@tablation/crew 0.124.0 → 0.126.0

package/dist/cli.js

@@ -234,14 +234,8 @@ function ensureLspPlugin(stateDir, flavor, mainCheckout) {
   const def = LSP_SERVERS[flavor];
   const dir = join2(stateDir, "intel", "plugins", flavor);
   const command2 = existsSync3(lspLocalBin(mainCheckout, flavor)) ? `\${CLAUDE_PROJECT_DIR}/node_modules/.bin/${def.bin}` : def.bin;
-  const files = [
-    [join2(".claude-plugin", "plugin.json"), { name: `crew-${flavor}`, version: "1.0.0", description: `Language server for the ${flavor} intel flavor, generated by crew` }],
-    [".lsp.json", { [def.bin]: { command: command2, args: [...def.args], extensionToLanguage: def.extensionToLanguage } }]
-  ];
-  for (const [rel, doc] of files) {
+  for (const [rel, text2] of lspPluginFiles(flavor, command2)) {
     const path = join2(dir, rel);
-    const text2 = `${JSON.stringify(doc, null, 2)}
-`;
     let old;
     try {
       old = readFileSync2(path, "utf8");
@@ -253,6 +247,21 @@ function ensureLspPlugin(stateDir, flavor, mainCheckout) {
   }
   return dir;
 }
+function lspPluginFiles(flavor, command2) {
+  const def = LSP_SERVERS[flavor];
+  const files = [
+    [join2(".claude-plugin", "plugin.json"), { name: `crew-${flavor}`, version: "1.0.0", description: `Language server for the ${flavor} intel flavor, generated by crew` }],
+    [".lsp.json", { [def.bin]: { command: command2, args: [...def.args], extensionToLanguage: def.extensionToLanguage } }]
+  ];
+  return files.map(([rel, doc]) => [rel, `${JSON.stringify(doc, null, 2)}
+`]);
+}
+var SANDBOX_INTEL_DIR = "/sandbox/.crew/intel";
+function sandboxLspPlugin(flavor) {
+  const dir = `${SANDBOX_INTEL_DIR}/plugins/${flavor}`;
+  const command2 = `\${CLAUDE_PROJECT_DIR}/node_modules/.bin/${LSP_SERVERS[flavor].bin}`;
+  return { dir, files: lspPluginFiles(flavor, command2).map(([rel, content]) => ({ path: `${dir}/${rel}`, content })) };
+}
 function lspToolsParagraph(harness, omlx = false) {
   if (harness !== "claude") return "No symbol service is available for this harness: this repository's `intel` flavor serves only the Claude Code harness's own LSP tool.";
   if (omlx) return "The harness's LSP tool is off for this launcher, so no symbol service is available for this run.";
@@ -579,11 +588,11 @@ function startSerena(d, s) {
       const dest = join5(p.home, "language_servers");
       if (!d.exists(dest)) d.link(s.languageServers, dest);
     }
-    const mainCache = join5(p.mainProject, "cache");
+    const mainCache = s.seedCache ?? join5(p.mainProject, "cache");
     const cache = join5(p.project, "cache");
     if (!d.exists(cache) && d.exists(mainCache)) d.copyDir(mainCache, cache);
     try {
-      ensureMainIndex(d, s);
+      if (!s.noMainIndex) ensureMainIndex(d, s);
     } catch {
     }
     const port = intelPortFor(s.ticket);
@@ -6295,8 +6304,9 @@ function attentionProblems(items, already) {
 import { createHash as createHash6 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { execFileSync as execFileSync8 } from "child_process";
-import { mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
 import { dirname as dirname14, join as join32 } from "path";
+import { fileURLToPath } from "url";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/passenger-containers.ts
@@ -6850,6 +6860,12 @@ exit 125
     ...CONTAINER_ENGINES.map((e) => `printf '%b' ${shSingle(body)} > ${shSingle(`${dir}/${e}`)} && chmod 755 ${shSingle(`${dir}/${e}`)}`)
   ].join(" && ");
 }
+function writeFilesScript(files) {
+  return files.map((f) => {
+    const dir = f.path.slice(0, f.path.lastIndexOf("/")) || "/";
+    return `mkdir -p ${shSingle(dir)} && printf %s ${shSingle(Buffer.from(f.content, "utf8").toString("base64"))} | base64 -d > ${shSingle(f.path)}`;
+  }).join(" && ");
+}
 function shSingle(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
@@ -6876,6 +6892,17 @@ function sandboxCheckoutSection(workDir, heading) {
     "skill for setup, ports and the hand-off push."
   ];
 }
+function sandboxCodeToolsSection(intel) {
+  if (lspFlavor(intel)) return ["", `**Code tools.** On the Claude Code harness: ${lspToolsParagraph("claude").replace(/^The harness's/, "the harness's")}`];
+  if (!wantsCodeBridge(intel)) return [];
+  return [
+    "",
+    `**Code tools.** A \`${INTEL_SERVER_NAME}\` MCP server serves this repository's symbols from its language server. It offers at least: ${INTEL_MINIMUM_TOOLS.join("; ")}.`,
+    "It lists only `code_status` until the symbol service is up. The service starts inside this sandbox",
+    "the first time the session asks the server for tools, and it expects `setup` to have run, so run `setup`",
+    "before your first lookup. `code_status` says whether it is starting, attached, or failed to start (and why)."
+  ];
+}
 function sandboxEnv(ship) {
   return ship.runner === "sandbox" ? { sandbox: { workDir: ship.sandbox?.workDir ?? DEFAULT_SANDBOX_WORKDIR } } : {};
 }
@@ -7175,7 +7202,7 @@ function renderEnvironment(i) {
     );
   }
   if (only && i.sandbox) {
-    lines2.push(...sandboxCheckoutSection(i.sandbox.workDir, "## Your checkout"));
+    lines2.push(...sandboxCheckoutSection(i.sandbox.workDir, "## Your checkout"), ...sandboxCodeToolsSection(only.config.hooks.intel));
   } else if (only) {
     lines2.push(...repoSection(only, key, "## Your worktree"));
   } else {
@@ -7191,7 +7218,7 @@ function renderEnvironment(i) {
     );
     if (i.sandbox) lines2.push(...sandboxCheckoutSection(i.sandbox.workDir, "### Your checkout"));
     for (const r of repos) {
-      lines2.push(...i.sandbox ? ["", `### ${r.name}`] : repoSection(r, key, `### ${r.name} \u2014 \`${r.dir}\``));
+      lines2.push(...i.sandbox ? ["", `### ${r.name}`, ...sandboxCodeToolsSection(r.config.hooks.intel)] : repoSection(r, key, `### ${r.name} \u2014 \`${r.dir}\``));
       lines2.push("", `Hooks for ${r.name} \u2014 the only commands you should run here:`, "", hookTable(r.config));
       lines2.push(...mapSection(r, `#### Repository map \u2014 ${r.name}`));
     }
@@ -7219,6 +7246,8 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 var STATUS_TOOL = "code_status";
 var STATUS_WAITING = "The symbol service is not available yet: the worktree has not been cut. Run `crew worktree` for the ticket; the symbol tools appear in this server afterwards.";
+var STATUS_STARTING = "The symbol service is starting inside this sandbox. Call `code_status` again in a few seconds; the symbol tools replace it once the service answers.";
+var statusFailed = (reason) => `The symbol service did not start (${reason}). Run the repository's \`setup\` hook first if you have not; this call has started a retry, so call \`code_status\` again in a few seconds; until it starts use text search.`;
 var STATUS_LOST = "The symbol service stopped answering, so its tools are unavailable. They return if the service comes back; until then use text search.";
 function intelDir(stateDir, route2, ticket) {
   const safe = (s) => s.replace(/[^A-Za-z0-9._-]+/g, "_");
@@ -7258,6 +7287,8 @@ function createBridge(o) {
   let lost = false;
   let connecting = false;
   let timer;
+  let starting;
+  let startError;
   const notify2 = () => {
     void server.sendToolListChanged().catch(() => {
     });
@@ -7270,8 +7301,40 @@ function createBridge(o) {
     });
     notify2();
   };
-  const status2 = () => ({ content: [{ type: "text", text: lost ? STATUS_LOST : STATUS_WAITING }] });
+  const statusText = () => lost ? STATUS_LOST : starting ? STATUS_STARTING : startError !== void 0 ? statusFailed(startError) : STATUS_WAITING;
+  const status2 = () => ({ content: [{ type: "text", text: statusText() }] });
+  const ensureStarted = () => {
+    if (!o.start || upstream || starting) return;
+    startError = void 0;
+    starting = (async () => {
+      try {
+        const r = await o.start();
+        if ("error" in r) {
+          startError = r.error;
+          return;
+        }
+        writeAttachFile(o.attachFile, r.url);
+        await tryAttach();
+        if (!upstream) startError = `${r.url} did not accept a connection`;
+      } catch (e) {
+        startError = e.message.replace(/\s+/g, " ").slice(0, 200);
+      } finally {
+        starting = void 0;
+        notify2();
+      }
+    })();
+  };
+  const waitForStart = async () => {
+    const running = starting;
+    if (!running) return;
+    let t;
+    await Promise.race([running, new Promise((r) => {
+      t = setTimeout(r, o.startWaitMs ?? 12e4);
+    })]);
+    if (t) clearTimeout(t);
+  };
   server.setRequestHandler(ListToolsRequestSchema, async () => {
+    ensureStarted();
     if (!upstream) return { tools: [statusTool] };
     try {
       return await upstream.listTools();
@@ -7281,6 +7344,11 @@ function createBridge(o) {
     }
   });
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const failedNow = req.params.name === STATUS_TOOL && !upstream && !starting && startError !== void 0;
+    const failedText = failedNow ? statusText() : void 0;
+    ensureStarted();
+    if (failedText !== void 0) return { content: [{ type: "text", text: failedText }] };
+    if (req.params.name !== STATUS_TOOL) await waitForStart();
     if (!upstream) return status2();
     try {
       return await upstream.callTool({ name: req.params.name, arguments: req.params.arguments });
@@ -10733,6 +10801,9 @@ var SandboxRunner = class {
         lockfile: cfg.depsLockfile ?? DEFAULT_CACHE_SETTINGS.depsLockfile
       })} && ${containerEngineStubScript()}`;
       await this.os(["sandbox", "exec", "-n", name, "--no-login-shell", "--", "sh", "-c", clone]);
+      if (plan.sandboxFiles?.length) {
+        await this.os(["sandbox", "exec", "-n", name, "--no-login-shell", "--", "sh", "-c", writeFilesScript(plan.sandboxFiles)]);
+      }
       const harness = cfg.agentBin ?? basename8(plan.bin);
       const viaUpload = Buffer.byteLength(plan.prompt) > SANDBOX_STDIN_LIMIT;
       if (viaUpload) {
@@ -10882,6 +10953,15 @@ function lspPluginDirsFor(route2, repo, stateDir) {
     return void 0;
   }
 }
+function sandboxLspPluginFor(route2, repo) {
+  try {
+    const dir = reposOf(route2).find((r) => r.name === repo)?.dir ?? route2.dir;
+    const flavor = lspFlavor(loadRepoConfig(dir)?.hooks.intel);
+    return flavor ? sandboxLspPlugin(flavor) : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var AgentSpawnError = class extends AgentError {
 };
 var WorkspaceAuthRefused = class extends AgentSpawnError {
@@ -10917,25 +10997,49 @@ function streamShowsAllowanceRefusal(streamPath) {
 }
 var digestPathFor = (stateDir, routeLabel, role, runId) => join29(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
 function codeBridgeFor(o, harness) {
-  if (o.ship.runner === "sandbox" || !o.ticket) return void 0;
+  if (!o.ticket) return void 0;
   const number = /(\d+)$/.exec(o.ticket)?.[1];
   if (!number) return void 0;
   let intel;
+  let seed;
   try {
     const repos = reposOf(o.route);
     const target = repos.find((r) => r.name === o.repo) ?? (repos.length === 1 ? repos[0] : void 0);
     intel = target ? loadRepoConfig(target.dir)?.hooks?.intel : void 0;
+    const origin = target && o.ship.runner === "sandbox" && intelFlavor(intel) === "serena" ? originUrlOf(target.dir, "origin") : null;
+    const remote = origin ? parseRemote(origin) : null;
+    if (remote) seed = `${o.ship.sandbox?.mirrorDir ?? "/cache"}/${intelRelDir(remote)}/cache`;
   } catch {
   }
   if (!wantsCodeBridge(intel)) return void 0;
-  const args = [...process.execArgv, process.argv[1] ?? "crew", "intel", "bridge", o.route.route, number, "--state-dir", o.stateDir];
-  const bridge = { command: process.execPath, args };
+  const sandbox = o.ship.runner === "sandbox";
+  const args = sandbox ? [
+    SANDBOX_BRIDGE_PATH,
+    "--attach-file",
+    `${SANDBOX_INTEL_DIR}/url`,
+    "--start",
+    intel.trim(),
+    "--clone",
+    o.ship.sandbox?.workDir ?? DEFAULT_SANDBOX_WORKDIR,
+    "--state-dir",
+    dirname13(SANDBOX_INTEL_DIR),
+    "--ticket",
+    number,
+    ...seed ? ["--seed-cache", seed] : []
+  ] : [...process.execArgv, process.argv[1] ?? "crew", "intel", "bridge", o.route.route, number, "--state-dir", o.stateDir];
+  const bridge = { command: sandbox ? "node" : process.execPath, args };
   if (harness === "gemini") {
-    const file = join29(intelDir(o.stateDir, o.route.route, number), "gemini-settings.json");
-    mkdirSync18(dirname13(file), { recursive: true });
-    writeFileSync19(file, `${JSON.stringify({ mcpServers: { [INTEL_SERVER_NAME]: { command: bridge.command, args } } }, null, 2)}
-`);
-    bridge.settingsFile = file;
+    const text2 = `${JSON.stringify({ mcpServers: { [INTEL_SERVER_NAME]: { command: bridge.command, args } } }, null, 2)}
+`;
+    if (sandbox) {
+      bridge.settingsFile = `${SANDBOX_INTEL_DIR}/gemini-settings.json`;
+      bridge.files = [{ path: bridge.settingsFile, content: text2 }];
+    } else {
+      const file = join29(intelDir(o.stateDir, o.route.route, number), "gemini-settings.json");
+      mkdirSync18(dirname13(file), { recursive: true });
+      writeFileSync19(file, text2);
+      bridge.settingsFile = file;
+    }
   }
   return bridge;
 }
@@ -10996,11 +11100,13 @@ function planAgentRun(o) {
   }
   const adapter = adapterFor(toolchain.harness);
   const code = codeBridgeFor(o, adapter.harness);
+  const sandboxLsp = o.ship.runner === "sandbox" && adapter.harness === "claude" ? sandboxLspPluginFor(o.route, o.repo) : void 0;
+  const sandboxFiles = [...code?.files ?? [], ...sandboxLsp?.files ?? []];
   const invocation = adapter.invocation(toolchain, {
     code,
     role: o.role,
     model,
-    pluginDirs: adapter.harness === "claude" ? lspPluginDirsFor(o.route, o.repo, o.stateDir) : void 0,
+    pluginDirs: adapter.harness !== "claude" ? void 0 : sandboxLsp ? [sandboxLsp.dir] : lspPluginDirsFor(o.route, o.repo, o.stateDir),
     // Skipped when there's no key to send: a route `crew connect` hasn't
     // resolved yet has nothing to authenticate the MCP connection with either.
     mcp: o.apiKey ? { url: `${o.route.baseUrl}/api/mcp`, keyVar: API_KEY_VAR } : void 0
@@ -11047,7 +11153,8 @@ function planAgentRun(o) {
     ...o.ship.runner === "sandbox" ? {
       runner: "sandbox",
       ...o.ship.sandbox ? { sandboxConfig: o.ship.sandbox } : {},
-      sandboxPolicy: sandboxPolicyInputFor(o.route, toolchain, { harnessBin: invocation.bin, repo: o.repo, sandbox: o.ship.sandbox })
+      sandboxPolicy: sandboxPolicyInputFor(o.route, toolchain, { harnessBin: invocation.bin, repo: o.repo, sandbox: o.ship.sandbox }),
+      ...sandboxFiles.length ? { sandboxFiles } : {}
     } : {},
     resolution: { toolchain: seat.toolchainWhy, model: seat.modelWhy },
     warnings: [...seat.warnings ?? [], ...expanded.warnings],
@@ -12243,6 +12350,9 @@ function mirrorRelPath(r) {
 function depsRelDir(r) {
   return `cache/deps/${r.host}/${r.path}`;
 }
+function intelRelDir(r) {
+  return `intel/${r.host}/${r.path}`;
+}
 var q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
 function cloneScript(o) {
   const mirror = `${o.mirrorDir}/${mirrorRelPath(o.repo)}`;
@@ -12293,6 +12403,30 @@ find . -name node_modules -type d -prune | while read -r p; do
 done
 rm -rf "$droot/$h"; mv "$droot/$h.tmp" "$droot/$h"
 `;
+var INTEL_SCRIPT = `
+set -e
+m=${VOLUME_ROOT}/"$1"; iroot=${VOLUME_ROOT}/"$2"; config="$3"; ls="\${CREW_SERENA_LANGUAGE_SERVERS:-}"
+export GIT_TERMINAL_PROMPT=0
+git config --global --add safe.directory '*'
+tip=$(git -C "$m" rev-parse --verify --quiet "HEAD^{commit}") || { echo "the mirror has no default branch" >&2; exit 3; }
+[ "$(cat "$iroot/indexed-commit" 2>/dev/null)" = "$tip" ] && { echo "unchanged $tip"; exit 0; }
+w=$(mktemp -d); trap 'rm -rf "$w"' EXIT
+git clone --quiet --shared "$m" "$w/src"
+git -C "$w/src" checkout --quiet "$tip"
+mkdir -p "$w/home" "$w/project"
+printf '%s' "$config" | sed "s#@PROJECT@#$w/project#" > "$w/home/serena_config.yml"
+git -C "$w/src" show "$tip:.serena/project.yml" > "$w/project/project.yml" 2>/dev/null || : > "$w/project/project.yml"
+if grep -q '^read_only' "$w/project/project.yml"; then sed -i 's/^read_only.*/read_only: true/' "$w/project/project.yml"; else echo 'read_only: true' >> "$w/project/project.yml"; fi
+[ -n "$ls" ] && [ -d "$ls" ] && ln -s "$ls" "$w/home/language_servers"
+SERENA_HOME="$w/home" serena project index "$w/src"
+cd "$w/project"; mkdir -p cache
+mkdir -p "$(dirname "$iroot")"; rm -rf "$iroot.tmp"; mkdir -p "$iroot.tmp"
+cp -R -P cache "$iroot.tmp/"
+printf '%s
+' "$tip" > "$iroot.tmp/indexed-commit"
+rm -rf "$iroot"; mv "$iroot.tmp" "$iroot"
+echo "updated $tip"
+`;
 var MATERIALIZE_SCRIPT = `
 set -e
 export GIT_TERMINAL_PROMPT=0
@@ -12371,6 +12505,14 @@ var SandboxCache = class {
           continue;
         }
       }
+      if (r.intelImage) {
+        try {
+          await this.helper(r.intelImage, INTEL_SCRIPT, [mirrorRelPath(r), intelRelDir(r), serenaConfigYaml("@PROJECT@")]);
+        } catch (e) {
+          out.push({ repo: r, ok: false, detail: `intel index: ${describe(e)}` });
+          continue;
+        }
+      }
       out.push({ repo: r, ok: true });
     }
     return out;
@@ -12396,13 +12538,13 @@ var SandboxCache = class {
     } catch {
       return [];
     }
-    const script = `cd ${VOLUME_ROOT}/mirrors 2>/dev/null || exit 0; find . -name '*.git' -type d -prune | while read -r d; do printf '%s\\t%s\\n' "\${d#./}" "$(cat "$d/crew-last-refresh" 2>/dev/null)"; done`;
+    const script = `cd ${VOLUME_ROOT}/mirrors 2>/dev/null || exit 0; find . -name '*.git' -type d -prune | while read -r d; do r="\${d#./}"; i=${VOLUME_ROOT}/intel/"\${r%.git}"; printf '%s\\t%s\\t%s\\t%s\\n' "$r" "$(cat "$d/crew-last-refresh" 2>/dev/null)" "$(cat "$i/indexed-commit" 2>/dev/null)" "$(stat -c %y "$i/indexed-commit" 2>/dev/null | cut -c1-19)"; done`;
     const { stdout } = await this.helper(this.s.helperImage, script, []);
     const rows = [];
     for (const line of stdout.split("\n").filter(Boolean)) {
-      const [rel, when] = line.split("	");
+      const [rel, when, commit, indexedAt] = line.split("	");
       const m = /^([^/]+)\/(.+)\.git$/.exec(rel ?? "");
-      if (m) rows.push({ repo: { host: m[1], path: m[2] }, lastRefresh: when?.trim() || null });
+      if (m) rows.push({ repo: { host: m[1], path: m[2] }, lastRefresh: when?.trim() || null, ...commit?.trim() ? { intel: { commit: commit.trim(), indexedAt: indexedAt?.trim() || null } } : {} });
     }
     return rows;
   }
@@ -12411,7 +12553,7 @@ var SandboxCache = class {
     const have = new Set(keep.map((r) => `${r.host}/${r.path}`));
     const drop = (await this.list()).map((m) => m.repo).filter((r) => !have.has(`${r.host}/${r.path}`));
     for (const r of drop) {
-      await this.helper(this.s.helperImage, `rm -rf ${VOLUME_ROOT}/${q(mirrorRelPath(r))} ${VOLUME_ROOT}/${q(depsRelDir(r))}`, []);
+      await this.helper(this.s.helperImage, `rm -rf ${VOLUME_ROOT}/${q(mirrorRelPath(r))} ${VOLUME_ROOT}/${q(depsRelDir(r))} ${VOLUME_ROOT}/${q(intelRelDir(r))}`, []);
     }
     return drop;
   }
@@ -12686,6 +12828,14 @@ var SANDBOX_CLAUDE_SHA256 = {
 };
 var SANDBOX_UID = 1e3;
 var CREW_PREFIX = "/opt/crew";
+var SANDBOX_BRIDGE_PATH = `${CREW_PREFIX}/bin/intel-bridge`;
+function readBridgeBundle() {
+  const here = dirname14(fileURLToPath(import.meta.url));
+  for (const p of [join32(here, "sandbox-intel-bridge.cjs"), join32(here, "..", "dist", "sandbox-intel-bridge.cjs")]) {
+    if (existsSync30(p)) return readFileSync27(p, "utf8");
+  }
+  return void 0;
+}
 var SANDBOX_UV_VERSION = "0.13.6";
 var SANDBOX_SERENA_VERSION = "2.1.0";
 var SERENA_IMAGE_HOME = `${CREW_PREFIX}/serena`;
@@ -12749,8 +12899,8 @@ function baseLayer() {
   ].join("\n");
   return { name: "base", tag: `crew-sandbox-base:${hash({ SANDBOX_BASE_IMAGE, SANDBOX_OPENSHELL_VERSION })}`, dockerfile, files: {} };
 }
-function crewLayer(base, intel) {
-  const files = { "credential-helper": CREDENTIAL_HELPER, "mcp.json": MCP_CONFIG };
+function crewLayer(base, intel, bridge) {
+  const files = { "credential-helper": CREDENTIAL_HELPER, "mcp.json": MCP_CONFIG, ...bridge ? { "intel-bridge": bridge } : {} };
   const env = Object.entries(CREW_ENV).map(([k, v]) => `${k}=${v}`).join(" ");
   const dockerfile = [
     `FROM ${base.tag}`,
@@ -12758,6 +12908,7 @@ function crewLayer(base, intel) {
     run2(`apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git${intel ? " python3 python3-venv nodejs" : ""} && rm -rf /var/lib/apt/lists/*`),
     `COPY credential-helper ${CREW_PREFIX}/bin/credential-helper`,
     `COPY mcp.json ${CREW_PREFIX}/mcp/mcp.json`,
+    ...bridge ? [`COPY intel-bridge ${SANDBOX_BRIDGE_PATH}`] : [],
     run2(claudeInstallCommand()),
     ...intel ? [run2(`mkdir -p ${CREW_PREFIX}/cache && ${serenaInstallCommand()}`)] : [],
     run2(`chmod 0755 ${CREW_PREFIX}/bin/credential-helper && git config --system credential.helper ${CREW_PREFIX}/bin/credential-helper`),
@@ -12822,9 +12973,9 @@ function repoLayer(repo, decl, crew, warm) {
   const dockerfile = lines2.join("\n");
   return { name: "repo", tag: `crew-sandbox/${slug(repo)}:${hash({ crew: crew.tag, dockerfile, files })}`, dockerfile, files };
 }
-function planSandbox(repo, decl, warm = {}) {
+function planSandbox(repo, decl, warm = {}, bridge) {
   const base = baseLayer();
-  const crew = crewLayer(base, decl.intel);
+  const crew = crewLayer(base, decl.intel, bridge);
   const layer = repoLayer(repo, decl, crew, warm);
   return { repo, tag: layer.tag, claude: SANDBOX_CLAUDE_VERSION, layers: [base, crew, layer] };
 }
@@ -12844,6 +12995,9 @@ function writeSandboxState(stateDir, state) {
 `);
   renameSync3(`${file}.tmp`, file);
 }
+function sandboxImageFor(state, repo) {
+  return state[repo]?.tags[0]?.tag ?? null;
+}
 function sandboxImageStatus(state, plan) {
   const s = state[plan.repo];
   const current = s?.tags[0];
@@ -12934,7 +13088,7 @@ function sandboxFailedItem(repo, tag, layer, logPath, nowIso = (/* @__PURE__ */
 async function sandboxBuildTick(repos, deps, force = false) {
   const nowMs = (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime();
   for (const r of repos) {
-    const plan = planSandbox(r.name, r.decl, r.warm);
+    const plan = planSandbox(r.name, r.decl, r.warm, r.bridge);
     const state = readSandboxState(deps.stateDir)[r.name];
     const upToDate = state?.tags[0]?.tag === plan.tag && deps.hasImage(plan.tag);
     if (upToDate) {
@@ -13093,7 +13247,7 @@ function managedRuntimeWarnings(kind, ship) {
 
 // src/selftest.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync28, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync28, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join33 } from "path";
 var SELFTEST_TIMEOUT_MS = 12e4;
@@ -13293,7 +13447,7 @@ var fileFor2 = (stateDir) => join33(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync30(p) ? JSON.parse(readFileSync28(p, "utf8")) : {};
+    return existsSync31(p) ? JSON.parse(readFileSync28(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -13315,7 +13469,7 @@ function doctorSelftestLines(stored, toolchains) {
 
 // src/cli.ts
 import { resolve as resolve7, dirname as dirname33, join as join55, basename as basename16 } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { hostname as hostname4, homedir as homedir11 } from "os";
 import { spawnSync as spawnSync11 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
@@ -13619,7 +13773,7 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync22, readFileSync as readFileSync30, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync30, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
 import { dirname as dirname16, join as join35 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
@@ -13692,7 +13846,7 @@ async function runReset(o, fx) {
   }
   if (o.beforeState) steps.push(...await o.beforeState());
   steps.push(...o.wipeState ? wipeStateDir(o.stateDir, o.dryRun) : removeState(o.stateDir, o.dryRun));
-  if (existsSync31(o.configFile)) {
+  if (existsSync32(o.configFile)) {
     if (!o.dryRun) rmSync18(o.configFile, { force: true });
     steps.push({ step: "config", target: o.configFile, action: mark(o.dryRun) });
   } else {
@@ -13701,7 +13855,7 @@ async function runReset(o, fx) {
   return steps;
 }
 function removeCheckout(dir, dryRun, fx) {
-  if (!existsSync31(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
+  if (!existsSync32(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
   const { dirty, linkedWorktrees } = fx.inspectCheckout(dir);
   if (dirty.length) {
     return { step: "checkout", target: dir, action: "kept", detail: `has uncommitted changes (${dirty.length} path${dirty.length === 1 ? "" : "s"}: ${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? ", \u2026" : ""})` };
@@ -13722,7 +13876,7 @@ function removeState(stateDir, dryRun) {
   } catch {
   }
   for (const t of targets) {
-    if (!existsSync31(t)) continue;
+    if (!existsSync32(t)) continue;
     if (!dryRun) rmSync18(t, { recursive: true, force: true });
     out.push({ step: "state", target: t, action: mark(dryRun) });
   }
@@ -14118,13 +14272,13 @@ function hostArchitecture(arch = process.arch) {
 
 // src/pool-member-host.ts
 import "child_process";
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 import { hostname as hostname3 } from "os";
 
 // src/machine-id.ts
 import { execFileSync as execFileSync10 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname18, join as join37 } from "path";
 function machineIdPathFor(stateDir) {
   return join37(stateDir, "machine-id");
@@ -14140,7 +14294,7 @@ function readRawMachineId(platform2 = process.platform) {
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync32(p)) {
+      if (existsSync33(p)) {
         const id = readFileSync32(p, "utf8").trim();
         if (id) return id;
       }
@@ -14152,7 +14306,7 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync32(path)) {
+  if (existsSync33(path)) {
     const cached = readFileSync32(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
@@ -14173,7 +14327,7 @@ function matchShipRows(ships, shipName2, machineId) {
 
 // src/provision.ts
 import { spawnSync as spawnSync8 } from "child_process";
-import { existsSync as existsSync33, readFileSync as readFileSync33, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync33, writeFileSync as writeFileSync26 } from "fs";
 import { hostname as hostname2 } from "os";
 import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
@@ -14767,7 +14921,7 @@ function realProvisionDeps(crewHome) {
   };
   const configFile = () => {
     const f = findConfigFile(crewHome);
-    return existsSync33(f) ? f : null;
+    return existsSync34(f) ? f : null;
   };
   return {
     crew: spawnCrew,
@@ -14801,14 +14955,14 @@ function realProvisionDeps(crewHome) {
           continue;
         }
         for (const p of plan.unitPaths) {
-          if (!existsSync33(p) || readFileSync33(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+          if (!existsSync34(p) || readFileSync33(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
         }
       }
       const label = labelFor(crewHome, "run");
       let running = false;
       let lingering = true;
       if (mechanism === "systemd") {
-        const system = ctx.root || existsSync33(systemUnitPathFor(label));
+        const system = ctx.root || existsSync34(systemUnitPathFor(label));
         const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
         running = spawnSync8(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
         if (!system) {
@@ -14853,7 +15007,7 @@ host=${host}
 
 // src/tunnel.ts
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync25, readFileSync as readFileSync34, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync34, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
 import { randomInt } from "crypto";
 import { join as join39 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -14931,7 +15085,7 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync34(path)) return void 0;
+  if (!existsSync35(path)) return void 0;
   try {
     return JSON.parse(readFileSync34(path, "utf8"));
   } catch {
@@ -15044,7 +15198,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join39(stateDir, "passengers");
-  if (!existsSync34(dir)) return [];
+  if (!existsSync35(dir)) return [];
   return readdirSync13(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -15069,7 +15223,7 @@ function realPoolMemberDeps(o) {
       crewVersion: crewVersion(o.crewHome),
       hostname: hostname3()
     },
-    hasShipConfig: () => existsSync35(findConfigFile(o.crewHome)),
+    hasShipConfig: () => existsSync36(findConfigFile(o.crewHome)),
     async provision(lease, instanceClass, shipKind) {
       const hosts = lease.forges.map((f) => f.host.toLowerCase());
       const lines2 = [];
@@ -16439,7 +16593,7 @@ async function resolveOne(tracker, t, seat, approvedStatus, buildingStatus, affi
 }
 
 // src/repo-refresh.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync26, readFileSync as readFileSync35, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync35, writeFileSync as writeFileSync29 } from "fs";
 import { dirname as dirname20 } from "path";
 var REFRESH_COOLDOWN_MS = 2 * 6e4;
 var UNSERVABLE_PASSES_BEFORE_ATTENTION = 3;
@@ -16469,7 +16623,7 @@ function applyRepoRows(resolved, rows) {
 }
 function persistRepoRows(stateDir, routeName, rows) {
   const path = resolvedPathFor(stateDir, routeName);
-  if (!existsSync36(path)) return;
+  if (!existsSync37(path)) return;
   const raw = JSON.parse(readFileSync35(path, "utf8"));
   applyRepoRows(raw, rows);
   mkdirSync26(dirname20(path), { recursive: true });
@@ -16924,12 +17078,12 @@ var localRefSkipReported = (ticket, problem, events) => events.some((e) => e.rec
 
 // src/connect-wizard.ts
 import { delimiter, dirname as dirname21, join as join41 } from "path";
-import { accessSync as accessSync3, constants as constants3, existsSync as existsSync37, mkdirSync as mkdirSync27, writeFileSync as writeFileSync30 } from "fs";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync38, mkdirSync as mkdirSync27, writeFileSync as writeFileSync30 } from "fs";
 import { stringify as stringify3 } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync37;
+  const exists = opts.configExists ?? existsSync38;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -17123,7 +17277,7 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync36, writeFileSync as writeFileSync31, existsSync as existsSync38, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
+import { readFileSync as readFileSync36, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
 import { dirname as dirname23, join as join43 } from "path";
 import { tmpdir as tmpdir5 } from "os";
 
@@ -17867,7 +18021,7 @@ async function bump(o, size) {
   }
   const files = o.repo.release.versionFiles.map((f) => join43(o.cwd, f));
   const first = files[0];
-  if (!existsSync38(first)) {
+  if (!existsSync39(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
@@ -17903,7 +18057,7 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync38(path) ? readFileSync36(path, "utf8") : "# Changelog\n";
+  const existing = existsSync39(path) ? readFileSync36(path, "utf8") : "# Changelog\n";
   writeFileSync31(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
@@ -18009,7 +18163,7 @@ function openReleaseCheckout(o) {
   }
   for (const f of o.repo.worktrees.copy) {
     const src = join43(o.cwd, f);
-    if (!existsSync38(src)) continue;
+    if (!existsSync39(src)) continue;
     mkdirSync28(dirname23(join43(dir, f)), { recursive: true });
     copyFileSync(src, join43(dir, f));
   }
@@ -18990,7 +19144,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync39, statSync as statSync11, openSync as openSync5, readSync as readSync2, closeSync as closeSync5 } from "fs";
+import { watch as watchFile, existsSync as existsSync40, statSync as statSync11, openSync as openSync5, readSync as readSync2, closeSync as closeSync5 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -19091,7 +19245,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync39(file)) return { events: [], offset: from };
+  if (!existsSync40(file)) return { events: [], offset: from };
   const size = statSync11(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -19334,7 +19488,7 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync29, readFileSync as readFileSync37, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync29, readFileSync as readFileSync37, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
 import { dirname as dirname24 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
@@ -19396,7 +19550,7 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync40(resolvedFile)) return void 0;
+  if (!existsSync41(resolvedFile)) return void 0;
   try {
     const v = JSON.parse(readFileSync37(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
@@ -19405,7 +19559,7 @@ function readSyncedName(resolvedFile) {
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync40(resolvedFile)) return;
+  if (!existsSync41(resolvedFile)) return;
   let raw;
   try {
     raw = JSON.parse(readFileSync37(resolvedFile, "utf8"));
@@ -20107,7 +20261,7 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync41, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
 import { dirname as dirname25 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
@@ -20141,7 +20295,7 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync41(resolvedPath) ? JSON.parse(readFileSync38(resolvedPath, "utf8")) : {};
+    const raw = existsSync42(resolvedPath) ? JSON.parse(readFileSync38(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
@@ -20836,7 +20990,7 @@ function planSampleTicket(i) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync42, readFileSync as readFileSync40, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync43, readFileSync as readFileSync40, readdirSync as readdirSync14 } from "fs";
 import { basename as basename13, dirname as dirname27, join as join45, resolve as resolve5 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -20949,7 +21103,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync42(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync43(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -20957,7 +21111,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync42(a.path)) {
+    if (!dryRun && existsSync43(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -20968,7 +21122,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync42(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync43(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse2(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -21122,12 +21276,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync43, readdirSync as readdirSync15, rmSync as rmSync20, statSync as statSync12 } from "fs";
+import { existsSync as existsSync44, readdirSync as readdirSync15, rmSync as rmSync20, statSync as statSync12 } from "fs";
 import { join as join46 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join46(stateDir, "streams");
-  if (!existsSync43(dir)) return [];
+  if (!existsSync44(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync15(dir).map((name) => join46(dir, name)).filter((path) => {
     try {
@@ -21155,7 +21309,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync43(stateDir)) return [];
+  if (!existsSync44(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync15(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join46(stateDir, name)).filter((path) => {
     try {
@@ -21167,11 +21321,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync46, existsSync as existsSync50, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync46, existsSync as existsSync51, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync44, mkdirSync as mkdirSync31, readFileSync as readFileSync41, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
+import { existsSync as existsSync45, mkdirSync as mkdirSync31, readFileSync as readFileSync41, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
 import { join as join47 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -21197,7 +21351,7 @@ function writePeriscopePrior(stateDir, ticketRecordId, prior) {
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync44(p) ? JSON.parse(readFileSync41(p, "utf8")) : void 0;
+    return existsSync45(p) ? JSON.parse(readFileSync41(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -21752,7 +21906,7 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync13 } from "child_process";
-import { existsSync as existsSync45, mkdirSync as mkdirSync32, readFileSync as readFileSync42, chmodSync as chmodSync3 } from "fs";
+import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync42, chmodSync as chmodSync3 } from "fs";
 import { dirname as dirname28, join as join49 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -21762,7 +21916,7 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync45(privateKeyPath)) {
+  if (!existsSync46(privateKeyPath)) {
     mkdirSync32(dirname28(privateKeyPath), { recursive: true });
     try {
       execFileSync13("ssh-keygen", [
@@ -21783,7 +21937,7 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync45(publicKeyPath)) {
+  if (!existsSync46(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
   const publicKey = readFileSync42(publicKeyPath, "utf8").trim();
@@ -21950,7 +22104,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn9 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync46, mkdirSync as mkdirSync34, readFileSync as readFileSync43, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync47, mkdirSync as mkdirSync34, readFileSync as readFileSync43, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
 import { join as join50 } from "path";
 
 // src/passenger-mirror.ts
@@ -22085,7 +22239,7 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync46(path)) return void 0;
+  if (!existsSync47(path)) return void 0;
   try {
     return JSON.parse(readFileSync43(path, "utf8"));
   } catch {
@@ -22116,7 +22270,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join50(stateDir, "passengers");
-  if (!existsSync46(dir)) return [];
+  if (!existsSync47(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync16(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -22613,7 +22767,7 @@ function describeCause(err3) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync47, mkdirSync as mkdirSync36, readFileSync as readFileSync44, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync36, readFileSync as readFileSync44, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
 import { join as join51 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -22711,7 +22865,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync47(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync48(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join51(stateDir, "reload-requested");
@@ -23300,7 +23454,7 @@ import { createHash as createHash10 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync6,
-  existsSync as existsSync48,
+  existsSync as existsSync49,
   fstatSync,
   openSync as openSync6,
   readSync as readSync3,
@@ -23671,7 +23825,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync48(live)) {
+  if (!existsSync49(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -23828,7 +23982,7 @@ async function route(deps, method, url, req, abort) {
     const run3 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run3) || run3.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run3)) return err2(400, "not a run name");
     const file = join52(deps.stateDir, "streams", run3.endsWith(".jsonl") ? run3 : `${run3}.jsonl`);
-    if (!existsSync48(file)) return err2(404, "no such run");
+    if (!existsSync49(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -23872,7 +24026,7 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync48(path)) return false;
+  if (!existsSync49(path)) return false;
   return new Promise((resolve8) => {
     const c = createConnection(path);
     c.once("connect", () => {
@@ -23891,7 +24045,7 @@ async function startControlServer(deps) {
     return null;
   }
   if (await socketIsStale(path)) rmSync23(path, { force: true });
-  else if (existsSync48(path)) {
+  else if (existsSync49(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -23984,7 +24138,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync49, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync45, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync50, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync45, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
 import { join as join53 } from "path";
 var secretDir = (stateDir) => join53(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join53(secretDir(stateDir), `${id}.json`);
@@ -24027,7 +24181,7 @@ function removePeriscopeEndpointRecord(stateDir, ticketRecordId) {
 }
 function listPeriscopeEndpoints(stateDir) {
   const dir = endpointDir(stateDir);
-  if (!existsSync49(dir)) return [];
+  if (!existsSync50(dir)) return [];
   const out = [];
   for (const name of readdirSync19(dir)) {
     if (!name.endsWith(".json")) continue;
@@ -24391,7 +24545,7 @@ function findPeriscope(sidecars, segment) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname33(process.execPath) : resolve7(dirname33(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname33(process.execPath) : resolve7(dirname33(fileURLToPath2(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -24907,6 +25061,7 @@ if (command === "passenger-sync-daemon") {
     return { action: out.action, unsafe, detail: unsafe ? describeUnsafeBase(out, remote, base) : out.detail };
   }, sandboxCacheRepos = function(c, ship) {
     const out = [];
+    let images;
     for (const t of reposOf(c)) {
       const origin = originUrlOf(t.dir, "origin");
       const repo = origin ? parseRemote(origin) : null;
@@ -24916,7 +25071,12 @@ if (command === "passenger-sync-daemon") {
         token = readForgeToken(ship.forges, repo.host, ship.stateDir);
       } catch {
       }
-      out.push({ ...repo, dir: t.dir, token, username: forgeFor(ship.forges, repo.host)?.entry.username });
+      let intelImage = null;
+      try {
+        if (intelFlavor(loadRepoConfig(t.dir)?.hooks.intel) === "serena") intelImage = sandboxImageFor(images ??= readSandboxState(ship.stateDir), t.name);
+      } catch {
+      }
+      out.push({ ...repo, dir: t.dir, token, username: forgeFor(ship.forges, repo.host)?.entry.username, intelImage });
     }
     return out;
   }, buildSandboxCachePass = function(c, ship, state2, emit2) {
@@ -25004,7 +25164,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "deprovision" || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset") || command === "deprovision";
-      if (configless && !existsSync50(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync51(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -25327,7 +25487,7 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join55(homedir11(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync50(staleTimer)) {
+      if (existsSync51(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -25354,7 +25514,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync50(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync51(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -25381,7 +25541,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync50(p);
+    const unitExists = (p) => existsSync51(p);
     const crontab = o.host === "linux" ? spawnSync11("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -25427,7 +25587,7 @@ ${changed2.map((c) => `  - ${c}
           warm = readWarmFiles(r.dir, `${r.config.branch.remote}/${r.config.branch.base}`, r.config.sandbox.warm ?? []);
         } catch {
         }
-        out.set(r.name, { name: r.name, decl: intelFlavor(r.config.hooks.intel) === "serena" ? { ...r.config.sandbox, intel: "serena" } : r.config.sandbox, warm });
+        out.set(r.name, { name: r.name, decl: intelFlavor(r.config.hooks.intel) === "serena" ? { ...r.config.sandbox, intel: "serena" } : r.config.sandbox, warm, ...wantsCodeBridge(r.config.hooks.intel) ? { bridge: readBridgeBundle() } : {} });
       }
     }
     return [...out.values()];
@@ -26842,7 +27002,7 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync50(resolvedPath) ? JSON.parse(readFileSync46(resolvedPath, "utf8")) : {};
+        const raw = existsSync51(resolvedPath) ? JSON.parse(readFileSync46(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync38(dirOf2(resolvedPath), { recursive: true });
         writeFileSync38(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -26947,8 +27107,8 @@ ${cu.tail.trimEnd()}
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
           const dir = repoDirOf(configText, dirname33(cfg.configFile), a.route, a.name);
-          if (!existsSync50(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync50(resolvePath(dir, r)), list: (r) => {
+          if (!existsSync51(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync51(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync20(resolvePath(dir, r));
             } catch {
@@ -27066,7 +27226,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync50(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync51(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -27096,7 +27256,7 @@ ${cu.tail.trimEnd()}
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       if (sub === "list" || sub === "add") {
         const liveRoute = cfg.routes.find((r) => r.route === routeName);
-        if (liveRoute?.resolved?.reposModelId && existsSync50(resolvedFile) && !dryRun) {
+        if (liveRoute?.resolved?.reposModelId && existsSync51(resolvedFile) && !dryRun) {
           try {
             await hydrateApiKeys([liveRoute]);
             persistRepoRows(cfg.ship.stateDir, liveRoute.route, await new Tracker(liveRoute, cfg.ship).repoRowsForMap());
@@ -27105,7 +27265,7 @@ ${cu.tail.trimEnd()}
         }
       }
       let resolvedRemotes;
-      if (existsSync50(resolvedFile)) {
+      if (existsSync51(resolvedFile)) {
         try {
           resolvedRemotes = JSON.parse(readFileSync46(resolvedFile, "utf8"));
         } catch {
@@ -27114,7 +27274,7 @@ ${cu.tail.trimEnd()}
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text2 = configText;
       const base = dirname33(cfg.configFile);
-      const isCheckout = (d) => existsSync50(`${d}/.git`);
+      const isCheckout = (d) => existsSync51(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -27124,7 +27284,7 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync50(d),
+              exists: (d) => existsSync51(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
@@ -27145,7 +27305,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync50(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync51(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -27157,9 +27317,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text: text2, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync50(plan2.target) && (existsSync50(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
+          if (existsSync51(plan2.target) && (existsSync51(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync50(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync51(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -27184,7 +27344,7 @@ ${cu.tail.trimEnd()}
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir11()));
-        const top = existsSync50(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync51(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -27236,7 +27396,7 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync50(resolvedFile)) {
+          if (existsSync51(resolvedFile)) {
             const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
@@ -27658,7 +27818,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync50(resolvedPath);
+        const hadPreviousFile = existsSync51(resolvedPath);
         if (hadPreviousFile) {
           try {
             previous = JSON.parse(readFileSync46(resolvedPath, "utf8"));
@@ -28190,7 +28350,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           if (subS === "images") {
             const stateS = readSandboxState(cfg.ship.stateDir);
             const rows = declared.map((r) => {
-              const plan = planSandbox(r.name, r.decl, r.warm);
+              const plan = planSandbox(r.name, r.decl, r.warm, r.bridge);
               return { repo: r.name, wants: plan.tag, tags: stateS[r.name]?.tags ?? [], ...sandboxImageStatus(stateS, plan) };
             });
             if (jsonS) {
@@ -28224,7 +28384,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           for (const t of targets) {
             await sandboxBuildTick([t], depsS, true);
             const after = readSandboxState(cfg.ship.stateDir);
-            const st = sandboxImageStatus(after, planSandbox(t.name, t.decl, t.warm));
+            const st = sandboxImageStatus(after, planSandbox(t.name, t.decl, t.warm, t.bridge));
             if (st.status === "failed") failed = true;
             process.stdout.write(`${t.name}: ${st.status} \u2014 ${st.detail}
 `);
@@ -28257,8 +28417,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
               if (mirrors.length === 0) process.stdout.write(`volume ${settings.volume}: no mirrors yet
 `);
-              for (const m of mirrors) process.stdout.write(`${m.repo.host}/${m.repo.path}  last refresh ${m.lastRefresh ?? "never"}
+              for (const m of mirrors) {
+                process.stdout.write(`${m.repo.host}/${m.repo.path}  last refresh ${m.lastRefresh ?? "never"}${m.intel ? `  intel ${m.intel.commit.slice(0, 12)} (${m.intel.indexedAt ?? "age unknown"})` : ""}
 `);
+              }
             }
           } catch (e) {
             process.stderr.write(`crew sandbox cache: ${e instanceof Error ? e.message : String(e)}
@@ -28536,7 +28698,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           prepare: async (path) => {
             for (const f of repoWt.config.worktrees.copy) {
               const src = join55(repoWt.dir, f);
-              if (!existsSync50(src) || existsSync50(join55(path, f))) continue;
+              if (!existsSync51(src) || existsSync51(join55(path, f))) continue;
               mkdirSync38(dirOf2(join55(path, f)), { recursive: true });
               copyFileSync2(src, join55(path, f));
             }
@@ -28758,7 +28920,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync50(p),
+            worktreeExists: (p) => existsSync51(p),
             prepareDropFile,
             startProxy: (wt, url, n) => launchProxy(crewInvocation(CREW_HOME), wt, url, Number(n), { host: hit.row.host || "localhost", inject: hit.repo.config.periscope?.inspector !== "repo" }),
             caps: periscopeCaps(cfg.ship),
@@ -28855,7 +29017,7 @@ ${where.join("\n")}`);
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
               const src = join55(repoP.dir, f);
-              if (!existsSync50(src)) continue;
+              if (!existsSync51(src)) continue;
               mkdirSync38(dirOf2(join55(path, f)), { recursive: true });
               copyFileSync2(src, join55(path, f));
             }
@@ -29347,7 +29509,7 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync50(resolvedFile)) {
+          if (existsSync51(resolvedFile)) {
             const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
@@ -29355,13 +29517,13 @@ ${where.join("\n")}`);
 `);
           }
         }
-        if (existsSync50(join55(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync25(dir, { recursive: true, force: true });
+        if (existsSync51(join55(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync25(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync50(join55(dir, ".git"));
-      if (existsSync50(dir) && fresh && readdirSync20(dir).length > 0) fail2(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync51(join55(dir, ".git"));
+      if (existsSync51(dir) && fresh && readdirSync20(dir).length > 0) fail2(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
@@ -29387,7 +29549,7 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync50(resolvedFile)) {
+        if (existsSync51(resolvedFile)) {
           const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
@@ -29743,7 +29905,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync50(r.dir)) {
+            if (existsSync51(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -29839,7 +30001,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync50(evFile) ? statSync16(evFile).size : 0;
+        const evSize = existsSync51(evFile) ? statSync16(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -30303,7 +30465,7 @@ ${foreign.join("\n")}
         const declaredS = await sandboxReposOf(cfg.routes.filter((r) => r.enabled));
         const stateS = readSandboxState(cfg.ship.stateDir);
         for (const r of declaredS) {
-          const st = sandboxImageStatus(stateS, planSandbox(r.name, r.decl, r.warm));
+          const st = sandboxImageStatus(stateS, planSandbox(r.name, r.decl, r.warm, r.bridge));
           process.stdout.write(`sandbox image:    ${r.name}: ${st.status.toUpperCase()} \u2014 ${st.detail}
 `);
         }