@tablation/crew 0.127.0 → 0.127.2

package/dist/cli.js

@@ -6356,7 +6356,7 @@ function attentionProblems(items, already) {
 import { createHash as createHash7 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync28, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
 import { dirname as dirname15, join as join32 } from "path";
 import { fileURLToPath } from "url";
 import { tmpdir as tmpdir3 } from "os";
@@ -6374,12 +6374,12 @@ import { spawnSync as spawnSync7 } from "child_process";
 import { existsSync as existsSync29, readdirSync as readdirSync11 } from "fs";
 
 // src/interrupted.ts
-import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync27 } from "fs";
 import { join as join30 } from "path";
 
 // src/agent.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync25, existsSync as existsSync26, statSync as statSync8, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, createWriteStream, openSync as openSync4, closeSync as closeSync4, readSync } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync26, statSync as statSync8, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, createWriteStream, openSync as openSync4, closeSync as closeSync4, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
 import { join as join29, dirname as dirname14, basename as basename9 } from "path";
@@ -6887,6 +6887,97 @@ var State = class _State {
   }
 };
 
+// src/signed-out.ts
+import { readFileSync as readFileSync20 } from "fs";
+var SIGNED_OUT_PATTERN = /not logged in|please run \/?login|\/login|invalid api key|failed to authenticate|oauth session expired|could not be refreshed|reauthentication is needed|application default credentials/i;
+function authModeOf(spec, hostEnv = process.env) {
+  const env = { ...hostEnv, ...spec.env };
+  const on = (v) => !!v && v !== "0" && v.toLowerCase() !== "false";
+  if (spec.auth === "subscription") return "login";
+  if (on(env.CLAUDE_CODE_USE_VERTEX)) return "vertex";
+  if (env.ANTHROPIC_API_KEY) return "api-key";
+  return "login";
+}
+var SIGNED_OUT_REMEDY = {
+  vertex: "run `gcloud auth application-default login` on this Mac",
+  "api-key": "check the API key the toolchain uses (ANTHROPIC_API_KEY) is valid and unrevoked",
+  login: "run `claude` in a terminal on this Mac and `/login`"
+};
+function signedOutMessage(toolchain, mode) {
+  return `toolchain ${toolchain} is signed out \u2014 its runs end at the harness's sign-out error. To fix: ${SIGNED_OUT_REMEDY[mode]}`;
+}
+var signedOutKey = (toolchain) => `signed_out:${toolchain}`;
+function signedOutItem(toolchain, mode, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  return { kind: "signed_out", key: signedOutKey(toolchain), since: nowIso, message: signedOutMessage(toolchain, mode) };
+}
+var textOf = (v) => typeof v === "string" ? v : JSON.stringify(v ?? "");
+function eventsShowSignedOut(events) {
+  let assistantTurns = 0;
+  let toolUse = false;
+  let onlyTurnSignedOut = false;
+  for (const ev of events) {
+    if (typeof ev !== "object" || ev === null) continue;
+    const e = ev;
+    if (e.type === "result") {
+      if (e.is_error === true && SIGNED_OUT_PATTERN.test(textOf(e.result))) return true;
+    } else if (e.type === "assistant") {
+      assistantTurns++;
+      const content = Array.isArray(e.message?.content) ? e.message.content : [];
+      if (content.some((b) => b?.type === "tool_use")) toolUse = true;
+      if (SIGNED_OUT_PATTERN.test(textOf(e.message))) {
+        if (e.isApiErrorMessage === true || e.error !== void 0) return true;
+        onlyTurnSignedOut = true;
+      }
+    }
+  }
+  return assistantTurns === 1 && onlyTurnSignedOut && !toolUse;
+}
+function streamShowsSignedOut(streamPath) {
+  let raw;
+  try {
+    raw = readFileSync20(streamPath, "utf8");
+  } catch {
+    return false;
+  }
+  if (!SIGNED_OUT_PATTERN.test(raw)) return false;
+  const events = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return eventsShowSignedOut(events);
+}
+function streamShowsRealTurn(streamPath) {
+  let raw;
+  try {
+    raw = readFileSync20(streamPath, "utf8");
+  } catch {
+    return false;
+  }
+  return raw.split("\n").some((line) => {
+    if (!line.includes('"assistant"')) return false;
+    try {
+      const e = JSON.parse(line);
+      return e.type === "assistant" && e.isApiErrorMessage !== true && e.error === void 0 && !SIGNED_OUT_PATTERN.test(textOf(e.message));
+    } catch {
+      return false;
+    }
+  });
+}
+var SignedOutError = class extends Error {
+  toolchain;
+  mode;
+  constructor(toolchain, mode) {
+    super(signedOutMessage(toolchain, mode));
+    this.toolchain = toolchain;
+    this.mode = mode;
+  }
+};
+var SIGNED_OUT_PAUSE_MS = 15 * 60 * 1e3;
+
 // src/environment.ts
 import { basename as basename6 } from "path";
 
@@ -7286,7 +7377,7 @@ function renderEnvironment(i) {
 }
 
 // src/intel-bridge.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync20, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync21, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname11, join as join22 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -7313,7 +7404,7 @@ function writeAttachFile(file, url) {
 }
 function readAttachFile(file) {
   try {
-    const url = readFileSync20(file, "utf8").trim();
+    const url = readFileSync21(file, "utf8").trim();
     return /^https?:\/\/\S+$/i.test(url) ? url : void 0;
   } catch {
     return void 0;
@@ -7692,7 +7783,7 @@ var BeforeFirstEditTracker = class {
 };
 
 // src/agent-log.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync15, readdirSync as readdirSync6, readFileSync as readFileSync21, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync15, readdirSync as readdirSync6, readFileSync as readFileSync22, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "fs";
 import { join as join23 } from "path";
 
 // src/pending-backoff.ts
@@ -7909,7 +8000,7 @@ async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__
     const path = join23(dir, f);
     let q2;
     try {
-      q2 = JSON.parse(readFileSync21(path, "utf8"));
+      q2 = JSON.parse(readFileSync22(path, "utf8"));
     } catch {
       continue;
     }
@@ -7962,7 +8053,7 @@ async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /
     const path = join23(dir, f);
     let q2;
     try {
-      q2 = JSON.parse(readFileSync21(path, "utf8"));
+      q2 = JSON.parse(readFileSync22(path, "utf8"));
     } catch {
       continue;
     }
@@ -8184,7 +8275,7 @@ var HandoffTranscriptTracker = class {
 };
 
 // src/pending-handoff.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync22, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync23, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "fs";
 import { join as join25 } from "path";
 
 // src/ticket-branch.ts
@@ -9879,7 +9970,7 @@ function listPendingHandoffs(stateDir, route2) {
   const out = [];
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     try {
-      const rec = JSON.parse(readFileSync22(join25(dir, f), "utf8"));
+      const rec = JSON.parse(readFileSync23(join25(dir, f), "utf8"));
       if (rec.version === 1 && rec.ticketRecordId && (!route2 || rec.route === route2)) out.push(rec);
     } catch {
     }
@@ -9997,7 +10088,7 @@ function expandSkillMarkers(text2, lookup2, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync24, readdirSync as readdirSync8, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync25, readdirSync as readdirSync8, existsSync as existsSync25 } from "fs";
 import { join as join27 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError3, TablationApiError as TablationApiError2 } from "@tablation/client";
@@ -10014,7 +10105,7 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync23, existsSync as existsSync24 } from "fs";
+import { readFileSync as readFileSync24, existsSync as existsSync24 } from "fs";
 import { join as join26 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError2, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -10031,10 +10122,10 @@ var AgentsSyncError = class extends Error {
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join26(promptsDir, "personas", `lane-${role}.md`);
   if (!existsSync24(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync23(briefPath, "utf8");
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync24(briefPath, "utf8");
   const commonPath = join26(promptsDir, "personas", "common.md");
-  if (!existsSync24(commonPath)) return readFileSync23(briefPath, "utf8");
-  return `${readFileSync23(commonPath, "utf8")}${readFileSync23(briefPath, "utf8")}`;
+  if (!existsSync24(commonPath)) return readFileSync24(briefPath, "utf8");
+  return `${readFileSync24(commonPath, "utf8")}${readFileSync24(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route2, role, opts) {
   const cached = route2.resolved?.agentPersonas?.[role]?.agentId;
@@ -10481,7 +10572,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text2 = readFileSync24(path, "utf8");
+  const text2 = readFileSync25(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text2);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -11061,7 +11152,7 @@ var ALLOWANCE_REFUSAL_MARKER = "AI_ALLOWANCE_EXCEEDED";
 function streamShowsAllowanceRefusal(streamPath) {
   let raw;
   try {
-    raw = readFileSync25(streamPath, "utf8");
+    raw = readFileSync26(streamPath, "utf8");
   } catch {
     return false;
   }
@@ -11147,10 +11238,10 @@ function planAgentRun(o) {
   let ageSeconds;
   if (existsSync26(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync8(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync25(digestPath2, "utf8");
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync26(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync25(commonPath, "utf8") : "";
-  const brief = readFileSync25(briefPath, "utf8");
+  const common = usesCommon ? readFileSync26(commonPath, "utf8") : "";
+  const brief = readFileSync26(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = appendAdditions(o.divergedPrompt ?? brief, o.personaAdditions);
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -11239,6 +11330,7 @@ function planAgentRun(o) {
     toolchain: toolchain.name,
     harness: toolchain.harness,
     workspaceAuth: toolchain.auth === "workspace",
+    authMode: authModeOf(toolchain),
     provider: toolchainProvider(toolchain),
     maxRunMinutes: resolveMaxRunMinutes(o.route.maxRunMinutes, toolchain.maxRunMinutes),
     ...o.ship.runner === "sandbox" ? {
@@ -11305,7 +11397,7 @@ function describePlan(p) {
 var pidPathFor = (streamPath) => `${streamPath}.pid`;
 function readRunSidecar(streamPath) {
   try {
-    const sc = JSON.parse(readFileSync25(pidPathFor(streamPath), "utf8"));
+    const sc = JSON.parse(readFileSync26(pidPathFor(streamPath), "utf8"));
     return typeof sc.pid === "number" && typeof sc.spawnedAt === "string" && typeof sc.role === "string" ? sc : null;
   } catch {
     return null;
@@ -11620,10 +11712,11 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
       ...result?.costUsd !== void 0 ? { totalCostUsd: result.costUsd } : {}
     }
   });
+  const signedOut = !end.interrupted && streamShowsSignedOut(id.streamPath);
   if (id.agentLog && agentLogKey) {
     const report = {
       ticketReference: attributedTicket,
-      outcome: end.interrupted ? "interrupted" : end.code === 0 || end.code === null && obs.sawResult ? "success" : "error",
+      outcome: end.interrupted ? "interrupted" : signedOut ? "error" : end.code === 0 || end.code === null && obs.sawResult ? "success" : "error",
       startedAt,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
       cycles: obs.cycles,
@@ -11878,7 +11971,7 @@ function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
   if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync26(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync27(path, "utf8")).running !== true;
   } catch {
     return true;
   }
@@ -12969,7 +13062,7 @@ var SANDBOX_BRIDGE_PATH = `${CREW_PREFIX}/bin/intel-bridge`;
 function readBridgeBundle() {
   const here = dirname15(fileURLToPath(import.meta.url));
   for (const p of [join32(here, "sandbox-intel-bridge.cjs"), join32(here, "..", "dist", "sandbox-intel-bridge.cjs")]) {
-    if (existsSync30(p)) return readFileSync27(p, "utf8");
+    if (existsSync30(p)) return readFileSync28(p, "utf8");
   }
   return void 0;
 }
@@ -13121,7 +13214,7 @@ var shipSandboxRef = () => ({ name: SHIP_SANDBOX_KEY, decl: { packages: [], setu
 var sandboxStatePath = (stateDir) => join32(stateDir, "sandbox-images.json");
 function readSandboxState(stateDir) {
   try {
-    const v = JSON.parse(readFileSync27(sandboxStatePath(stateDir), "utf8"));
+    const v = JSON.parse(readFileSync28(sandboxStatePath(stateDir), "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : {};
   } catch {
     return {};
@@ -13253,7 +13346,7 @@ async function sandboxBuildTick(repos, deps, force = false) {
 }
 
 // src/doctor-checks.ts
-import { execFileSync as execFileSync9 } from "child_process";
+import { execFileSync as execFileSync9, spawnSync as spawnSync8 } from "child_process";
 var PROBE_BRANCH = "crew-probe-branch";
 var realGit = (cwd, args, env) => {
   execFileSync9("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
@@ -13386,10 +13479,25 @@ function managedRuntimeWarnings(kind, ship) {
   }
   return out;
 }
+var MANAGED_GIT_EMAIL = "crew@tablation.dev";
+function readGlobalGitIdentity() {
+  const get2 = (key) => {
+    const res = spawnSync8("git", ["config", "--global", "--get", key], { encoding: "utf8" });
+    const v = (res.stdout ?? "").trim();
+    return res.status === 0 && v ? v : null;
+  };
+  return { name: get2("user.name"), email: get2("user.email") };
+}
+function managedGitIdentityWarnings(kind, identity) {
+  if (kind !== "managed_instance" && kind !== "pooled_instance" && kind !== "pooled") return [];
+  const missing = [identity.name ? "" : "user.name", identity.email ? "" : "user.email"].filter(Boolean);
+  if (missing.length === 0) return [];
+  return [`git ${missing.join(" and ")} not set for this user on a ${kind} ship; every commit crew makes here fails with "Committer identity unknown" (re-run \`crew provision\`, or \`git config --global user.name <ship name>\` and \`user.email ${MANAGED_GIT_EMAIL}\`)`];
+}
 
 // src/selftest.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync28, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync29, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join33 } from "path";
 var SELFTEST_TIMEOUT_MS = 12e4;
@@ -13523,6 +13631,11 @@ ${seen.texts.join("\n")}`)) {
     return fail2("mcp-unavailable", "the tracker MCP tool was not available to the session");
   }
   const answered = seen.texts.length > 0 || seen.finalText;
+  if (SIGNED_OUT_PATTERN.test(`${run3.stderr}
+${seen.finalText ?? ""}
+${seen.texts.join("\n")}`)) {
+    return { failure: "login-missing", detail: signedOutMessage(spec.name, authModeOf(spec)) };
+  }
   if (!answered || LOGIN.test(run3.stderr) || LOGIN.test(seen.finalText ?? "")) {
     return fail2("login-missing", `\`${bin}\` exited${run3.code !== null ? ` (${run3.code})` : ""} before answering; the vendor login is probably missing`);
   }
@@ -13589,7 +13702,7 @@ var fileFor2 = (stateDir) => join33(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync31(p) ? JSON.parse(readFileSync28(p, "utf8")) : {};
+    return existsSync31(p) ? JSON.parse(readFileSync29(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -13613,7 +13726,7 @@ function doctorSelftestLines(stored, toolchains) {
 import { resolve as resolve7, dirname as dirname34, join as join56, basename as basename16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { hostname as hostname5, homedir as homedir11 } from "os";
-import { spawnSync as spawnSync11 } from "child_process";
+import { spawnSync as spawnSync12 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
 
 // src/argv.ts
@@ -13808,14 +13921,14 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/connect-resume.ts
-import { mkdirSync as mkdirSync21, readFileSync as readFileSync29, rmSync as rmSync17, writeFileSync as writeFileSync22 } from "fs";
+import { mkdirSync as mkdirSync21, readFileSync as readFileSync30, rmSync as rmSync17, writeFileSync as writeFileSync22 } from "fs";
 import { dirname as dirname16, join as join34 } from "path";
 function lastSessionFile(stateDir) {
   return join34(stateDir, "connect-session.json");
 }
 function readPointers(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync29(lastSessionFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync30(lastSessionFile(stateDir), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const out = {};
     for (const [host, v] of Object.entries(parsed)) {
@@ -13915,7 +14028,7 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync30, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
 import { dirname as dirname17, join as join35 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
@@ -13923,7 +14036,7 @@ function clonedCheckoutsFile(stateDir) {
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync30(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync31(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -14114,7 +14227,7 @@ async function runDeprovision(o, fx, deps) {
 }
 
 // src/pool-member.ts
-import { mkdirSync as mkdirSync23, readFileSync as readFileSync31, renameSync as renameSync4, writeFileSync as writeFileSync24 } from "fs";
+import { mkdirSync as mkdirSync23, readFileSync as readFileSync32, renameSync as renameSync4, writeFileSync as writeFileSync24 } from "fs";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname18, join as join36 } from "path";
 var POOL_EXIT = { ok: 0, failed: 1, credential: 2 };
@@ -14354,7 +14467,7 @@ function fileMemberStore(dir) {
   return {
     read() {
       try {
-        return JSON.parse(readFileSync31(file, "utf8"));
+        return JSON.parse(readFileSync32(file, "utf8"));
       } catch {
         return {};
       }
@@ -14420,7 +14533,7 @@ import { hostname as hostname3 } from "os";
 // src/machine-id.ts
 import { execFileSync as execFileSync10 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname19, join as join37 } from "path";
 function machineIdPathFor(stateDir) {
   return join37(stateDir, "machine-id");
@@ -14437,7 +14550,7 @@ function readRawMachineId(platform2 = process.platform) {
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       if (existsSync33(p)) {
-        const id = readFileSync32(p, "utf8").trim();
+        const id = readFileSync33(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -14449,7 +14562,7 @@ function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
   if (existsSync33(path)) {
-    const cached = readFileSync32(path, "utf8").trim();
+    const cached = readFileSync33(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
@@ -14468,8 +14581,8 @@ function matchShipRows(ships, shipName2, machineId) {
 }
 
 // src/provision.ts
-import { spawnSync as spawnSync8 } from "child_process";
-import { existsSync as existsSync34, readFileSync as readFileSync33, writeFileSync as writeFileSync26 } from "fs";
+import { spawnSync as spawnSync9 } from "child_process";
+import { existsSync as existsSync34, readFileSync as readFileSync34, writeFileSync as writeFileSync26 } from "fs";
 import { hostname as hostname2 } from "os";
 import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
@@ -14916,6 +15029,11 @@ async function runProvision(o, deps, write, human) {
       emit("connect", `set ${key}`, { setting: key });
     }
   }
+  if (isManagedShipKind(o.shipKind)) {
+    summary.gitIdentity = deps.ensureGitIdentity(shipName2, MANAGED_GIT_EMAIL);
+    if (summary.gitIdentity === "set") summary.changed = true;
+    emit("git_identity", `git identity: ${summary.gitIdentity}`, { action: summary.gitIdentity });
+  }
   for (const host of o.forgeHosts) {
     const token = o.tokens[host];
     const stored = deps.storedToken(host);
@@ -15072,7 +15190,7 @@ function realProvisionDeps(crewHome) {
     const env = { ...process.env, ...o.env };
     delete env.CREW_FORGE_TOKEN;
     for (const k of Object.keys(env)) if (k.startsWith("CREW_CONNECT_KEY_")) delete env[k];
-    const res = spawnSync8(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
+    const res = spawnSync9(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
     return { status: res.status ?? 1, stdout: res.stdout ?? "", stderr: `${res.stderr ?? ""}${res.error ? String(res.error) : ""}` };
   };
   const configFile = () => {
@@ -15085,7 +15203,7 @@ function realProvisionDeps(crewHome) {
     enableRoute(route2) {
       const file = configFile();
       if (!file) return false;
-      const text2 = readFileSync33(file, "utf8");
+      const text2 = readFileSync34(file, "utf8");
       const doc = parseDocument3(text2);
       const routes = doc.get("routes");
       const entry = routes?.items?.find((r) => r.get("route") === route2);
@@ -15111,7 +15229,7 @@ function realProvisionDeps(crewHome) {
           continue;
         }
         for (const p of plan.unitPaths) {
-          if (!existsSync34(p) || readFileSync33(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+          if (!existsSync34(p) || readFileSync34(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
         }
       }
       const label = labelFor(crewHome, "run");
@@ -15120,22 +15238,22 @@ function realProvisionDeps(crewHome) {
       if (mechanism === "systemd") {
         const system = ctx.root || existsSync34(systemUnitPathFor(label));
         const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
-        running = spawnSync8(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
+        running = spawnSync9(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
         if (!system) {
-          const out = spawnSync8("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
+          const out = spawnSync9("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
           lingering = /Linger=yes/.test(out.stdout ?? "");
         }
       } else if (mechanism === "cron") {
         running = true;
       } else if (mechanism === "launchd") {
-        running = spawnSync8("launchctl", ["list", label]).status === 0;
+        running = spawnSync9("launchctl", ["list", label]).status === 0;
       }
       return { mechanism, unitsStale, running, lingering };
     },
     setShipSetting(key, value2) {
       const file = configFile();
       if (!file) return false;
-      const doc = parseDocument3(readFileSync33(file, "utf8"));
+      const doc = parseDocument3(readFileSync34(file, "utf8"));
       if (doc.getIn(["ship", key]) === value2) return false;
       doc.setIn(["ship", key], value2);
       writeFileSync26(file, doc.toString());
@@ -15144,11 +15262,22 @@ function realProvisionDeps(crewHome) {
     applyManagedDefaults() {
       const file = configFile();
       if (!file) return [];
-      const doc = parseDocument3(readFileSync33(file, "utf8"));
+      const doc = parseDocument3(readFileSync34(file, "utf8"));
       const wrote = applyManagedDefaultsToDoc(doc);
       if (wrote.length) writeFileSync26(file, doc.toString());
       return wrote;
     },
+    ensureGitIdentity(name, email) {
+      const have = readGlobalGitIdentity();
+      let wrote = false;
+      for (const [key, value2] of [["user.name", have.name ? null : name], ["user.email", have.email ? null : email]]) {
+        if (value2 === null) continue;
+        const res = spawnSync9("git", ["config", "--global", key, value2], { encoding: "utf8" });
+        if (res.status !== 0) throw new Error(`git config --global ${key}: ${(res.stderr ?? "").trim() || `exited ${res.status}`}`);
+        wrote = true;
+      }
+      return wrote ? "set" : "kept";
+    },
     storedToken(host) {
       const res = spawnCrew(["credential", "get"], { input: `protocol=https
 host=${host}
@@ -15163,7 +15292,7 @@ host=${host}
 
 // src/tunnel.ts
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync34, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync35, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
 import { randomInt } from "crypto";
 import { join as join39 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -15249,7 +15378,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync35(path)) return void 0;
   try {
-    return JSON.parse(readFileSync34(path, "utf8"));
+    return JSON.parse(readFileSync35(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -16794,7 +16923,7 @@ async function resolveOne(tracker, t, seat, approvedStatus, buildingStatus, affi
 }
 
 // src/repo-refresh.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync35, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync29 } from "fs";
 import { dirname as dirname21 } from "path";
 var REFRESH_COOLDOWN_MS = 2 * 6e4;
 var UNSERVABLE_PASSES_BEFORE_ATTENTION = 3;
@@ -16825,7 +16954,7 @@ function applyRepoRows(resolved, rows) {
 function persistRepoRows(stateDir, routeName, rows) {
   const path = resolvedPathFor(stateDir, routeName);
   if (!existsSync37(path)) return;
-  const raw = JSON.parse(readFileSync35(path, "utf8"));
+  const raw = JSON.parse(readFileSync36(path, "utf8"));
   applyRepoRows(raw, rows);
   mkdirSync26(dirname21(path), { recursive: true });
   writeFileSync29(path, `${JSON.stringify(raw, null, 2)}
@@ -17478,7 +17607,7 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync36, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
 import { dirname as dirname24, join as join43 } from "path";
 import { tmpdir as tmpdir5, hostname as hostname4 } from "os";
 
@@ -18255,7 +18384,7 @@ async function bump(o, size) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const firstText = readFileSync36(first, "utf8");
+  const firstText = readFileSync37(first, "utf8");
   const problem = versionFileProblem(o.repo.release.versionFiles[0], firstText);
   if (problem) {
     o.emit.error(problem);
@@ -18274,7 +18403,7 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync36(f, "utf8");
+    const src = readFileSync37(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
@@ -18293,7 +18422,7 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync39(path) ? readFileSync36(path, "utf8") : "# Changelog\n";
+  const existing = existsSync39(path) ? readFileSync37(path, "utf8") : "# Changelog\n";
   writeFileSync31(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
@@ -19810,7 +19939,7 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync37, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
 import { dirname as dirname26 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
@@ -19874,7 +20003,7 @@ async function syncRouteName(i) {
 function readSyncedName(resolvedFile) {
   if (!existsSync42(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync37(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync38(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
@@ -19884,7 +20013,7 @@ function writeSyncedName(resolvedFile, name) {
   if (!existsSync42(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync37(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync38(resolvedFile, "utf8"));
   } catch {
     return;
   }
@@ -19899,7 +20028,7 @@ function writeSyncedName(resolvedFile, name) {
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync37(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync38(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -19923,7 +20052,7 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text2 = readFileSync37(i.configFile, "utf8");
+    const text2 = readFileSync38(i.configFile, "utf8");
     writeFileSync32(i.configFile, setShipNameInYaml(text2, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
@@ -20583,7 +20712,7 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync39, writeFileSync as writeFileSync33 } from "fs";
 import { dirname as dirname27 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
@@ -20617,7 +20746,7 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync43(resolvedPath) ? JSON.parse(readFileSync38(resolvedPath, "utf8")) : {};
+    const raw = existsSync43(resolvedPath) ? JSON.parse(readFileSync39(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
@@ -20738,8 +20867,8 @@ async function showLogEntry(route2, entryId, opts = {}) {
 }
 
 // src/repos-check.ts
-import { spawnSync as spawnSync10 } from "child_process";
-import { readFileSync as readFileSync39 } from "fs";
+import { spawnSync as spawnSync11 } from "child_process";
+import { readFileSync as readFileSync40 } from "fs";
 import { basename as basename11 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
 function checkHookSyntax(script, shell) {
@@ -20747,10 +20876,10 @@ function checkHookSyntax(script, shell) {
   const name = basename11(spec.bin).replace(/\.exe$/i, "").toLowerCase();
   let run3;
   if (POSIX_SHELL.test(name)) {
-    run3 = spawnSync10(spec.bin, ["-n"], { input: script, encoding: "utf8" });
+    run3 = spawnSync11(spec.bin, ["-n"], { input: script, encoding: "utf8" });
   } else if (/^(pwsh|powershell)$/.test(name)) {
     const parse3 = "$e=$null;[void][System.Management.Automation.Language.Parser]::ParseInput($env:CREW_CHECK_SCRIPT,[ref]$null,[ref]$e);if($e){$e|ForEach-Object{[Console]::Error.WriteLine($_.Message)};exit 1}";
-    run3 = spawnSync10(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
+    run3 = spawnSync11(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
       encoding: "utf8",
       env: { ...process.env, CREW_CHECK_SCRIPT: script }
     });
@@ -20780,7 +20909,7 @@ function checkRepoSpec(dir, opts = {}) {
   }
   let parsed;
   try {
-    parsed = parseRepoConfig(readFileSync39(file, "utf8"), file);
+    parsed = parseRepoConfig(readFileSync40(file, "utf8"), file);
   } catch (e) {
     if (!(e instanceof RepoConfigError)) throw e;
     return { ...empty, file, error: e.message, exitCode: 1 };
@@ -21312,7 +21441,7 @@ function planSampleTicket(i) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync44, readFileSync as readFileSync40, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync41, readdirSync as readdirSync14 } from "fs";
 import { basename as basename13, dirname as dirname29, join as join45, resolve as resolve5 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -21493,7 +21622,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync40(resolve5(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync41(resolve5(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -21643,11 +21772,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync46, existsSync as existsSync52, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync47, existsSync as existsSync52, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync41, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
+import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync42, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
 import { join as join47 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -21673,7 +21802,7 @@ function writePeriscopePrior(stateDir, ticketRecordId, prior) {
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync46(p) ? JSON.parse(readFileSync41(p, "utf8")) : void 0;
+    return existsSync46(p) ? JSON.parse(readFileSync42(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -22228,7 +22357,7 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync13 } from "child_process";
-import { existsSync as existsSync47, mkdirSync as mkdirSync33, readFileSync as readFileSync42, chmodSync as chmodSync3 } from "fs";
+import { existsSync as existsSync47, mkdirSync as mkdirSync33, readFileSync as readFileSync43, chmodSync as chmodSync3 } from "fs";
 import { dirname as dirname30, join as join49 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -22262,7 +22391,7 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync47(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync42(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync43(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -22426,7 +22555,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn9 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync48, mkdirSync as mkdirSync34, readFileSync as readFileSync43, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync34, readFileSync as readFileSync44, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
 import { join as join50 } from "path";
 
 // src/secret-compare.ts
@@ -22526,7 +22655,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync48(path)) return void 0;
   try {
-    return JSON.parse(readFileSync43(path, "utf8"));
+    return JSON.parse(readFileSync44(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -23075,7 +23204,7 @@ function contractFixers(dir, baseRef, tickets, locate) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync49, mkdirSync as mkdirSync36, readFileSync as readFileSync44, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
+import { existsSync as existsSync49, mkdirSync as mkdirSync36, readFileSync as readFileSync45, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
 import { join as join52 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -23196,7 +23325,7 @@ function noteDaemonStarted(stateDir, now = Date.now()) {
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync44(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync45(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -23379,6 +23508,12 @@ async function runOnePassUnguarded(o) {
         clearShipAttention(o.state, workspaceAllowanceKey(role));
       }).catch(async (e) => {
         const message = e.message;
+        if (e instanceof SignedOutError) {
+          breaker.pause(role, SIGNED_OUT_PAUSE_MS);
+          emit.warn(`${role} paused: ${message}`, { step: "agent", role });
+          await raiseShipAttention({ state: o.state, emit, route: o.route, ship: o.ship }, signedOutItem(e.toolchain, e.mode));
+          return;
+        }
         if (e instanceof WorkspaceAllowanceExhausted) {
           breaker.pause(role, ALLOWANCE_PAUSE_MS);
           emit.warn(`${role} paused: ${message}`, { step: "agent", role });
@@ -23720,6 +23855,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       if (plan.workspaceAuth && streamShowsAllowanceRefusal(plan.streamPath)) {
         throw new WorkspaceAllowanceExhausted("the inference endpoint refused the run: the workspace is past its AI allowance");
       }
+      await settleSignOut(plan, tracker, ctx.state, workingId, emit);
     }
   } finally {
     await settleRunEnd({
@@ -23756,6 +23892,26 @@ async function buildEnvironment(route2, ship, ticket) {
   const attachments = await tracker.attachmentsProbe().catch(() => null);
   return renderEnvironment({ route: route2, userAgent: ship.userAgent, repos: await withRepoMaps(repos, ship.mapTokenBudget, ship.shell), contract, sourceTicket: ticket, authorship, attachments, shipName: ship.name, ...sandboxEnv(ship) });
 }
+async function settleSignOut(plan, tracker, state, ticketId, emit) {
+  const toolchain = plan.toolchain;
+  if (!toolchain) return;
+  if (!streamShowsSignedOut(plan.streamPath)) {
+    if (streamShowsRealTurn(plan.streamPath)) clearShipAttention(state, signedOutKey(toolchain));
+    return;
+  }
+  if (ticketId) {
+    try {
+      const affinity = await tracker.claimAffinity();
+      const current = await tracker.ticket(ticketId);
+      if (affinity && current[affinity.column] === affinity.shipId) {
+        await tracker.updateTicket(ticketId, { [affinity.column]: null }, current.updated_at);
+      }
+    } catch (e) {
+      emit.warn(`could not release the ticket hold after a sign-out: ${e.message}`, { step: "agent" });
+    }
+  }
+  throw new SignedOutError(toolchain, plan.authMode ?? "login");
+}
 
 // src/control-api.ts
 import { createHash as createHash11 } from "crypto";
@@ -24446,7 +24602,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync51, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync45, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync51, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync46, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
 import { join as join54 } from "path";
 var secretDir = (stateDir) => join54(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join54(secretDir(stateDir), `${id}.json`);
@@ -24463,7 +24619,7 @@ function mintPeriscopeSecret(stateDir, ticketRecordId) {
 }
 function readPeriscopeSecret(stateDir, ticketRecordId) {
   try {
-    const v = JSON.parse(readFileSync45(secretFile(stateDir, ticketRecordId), "utf8"));
+    const v = JSON.parse(readFileSync46(secretFile(stateDir, ticketRecordId), "utf8"));
     return typeof v.secret === "string" && v.secret ? v.secret : void 0;
   } catch {
     return void 0;
@@ -24474,7 +24630,7 @@ function removePeriscopeSecret(stateDir, ticketRecordId) {
 }
 function readPeriscopeEndpoint(stateDir, ticketRecordId) {
   try {
-    return JSON.parse(readFileSync45(endpointFile(stateDir, ticketRecordId), "utf8"));
+    return JSON.parse(readFileSync46(endpointFile(stateDir, ticketRecordId), "utf8"));
   } catch {
     return void 0;
   }
@@ -25223,7 +25379,7 @@ if (command === "provision") {
   process.exit(outcome.code);
 }
 if (command === "pool-member") {
-  const pool = poolConfigFrom(argv, process.env, () => readFileSync46(0, "utf8"));
+  const pool = poolConfigFrom(argv, process.env, () => readFileSync47(0, "utf8"));
   if (typeof pool === "string") {
     process.stderr.write(`crew pool-member: ${pool}
 `);
@@ -25487,7 +25643,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   if (command === "credential") {
-    const r = runCredential(positional[1], readFileSync46(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    const r = runCredential(positional[1], readFileSync47(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
     process.stdout.write(r.out);
     process.stderr.write(r.err);
     process.exit(r.code);
@@ -25499,9 +25655,9 @@ if (command === "passenger-sync-daemon") {
         forges: cfg.ship.forges,
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
-        readFile: (p) => readFileSync46(p, "utf8"),
+        readFile: (p) => readFileSync47(p, "utf8"),
         writeFile: (p, t) => writeFileSync38(p, t),
-        stdin: () => readFileSync46(0, "utf8"),
+        stdin: () => readFileSync47(0, "utf8"),
         env: process.env
       }
     );
@@ -25831,7 +25987,7 @@ if (command === "passenger-sync-daemon") {
 `
         );
         if (!dryRun) {
-          spawnSync11("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
+          spawnSync12("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
           try {
             unlinkSync5(staleTimer);
           } catch {
@@ -25882,7 +26038,7 @@ if (command === "passenger-sync-daemon") {
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
     const unitExists = (p) => existsSync52(p);
-    const crontab = o.host === "linux" ? spawnSync11("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
+    const crontab = o.host === "linux" ? spawnSync12("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
     for (const n of plan.notes) process.stdout.write(`fix: ${n}
@@ -25898,7 +26054,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync38(cfg.configFile, planEnable(readFileSync46(cfg.configFile, "utf8"), a.route));
+          writeFileSync38(cfg.configFile, planEnable(readFileSync47(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -27053,7 +27209,7 @@ ${cu.tail.trimEnd()}
           }
           let failed = false;
           for (const cmd2 of commands) {
-            const res2 = spawnSync11(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+            const res2 = spawnSync12(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
             if (res2.stdout) process.stdout.write(res2.stdout);
             if (res2.stderr) process.stderr.write(res2.stderr);
             if (cmd2 === control.startCommand && (res2.error || res2.status !== 0)) {
@@ -27071,7 +27227,7 @@ ${cu.tail.trimEnd()}
 `);
           break;
         }
-        const res = spawnSync11(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+        const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
         if (res.stdout) process.stdout.write(res.stdout);
         if (res.stderr) process.stderr.write(res.stderr);
         if (daemonSub !== "status" && (res.error || res.status !== 0)) {
@@ -27399,7 +27555,7 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync52(resolvedPath) ? JSON.parse(readFileSync46(resolvedPath, "utf8")) : {};
+        const raw = existsSync52(resolvedPath) ? JSON.parse(readFileSync47(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync38(dirOf2(resolvedPath), { recursive: true });
         writeFileSync38(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -27425,7 +27581,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync46(cfg.configFile, "utf8"), newName));
+      writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -27472,7 +27628,7 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync46(cfg.configFile, "utf8");
+      const configText = readFileSync47(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
@@ -27513,7 +27669,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync46(resolvePath(dir, r), "utf8");
+              return readFileSync47(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -27664,7 +27820,7 @@ ${cu.tail.trimEnd()}
       let resolvedRemotes;
       if (existsSync52(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync47(resolvedFile, "utf8"));
         } catch {
         }
       }
@@ -27686,7 +27842,7 @@ ${cu.tail.trimEnd()}
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
                   const path = resolvePath(d, f);
-                  return Object.keys(parseRepoConfig(readFileSync46(path, "utf8"), path).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync47(path, "utf8"), path).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -27795,7 +27951,7 @@ ${cu.tail.trimEnd()}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync52(resolvedFile)) {
-            const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
             writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -28173,7 +28329,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync46(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -28219,7 +28375,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync52(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync46(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync47(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -29528,7 +29684,7 @@ ${where.join("\n")}`);
           process.stdout.write(upOutput(res, terminal));
           const opener = openerFor(process.platform);
           if (opener && shouldOpen({ open: flag("open"), noOpen: flag("no-open"), json: jsonP, terminal })) {
-            const r = spawnSync11(opener, [res.url], { stdio: "ignore" });
+            const r = spawnSync12(opener, [res.url], { stdio: "ignore" });
             if (r.error || r.status !== 0) process.stderr.write(`crew periscope: could not open ${res.url} with ${opener}
 `);
           }
@@ -29729,7 +29885,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync46(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync47(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -29776,7 +29932,7 @@ ${where.join("\n")}`);
       }
       const host = hostPlatform();
       const control = host === "windows" ? null : planDaemonControl(CREW_HOME, host, detectSystemd());
-      const unitStatus = control?.statusCommand ? spawnSync11(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
+      const unitStatus = control?.statusCommand ? spawnSync12(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
       const unitRunning = unitStatus !== null && !unitStatus.error && unitStatus.status === 0;
       if (!unitRunning) {
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
@@ -29790,7 +29946,7 @@ ${where.join("\n")}`);
       );
       if (flag("now") && control?.stopCommand && control.startCommand) {
         for (const cmd of [control.stopCommand, control.startCommand]) {
-          const res = spawnSync11(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+          const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
           if (cmd === control.startCommand && (res.error || res.status !== 0)) {
             process.stderr.write(`crew reload: ${cmd.join(" ")} exited ${res.status ?? "error"}
 `);
@@ -29848,7 +30004,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text2 = readFileSync46(cfg.ship.logFile, "utf8").split("\n");
+        const text2 = readFileSync47(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text2.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -29871,7 +30027,7 @@ ${where.join("\n")}`);
       };
       if (!route2.resolved) fail2(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
-      const configText = readFileSync46(cfg.configFile, "utf8");
+      const configText = readFileSync47(cfg.configFile, "utf8");
       const cfgBase = dirname34(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
@@ -29909,7 +30065,7 @@ ${where.join("\n")}`);
         if (row) {
           await tracker.deleteRepoRow(row.id);
           if (existsSync52(resolvedFile)) {
-            const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
             writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -29932,7 +30088,7 @@ ${where.join("\n")}`);
         writeFileSync38(join56(dir, "README.md"), SAMPLE_README);
         writeFileSync38(join56(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
-          const r = spawnSync11("git", a, { cwd: dir, encoding: "utf8" });
+          const r = spawnSync12("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail2(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
         };
         g("init", "-b", "main");
@@ -29949,7 +30105,7 @@ ${where.join("\n")}`);
         });
         repoId = (await tracker.createRepoRow(payload)).id;
         if (existsSync52(resolvedFile)) {
-          const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+          const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
           writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -30364,7 +30520,9 @@ watermark:  ${state.watermark()}
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
         if (!flag("offline")) {
-          for (const message of managedRuntimeWarnings(await doctorShipKind(route2, cfg.ship), cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+          const shipKind = await doctorShipKind(route2, cfg.ship);
+          for (const message of managedRuntimeWarnings(shipKind, cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
+          for (const message of managedGitIdentityWarnings(shipKind, readGlobalGitIdentity())) problems.push({ severity: "attention", kind: "managed_git_identity", message });
         }
         for (const t of rejectedTunnels(cfg.ship.stateDir)) {
           problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
@@ -30421,7 +30579,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run", installContext());
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync46(p, "utf8");
+            return readFileSync47(p, "utf8");
           } catch {
             return null;
           }
@@ -30615,6 +30773,8 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
 `
           );
           for (const w of managedRuntimeWarnings(row.kind, cfg.ship)) process.stdout.write(`managed runtime:  WARN ${w}
+`);
+          for (const w of managedGitIdentityWarnings(row.kind, readGlobalGitIdentity())) process.stdout.write(`managed git:      WARN ${w}
 `);
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.127.0",
+  "version": "0.127.2",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",