@tablation/crew 0.126.7 → 0.126.9

package/dist/cli.js

@@ -14892,6 +14892,20 @@ async function runProvision(o, deps, write, human) {
       emit("route_enabled", `enabled route ${route2}`, { route: route2 });
     }
   }
+  summary.seatKeys = [];
+  for (const route2 of routeNames) {
+    const res = deps.crew(["agents", "sync", route2]);
+    const lines2 = res.stdout.split("\n").map((l) => l.trim());
+    const minted = lines2.flatMap((l) => /^(\w+): agent key minted/.exec(l)?.[1] ?? []);
+    const refused = lines2.filter((l) => /could not mint an agent key|^seat keys: not minted/.test(l));
+    summary.seatKeys.push({ route: route2, minted });
+    if (minted.length > 0) summary.changed = true;
+    emit("seat_keys", `seat keys: ${minted.length} minted${minted.length > 0 ? ` (${minted.join(", ")})` : ""} for ${route2}`, { route: route2, minted });
+    if (res.status >= 2 || refused.length > 0) {
+      const why = refused[0] ?? (res.stderr.trim().split("\n").pop() || `crew agents sync exited ${res.status}`);
+      return fail2(PROVISION_EXIT.failed, `seat keys for ${route2}: ${why}`, { stage: "seat_keys", route: route2 });
+    }
+  }
   const before = deps.installState();
   if (before.unitsStale || !before.running || !before.lingering) {
     const res = deps.crew(["install"]);
@@ -15222,13 +15236,30 @@ function isPidAlive(pid) {
 }
 var CONTROL_ONLY_HASH = "control-only";
 var TUNNEL_REJECTED_AFTER = 2;
+var CONTROL_RETRY_MS = 60 * 60 * 1e3;
+var RELAY_CONTROL_UNSUPPORTED_KEY = "relay_control_unsupported";
+function relayControlUnsupportedMessage(workspaceId) {
+  return `the relay refused the control-path forward for workspace ${workspaceId}, so the passengers tunnel runs without the control API (remote ship transport and periscopes will not reach this ship); the relay is too old for \`-path-control\` (crew-relay 0.2.0+) \u2014 deploy it with scripts/deploy-relay.sh`;
+}
+function controlRefusedTunnels(stateDir, now = Date.now()) {
+  const out = [];
+  for (const workspaceId of readAllPersistedWorkspaceIds(stateDir)) {
+    const at = readPersistedTunnel(stateDir, workspaceId)?.controlRefusedAt;
+    if (at && now - Date.parse(at) < CONTROL_RETRY_MS) out.push(workspaceId);
+  }
+  return out;
+}
 function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, stateDir, mcpSecrets = /* @__PURE__ */ new Map(), deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
   const plannedIds = new Set(plans.map((p) => p.workspaceId));
   for (const plan of plans) {
     const existing = readPersistedTunnel(stateDir, plan.workspaceId);
     const mountsHash = plan.mountsHash ?? CONTROL_ONLY_HASH;
-    const controlUnchanged = existing?.controlSocket === deps.controlSocket;
+    const refusedAt = existing?.controlRefusedAt;
+    const refusalFresh = refusedAt !== void 0 && Date.now() - Date.parse(refusedAt) < CONTROL_RETRY_MS;
+    let controlSocket = deps.controlSocket && refusalFresh ? void 0 : deps.controlSocket;
+    let controlRefusedAt = refusalFresh ? refusedAt : void 0;
+    const controlUnchanged = existing?.controlSocket === controlSocket;
     const currentSecret = mcpSecrets.get(plan.workspaceId);
     const secretUnchanged = (existing?.mcpSecret ?? void 0) === (currentSecret ?? void 0);
     const slug2 = existing?.slug ?? generateTunnelSlug();
@@ -15253,7 +15284,12 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       continue;
     }
     const diedQuickly = existing !== void 0 && existing.status === "connecting" && !alive(existing.pid) && controlUnchanged && secretUnchanged && slugUnchanged && existing.mountsHash === mountsHash;
-    const quickExits = diedQuickly ? (existing.quickExits ?? 0) + 1 : 0;
+    let quickExits = diedQuickly ? (existing.quickExits ?? 0) + 1 : 0;
+    if (diedQuickly && controlSocket && plan.port !== void 0) {
+      controlSocket = void 0;
+      controlRefusedAt = (/* @__PURE__ */ new Date()).toISOString();
+      quickExits = 0;
+    }
     let settledStatus = "connecting";
     const tunnel = startTunnel({
       relayHost,
@@ -15262,7 +15298,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       slug: slug2,
       apiKey,
       localPort: plan.port,
-      controlSocket: deps.controlSocket,
+      controlSocket,
       privateKeyPath,
       mcpSecret: currentSecret,
       spawnFn: deps.spawnFn,
@@ -15275,7 +15311,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       containerName: plan.containerName ?? "",
       workspaceId: plan.workspaceId,
       mountsHash,
-      controlSocket: deps.controlSocket,
+      controlSocket,
+      controlRefusedAt,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: settledStatus,
       mcpSecret: currentSecret,
@@ -25545,6 +25582,15 @@ if (command === "passenger-sync-daemon") {
               since: (/* @__PURE__ */ new Date()).toISOString()
             }).then(() => void 0).catch(() => void 0));
           } else if (status2 === "connected") clearShipAttention(state, rejectedKey);
+          const controlKey = `${RELAY_CONTROL_UNSUPPORTED_KEY}:${workspaceId}`;
+          if (info?.controlRefusedAt) {
+            pending.push(raiseShipAttention({ state, emit, route: owningRoute, ship: cfg.ship }, {
+              kind: RELAY_CONTROL_UNSUPPORTED_KEY,
+              key: controlKey,
+              message: relayControlUnsupportedMessage(workspaceId),
+              since: (/* @__PURE__ */ new Date()).toISOString()
+            }).then(() => void 0).catch(() => void 0));
+          } else if (status2 === "connected") clearShipAttention(state, controlKey);
         }
       });
       for (const plan of containerPlans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
@@ -30245,6 +30291,9 @@ watermark:  ${state.watermark()}
         for (const t of rejectedTunnels(cfg.ship.stateDir)) {
           problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
         }
+        for (const workspaceId of controlRefusedTunnels(cfg.ship.stateDir)) {
+          problems.push({ severity: "attention", kind: RELAY_CONTROL_UNSUPPORTED_KEY, message: relayControlUnsupportedMessage(workspaceId), remedy: "deploy crew-relay 0.2.0 or later (scripts/deploy-relay.sh in the crew-relay repository)" });
+        }
         const previewProblem2 = await previewHostProblem(cfg);
         if (previewProblem2) problems.push(previewHostFinding(previewProblem2));
         if (cfg.routes.some((x) => x.route === route2.route && x.enabled && x.hostPeriscopes)) {
@@ -30267,6 +30316,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       for (const w of roleCapWarnings(cfg.ship)) process.stdout.write(`role concurrency: WARN ${w}
 `);
       for (const t of rejectedTunnels(cfg.ship.stateDir)) process.stdout.write(`relay tunnel:      ATTENTION ${tunnelRejectedMessage(t.workspaceId, t.quickExits)}
+`);
+      for (const workspaceId of controlRefusedTunnels(cfg.ship.stateDir)) process.stdout.write(`relay tunnel:      ATTENTION ${relayControlUnsupportedMessage(workspaceId)}
 `);
       process.stdout.write(`periscopes:        ${periscopeSummary(cfg)}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.7",
+  "version": "0.126.9",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",