@tablation/crew 0.126.6 → 0.126.8

package/dist/cli.js

@@ -12004,6 +12004,21 @@ function slugFor(route2, agentId) {
   const [workspaceSlug] = splitRoute(route2.route);
   return seatKeySlug(workspaceSlug, agentId);
 }
+function withFoundSeats(route2, found, previousReleaseAgentId) {
+  const resolved = route2.resolved;
+  if (!resolved) return route2;
+  const releaseSeat2 = found.releaseSeat ?? resolved.releaseSeat;
+  const releaseAgentId = resolved.releaseAgentId ?? previousReleaseAgentId;
+  return {
+    ...route2,
+    resolved: {
+      ...resolved,
+      seats: found.seats,
+      ...releaseSeat2 ? { releaseSeat: releaseSeat2 } : {},
+      ...releaseAgentId ? { releaseAgentId } : {}
+    }
+  };
+}
 function seatAgentId(route2, role) {
   return route2.resolved?.agentPersonas?.[role]?.agentId;
 }
@@ -12496,6 +12511,15 @@ printf '%s
 ' "$tip" > "$out/$name.tip"
 echo "updated $tip"
 `;
+var SHOW_SCRIPT = `
+set -e
+export GIT_TERMINAL_PROMPT=0
+m=${VOLUME_ROOT}/"$1"; base="$2"; path="$3"
+git config --global --add safe.directory '*'
+git -C "$m" rev-parse --verify --quiet "refs/heads/$base^{commit}" >/dev/null || { echo "the mirror has no branch $base" >&2; exit 3; }
+git -C "$m" cat-file -e "refs/heads/$base:$path" 2>/dev/null || exit 4
+git -C "$m" show "refs/heads/$base:$path"
+`;
 var SandboxCache = class {
   s;
   exec;
@@ -12582,6 +12606,20 @@ var SandboxCache = class {
     if (!m) throw new Error(`unexpected output materializing ${repo.host}/${repo.path}: ${stdout.trim().slice(0, 200)}`);
     return { tip: m[2], changed: m[1] === "updated" };
   }
+  /**
+   * The text of `path` at the tip of `base` in the repository's mirror, or
+   * null when the mirror has no such file. Throws when the mirror or the
+   * branch is missing, so the caller can tell "no contract" from "no mirror".
+   */
+  async showFile(repo, base, path) {
+    try {
+      const { stdout } = await this.helper(this.s.helperImage, SHOW_SCRIPT, [mirrorRelPath(repo), base, path]);
+      return stdout;
+    } catch (e) {
+      if (e.code === 4) return null;
+      throw e;
+    }
+  }
   /** Mirrors in the volume with their last refresh; empty when the volume does not exist. */
   async list() {
     try {
@@ -14055,7 +14093,7 @@ async function runPoolMember(deps) {
       await deps.sleep(backoffMs(failures++));
     }
   };
-  let reported;
+  let reported2;
   let busy = false;
   const report = async (state, o = {}) => {
     const body = {
@@ -14078,7 +14116,7 @@ async function runPoolMember(deps) {
     if (r.status === 401) return "credential";
     if (r.status === 409) deps.log(`status ${state}: the platform refused the transition (409); not retrying`);
     else if (r.status >= 400) deps.log(`status ${state}: platform answered ${r.status}; not retrying`);
-    reported = body;
+    reported2 = body;
     deps.store.write({ ...deps.store.read(), lastState: state });
     return "ok";
   };
@@ -14161,7 +14199,7 @@ async function runPoolMember(deps) {
         if (r === "stopped") return POOL_EXIT.ok;
       }
     }
-    let relayReported = reported?.state === "running" ? reported.relayUrl : null;
+    let relayReported = reported2?.state === "running" ? reported2.relayUrl : null;
     let reregister = false;
     while (!reregister) {
       if (deps.stopping()) return POOL_EXIT.ok;
@@ -15184,13 +15222,30 @@ function isPidAlive(pid) {
 }
 var CONTROL_ONLY_HASH = "control-only";
 var TUNNEL_REJECTED_AFTER = 2;
+var CONTROL_RETRY_MS = 60 * 60 * 1e3;
+var RELAY_CONTROL_UNSUPPORTED_KEY = "relay_control_unsupported";
+function relayControlUnsupportedMessage(workspaceId) {
+  return `the relay refused the control-path forward for workspace ${workspaceId}, so the passengers tunnel runs without the control API (remote ship transport and periscopes will not reach this ship); the relay is too old for \`-path-control\` (crew-relay 0.2.0+) \u2014 deploy it with scripts/deploy-relay.sh`;
+}
+function controlRefusedTunnels(stateDir, now = Date.now()) {
+  const out = [];
+  for (const workspaceId of readAllPersistedWorkspaceIds(stateDir)) {
+    const at = readPersistedTunnel(stateDir, workspaceId)?.controlRefusedAt;
+    if (at && now - Date.parse(at) < CONTROL_RETRY_MS) out.push(workspaceId);
+  }
+  return out;
+}
 function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, stateDir, mcpSecrets = /* @__PURE__ */ new Map(), deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
   const plannedIds = new Set(plans.map((p) => p.workspaceId));
   for (const plan of plans) {
     const existing = readPersistedTunnel(stateDir, plan.workspaceId);
     const mountsHash = plan.mountsHash ?? CONTROL_ONLY_HASH;
-    const controlUnchanged = existing?.controlSocket === deps.controlSocket;
+    const refusedAt = existing?.controlRefusedAt;
+    const refusalFresh = refusedAt !== void 0 && Date.now() - Date.parse(refusedAt) < CONTROL_RETRY_MS;
+    let controlSocket = deps.controlSocket && refusalFresh ? void 0 : deps.controlSocket;
+    let controlRefusedAt = refusalFresh ? refusedAt : void 0;
+    const controlUnchanged = existing?.controlSocket === controlSocket;
     const currentSecret = mcpSecrets.get(plan.workspaceId);
     const secretUnchanged = (existing?.mcpSecret ?? void 0) === (currentSecret ?? void 0);
     const slug2 = existing?.slug ?? generateTunnelSlug();
@@ -15215,7 +15270,12 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       continue;
     }
     const diedQuickly = existing !== void 0 && existing.status === "connecting" && !alive(existing.pid) && controlUnchanged && secretUnchanged && slugUnchanged && existing.mountsHash === mountsHash;
-    const quickExits = diedQuickly ? (existing.quickExits ?? 0) + 1 : 0;
+    let quickExits = diedQuickly ? (existing.quickExits ?? 0) + 1 : 0;
+    if (diedQuickly && controlSocket && plan.port !== void 0) {
+      controlSocket = void 0;
+      controlRefusedAt = (/* @__PURE__ */ new Date()).toISOString();
+      quickExits = 0;
+    }
     let settledStatus = "connecting";
     const tunnel = startTunnel({
       relayHost,
@@ -15224,7 +15284,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       slug: slug2,
       apiKey,
       localPort: plan.port,
-      controlSocket: deps.controlSocket,
+      controlSocket,
       privateKeyPath,
       mcpSecret: currentSecret,
       spawnFn: deps.spawnFn,
@@ -15237,7 +15297,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       containerName: plan.containerName ?? "",
       workspaceId: plan.workspaceId,
       mountsHash,
-      controlSocket: deps.controlSocket,
+      controlSocket,
+      controlRefusedAt,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: settledStatus,
       mcpSecret: currentSecret,
@@ -19076,6 +19137,73 @@ function runForge(a, io) {
 `, err: "" };
 }
 
+// src/mirror-contract.ts
+import { existsSync as existsSync40 } from "fs";
+
+// src/passenger-mirror.ts
+import { mkdirSync as mkdirSync29 } from "fs";
+import { dirname as dirname25 } from "path";
+function mirrorRepoOf(spec) {
+  const fromOrigin = spec.originUrl ? parseRemote(spec.originUrl) : null;
+  if (fromOrigin) return fromOrigin;
+  if (!spec.remote) return null;
+  return { host: normalizeForgeHost(spec.forgeHost) || DEFAULT_FORGE_HOST, path: spec.remote };
+}
+async function materializeMirrorCheckouts(specs, cacheFor = (s) => new SandboxCache(s.mirror.cache)) {
+  const out = [];
+  for (const spec of specs) {
+    if (!spec.mirror) continue;
+    const base = { name: spec.name, workspaceId: spec.workspaceId };
+    const repo = mirrorRepoOf(spec);
+    if (!repo) {
+      out.push({ ...base, action: "failed", detail: `no remote known for ${spec.name}, so its mirror cannot be found` });
+      continue;
+    }
+    try {
+      const parent = dirname25(spec.dir);
+      mkdirSync29(parent, { recursive: true });
+      mkdirSync29(spec.dir, { recursive: true });
+      const r = await cacheFor(spec).materialize(repo, spec.base, parent, spec.name);
+      out.push({ ...base, action: r.changed ? "updated" : "unchanged", detail: r.tip });
+    } catch (e) {
+      const err3 = e;
+      out.push({ ...base, action: "failed", detail: (err3.stderr?.trim() || err3.message || String(e)).split("\n").slice(-3).join(" / ") });
+    }
+  }
+  return out;
+}
+function mirrorOutcome(m) {
+  if (m.action === "failed") return { action: "clone-failed", detail: m.detail, repeat: false };
+  return { action: "cloned", detail: `${m.action} ${m.detail}` };
+}
+
+// src/mirror-contract.ts
+function lacksCheckout(ship, dir) {
+  return ship.runner === "sandbox" && !existsSync40(dir);
+}
+function mirrorRepoOfTarget(t) {
+  return mirrorRepoOf({ remote: t.remote, forgeHost: t.forgeHost });
+}
+async function readMirrorContract(cache, repo, base) {
+  for (const name of REPO_CONFIG_FILENAMES) {
+    const text2 = await cache.showFile(repo, base, name);
+    if (text2 !== null) return parseRepoConfig(text2, `${repo.host}/${repo.path}:${base}:${name}`);
+  }
+  return null;
+}
+function noCheckoutReleaseNote(repo, mode) {
+  if (mode === "local" || mode === null) {
+    return `${repo}: no checkout on this ship; release.mode "local" repositories are released by the host that owns the deploy hook, which takes a ticket at verified`;
+  }
+  return `${repo}: no checkout on this ship; release.mode "${mode}" needs the sandboxed release over a mirror-fed clone, which is not built (CREW-2940)`;
+}
+var reported = /* @__PURE__ */ new Set();
+function firstReport(key) {
+  if (reported.has(key)) return false;
+  reported.add(key);
+  return true;
+}
+
 // src/whoami.ts
 async function buildWhoami(routes, deps = {}) {
   const doFetch = deps.fetch ?? fetch;
@@ -19247,7 +19375,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync40, statSync as statSync11, openSync as openSync5, readSync as readSync2, closeSync as closeSync5 } from "fs";
+import { watch as watchFile, existsSync as existsSync41, statSync as statSync11, openSync as openSync5, readSync as readSync2, closeSync as closeSync5 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -19348,7 +19476,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync40(file)) return { events: [], offset: from };
+  if (!existsSync41(file)) return { events: [], offset: from };
   const size = statSync11(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -19591,8 +19719,8 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync41, mkdirSync as mkdirSync29, readFileSync as readFileSync37, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname25 } from "path";
+import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync37, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
+import { dirname as dirname26 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
 };
@@ -19653,7 +19781,7 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync41(resolvedFile)) return void 0;
+  if (!existsSync42(resolvedFile)) return void 0;
   try {
     const v = JSON.parse(readFileSync37(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
@@ -19662,7 +19790,7 @@ function readSyncedName(resolvedFile) {
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync41(resolvedFile)) return;
+  if (!existsSync42(resolvedFile)) return;
   let raw;
   try {
     raw = JSON.parse(readFileSync37(resolvedFile, "utf8"));
@@ -19671,7 +19799,7 @@ function writeSyncedName(resolvedFile, name) {
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync29(dirname25(resolvedFile), { recursive: true });
+  mkdirSync30(dirname26(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
   writeFileSync32(tmp, `${JSON.stringify(raw, null, 2)}
 `);
@@ -20364,8 +20492,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
-import { dirname as dirname26 } from "path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
+import { dirname as dirname27 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -20398,11 +20526,11 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync42(resolvedPath) ? JSON.parse(readFileSync38(resolvedPath, "utf8")) : {};
+    const raw = existsSync43(resolvedPath) ? JSON.parse(readFileSync38(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync30(dirname26(resolvedPath), { recursive: true });
+    mkdirSync31(dirname27(resolvedPath), { recursive: true });
     writeFileSync33(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
@@ -21025,7 +21153,7 @@ ${run3.err}` });
 }
 
 // src/sample-ticket.ts
-import { basename as basename12, dirname as dirname27, join as join44 } from "path";
+import { basename as basename12, dirname as dirname28, join as join44 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -21048,7 +21176,7 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join44(dirname27(existing[0]), SAMPLE_REPO);
+  if (existing.length > 0) return join44(dirname28(existing[0]), SAMPLE_REPO);
   return join44(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
@@ -21093,8 +21221,8 @@ function planSampleTicket(i) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync43, readFileSync as readFileSync40, readdirSync as readdirSync14 } from "fs";
-import { basename as basename13, dirname as dirname28, join as join45, resolve as resolve5 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync40, readdirSync as readdirSync14 } from "fs";
+import { basename as basename13, dirname as dirname29, join as join45, resolve as resolve5 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -21158,7 +21286,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname28(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname29(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename13(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve5(w.path)));
   let names;
@@ -21206,7 +21334,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync43(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync44(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -21214,7 +21342,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync43(a.path)) {
+    if (!dryRun && existsSync44(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -21225,7 +21353,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync43(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync44(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse2(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -21379,12 +21507,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync44, readdirSync as readdirSync15, rmSync as rmSync20, statSync as statSync12 } from "fs";
+import { existsSync as existsSync45, readdirSync as readdirSync15, rmSync as rmSync20, statSync as statSync12 } from "fs";
 import { join as join46 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join46(stateDir, "streams");
-  if (!existsSync44(dir)) return [];
+  if (!existsSync45(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync15(dir).map((name) => join46(dir, name)).filter((path) => {
     try {
@@ -21412,7 +21540,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync44(stateDir)) return [];
+  if (!existsSync45(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync15(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join46(stateDir, name)).filter((path) => {
     try {
@@ -21424,11 +21552,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync46, existsSync as existsSync51, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync46, existsSync as existsSync52, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync45, mkdirSync as mkdirSync31, readFileSync as readFileSync41, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
+import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync41, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
 import { join as join47 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -21446,7 +21574,7 @@ function removePeriscopePrior(stateDir, ticketRecordId) {
 }
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
-    mkdirSync31(priorDir(stateDir), { recursive: true });
+    mkdirSync32(priorDir(stateDir), { recursive: true });
     writeFileSync34(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
@@ -21454,7 +21582,7 @@ function writePeriscopePrior(stateDir, ticketRecordId, prior) {
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync45(p) ? JSON.parse(readFileSync41(p, "utf8")) : void 0;
+    return existsSync46(p) ? JSON.parse(readFileSync41(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -22009,8 +22137,8 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync13 } from "child_process";
-import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync42, chmodSync as chmodSync3 } from "fs";
-import { dirname as dirname29, join as join49 } from "path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync33, readFileSync as readFileSync42, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname30, join as join49 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
@@ -22019,8 +22147,8 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync46(privateKeyPath)) {
-    mkdirSync32(dirname29(privateKeyPath), { recursive: true });
+  if (!existsSync47(privateKeyPath)) {
+    mkdirSync33(dirname30(privateKeyPath), { recursive: true });
     try {
       execFileSync13("ssh-keygen", [
         "-t",
@@ -22040,7 +22168,7 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync46(publicKeyPath)) {
+  if (!existsSync47(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
   const publicKey = readFileSync42(publicKeyPath, "utf8").trim();
@@ -22207,46 +22335,9 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn9 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync47, mkdirSync as mkdirSync34, readFileSync as readFileSync43, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync34, readFileSync as readFileSync43, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
 import { join as join50 } from "path";
 
-// src/passenger-mirror.ts
-import { mkdirSync as mkdirSync33 } from "fs";
-import { dirname as dirname30 } from "path";
-function mirrorRepoOf(spec) {
-  const fromOrigin = spec.originUrl ? parseRemote(spec.originUrl) : null;
-  if (fromOrigin) return fromOrigin;
-  if (!spec.remote) return null;
-  return { host: normalizeForgeHost(spec.forgeHost) || DEFAULT_FORGE_HOST, path: spec.remote };
-}
-async function materializeMirrorCheckouts(specs, cacheFor = (s) => new SandboxCache(s.mirror.cache)) {
-  const out = [];
-  for (const spec of specs) {
-    if (!spec.mirror) continue;
-    const base = { name: spec.name, workspaceId: spec.workspaceId };
-    const repo = mirrorRepoOf(spec);
-    if (!repo) {
-      out.push({ ...base, action: "failed", detail: `no remote known for ${spec.name}, so its mirror cannot be found` });
-      continue;
-    }
-    try {
-      const parent = dirname30(spec.dir);
-      mkdirSync33(parent, { recursive: true });
-      mkdirSync33(spec.dir, { recursive: true });
-      const r = await cacheFor(spec).materialize(repo, spec.base, parent, spec.name);
-      out.push({ ...base, action: r.changed ? "updated" : "unchanged", detail: r.tip });
-    } catch (e) {
-      const err3 = e;
-      out.push({ ...base, action: "failed", detail: (err3.stderr?.trim() || err3.message || String(e)).split("\n").slice(-3).join(" / ") });
-    }
-  }
-  return out;
-}
-function mirrorOutcome(m) {
-  if (m.action === "failed") return { action: "clone-failed", detail: m.detail, repeat: false };
-  return { action: "cloned", detail: `${m.action} ${m.detail}` };
-}
-
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
 function secretsMatch(a, b) {
@@ -22342,7 +22433,7 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync47(path)) return void 0;
+  if (!existsSync48(path)) return void 0;
   try {
     return JSON.parse(readFileSync43(path, "utf8"));
   } catch {
@@ -22373,7 +22464,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join50(stateDir, "passengers");
-  if (!existsSync47(dir)) return [];
+  if (!existsSync48(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync16(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -22893,7 +22984,7 @@ function contractFixers(dir, baseRef, tickets, locate) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync48, mkdirSync as mkdirSync36, readFileSync as readFileSync44, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
+import { existsSync as existsSync49, mkdirSync as mkdirSync36, readFileSync as readFileSync44, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
 import { join as join52 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -22991,7 +23082,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync48(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync49(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join52(stateDir, "reload-requested");
@@ -23242,8 +23333,8 @@ async function runOnePassUnguarded(o) {
         set.add(run3);
         void run3.finally(() => set.delete(run3));
       }
-      const reported = TICKET_ROLES.has(role) ? await settled : true;
-      const tookTicket = reported !== false;
+      const reported2 = TICKET_ROLES.has(role) ? await settled : true;
+      const tookTicket = reported2 !== false;
       if (tookTicket) started.push(role);
       if (roleCap(role) <= 1) {
         live.delete(role);
@@ -23580,7 +23671,7 @@ import { createHash as createHash10 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync6,
-  existsSync as existsSync49,
+  existsSync as existsSync50,
   fstatSync,
   openSync as openSync6,
   readSync as readSync3,
@@ -23951,7 +24042,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync49(live)) {
+  if (!existsSync50(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -24108,7 +24199,7 @@ async function route(deps, method, url, req, abort) {
     const run3 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run3) || run3.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run3)) return err2(400, "not a run name");
     const file = join53(deps.stateDir, "streams", run3.endsWith(".jsonl") ? run3 : `${run3}.jsonl`);
-    if (!existsSync49(file)) return err2(404, "no such run");
+    if (!existsSync50(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -24152,7 +24243,7 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync49(path)) return false;
+  if (!existsSync50(path)) return false;
   return new Promise((resolve8) => {
     const c = createConnection(path);
     c.once("connect", () => {
@@ -24171,7 +24262,7 @@ async function startControlServer(deps) {
     return null;
   }
   if (await socketIsStale(path)) rmSync23(path, { force: true });
-  else if (existsSync49(path)) {
+  else if (existsSync50(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -24264,7 +24355,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync50, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync45, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync51, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync45, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
 import { join as join54 } from "path";
 var secretDir = (stateDir) => join54(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join54(secretDir(stateDir), `${id}.json`);
@@ -24307,7 +24398,7 @@ function removePeriscopeEndpointRecord(stateDir, ticketRecordId) {
 }
 function listPeriscopeEndpoints(stateDir) {
   const dir = endpointDir(stateDir);
-  if (!existsSync50(dir)) return [];
+  if (!existsSync51(dir)) return [];
   const out = [];
   for (const name of readdirSync19(dir)) {
     if (!name.endsWith(".json")) continue;
@@ -25290,7 +25381,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "deprovision" || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset") || command === "deprovision";
-      if (configless && !existsSync51(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync52(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -25477,6 +25568,15 @@ if (command === "passenger-sync-daemon") {
               since: (/* @__PURE__ */ new Date()).toISOString()
             }).then(() => void 0).catch(() => void 0));
           } else if (status2 === "connected") clearShipAttention(state, rejectedKey);
+          const controlKey = `${RELAY_CONTROL_UNSUPPORTED_KEY}:${workspaceId}`;
+          if (info?.controlRefusedAt) {
+            pending.push(raiseShipAttention({ state, emit, route: owningRoute, ship: cfg.ship }, {
+              kind: RELAY_CONTROL_UNSUPPORTED_KEY,
+              key: controlKey,
+              message: relayControlUnsupportedMessage(workspaceId),
+              since: (/* @__PURE__ */ new Date()).toISOString()
+            }).then(() => void 0).catch(() => void 0));
+          } else if (status2 === "connected") clearShipAttention(state, controlKey);
         }
       });
       for (const plan of containerPlans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
@@ -25634,7 +25734,7 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join56(homedir11(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync51(staleTimer)) {
+      if (existsSync52(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -25663,7 +25763,7 @@ if (command === "passenger-sync-daemon") {
     const { settled: doctorRepos, errors: refusedRepos } = await settleRepos(reposOf(c), (t) => t.name, (t) => resolveOneRepo(c, t));
     for (const e of refusedRepos) problems.push(`repo ${e.repo}: ${e.detail}`);
     for (const r of doctorRepos) {
-      if (!existsSync51(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync52(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -25690,7 +25790,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync51(p);
+    const unitExists = (p) => existsSync52(p);
     const crontab = o.host === "linux" ? spawnSync11("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -25842,9 +25942,25 @@ ${changed2.map((c) => `  - ${c}
     }
   }
   const precheckTickets = /* @__PURE__ */ new Map();
+  const scope0 = (c, t) => releaseLockScope(c.route, t.name);
   async function releasePhase(c, target, opts = {}) {
     const scope = releaseLockScope(c.route, target.name);
     const remit = emit.forRoute(c.route);
+    if (lacksCheckout(cfg.ship, target.dir)) {
+      let mode = null;
+      const settings = cacheSettingsOf(cfg.ship.sandbox);
+      const mirror = mirrorRepoOfTarget(target);
+      if (settings && mirror) {
+        try {
+          mode = (await readMirrorContract(new SandboxCache(settings), mirror, c.branch?.base ?? "main"))?.release.mode ?? null;
+        } catch (e) {
+          if (firstReport(`${scope0(c, target)}:contract`)) remit.warn(`${target.name}: could not read the contract from the mirror: ${e.message}`, { step: "release" });
+        }
+      }
+      const note = noCheckoutReleaseNote(target.name, mode);
+      if (firstReport(`${scope0(c, target)}:release`)) remit.emit(note, { step: "release" });
+      return { scope: releaseLockScope(c.route, target.name), tests: "skipped", outcome: "skipped", detail: note };
+    }
     const relLock = dryRun ? void 0 : state.acquire(`release-${scope}`);
     if (relLock && !relLock.ok) {
       remit.emit(`a previous release (pid ${relLock.heldBy}) is still running \u2014 skipping`, { step: "release" });
@@ -26104,10 +26220,10 @@ ${changed2.map((c) => `  - ${c}
       if (outcome.gateRed && !dryRun) {
         try {
           const g = outcome.gateRed;
-          const reported = await tracker.events("gate_red");
+          const reported2 = await tracker.events("gate_red");
           const seat = releaseSeat(c);
           for (const t of gateRedTickets(outcome.merged, outcome.decision.merges)) {
-            if (alreadyReported(t, g, reported)) continue;
+            if (alreadyReported(t, g, reported2)) continue;
             await tracker.postEvent(t.id, gateRedComment(g), seat, "gate_red");
             remit.warn(`test gate red for ${g.count} cycles \u2014 noted on the ticket`, { ticket: t.issue_id, step: "merge" });
           }
@@ -26118,10 +26234,10 @@ ${changed2.map((c) => `  - ${c}
       }
       if (outcome.localRefSkips?.length && !dryRun) {
         try {
-          const reported = await tracker.events("local_ref_skip");
+          const reported2 = await tracker.events("local_ref_skip");
           const seat = releaseSeat(c);
           for (const s of outcome.localRefSkips) {
-            if (localRefSkipReported(s.ticket, s.problem, reported)) continue;
+            if (localRefSkipReported(s.ticket, s.problem, reported2)) continue;
             await tracker.postEvent(s.ticket.id, localRefSkipComment(cfg.ship.name, s.problem), seat, "local_ref_skip");
           }
         } catch (e) {
@@ -27191,7 +27307,7 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync51(resolvedPath) ? JSON.parse(readFileSync46(resolvedPath, "utf8")) : {};
+        const raw = existsSync52(resolvedPath) ? JSON.parse(readFileSync46(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync38(dirOf2(resolvedPath), { recursive: true });
         writeFileSync38(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -27296,8 +27412,8 @@ ${cu.tail.trimEnd()}
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
           const dir = repoDirOf(configText, dirname34(cfg.configFile), a.route, a.name);
-          if (!existsSync51(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync51(resolvePath(dir, r)), list: (r) => {
+          if (!existsSync52(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync52(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync20(resolvePath(dir, r));
             } catch {
@@ -27415,7 +27531,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync51(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync52(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -27445,7 +27561,7 @@ ${cu.tail.trimEnd()}
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       if (sub === "list" || sub === "add") {
         const liveRoute = cfg.routes.find((r) => r.route === routeName);
-        if (liveRoute?.resolved?.reposModelId && existsSync51(resolvedFile) && !dryRun) {
+        if (liveRoute?.resolved?.reposModelId && existsSync52(resolvedFile) && !dryRun) {
           try {
             await hydrateApiKeys([liveRoute]);
             persistRepoRows(cfg.ship.stateDir, liveRoute.route, await new Tracker(liveRoute, cfg.ship).repoRowsForMap());
@@ -27454,7 +27570,7 @@ ${cu.tail.trimEnd()}
         }
       }
       let resolvedRemotes;
-      if (existsSync51(resolvedFile)) {
+      if (existsSync52(resolvedFile)) {
         try {
           resolvedRemotes = JSON.parse(readFileSync46(resolvedFile, "utf8"));
         } catch {
@@ -27463,7 +27579,7 @@ ${cu.tail.trimEnd()}
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text2 = configText;
       const base = dirname34(cfg.configFile);
-      const isCheckout = (d) => existsSync51(`${d}/.git`);
+      const isCheckout = (d) => existsSync52(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -27473,7 +27589,7 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync51(d),
+              exists: (d) => existsSync52(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
@@ -27495,7 +27611,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync51(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync52(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -27507,9 +27623,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text: text2, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync51(plan2.target) && (existsSync51(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
+          if (existsSync52(plan2.target) && (existsSync52(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync51(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync52(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -27534,7 +27650,7 @@ ${cu.tail.trimEnd()}
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir11()));
-        const top = existsSync51(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync52(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -27586,7 +27702,7 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync51(resolvedFile)) {
+          if (existsSync52(resolvedFile)) {
             const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
@@ -28008,7 +28124,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync51(resolvedPath);
+        const hadPreviousFile = existsSync52(resolvedPath);
         if (hadPreviousFile) {
           try {
             previous = JSON.parse(readFileSync46(resolvedPath, "utf8"));
@@ -28153,7 +28269,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         let mintOutcomes = [];
         if (!dryRun && previous?.agentPersonas && existingRoute?.resolved) {
           try {
-            mintOutcomes = await mintMissingSeatKeys({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
+            mintOutcomes = await mintMissingSeatKeys(withFoundSeats(existingRoute, found, previous.releaseAgentId), { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
             for (const o of mintOutcomes) process.stderr.write(`${describeMintOutcome(o)}
 `);
             for (const p of await probeSeatReads({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent })) {
@@ -28888,7 +29004,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           prepare: async (path) => {
             for (const f of repoWt.config.worktrees.copy) {
               const src = join56(repoWt.dir, f);
-              if (!existsSync51(src) || existsSync51(join56(path, f))) continue;
+              if (!existsSync52(src) || existsSync52(join56(path, f))) continue;
               mkdirSync38(dirOf2(join56(path, f)), { recursive: true });
               copyFileSync2(src, join56(path, f));
             }
@@ -29111,7 +29227,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync51(p),
+            worktreeExists: (p) => existsSync52(p),
             prepareDropFile,
             startProxy: (wt, url, n) => launchProxy(crewInvocation(CREW_HOME), wt, url, Number(n), { host: hit.row.host || "localhost", inject: hit.repo.config.periscope?.inspector !== "repo" }),
             caps: periscopeCaps(cfg.ship),
@@ -29208,7 +29324,7 @@ ${where.join("\n")}`);
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
               const src = join56(repoP.dir, f);
-              if (!existsSync51(src)) continue;
+              if (!existsSync52(src)) continue;
               mkdirSync38(dirOf2(join56(path, f)), { recursive: true });
               copyFileSync2(src, join56(path, f));
             }
@@ -29700,7 +29816,7 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync51(resolvedFile)) {
+          if (existsSync52(resolvedFile)) {
             const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
@@ -29708,13 +29824,13 @@ ${where.join("\n")}`);
 `);
           }
         }
-        if (existsSync51(join56(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync25(dir, { recursive: true, force: true });
+        if (existsSync52(join56(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync25(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync51(join56(dir, ".git"));
-      if (existsSync51(dir) && fresh && readdirSync20(dir).length > 0) fail2(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync52(join56(dir, ".git"));
+      if (existsSync52(dir) && fresh && readdirSync20(dir).length > 0) fail2(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
@@ -29740,7 +29856,7 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync51(resolvedFile)) {
+        if (existsSync52(resolvedFile)) {
           const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
@@ -30096,7 +30212,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync51(r.dir)) {
+            if (existsSync52(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -30161,6 +30277,9 @@ watermark:  ${state.watermark()}
         for (const t of rejectedTunnels(cfg.ship.stateDir)) {
           problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
         }
+        for (const workspaceId of controlRefusedTunnels(cfg.ship.stateDir)) {
+          problems.push({ severity: "attention", kind: RELAY_CONTROL_UNSUPPORTED_KEY, message: relayControlUnsupportedMessage(workspaceId), remedy: "deploy crew-relay 0.2.0 or later (scripts/deploy-relay.sh in the crew-relay repository)" });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -30183,6 +30302,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       for (const w of roleCapWarnings(cfg.ship)) process.stdout.write(`role concurrency: WARN ${w}
 `);
       for (const t of rejectedTunnels(cfg.ship.stateDir)) process.stdout.write(`relay tunnel:      ATTENTION ${tunnelRejectedMessage(t.workspaceId, t.quickExits)}
+`);
+      for (const workspaceId of controlRefusedTunnels(cfg.ship.stateDir)) process.stdout.write(`relay tunnel:      ATTENTION ${relayControlUnsupportedMessage(workspaceId)}
 `);
       process.stdout.write(`periscopes:        ${periscopeSummary(cfg)}
 `);
@@ -30197,7 +30318,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync51(evFile) ? statSync16(evFile).size : 0;
+        const evSize = existsSync52(evFile) ? statSync16(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.6",
+  "version": "0.126.8",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",