@tablation/crew 0.126.12 → 0.127.1

package/dist/cli.js

@@ -10821,7 +10821,8 @@ var SandboxRunner = class {
     }
     const create2 = ["sandbox", "create", "--name", name, "--detach"];
     if (policyFile) create2.push("--policy", policyFile);
-    if (cfg.image) create2.push("--from", cfg.image);
+    const image = cfg.image ?? plan.sandboxImage;
+    if (image) create2.push("--from", image);
     if (cfg.cacheVolume) {
       create2.push("--driver-config-json", JSON.stringify({
         docker: { mounts: [{ type: "volume", source: cfg.cacheVolume, target: cfg.mirrorDir, read_only: true }] }
@@ -11041,6 +11042,15 @@ function sandboxLspPluginFor(route2, repo) {
     return void 0;
   }
 }
+function sandboxImageOf(route2, repo, stateDir) {
+  let declares = false;
+  try {
+    const dir = reposOf(route2).find((r) => r.name === repo)?.dir ?? route2.dir;
+    declares = Boolean(loadRepoConfig(dir)?.sandbox);
+  } catch {
+  }
+  return sandboxImageForRun(readSandboxState(stateDir), repo, declares) ?? void 0;
+}
 var AgentSpawnError = class extends AgentError {
 };
 var WorkspaceAuthRefused = class extends AgentSpawnError {
@@ -11181,6 +11191,7 @@ function planAgentRun(o) {
   const code = codeBridgeFor(o, adapter.harness);
   const sandboxLsp = o.ship.runner === "sandbox" && adapter.harness === "claude" ? sandboxLspPluginFor(o.route, o.repo) : void 0;
   const sandboxOrigin = o.ship.runner === "sandbox" ? sandboxOriginFor(o.route, o.repo) : void 0;
+  const sandboxImage = o.ship.runner === "sandbox" ? sandboxImageOf(o.route, o.repo, o.stateDir) : void 0;
   const sandboxFiles = [...code?.files ?? [], ...sandboxLsp?.files ?? []];
   const invocation = adapter.invocation(toolchain, {
     code,
@@ -11234,6 +11245,7 @@ function planAgentRun(o) {
       runner: "sandbox",
       ...o.ship.sandbox ? { sandboxConfig: o.ship.sandbox } : {},
       ...sandboxOrigin ? { sandboxOrigin } : {},
+      ...sandboxImage ? { sandboxImage } : {},
       sandboxPolicy: sandboxPolicyInputFor(o.route, toolchain, { harnessBin: invocation.bin, repo: o.repo, sandbox: o.ship.sandbox }),
       ...sandboxFiles.length ? { sandboxFiles } : {}
     } : {},
@@ -13104,6 +13116,8 @@ function planSandbox(repo, decl, warm = {}, bridge) {
   const layer = repoLayer(repo, decl, crew, warm);
   return { repo, tag: layer.tag, claude: SANDBOX_CLAUDE_VERSION, layers: [base, crew, layer] };
 }
+var SHIP_SANDBOX_KEY = "@ship";
+var shipSandboxRef = () => ({ name: SHIP_SANDBOX_KEY, decl: { packages: [], setup: [] } });
 var sandboxStatePath = (stateDir) => join32(stateDir, "sandbox-images.json");
 function readSandboxState(stateDir) {
   try {
@@ -13123,6 +13137,9 @@ function writeSandboxState(stateDir, state) {
 function sandboxImageFor(state, repo) {
   return state[repo]?.tags[0]?.tag ?? null;
 }
+function sandboxImageForRun(state, repo, declares) {
+  return (declares && repo ? sandboxImageFor(state, repo) : null) ?? sandboxImageFor(state, SHIP_SANDBOX_KEY);
+}
 function sandboxImageStatus(state, plan) {
   const s = state[plan.repo];
   const current = s?.tags[0];
@@ -13236,7 +13253,7 @@ async function sandboxBuildTick(repos, deps, force = false) {
 }
 
 // src/doctor-checks.ts
-import { execFileSync as execFileSync9 } from "child_process";
+import { execFileSync as execFileSync9, spawnSync as spawnSync8 } from "child_process";
 var PROBE_BRANCH = "crew-probe-branch";
 var realGit = (cwd, args, env) => {
   execFileSync9("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
@@ -13369,6 +13386,21 @@ function managedRuntimeWarnings(kind, ship) {
   }
   return out;
 }
+var MANAGED_GIT_EMAIL = "crew@tablation.dev";
+function readGlobalGitIdentity() {
+  const get2 = (key) => {
+    const res = spawnSync8("git", ["config", "--global", "--get", key], { encoding: "utf8" });
+    const v = (res.stdout ?? "").trim();
+    return res.status === 0 && v ? v : null;
+  };
+  return { name: get2("user.name"), email: get2("user.email") };
+}
+function managedGitIdentityWarnings(kind, identity) {
+  if (kind !== "managed_instance" && kind !== "pooled_instance" && kind !== "pooled") return [];
+  const missing = [identity.name ? "" : "user.name", identity.email ? "" : "user.email"].filter(Boolean);
+  if (missing.length === 0) return [];
+  return [`git ${missing.join(" and ")} not set for this user on a ${kind} ship; every commit crew makes here fails with "Committer identity unknown" (re-run \`crew provision\`, or \`git config --global user.name <ship name>\` and \`user.email ${MANAGED_GIT_EMAIL}\`)`];
+}
 
 // src/selftest.ts
 import { spawn as spawn6 } from "child_process";
@@ -13596,7 +13628,7 @@ function doctorSelftestLines(stored, toolchains) {
 import { resolve as resolve7, dirname as dirname34, join as join56, basename as basename16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { hostname as hostname5, homedir as homedir11 } from "os";
-import { spawnSync as spawnSync11 } from "child_process";
+import { spawnSync as spawnSync12 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
 
 // src/argv.ts
@@ -14451,7 +14483,7 @@ function matchShipRows(ships, shipName2, machineId) {
 }
 
 // src/provision.ts
-import { spawnSync as spawnSync8 } from "child_process";
+import { spawnSync as spawnSync9 } from "child_process";
 import { existsSync as existsSync34, readFileSync as readFileSync33, writeFileSync as writeFileSync26 } from "fs";
 import { hostname as hostname2 } from "os";
 import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
@@ -14899,6 +14931,11 @@ async function runProvision(o, deps, write, human) {
       emit("connect", `set ${key}`, { setting: key });
     }
   }
+  if (isManagedShipKind(o.shipKind)) {
+    summary.gitIdentity = deps.ensureGitIdentity(shipName2, MANAGED_GIT_EMAIL);
+    if (summary.gitIdentity === "set") summary.changed = true;
+    emit("git_identity", `git identity: ${summary.gitIdentity}`, { action: summary.gitIdentity });
+  }
   for (const host of o.forgeHosts) {
     const token = o.tokens[host];
     const stored = deps.storedToken(host);
@@ -15055,7 +15092,7 @@ function realProvisionDeps(crewHome) {
     const env = { ...process.env, ...o.env };
     delete env.CREW_FORGE_TOKEN;
     for (const k of Object.keys(env)) if (k.startsWith("CREW_CONNECT_KEY_")) delete env[k];
-    const res = spawnSync8(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
+    const res = spawnSync9(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
     return { status: res.status ?? 1, stdout: res.stdout ?? "", stderr: `${res.stderr ?? ""}${res.error ? String(res.error) : ""}` };
   };
   const configFile = () => {
@@ -15103,15 +15140,15 @@ function realProvisionDeps(crewHome) {
       if (mechanism === "systemd") {
         const system = ctx.root || existsSync34(systemUnitPathFor(label));
         const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
-        running = spawnSync8(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
+        running = spawnSync9(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
         if (!system) {
-          const out = spawnSync8("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
+          const out = spawnSync9("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
           lingering = /Linger=yes/.test(out.stdout ?? "");
         }
       } else if (mechanism === "cron") {
         running = true;
       } else if (mechanism === "launchd") {
-        running = spawnSync8("launchctl", ["list", label]).status === 0;
+        running = spawnSync9("launchctl", ["list", label]).status === 0;
       }
       return { mechanism, unitsStale, running, lingering };
     },
@@ -15132,6 +15169,17 @@ function realProvisionDeps(crewHome) {
       if (wrote.length) writeFileSync26(file, doc.toString());
       return wrote;
     },
+    ensureGitIdentity(name, email) {
+      const have = readGlobalGitIdentity();
+      let wrote = false;
+      for (const [key, value2] of [["user.name", have.name ? null : name], ["user.email", have.email ? null : email]]) {
+        if (value2 === null) continue;
+        const res = spawnSync9("git", ["config", "--global", key, value2], { encoding: "utf8" });
+        if (res.status !== 0) throw new Error(`git config --global ${key}: ${(res.stderr ?? "").trim() || `exited ${res.status}`}`);
+        wrote = true;
+      }
+      return wrote ? "set" : "kept";
+    },
     storedToken(host) {
       const res = spawnCrew(["credential", "get"], { input: `protocol=https
 host=${host}
@@ -20721,7 +20769,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
 }
 
 // src/repos-check.ts
-import { spawnSync as spawnSync10 } from "child_process";
+import { spawnSync as spawnSync11 } from "child_process";
 import { readFileSync as readFileSync39 } from "fs";
 import { basename as basename11 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
@@ -20730,10 +20778,10 @@ function checkHookSyntax(script, shell) {
   const name = basename11(spec.bin).replace(/\.exe$/i, "").toLowerCase();
   let run3;
   if (POSIX_SHELL.test(name)) {
-    run3 = spawnSync10(spec.bin, ["-n"], { input: script, encoding: "utf8" });
+    run3 = spawnSync11(spec.bin, ["-n"], { input: script, encoding: "utf8" });
   } else if (/^(pwsh|powershell)$/.test(name)) {
     const parse3 = "$e=$null;[void][System.Management.Automation.Language.Parser]::ParseInput($env:CREW_CHECK_SCRIPT,[ref]$null,[ref]$e);if($e){$e|ForEach-Object{[Console]::Error.WriteLine($_.Message)};exit 1}";
-    run3 = spawnSync10(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
+    run3 = spawnSync11(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
       encoding: "utf8",
       env: { ...process.env, CREW_CHECK_SCRIPT: script }
     });
@@ -25814,7 +25862,7 @@ if (command === "passenger-sync-daemon") {
 `
         );
         if (!dryRun) {
-          spawnSync11("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
+          spawnSync12("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
           try {
             unlinkSync5(staleTimer);
           } catch {
@@ -25865,7 +25913,7 @@ if (command === "passenger-sync-daemon") {
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
     const unitExists = (p) => existsSync52(p);
-    const crontab = o.host === "linux" ? spawnSync11("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
+    const crontab = o.host === "linux" ? spawnSync12("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
     for (const n of plan.notes) process.stdout.write(`fix: ${n}
@@ -25924,6 +25972,7 @@ ${changed2.map((c) => `  - ${c}
     }
     return [...out.values()];
   }
+  const withShipSandbox = (declared) => cfg.ship.runner === "sandbox" ? [shipSandboxRef(), ...declared] : declared;
   async function resolveOneRepo(c, t) {
     {
       const id = repoIdForName(c, t.name);
@@ -27035,7 +27084,7 @@ ${cu.tail.trimEnd()}
           }
           let failed = false;
           for (const cmd2 of commands) {
-            const res2 = spawnSync11(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+            const res2 = spawnSync12(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
             if (res2.stdout) process.stdout.write(res2.stdout);
             if (res2.stderr) process.stderr.write(res2.stderr);
             if (cmd2 === control.startCommand && (res2.error || res2.status !== 0)) {
@@ -27053,7 +27102,7 @@ ${cu.tail.trimEnd()}
 `);
           break;
         }
-        const res = spawnSync11(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+        const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
         if (res.stdout) process.stdout.write(res.stdout);
         if (res.stderr) process.stderr.write(res.stderr);
         if (daemonSub !== "status" && (res.error || res.status !== 0)) {
@@ -27192,7 +27241,7 @@ ${cu.tail.trimEnd()}
         onPass: (result) => {
           if (!sandboxBuilding) {
             sandboxBuilding = true;
-            void sandboxReposOf(cfg.routes.filter((r) => r.enabled)).then((repos) => repos.length ? sandboxBuildTick(repos, sandboxTickDeps(emit, route2)) : null).catch((err3) => emit.warn(`sandbox image build tick failed: ${err3 instanceof Error ? err3.message : String(err3)}`)).finally(() => {
+            void sandboxReposOf(cfg.routes.filter((r) => r.enabled)).then(withShipSandbox).then((repos) => repos.length ? sandboxBuildTick(repos, sandboxTickDeps(emit, route2)) : null).catch((err3) => emit.warn(`sandbox image build tick failed: ${err3 instanceof Error ? err3.message : String(err3)}`)).finally(() => {
               sandboxBuilding = false;
             });
           }
@@ -28726,7 +28775,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             }
             throw e;
           }
-          const declared = await sandboxReposOf(routesS);
+          const declared = withShipSandbox(await sandboxReposOf(routesS));
           if (subS === "images") {
             const stateS = readSandboxState(cfg.ship.stateDir);
             const rows = declared.map((r) => {
@@ -28753,8 +28802,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const only = positional[2];
           const targets = only ? declared.filter((r) => r.name === only) : declared;
           if (targets.length === 0) {
-            process.stderr.write(only ? `crew: no repository "${only}" declares a sandbox: section
-` : "crew: no repository declares a sandbox: section in its .crew.yaml\n");
+            process.stderr.write(only ? `crew: no repository "${only}" declares a sandbox: section (${SHIP_SANDBOX_KEY} is the ship's crew layer, built only on a ship.runner: sandbox ship)
+` : "crew: this ship is not a sandbox ship and no repository declares a sandbox: section in its .crew.yaml\n");
             process.exit(2);
           }
           const emitS = new Emitter({ route: routesS[0].route, eventFile: eventFileFor(cfg.ship.stateDir), rotateBytes: cfg.ship.eventsRotateBytes, logFile: cfg.ship.logFile, console: (l) => process.stderr.write(`${l}
@@ -29510,7 +29559,7 @@ ${where.join("\n")}`);
           process.stdout.write(upOutput(res, terminal));
           const opener = openerFor(process.platform);
           if (opener && shouldOpen({ open: flag("open"), noOpen: flag("no-open"), json: jsonP, terminal })) {
-            const r = spawnSync11(opener, [res.url], { stdio: "ignore" });
+            const r = spawnSync12(opener, [res.url], { stdio: "ignore" });
             if (r.error || r.status !== 0) process.stderr.write(`crew periscope: could not open ${res.url} with ${opener}
 `);
           }
@@ -29758,7 +29807,7 @@ ${where.join("\n")}`);
       }
       const host = hostPlatform();
       const control = host === "windows" ? null : planDaemonControl(CREW_HOME, host, detectSystemd());
-      const unitStatus = control?.statusCommand ? spawnSync11(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
+      const unitStatus = control?.statusCommand ? spawnSync12(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
       const unitRunning = unitStatus !== null && !unitStatus.error && unitStatus.status === 0;
       if (!unitRunning) {
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
@@ -29772,7 +29821,7 @@ ${where.join("\n")}`);
       );
       if (flag("now") && control?.stopCommand && control.startCommand) {
         for (const cmd of [control.stopCommand, control.startCommand]) {
-          const res = spawnSync11(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+          const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
           if (cmd === control.startCommand && (res.error || res.status !== 0)) {
             process.stderr.write(`crew reload: ${cmd.join(" ")} exited ${res.status ?? "error"}
 `);
@@ -29914,7 +29963,7 @@ ${where.join("\n")}`);
         writeFileSync38(join56(dir, "README.md"), SAMPLE_README);
         writeFileSync38(join56(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
-          const r = spawnSync11("git", a, { cwd: dir, encoding: "utf8" });
+          const r = spawnSync12("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail2(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
         };
         g("init", "-b", "main");
@@ -30346,7 +30395,9 @@ watermark:  ${state.watermark()}
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
         if (!flag("offline")) {
-          for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+          const shipKind = await doctorShipKind(route2, cfg.ship);
+          for (const message of managedRuntimeWarnings(shipKind, cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+          for (const message of managedGitIdentityWarnings(shipKind, readGlobalGitIdentity())) problems.push({ severity: "attention", kind: "managed_git_identity", message });
         }
         for (const t of rejectedTunnels(cfg.ship.stateDir)) {
           problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
@@ -30597,6 +30648,8 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
 `
           );
           for (const w of managedRuntimeWarnings(row.kind, cfg.ship)) process.stdout.write(`managed runtime:  WARN ${w}
+`);
+          for (const w of managedGitIdentityWarnings(row.kind, readGlobalGitIdentity())) process.stdout.write(`managed git:      WARN ${w}
 `);
         }
       }
@@ -30853,7 +30906,7 @@ ${foreign.join("\n")}
         }
       }
       {
-        const declaredS = await sandboxReposOf(cfg.routes.filter((r) => r.enabled));
+        const declaredS = withShipSandbox(await sandboxReposOf(cfg.routes.filter((r) => r.enabled)));
         const stateS = readSandboxState(cfg.ship.stateDir);
         for (const r of declaredS) {
           const st = sandboxImageStatus(stateS, planSandbox(r.name, r.decl, r.warm, r.bridge));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.12",
+  "version": "0.127.1",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",