@tablation/crew 0.126.9 → 0.126.11

package/dist/cli.js

@@ -2747,11 +2747,12 @@ function tablationEndpoint(url) {
   }
   return { host, port };
 }
-var TOOL_BINARIES = ["/usr/bin/curl", "/usr/bin/node", "/usr/local/bin/node", "/usr/bin/npm", "/usr/local/bin/npm", "/usr/local/bin/pnpm", "/usr/bin/corepack", "/usr/local/bin/corepack"];
+var CREW_BIN = "/opt/crew/bin";
+var TOOL_BINARIES = ["/usr/bin/curl", `${CREW_BIN}/node`, "/usr/bin/node", "/usr/local/bin/node", "/usr/bin/npm", "/usr/local/bin/npm", "/usr/local/bin/pnpm", "/usr/bin/corepack", "/usr/local/bin/corepack"];
 var GIT_BINARIES = ["/usr/bin/git", "/usr/lib/git-core/git-remote-http", "/usr/lib/git-core/git-remote-https"];
 function policyGroups(input) {
   const harness = `/usr/local/bin/${basename2(input.harnessBin)}`;
-  const harnessBins = [.../* @__PURE__ */ new Set([harness, `/usr/bin/${basename2(input.harnessBin)}`, "/usr/bin/node", "/usr/local/bin/node"])];
+  const harnessBins = [.../* @__PURE__ */ new Set([`${CREW_BIN}/${basename2(input.harnessBin)}`, harness, `/usr/bin/${basename2(input.harnessBin)}`, `${CREW_BIN}/node`, "/usr/bin/node", "/usr/local/bin/node"])];
   const groups = [];
   const tablation = tablationEndpoint(input.tablationUrl);
   groups.push({
@@ -6352,7 +6353,7 @@ function attentionProblems(items, already) {
 }
 
 // src/sandbox-image.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { execFileSync as execFileSync8 } from "child_process";
 import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
@@ -6362,7 +6363,7 @@ import { tmpdir as tmpdir3 } from "os";
 
 // src/passenger-containers.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 
 // src/sandbox-cache.ts
 import { execFile as execFile2 } from "child_process";
@@ -6382,7 +6383,7 @@ import { readFileSync as readFileSync25, existsSync as existsSync26, statSync as
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
 import { join as join29, dirname as dirname14, basename as basename9 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/state.ts
 import { readFileSync as readFileSync19, writeFileSync as writeFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync13, rmSync as rmSync10, statSync as statSync7, readdirSync as readdirSync5 } from "fs";
@@ -10681,6 +10682,7 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
 // src/runner.ts
 import { spawn as spawn3, execFile, execFileSync as execFileSync6 } from "child_process";
 import { mkdtempSync, mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, rmSync as rmSync14 } from "fs";
+import { createHash as createHash4 } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
 import { basename as basename8, dirname as dirname13, join as join28 } from "path";
 import { promisify } from "util";
@@ -10776,8 +10778,9 @@ function shQuote2(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 function sandboxName(plan, now = Date.now()) {
-  const base = [plan.route, plan.role, plan.ticket ?? ""].join("-").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return `crew-${base.slice(0, 36)}-${now.toString(36)}`.replace(/-+/g, "-");
+  const h = createHash4("sha256").update([plan.route, plan.role, plan.ticket ?? ""].join("\0")).digest();
+  const tag = (h.readUInt32BE(0) % 36 ** 6).toString(36).padStart(6, "0");
+  return `crew-${tag}${now.toString(36).slice(-8).padStart(8, "0")}`;
 }
 var SandboxRunner = class {
   kind = "sandbox";
@@ -10792,8 +10795,10 @@ var SandboxRunner = class {
     return execFileP(this.cfg.bin, args, { env: o.env ?? process.env, maxBuffer: 16 * 1024 * 1024 });
   }
   async start(plan, o) {
-    const origin = this.originOf(plan.cwd);
-    if (!origin) throw new Error(`cannot find the origin remote of ${plan.cwd}, so there is nothing to clone into the sandbox`);
+    const origin = plan.sandboxOrigin ?? (plan.repo ? null : this.originOf(plan.cwd));
+    if (!origin) {
+      throw new Error(plan.repo ? `cannot place the repository ${plan.repo} of ${plan.ticket ?? "this run"} on route ${plan.route}, so there is nothing to clone into the sandbox` : `cannot find the origin remote of ${plan.cwd}, so there is nothing to clone into the sandbox`);
+    }
     const repo = parseRemote(origin);
     if (!repo) throw new Error(`cannot read a forge host and path from the origin remote ${origin}`);
     const name = sandboxName(plan);
@@ -10938,7 +10943,8 @@ function runnerFor(kind, sandbox) {
 function runnerOfSidecar(sc) {
   return sc.runner === "sandbox" ? new SandboxRunner(sc.sandboxBin ? { bin: sc.sandboxBin } : {}) : new HostRunner();
 }
-function checkSandboxRunner(cfg = {}, run3 = (b, a) => execFileSync6(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 })) {
+var PROBE_CREATE_TIMEOUT_MS = 12e4;
+function checkSandboxRunner(cfg = {}, run3 = (b, a, t) => execFileSync6(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: t ?? 15e3 })) {
   const bin = cfg.bin ?? DEFAULT_SANDBOX_CONFIG.bin;
   let version;
   try {
@@ -10955,6 +10961,21 @@ function checkSandboxRunner(cfg = {}, run3 = (b, a) => execFileSync6(b, a, { enc
       detail: `${version}: the gateway does not answer (${(err3.stderr || err3.message).trim().split("\n").filter(Boolean).slice(0, 2).join(" / ")}). Start it; on Docker Desktop its docker section needs supervisor_network_mode = "bridge", and allow_driver_config = true for the cache volume mount.`
     };
   }
+  const probe = sandboxName({ route: "doctor", role: "dev", ticket: void 0 });
+  try {
+    run3(bin, ["sandbox", "create", "--name", probe, "--detach", "--", "sleep", "60"], PROBE_CREATE_TIMEOUT_MS);
+  } catch (e) {
+    const err3 = e;
+    if (err3.code === "ETIMEDOUT" || err3.killed) {
+      return { ok: false, detail: `${version}: creating a probe sandbox named ${probe} timed out after ${PROBE_CREATE_TIMEOUT_MS / 1e3} s; the gateway may still be pulling its images on a first create, so run crew doctor again` };
+    }
+    return { ok: false, detail: `${version}: the gateway refused a probe sandbox named ${probe} (${(err3.stderr || err3.message).trim().split("\n").filter(Boolean).slice(0, 2).join(" / ")})` };
+  } finally {
+    try {
+      run3(bin, ["sandbox", "delete", probe]);
+    } catch {
+    }
+  }
   return { ok: true, detail: version };
 }
 
@@ -10975,6 +10996,13 @@ function assemblePrompt(p) {
 }
 var AgentError = class extends Error {
 };
+function sandboxOriginFor(route2, repo) {
+  if (!repo) return void 0;
+  const repos = reposOf(route2);
+  const target = repos.find((r) => r.name === repo) ?? (repos.length === 1 ? repos[0] : void 0);
+  if (!target) return void 0;
+  return originUrlOf(target.dir, "origin") ?? (target.remote ? cloneUrlFor(target.remote, { host: target.forgeHost }) : void 0);
+}
 function sandboxPolicyInputFor(route2, toolchain, o) {
   const repos = reposOf(route2);
   const forgeHosts = [...new Set(repos.map((r) => r.forgeHost ?? "github.com"))];
@@ -11134,7 +11162,7 @@ function planAgentRun(o) {
     brief: expanded.text,
     digest
   });
-  const promptSha = createHash4("sha256").update(expanded.text).digest("hex");
+  const promptSha = createHash5("sha256").update(expanded.text).digest("hex");
   const streamsDir = join29(o.stateDir, "streams");
   const base = `${routeLabel}-${o.role}-${o.cycle}${o.runId ? `-${o.runId}` : ""}`;
   const seat = resolveSeat(o.ship, o.route, o.role, o.agentPersona ?? (o.agentModel ? { model: o.agentModel } : {}), o.repo);
@@ -11152,6 +11180,7 @@ function planAgentRun(o) {
   const adapter = adapterFor(toolchain.harness);
   const code = codeBridgeFor(o, adapter.harness);
   const sandboxLsp = o.ship.runner === "sandbox" && adapter.harness === "claude" ? sandboxLspPluginFor(o.route, o.repo) : void 0;
+  const sandboxOrigin = o.ship.runner === "sandbox" ? sandboxOriginFor(o.route, o.repo) : void 0;
   const sandboxFiles = [...code?.files ?? [], ...sandboxLsp?.files ?? []];
   const invocation = adapter.invocation(toolchain, {
     code,
@@ -11204,6 +11233,7 @@ function planAgentRun(o) {
     ...o.ship.runner === "sandbox" ? {
       runner: "sandbox",
       ...o.ship.sandbox ? { sandboxConfig: o.ship.sandbox } : {},
+      ...sandboxOrigin ? { sandboxOrigin } : {},
       sandboxPolicy: sandboxPolicyInputFor(o.route, toolchain, { harnessBin: invocation.bin, repo: o.repo, sandbox: o.ship.sandbox }),
       ...sandboxFiles.length ? { sandboxFiles } : {}
     } : {},
@@ -12085,8 +12115,8 @@ async function mintMissingSeatKeys(route2, o) {
   const resolved = route2.resolved;
   const doFetch = o.fetchImpl ?? fetch;
   const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
   ];
   let store;
   try {
@@ -12115,7 +12145,7 @@ async function mintMissingSeatKeys(route2, o) {
       return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
     }
   }
-  for (const { role, agentId } of targets) {
+  for (const { role, agentId, actorRecordId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
       continue;
@@ -12137,7 +12167,7 @@ async function mintMissingSeatKeys(route2, o) {
           "Content-Type": "application/json",
           "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
         },
-        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}`, ...actorRecordId ? { actorRecordId } : {} })
       });
       if (res.status === 403) {
         out.push({ role, action: "forbidden" });
@@ -12208,8 +12238,8 @@ async function revokeSeatKeys(route2, o) {
   const resolved = route2.resolved;
   const doFetch = o.fetchImpl ?? fetch;
   const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
   ];
   let store;
   try {
@@ -12739,12 +12769,12 @@ function containerNameFor(workspaceId) {
   return `crew-passenger-${workspaceId}`;
 }
 function portFor(workspaceId, base = 28765, span = 1e3) {
-  const digest = createHash5("sha256").update(workspaceId).digest();
+  const digest = createHash6("sha256").update(workspaceId).digest();
   return base + digest.readUInt32BE(0) % span;
 }
 function mountsDigest(mounts, image) {
   const sorted2 = [...mounts].sort((a, b) => a.containerPath.localeCompare(b.containerPath));
-  return createHash5("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
 }
 function planContainers(cfg) {
   const byWorkspace = /* @__PURE__ */ new Map();
@@ -12947,7 +12977,7 @@ echo "password=$CREW_FORGE_TOKEN"
 `;
 var MCP_CONFIG = `${JSON.stringify({ mcpServers: {} }, null, 2)}
 `;
-var hash = (parts) => createHash6("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 12);
+var hash = (parts) => createHash7("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 12);
 var slug = (s) => s.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
 var run2 = (cmd) => `RUN ["/bin/bash", "-c", ${JSON.stringify(`set -euo pipefail; ${cmd}`)}]`;
 var CREW_ENV = {
@@ -14372,13 +14402,13 @@ import { hostname as hostname3 } from "os";
 
 // src/machine-id.ts
 import { execFileSync as execFileSync10 } from "child_process";
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname19, join as join37 } from "path";
 function machineIdPathFor(stateDir) {
   return join37(stateDir, "machine-id");
 }
-var sha256 = (s) => createHash7("sha256").update(s).digest("hex");
+var sha256 = (s) => createHash8("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
@@ -20560,7 +20590,7 @@ async function runAgentsSync(target, o) {
 }
 
 // src/logbook.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
 var LogbookError = class extends Error {
 };
@@ -20646,7 +20676,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
     };
   }
   const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
-  const actualSha = createHash8("sha256").update(prompt).digest("hex");
+  const actualSha = createHash9("sha256").update(prompt).digest("hex");
   const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
   return {
     entry,
@@ -22228,7 +22258,7 @@ function shipIdentityJson(s) {
 }
 
 // src/mcp-endpoint-registry.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function endpointsUrl(api, workspaceId, id) {
   const base = `${api.baseUrl.replace(/\/+$/, "")}/api/workspaces/${workspaceId}/mcp-endpoints`;
   return id ? `${base}/${id}` : base;
@@ -22298,7 +22328,7 @@ async function probeEndpointAccess(api, workspaceId) {
 }
 var REGISTER_MCP_ENDPOINTS_HINT = "give this key's role the REGISTER_MCP_ENDPOINTS capability, e.g. via the group that holds the Crew project role";
 function registrationKey(url, mcpSecret, controlUrl) {
-  return createHash9("sha256").update(`${url}
+  return createHash10("sha256").update(`${url}
 ${mcpSecret ?? ""}
 ${controlUrl ?? ""}`).digest("hex").slice(0, 16);
 }
@@ -23681,7 +23711,7 @@ async function buildEnvironment(route2, ship, ticket) {
 }
 
 // src/control-api.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync6,
@@ -23941,7 +23971,7 @@ var ControlAuth = class {
     if (!token) return "unauthorized";
     for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
     const now = (this.o.now ?? Date.now)();
-    const id = createHash10("sha256").update(token).digest("hex");
+    const id = createHash11("sha256").update(token).digest("hex");
     const hit = this.cache.get(id);
     if (hit && now - hit.at < (this.o.cacheMs ?? 6e4)) return hit.verdict;
     const verdict = await this.ask(token);
@@ -23962,7 +23992,7 @@ var ControlAuth = class {
     for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
     for (const k of this.o.workspaceSecrets?.(workspaceId) ?? []) if (k && secretsMatch(token, k)) return "ok";
     const now = (this.o.now ?? Date.now)();
-    const id = `${workspaceId}:${createHash10("sha256").update(token).digest("hex")}`;
+    const id = `${workspaceId}:${createHash11("sha256").update(token).digest("hex")}`;
     const hit = this.cache.get(id);
     if (hit && now - hit.at < (this.o.cacheMs ?? 6e4)) return hit.verdict;
     const verdict = await this.ask(token, [workspaceId]);

package/dist/sandbox-intel-bridge.cjs

@@ -24646,6 +24646,8 @@ function parseEndpoint(raw, defaultPort = 443) {
   if (!IPV4.test(host) && !HOST.test(host)) throw new SandboxPolicyError(`"${raw}" is not a valid host name`);
   return { host, port };
 }
+var CREW_BIN = "/opt/crew/bin";
+var TOOL_BINARIES = ["/usr/bin/curl", `${CREW_BIN}/node`, "/usr/bin/node", "/usr/local/bin/node", "/usr/bin/npm", "/usr/local/bin/npm", "/usr/local/bin/pnpm", "/usr/bin/corepack", "/usr/local/bin/corepack"];
 function parseSandboxNetwork(raw, file, fail2) {
   if (raw === void 0 || raw === null) return void 0;
   if (typeof raw !== "object" || Array.isArray(raw)) throw fail2(`${file}: sandbox must be a mapping`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.126.9",
+  "version": "0.126.11",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",