@tablation/crew 0.127.6 → 0.127.8

package/dist/cli.js

@@ -11563,10 +11563,7 @@ var SandboxRunner = class {
     }
   }
 };
-function describeExecError(e) {
-  const err3 = e;
-  return (err3.stderr?.trim() || err3.message || String(e)).split("\n").slice(-3).join(" / ");
-}
+var describeExecError = describe;
 function gitOrigin(cwd) {
   try {
     return execFileSync6("git", ["-C", cwd, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -12795,9 +12792,10 @@ var realExec = (bin, args, o) => execFileP2(bin, args, { env: o?.env ?? process.
 var OPENSHELL_ATTACHABLE_LABEL = "openshell.ai/sandbox-attachable=true";
 var OPENSHELL_WORKSPACE_LABEL = "openshell.ai/sandbox-attachable-workspace";
 var VOLUME_ROOT = "/cache";
+var SANDBOX_WORKSPACE = "default";
 var DEFAULT_CACHE_SETTINGS = {
   engine: "docker",
-  workspace: "crew",
+  workspace: SANDBOX_WORKSPACE,
   helperImage: "alpine/git:latest",
   depsLockfile: "pnpm-lock.yaml"
 };
@@ -12821,6 +12819,10 @@ function cloneScript(o) {
   const mirror = `${o.mirrorDir}/${mirrorRelPath(o.repo)}`;
   const depsRoot = `${o.mirrorDir}/${depsRelDir(o.repo)}`;
   return [
+    // The mirror is written by the helper container as root and mounted read-only,
+    // so git sees it as owned by someone else and refuses it. Global (not `-c`) so
+    // it holds for every later git call in the run that reads through the alternates.
+    `git config --global --add safe.directory '*'`,
     `git clone --quiet --shared ${q(mirror)} ${q(o.workDir)}`,
     `cd ${q(o.workDir)}`,
     `git remote set-url origin ${q(o.origin)}`,
@@ -12949,6 +12951,16 @@ var SandboxCache = class {
     ]);
     return true;
   }
+  /** The workspace label the existing volume carries, or null when the volume is absent or unlabeled. A volume's labels cannot be changed in place. */
+  async volumeWorkspace() {
+    try {
+      const { stdout } = await this.engine(["volume", "inspect", "--format", `{{index .Labels "${OPENSHELL_WORKSPACE_LABEL}"}}`, this.s.volume]);
+      const v = stdout.trim();
+      return v && v !== "<no value>" ? v : null;
+    } catch {
+      return null;
+    }
+  }
   helper(image, script, args, env = {}, extra = []) {
     const flags = Object.keys(env).flatMap((k) => ["-e", k]);
     return this.engine(["run", "--rm", "--label", DOCKER_LABEL_OWNER, "-v", `${this.s.volume}:${VOLUME_ROOT}`, ...extra, ...flags, "--entrypoint", "sh", image, "-c", script, "sh", ...args], { ...process.env, ...env });
@@ -13055,7 +13067,10 @@ var SandboxCache = class {
 };
 function describe(e) {
   const err3 = e;
-  return (err3.stderr?.trim() || err3.message || String(e)).split("\n").slice(-3).join(" / ");
+  const lines2 = (err3.stderr?.trim() || err3.message || String(e)).split("\n");
+  const tail3 = lines2.slice(-3);
+  const first = lines2.find((l) => /^(fatal|error):/.test(l.trim()));
+  return (first && !tail3.includes(first) ? [first, ...tail3] : tail3).join(" / ");
 }
 function cacheSettingsOf(cfg) {
   if (!cfg?.cacheVolume) return null;
@@ -30738,6 +30753,8 @@ watermark:  ${state.watermark()}
           try {
             const missing = unmirroredRepos(sandboxCacheRepos(route2, cfg.ship), await new SandboxCache(cacheSettings).list());
             for (const r of missing) problems.push({ severity: "attention", kind: "sandbox_cache_unmirrored", route: route2.route, message: `${r} has no mirror in the cache volume ${cacheSettings.volume}, so sandboxed runs cannot clone it`, remedy: "see `crew sandbox cache` for the last refresh failure" });
+            const labeled = await new SandboxCache(cacheSettings).volumeWorkspace();
+            if (labeled !== null && labeled !== cacheSettings.workspace) problems.push({ severity: "blocker", kind: "sandbox_cache_workspace_mismatch", route: route2.route, message: `the cache volume ${cacheSettings.volume} is labeled for OpenShell workspace "${labeled}" but sandboxes are created in "${cacheSettings.workspace}", so the gateway refuses to mount it`, remedy: "run `crew sandbox cache --reset` to recreate the volume with the right label" });
           } catch {
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.127.6",
+  "version": "0.127.8",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",