);
+}
+
 // src/outage.ts
 var TRANSIENT_BACKOFF_MS = [15e3, 3e4, 6e4];
 var OUTAGE_ESCALATE_AFTER = 5;
@@ -21666,7 +22080,7 @@ function describeCause(err3) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync44, mkdirSync as mkdirSync32, readFileSync as readFileSync40, readdirSync as readdirSync17, rmSync as rmSync20, statSync as statSync14, writeFileSync as writeFileSync33 } from "fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync33, readFileSync as readFileSync40, readdirSync as readdirSync17, rmSync as rmSync20, statSync as statSync14, writeFileSync as writeFileSync33 } from "fs";
 import { join as join47 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -21780,7 +22194,7 @@ function daemonStampFor(stateDir) {
   return join47(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync32(stateDir, { recursive: true });
+  mkdirSync33(stateDir, { recursive: true });
   rmSync20(reloadSentinelFor(stateDir), { force: true });
   writeFileSync33(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
@@ -21852,7 +22266,7 @@ async function runOnePassUnguarded(o) {
   await hydrateApiKeys([o.route], o.getSessionStore);
   const emit = o.newEmitter();
   const decide = o.decide ?? decideCycle;
-  const spawn11 = o.spawnRoleAgent ?? runRoleAgent;
+  const spawn12 = o.spawnRoleAgent ?? runRoleAgent;
   const breaker = o.spawnBreaker ?? new SpawnBreaker();
   const ctx = { route: o.route, ship: o.ship, state: o.state, emit, getSessionStore: o.getSessionStore };
   if (o.sandboxCache) {
@@ -21963,7 +22377,7 @@ async function runOnePassUnguarded(o) {
         settle = resolve8;
       });
       const ready = (tookTicket2) => settle(tookTicket2);
-      const run3 = spawn11(role, decision, ctx, { ready }).then(() => {
+      const run3 = spawn12(role, decision, ctx, { ready }).then(() => {
         breaker.recordSuccess(role);
         clearShipAttention(o.state, `role_parked:${role}`);
         clearShipAttention(o.state, workspaceAuthKey(role));
@@ -22363,12 +22777,12 @@ import {
   watch
 } from "fs";
 import { createConnection } from "net";
-import { createServer } from "http";
-import { basename as basename14, dirname as dirname28, join as join48 } from "path";
-import { execFile as execFile3, spawn as spawn10 } from "child_process";
+import { createServer as createServer2 } from "http";
+import { basename as basename14, dirname as dirname29, join as join48 } from "path";
+import { execFile as execFile3, spawn as spawn11 } from "child_process";
 
 // src/periscope-control.ts
-import { spawn as spawn9 } from "child_process";
+import { spawn as spawn10 } from "child_process";
 var reply = (status2, body) => ({ status: status2, body });
 var err = (status2, message) => reply(status2, { error: message });
 var TICKET_RE = /^(?:[A-Za-z]+-)?\d+$/;
@@ -22559,7 +22973,7 @@ async function handlePeriscopes(h, q2) {
 }
 function runCrew(args, onLine, timeoutMs = 20 * 6e4) {
   return new Promise((resolve8) => {
-    const child = spawn9(process.execPath, [process.argv[1] ?? "", ...args], { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn10(process.execPath, [process.argv[1] ?? "", ...args], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     let pending = "";
@@ -22598,7 +23012,7 @@ var MAX_SOCKET_PATH = 100;
 var MAX_TAIL_BYTES = 1024 * 1024;
 var MAX_WAIT_SECONDS = 30;
 var DEFAULT_TAIL_LINES = 100;
-var MAX_BODY_BYTES = 4096;
+var MAX_BODY_BYTES2 = 4096;
 var ControlAuth = class {
   cache = /* @__PURE__ */ new Map();
   o;
@@ -22680,7 +23094,7 @@ function candidates(live, rotated) {
   const out = [live];
   if (!rotated) return out;
   try {
-    for (const n of readdirSync18(dirname28(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join48(dirname28(live), n));
+    for (const n of readdirSync18(dirname29(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join48(dirname29(live), n));
   } catch {
   }
   return out;
@@ -22819,7 +23233,7 @@ async function readJsonBody(req) {
   let n = 0;
   for await (const c of req) {
     n += c.length;
-    if (n > MAX_BODY_BYTES) return null;
+    if (n > MAX_BODY_BYTES2) return null;
     chunks.push(c);
   }
   if (!n) return {};
@@ -22840,7 +23254,7 @@ async function tailReply(path, q2, rotated, abort) {
   const deadline = Date.now() + Math.min(wait, MAX_WAIT_SECONDS) * 1e3;
   let r = readTail(path, { after, tail: tail3, rotated });
   while (after && !r.lines.length && !r.reset && Date.now() < deadline && !abort.aborted) {
-    await waitForChange(dirname28(path), deadline - Date.now(), abort);
+    await waitForChange(dirname29(path), deadline - Date.now(), abort);
     r = readTail(path, { after: r.cursor, rotated });
   }
   return reply2(200, r);
@@ -22948,7 +23362,7 @@ async function startControlServer(deps) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
-  const server = createServer((req, res) => {
+  const server = createServer2((req, res) => {
     const abort = new AbortController();
     res.on("close", () => abort.abort());
     void (async () => {
@@ -22999,7 +23413,7 @@ async function startControlServer(deps) {
   });
 }
 var shq2 = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-function runDetached(commands, spawnFn = spawn10) {
+function runDetached(commands, spawnFn = spawn11) {
   const script = `sleep 1; ${commands.map((c) => c.map(shq2).join(" ")).join("; ")}`;
   const child = spawnFn("/bin/sh", ["-c", script], { detached: true, stdio: "ignore" });
   child.on("error", () => {
@@ -23030,21 +23444,21 @@ function crewJson(args, timeoutMs = 6e4) {
 
 // src/periscope-mcp.ts
 import { lstat, mkdir, readdir, readFile, readlink, realpath, rm, stat, writeFile } from "fs/promises";
-import { basename as basename15, dirname as dirname29, isAbsolute as isAbsolute4, join as join50, relative as relative2, resolve as resolve6, sep } from "path";
+import { basename as basename15, dirname as dirname30, isAbsolute as isAbsolute5, join as join50, relative as relative2, resolve as resolve6, sep } from "path";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync46, mkdirSync as mkdirSync33, readdirSync as readdirSync19, readFileSync as readFileSync41, rmSync as rmSync22, writeFileSync as writeFileSync34 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync46, mkdirSync as mkdirSync34, readdirSync as readdirSync19, readFileSync as readFileSync41, rmSync as rmSync22, writeFileSync as writeFileSync34 } from "fs";
 import { join as join49 } from "path";
 var secretDir = (stateDir) => join49(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join49(secretDir(stateDir), `${id}.json`);
 var endpointDir = (stateDir) => join49(stateDir, "periscope-endpoints");
 var endpointFile = (stateDir, id) => join49(endpointDir(stateDir), `${id}.json`);
 function mintPeriscopeSecret(stateDir, ticketRecordId) {
-  mkdirSync33(secretDir(stateDir), { recursive: true, mode: 448 });
+  mkdirSync34(secretDir(stateDir), { recursive: true, mode: 448 });
   const secret = randomBytes3(32).toString("base64url");
   const file = secretFile(stateDir, ticketRecordId);
   writeFileSync34(file, `${JSON.stringify({ secret })}
@@ -23071,7 +23485,7 @@ function readPeriscopeEndpoint(stateDir, ticketRecordId) {
   }
 }
 function writePeriscopeEndpoint(stateDir, rec) {
-  mkdirSync33(endpointDir(stateDir), { recursive: true });
+  mkdirSync34(endpointDir(stateDir), { recursive: true });
   writeFileSync34(endpointFile(stateDir, rec.ticketRecordId), `${JSON.stringify(rec, null, 2)}
 `);
 }
@@ -23141,7 +23555,7 @@ async function removeEndedPeriscopeEndpoints(d) {
 var PERISCOPE_HOOKS = ["test", "build", "ports", "handoff", "preview", "isolate"];
 var MAX_READ_BYTES = 1024 * 1024;
 var MAX_WRITE_BYTES = 4 * 1024 * 1024;
-var MAX_BODY_BYTES2 = 8 * 1024 * 1024;
+var MAX_BODY_BYTES3 = 8 * 1024 * 1024;
 var MAX_HOOK_OUTPUT = 2e4;
 var MAX_DIFF = 2e5;
 var MAX_SEARCH_RESULTS = 500;
@@ -23149,7 +23563,7 @@ var PathRefusal = class extends Error {
 };
 var isInside = (root, p) => {
   const rel = relative2(root, p);
-  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute4(rel);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute5(rel);
 };
 async function realAncestor(p) {
   let cur = p;
@@ -23168,10 +23582,10 @@ async function realAncestor(p) {
     }
     if (isLink) {
       if (++hops > 40) throw new PathRefusal(`too many symbolic links resolving ${p}`);
-      cur = resolve6(dirname29(cur), await readlink(cur));
+      cur = resolve6(dirname30(cur), await readlink(cur));
       continue;
     }
-    const parent = dirname29(cur);
+    const parent = dirname30(cur);
     if (parent === cur) throw new PathRefusal(`cannot resolve ${p}`);
     tail3.push(basename15(cur));
     cur = parent;
@@ -23181,7 +23595,7 @@ async function resolveInWorktree(root, requested) {
   if (!requested || requested.includes("\0")) throw new PathRefusal("path is required");
   const realRoot = await realpath(root);
   let abs;
-  if (isAbsolute4(requested)) {
+  if (isAbsolute5(requested)) {
     abs = resolve6(requested);
     if (isInside(root, abs)) abs = join50(realRoot, relative2(root, abs));
   } else {
@@ -23282,7 +23696,7 @@ function createPeriscopeMcpServer(d, sc) {
     if (Buffer.byteLength(content) > MAX_WRITE_BYTES) return text(`content exceeds ${MAX_WRITE_BYTES} bytes`, true);
     const abs = await inTree(path);
     if (abs === await realpath(root)) return text("path must name a file", true);
-    await mkdir(dirname29(abs), { recursive: true });
+    await mkdir(dirname30(abs), { recursive: true });
     await inTree(path);
     await writeFile(abs, content);
     return text(`Wrote ${Buffer.byteLength(content)} bytes to ${await rel(abs)}`);
@@ -23322,7 +23736,7 @@ function createPeriscopeMcpServer(d, sc) {
     inputSchema: { path: z.string() },
     annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
   }, async ({ path }) => {
-    const parent = await inTree(dirname29(path) === "" ? "." : dirname29(path));
+    const parent = await inTree(dirname30(path) === "" ? "." : dirname30(path));
     const abs = join50(parent, basename15(path));
     if (basename15(path) === ".git" || abs === parent) return text("path must name a file", true);
     const st = await lstat(abs).catch(() => void 0);
@@ -23395,7 +23809,7 @@ async function readBody(req) {
   let n = 0;
   for await (const c of req) {
     n += c.length;
-    if (n > MAX_BODY_BYTES2) return null;
+    if (n > MAX_BODY_BYTES3) return null;
     chunks.push(c);
   }
   return Buffer.concat(chunks).toString("utf8");
@@ -23444,7 +23858,7 @@ function findPeriscope(sidecars, segment) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname30(process.execPath) : resolve7(dirname30(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname31(process.execPath) : resolve7(dirname31(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -23701,6 +24115,7 @@ var connectChoices = parseChoices(argv);
 if (!command) usage(argv.length ? `unknown option "${argv[0]}"` : void 0);
 var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "passenger-sync-daemon",
+  "periscope-proxy",
   "agents",
   "connect",
   "credential",
@@ -23839,6 +24254,13 @@ if (command === "pool-member") {
 }
 if (command === "passenger-sync-daemon") {
   runSyncDaemonFromEnv();
+} else if (command === "periscope-proxy") {
+  const dropFile = positional[1];
+  if (!dropFile) {
+    process.stderr.write("crew periscope-proxy is started by `crew periscope up`, not run by hand\n");
+    process.exit(2);
+  }
+  runProxyFromEnv(dropFile);
 } else {
   let requireArmed = function(what) {
     if (dryRun || route2.enabled) return;
@@ -25880,7 +26302,7 @@ ${cu.tail.trimEnd()}
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
         const raw = existsSync47(resolvedPath) ? JSON.parse(readFileSync42(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync34(dirOf2(resolvedPath), { recursive: true });
+        mkdirSync35(dirOf2(resolvedPath), { recursive: true });
         writeFileSync35(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
@@ -25958,7 +26380,7 @@ ${cu.tail.trimEnd()}
           const found = cfg.routes.find((r) => r.route === routeArg);
           if (!found) throw new ReposError(`no route "${routeArg}" in the config (have: ${cfg.routes.map((r) => r.route).join(", ") || "none"})`);
           const named2 = value("route") ? void 0 : positional[3];
-          const dir = named2 ? repoDirOf(configText, dirname30(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
+          const dir = named2 ? repoDirOf(configText, dirname31(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
           const target = reposOf(found).find((t) => resolvePath(t.dir) === dir || t.name === named2);
           const o = target ? found.repoOverrides[target.name] : void 0;
           runReposCheck(dir, {
@@ -25981,7 +26403,7 @@ ${cu.tail.trimEnd()}
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname30(cfg.configFile), a.route, a.name);
+          const dir = repoDirOf(configText, dirname31(cfg.configFile), a.route, a.name);
           if (!existsSync47(dir)) throw new ReposError(`${dir} does not exist on disk`);
           const files = { exists: (r) => existsSync47(resolvePath(dir, r)), list: (r) => {
             try {
@@ -26148,7 +26570,7 @@ ${cu.tail.trimEnd()}
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text2 = configText;
-      const base = dirname30(cfg.configFile);
+      const base = dirname31(cfg.configFile);
       const isCheckout = (d) => existsSync47(`${d}/.git`);
       try {
         if (sub === "list") {
@@ -26826,7 +27248,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync34(dirname30(resolvedPath), { recursive: true });
+          mkdirSync35(dirname31(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
           writeFileSync35(tmpPath, `${JSON.stringify(resolved, null, 2)}
@@ -26875,7 +27297,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync34(dirname30(apiKeyFile), { recursive: true });
+            mkdirSync35(dirname31(apiKeyFile), { recursive: true });
             writeFileSync35(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
@@ -27753,6 +28175,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             find: async () => hit && { row: hit.row, tag: hit.tag },
             worktreeExists: (p) => existsSync47(p),
             prepareDropFile,
+            startProxy: (wt, url, n) => launchProxy(crewInvocation(CREW_HOME), wt, url, Number(n), { host: hit.row.host || "localhost", inject: hit.repo.config.periscope?.inspector !== "repo" }),
             caps: periscopeCaps(cfg.ship),
             runHook: async (name, cwd, env) => {
               const script = hit?.repo.config.hooks[name];
@@ -27848,7 +28271,7 @@ ${where.join("\n")}`);
             for (const f of repoP.config.worktrees.copy) {
               const src = join51(repoP.dir, f);
               if (!existsSync47(src)) continue;
-              mkdirSync34(dirOf2(join51(path, f)), { recursive: true });
+              mkdirSync35(dirOf2(join51(path, f)), { recursive: true });
               copyFileSync2(src, join51(path, f));
             }
             const setup = repoP.config.hooks.setup;
@@ -27862,6 +28285,7 @@ ${where.join("\n")}`);
           },
           createRow: (fields) => trackerP.createPeriscope(fields),
           prepareDropFile,
+          startProxy: (wt, url, n) => launchProxy(crewInvocation(CREW_HOME), wt, url, Number(n), { host: a.host ?? "localhost", inject: repoP.config.periscope?.inspector !== "repo" }),
           registerCode: registerCodeServer,
           recordLocal: (sc) => {
             writePeriscopeSidecar(cfg.ship.stateDir, { ...sc, route: routeP.route });
@@ -28200,7 +28624,7 @@ ${where.join("\n")}`);
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync34(cfg.ship.stateDir, { recursive: true });
+      mkdirSync35(cfg.ship.stateDir, { recursive: true });
       writeFileSync35(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write(
@@ -28290,7 +28714,7 @@ ${where.join("\n")}`);
       if (!route2.resolved) fail(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
       const configText = readFileSync42(cfg.configFile, "utf8");
-      const cfgBase = dirname30(cfg.configFile);
+      const cfgBase = dirname31(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route2.route);
@@ -28346,7 +28770,7 @@ ${where.join("\n")}`);
         break;
       }
       if (fresh) {
-        mkdirSync34(dir, { recursive: true });
+        mkdirSync35(dir, { recursive: true });
         writeFileSync35(join51(dir, "README.md"), SAMPLE_README);
         writeFileSync35(join51(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.118.0",
+  "version": "0.119.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",