@tablation/crew 0.126.10 → 0.126.12

package/dist/cli.js

@@ -6353,7 +6353,7 @@ function attentionProblems(items, already) {
 }
 
 // src/sandbox-image.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { execFileSync as execFileSync8 } from "child_process";
 import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
@@ -6363,7 +6363,7 @@ import { tmpdir as tmpdir3 } from "os";
 
 // src/passenger-containers.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 
 // src/sandbox-cache.ts
 import { execFile as execFile2 } from "child_process";
@@ -6383,7 +6383,7 @@ import { readFileSync as readFileSync25, existsSync as existsSync26, statSync as
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
 import { join as join29, dirname as dirname14, basename as basename9 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/state.ts
 import { readFileSync as readFileSync19, writeFileSync as writeFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync13, rmSync as rmSync10, statSync as statSync7, readdirSync as readdirSync5 } from "fs";
@@ -10682,6 +10682,7 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
 // src/runner.ts
 import { spawn as spawn3, execFile, execFileSync as execFileSync6 } from "child_process";
 import { mkdtempSync, mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, rmSync as rmSync14 } from "fs";
+import { createHash as createHash4 } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
 import { basename as basename8, dirname as dirname13, join as join28 } from "path";
 import { promisify } from "util";
@@ -10777,8 +10778,9 @@ function shQuote2(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 function sandboxName(plan, now = Date.now()) {
-  const base = [plan.route, plan.role, plan.ticket ?? ""].join("-").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return `crew-${base.slice(0, 36)}-${now.toString(36)}`.replace(/-+/g, "-");
+  const h = createHash4("sha256").update([plan.route, plan.role, plan.ticket ?? ""].join("\0")).digest();
+  const tag = (h.readUInt32BE(0) % 36 ** 6).toString(36).padStart(6, "0");
+  return `crew-${tag}${now.toString(36).slice(-8).padStart(8, "0")}`;
 }
 var SandboxRunner = class {
   kind = "sandbox";
@@ -10941,7 +10943,8 @@ function runnerFor(kind, sandbox) {
 function runnerOfSidecar(sc) {
   return sc.runner === "sandbox" ? new SandboxRunner(sc.sandboxBin ? { bin: sc.sandboxBin } : {}) : new HostRunner();
 }
-function checkSandboxRunner(cfg = {}, run3 = (b, a) => execFileSync6(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 })) {
+var PROBE_CREATE_TIMEOUT_MS = 12e4;
+function checkSandboxRunner(cfg = {}, run3 = (b, a, t) => execFileSync6(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: t ?? 15e3 })) {
   const bin = cfg.bin ?? DEFAULT_SANDBOX_CONFIG.bin;
   let version;
   try {
@@ -10958,6 +10961,21 @@ function checkSandboxRunner(cfg = {}, run3 = (b, a) => execFileSync6(b, a, { enc
       detail: `${version}: the gateway does not answer (${(err3.stderr || err3.message).trim().split("\n").filter(Boolean).slice(0, 2).join(" / ")}). Start it; on Docker Desktop its docker section needs supervisor_network_mode = "bridge", and allow_driver_config = true for the cache volume mount.`
     };
   }
+  const probe = sandboxName({ route: "doctor", role: "dev", ticket: void 0 });
+  try {
+    run3(bin, ["sandbox", "create", "--name", probe, "--detach", "--", "sleep", "60"], PROBE_CREATE_TIMEOUT_MS);
+  } catch (e) {
+    const err3 = e;
+    if (err3.code === "ETIMEDOUT" || err3.killed) {
+      return { ok: false, detail: `${version}: creating a probe sandbox named ${probe} timed out after ${PROBE_CREATE_TIMEOUT_MS / 1e3} s; the gateway may still be pulling its images on a first create, so run crew doctor again` };
+    }
+    return { ok: false, detail: `${version}: the gateway refused a probe sandbox named ${probe} (${(err3.stderr || err3.message).trim().split("\n").filter(Boolean).slice(0, 2).join(" / ")})` };
+  } finally {
+    try {
+      run3(bin, ["sandbox", "delete", probe]);
+    } catch {
+    }
+  }
   return { ok: true, detail: version };
 }
 
@@ -11144,7 +11162,7 @@ function planAgentRun(o) {
     brief: expanded.text,
     digest
   });
-  const promptSha = createHash4("sha256").update(expanded.text).digest("hex");
+  const promptSha = createHash5("sha256").update(expanded.text).digest("hex");
   const streamsDir = join29(o.stateDir, "streams");
   const base = `${routeLabel}-${o.role}-${o.cycle}${o.runId ? `-${o.runId}` : ""}`;
   const seat = resolveSeat(o.ship, o.route, o.role, o.agentPersona ?? (o.agentModel ? { model: o.agentModel } : {}), o.repo);
@@ -12097,8 +12115,8 @@ async function mintMissingSeatKeys(route2, o) {
   const resolved = route2.resolved;
   const doFetch = o.fetchImpl ?? fetch;
   const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
   ];
   let store;
   try {
@@ -12127,7 +12145,7 @@ async function mintMissingSeatKeys(route2, o) {
       return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
     }
   }
-  for (const { role, agentId } of targets) {
+  for (const { role, agentId, actorRecordId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
       continue;
@@ -12149,7 +12167,7 @@ async function mintMissingSeatKeys(route2, o) {
           "Content-Type": "application/json",
           "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
         },
-        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}`, ...actorRecordId ? { actorRecordId } : {} })
       });
       if (res.status === 403) {
         out.push({ role, action: "forbidden" });
@@ -12220,8 +12238,8 @@ async function revokeSeatKeys(route2, o) {
   const resolved = route2.resolved;
   const doFetch = o.fetchImpl ?? fetch;
   const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
   ];
   let store;
   try {
@@ -12751,12 +12769,12 @@ function containerNameFor(workspaceId) {
   return `crew-passenger-${workspaceId}`;
 }
 function portFor(workspaceId, base = 28765, span = 1e3) {
-  const digest = createHash5("sha256").update(workspaceId).digest();
+  const digest = createHash6("sha256").update(workspaceId).digest();
   return base + digest.readUInt32BE(0) % span;
 }
 function mountsDigest(mounts, image) {
   const sorted2 = [...mounts].sort((a, b) => a.containerPath.localeCompare(b.containerPath));
-  return createHash5("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
 }
 function planContainers(cfg) {
   const byWorkspace = /* @__PURE__ */ new Map();
@@ -12959,7 +12977,7 @@ echo "password=$CREW_FORGE_TOKEN"
 `;
 var MCP_CONFIG = `${JSON.stringify({ mcpServers: {} }, null, 2)}
 `;
-var hash = (parts) => createHash6("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 12);
+var hash = (parts) => createHash7("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 12);
 var slug = (s) => s.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
 var run2 = (cmd) => `RUN ["/bin/bash", "-c", ${JSON.stringify(`set -euo pipefail; ${cmd}`)}]`;
 var CREW_ENV = {
@@ -13577,7 +13595,7 @@ function doctorSelftestLines(stored, toolchains) {
 // src/cli.ts
 import { resolve as resolve7, dirname as dirname34, join as join56, basename as basename16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { hostname as hostname4, homedir as homedir11 } from "os";
+import { hostname as hostname5, homedir as homedir11 } from "os";
 import { spawnSync as spawnSync11 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
 
@@ -14384,13 +14402,13 @@ import { hostname as hostname3 } from "os";
 
 // src/machine-id.ts
 import { execFileSync as execFileSync10 } from "child_process";
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname19, join as join37 } from "path";
 function machineIdPathFor(stateDir) {
   return join37(stateDir, "machine-id");
 }
-var sha256 = (s) => createHash7("sha256").update(s).digest("hex");
+var sha256 = (s) => createHash8("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
@@ -17445,7 +17463,7 @@ function flagWizardAnswers(f, env) {
 // src/release-run.ts
 import { readFileSync as readFileSync36, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
 import { dirname as dirname24, join as join43 } from "path";
-import { tmpdir as tmpdir5 } from "os";
+import { tmpdir as tmpdir5, hostname as hostname4 } from "os";
 
 // src/release.ts
 function describeUnplaceable(unplaceable, verifiedStatus) {
@@ -18132,6 +18150,17 @@ async function confirmExternalReleased(o, closures) {
     return { ...c, confirmed, version };
   });
 }
+var mergeFailed = (r) => typeof r === "object" && ("conflict" in r || "error" in r);
+function ensureCommitterIdentity(o) {
+  if (gitOk(o.cwd, ["var", "GIT_COMMITTER_IDENT"])) return;
+  const ship = hostname4().split(".")[0] || "ship";
+  git(o.cwd, ["config", "user.name", `Crew (${ship})`]);
+  git(o.cwd, ["config", "user.email", `crew@${ship}`]);
+  o.emit.warn(`no git committer identity here \u2014 set a checkout-local one, Crew (${ship}), for the release commit`);
+}
+function isConflict(message, unmergedPaths) {
+  return unmergedPaths.length > 0 || /CONFLICT \(|Automatic merge failed|unmerged (files|paths)/i.test(message);
+}
 function mergeOne(o, c) {
   const subject = c.entries[0] ?? `${c.ticket.title ?? c.ticket.issue_id} (${c.ticket.issue_id})`;
   if (o.dryRun) {
@@ -18139,7 +18168,11 @@ function mergeOne(o, c) {
     return { applied: true };
   }
   const before = headSha(o.cwd);
+  const clearFailure = () => {
+    o.attention?.clear(`release_merge_failed:${o.scope ?? "release"}`);
+  };
   try {
+    ensureCommitterIdentity(o);
     git(o.cwd, ["merge", "--squash", c.branch]);
     if (!git(o.cwd, ["diff", "--cached", "--name-only"])) {
       git(o.cwd, ["reset", "--hard", before]);
@@ -18147,6 +18180,7 @@ function mergeOne(o, c) {
         `${c.branch} is already contained in the integration branch \u2014 nothing to apply`,
         { ticket: c.ticket.issue_id }
       );
+      clearFailure();
       return "noop";
     }
     const tip = gitOk(o.cwd, ["rev-parse", "--verify", "-q", `${c.branch}^{commit}`]);
@@ -18158,12 +18192,25 @@ ${BRANCH_TIP_TRAILER}: ${tip}` : "";
 Closes ${c.ticket.issue_id}.${trailer}`]);
     const sha = headSha(o.cwd);
     o.emit.emit(`merged ${c.branch}`, { ticket: c.ticket.issue_id });
+    clearFailure();
     return { applied: true, sha };
   } catch (e) {
     const paths = (gitOk(o.cwd, ["diff", "--name-only", "--diff-filter=U"]) ?? "").split("\n").filter(Boolean);
     gitOk(o.cwd, ["reset", "--hard", before]);
-    o.emit.error(`could not merge ${c.branch}: ${e.message}`, { ticket: c.ticket.issue_id });
-    return { conflict: { candidate: c, paths, message: e.message } };
+    const message = e.message;
+    o.emit.error(`could not merge ${c.branch}: ${message}`, { ticket: c.ticket.issue_id });
+    if (!isConflict(message, paths)) {
+      if (o.attention) {
+        void o.attention.raise({
+          kind: "release_merge_failed",
+          key: `release_merge_failed:${o.scope ?? "release"}`,
+          message: `${o.scope ?? "release"}: could not merge ${c.branch} (${c.ticket.issue_id}) \u2014 not a conflict, so the ticket stays verified and is retried: ${message.slice(0, 400)}`,
+          since: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+      return { error: message };
+    }
+    return { conflict: { candidate: c, paths, message } };
   }
 }
 async function bump(o, size) {
@@ -18558,7 +18605,7 @@ async function isolateAndRetry(o, name, output, merged, preMerge, decision, fres
     for (const c of applied) {
       gitOk(o.cwd, ["reset", "--hard", preMerge]);
       const m = mergeOne(o, c);
-      if (typeof m === "object" && "conflict" in m) continue;
+      if (mergeFailed(m)) continue;
       const r = await hook(o, name);
       if (r && r.code !== 0) {
         o.emit.warn(`${c.branch} fails the ${name} hook on its own`, { ticket: c.ticket.issue_id });
@@ -18570,8 +18617,8 @@ async function isolateAndRetry(o, name, output, merged, preMerge, decision, fres
       for (const [i, j] of pairs) {
         gitOk(o.cwd, ["reset", "--hard", preMerge]);
         const a = mergeOne(o, applied[i]);
-        const b = typeof a === "object" && "conflict" in a ? a : mergeOne(o, applied[j]);
-        if (typeof b === "object" && "conflict" in b) continue;
+        const b = mergeFailed(a) ? a : mergeOne(o, applied[j]);
+        if (mergeFailed(b)) continue;
         const r = await hook(o, name);
         if (r && r.code !== 0) {
           o.emit.warn(`${applied[j].branch} fails the ${name} hook together with ${applied[i].branch}`, { ticket: applied[j].ticket.issue_id });
@@ -18588,7 +18635,7 @@ async function isolateAndRetry(o, name, output, merged, preMerge, decision, fres
           let clean = true;
           for (const c of applied.slice(0, mid)) {
             const m = mergeOne(o, c);
-            if (typeof m === "object" && "conflict" in m) {
+            if (mergeFailed(m)) {
               clean = false;
               break;
             }
@@ -18659,6 +18706,7 @@ async function mergeAndRelease(o, decision, fresh, releaseBranch, isolated = fal
       conflicts.push(r.conflict);
       continue;
     }
+    if (typeof r === "object" && "error" in r) continue;
     if (typeof r === "object" && r.applied) {
       applied++;
       c.sha = r.sha;
@@ -20572,7 +20620,7 @@ async function runAgentsSync(target, o) {
 }
 
 // src/logbook.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
 var LogbookError = class extends Error {
 };
@@ -20658,7 +20706,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
     };
   }
   const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
-  const actualSha = createHash8("sha256").update(prompt).digest("hex");
+  const actualSha = createHash9("sha256").update(prompt).digest("hex");
   const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
   return {
     entry,
@@ -22240,7 +22288,7 @@ function shipIdentityJson(s) {
 }
 
 // src/mcp-endpoint-registry.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function endpointsUrl(api, workspaceId, id) {
   const base = `${api.baseUrl.replace(/\/+$/, "")}/api/workspaces/${workspaceId}/mcp-endpoints`;
   return id ? `${base}/${id}` : base;
@@ -22310,7 +22358,7 @@ async function probeEndpointAccess(api, workspaceId) {
 }
 var REGISTER_MCP_ENDPOINTS_HINT = "give this key's role the REGISTER_MCP_ENDPOINTS capability, e.g. via the group that holds the Crew project role";
 function registrationKey(url, mcpSecret, controlUrl) {
-  return createHash9("sha256").update(`${url}
+  return createHash10("sha256").update(`${url}
 ${mcpSecret ?? ""}
 ${controlUrl ?? ""}`).digest("hex").slice(0, 16);
 }
@@ -23693,7 +23741,7 @@ async function buildEnvironment(route2, ship, ticket) {
 }
 
 // src/control-api.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync6,
@@ -23953,7 +24001,7 @@ var ControlAuth = class {
     if (!token) return "unauthorized";
     for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
     const now = (this.o.now ?? Date.now)();
-    const id = createHash10("sha256").update(token).digest("hex");
+    const id = createHash11("sha256").update(token).digest("hex");
     const hit = this.cache.get(id);
     if (hit && now - hit.at < (this.o.cacheMs ?? 6e4)) return hit.verdict;
     const verdict = await this.ask(token);
@@ -23974,7 +24022,7 @@ var ControlAuth = class {
     for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
     for (const k of this.o.workspaceSecrets?.(workspaceId) ?? []) if (k && secretsMatch(token, k)) return "ok";
     const now = (this.o.now ?? Date.now)();
-    const id = `${workspaceId}:${createHash10("sha256").update(token).digest("hex")}`;
+    const id = `${workspaceId}:${createHash11("sha256").update(token).digest("hex")}`;
     const hit = this.cache.get(id);
     if (hit && now - hit.at < (this.o.cacheMs ?? 6e4)) return hit.verdict;
     const verdict = await this.ask(token, [workspaceId]);
@@ -25367,7 +25415,7 @@ if (command === "passenger-sync-daemon") {
     };
     if (command === "connect" && !flag("sign-out") && usesFlagAnswers(wizardFlags, connectIsTTY) && shouldRunWizard({ isTTY: true, crewHome: CREW_HOME })) {
       const flagged = flagWizardAnswers(wizardFlags, {
-        hostname: hostname4(),
+        hostname: hostname5(),
         platform: hostPlatform(),
         pathEnv: process.env.PATH ?? "",
         nodePath: process.execPath,
@@ -25392,7 +25440,7 @@ if (command === "passenger-sync-daemon") {
       let answers;
       try {
         answers = await runWizard(prompter, {
-          hostname: hostname4(),
+          hostname: hostname5(),
           platform: hostPlatform(),
           pathEnv: process.env.PATH ?? "",
           nodePath: process.execPath,
@@ -27949,7 +27997,7 @@ ${reconstruction.prompt}
         let result;
         try {
           result = await loginWithDeviceCode(`${baseUrl}/api`, {
-            deviceName: `crew on ${hostname4()}`,
+            deviceName: `crew on ${hostname5()}`,
             // Lets the approval page preselect the workspace this connect is for.
             // A bare `crew connect` has none and passes nothing.
             ...workspace ? { workspaceSlug: workspace } : {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.10",
+  "version": "0.126.12",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",