@tablation/crew 0.126.4 → 0.126.5

package/dist/cli.js

@@ -15097,6 +15097,12 @@ function sshArgsFor(o) {
     "ServerAliveCountMax=3",
     "-o",
     "ExitOnForwardFailure=yes",
+    // Offer only the ship key. Without this OpenSSH offers every ssh-agent key
+    // before the `-i` one, the relay hashes whichever it sees first, and a
+    // slug owned by the ship key's fingerprint is rejected as a conflict
+    // (CREW-2932).
+    "-o",
+    "IdentitiesOnly=yes",
     "-i",
     o.privateKeyPath,
     "-p",
@@ -15173,6 +15179,7 @@ function isPidAlive(pid) {
   }
 }
 var CONTROL_ONLY_HASH = "control-only";
+var TUNNEL_REJECTED_AFTER = 2;
 function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, stateDir, mcpSecrets = /* @__PURE__ */ new Map(), deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
   const plannedIds = new Set(plans.map((p) => p.workspaceId));
@@ -15203,6 +15210,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       deps.onStatus?.(plan.workspaceId, "disconnected", existing);
       continue;
     }
+    const diedQuickly = existing !== void 0 && existing.status === "connecting" && !alive(existing.pid) && controlUnchanged && secretUnchanged && slugUnchanged && existing.mountsHash === mountsHash;
+    const quickExits = diedQuickly ? (existing.quickExits ?? 0) + 1 : 0;
     let settledStatus = "connecting";
     const tunnel = startTunnel({
       relayHost,
@@ -15230,6 +15239,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       mcpSecret: currentSecret,
       slug: slug2,
       liveSlug: slug2,
+      quickExits,
       endpointId: existing?.endpointId,
       registeredKey: existing?.registeredKey
     };
@@ -15254,6 +15264,18 @@ function readAllPersistedWorkspaceIds(stateDir) {
   if (!existsSync35(dir)) return [];
   return readdirSync13(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
+var TUNNEL_REJECTED_KEY = "tunnel_rejected";
+function tunnelRejectedMessage(workspaceId, quickExits) {
+  return `the relay tunnel for workspace ${workspaceId} exited before settling on ${quickExits} consecutive cycles, which is how a refused claim looks (the relay logs "slug already owned by another workspace/ssh key") \u2014 rotate the slug with \`crew rotate-passenger-url\` or check the relay journal`;
+}
+function rejectedTunnels(stateDir) {
+  const out = [];
+  for (const workspaceId of readAllPersistedWorkspaceIds(stateDir)) {
+    const q2 = readPersistedTunnel(stateDir, workspaceId)?.quickExits ?? 0;
+    if (q2 >= TUNNEL_REJECTED_AFTER) out.push({ workspaceId, quickExits: q2 });
+  }
+  return out;
+}
 
 // src/pool-member-host.ts
 function loadShip(crewHome) {
@@ -25442,6 +25464,15 @@ if (command === "passenger-sync-daemon") {
             })
           );
           if (status2 === "disconnected") pending.push(unregisterEndpoint(workspaceId, info, reconcile));
+          const rejectedKey = `${TUNNEL_REJECTED_KEY}:${workspaceId}`;
+          if ((info?.quickExits ?? 0) >= TUNNEL_REJECTED_AFTER) {
+            pending.push(raiseShipAttention({ state, emit, route: owningRoute, ship: cfg.ship }, {
+              kind: TUNNEL_REJECTED_KEY,
+              key: rejectedKey,
+              message: tunnelRejectedMessage(workspaceId, info.quickExits),
+              since: (/* @__PURE__ */ new Date()).toISOString()
+            }).then(() => void 0).catch(() => void 0));
+          } else if (status2 === "connected") clearShipAttention(state, rejectedKey);
         }
       });
       for (const plan of containerPlans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
@@ -30122,6 +30153,9 @@ watermark:  ${state.watermark()}
         if (!flag("offline")) {
           for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
         }
+        for (const t of rejectedTunnels(cfg.ship.stateDir)) {
+          problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -30142,6 +30176,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 `
       );
       for (const w of roleCapWarnings(cfg.ship)) process.stdout.write(`role concurrency: WARN ${w}
+`);
+      for (const t of rejectedTunnels(cfg.ship.stateDir)) process.stdout.write(`relay tunnel:      ATTENTION ${tunnelRejectedMessage(t.workspaceId, t.quickExits)}
 `);
       process.stdout.write(`periscopes:        ${periscopeSummary(cfg)}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.4",
+  "version": "0.126.5",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",