@tablation/crew 0.126.4 → 0.126.6

package/dist/cli.js

@@ -690,9 +690,9 @@ function urlPort(url) {
     return void 0;
   }
 }
-function portListening(port, timeoutMs = 500) {
+function hostListening(port, host, timeoutMs) {
   return new Promise((resolve8) => {
-    const s = connect({ port, host: "127.0.0.1" });
+    const s = connect({ port, host });
     const done = (ok) => {
       s.destroy();
       resolve8(ok);
@@ -702,6 +702,10 @@ function portListening(port, timeoutMs = 500) {
     s.once("error", () => done(false));
   });
 }
+async function portListening(port, timeoutMs = 500) {
+  if (await hostListening(port, "127.0.0.1", timeoutMs)) return true;
+  return hostListening(port, "::1", timeoutMs);
+}
 async function periscopesForStatus(stateDir, probe = portListening) {
   return Promise.all(readPeriscopeSidecars(stateDir).map(async (sc) => {
     const port = urlPort(sc.url);
@@ -15097,6 +15101,12 @@ function sshArgsFor(o) {
     "ServerAliveCountMax=3",
     "-o",
     "ExitOnForwardFailure=yes",
+    // Offer only the ship key. Without this OpenSSH offers every ssh-agent key
+    // before the `-i` one, the relay hashes whichever it sees first, and a
+    // slug owned by the ship key's fingerprint is rejected as a conflict
+    // (CREW-2932).
+    "-o",
+    "IdentitiesOnly=yes",
     "-i",
     o.privateKeyPath,
     "-p",
@@ -15173,6 +15183,7 @@ function isPidAlive(pid) {
   }
 }
 var CONTROL_ONLY_HASH = "control-only";
+var TUNNEL_REJECTED_AFTER = 2;
 function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, stateDir, mcpSecrets = /* @__PURE__ */ new Map(), deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
   const plannedIds = new Set(plans.map((p) => p.workspaceId));
@@ -15203,6 +15214,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       deps.onStatus?.(plan.workspaceId, "disconnected", existing);
       continue;
     }
+    const diedQuickly = existing !== void 0 && existing.status === "connecting" && !alive(existing.pid) && controlUnchanged && secretUnchanged && slugUnchanged && existing.mountsHash === mountsHash;
+    const quickExits = diedQuickly ? (existing.quickExits ?? 0) + 1 : 0;
     let settledStatus = "connecting";
     const tunnel = startTunnel({
       relayHost,
@@ -15230,6 +15243,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       mcpSecret: currentSecret,
       slug: slug2,
       liveSlug: slug2,
+      quickExits,
       endpointId: existing?.endpointId,
       registeredKey: existing?.registeredKey
     };
@@ -15254,6 +15268,18 @@ function readAllPersistedWorkspaceIds(stateDir) {
   if (!existsSync35(dir)) return [];
   return readdirSync13(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
+var TUNNEL_REJECTED_KEY = "tunnel_rejected";
+function tunnelRejectedMessage(workspaceId, quickExits) {
+  return `the relay tunnel for workspace ${workspaceId} exited before settling on ${quickExits} consecutive cycles, which is how a refused claim looks (the relay logs "slug already owned by another workspace/ssh key") \u2014 rotate the slug with \`crew rotate-passenger-url\` or check the relay journal`;
+}
+function rejectedTunnels(stateDir) {
+  const out = [];
+  for (const workspaceId of readAllPersistedWorkspaceIds(stateDir)) {
+    const q2 = readPersistedTunnel(stateDir, workspaceId)?.quickExits ?? 0;
+    if (q2 >= TUNNEL_REJECTED_AFTER) out.push({ workspaceId, quickExits: q2 });
+  }
+  return out;
+}
 
 // src/pool-member-host.ts
 function loadShip(crewHome) {
@@ -25442,6 +25468,15 @@ if (command === "passenger-sync-daemon") {
             })
           );
           if (status2 === "disconnected") pending.push(unregisterEndpoint(workspaceId, info, reconcile));
+          const rejectedKey = `${TUNNEL_REJECTED_KEY}:${workspaceId}`;
+          if ((info?.quickExits ?? 0) >= TUNNEL_REJECTED_AFTER) {
+            pending.push(raiseShipAttention({ state, emit, route: owningRoute, ship: cfg.ship }, {
+              kind: TUNNEL_REJECTED_KEY,
+              key: rejectedKey,
+              message: tunnelRejectedMessage(workspaceId, info.quickExits),
+              since: (/* @__PURE__ */ new Date()).toISOString()
+            }).then(() => void 0).catch(() => void 0));
+          } else if (status2 === "connected") clearShipAttention(state, rejectedKey);
         }
       });
       for (const plan of containerPlans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
@@ -28920,11 +28955,12 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             });
           };
           if (subP === "list") {
-            const entries = periscopeListEntries(
-              (await Promise.all(routesP.map(gather))).flat().map((r) => ({ ...r, pointedAt: readPointedAt(r.worktree) })),
-              /* @__PURE__ */ new Date(),
-              (r) => pidsInWorktree(r.worktree, Number(r.number)).length > 0
-            );
+            const listRows = (await Promise.all(routesP.map(gather))).flat().map((r) => ({ ...r, pointedAt: readPointedAt(r.worktree) }));
+            const serving = new Map(await Promise.all(listRows.map(async (r) => {
+              const port = urlPort(r.url);
+              return [r.id, port === void 0 ? false : await portListening(port)];
+            })));
+            const entries = periscopeListEntries(listRows, /* @__PURE__ */ new Date(), (r) => serving.get(r.id) ?? false);
             process.stdout.write(jsonP ? `${JSON.stringify(entries)}
 ` : `${formatPeriscopeList(entries)}
 `);
@@ -30122,6 +30158,9 @@ watermark:  ${state.watermark()}
         if (!flag("offline")) {
           for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
         }
+        for (const t of rejectedTunnels(cfg.ship.stateDir)) {
+          problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -30142,6 +30181,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 `
       );
       for (const w of roleCapWarnings(cfg.ship)) process.stdout.write(`role concurrency: WARN ${w}
+`);
+      for (const t of rejectedTunnels(cfg.ship.stateDir)) process.stdout.write(`relay tunnel:      ATTENTION ${tunnelRejectedMessage(t.workspaceId, t.quickExits)}
 `);
       process.stdout.write(`periscopes:        ${periscopeSummary(cfg)}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.4",
+  "version": "0.126.6",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",