@tablation/crew 0.127.4 → 0.127.6

package/dist/cli.js

@@ -6979,6 +6979,502 @@ var SignedOutError = class extends Error {
 };
 var SIGNED_OUT_PAUSE_MS = 15 * 60 * 1e3;
 
+// src/seat-keys.ts
+import { hostFromUrl as hostFromUrl2 } from "@tablation/client";
+var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function keyIsAdmin(route2) {
+  const role = route2.resolved?.role;
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
+var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
+var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
+function seatKeySlug(workspaceSlug, agentId) {
+  return `${workspaceSlug}#agent:${agentId}`;
+}
+function slugFor(route2, agentId) {
+  const [workspaceSlug] = splitRoute(route2.route);
+  return seatKeySlug(workspaceSlug, agentId);
+}
+function withFoundSeats(route2, found, previousReleaseAgentId) {
+  const resolved = route2.resolved;
+  if (!resolved) return route2;
+  const releaseSeat2 = found.releaseSeat ?? resolved.releaseSeat;
+  const releaseAgentId = resolved.releaseAgentId ?? previousReleaseAgentId;
+  return {
+    ...route2,
+    resolved: {
+      ...resolved,
+      seats: found.seats,
+      ...releaseSeat2 ? { releaseSeat: releaseSeat2 } : {},
+      ...releaseAgentId ? { releaseAgentId } : {}
+    }
+  };
+}
+function seatAgentId(route2, role) {
+  return route2.resolved?.agentPersonas?.[role]?.agentId;
+}
+async function resolveReleaseKey(route2, getStore = getSessionStore) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route2), reason });
+  const agentId = route2.resolved?.releaseAgentId;
+  if (!agentId) return ship(keyIsAdmin(route2) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
+  try {
+    const session = await getStore().get(hostFromUrl2(route2.baseUrl), slugFor(route2, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship(keyIsAdmin(route2) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+  } catch (e) {
+    const reason = describeReadError(e);
+    return { kind: "ship", apiKey: resolveApiKey(route2), reason, storeError: reason };
+  }
+}
+async function resolveSeatKey(route2, role, getStore = getSessionStore) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route2), reason });
+  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
+  const agentId = seatAgentId(route2, role);
+  if (!agentId) return ship(keyIsAdmin(route2) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
+  try {
+    const session = await getStore().get(hostFromUrl2(route2.baseUrl), slugFor(route2, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship(keyIsAdmin(route2) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+  } catch (e) {
+    const reason = describeReadError(e);
+    return { kind: "ship", apiKey: resolveApiKey(route2), reason, storeError: reason };
+  }
+}
+function safeStderrLine(e) {
+  const err3 = e;
+  const raw = typeof err3?.stderr === "string" && err3.stderr.trim() ? err3.stderr : typeof err3?.message === "string" ? err3.message : "";
+  for (const line of raw.split("\n")) {
+    const t = line.trim();
+    if (!t || /^Command failed:/i.test(t) || /(^|\s)-w(\s|$)/.test(t)) continue;
+    return t.slice(0, 120);
+  }
+  return void 0;
+}
+function describeReadError(e) {
+  const fsErr = e;
+  if (typeof fsErr?.path === "string" && typeof fsErr.code === "string") return `key file store unreadable (${fsErr.code})`;
+  const code = e?.code;
+  const line = safeStderrLine(e);
+  const what = typeof code === "number" ? `security exited ${code}` : typeof code === "string" ? `security failed: ${code}` : void 0;
+  const detail = [what, line].filter(Boolean).join(what && line ? ": " : "");
+  return detail ? `OS keychain unavailable (${detail})` : "OS keychain unavailable";
+}
+function keychainExitCode(reason) {
+  const m = /security exited (\d+)/.exec(reason);
+  return m ? Number(m[1]) : void 0;
+}
+function describeStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/User interaction is not allowed/i.test(msg)) {
+    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+  }
+  return "keychain unavailable (could not write to the OS keychain)";
+}
+async function mintMissingSeatKeys(route2, o) {
+  const out = [];
+  if (!route2.resolved) return out;
+  const resolved = route2.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore)();
+  } catch (e) {
+    return targets.map(({ role }) => ({
+      role,
+      action: "failed",
+      detail: describeStoreError(e)
+    }));
+  }
+  const host = hostFromUrl2(route2.baseUrl);
+  const base = route2.baseUrl.replace(/\/+$/, "");
+  if (!o.dryRun) {
+    const probeSlug = seatKeySlug(splitRoute(route2.route)[0], "_probe");
+    try {
+      await store.set(host, probeSlug, {
+        apiKey: "probe",
+        workspaceId: resolved.workspaceId,
+        identityId: "_probe",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await store.clear(host, probeSlug);
+    } catch (e) {
+      const detail = `${describeStoreError(e)}; no keys minted`;
+      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
+    }
+  }
+  for (const { role, agentId, actorRecordId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug2 = slugFor(route2, agentId);
+    try {
+      if ((await store.get(host, slug2))?.apiKey) {
+        out.push({ role, action: "already_stored" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "minted", detail: "dry run" });
+        continue;
+      }
+      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${resolveApiKey(route2)}`,
+          "Content-Type": "application/json",
+          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+        },
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}`, ...actorRecordId ? { actorRecordId } : {} })
+      });
+      if (res.status === 403) {
+        out.push({ role, action: "forbidden" });
+        break;
+      }
+      if (!res.ok) {
+        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
+        continue;
+      }
+      const body = await res.json();
+      if (!body.key) {
+        out.push({ role, action: "failed", detail: "response carried no key" });
+        continue;
+      }
+      try {
+        const session = {
+          apiKey: body.key,
+          workspaceId: resolved.workspaceId,
+          identityId: agentId,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...body.id ? { keyId: body.id } : {}
+        };
+        await store.set(host, slug2, session);
+      } catch (e) {
+        let revoked = false;
+        if (body.id) {
+          try {
+            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+            });
+            revoked = del2.ok;
+          } catch {
+            revoked = false;
+          }
+        }
+        out.push({
+          role,
+          action: "failed",
+          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
+        });
+        continue;
+      }
+      out.push({ role, action: "minted" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+    }
+  }
+  return out;
+}
+function describeMintOutcome(o) {
+  switch (o.action) {
+    case "minted":
+      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
+    case "already_stored":
+      return `${o.role}: agent key already stored`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "forbidden":
+      return FORBIDDEN_LINE;
+    case "failed":
+      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
+  }
+}
+async function revokeSeatKeys(route2, o) {
+  const out = [];
+  if (!route2.resolved) return out;
+  const resolved = route2.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore)();
+  } catch (e) {
+    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
+  }
+  const host = hostFromUrl2(route2.baseUrl);
+  const base = route2.baseUrl.replace(/\/+$/, "");
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug2 = slugFor(route2, agentId);
+    try {
+      const session = await store.get(host, slug2);
+      if (!session?.apiKey) {
+        out.push({ role, action: "not_stored" });
+        continue;
+      }
+      if (!session.keyId) {
+        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "revoked", detail: "dry run" });
+        continue;
+      }
+      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+      });
+      if (!del2.ok && del2.status !== 404) {
+        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
+        continue;
+      }
+      await store.clear(host, slug2);
+      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+    }
+  }
+  return out;
+}
+function describeRevokeOutcome(o) {
+  switch (o.action) {
+    case "revoked":
+      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
+    case "not_stored":
+      return `${o.role}: no agent key stored on this ship`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row`;
+    case "failed":
+      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
+  }
+}
+async function canMintAgentKeys(route2, o = {}) {
+  const resolved = route2.resolved;
+  if (!resolved) return void 0;
+  const agentId = seatAgentId(route2, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route2, r)).find(Boolean);
+  if (!agentId) return void 0;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(`${route2.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return true;
+    return res.status === 403 ? false : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/seat-read-probe.ts
+var SEAT_NO_READ_REMEDY = "the project has no default role for agent keys \u2014 update the Issues app's template, then re-mint with `crew agents sync --revoke-seat-keys`, or assign the Crew seat role to the agent members";
+function probeTables(route2) {
+  const m = route2.resolved?.models;
+  if (!m) return [];
+  const r = route2.resolved;
+  return [
+    { name: "Issues", modelId: m.issues },
+    { name: "Comments", modelId: m.comments },
+    { name: "Crew", modelId: m.crew },
+    { name: "Ships", modelId: r?.shipsModelId ?? "" }
+  ].filter((t) => !!t.modelId);
+}
+async function probeTableRead(route2, modelId, apiKey, o = {}) {
+  const url = `${route2.baseUrl.replace(/\/+$/, "")}/api/data-models/${modelId}/records?limit=1`;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(url, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return { state: "ok" };
+    if (res.status === 403) return { state: "forbidden" };
+    return { state: "unknown", detail: `HTTP ${res.status}` };
+  } catch (e) {
+    return { state: "unknown", detail: e.message };
+  }
+}
+async function probeSeatReads(route2, o = {}) {
+  const out = [];
+  const roles = [...SEAT_KEY_ROLES.filter((r) => route2.resolved?.seats[r]), ...route2.resolved?.releaseSeat ? ["release"] : []];
+  for (const role of roles) {
+    const id = role === "release" ? await resolveReleaseKey(route2, o.getStore) : await resolveSeatKey(route2, role, o.getStore);
+    if (id.kind !== "agent") continue;
+    const tables = [];
+    for (const t of probeTables(route2)) tables.push({ table: t.name, ...await probeTableRead(route2, t.modelId, id.apiKey, o) });
+    const bad = tables.find((t) => t.state === "forbidden") ?? tables.find((t) => t.state === "unknown");
+    out.push({ role, state: bad?.state ?? (tables.length ? "ok" : "unknown"), detail: bad?.detail ?? (tables.length ? void 0 : "route has no resolved tables"), tables });
+  }
+  return out;
+}
+function forbiddenDetail(e, route2) {
+  const msg = e instanceof Error ? e.message : String(e);
+  const m = /^([A-Z]+) (\S+) -> 403/.exec(msg);
+  const verb = /No (READ|WRITE) access/i.exec(msg)?.[1]?.toUpperCase();
+  const modelId = /\/data-models\/([\w-]+)/i.exec(m?.[2] ?? "")?.[1];
+  const r = route2?.resolved;
+  const known = [
+    [r?.models?.issues, "Issues"],
+    [r?.models?.comments, "Comments"],
+    [r?.models?.crew, "Crew"],
+    [r?.shipsModelId, "Ships"],
+    [r?.locksModelId, "Locks"],
+    [r?.epicsModelId, "Epics"],
+    [r?.periscopesModelId, "Periscopes"],
+    [r?.reposModelId, "Repos"]
+  ];
+  const table2 = modelId ? known.find(([id]) => id && id === modelId)?.[1] ?? `table ${modelId}` : void 0;
+  return { method: m?.[1], path: m?.[2], table: table2, verb };
+}
+function remedyFor(d, roleName = "the agent role") {
+  if (d.table && d.verb && !(d.table === "Issues" && d.verb === "READ")) {
+    return `grant ${d.verb} on ${d.table} to ${roleName}`;
+  }
+  return SEAT_NO_READ_REMEDY;
+}
+function describeSeatForbidden(role, tables = []) {
+  const bad = tables.filter((t) => t.state === "forbidden").map((t) => t.table);
+  const what = bad.length ? bad.join(", ") : "Issues";
+  const remedy = bad.length && !(bad.length === 1 && bad[0] === "Issues") ? bad.map((t) => remedyFor({ table: t, verb: "READ" })).join("; ") : SEAT_NO_READ_REMEDY;
+  return `seat read:        ERROR ${role} agent key cannot read ${what} (403) \u2014 ${remedy}`;
+}
+function describeSeatTables(role, tables) {
+  const cells = tables.map((t) => `${t.table} ${t.state === "ok" ? "ok" : t.state === "forbidden" ? "403" : `error (${t.detail ?? "?"})`}`);
+  return `seat read:        ${role}: ${cells.join(", ")}`;
+}
+function isForbiddenError(e) {
+  const status2 = e?.status;
+  if (status2 === 403) return true;
+  return /\b403\b/.test(e instanceof Error ? e.message : String(e));
+}
+var SEAT_FORBIDDEN_KEY = "seat_forbidden:release";
+function seatForbiddenItem(now = /* @__PURE__ */ new Date(), e, route2) {
+  const d = e === void 0 ? {} : forbiddenDetail(e, route2);
+  const what = d.method && d.table ? `${d.method} ${d.table}${d.verb ? ` -> 403 No ${d.verb} access` : " -> 403"}` : "cannot read the Issues table (403)";
+  return {
+    kind: "seat_forbidden",
+    key: SEAT_FORBIDDEN_KEY,
+    message: `release seat: ${what} \u2014 ${remedyFor(d)}`,
+    since: now.toISOString()
+  };
+}
+function seatForbiddenRepoLine(scope) {
+  return `${scope}: skipped \u2014 release seat was refused by the tracker (see attention)`;
+}
+var SEAT_WRITE_ISSUE_FIELDS = [
+  "status",
+  "assignee_id",
+  "held_by_ship_id",
+  "work_started_at",
+  "commit_sha",
+  "merged_at",
+  "resolved_at",
+  "released_version",
+  "released_at",
+  "resolution_note",
+  "agent_runs",
+  "tokens_in",
+  "tokens_out",
+  "cache_read_tokens",
+  "cache_write_tokens",
+  "cost_usd"
+];
+var canWrite = (level) => level === "WRITE" || level === "DELETE";
+function refusedIssueFields(body, columns = SEAT_WRITE_ISSUE_FIELDS) {
+  const fields = body?.fields;
+  if (!fields || typeof fields !== "object") return [];
+  return columns.filter((c) => c in fields && !canWrite(fields[c]));
+}
+async function getJson(url, apiKey, o) {
+  const res = await (o.fetchImpl ?? fetch)(url, {
+    headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+  });
+  if (!res.ok) return { status: res.status };
+  try {
+    return { status: res.status, body: await res.json() };
+  } catch {
+    return { status: 0 };
+  }
+}
+function writeTables(route2) {
+  const r = route2.resolved;
+  return [
+    { name: "Crew", modelId: r?.models?.crew ?? "" },
+    { name: "Ships", modelId: r?.shipsModelId ?? "" },
+    { name: "Locks", modelId: r?.locksModelId ?? "" },
+    { name: "Periscopes", modelId: r?.periscopesModelId ?? "" }
+  ].filter((t) => !!t.modelId);
+}
+async function probeKeyWrites(route2, apiKey, o = {}) {
+  const base = route2.baseUrl.replace(/\/+$/, "");
+  const out = [];
+  const issues = route2.resolved?.models?.issues;
+  const guard = async (table2, fn) => {
+    try {
+      out.push(await fn());
+    } catch (e) {
+      out.push({ table: table2, state: "unknown", fields: [], detail: e.message });
+    }
+  };
+  if (issues) {
+    await guard("Issues", async () => {
+      const r = await getJson(`${base}/api/data-models/${issues}/field-access`, apiKey, o);
+      if (r.status === 403) return { table: "Issues", state: "forbidden", fields: [] };
+      if (!r.body) return { table: "Issues", state: "unknown", fields: [], detail: `HTTP ${r.status}` };
+      const fields = refusedIssueFields(r.body);
+      return { table: "Issues", state: fields.length ? "forbidden" : "ok", fields };
+    });
+  }
+  for (const t of writeTables(route2)) {
+    await guard(t.name, async () => {
+      const r = await getJson(`${base}/api/data-models/${t.modelId}/access`, apiKey, o);
+      if (r.status === 403) return { table: t.name, state: "forbidden", fields: [] };
+      if (!r.body) return { table: t.name, state: "unknown", fields: [], detail: `HTTP ${r.status}` };
+      return { table: t.name, state: canWrite(r.body.access) ? "ok" : "forbidden", fields: [] };
+    });
+  }
+  return out;
+}
+async function probeSeatWrites(route2, o = {}) {
+  const out = [];
+  const all = [...SEAT_KEY_ROLES.filter((r) => route2.resolved?.seats[r]), ...route2.resolved?.releaseSeat ? ["release"] : []];
+  const roles = o.only ? all.filter((r) => r === o.only) : all;
+  for (const role of roles) {
+    const id = role === "release" ? await resolveReleaseKey(route2, o.getStore) : await resolveSeatKey(route2, role, o.getStore);
+    if (id.kind !== "agent") continue;
+    const tables = await probeKeyWrites(route2, id.apiKey, o);
+    const bad = tables.find((t) => t.state === "forbidden") ?? tables.find((t) => t.state === "unknown");
+    out.push({ role, state: bad?.state ?? "ok", tables });
+  }
+  return out;
+}
+function describeWriteRefusals(tables) {
+  return tables.filter((t) => t.state === "forbidden").map((t) => t.fields.length ? `${t.table} (${t.fields.join(", ")})` : t.table).join(", ");
+}
+var SEAT_NO_WRITE_REMEDY = "raise the grants on that role to WRITE, or point the project's default agent role at the Issues app template's";
+function seatCannotWriteMessage(role, tables) {
+  return `${role} agent key cannot write ${describeWriteRefusals(tables)}`;
+}
+var seatCannotWriteKey = (role) => `seat_cannot_write:${role}`;
+function seatCannotWriteItem(role, detail, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  return { kind: "seat_cannot_write", key: seatCannotWriteKey(role), since: nowIso, message: `${role} seat: ${detail} (403) \u2014 ${SEAT_NO_WRITE_REMEDY}` };
+}
+async function seatWriteStillRefused(route2, role, o = {}) {
+  try {
+    const [r] = await probeSeatWrites(route2, { ...o, only: role });
+    return !!r && r.state !== "ok";
+  } catch {
+    return true;
+  }
+}
+
 // src/environment.ts
 import { basename as basename6 } from "path";
 
@@ -8223,6 +8719,22 @@ function isTransportFailure(isError, text2) {
   }
   return TRANSPORT_FAILURE.test(text2);
 }
+var FORBIDDEN_WRITE = /\b403\b[^]*?No WRITE access/i;
+function isForbiddenWrite(isError, text2) {
+  if (FORBIDDEN_WRITE.test(text2)) return true;
+  if (!isError) {
+    try {
+      const doc = JSON.parse(text2);
+      return !!doc && typeof doc === "object" && doc.statusCode === 403;
+    } catch {
+    }
+  }
+  return false;
+}
+function forbiddenDetail403(text2) {
+  const m = /No WRITE access to (?:"[^"]+"|this model|[\w-]+)/i.exec(text2);
+  return m ? m[0] : "a hand-off write was refused";
+}
 var HandoffTranscriptTracker = class {
   open = /* @__PURE__ */ new Map();
   /** Per ticket record: the last hand-off status write's outcome. */
@@ -8230,6 +8742,9 @@ var HandoffTranscriptTracker = class {
   /** Per ticket record: the last hand-off comment that failed after the status write's turn. */
   comment = /* @__PURE__ */ new Map();
   landed = /* @__PURE__ */ new Set();
+  /** Per ticket record: the last hand-off status write, when the tracker refused it with 403. */
+  forbiddenWrites = /* @__PURE__ */ new Map();
+  statusLanded = false;
   lastText = "";
   resultLine = "";
   feed(parsed) {
@@ -8250,7 +8765,16 @@ var HandoffTranscriptTracker = class {
         const w = this.open.get(b.tool_use_id);
         if (!w) continue;
         this.open.delete(b.tool_use_id);
-        const failed = isTransportFailure(b.is_error === true, resultText(b.content));
+        const text2 = resultText(b.content);
+        if (w.kind === "handoff") {
+          const refused = isForbiddenWrite(b.is_error === true, text2);
+          if (refused) this.forbiddenWrites.set(w.recordId, forbiddenDetail403(text2));
+          else {
+            this.forbiddenWrites.delete(w.recordId);
+            if (!isTransportFailure(b.is_error === true, text2)) this.statusLanded = true;
+          }
+        }
+        const failed = isTransportFailure(b.is_error === true, text2);
         if (w.kind === "handoff") this.status.set(w.recordId, { ok: !failed, patch: w.body });
         else if (failed && typeof w.body.body === "string") this.comment.set(w.recordId, w.body.body);
         else if (!failed) {
@@ -8260,6 +8784,15 @@ var HandoffTranscriptTracker = class {
       }
     }
   }
+  /** The newest hand-off write the tracker refused with 403 and no later success for that ticket, else null. */
+  forbidden() {
+    const last = [...this.forbiddenWrites].at(-1);
+    return last ? { ticketRecordId: last[0], detail: last[1] } : null;
+  }
+  /** A hand-off status write went through, so the seat can write what a hand-off needs. */
+  handoffLanded() {
+    return this.statusLanded && this.forbiddenWrites.size === 0;
+  }
   /** The hand-off that did not land, or null when every hand-off write succeeded (or none was tried). */
   pending() {
     const failed = [...this.status].filter(([, s2]) => !s2.ok).at(-1);
@@ -9683,18 +10216,28 @@ async function missingAcceptance(i, t) {
   if (lines2.length === 0 || !i.writer.comments) return null;
   const cc = i.contract.comments;
   const mine = (await i.writer.comments()).map((c) => c).filter((r) => r[cc.parent] === t.id && r[cc.author] === i.seatId).sort((a, b) => String(a[cc.createdAt] ?? "").localeCompare(String(b[cc.createdAt] ?? "")));
-  const last = mine.at(-1);
-  const missing = unquotedAcceptance(lines2, last ? String(last[cc.body] ?? "") : "");
-  return missing.length > 0 ? missing : null;
+  const from = i.since ? Date.parse(i.since) : NaN;
+  const recent = Number.isNaN(from) ? [] : mine.filter((r) => Date.parse(String(r[cc.createdAt] ?? "")) >= from);
+  const candidates2 = recent.length > 0 ? recent : mine.slice(-1);
+  if (candidates2.length === 0) return { missing: lines2, judged: null };
+  let best = null;
+  for (const c of candidates2) {
+    const missing = unquotedAcceptance(lines2, String(c[cc.body] ?? ""));
+    if (missing.length === 0) return null;
+    if (!best || missing.length <= best.missing.length) best = { missing, judged: String(c[cc.createdAt] ?? "") || null };
+  }
+  return best;
 }
-function acceptanceBounceComment(missing, shipName2) {
+function acceptanceBounceComment(missing, shipName2, judged) {
   return `${ACCEPTANCE_BOUNCED_MARKER}
 
 **Hand-off bounced: the hand-off comment does not quote every line of the ticket's Acceptance section.**
 
 ${shipName2 ? `Ship: ${shipName2}
 
-` : ""}Not quoted verbatim:
+` : ""}${judged ? `Judged the comment posted at ${judged}; no comment this run quoted every line.
+
+` : "This seat has no comment on the ticket.\n\n"}Not quoted verbatim:
 ${missing.map((l) => `- ${l}`).join("\n")}
 
 Set back to \`in_progress\`. Post a comment that lists every Acceptance line verbatim, each followed by the test, command or manual check that exercised it in this run and its result (a line you could not exercise is listed with the reason, never omitted), then set \`fixed\` again. The branch is already pushed.`;
@@ -9715,8 +10258,8 @@ async function enforceHandoff(i) {
       return { kind: "unverified", why: v.why };
     }
     if (v.kind === "pushed" && !claimed) {
-      const missing = await missingAcceptance(i, t);
-      if (missing) {
+      const gap = await missingAcceptance(i, t);
+      if (gap) {
         const heldNow = i.hold ? t[i.hold.column] : void 0;
         if (i.hold && heldNow && heldNow !== i.hold.shipId || await takenOverSince(i, t.id)) {
           i.log.warn(`${t.issue_id} is held by another ship now \u2014 the acceptance check is stale, left alone`, log);
@@ -9724,10 +10267,11 @@ async function enforceHandoff(i) {
         }
         await i.writer.updateTicket(t.id, {
           status: i.contract.statuses.building,
-          ...t.assignee_id ? {} : { assignee_id: i.seatId },
+          // CREW-2962: the hand-off may have assigned QA's seat; a bounce is the building seat's again.
+          assignee_id: i.seatId,
           ...i.hold && !heldNow ? { [i.hold.column]: i.hold.shipId } : {}
         });
-        await i.writer.postEvent(t.id, acceptanceBounceComment(missing, i.shipName), i.seatId, "bounced").catch(() => {
+        await i.writer.postEvent(t.id, acceptanceBounceComment(gap.missing, i.shipName, gap.judged), i.seatId, "bounced").catch(() => {
           i.log.warn("bounced, but the note failed to post", log);
         });
         i.log.warn(`${t.issue_id} bounced back to ${i.contract.statuses.building}: hand-off comment lacks the acceptance checklist`, log);
@@ -9781,7 +10325,7 @@ async function enforceHandoff(i) {
     }
     await i.writer.updateTicket(t.id, {
       status: i.contract.statuses.building,
-      ...t.assignee_id ? {} : { assignee_id: i.seatId },
+      assignee_id: i.seatId,
       ...i.hold && !heldBy ? { [i.hold.column]: i.hold.shipId } : {}
     });
     await i.writer.postEvent(t.id, bounceComment(v, i.shipName, pushError), i.seatId, "bounced").catch(() => {
@@ -9921,7 +10465,7 @@ ${i.shipName ? `${i.shipName}'s ` : "A "}${i.role} run set it to \`${st.handoff}
           i.log.warn(`${t.issue_id}: \`${v.remote}/${v.branch}\` is at ${v.origin.slice(0, 7)}, not a tip this checkout built \u2014 left alone`, at);
           continue;
         }
-        await i.writer.updateTicket(t.id, { status: st.building, ...t.assignee_id ? {} : { assignee_id: i.seatId } });
+        await i.writer.updateTicket(t.id, { status: st.building, assignee_id: i.seatId });
         await i.writer.postEvent(t.id, bounceComment(v, i.shipName), i.seatId, "bounced").catch(() => {
         });
       }
@@ -11678,6 +12222,18 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
       emit.warn(`could not save the pending hand-off: ${e.message}`, { step: "agent" });
     }
   }
+  const forbidden = end.interrupted ? null : obs.handoff.forbidden();
+  if (forbidden) {
+    try {
+      await raiseShipAttention({ state: new State(stateDirOfStream(id.streamPath)), emit }, seatCannotWriteItem(id.role, forbidden.detail));
+    } catch {
+    }
+  } else if (!end.interrupted && obs.handoff.handoffLanded()) {
+    try {
+      clearShipAttention(new State(stateDirOfStream(id.streamPath)), seatCannotWriteKey(id.role));
+    } catch {
+    }
+  }
   const before = obs.beforeFirstEdit.result();
   try {
     writeRunMeta(id, startedAt, obs.liveTicket, {
@@ -11701,6 +12257,7 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
       ms: ms3,
       code: end.code,
       ...pending ? { handoff: "pending" } : {},
+      ...forbidden ? { reason: "forbidden", forbidden: forbidden.detail } : {},
       ...end.interrupted ? { interrupted: end.interrupted } : {},
       ...identity,
       attributedTicket: attributedTicket ?? null,
@@ -11717,7 +12274,7 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
   if (id.agentLog && agentLogKey) {
     const report = {
       ticketReference: attributedTicket,
-      outcome: end.interrupted ? "interrupted" : signedOut ? "error" : end.code === 0 || end.code === null && obs.sawResult ? "success" : "error",
+      outcome: end.interrupted ? "interrupted" : signedOut || forbidden ? "error" : end.code === 0 || end.code === null && obs.sawResult ? "success" : "error",
       startedAt,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
       cycles: obs.cycles,
@@ -11927,496 +12484,200 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
     o.onAdopted?.();
     const pollMs = o.pollMs ?? TAIL_POLL_MS;
     while (isAlive(sc)) {
-      obs.feed(tail3.poll());
-      if (!killed && (msUntilDeadline(sc.deadline) ?? 1) <= 0) {
-        killed = await killForDeadline(() => runner.kill(runner.reattach(sc), WALL_CLOCK_REASON), sc.pid, emit, sc.role, obs.liveTicket ?? sc.ticket, sc.spawnedAt, sc.maxRunMinutes);
-        continue;
-      }
-      await new Promise((r) => setTimeout(r, pollMs));
-    }
-  }
-  obs.feed(tail3.poll());
-  obs.end();
-  await endSink(eventsSink);
-  await runner.release(runner.reattach(sc), emit);
-  const interrupted = killed ? WALL_CLOCK_REASON : obs.sawResult ? void 0 : adopted ? "no-result" : "daemon-exit";
-  const { ms: ms3, ticket } = await finishRun(
-    id,
-    obs,
-    emit,
-    sc.spawnedAt,
-    { code: null, ...interrupted ? { interrupted } : {} },
-    o.agentLogKey
-  );
-  return { adopted, ...interrupted ? { interrupted } : {}, ...killed ? { killed } : {}, ms: ms3, ticket };
-}
-
-// src/interrupted.ts
-var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
-function interruptedComment(b) {
-  const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
-  return `${INTERRUPTED_MARKER}
-
-The agent run on this ticket was cut short (${b.reason}) before it handed on${b.branch ? `; its branch is \`${b.branch}\`` : ""}. ${tree} The next run on this seat resumes from the worktree rather than starting over.`;
-}
-var handled = /* @__PURE__ */ new Set();
-var pidAlive = (pid) => {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return e.code === "EPERM";
-  }
-};
-function runFinished(streamPath) {
-  const path = `${streamPath}.meta.json`;
-  if (!existsSync27(path)) return false;
-  try {
-    return JSON.parse(readFileSync27(path, "utf8")).running !== true;
-  } catch {
-    return true;
-  }
-}
-function orphanedStreams(o) {
-  const dir = join30(o.stateDir, "streams");
-  if (!existsSync27(dir)) return [];
-  const ownerAlive = o.isOwnerAlive ?? pidAlive;
-  const out = [];
-  for (const name of readdirSync9(dir)) {
-    if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join30(dir, name);
-    if (runFinished(streamPath)) continue;
-    const sidecar = readRunSidecar(streamPath);
-    if (!sidecar || sidecar.route !== o.routeLabel) continue;
-    if (ownerAlive(sidecar.ownerPid)) continue;
-    out.push({ streamPath, sidecar });
-  }
-  return out;
-}
-async function reconcileRuns(o) {
-  let adopted = 0;
-  let interrupted = 0;
-  for (const { streamPath, sidecar } of orphanedStreams(o)) {
-    if (handled.has(streamPath)) continue;
-    handled.add(streamPath);
-    const isAlive = o.isAlive ?? runIsAlive;
-    const lock = isAlive(sidecar) ? o.state.acquireRun(sidecar.role, o.maxConcurrentAgents, o.roleConcurrency?.[sidecar.role] ?? 1) : null;
-    const ticketLock = isAlive(sidecar) && sidecar.ticketRecordId ? o.state.acquireTicket(sidecar.ticketRecordId) : null;
-    const work = (async () => {
-      try {
-        const result = await reattachRun(streamPath, sidecar, o.emit, {
-          agentLogKey: await o.agentLogKey?.(sidecar.role).catch(() => void 0),
-          isAlive: o.isAlive,
-          pollMs: o.pollMs,
-          onAdopted: () => o.emit.emit(`adopted ${sidecar.role} run (pid ${sidecar.pid}) left by a previous crew process`, { step: "agent", role: sidecar.role })
-        });
-        if (result.adopted) adopted++;
-        else interrupted++;
-        try {
-          await o.afterRun?.(sidecar, result);
-        } catch (e) {
-          o.emit.warn(`could not follow up on ${sidecar.role} run ${streamPath}: ${e.message}`, { step: "agent" });
-        }
-      } catch (e) {
-        o.emit.warn(`could not reattach ${sidecar.role} run ${streamPath}: ${e.message}`, { step: "agent" });
-      } finally {
-        if (lock?.ok) lock.release();
-        if (ticketLock?.ok) ticketLock.release();
-      }
-    })();
-    if (isAlive(sidecar)) {
-      if (o.inFlight) {
-        o.inFlight.add(work);
-        void work.finally(() => o.inFlight.delete(work));
-      }
-    } else {
-      await work;
-    }
-  }
-  return { adopted, interrupted };
-}
-
-// src/live-runs.ts
-import { existsSync as existsSync28, readdirSync as readdirSync10, statSync as statSync9 } from "fs";
-import { join as join31 } from "path";
-function liveRuns(stateDir, isAlive = runIsAlive) {
-  const dir = join31(stateDir, "streams");
-  if (!existsSync28(dir)) return [];
-  const out = [];
-  for (const name of readdirSync10(dir)) {
-    if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join31(dir, name);
-    if (runFinished(streamPath)) continue;
-    const sidecar = readRunSidecar(streamPath);
-    if (!sidecar || !isAlive(sidecar)) continue;
-    out.push({ ...sidecar, streamPath });
-  }
-  return out.sort((a, b) => a.spawnedAt.localeCompare(b.spawnedAt));
-}
-function runActivity(stateDir, isAlive = runIsAlive) {
-  const activeRuns = liveRuns(stateDir, isAlive).length;
-  const dir = join31(stateDir, "streams");
-  let newest = 0;
-  if (existsSync28(dir)) {
-    for (const name of readdirSync10(dir)) {
-      if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-      const streamPath = join31(dir, name);
-      if (!runFinished(streamPath)) continue;
-      try {
-        newest = Math.max(newest, statSync9(`${streamPath}.meta.json`).mtimeMs);
-      } catch {
-      }
-    }
-  }
-  return { activeRuns, lastRunEndedAt: newest ? new Date(newest).toISOString() : null };
-}
-function siblingRuns(runs, ownTicketRecordId) {
-  return runs.filter((r) => !ownTicketRecordId || r.ticketRecordId !== ownTicketRecordId);
-}
-async function settleRunEnd(o) {
-  const { tracker, emit } = o;
-  const all = o.runs ?? liveRuns(o.stateDir);
-  const slug2 = routeSlug(o.route.route);
-  const seatSiblings = siblingRuns(all.filter((r) => r.role === o.role && r.route === slug2), o.ownTicketRecordId);
-  const shipSiblings = siblingRuns(all, o.ownTicketRecordId);
-  const newest = (rs) => rs[rs.length - 1];
-  if (o.memberId) {
-    try {
-      if (seatSiblings.length) await tracker.setCrewStatus(o.memberId, "working", newest(seatSiblings).ticketRecordId);
-      else await tracker.setCrewStatus(o.memberId, "idle");
-    } catch (e) {
-      emit.warn(`could not clear crew status: ${e.message}`, { step: "agent" });
-    }
-  }
-  try {
-    if (shipSiblings.length) {
-      const n = newest(shipSiblings);
-      await tracker.beatEngaged(o.shipName, n.routeName ?? n.route, n.ticketRecordId, n.spawnedAt);
-    } else {
-      await tracker.beatIdle(o.shipName);
-    }
-  } catch (e) {
-    emit.warn(`could not beat ship idle: ${e.message}`, { step: "agent" });
-  }
-}
-function describeRun(run3, route2, seatIds, worktreeOf = (d, n) => {
-  try {
-    return worktreeForNumber(d, n)?.path ?? null;
-  } catch {
-    return null;
-  }
-}) {
-  const ownRoute = run3.route === routeSlug(route2.route);
-  const repoDir = run3.repo ? reposOf(route2).find((t) => t.name === run3.repo)?.dir : void 0;
-  const num = run3.ticket?.replace(/^\D+/, "") ?? "";
-  return {
-    role: run3.role,
-    seat: ownRoute ? seatIds[run3.role] ?? null : null,
-    ticket: run3.ticket,
-    ticketRecordId: run3.ticketRecordId,
-    repo: run3.repo ?? null,
-    worktree: repoDir && num ? worktreeOf(repoDir, num) : null,
-    stream: run3.streamPath,
-    pid: run3.pid,
-    startedAt: run3.spawnedAt,
-    deadline: run3.deadline ?? null
-  };
-}
-
-// src/seat-keys.ts
-import { hostFromUrl as hostFromUrl2 } from "@tablation/client";
-var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
-function keyIsAdmin(route2) {
-  const role = route2.resolved?.role;
-  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
-}
-var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
-var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
-var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
-function seatKeySlug(workspaceSlug, agentId) {
-  return `${workspaceSlug}#agent:${agentId}`;
-}
-function slugFor(route2, agentId) {
-  const [workspaceSlug] = splitRoute(route2.route);
-  return seatKeySlug(workspaceSlug, agentId);
-}
-function withFoundSeats(route2, found, previousReleaseAgentId) {
-  const resolved = route2.resolved;
-  if (!resolved) return route2;
-  const releaseSeat2 = found.releaseSeat ?? resolved.releaseSeat;
-  const releaseAgentId = resolved.releaseAgentId ?? previousReleaseAgentId;
-  return {
-    ...route2,
-    resolved: {
-      ...resolved,
-      seats: found.seats,
-      ...releaseSeat2 ? { releaseSeat: releaseSeat2 } : {},
-      ...releaseAgentId ? { releaseAgentId } : {}
+      obs.feed(tail3.poll());
+      if (!killed && (msUntilDeadline(sc.deadline) ?? 1) <= 0) {
+        killed = await killForDeadline(() => runner.kill(runner.reattach(sc), WALL_CLOCK_REASON), sc.pid, emit, sc.role, obs.liveTicket ?? sc.ticket, sc.spawnedAt, sc.maxRunMinutes);
+        continue;
+      }
+      await new Promise((r) => setTimeout(r, pollMs));
     }
-  };
+  }
+  obs.feed(tail3.poll());
+  obs.end();
+  await endSink(eventsSink);
+  await runner.release(runner.reattach(sc), emit);
+  const interrupted = killed ? WALL_CLOCK_REASON : obs.sawResult ? void 0 : adopted ? "no-result" : "daemon-exit";
+  const { ms: ms3, ticket } = await finishRun(
+    id,
+    obs,
+    emit,
+    sc.spawnedAt,
+    { code: null, ...interrupted ? { interrupted } : {} },
+    o.agentLogKey
+  );
+  return { adopted, ...interrupted ? { interrupted } : {}, ...killed ? { killed } : {}, ms: ms3, ticket };
 }
-function seatAgentId(route2, role) {
-  return route2.resolved?.agentPersonas?.[role]?.agentId;
+
+// src/interrupted.ts
+var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
+function interruptedComment(b) {
+  const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
+  return `${INTERRUPTED_MARKER}
+
+The agent run on this ticket was cut short (${b.reason}) before it handed on${b.branch ? `; its branch is \`${b.branch}\`` : ""}. ${tree} The next run on this seat resumes from the worktree rather than starting over.`;
 }
-async function resolveReleaseKey(route2, getStore = getSessionStore) {
-  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route2), reason });
-  const agentId = route2.resolved?.releaseAgentId;
-  if (!agentId) return ship(keyIsAdmin(route2) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
+var handled = /* @__PURE__ */ new Set();
+var pidAlive = (pid) => {
   try {
-    const session = await getStore().get(hostFromUrl2(route2.baseUrl), slugFor(route2, agentId));
-    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship(keyIsAdmin(route2) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+    process.kill(pid, 0);
+    return true;
   } catch (e) {
-    const reason = describeReadError(e);
-    return { kind: "ship", apiKey: resolveApiKey(route2), reason, storeError: reason };
+    return e.code === "EPERM";
   }
-}
-async function resolveSeatKey(route2, role, getStore = getSessionStore) {
-  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route2), reason });
-  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
-  const agentId = seatAgentId(route2, role);
-  if (!agentId) return ship(keyIsAdmin(route2) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
+};
+function runFinished(streamPath) {
+  const path = `${streamPath}.meta.json`;
+  if (!existsSync27(path)) return false;
   try {
-    const session = await getStore().get(hostFromUrl2(route2.baseUrl), slugFor(route2, agentId));
-    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship(keyIsAdmin(route2) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
-  } catch (e) {
-    const reason = describeReadError(e);
-    return { kind: "ship", apiKey: resolveApiKey(route2), reason, storeError: reason };
-  }
-}
-function safeStderrLine(e) {
-  const err3 = e;
-  const raw = typeof err3?.stderr === "string" && err3.stderr.trim() ? err3.stderr : typeof err3?.message === "string" ? err3.message : "";
-  for (const line of raw.split("\n")) {
-    const t = line.trim();
-    if (!t || /^Command failed:/i.test(t) || /(^|\s)-w(\s|$)/.test(t)) continue;
-    return t.slice(0, 120);
-  }
-  return void 0;
-}
-function describeReadError(e) {
-  const fsErr = e;
-  if (typeof fsErr?.path === "string" && typeof fsErr.code === "string") return `key file store unreadable (${fsErr.code})`;
-  const code = e?.code;
-  const line = safeStderrLine(e);
-  const what = typeof code === "number" ? `security exited ${code}` : typeof code === "string" ? `security failed: ${code}` : void 0;
-  const detail = [what, line].filter(Boolean).join(what && line ? ": " : "");
-  return detail ? `OS keychain unavailable (${detail})` : "OS keychain unavailable";
-}
-function keychainExitCode(reason) {
-  const m = /security exited (\d+)/.exec(reason);
-  return m ? Number(m[1]) : void 0;
-}
-function describeStoreError(e) {
-  const msg = e instanceof Error ? e.message : String(e);
-  if (/User interaction is not allowed/i.test(msg)) {
-    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+    return JSON.parse(readFileSync27(path, "utf8")).running !== true;
+  } catch {
+    return true;
   }
-  return "keychain unavailable (could not write to the OS keychain)";
 }
-async function mintMissingSeatKeys(route2, o) {
+function orphanedStreams(o) {
+  const dir = join30(o.stateDir, "streams");
+  if (!existsSync27(dir)) return [];
+  const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
-  if (!route2.resolved) return out;
-  const resolved = route2.resolved;
-  const doFetch = o.fetchImpl ?? fetch;
-  const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
-  ];
-  let store;
-  try {
-    store = (o.getStore ?? getSessionStore)();
-  } catch (e) {
-    return targets.map(({ role }) => ({
-      role,
-      action: "failed",
-      detail: describeStoreError(e)
-    }));
-  }
-  const host = hostFromUrl2(route2.baseUrl);
-  const base = route2.baseUrl.replace(/\/+$/, "");
-  if (!o.dryRun) {
-    const probeSlug = seatKeySlug(splitRoute(route2.route)[0], "_probe");
-    try {
-      await store.set(host, probeSlug, {
-        apiKey: "probe",
-        workspaceId: resolved.workspaceId,
-        identityId: "_probe",
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      await store.clear(host, probeSlug);
-    } catch (e) {
-      const detail = `${describeStoreError(e)}; no keys minted`;
-      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
-    }
+  for (const name of readdirSync9(dir)) {
+    if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
+    const streamPath = join30(dir, name);
+    if (runFinished(streamPath)) continue;
+    const sidecar = readRunSidecar(streamPath);
+    if (!sidecar || sidecar.route !== o.routeLabel) continue;
+    if (ownerAlive(sidecar.ownerPid)) continue;
+    out.push({ streamPath, sidecar });
   }
-  for (const { role, agentId, actorRecordId } of targets) {
-    if (!agentId) {
-      out.push({ role, action: "no_agent" });
-      continue;
-    }
-    const slug2 = slugFor(route2, agentId);
-    try {
-      if ((await store.get(host, slug2))?.apiKey) {
-        out.push({ role, action: "already_stored" });
-        continue;
-      }
-      if (o.dryRun) {
-        out.push({ role, action: "minted", detail: "dry run" });
-        continue;
-      }
-      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${resolveApiKey(route2)}`,
-          "Content-Type": "application/json",
-          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
-        },
-        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}`, ...actorRecordId ? { actorRecordId } : {} })
-      });
-      if (res.status === 403) {
-        out.push({ role, action: "forbidden" });
-        break;
-      }
-      if (!res.ok) {
-        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
-        continue;
-      }
-      const body = await res.json();
-      if (!body.key) {
-        out.push({ role, action: "failed", detail: "response carried no key" });
-        continue;
-      }
+  return out;
+}
+async function reconcileRuns(o) {
+  let adopted = 0;
+  let interrupted = 0;
+  for (const { streamPath, sidecar } of orphanedStreams(o)) {
+    if (handled.has(streamPath)) continue;
+    handled.add(streamPath);
+    const isAlive = o.isAlive ?? runIsAlive;
+    const lock = isAlive(sidecar) ? o.state.acquireRun(sidecar.role, o.maxConcurrentAgents, o.roleConcurrency?.[sidecar.role] ?? 1) : null;
+    const ticketLock = isAlive(sidecar) && sidecar.ticketRecordId ? o.state.acquireTicket(sidecar.ticketRecordId) : null;
+    const work = (async () => {
       try {
-        const session = {
-          apiKey: body.key,
-          workspaceId: resolved.workspaceId,
-          identityId: agentId,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          ...body.id ? { keyId: body.id } : {}
-        };
-        await store.set(host, slug2, session);
-      } catch (e) {
-        let revoked = false;
-        if (body.id) {
-          try {
-            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
-              method: "DELETE",
-              headers: { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-            });
-            revoked = del2.ok;
-          } catch {
-            revoked = false;
-          }
-        }
-        out.push({
-          role,
-          action: "failed",
-          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
+        const result = await reattachRun(streamPath, sidecar, o.emit, {
+          agentLogKey: await o.agentLogKey?.(sidecar.role).catch(() => void 0),
+          isAlive: o.isAlive,
+          pollMs: o.pollMs,
+          onAdopted: () => o.emit.emit(`adopted ${sidecar.role} run (pid ${sidecar.pid}) left by a previous crew process`, { step: "agent", role: sidecar.role })
         });
-        continue;
+        if (result.adopted) adopted++;
+        else interrupted++;
+        try {
+          await o.afterRun?.(sidecar, result);
+        } catch (e) {
+          o.emit.warn(`could not follow up on ${sidecar.role} run ${streamPath}: ${e.message}`, { step: "agent" });
+        }
+      } catch (e) {
+        o.emit.warn(`could not reattach ${sidecar.role} run ${streamPath}: ${e.message}`, { step: "agent" });
+      } finally {
+        if (lock?.ok) lock.release();
+        if (ticketLock?.ok) ticketLock.release();
       }
-      out.push({ role, action: "minted" });
-    } catch (e) {
-      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
-    }
-  }
-  return out;
-}
-function describeMintOutcome(o) {
-  switch (o.action) {
-    case "minted":
-      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
-    case "already_stored":
-      return `${o.role}: agent key already stored`;
-    case "no_agent":
-      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
-    case "forbidden":
-      return FORBIDDEN_LINE;
-    case "failed":
-      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
+    })();
+    if (isAlive(sidecar)) {
+      if (o.inFlight) {
+        o.inFlight.add(work);
+        void work.finally(() => o.inFlight.delete(work));
+      }
+    } else {
+      await work;
+    }
   }
+  return { adopted, interrupted };
 }
-async function revokeSeatKeys(route2, o) {
+
+// src/live-runs.ts
+import { existsSync as existsSync28, readdirSync as readdirSync10, statSync as statSync9 } from "fs";
+import { join as join31 } from "path";
+function liveRuns(stateDir, isAlive = runIsAlive) {
+  const dir = join31(stateDir, "streams");
+  if (!existsSync28(dir)) return [];
   const out = [];
-  if (!route2.resolved) return out;
-  const resolved = route2.resolved;
-  const doFetch = o.fetchImpl ?? fetch;
-  const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route2, role), actorRecordId: resolved.seats[role] })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId, actorRecordId: resolved.releaseSeat }] : []
-  ];
-  let store;
-  try {
-    store = (o.getStore ?? getSessionStore)();
-  } catch (e) {
-    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
+  for (const name of readdirSync10(dir)) {
+    if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
+    const streamPath = join31(dir, name);
+    if (runFinished(streamPath)) continue;
+    const sidecar = readRunSidecar(streamPath);
+    if (!sidecar || !isAlive(sidecar)) continue;
+    out.push({ ...sidecar, streamPath });
   }
-  const host = hostFromUrl2(route2.baseUrl);
-  const base = route2.baseUrl.replace(/\/+$/, "");
-  for (const { role, agentId } of targets) {
-    if (!agentId) {
-      out.push({ role, action: "no_agent" });
-      continue;
+  return out.sort((a, b) => a.spawnedAt.localeCompare(b.spawnedAt));
+}
+function runActivity(stateDir, isAlive = runIsAlive) {
+  const activeRuns = liveRuns(stateDir, isAlive).length;
+  const dir = join31(stateDir, "streams");
+  let newest = 0;
+  if (existsSync28(dir)) {
+    for (const name of readdirSync10(dir)) {
+      if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
+      const streamPath = join31(dir, name);
+      if (!runFinished(streamPath)) continue;
+      try {
+        newest = Math.max(newest, statSync9(`${streamPath}.meta.json`).mtimeMs);
+      } catch {
+      }
     }
-    const slug2 = slugFor(route2, agentId);
+  }
+  return { activeRuns, lastRunEndedAt: newest ? new Date(newest).toISOString() : null };
+}
+function siblingRuns(runs, ownTicketRecordId) {
+  return runs.filter((r) => !ownTicketRecordId || r.ticketRecordId !== ownTicketRecordId);
+}
+async function settleRunEnd(o) {
+  const { tracker, emit } = o;
+  const all = o.runs ?? liveRuns(o.stateDir);
+  const slug2 = routeSlug(o.route.route);
+  const seatSiblings = siblingRuns(all.filter((r) => r.role === o.role && r.route === slug2), o.ownTicketRecordId);
+  const shipSiblings = siblingRuns(all, o.ownTicketRecordId);
+  const newest = (rs) => rs[rs.length - 1];
+  if (o.memberId) {
     try {
-      const session = await store.get(host, slug2);
-      if (!session?.apiKey) {
-        out.push({ role, action: "not_stored" });
-        continue;
-      }
-      if (!session.keyId) {
-        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
-        continue;
-      }
-      if (o.dryRun) {
-        out.push({ role, action: "revoked", detail: "dry run" });
-        continue;
-      }
-      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
-        method: "DELETE",
-        headers: { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-      });
-      if (!del2.ok && del2.status !== 404) {
-        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
-        continue;
-      }
-      await store.clear(host, slug2);
-      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
+      if (seatSiblings.length) await tracker.setCrewStatus(o.memberId, "working", newest(seatSiblings).ticketRecordId);
+      else await tracker.setCrewStatus(o.memberId, "idle");
     } catch (e) {
-      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+      emit.warn(`could not clear crew status: ${e.message}`, { step: "agent" });
     }
   }
-  return out;
-}
-function describeRevokeOutcome(o) {
-  switch (o.action) {
-    case "revoked":
-      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
-    case "not_stored":
-      return `${o.role}: no agent key stored on this ship`;
-    case "no_agent":
-      return `${o.role}: no linked Agents row`;
-    case "failed":
-      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
+  try {
+    if (shipSiblings.length) {
+      const n = newest(shipSiblings);
+      await tracker.beatEngaged(o.shipName, n.routeName ?? n.route, n.ticketRecordId, n.spawnedAt);
+    } else {
+      await tracker.beatIdle(o.shipName);
+    }
+  } catch (e) {
+    emit.warn(`could not beat ship idle: ${e.message}`, { step: "agent" });
   }
 }
-async function canMintAgentKeys(route2, o = {}) {
-  const resolved = route2.resolved;
-  if (!resolved) return void 0;
-  const agentId = seatAgentId(route2, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route2, r)).find(Boolean);
-  if (!agentId) return void 0;
+function describeRun(run3, route2, seatIds, worktreeOf = (d, n) => {
   try {
-    const res = await (o.fetchImpl ?? fetch)(`${route2.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
-      headers: { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-    });
-    if (res.ok) return true;
-    return res.status === 403 ? false : void 0;
+    return worktreeForNumber(d, n)?.path ?? null;
   } catch {
-    return void 0;
+    return null;
   }
+}) {
+  const ownRoute = run3.route === routeSlug(route2.route);
+  const repoDir = run3.repo ? reposOf(route2).find((t) => t.name === run3.repo)?.dir : void 0;
+  const num = run3.ticket?.replace(/^\D+/, "") ?? "";
+  return {
+    role: run3.role,
+    seat: ownRoute ? seatIds[run3.role] ?? null : null,
+    ticket: run3.ticket,
+    ticketRecordId: run3.ticketRecordId,
+    repo: run3.repo ?? null,
+    worktree: repoDir && num ? worktreeOf(repoDir, num) : null,
+    stream: run3.streamPath,
+    pid: run3.pid,
+    startedAt: run3.spawnedAt,
+    deadline: run3.deadline ?? null
+  };
 }
 
 // src/deprovision-host.ts
@@ -19488,100 +19749,6 @@ function formatWhoami(report) {
 `;
 }
 
-// src/seat-read-probe.ts
-var SEAT_NO_READ_REMEDY = "the project has no default role for agent keys \u2014 update the Issues app's template, then re-mint with `crew agents sync --revoke-seat-keys`, or assign the Crew seat role to the agent members";
-function probeTables(route2) {
-  const m = route2.resolved?.models;
-  if (!m) return [];
-  const r = route2.resolved;
-  return [
-    { name: "Issues", modelId: m.issues },
-    { name: "Comments", modelId: m.comments },
-    { name: "Crew", modelId: m.crew },
-    { name: "Ships", modelId: r?.shipsModelId ?? "" }
-  ].filter((t) => !!t.modelId);
-}
-async function probeTableRead(route2, modelId, apiKey, o = {}) {
-  const url = `${route2.baseUrl.replace(/\/+$/, "")}/api/data-models/${modelId}/records?limit=1`;
-  try {
-    const res = await (o.fetchImpl ?? fetch)(url, {
-      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-    });
-    if (res.ok) return { state: "ok" };
-    if (res.status === 403) return { state: "forbidden" };
-    return { state: "unknown", detail: `HTTP ${res.status}` };
-  } catch (e) {
-    return { state: "unknown", detail: e.message };
-  }
-}
-async function probeSeatReads(route2, o = {}) {
-  const out = [];
-  const roles = [...SEAT_KEY_ROLES.filter((r) => route2.resolved?.seats[r]), ...route2.resolved?.releaseSeat ? ["release"] : []];
-  for (const role of roles) {
-    const id = role === "release" ? await resolveReleaseKey(route2, o.getStore) : await resolveSeatKey(route2, role, o.getStore);
-    if (id.kind !== "agent") continue;
-    const tables = [];
-    for (const t of probeTables(route2)) tables.push({ table: t.name, ...await probeTableRead(route2, t.modelId, id.apiKey, o) });
-    const bad = tables.find((t) => t.state === "forbidden") ?? tables.find((t) => t.state === "unknown");
-    out.push({ role, state: bad?.state ?? (tables.length ? "ok" : "unknown"), detail: bad?.detail ?? (tables.length ? void 0 : "route has no resolved tables"), tables });
-  }
-  return out;
-}
-function forbiddenDetail(e, route2) {
-  const msg = e instanceof Error ? e.message : String(e);
-  const m = /^([A-Z]+) (\S+) -> 403/.exec(msg);
-  const verb = /No (READ|WRITE) access/i.exec(msg)?.[1]?.toUpperCase();
-  const modelId = /\/data-models\/([\w-]+)/i.exec(m?.[2] ?? "")?.[1];
-  const r = route2?.resolved;
-  const known = [
-    [r?.models?.issues, "Issues"],
-    [r?.models?.comments, "Comments"],
-    [r?.models?.crew, "Crew"],
-    [r?.shipsModelId, "Ships"],
-    [r?.locksModelId, "Locks"],
-    [r?.epicsModelId, "Epics"],
-    [r?.periscopesModelId, "Periscopes"],
-    [r?.reposModelId, "Repos"]
-  ];
-  const table2 = modelId ? known.find(([id]) => id && id === modelId)?.[1] ?? `table ${modelId}` : void 0;
-  return { method: m?.[1], path: m?.[2], table: table2, verb };
-}
-function remedyFor(d, roleName = "the agent role") {
-  if (d.table && d.verb && !(d.table === "Issues" && d.verb === "READ")) {
-    return `grant ${d.verb} on ${d.table} to ${roleName}`;
-  }
-  return SEAT_NO_READ_REMEDY;
-}
-function describeSeatForbidden(role, tables = []) {
-  const bad = tables.filter((t) => t.state === "forbidden").map((t) => t.table);
-  const what = bad.length ? bad.join(", ") : "Issues";
-  const remedy = bad.length && !(bad.length === 1 && bad[0] === "Issues") ? bad.map((t) => remedyFor({ table: t, verb: "READ" })).join("; ") : SEAT_NO_READ_REMEDY;
-  return `seat read:        ERROR ${role} agent key cannot read ${what} (403) \u2014 ${remedy}`;
-}
-function describeSeatTables(role, tables) {
-  const cells = tables.map((t) => `${t.table} ${t.state === "ok" ? "ok" : t.state === "forbidden" ? "403" : `error (${t.detail ?? "?"})`}`);
-  return `seat read:        ${role}: ${cells.join(", ")}`;
-}
-function isForbiddenError(e) {
-  const status2 = e?.status;
-  if (status2 === 403) return true;
-  return /\b403\b/.test(e instanceof Error ? e.message : String(e));
-}
-var SEAT_FORBIDDEN_KEY = "seat_forbidden:release";
-function seatForbiddenItem(now = /* @__PURE__ */ new Date(), e, route2) {
-  const d = e === void 0 ? {} : forbiddenDetail(e, route2);
-  const what = d.method && d.table ? `${d.method} ${d.table}${d.verb ? ` -> 403 No ${d.verb} access` : " -> 403"}` : "cannot read the Issues table (403)";
-  return {
-    kind: "seat_forbidden",
-    key: SEAT_FORBIDDEN_KEY,
-    message: `release seat: ${what} \u2014 ${remedyFor(d)}`,
-    since: now.toISOString()
-  };
-}
-function seatForbiddenRepoLine(scope) {
-  return `${scope}: skipped \u2014 release seat was refused by the tracker (see attention)`;
-}
-
 // src/cli.ts
 import { StaleWriteError as StaleWriteError9 } from "@tablation/client";
 
@@ -23493,6 +23660,14 @@ async function runOnePassUnguarded(o) {
     for (const role of order) {
       const count = live.get(role);
       if (count === void 0) continue;
+      if (openShipAttention(o.state).some((i) => i.key === seatCannotWriteKey(role))) {
+        if (await (o.seatWriteRefused ?? ((r) => seatWriteStillRefused(o.route, r, { userAgent: o.ship.userAgent })))(role)) {
+          if (count === 0) skipped.push({ role, reason: "seat role cannot write the hand-off fields \u2014 see attention" });
+          live.delete(role);
+          continue;
+        }
+        clearShipAttention(o.state, seatCannotWriteKey(role));
+      }
       if (!breaker.allows(role)) {
         if (count === 0) skipped.push({ role, reason: "agent recently failed to start \u2014 waiting before retry" });
         live.delete(role);
@@ -23827,6 +24002,17 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
     agentPersona: await fetchSeatPersona(route2, role, { userAgent: ship.userAgent }),
     resolvedAgentId: await resolveAgentId(route2, role, { userAgent: ship.userAgent })
   });
+  const raiseIfSeatForbidden = async (e, what) => {
+    if (identity.kind !== "agent" || !isForbiddenError(e)) return;
+    const d = forbiddenDetail(e, route2);
+    try {
+      await raiseShipAttention(
+        { state: ctx.state, emit, route: route2, ship },
+        seatCannotWriteItem(role, `${what} refused${d.table ? ` on ${d.table}` : ""}${d.verb ? ` (no ${d.verb} access)` : ""}`)
+      );
+    } catch {
+    }
+  };
   emit.enter("agent", role);
   emit.emit(`starting agent run for ${route2.route}`);
   const memberId = route2.resolved?.seats[role];
@@ -23835,12 +24021,14 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       await tracker.setCrewStatus(memberId, "working", workingId);
     } catch (e) {
       emit.warn(`could not set crew status: ${e.message}`, { step: "agent" });
+      await raiseIfSeatForbidden(e, "status write");
     }
   }
   try {
     await tracker.beatEngaged(ship.name, route2.route, workingId);
   } catch (e) {
     emit.warn(`could not beat ship engaged: ${e.message}`, { step: "agent" });
+    await raiseIfSeatForbidden(e, "Ships heartbeat");
   }
   try {
     const runStart = (/* @__PURE__ */ new Date()).toISOString();
@@ -30533,6 +30721,11 @@ watermark:  ${state.watermark()}
               problems.push({ severity: "blocker", kind: "seat_cannot_read_issues", route: route2.route, message: `${p.role} agent key refused on ${p.tables.filter((t) => t.state === "forbidden").map((t) => t.table).join(", ")} (403)`, remedy: describeSeatForbidden(p.role, p.tables).replace(/^.*?— /, "") });
             } else if (p.state === "ok") passed++;
           }
+          for (const w of await probeSeatWrites(route2, { userAgent: cfg.ship.userAgent })) {
+            if (w.state === "forbidden") {
+              problems.push({ severity: "blocker", kind: "seat_cannot_write", route: route2.route, message: seatCannotWriteMessage(w.role, w.tables), remedy: SEAT_NO_WRITE_REMEDY });
+            } else if (w.state === "ok") passed++;
+          }
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
         if (!flag("offline")) {
@@ -30768,6 +30961,14 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
 `);
           }
         }
+        for (const w of await probeSeatWrites(roleRoute, { userAgent: cfg.ship.userAgent })) {
+          if (w.state === "forbidden") {
+            process.stdout.write(`seat write:       ERROR ${seatCannotWriteMessage(w.role, w.tables)} (READ only) \u2014 ${SEAT_NO_WRITE_REMEDY}
+`);
+            process.exitCode = 1;
+          } else if (w.state === "ok") process.stdout.write(`seat write:       ${w.role}: ok
+`);
+        }
       }
       const [ships, crewRows] = await Promise.all([tracker.shipRows(), tracker.crewRows()]);
       if (ships.length === 0) {