@tablation/crew 0.127.1 → 0.127.3

package/dist/cli.js

@@ -6215,7 +6215,8 @@ async function raiseShipAttention(o, item) {
   const previous = store.previous();
   const next = upsert(previous, item);
   store.persist(next);
-  if (transitions(previous, next).length === 0) return false;
+  const changed2 = item.kind === "sandbox_cache" && previous.some((i) => i.key === item.key && i.message !== item.message);
+  if (transitions(previous, next).length === 0 && !changed2) return false;
   announce(o.emit, item);
   if (o.route && o.ship) {
     await notify(o.route, o.ship, { level: "warn", headline: item.message }, o.emit);
@@ -6356,7 +6357,7 @@ function attentionProblems(items, already) {
 import { createHash as createHash7 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync28, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
 import { dirname as dirname15, join as join32 } from "path";
 import { fileURLToPath } from "url";
 import { tmpdir as tmpdir3 } from "os";
@@ -6374,12 +6375,12 @@ import { spawnSync as spawnSync7 } from "child_process";
 import { existsSync as existsSync29, readdirSync as readdirSync11 } from "fs";
 
 // src/interrupted.ts
-import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync27 } from "fs";
 import { join as join30 } from "path";
 
 // src/agent.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync25, existsSync as existsSync26, statSync as statSync8, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, createWriteStream, openSync as openSync4, closeSync as closeSync4, readSync } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync26, statSync as statSync8, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, createWriteStream, openSync as openSync4, closeSync as closeSync4, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
 import { join as join29, dirname as dirname14, basename as basename9 } from "path";
@@ -6887,6 +6888,97 @@ var State = class _State {
   }
 };
 
+// src/signed-out.ts
+import { readFileSync as readFileSync20 } from "fs";
+var SIGNED_OUT_PATTERN = /not logged in|please run \/?login|\/login|invalid api key|failed to authenticate|oauth session expired|could not be refreshed|reauthentication is needed|application default credentials/i;
+function authModeOf(spec, hostEnv = process.env) {
+  const env = { ...hostEnv, ...spec.env };
+  const on = (v) => !!v && v !== "0" && v.toLowerCase() !== "false";
+  if (spec.auth === "subscription") return "login";
+  if (on(env.CLAUDE_CODE_USE_VERTEX)) return "vertex";
+  if (env.ANTHROPIC_API_KEY) return "api-key";
+  return "login";
+}
+var SIGNED_OUT_REMEDY = {
+  vertex: "run `gcloud auth application-default login` on this Mac",
+  "api-key": "check the API key the toolchain uses (ANTHROPIC_API_KEY) is valid and unrevoked",
+  login: "run `claude` in a terminal on this Mac and `/login`"
+};
+function signedOutMessage(toolchain, mode) {
+  return `toolchain ${toolchain} is signed out \u2014 its runs end at the harness's sign-out error. To fix: ${SIGNED_OUT_REMEDY[mode]}`;
+}
+var signedOutKey = (toolchain) => `signed_out:${toolchain}`;
+function signedOutItem(toolchain, mode, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  return { kind: "signed_out", key: signedOutKey(toolchain), since: nowIso, message: signedOutMessage(toolchain, mode) };
+}
+var textOf = (v) => typeof v === "string" ? v : JSON.stringify(v ?? "");
+function eventsShowSignedOut(events) {
+  let assistantTurns = 0;
+  let toolUse = false;
+  let onlyTurnSignedOut = false;
+  for (const ev of events) {
+    if (typeof ev !== "object" || ev === null) continue;
+    const e = ev;
+    if (e.type === "result") {
+      if (e.is_error === true && SIGNED_OUT_PATTERN.test(textOf(e.result))) return true;
+    } else if (e.type === "assistant") {
+      assistantTurns++;
+      const content = Array.isArray(e.message?.content) ? e.message.content : [];
+      if (content.some((b) => b?.type === "tool_use")) toolUse = true;
+      if (SIGNED_OUT_PATTERN.test(textOf(e.message))) {
+        if (e.isApiErrorMessage === true || e.error !== void 0) return true;
+        onlyTurnSignedOut = true;
+      }
+    }
+  }
+  return assistantTurns === 1 && onlyTurnSignedOut && !toolUse;
+}
+function streamShowsSignedOut(streamPath) {
+  let raw;
+  try {
+    raw = readFileSync20(streamPath, "utf8");
+  } catch {
+    return false;
+  }
+  if (!SIGNED_OUT_PATTERN.test(raw)) return false;
+  const events = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return eventsShowSignedOut(events);
+}
+function streamShowsRealTurn(streamPath) {
+  let raw;
+  try {
+    raw = readFileSync20(streamPath, "utf8");
+  } catch {
+    return false;
+  }
+  return raw.split("\n").some((line) => {
+    if (!line.includes('"assistant"')) return false;
+    try {
+      const e = JSON.parse(line);
+      return e.type === "assistant" && e.isApiErrorMessage !== true && e.error === void 0 && !SIGNED_OUT_PATTERN.test(textOf(e.message));
+    } catch {
+      return false;
+    }
+  });
+}
+var SignedOutError = class extends Error {
+  toolchain;
+  mode;
+  constructor(toolchain, mode) {
+    super(signedOutMessage(toolchain, mode));
+    this.toolchain = toolchain;
+    this.mode = mode;
+  }
+};
+var SIGNED_OUT_PAUSE_MS = 15 * 60 * 1e3;
+
 // src/environment.ts
 import { basename as basename6 } from "path";
 
@@ -7286,7 +7378,7 @@ function renderEnvironment(i) {
 }
 
 // src/intel-bridge.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync20, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync21, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname11, join as join22 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -7313,7 +7405,7 @@ function writeAttachFile(file, url) {
 }
 function readAttachFile(file) {
   try {
-    const url = readFileSync20(file, "utf8").trim();
+    const url = readFileSync21(file, "utf8").trim();
     return /^https?:\/\/\S+$/i.test(url) ? url : void 0;
   } catch {
     return void 0;
@@ -7692,7 +7784,7 @@ var BeforeFirstEditTracker = class {
 };
 
 // src/agent-log.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync15, readdirSync as readdirSync6, readFileSync as readFileSync21, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync15, readdirSync as readdirSync6, readFileSync as readFileSync22, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "fs";
 import { join as join23 } from "path";
 
 // src/pending-backoff.ts
@@ -7909,7 +8001,7 @@ async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__
     const path = join23(dir, f);
     let q2;
     try {
-      q2 = JSON.parse(readFileSync21(path, "utf8"));
+      q2 = JSON.parse(readFileSync22(path, "utf8"));
     } catch {
       continue;
     }
@@ -7962,7 +8054,7 @@ async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /
     const path = join23(dir, f);
     let q2;
     try {
-      q2 = JSON.parse(readFileSync21(path, "utf8"));
+      q2 = JSON.parse(readFileSync22(path, "utf8"));
     } catch {
       continue;
     }
@@ -8184,7 +8276,7 @@ var HandoffTranscriptTracker = class {
 };
 
 // src/pending-handoff.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync22, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync23, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "fs";
 import { join as join25 } from "path";
 
 // src/ticket-branch.ts
@@ -9879,7 +9971,7 @@ function listPendingHandoffs(stateDir, route2) {
   const out = [];
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     try {
-      const rec = JSON.parse(readFileSync22(join25(dir, f), "utf8"));
+      const rec = JSON.parse(readFileSync23(join25(dir, f), "utf8"));
       if (rec.version === 1 && rec.ticketRecordId && (!route2 || rec.route === route2)) out.push(rec);
     } catch {
     }
@@ -9997,7 +10089,7 @@ function expandSkillMarkers(text2, lookup2, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync24, readdirSync as readdirSync8, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync25, readdirSync as readdirSync8, existsSync as existsSync25 } from "fs";
 import { join as join27 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError3, TablationApiError as TablationApiError2 } from "@tablation/client";
@@ -10014,7 +10106,7 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync23, existsSync as existsSync24 } from "fs";
+import { readFileSync as readFileSync24, existsSync as existsSync24 } from "fs";
 import { join as join26 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError2, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -10031,10 +10123,10 @@ var AgentsSyncError = class extends Error {
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join26(promptsDir, "personas", `lane-${role}.md`);
   if (!existsSync24(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync23(briefPath, "utf8");
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync24(briefPath, "utf8");
   const commonPath = join26(promptsDir, "personas", "common.md");
-  if (!existsSync24(commonPath)) return readFileSync23(briefPath, "utf8");
-  return `${readFileSync23(commonPath, "utf8")}${readFileSync23(briefPath, "utf8")}`;
+  if (!existsSync24(commonPath)) return readFileSync24(briefPath, "utf8");
+  return `${readFileSync24(commonPath, "utf8")}${readFileSync24(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route2, role, opts) {
   const cached = route2.resolved?.agentPersonas?.[role]?.agentId;
@@ -10481,7 +10573,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text2 = readFileSync24(path, "utf8");
+  const text2 = readFileSync25(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text2);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -11061,7 +11153,7 @@ var ALLOWANCE_REFUSAL_MARKER = "AI_ALLOWANCE_EXCEEDED";
 function streamShowsAllowanceRefusal(streamPath) {
   let raw;
   try {
-    raw = readFileSync25(streamPath, "utf8");
+    raw = readFileSync26(streamPath, "utf8");
   } catch {
     return false;
   }
@@ -11147,10 +11239,10 @@ function planAgentRun(o) {
   let ageSeconds;
   if (existsSync26(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync8(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync25(digestPath2, "utf8");
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync26(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync25(commonPath, "utf8") : "";
-  const brief = readFileSync25(briefPath, "utf8");
+  const common = usesCommon ? readFileSync26(commonPath, "utf8") : "";
+  const brief = readFileSync26(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = appendAdditions(o.divergedPrompt ?? brief, o.personaAdditions);
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -11239,6 +11331,7 @@ function planAgentRun(o) {
     toolchain: toolchain.name,
     harness: toolchain.harness,
     workspaceAuth: toolchain.auth === "workspace",
+    authMode: authModeOf(toolchain),
     provider: toolchainProvider(toolchain),
     maxRunMinutes: resolveMaxRunMinutes(o.route.maxRunMinutes, toolchain.maxRunMinutes),
     ...o.ship.runner === "sandbox" ? {
@@ -11305,7 +11398,7 @@ function describePlan(p) {
 var pidPathFor = (streamPath) => `${streamPath}.pid`;
 function readRunSidecar(streamPath) {
   try {
-    const sc = JSON.parse(readFileSync25(pidPathFor(streamPath), "utf8"));
+    const sc = JSON.parse(readFileSync26(pidPathFor(streamPath), "utf8"));
     return typeof sc.pid === "number" && typeof sc.spawnedAt === "string" && typeof sc.role === "string" ? sc : null;
   } catch {
     return null;
@@ -11620,10 +11713,11 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
       ...result?.costUsd !== void 0 ? { totalCostUsd: result.costUsd } : {}
     }
   });
+  const signedOut = !end.interrupted && streamShowsSignedOut(id.streamPath);
   if (id.agentLog && agentLogKey) {
     const report = {
       ticketReference: attributedTicket,
-      outcome: end.interrupted ? "interrupted" : end.code === 0 || end.code === null && obs.sawResult ? "success" : "error",
+      outcome: end.interrupted ? "interrupted" : signedOut ? "error" : end.code === 0 || end.code === null && obs.sawResult ? "success" : "error",
       startedAt,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
       cycles: obs.cycles,
@@ -11878,7 +11972,7 @@ function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
   if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync26(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync27(path, "utf8")).running !== true;
   } catch {
     return true;
   }
@@ -12611,7 +12705,7 @@ var SandboxCache = class {
       try {
         await this.helper(this.s.helperImage, REFRESH_SCRIPT, [mirrorRelPath(r), forgeDescriptorFor(r.host).httpsUrl(r.host, r.path)], env);
       } catch (e) {
-        out.push({ repo: r, ok: false, detail: describe(e) });
+        out.push({ repo: r, ok: false, detail: r.token ? describe(e) : `no readable forge token for ${r.host} (see \`crew forge list\`); ${describe(e)}` });
         continue;
       }
       if (this.s.depsCommand && this.s.depsImage) {
@@ -12715,6 +12809,10 @@ function cacheSettingsOf(cfg) {
   };
 }
 var sandboxCacheKey = (volume, r) => `sandbox_cache:${volume}:${r.host}/${r.path}`;
+function unmirroredRepos(served, mirrors) {
+  const have = new Set(mirrors.map((m) => `${m.repo.host}/${m.repo.path}`));
+  return served.map((r) => `${r.host}/${r.path}`).filter((k, i, a) => !have.has(k) && a.indexOf(k) === i);
+}
 var CACHE_REFRESH_INTERVAL_MS = 6e4;
 function makeCachePass(o) {
   const now = o.now ?? Date.now;
@@ -12737,7 +12835,7 @@ function makeCachePass(o) {
     for (const out of all) {
       const key = sandboxCacheKey(o.volume, out.repo);
       if (out.ok) o.ok(key);
-      else await o.fail(key, `sandbox cache: ${out.repo.host}/${out.repo.path} did not refresh (${out.detail}); runs use the previous mirror. Resumes automatically when a later pass refreshes it`);
+      else await o.fail(key, `sandbox cache: ${out.repo.host}/${out.repo.path} did not refresh (${out.detail}); runs use the previous mirror. Resumes automatically when a later pass refreshes it`, new Date(now()).toISOString());
     }
     return all;
   };
@@ -12969,7 +13067,7 @@ var SANDBOX_BRIDGE_PATH = `${CREW_PREFIX}/bin/intel-bridge`;
 function readBridgeBundle() {
   const here = dirname15(fileURLToPath(import.meta.url));
   for (const p of [join32(here, "sandbox-intel-bridge.cjs"), join32(here, "..", "dist", "sandbox-intel-bridge.cjs")]) {
-    if (existsSync30(p)) return readFileSync27(p, "utf8");
+    if (existsSync30(p)) return readFileSync28(p, "utf8");
   }
   return void 0;
 }
@@ -13121,7 +13219,7 @@ var shipSandboxRef = () => ({ name: SHIP_SANDBOX_KEY, decl: { packages: [], setu
 var sandboxStatePath = (stateDir) => join32(stateDir, "sandbox-images.json");
 function readSandboxState(stateDir) {
   try {
-    const v = JSON.parse(readFileSync27(sandboxStatePath(stateDir), "utf8"));
+    const v = JSON.parse(readFileSync28(sandboxStatePath(stateDir), "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : {};
   } catch {
     return {};
@@ -13404,7 +13502,7 @@ function managedGitIdentityWarnings(kind, identity) {
 
 // src/selftest.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync28, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync29, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join33 } from "path";
 var SELFTEST_TIMEOUT_MS = 12e4;
@@ -13538,6 +13636,11 @@ ${seen.texts.join("\n")}`)) {
     return fail2("mcp-unavailable", "the tracker MCP tool was not available to the session");
   }
   const answered = seen.texts.length > 0 || seen.finalText;
+  if (SIGNED_OUT_PATTERN.test(`${run3.stderr}
+${seen.finalText ?? ""}
+${seen.texts.join("\n")}`)) {
+    return { failure: "login-missing", detail: signedOutMessage(spec.name, authModeOf(spec)) };
+  }
   if (!answered || LOGIN.test(run3.stderr) || LOGIN.test(seen.finalText ?? "")) {
     return fail2("login-missing", `\`${bin}\` exited${run3.code !== null ? ` (${run3.code})` : ""} before answering; the vendor login is probably missing`);
   }
@@ -13604,7 +13707,7 @@ var fileFor2 = (stateDir) => join33(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync31(p) ? JSON.parse(readFileSync28(p, "utf8")) : {};
+    return existsSync31(p) ? JSON.parse(readFileSync29(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -13823,14 +13926,14 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/connect-resume.ts
-import { mkdirSync as mkdirSync21, readFileSync as readFileSync29, rmSync as rmSync17, writeFileSync as writeFileSync22 } from "fs";
+import { mkdirSync as mkdirSync21, readFileSync as readFileSync30, rmSync as rmSync17, writeFileSync as writeFileSync22 } from "fs";
 import { dirname as dirname16, join as join34 } from "path";
 function lastSessionFile(stateDir) {
   return join34(stateDir, "connect-session.json");
 }
 function readPointers(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync29(lastSessionFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync30(lastSessionFile(stateDir), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const out = {};
     for (const [host, v] of Object.entries(parsed)) {
@@ -13930,7 +14033,7 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync30, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
 import { dirname as dirname17, join as join35 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
@@ -13938,7 +14041,7 @@ function clonedCheckoutsFile(stateDir) {
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync30(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync31(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -14129,7 +14232,7 @@ async function runDeprovision(o, fx, deps) {
 }
 
 // src/pool-member.ts
-import { mkdirSync as mkdirSync23, readFileSync as readFileSync31, renameSync as renameSync4, writeFileSync as writeFileSync24 } from "fs";
+import { mkdirSync as mkdirSync23, readFileSync as readFileSync32, renameSync as renameSync4, writeFileSync as writeFileSync24 } from "fs";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname18, join as join36 } from "path";
 var POOL_EXIT = { ok: 0, failed: 1, credential: 2 };
@@ -14369,7 +14472,7 @@ function fileMemberStore(dir) {
   return {
     read() {
       try {
-        return JSON.parse(readFileSync31(file, "utf8"));
+        return JSON.parse(readFileSync32(file, "utf8"));
       } catch {
         return {};
       }
@@ -14435,7 +14538,7 @@ import { hostname as hostname3 } from "os";
 // src/machine-id.ts
 import { execFileSync as execFileSync10 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname19, join as join37 } from "path";
 function machineIdPathFor(stateDir) {
   return join37(stateDir, "machine-id");
@@ -14452,7 +14555,7 @@ function readRawMachineId(platform2 = process.platform) {
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       if (existsSync33(p)) {
-        const id = readFileSync32(p, "utf8").trim();
+        const id = readFileSync33(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -14464,7 +14567,7 @@ function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
   if (existsSync33(path)) {
-    const cached = readFileSync32(path, "utf8").trim();
+    const cached = readFileSync33(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
@@ -14484,7 +14587,7 @@ function matchShipRows(ships, shipName2, machineId) {
 
 // src/provision.ts
 import { spawnSync as spawnSync9 } from "child_process";
-import { existsSync as existsSync34, readFileSync as readFileSync33, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync34, writeFileSync as writeFileSync26 } from "fs";
 import { hostname as hostname2 } from "os";
 import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
@@ -15105,7 +15208,7 @@ function realProvisionDeps(crewHome) {
     enableRoute(route2) {
       const file = configFile();
       if (!file) return false;
-      const text2 = readFileSync33(file, "utf8");
+      const text2 = readFileSync34(file, "utf8");
       const doc = parseDocument3(text2);
       const routes = doc.get("routes");
       const entry = routes?.items?.find((r) => r.get("route") === route2);
@@ -15131,7 +15234,7 @@ function realProvisionDeps(crewHome) {
           continue;
         }
         for (const p of plan.unitPaths) {
-          if (!existsSync34(p) || readFileSync33(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+          if (!existsSync34(p) || readFileSync34(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
         }
       }
       const label = labelFor(crewHome, "run");
@@ -15155,7 +15258,7 @@ function realProvisionDeps(crewHome) {
     setShipSetting(key, value2) {
       const file = configFile();
       if (!file) return false;
-      const doc = parseDocument3(readFileSync33(file, "utf8"));
+      const doc = parseDocument3(readFileSync34(file, "utf8"));
       if (doc.getIn(["ship", key]) === value2) return false;
       doc.setIn(["ship", key], value2);
       writeFileSync26(file, doc.toString());
@@ -15164,7 +15267,7 @@ function realProvisionDeps(crewHome) {
     applyManagedDefaults() {
       const file = configFile();
       if (!file) return [];
-      const doc = parseDocument3(readFileSync33(file, "utf8"));
+      const doc = parseDocument3(readFileSync34(file, "utf8"));
       const wrote = applyManagedDefaultsToDoc(doc);
       if (wrote.length) writeFileSync26(file, doc.toString());
       return wrote;
@@ -15194,7 +15297,7 @@ host=${host}
 
 // src/tunnel.ts
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync34, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync35, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
 import { randomInt } from "crypto";
 import { join as join39 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -15280,7 +15383,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync35(path)) return void 0;
   try {
-    return JSON.parse(readFileSync34(path, "utf8"));
+    return JSON.parse(readFileSync35(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -16825,7 +16928,7 @@ async function resolveOne(tracker, t, seat, approvedStatus, buildingStatus, affi
 }
 
 // src/repo-refresh.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync35, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync29 } from "fs";
 import { dirname as dirname21 } from "path";
 var REFRESH_COOLDOWN_MS = 2 * 6e4;
 var UNSERVABLE_PASSES_BEFORE_ATTENTION = 3;
@@ -16856,7 +16959,7 @@ function applyRepoRows(resolved, rows) {
 function persistRepoRows(stateDir, routeName, rows) {
   const path = resolvedPathFor(stateDir, routeName);
   if (!existsSync37(path)) return;
-  const raw = JSON.parse(readFileSync35(path, "utf8"));
+  const raw = JSON.parse(readFileSync36(path, "utf8"));
   applyRepoRows(raw, rows);
   mkdirSync26(dirname21(path), { recursive: true });
   writeFileSync29(path, `${JSON.stringify(raw, null, 2)}
@@ -17509,7 +17612,7 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync36, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
 import { dirname as dirname24, join as join43 } from "path";
 import { tmpdir as tmpdir5, hostname as hostname4 } from "os";
 
@@ -18286,7 +18389,7 @@ async function bump(o, size) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const firstText = readFileSync36(first, "utf8");
+  const firstText = readFileSync37(first, "utf8");
   const problem = versionFileProblem(o.repo.release.versionFiles[0], firstText);
   if (problem) {
     o.emit.error(problem);
@@ -18305,7 +18408,7 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync36(f, "utf8");
+    const src = readFileSync37(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
@@ -18324,7 +18427,7 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync39(path) ? readFileSync36(path, "utf8") : "# Changelog\n";
+  const existing = existsSync39(path) ? readFileSync37(path, "utf8") : "# Changelog\n";
   writeFileSync31(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
@@ -19238,6 +19341,7 @@ function runForge(a, io) {
     const tok = sourceFromArgs(a);
     if (typeof tok === "string") return fail2(tok);
     const doc = parseDocument4(io.readFile(io.configFile));
+    doc.setIn(["ship", "forges", host, "username"], forgeDescriptorFor(host).credentialUsername);
     doc.setIn(["ship", "forges", host, "token"], tok);
     io.writeFile(io.configFile, doc.toString());
     io.forges = { ...io.forges ?? {}, [host]: { username: forgeDescriptorFor(host).credentialUsername, token: tok } };
@@ -19841,7 +19945,7 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync37, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
 import { dirname as dirname26 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
@@ -19905,7 +20009,7 @@ async function syncRouteName(i) {
 function readSyncedName(resolvedFile) {
   if (!existsSync42(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync37(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync38(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
@@ -19915,7 +20019,7 @@ function writeSyncedName(resolvedFile, name) {
   if (!existsSync42(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync37(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync38(resolvedFile, "utf8"));
   } catch {
     return;
   }
@@ -19930,7 +20034,7 @@ function writeSyncedName(resolvedFile, name) {
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync37(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync38(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -19954,7 +20058,7 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text2 = readFileSync37(i.configFile, "utf8");
+    const text2 = readFileSync38(i.configFile, "utf8");
     writeFileSync32(i.configFile, setShipNameInYaml(text2, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
@@ -20614,7 +20718,7 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync39, writeFileSync as writeFileSync33 } from "fs";
 import { dirname as dirname27 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
@@ -20648,7 +20752,7 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync43(resolvedPath) ? JSON.parse(readFileSync38(resolvedPath, "utf8")) : {};
+    const raw = existsSync43(resolvedPath) ? JSON.parse(readFileSync39(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
@@ -20770,7 +20874,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
 
 // src/repos-check.ts
 import { spawnSync as spawnSync11 } from "child_process";
-import { readFileSync as readFileSync39 } from "fs";
+import { readFileSync as readFileSync40 } from "fs";
 import { basename as basename11 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
 function checkHookSyntax(script, shell) {
@@ -20811,7 +20915,7 @@ function checkRepoSpec(dir, opts = {}) {
   }
   let parsed;
   try {
-    parsed = parseRepoConfig(readFileSync39(file, "utf8"), file);
+    parsed = parseRepoConfig(readFileSync40(file, "utf8"), file);
   } catch (e) {
     if (!(e instanceof RepoConfigError)) throw e;
     return { ...empty, file, error: e.message, exitCode: 1 };
@@ -21343,7 +21447,7 @@ function planSampleTicket(i) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync44, readFileSync as readFileSync40, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync41, readdirSync as readdirSync14 } from "fs";
 import { basename as basename13, dirname as dirname29, join as join45, resolve as resolve5 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -21524,7 +21628,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync40(resolve5(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync41(resolve5(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -21674,11 +21778,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync46, existsSync as existsSync52, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync47, existsSync as existsSync52, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync41, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
+import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync42, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
 import { join as join47 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -21704,7 +21808,7 @@ function writePeriscopePrior(stateDir, ticketRecordId, prior) {
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync46(p) ? JSON.parse(readFileSync41(p, "utf8")) : void 0;
+    return existsSync46(p) ? JSON.parse(readFileSync42(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -22259,7 +22363,7 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync13 } from "child_process";
-import { existsSync as existsSync47, mkdirSync as mkdirSync33, readFileSync as readFileSync42, chmodSync as chmodSync3 } from "fs";
+import { existsSync as existsSync47, mkdirSync as mkdirSync33, readFileSync as readFileSync43, chmodSync as chmodSync3 } from "fs";
 import { dirname as dirname30, join as join49 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -22293,7 +22397,7 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync47(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync42(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync43(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -22457,7 +22561,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn9 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync48, mkdirSync as mkdirSync34, readFileSync as readFileSync43, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync34, readFileSync as readFileSync44, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
 import { join as join50 } from "path";
 
 // src/secret-compare.ts
@@ -22557,7 +22661,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync48(path)) return void 0;
   try {
-    return JSON.parse(readFileSync43(path, "utf8"));
+    return JSON.parse(readFileSync44(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -23106,7 +23210,7 @@ function contractFixers(dir, baseRef, tickets, locate) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync49, mkdirSync as mkdirSync36, readFileSync as readFileSync44, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
+import { existsSync as existsSync49, mkdirSync as mkdirSync36, readFileSync as readFileSync45, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
 import { join as join52 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -23227,7 +23331,7 @@ function noteDaemonStarted(stateDir, now = Date.now()) {
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync44(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync45(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -23410,6 +23514,12 @@ async function runOnePassUnguarded(o) {
         clearShipAttention(o.state, workspaceAllowanceKey(role));
       }).catch(async (e) => {
         const message = e.message;
+        if (e instanceof SignedOutError) {
+          breaker.pause(role, SIGNED_OUT_PAUSE_MS);
+          emit.warn(`${role} paused: ${message}`, { step: "agent", role });
+          await raiseShipAttention({ state: o.state, emit, route: o.route, ship: o.ship }, signedOutItem(e.toolchain, e.mode));
+          return;
+        }
         if (e instanceof WorkspaceAllowanceExhausted) {
           breaker.pause(role, ALLOWANCE_PAUSE_MS);
           emit.warn(`${role} paused: ${message}`, { step: "agent", role });
@@ -23751,6 +23861,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       if (plan.workspaceAuth && streamShowsAllowanceRefusal(plan.streamPath)) {
         throw new WorkspaceAllowanceExhausted("the inference endpoint refused the run: the workspace is past its AI allowance");
       }
+      await settleSignOut(plan, tracker, ctx.state, workingId, emit);
     }
   } finally {
     await settleRunEnd({
@@ -23787,6 +23898,26 @@ async function buildEnvironment(route2, ship, ticket) {
   const attachments = await tracker.attachmentsProbe().catch(() => null);
   return renderEnvironment({ route: route2, userAgent: ship.userAgent, repos: await withRepoMaps(repos, ship.mapTokenBudget, ship.shell), contract, sourceTicket: ticket, authorship, attachments, shipName: ship.name, ...sandboxEnv(ship) });
 }
+async function settleSignOut(plan, tracker, state, ticketId, emit) {
+  const toolchain = plan.toolchain;
+  if (!toolchain) return;
+  if (!streamShowsSignedOut(plan.streamPath)) {
+    if (streamShowsRealTurn(plan.streamPath)) clearShipAttention(state, signedOutKey(toolchain));
+    return;
+  }
+  if (ticketId) {
+    try {
+      const affinity = await tracker.claimAffinity();
+      const current = await tracker.ticket(ticketId);
+      if (affinity && current[affinity.column] === affinity.shipId) {
+        await tracker.updateTicket(ticketId, { [affinity.column]: null }, current.updated_at);
+      }
+    } catch (e) {
+      emit.warn(`could not release the ticket hold after a sign-out: ${e.message}`, { step: "agent" });
+    }
+  }
+  throw new SignedOutError(toolchain, plan.authMode ?? "login");
+}
 
 // src/control-api.ts
 import { createHash as createHash11 } from "crypto";
@@ -24477,7 +24608,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync51, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync45, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync51, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync46, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
 import { join as join54 } from "path";
 var secretDir = (stateDir) => join54(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join54(secretDir(stateDir), `${id}.json`);
@@ -24494,7 +24625,7 @@ function mintPeriscopeSecret(stateDir, ticketRecordId) {
 }
 function readPeriscopeSecret(stateDir, ticketRecordId) {
   try {
-    const v = JSON.parse(readFileSync45(secretFile(stateDir, ticketRecordId), "utf8"));
+    const v = JSON.parse(readFileSync46(secretFile(stateDir, ticketRecordId), "utf8"));
     return typeof v.secret === "string" && v.secret ? v.secret : void 0;
   } catch {
     return void 0;
@@ -24505,7 +24636,7 @@ function removePeriscopeSecret(stateDir, ticketRecordId) {
 }
 function readPeriscopeEndpoint(stateDir, ticketRecordId) {
   try {
-    return JSON.parse(readFileSync45(endpointFile(stateDir, ticketRecordId), "utf8"));
+    return JSON.parse(readFileSync46(endpointFile(stateDir, ticketRecordId), "utf8"));
   } catch {
     return void 0;
   }
@@ -25254,7 +25385,7 @@ if (command === "provision") {
   process.exit(outcome.code);
 }
 if (command === "pool-member") {
-  const pool = poolConfigFrom(argv, process.env, () => readFileSync46(0, "utf8"));
+  const pool = poolConfigFrom(argv, process.env, () => readFileSync47(0, "utf8"));
   if (typeof pool === "string") {
     process.stderr.write(`crew pool-member: ${pool}
 `);
@@ -25415,7 +25546,7 @@ if (command === "passenger-sync-daemon") {
         if (intelFlavor(loadRepoConfig(t.dir)?.hooks.intel) === "serena") intelImage = sandboxImageFor(images ??= readSandboxState(ship.stateDir), t.name);
       } catch {
       }
-      out.push({ ...repo, dir: t.dir, token, username: forgeFor(ship.forges, repo.host)?.entry.username, intelImage });
+      out.push({ ...repo, dir: t.dir, token, username: forgeFor(ship.forges, repo.host)?.entry.username || forgeDescriptorFor(repo.host).credentialUsername, intelImage });
     }
     return out;
   }, buildSandboxCachePass = function(c, ship, state2, emit2) {
@@ -25426,7 +25557,7 @@ if (command === "passenger-sync-daemon") {
       volume: settings.volume,
       repos: () => sandboxCacheRepos(c, ship),
       lock: (dir) => acquireCheckoutLock(dir),
-      fail: (key, message) => raiseShipAttention({ state: state2, emit: emit2, route: c, ship }, { kind: "sandbox_cache", key, message, since: (/* @__PURE__ */ new Date()).toISOString() }).then(() => void 0),
+      fail: (key, message, failedAt) => raiseShipAttention({ state: state2, emit: emit2, route: c, ship }, { kind: "sandbox_cache", key, message, since: failedAt, lastFailedAt: failedAt }).then(() => void 0),
       ok: (key) => clearShipAttention(state2, key)
     });
     return async () => {
@@ -25518,7 +25649,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   if (command === "credential") {
-    const r = runCredential(positional[1], readFileSync46(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    const r = runCredential(positional[1], readFileSync47(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
     process.stdout.write(r.out);
     process.stderr.write(r.err);
     process.exit(r.code);
@@ -25530,9 +25661,9 @@ if (command === "passenger-sync-daemon") {
         forges: cfg.ship.forges,
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
-        readFile: (p) => readFileSync46(p, "utf8"),
+        readFile: (p) => readFileSync47(p, "utf8"),
         writeFile: (p, t) => writeFileSync38(p, t),
-        stdin: () => readFileSync46(0, "utf8"),
+        stdin: () => readFileSync47(0, "utf8"),
         env: process.env
       }
     );
@@ -25929,7 +26060,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync38(cfg.configFile, planEnable(readFileSync46(cfg.configFile, "utf8"), a.route));
+          writeFileSync38(cfg.configFile, planEnable(readFileSync47(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -27430,7 +27561,7 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync52(resolvedPath) ? JSON.parse(readFileSync46(resolvedPath, "utf8")) : {};
+        const raw = existsSync52(resolvedPath) ? JSON.parse(readFileSync47(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync38(dirOf2(resolvedPath), { recursive: true });
         writeFileSync38(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -27456,7 +27587,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync46(cfg.configFile, "utf8"), newName));
+      writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -27503,7 +27634,7 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync46(cfg.configFile, "utf8");
+      const configText = readFileSync47(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
@@ -27544,7 +27675,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync46(resolvePath(dir, r), "utf8");
+              return readFileSync47(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -27695,7 +27826,7 @@ ${cu.tail.trimEnd()}
       let resolvedRemotes;
       if (existsSync52(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync47(resolvedFile, "utf8"));
         } catch {
         }
       }
@@ -27717,7 +27848,7 @@ ${cu.tail.trimEnd()}
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
                   const path = resolvePath(d, f);
-                  return Object.keys(parseRepoConfig(readFileSync46(path, "utf8"), path).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync47(path, "utf8"), path).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -27826,7 +27957,7 @@ ${cu.tail.trimEnd()}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync52(resolvedFile)) {
-            const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
             writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -28204,7 +28335,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync46(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -28250,7 +28381,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync52(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync46(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync47(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -28838,8 +28969,13 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             }
             const dropped = flag("prune") ? await cache.prune(served) : [];
             const mirrors = await cache.list();
+            const open = openShipAttention(new State(cfg.ship.stateDir));
+            const failures = served.flatMap((r) => {
+              const item = open.find((i) => i.kind === "sandbox_cache" && i.key === sandboxCacheKey(settings.volume, r));
+              return item ? [{ repo: `${r.host}/${r.path}`, lastFailedAt: item.lastFailedAt ?? item.since, message: item.message }] : [];
+            });
             if (flag("json")) {
-              process.stdout.write(`${JSON.stringify({ volume: settings.volume, mirrors, dropped }, null, 2)}
+              process.stdout.write(`${JSON.stringify({ volume: settings.volume, mirrors, failures, dropped }, null, 2)}
 `);
             } else {
               for (const d of dropped) process.stdout.write(`dropped ${d.host}/${d.path}
@@ -28850,6 +28986,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
                 process.stdout.write(`${m.repo.host}/${m.repo.path}  last refresh ${m.lastRefresh ?? "never"}${m.intel ? `  intel ${m.intel.commit.slice(0, 12)} (${m.intel.indexedAt ?? "age unknown"})` : ""}
 `);
               }
+              for (const f of failures) process.stdout.write(`${f.repo}  REFRESH FAILING (last failed ${f.lastFailedAt}): ${f.message}
+`);
             }
           } catch (e) {
             process.stderr.write(`crew sandbox cache: ${e instanceof Error ? e.message : String(e)}
@@ -29760,7 +29898,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync46(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync47(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -29879,7 +30017,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text2 = readFileSync46(cfg.ship.logFile, "utf8").split("\n");
+        const text2 = readFileSync47(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text2.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -29902,7 +30040,7 @@ ${where.join("\n")}`);
       };
       if (!route2.resolved) fail2(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
-      const configText = readFileSync46(cfg.configFile, "utf8");
+      const configText = readFileSync47(cfg.configFile, "utf8");
       const cfgBase = dirname34(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
@@ -29940,7 +30078,7 @@ ${where.join("\n")}`);
         if (row) {
           await tracker.deleteRepoRow(row.id);
           if (existsSync52(resolvedFile)) {
-            const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
             writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -29980,7 +30118,7 @@ ${where.join("\n")}`);
         });
         repoId = (await tracker.createRepoRow(payload)).id;
         if (existsSync52(resolvedFile)) {
-          const raw = JSON.parse(readFileSync46(resolvedFile, "utf8"));
+          const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
           writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -30399,6 +30537,14 @@ watermark:  ${state.watermark()}
           for (const message of managedRuntimeWarnings(shipKind, cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
           for (const message of managedGitIdentityWarnings(shipKind, readGlobalGitIdentity())) problems.push({ severity: "attention", kind: "managed_git_identity", message });
         }
+        const cacheSettings = cfg.ship.runner === "sandbox" ? cacheSettingsOf(cfg.ship.sandbox) : null;
+        if (cacheSettings && !flag("offline")) {
+          try {
+            const missing = unmirroredRepos(sandboxCacheRepos(route2, cfg.ship), await new SandboxCache(cacheSettings).list());
+            for (const r of missing) problems.push({ severity: "attention", kind: "sandbox_cache_unmirrored", route: route2.route, message: `${r} has no mirror in the cache volume ${cacheSettings.volume}, so sandboxed runs cannot clone it`, remedy: "see `crew sandbox cache` for the last refresh failure" });
+          } catch {
+          }
+        }
         for (const t of rejectedTunnels(cfg.ship.stateDir)) {
           problems.push({ severity: "attention", kind: TUNNEL_REJECTED_KEY, message: tunnelRejectedMessage(t.workspaceId, t.quickExits), remedy: "rotate the slug with `crew rotate-passenger-url`" });
         }
@@ -30454,7 +30600,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run", installContext());
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync46(p, "utf8");
+            return readFileSync47(p, "utf8");
           } catch {
             return null;
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.127.1",
+  "version": "0.127.3",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",