@tablation/crew 0.128.3 → 0.129.1

package/dist/cli.js

@@ -797,7 +797,7 @@ function shellInitScript(shell) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync15, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
 import { resolve as resolve2, dirname as dirname8, isAbsolute as isAbsolute2, join as join17, basename as basename4 } from "path";
 import { homedir as homedir6, tmpdir } from "os";
 import { parse as parse2 } from "yaml";
@@ -2664,7 +2664,64 @@ function explain(ship, required) {
 }
 
 // src/repo-config.ts
-import { readFileSync as readFileSync14, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync14, existsSync as hostExists } from "fs";
+
+// src/remote-dir.ts
+import { execFileSync as execFileSync5 } from "child_process";
+import { posix } from "path";
+var REMOTE_ROOT = "/.crew-sandbox";
+var registry = /* @__PURE__ */ new Map();
+function registerRemoteDir(r) {
+  const dir = `${REMOTE_ROOT}/${r.sandbox}`;
+  registry.set(dir, r);
+  return dir;
+}
+function unregisterRemoteDir(dir) {
+  registry.delete(dir);
+}
+function remoteOf(path) {
+  if (!path.startsWith(`${REMOTE_ROOT}/`)) return null;
+  for (const [dir, remote] of registry) {
+    if (path === dir) return { remote, path: remote.workDir };
+    if (path.startsWith(`${dir}/`)) return { remote, path: posix.join(remote.workDir, path.slice(dir.length + 1)) };
+  }
+  return null;
+}
+function sandboxExecArgs(r, cwd, argv2) {
+  return ["sandbox", "exec", "-n", r.sandbox, "--no-login-shell", "--workdir", cwd, "--", ...argv2];
+}
+function execRemoteSync(hit, argv2, o = {}) {
+  return execFileSync5(hit.remote.bin, sandboxExecArgs(hit.remote, o.cwd ?? hit.path, argv2), {
+    encoding: "utf8",
+    stdio: [o.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"],
+    maxBuffer: 256 * 1024 * 1024,
+    ...o.input === void 0 ? {} : { input: o.input }
+  });
+}
+function existsAt(path, hostExists2) {
+  const hit = remoteOf(path);
+  if (!hit) return hostExists2(path);
+  try {
+    execRemoteSync(hit, ["test", "-e", hit.path], { cwd: hit.remote.workDir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readTextAt(path, hostRead) {
+  const hit = remoteOf(path);
+  return hit ? execRemoteSync(hit, ["cat", "--", hit.path], { cwd: hit.remote.workDir }) : hostRead(path);
+}
+function writeTextAt(path, text2, hostWrite) {
+  const hit = remoteOf(path);
+  if (!hit) {
+    hostWrite(path, text2);
+    return;
+  }
+  execRemoteSync(hit, ["sh", "-c", 'cat > "$1"', "sh", hit.path], { input: text2, cwd: hit.remote.workDir });
+}
+
+// src/repo-config.ts
 import { join as join16, basename as basename3, dirname as dirname7 } from "path";
 import { parse } from "yaml";
 
@@ -2964,7 +3021,7 @@ var PROVIDERS = ["github", "buildkite", "other", "none"];
 function findRepoConfig(dir) {
   for (const name of REPO_CONFIG_FILENAMES) {
     const p = join16(dir, name);
-    if (existsSync14(p)) return p;
+    if (existsAt(p, hostExists)) return p;
   }
   return null;
 }
@@ -3218,10 +3275,10 @@ function parseRepoConfig(text2, file) {
   if (versionFilesGiven) {
     for (const name of versionFiles) {
       const path = join16(dirname7(file), name);
-      if (!existsSync14(path)) continue;
+      if (!existsAt(path, hostExists)) continue;
       let text3;
       try {
-        text3 = readFileSync14(path, "utf8");
+        text3 = readTextAt(path, (p) => readFileSync14(p, "utf8"));
       } catch (e) {
         throw new RepoConfigError(
           `${file}: release.versionFiles entry "${name}" cannot be read (${e.code ?? "read error"})`
@@ -3266,7 +3323,7 @@ function parseRepoConfig(text2, file) {
 function loadRepoConfig(dir) {
   const file = findRepoConfig(dir);
   if (!file) return null;
-  return parseRepoConfig(readFileSync14(file, "utf8"), file);
+  return parseRepoConfig(readTextAt(file, (p) => readFileSync14(p, "utf8")), file);
 }
 function loadRepoConfigTolerant(dir, refused) {
   try {
@@ -3849,7 +3906,7 @@ function configSearchPath(crewHome) {
 }
 function findConfigFile(crewHome) {
   const candidates2 = configSearchPath(crewHome);
-  return candidates2.find((c) => existsSync15(c)) ?? candidates2[candidates2.length - 1];
+  return candidates2.find((c) => existsSync14(c)) ?? candidates2[candidates2.length - 1];
 }
 var defaultConfigPath = () => join17(process.env.XDG_CONFIG_HOME ?? join17(homedir6(), ".config"), "crew", "crew.yaml");
 function routeSlug(route2) {
@@ -3872,7 +3929,7 @@ function splitRoute(route2) {
 }
 function readResolvedFile(stateDir, route2) {
   const path = resolvedPathFor(stateDir, route2);
-  if (!existsSync15(path)) return void 0;
+  if (!existsSync14(path)) return void 0;
   try {
     return JSON.parse(readFileSync15(path, "utf8"));
   } catch (e) {
@@ -3935,7 +3992,7 @@ function parseResolved(raw, m, where) {
 }
 function loadConfig(crewHome, configFile, opts = {}) {
   const file = configFile ?? findConfigFile(crewHome);
-  if (opts.text === void 0 && !existsSync15(file)) {
+  if (opts.text === void 0 && !existsSync14(file)) {
     throw new ConfigError(
       `no config found. Looked in:
 ` + configSearchPath(crewHome).map((c) => `  - ${c}`).join("\n") + `
@@ -4353,7 +4410,7 @@ function repoIdForName(r, name) {
 }
 function resolveApiKey(r) {
   if (r.apiKey) return r.apiKey;
-  if (r.apiKeyFile && r.apiKeyVar && existsSync15(r.apiKeyFile)) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync14(r.apiKeyFile)) {
     for (const line of readFileSync15(r.apiKeyFile, "utf8").split("\n")) {
       const m = line.match(new RegExp(`^${r.apiKeyVar}=(.*)$`));
       if (m) return (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
@@ -4367,7 +4424,7 @@ function resolveApiKey(r) {
 }
 function credentialSource(r) {
   if (r.apiKey) return KEYCHAIN_ELIGIBLE_ROUTES.has(r) ? "keychain" : "inline";
-  if (r.apiKeyFile && r.apiKeyVar && existsSync15(r.apiKeyFile)) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync14(r.apiKeyFile)) {
     const re = new RegExp(`^${r.apiKeyVar}=`);
     if (readFileSync15(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
   }
@@ -4586,11 +4643,18 @@ function resolveShell(configured2) {
   if (/cmd(\.exe)?$/i.test(bin)) return { bin, args: ["/d", "/s", "/c"] };
   return { bin, args: ["-c"] };
 }
+function remoteScript(script, prelude, env) {
+  const q2 = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+  const exports = Object.entries(env ?? {}).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${q2(String(v))}; export ${k}; `).join("");
+  return `${prelude ?? ""}${exports}${script}`;
+}
 function runScript(script, opts) {
   const shell = opts.shell ?? defaultShell();
+  const hit = remoteOf(opts.cwd);
+  const [bin, args, cwd] = hit ? [hit.remote.bin, sandboxExecArgs(hit.remote, hit.path, [shell.bin, ...shell.args, remoteScript(script, hit.remote.prelude, opts.env)]), void 0] : [shell.bin, [...shell.args, script], opts.cwd];
   return new Promise((resolvePromise) => {
-    const child = spawn2(shell.bin, [...shell.args, script], {
-      cwd: opts.cwd,
+    const child = spawn2(bin, args, {
+      cwd,
       env: { ...process.env, ...opts.env },
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4762,7 +4826,7 @@ function recoveredFailureHeadlines(o, route2) {
 // src/install.ts
 import { dirname as dirname9, join as join18, extname } from "path";
 import { homedir as homedir7, userInfo } from "os";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync16, mkdirSync as mkdirSync11, readdirSync as readdirSync3, readFileSync as readFileSync16, statSync as statSync5, writeFileSync as writeFileSync12, unlinkSync, realpathSync } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync15, mkdirSync as mkdirSync11, readdirSync as readdirSync3, readFileSync as readFileSync16, statSync as statSync5, writeFileSync as writeFileSync12, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
 import { createHash as createHash3 } from "crypto";
 
@@ -5047,7 +5111,7 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
     };
   }
   if (hostShip === "linux" && hasSystemd) {
-    const system = existsSync16(systemUnitPathFor(label));
+    const system = existsSync15(systemUnitPathFor(label));
     const unitDir = system ? SYSTEM_UNIT_DIR : join18(homedir7(), ".config", "systemd", "user");
     const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
     if (job === "run") {
@@ -5088,7 +5152,7 @@ function planDaemonControl(crewHome, hostShip, hasSystemd) {
   }
   if (hostShip === "linux" && hasSystemd) {
     const unit = `${label}.service`;
-    const ctl = existsSync16(systemUnitPathFor(label)) ? ["systemctl"] : ["systemctl", "--user"];
+    const ctl = existsSync15(systemUnitPathFor(label)) ? ["systemctl"] : ["systemctl", "--user"];
     return {
       mechanism: "systemd",
       startCommand: [...ctl, "start", unit],
@@ -5101,9 +5165,22 @@ function planDaemonControl(crewHome, hostShip, hasSystemd) {
   }
   return { mechanism: "none", startCommand: null, stopCommand: null, statusCommand: null };
 }
+function withUserBusEnv(env = process.env, opts = {}) {
+  const platform2 = opts.platform ?? process.platform;
+  const uid = opts.uid === void 0 ? process.getuid?.() ?? null : opts.uid;
+  if (platform2 !== "linux" || uid === null) return env;
+  const dir = `/run/user/${uid}`;
+  if (env.XDG_RUNTIME_DIR && env.DBUS_SESSION_BUS_ADDRESS) return env;
+  if (!(opts.exists ?? existsSync15)(dir)) return env;
+  return {
+    ...env,
+    XDG_RUNTIME_DIR: env.XDG_RUNTIME_DIR || dir,
+    DBUS_SESSION_BUS_ADDRESS: env.DBUS_SESSION_BUS_ADDRESS || `unix:path=${env.XDG_RUNTIME_DIR || dir}/bus`
+  };
+}
 function runAll(commands, cwd, log) {
   for (const [bin, ...args] of commands) {
-    const res = spawnSync5(bin, args, { cwd, encoding: "utf8" });
+    const res = spawnSync5(bin, args, { cwd, encoding: "utf8", env: withUserBusEnv() });
     if (res.error || res.status !== 0) {
       log.warn(`${bin} ${args.join(" ")} exited ${res.status ?? "error"}`, {
         output: `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? String(res.error) : ""}`
@@ -5120,7 +5197,7 @@ async function applyInstall(plan, crewHome, dryRun, log) {
       log.emit(`would write ${path}`);
       continue;
     }
-    const before = existsSync16(path) ? readFileSync16(path, "utf8") : null;
+    const before = existsSync15(path) ? readFileSync16(path, "utf8") : null;
     if (before !== plan.unitContent[path]) changed2 = true;
     mkdirSync11(dirname9(path), { recursive: true });
     writeFileSync12(path, plan.unitContent[path]);
@@ -5187,7 +5264,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
     }
   }
   for (const path of plan.unitPaths) {
-    if (!existsSync16(path)) continue;
+    if (!existsSync15(path)) continue;
     if (dryRun) {
       log.emit(`would remove ${path}`);
       continue;
@@ -5223,7 +5300,7 @@ function loadedCrewLabels() {
   return [...parseLaunchctlList(list.stdout ?? "").keys()].filter((l) => l.startsWith(CREW_LAUNCHD_PREFIX));
 }
 function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
-  const files = existsSync16(dir) ? readdirSync3(dir) : [];
+  const files = existsSync15(dir) ? readdirSync3(dir) : [];
   const units = files.filter((f) => f.startsWith(CREW_LAUNCHD_PREFIX) && f.endsWith(".plist")).sort().map((f) => {
     const plistPath = join18(dir, f);
     let program = null;
@@ -5235,7 +5312,7 @@ function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
       label: f.slice(0, -".plist".length),
       plistPath,
       program,
-      programExists: program !== null && existsSync16(program)
+      programExists: program !== null && existsSync15(program)
     };
   });
   const seen = new Set(units.map((u) => u.label));
@@ -5254,9 +5331,9 @@ function removeLaunchdUnit(unit, dryRun, log) {
     log.emit(`would unload and remove ${unit.label}`);
     return;
   }
-  if (existsSync16(unit.plistPath)) spawnSync5("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
+  if (existsSync15(unit.plistPath)) spawnSync5("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
   spawnSync5("launchctl", ["remove", unit.label], { encoding: "utf8" });
-  if (existsSync16(unit.plistPath)) unlinkSync(unit.plistPath);
+  if (existsSync15(unit.plistPath)) unlinkSync(unit.plistPath);
   log.emit(`removed ${unit.label} (${unit.plistPath})`);
 }
 function clearForeignLaunchdUnits(crewHome, replace, dryRun, log, dir, loaded) {
@@ -5329,17 +5406,17 @@ function removeCrontabLine(marker) {
 }
 function detectSystemd() {
   if (process.platform !== "linux") return false;
-  const res = spawnSync5("systemctl", ["--user", "status"], { encoding: "utf8" });
+  const res = spawnSync5("systemctl", ["--user", "status"], { encoding: "utf8", env: withUserBusEnv() });
   return !res.error;
 }
 
 // src/ship-attention.ts
-import { existsSync as existsSync18, statfsSync } from "fs";
+import { existsSync as existsSync17, statfsSync } from "fs";
 
 // src/git.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import {
-  existsSync as existsSync17,
+  existsSync as existsSync16,
   mkdirSync as mkdirSync12,
   openSync as openSync3,
   closeSync as closeSync3,
@@ -5354,12 +5431,22 @@ import {
 import { dirname as dirname10, basename as basename5, join as join19 } from "path";
 var GitError = class extends Error {
 };
+function execGit(cwd, args, input) {
+  const hit = remoteOf(cwd);
+  if (hit) return execRemoteSync(hit, ["git", ...args], { input });
+  return execFileSync6("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+    ...input === void 0 ? { stdio: ["ignore", "pipe", "pipe"] } : { input }
+  });
+}
 function streamText(x) {
   return String(x ?? "").trim();
 }
 function gitRaw(cwd, args) {
   try {
-    return execFileSync5("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execGit(cwd, args);
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -5368,7 +5455,7 @@ function gitRaw(cwd, args) {
 }
 function git(cwd, args) {
   try {
-    return execFileSync5("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execGit(cwd, args).trim();
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -5516,6 +5603,10 @@ function pushTag(cwd, remote, tag) {
   git(cwd, ["push", remote, tag]);
 }
 function fetchRemote(cwd, remote = "origin") {
+  if (remoteOf(cwd)) {
+    const depth = gitOk(cwd, ["config", "--get", "crew.releaseDepth"]);
+    return gitOk(cwd, ["fetch", "--quiet", ...depth ? ["--depth", depth] : [], remote]) !== null;
+  }
   if (gitOk(cwd, ["fetch", "--prune", "--quiet", remote]) === null) return false;
   gitOk(cwd, ["fetch", "--quiet", remote, "refs/tags/*:refs/tags/*"]);
   return true;
@@ -5539,9 +5630,9 @@ function keyCommitsInRange(cwd, key, range) {
 }
 function patchIdOf(cwd, from, to) {
   try {
-    const diff = execFileSync5("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    const diff = execGit(cwd, ["diff", from, to]);
     if (!diff) return null;
-    const out = execFileSync5("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
+    const out = execGit(cwd, ["patch-id", "--stable"], diff);
     return out.split(" ")[0]?.trim() || null;
   } catch {
     return null;
@@ -5753,7 +5844,7 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
     try {
       const st = statSync6(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync17(join19(root, "checkout"))) continue;
+      if (existsSync16(join19(root, "checkout"))) continue;
       rmSync9(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
@@ -5805,7 +5896,7 @@ function originUrlOf(dir, remoteName) {
   }
 }
 function ensureRepoCheckout(dir, remote, opts = {}) {
-  if (existsSync17(`${dir}/.git`)) return false;
+  if (existsSync16(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
@@ -5814,7 +5905,7 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
   mkdirSync12(dirname10(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync5("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync6("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -5873,10 +5964,10 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
 function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (!existsSync17(`${dir}/.git`) && githubRemote) {
+    if (!existsSync16(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync17(marker) && readFileSync17(marker, "utf8").split("\n")[0] === url) {
+      if (existsSync16(marker) && readFileSync17(marker, "utf8").split("\n")[0] === url) {
         return { action: "clone-failed", detail: readFileSync17(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
@@ -6190,7 +6281,7 @@ function noteHeldWorktree(state, h, nowMs = Date.now()) {
 function reconcileHeldWorktrees(state, repo, log, stillRefused) {
   for (const i of state.shipAttention().previous()) {
     if (i.kind !== "worktree_held" || !i.held || i.held.repo !== repo) continue;
-    const gone = !existsSync18(i.held.path);
+    const gone = !existsSync17(i.held.path);
     if (!gone && !(stillRefused && !stillRefused.has(i.held.path))) continue;
     clearShipAttention(state, i.key);
     log.emit(
@@ -6356,14 +6447,14 @@ function attentionProblems(items, already) {
 // src/sandbox-image.ts
 import { createHash as createHash7 } from "crypto";
 import { spawn as spawn5 } from "child_process";
-import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync28, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
+import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync29, mkdirSync as mkdirSync19, readFileSync as readFileSync28, renameSync as renameSync3, writeFileSync as writeFileSync20, rmSync as rmSync15 } from "fs";
 import { dirname as dirname15, join as join32 } from "path";
 import { fileURLToPath } from "url";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync7 } from "child_process";
+import { execFileSync as execFileSync8 } from "child_process";
 import { createHash as createHash6 } from "crypto";
 
 // src/sandbox-cache.ts
@@ -6372,22 +6463,22 @@ import { promisify as promisify2 } from "util";
 
 // src/deprovision-host.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import { existsSync as existsSync29, readdirSync as readdirSync11 } from "fs";
+import { existsSync as existsSync28, readdirSync as readdirSync11 } from "fs";
 
 // src/interrupted.ts
-import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync26, readdirSync as readdirSync9, readFileSync as readFileSync27 } from "fs";
 import { join as join30 } from "path";
 
 // src/agent.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync26, existsSync as existsSync26, statSync as statSync8, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, createWriteStream, openSync as openSync4, closeSync as closeSync4, readSync } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync25, statSync as statSync8, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, createWriteStream, openSync as openSync4, closeSync as closeSync4, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
 import { join as join29, dirname as dirname14, basename as basename9 } from "path";
 import { createHash as createHash5 } from "crypto";
 
 // src/state.ts
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync13, rmSync as rmSync10, statSync as statSync7, readdirSync as readdirSync5 } from "fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync14, existsSync as existsSync18, mkdirSync as mkdirSync13, rmSync as rmSync10, statSync as statSync7, readdirSync as readdirSync5 } from "fs";
 import { join as join21 } from "path";
 var EPOCH = "1970-01-01T00:00:00.000Z";
 var State = class _State {
@@ -6433,10 +6524,10 @@ var State = class _State {
   }
   /** Whole-crew pause, and the per-role sentinels one level down. */
   isPaused() {
-    return existsSync19(this.path(".crew-paused"));
+    return existsSync18(this.path(".crew-paused"));
   }
   isRolePaused(role) {
-    return existsSync19(this.path(`.role-paused-${role}`));
+    return existsSync18(this.path(`.role-paused-${role}`));
   }
   pausedRoles(roles) {
     return new Set(roles.filter((r) => this.isRolePaused(r)));
@@ -6453,7 +6544,7 @@ var State = class _State {
    * while agents keep working.
    */
   isReleasePaused() {
-    return existsSync19(this.path(".release-paused"));
+    return existsSync18(this.path(".release-paused"));
   }
   setReleasePaused(paused) {
     if (paused) writeFileSync14(this.path(".release-paused"), "");
@@ -7874,7 +7965,7 @@ function renderEnvironment(i) {
 }
 
 // src/intel-bridge.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync14, readFileSync as readFileSync21, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync14, readFileSync as readFileSync21, rmSync as rmSync11, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname11, join as join22 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -8023,7 +8114,7 @@ function createBridge(o) {
     tryAttach,
     async start(transport) {
       await server.connect(transport);
-      if (existsSync20(o.attachFile)) await tryAttach();
+      if (existsSync19(o.attachFile)) await tryAttach();
       timer = setInterval(() => {
         void tryAttach();
       }, o.pollMs ?? 1e3);
@@ -8280,7 +8371,7 @@ var BeforeFirstEditTracker = class {
 };
 
 // src/agent-log.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync23, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync23, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "fs";
 import { join as join25 } from "path";
 
 // src/pending-backoff.ts
@@ -9347,7 +9438,7 @@ function materializeBranchForTicket(dir, cfg, t, role, onProblem, onReset) {
 }
 
 // src/pending-handoff.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync15, readdirSync as readdirSync6, readFileSync as readFileSync22, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15, readdirSync as readdirSync6, readFileSync as readFileSync22, rmSync as rmSync12, writeFileSync as writeFileSync16 } from "fs";
 import { join as join23 } from "path";
 var PENDING_MAX_AGE_MS = 48 * 36e5;
 var pendingDirFor = (stateDir) => join23(stateDir, "pending-handoffs");
@@ -9359,7 +9450,7 @@ function writePendingHandoff(stateDir, rec) {
 }
 function listPendingHandoffs(stateDir, route2) {
   const dir = pendingDirFor(stateDir);
-  if (!existsSync21(dir)) return [];
+  if (!existsSync20(dir)) return [];
   const out = [];
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
     try {
@@ -9540,7 +9631,7 @@ function holdWarnings(tickets, ships, contract, humanHolds, now = Date.now()) {
 }
 
 // src/run-worktree.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import { dirname as dirname12, join as join24 } from "path";
 var describeRunWorktreePlan = (p) => {
   switch (p.action) {
@@ -9582,7 +9673,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const existing = worktreeForNumber(dir, num);
   const located = locateBranchForTicket(dir, cfg, t, role);
   const baseRef = hasRemote ? `${remote}/${base}` : base;
-  if (existing && !existing.prunable && existsSync22(existing.path)) {
+  if (existing && !existing.prunable && existsSync21(existing.path)) {
     const branch = existing.branch;
     if (status(existing.path).length > 0) {
       return { action: opts.resumeInterrupted ? "resume-dirty" : "leave-dirty", path: existing.path, branch };
@@ -9652,7 +9743,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
   if (remoteConfigured(dir, remote) && remoteBranchExists(dir, remote, branch)) return false;
   if (countCommits(dir, `${baseRef}..${branch}`) !== 0) return false;
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (wt && existsSync22(wt.path)) {
+  if (wt && existsSync21(wt.path)) {
     if (status(wt.path).length > 0) return false;
     if (gitOk(dir, ["worktree", "remove", wt.path]) === null) return false;
   }
@@ -9660,7 +9751,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
 }
 async function finishRunWorktree(dir, cfg, branch) {
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (!wt || !existsSync22(wt.path)) return { kind: "none" };
+  if (!wt || !existsSync21(wt.path)) return { kind: "none" };
   if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
   if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
   if (remoteConfigured(dir, cfg.branch.remote) && worktreeHoldsUnpushed(wt.path, cfg.branch.remote)) {
@@ -9672,7 +9763,7 @@ async function finishRunWorktree(dir, cfg, branch) {
     if (pids.length) await killGently(pids);
   }
   gitOk(dir, ["worktree", "remove", wt.path]);
-  return existsSync22(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+  return existsSync21(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
 }
 
 // src/handoff-guard.ts
@@ -10310,7 +10401,7 @@ function queueAgentRun(stateDir, name, q2) {
 }
 async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = queueDir(stateDir);
-  if (!existsSync23(dir)) return 0;
+  if (!existsSync22(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     const path = join25(dir, f);
@@ -10363,7 +10454,7 @@ function queueTicketCounters(stateDir, name, q2) {
 }
 async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = countersDir(stateDir);
-  if (!existsSync23(dir)) return 0;
+  if (!existsSync22(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     const path = join25(dir, f);
@@ -10672,7 +10763,7 @@ function expandSkillMarkers(text2, lookup2, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync25, readdirSync as readdirSync8, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync25, readdirSync as readdirSync8, existsSync as existsSync24 } from "fs";
 import { join as join27 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError3, TablationApiError as TablationApiError2 } from "@tablation/client";
@@ -10689,7 +10780,7 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync24, existsSync as existsSync24 } from "fs";
+import { readFileSync as readFileSync24, existsSync as existsSync23 } from "fs";
 import { join as join26 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError2, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -10705,10 +10796,10 @@ var AgentsSyncError = class extends Error {
 };
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join26(promptsDir, "personas", `lane-${role}.md`);
-  if (!existsSync24(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
+  if (!existsSync23(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
   if (SELF_CONTAINED_ROLES.has(role)) return readFileSync24(briefPath, "utf8");
   const commonPath = join26(promptsDir, "personas", "common.md");
-  if (!existsSync24(commonPath)) return readFileSync24(briefPath, "utf8");
+  if (!existsSync23(commonPath)) return readFileSync24(briefPath, "utf8");
   return `${readFileSync24(commonPath, "utf8")}${readFileSync24(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route2, role, opts) {
@@ -11170,7 +11261,7 @@ function parseSkillFile(path) {
 }
 function listLocalSkills(promptsDir) {
   const dir = join27(promptsDir, "skills");
-  if (!existsSync25(dir)) return [];
+  if (!existsSync24(dir)) return [];
   return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join27(dir, f)));
 }
 async function syncSkills(route2, opts) {
@@ -11355,7 +11446,7 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
 }
 
 // src/runner.ts
-import { spawn as spawn3, execFile, execFileSync as execFileSync6 } from "child_process";
+import { spawn as spawn3, execFile, execFileSync as execFileSync7 } from "child_process";
 import { mkdtempSync, mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, rmSync as rmSync14 } from "fs";
 import { createHash as createHash4 } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
@@ -11605,7 +11696,7 @@ var SandboxRunner = class {
 var describeExecError = describe;
 function gitOrigin(cwd) {
   try {
-    return execFileSync6("git", ["-C", cwd, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync7("git", ["-C", cwd, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return null;
   }
@@ -11617,7 +11708,7 @@ function runnerOfSidecar(sc) {
   return sc.runner === "sandbox" ? new SandboxRunner(sc.sandboxBin ? { bin: sc.sandboxBin } : {}) : new HostRunner();
 }
 var PROBE_CREATE_TIMEOUT_MS = 12e4;
-function checkSandboxRunner(cfg = {}, run3 = (b, a, t) => execFileSync6(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: t ?? 15e3 })) {
+function checkSandboxRunner(cfg = {}, run3 = (b, a, t) => execFileSync7(b, a, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: t ?? 15e3 })) {
   const bin = cfg.bin ?? DEFAULT_SANDBOX_CONFIG.bin;
   let version;
   try {
@@ -11806,18 +11897,18 @@ function codeBridgeFor(o, harness) {
 }
 function planAgentRun(o) {
   const briefPath = join29(o.route.promptsDir, "personas", `lane-${o.role}.md`);
-  if (!existsSync26(briefPath)) {
+  if (!existsSync25(briefPath)) {
     throw new AgentError(`no brief at ${briefPath} \u2014 refusing to run an unscoped session`);
   }
   const commonPath = join29(o.route.promptsDir, "personas", "common.md");
-  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync26(commonPath);
+  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync25(commonPath);
   const now = o.now ?? (() => Date.now());
   const routeLabel = routeSlug(o.route.route);
   const ownDigest = o.runId ? digestPathFor(o.stateDir, routeLabel, o.role, o.runId) : void 0;
-  const digestPath2 = ownDigest && existsSync26(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
+  const digestPath2 = ownDigest && existsSync25(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
   let digest;
   let ageSeconds;
-  if (existsSync26(digestPath2)) {
+  if (existsSync25(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync8(digestPath2).mtimeMs) / 1e3);
     if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync26(digestPath2, "utf8");
   }
@@ -12563,7 +12654,7 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync27(path)) return false;
+  if (!existsSync26(path)) return false;
   try {
     return JSON.parse(readFileSync27(path, "utf8")).running !== true;
   } catch {
@@ -12572,7 +12663,7 @@ function runFinished(streamPath) {
 }
 function orphanedStreams(o) {
   const dir = join30(o.stateDir, "streams");
-  if (!existsSync27(dir)) return [];
+  if (!existsSync26(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync9(dir)) {
@@ -12630,11 +12721,11 @@ async function reconcileRuns(o) {
 }
 
 // src/live-runs.ts
-import { existsSync as existsSync28, readdirSync as readdirSync10, statSync as statSync9 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync10, statSync as statSync9 } from "fs";
 import { join as join31 } from "path";
 function liveRuns(stateDir, isAlive = runIsAlive) {
   const dir = join31(stateDir, "streams");
-  if (!existsSync28(dir)) return [];
+  if (!existsSync27(dir)) return [];
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
@@ -12650,7 +12741,7 @@ function runActivity(stateDir, isAlive = runIsAlive) {
   const activeRuns = liveRuns(stateDir, isAlive).length;
   const dir = join31(stateDir, "streams");
   let newest = 0;
-  if (existsSync28(dir)) {
+  if (existsSync27(dir)) {
     for (const name of readdirSync10(dir)) {
       if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
       const streamPath = join31(dir, name);
@@ -12743,7 +12834,7 @@ function realDeprovisionDeps(cfg, emit, crewHome, getStore) {
     if (host === "windows") return [];
     const ctx = installContext();
     const systemd = detectSystemd();
-    return ["run", "release", "passengers"].flatMap((job) => planInstall(cfg.ship, crewHome, host, systemd, job, ctx).unitPaths).filter((p) => existsSync29(p));
+    return ["run", "release", "passengers"].flatMap((job) => planInstall(cfg.ship, crewHome, host, systemd, job, ctx).unitPaths).filter((p) => existsSync28(p));
   };
   return {
     liveRuns: () => liveRuns(stateDir).map((r) => ({ role: r.role, route: r.route, pid: r.pid, ticketRecordId: r.ticketRecordId ?? void 0, streamPath: r.streamPath })),
@@ -12804,7 +12895,7 @@ function realDeprovisionDeps(cfg, emit, crewHome, getStore) {
     },
     remaining() {
       const left = [];
-      if (existsSync29(cfg.configFile)) left.push(`config ${cfg.configFile}`);
+      if (existsSync28(cfg.configFile)) left.push(`config ${cfg.configFile}`);
       for (const h of forgeHosts()) if (hasForgeToken(cfg.ship.forges, h, stateDir)) left.push(`forge token for ${h}`);
       try {
         for (const k of readdirSync11(keysDir(stateDir))) left.push(`seat key ${k}`);
@@ -13161,7 +13252,7 @@ function makeCachePass(o) {
 // src/passenger-containers.ts
 var realExec2 = (cmd, args, opts) => {
   try {
-    return execFileSync7(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
+    return execFileSync8(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
   } catch (e) {
     const err3 = e;
     const why = [err3.stderr, err3.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -13384,7 +13475,7 @@ var SANDBOX_BRIDGE_PATH = `${CREW_PREFIX}/bin/intel-bridge`;
 function readBridgeBundle() {
   const here = dirname15(fileURLToPath(import.meta.url));
   for (const p of [join32(here, "sandbox-intel-bridge.cjs"), join32(here, "..", "dist", "sandbox-intel-bridge.cjs")]) {
-    if (existsSync30(p)) return readFileSync28(p, "utf8");
+    if (existsSync29(p)) return readFileSync28(p, "utf8");
   }
   return void 0;
 }
@@ -13490,7 +13581,7 @@ var WARM_MAX_BYTES = 64 * 1024 * 1024;
 var globToRegExp = (glob) => new RegExp(`^${glob.split("*").map((p) => p.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*")}$`);
 function readWarmFiles(dir, ref, patterns) {
   if (patterns.length === 0) return {};
-  const git2 = (args) => execFileSync8("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: WARM_MAX_BYTES, stdio: ["ignore", "pipe", "pipe"] });
+  const git2 = (args) => execFileSync9("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: WARM_MAX_BYTES, stdio: ["ignore", "pipe", "pipe"] });
   const all = git2(["ls-tree", "-r", "--name-only", ref]).split("\n").filter(Boolean);
   const res = patterns.map(globToRegExp);
   const out = {};
@@ -13682,10 +13773,10 @@ async function sandboxBuildTick(repos, deps, force = false) {
 }
 
 // src/doctor-checks.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync8 } from "child_process";
+import { execFileSync as execFileSync10, spawnSync as spawnSync8 } from "child_process";
 var PROBE_BRANCH = "crew-probe-branch";
 var realGit = (cwd, args, env) => {
-  execFileSync9("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
+  execFileSync10("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
 };
 function isSshRemote(url) {
   return /^ssh:\/\//.test(url) || /^[\w.-]+@[\w.-]+:/.test(url);
@@ -13815,6 +13906,11 @@ function managedRuntimeWarnings(kind, ship) {
   }
   return out;
 }
+function runtimeDirWarning(platform2, uid, exists, user = "the crew user") {
+  if (platform2 !== "linux" || uid === null || uid === 0) return null;
+  if (exists(`/run/user/${uid}`)) return null;
+  return `/run/user/${uid} is missing, so \`systemctl --user\` cannot reach the user manager: lingering is off for ${user}; run \`sudo loginctl enable-linger ${user}\``;
+}
 var MANAGED_GIT_EMAIL = "crew@tablation.dev";
 function readGlobalGitIdentity() {
   const get2 = (key) => {
@@ -13833,7 +13929,7 @@ function managedGitIdentityWarnings(kind, identity) {
 
 // src/selftest.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync29, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync29, rmSync as rmSync16, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join33 } from "path";
 var SELFTEST_TIMEOUT_MS = 12e4;
@@ -14038,7 +14134,7 @@ var fileFor2 = (stateDir) => join33(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync31(p) ? JSON.parse(readFileSync29(p, "utf8")) : {};
+    return existsSync30(p) ? JSON.parse(readFileSync29(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -14059,9 +14155,9 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve7, dirname as dirname34, join as join56, basename as basename16 } from "path";
+import { resolve as resolve7, dirname as dirname35, join as join56, basename as basename16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { hostname as hostname5, homedir as homedir11 } from "os";
+import { hostname as hostname5, homedir as homedir11, userInfo as userInfo2 } from "os";
 import { spawnSync as spawnSync12 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
 
@@ -14364,7 +14460,7 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync22, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync22, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync18, statSync as statSync10, writeFileSync as writeFileSync23 } from "fs";
 import { dirname as dirname17, join as join35 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
@@ -14437,7 +14533,7 @@ async function runReset(o, fx) {
   }
   if (o.beforeState) steps.push(...await o.beforeState());
   steps.push(...o.wipeState ? wipeStateDir(o.stateDir, o.dryRun) : removeState(o.stateDir, o.dryRun));
-  if (existsSync32(o.configFile)) {
+  if (existsSync31(o.configFile)) {
     if (!o.dryRun) rmSync18(o.configFile, { force: true });
     steps.push({ step: "config", target: o.configFile, action: mark(o.dryRun) });
   } else {
@@ -14446,7 +14542,7 @@ async function runReset(o, fx) {
   return steps;
 }
 function removeCheckout(dir, dryRun, fx) {
-  if (!existsSync32(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
+  if (!existsSync31(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
   const { dirty, linkedWorktrees } = fx.inspectCheckout(dir);
   if (dirty.length) {
     return { step: "checkout", target: dir, action: "kept", detail: `has uncommitted changes (${dirty.length} path${dirty.length === 1 ? "" : "s"}: ${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? ", \u2026" : ""})` };
@@ -14467,7 +14563,7 @@ function removeState(stateDir, dryRun) {
   } catch {
   }
   for (const t of targets) {
-    if (!existsSync32(t)) continue;
+    if (!existsSync31(t)) continue;
     if (!dryRun) rmSync18(t, { recursive: true, force: true });
     out.push({ step: "state", target: t, action: mark(dryRun) });
   }
@@ -14863,13 +14959,13 @@ function hostArchitecture(arch = process.arch) {
 
 // src/pool-member-host.ts
 import "child_process";
-import { existsSync as existsSync36 } from "fs";
+import { existsSync as existsSync35 } from "fs";
 import { hostname as hostname3 } from "os";
 
 // src/machine-id.ts
-import { execFileSync as execFileSync10 } from "child_process";
+import { execFileSync as execFileSync11 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync33, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname19, join as join37 } from "path";
 function machineIdPathFor(stateDir) {
   return join37(stateDir, "machine-id");
@@ -14878,14 +14974,14 @@ var sha256 = (s) => createHash8("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
-      const out = execFileSync10("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      const out = execFileSync11("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync33(p)) {
+      if (existsSync32(p)) {
         const id = readFileSync33(p, "utf8").trim();
         if (id) return id;
       }
@@ -14897,7 +14993,7 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync33(path)) {
+  if (existsSync32(path)) {
     const cached = readFileSync33(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
@@ -14918,7 +15014,7 @@ function matchShipRows(ships, shipName2, machineId) {
 
 // src/provision.ts
 import { spawnSync as spawnSync9 } from "child_process";
-import { existsSync as existsSync34, readFileSync as readFileSync34, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync34, writeFileSync as writeFileSync26 } from "fs";
 import { hostname as hostname2 } from "os";
 import { parseDocument as parseDocument3, isMap as isMap2, isScalar } from "yaml";
 
@@ -15535,7 +15631,7 @@ function realProvisionDeps(crewHome) {
   };
   const configFile = () => {
     const f = findConfigFile(crewHome);
-    return existsSync34(f) ? f : null;
+    return existsSync33(f) ? f : null;
   };
   return {
     crew: spawnCrew,
@@ -15569,16 +15665,16 @@ function realProvisionDeps(crewHome) {
           continue;
         }
         for (const p of plan.unitPaths) {
-          if (!existsSync34(p) || readFileSync34(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+          if (!existsSync33(p) || readFileSync34(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
         }
       }
       const label = labelFor(crewHome, "run");
       let running = false;
       let lingering = true;
       if (mechanism === "systemd") {
-        const system = ctx.root || existsSync34(systemUnitPathFor(label));
+        const system = ctx.root || existsSync33(systemUnitPathFor(label));
         const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
-        running = spawnSync9(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
+        running = spawnSync9(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`], { env: withUserBusEnv() }).status === 0;
         if (!system) {
           const out = spawnSync9("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
           lingering = /Linger=yes/.test(out.stdout ?? "");
@@ -15632,7 +15728,7 @@ host=${host}
 
 // src/tunnel.ts
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync25, readFileSync as readFileSync35, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync25, readFileSync as readFileSync35, writeFileSync as writeFileSync27, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
 import { randomInt } from "crypto";
 import { join as join39 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -15716,7 +15812,7 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync35(path)) return void 0;
+  if (!existsSync34(path)) return void 0;
   try {
     return JSON.parse(readFileSync35(path, "utf8"));
   } catch {
@@ -15856,7 +15952,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join39(stateDir, "passengers");
-  if (!existsSync35(dir)) return [];
+  if (!existsSync34(dir)) return [];
   return readdirSync13(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 var TUNNEL_REJECTED_KEY = "tunnel_rejected";
@@ -15896,7 +15992,7 @@ function realPoolMemberDeps(o) {
       crewVersion: crewVersion(o.crewHome),
       hostname: hostname3()
     },
-    hasShipConfig: () => existsSync36(findConfigFile(o.crewHome)),
+    hasShipConfig: () => existsSync35(findConfigFile(o.crewHome)),
     async provision(lease, instanceClass, shipKind) {
       const hosts = lease.forges.map((f) => f.host.toLowerCase());
       const lines2 = [];
@@ -17272,7 +17368,7 @@ async function resolveOne(tracker, t, seat, approvedStatus, buildingStatus, affi
 }
 
 // src/repo-refresh.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync29 } from "fs";
 import { dirname as dirname21 } from "path";
 var REFRESH_COOLDOWN_MS = 2 * 6e4;
 var UNSERVABLE_PASSES_BEFORE_ATTENTION = 3;
@@ -17302,7 +17398,7 @@ function applyRepoRows(resolved, rows) {
 }
 function persistRepoRows(stateDir, routeName, rows) {
   const path = resolvedPathFor(stateDir, routeName);
-  if (!existsSync37(path)) return;
+  if (!existsSync36(path)) return;
   const raw = JSON.parse(readFileSync36(path, "utf8"));
   applyRepoRows(raw, rows);
   mkdirSync26(dirname21(path), { recursive: true });
@@ -17757,12 +17853,12 @@ var localRefSkipReported = (ticket, problem, events) => events.some((e) => e.rec
 
 // src/connect-wizard.ts
 import { delimiter, dirname as dirname22, join as join41 } from "path";
-import { accessSync as accessSync3, constants as constants3, existsSync as existsSync38, mkdirSync as mkdirSync27, writeFileSync as writeFileSync30 } from "fs";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync37, mkdirSync as mkdirSync27, writeFileSync as writeFileSync30 } from "fs";
 import { stringify as stringify3 } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync38;
+  const exists = opts.configExists ?? existsSync37;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -17956,7 +18052,7 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync31, existsSync as existsSync39, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync31, existsSync as existsSync38, copyFileSync, mkdirSync as mkdirSync28, mkdtempSync as mkdtempSync3, rmSync as rmSync19 } from "fs";
 import { dirname as dirname24, join as join43 } from "path";
 import { tmpdir as tmpdir5, hostname as hostname4 } from "os";
 
@@ -18656,6 +18752,17 @@ function ensureCommitterIdentity(o) {
 function isConflict(message, unmergedPaths) {
   return unmergedPaths.length > 0 || /CONFLICT \(|Automatic merge failed|unmerged (files|paths)/i.test(message);
 }
+var DEEPEN_STEP = 200;
+var DEEPEN_ATTEMPTS = 5;
+function deepenUntilMergeBase(o, branch) {
+  const { remote } = o.repo.branch;
+  for (let i = 0; i < DEEPEN_ATTEMPTS && gitOk(o.cwd, ["merge-base", "HEAD", branch]) === null; i++) {
+    const before = gitOk(o.cwd, ["rev-list", "--count", "--all"]);
+    if (gitOk(o.cwd, ["fetch", "--quiet", `--deepen=${DEEPEN_STEP}`, remote]) === null) return;
+    o.emit.emit(`deepened the release clone to find the merge base of ${branch}`, { step: "merge" });
+    if (gitOk(o.cwd, ["rev-list", "--count", "--all"]) === before) return;
+  }
+}
 function mergeOne(o, c) {
   const subject = c.entries[0] ?? `${c.ticket.title ?? c.ticket.issue_id} (${c.ticket.issue_id})`;
   if (o.dryRun) {
@@ -18663,6 +18770,7 @@ function mergeOne(o, c) {
     return { applied: true };
   }
   const before = headSha(o.cwd);
+  if (remoteOf(o.cwd)) deepenUntilMergeBase(o, c.branch);
   const clearFailure = () => {
     o.attention?.clear(`release_merge_failed:${o.scope ?? "release"}`);
   };
@@ -18729,11 +18837,11 @@ async function bump(o, size) {
   }
   const files = o.repo.release.versionFiles.map((f) => join43(o.cwd, f));
   const first = files[0];
-  if (!existsSync39(first)) {
+  if (!existsAt(first, existsSync38)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const firstText = readFileSync37(first, "utf8");
+  const firstText = readTextAt(first, (p) => readFileSync37(p, "utf8"));
   const problem = versionFileProblem(o.repo.release.versionFiles[0], firstText);
   if (problem) {
     o.emit.error(problem);
@@ -18752,13 +18860,13 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync37(f, "utf8");
+    const src = readTextAt(f, (p) => readFileSync37(p, "utf8"));
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync31(f, out);
+    writeTextAt(f, out, writeFileSync31);
   }
   return version;
 }
@@ -18771,8 +18879,8 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync39(path) ? readFileSync37(path, "utf8") : "# Changelog\n";
-  writeFileSync31(path, insertChangelogSection(existing, section));
+  const existing = existsAt(path, existsSync38) ? readTextAt(path, (p) => readFileSync37(p, "utf8")) : "# Changelog\n";
+  writeTextAt(path, insertChangelogSection(existing, section), writeFileSync31);
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -18877,7 +18985,7 @@ function openReleaseCheckout(o) {
   }
   for (const f of o.repo.worktrees.copy) {
     const src = join43(o.cwd, f);
-    if (!existsSync39(src)) continue;
+    if (!existsSync38(src)) continue;
     mkdirSync28(dirname24(join43(dir, f)), { recursive: true });
     copyFileSync(src, join43(dir, f));
   }
@@ -19017,6 +19125,12 @@ async function runReleaseCycle(o, movedPast2, localRefSkips) {
   if (inPlace) {
     return mergeAndRelease(o, decision, fresh);
   }
+  if (remoteOf(o.cwd)) {
+    const releaseBranch = `crew/release-${Date.now()}`;
+    git(o.cwd, ["checkout", "-q", "--no-track", "-b", releaseBranch, remoteRef]);
+    o.emit.emit("release checkout: the release sandbox clone", { step: "release" });
+    return mergeAndRelease(o, decision, fresh, releaseBranch);
+  }
   const primary = checkGuards(o.cwd, base);
   if (primary) {
     o.emit.emit(scoped(`primary checkout not fast-forwarded: ${primary.detail}; its dist/ is stale until rebuilt`), { step: "release" });
@@ -19708,7 +19822,7 @@ function runForge(a, io) {
 }
 
 // src/mirror-contract.ts
-import { existsSync as existsSync40 } from "fs";
+import { existsSync as existsSync39 } from "fs";
 
 // src/passenger-mirror.ts
 import { mkdirSync as mkdirSync29 } from "fs";
@@ -19749,11 +19863,15 @@ function mirrorOutcome(m) {
 
 // src/mirror-contract.ts
 function lacksCheckout(ship, dir) {
-  return ship.runner === "sandbox" && !existsSync40(dir);
+  return ship.runner === "sandbox" && !existsSync39(dir) && !remoteOf(dir);
 }
 function mirrorRepoOfTarget(t) {
   return mirrorRepoOf({ remote: t.remote, forgeHost: t.forgeHost });
 }
+function cacheRepoOfTarget(ship, t, origin) {
+  if (origin) return parseRemote(origin);
+  return lacksCheckout(ship, t.dir) ? mirrorRepoOfTarget(t) : null;
+}
 async function readMirrorContract(cache, repo, base) {
   for (const name of REPO_CONFIG_FILENAMES) {
     const text2 = await cache.showFile(repo, base, name);
@@ -19762,10 +19880,13 @@ async function readMirrorContract(cache, repo, base) {
   return null;
 }
 function noCheckoutReleaseNote(repo, mode) {
-  if (mode === "local" || mode === null) {
-    return `${repo}: no checkout on this ship; release.mode "local" repositories are released by the host that owns the deploy hook, which takes a ticket at verified`;
+  if (mode === "external") {
+    return `${repo}: no checkout on this ship; release.mode "external" repositories are handed off by a ship with a checkout`;
   }
-  return `${repo}: no checkout on this ship; release.mode "${mode}" needs the sandboxed release over a mirror-fed clone, which is not built (CREW-2940)`;
+  return `${repo}: no checkout on this ship; release.mode "local" repositories are released by the host that owns the deploy hook, which takes a ticket at verified`;
+}
+function releasesFromSandbox(mode) {
+  return mode === "integrate" || mode === "ci_auto" || mode === "ci_manual";
 }
 var reported = /* @__PURE__ */ new Set();
 function firstReport(key) {
@@ -19774,6 +19895,144 @@ function firstReport(key) {
   return true;
 }
 
+// src/release-sandbox.ts
+import { execFile as execFile3 } from "child_process";
+import { mkdirSync as mkdirSync30, writeFileSync as writeFileSync32 } from "fs";
+import { dirname as dirname26 } from "path";
+import { promisify as promisify3 } from "util";
+var execFileP3 = promisify3(execFile3);
+var RELEASE_CLONE_DEPTH = 50;
+var FORGE_TOKEN_VAR = "CREW_FORGE_TOKEN";
+var FORGE_USER_VAR = "CREW_FORGE_USER";
+var CREDENTIAL_HELPER2 = `!f() { echo username=\${${FORGE_USER_VAR}:-x-access-token}; echo password=$${FORGE_TOKEN_VAR}; }; f`;
+function releaseCloneScript(o) {
+  const mirror = `${o.mirrorDir}/${mirrorRelPath(o.repo)}`;
+  const depth = o.depth ?? RELEASE_CLONE_DEPTH;
+  const branch = shQuote2(o.base);
+  return [
+    "set -e",
+    "export GIT_TERMINAL_PROMPT=0",
+    // The mirror is written by a helper container as root and mounted read-only, so git sees it as someone else's.
+    `git config --global --add safe.directory '*'`,
+    `git config --global credential.helper ${shQuote2(CREDENTIAL_HELPER2)}`,
+    `m=${shQuote2(mirror)}`,
+    `depth=${depth}`,
+    `t=$(git -C "$m" describe --tags --abbrev=0 --match ${shQuote2(o.tagPattern)} ${shQuote2(`refs/heads/${o.base}`)} 2>/dev/null || true)`,
+    `if [ -n "$t" ]; then n=$(git -C "$m" rev-list --count "$t..refs/heads/"${branch}); [ $((n + 20)) -gt "$depth" ] && depth=$((n + 20)); fi`,
+    `git clone --quiet --no-tags --depth "$depth" --single-branch --branch ${branch} "file://$m" ${shQuote2(o.workDir)}`,
+    `cd ${shQuote2(o.workDir)}`,
+    `git remote set-url origin ${shQuote2(o.origin)}`,
+    `git config crew.releaseDepth "$depth"`,
+    // A tag already in the window: only its (annotated) tag object is new.
+    `if [ -n "$t" ]; then git fetch --quiet --no-tags "file://$m" "refs/tags/$t:refs/tags/$t" || true; fi`,
+    ...o.branches.flatMap((b) => {
+      const spec = shQuote2(`+refs/heads/${b}:refs/remotes/origin/${b}`);
+      return [
+        `git config --add remote.origin.fetch ${spec}`,
+        `git fetch --quiet --no-tags --depth "$depth" "file://$m" ${spec} 2>/dev/null || true`
+      ];
+    })
+  ].join("\n");
+}
+var endpointsOf = (g) => g.groups.flatMap((x) => x.endpoints.map((e) => `${e.host}:${e.port}`));
+async function openReleaseSandbox(o) {
+  const cfg = { ...DEFAULT_SANDBOX_CONFIG, ...o.sandbox };
+  const run3 = o.exec ?? ((bin, args, env) => execFileP3(bin, args, { env, maxBuffer: 16 * 1024 * 1024 }));
+  const name = sandboxName({ route: o.route, role: "release", ticket: o.repoName }, o.now?.());
+  let policyFile = cfg.policy;
+  let generated;
+  if (!policyFile) {
+    generated = generateSandboxPolicy({ mirrorDir: cfg.mirrorDir, workDir: cfg.workDir, ...o.policy });
+    policyFile = o.policyFile;
+    mkdirSync30(dirname26(policyFile), { recursive: true });
+    writeFileSync32(policyFile, generated.yaml, { mode: 384 });
+  }
+  const secrets = { ...process.env };
+  const secretKeys = [];
+  if (o.token) {
+    secrets[FORGE_TOKEN_VAR] = o.token;
+    secrets[FORGE_USER_VAR] = o.username ?? "x-access-token";
+    secretKeys.push(FORGE_TOKEN_VAR, FORGE_USER_VAR);
+  }
+  const create2 = ["sandbox", "create", "--name", name, "--detach"];
+  if (policyFile) create2.push("--policy", policyFile);
+  const image = cfg.image ?? o.image;
+  if (image) create2.push("--from", image);
+  if (cfg.cacheVolume) {
+    create2.push("--driver-config-json", JSON.stringify({
+      docker: { mounts: [{ type: "volume", source: cfg.cacheVolume, target: cfg.mirrorDir, read_only: true }] }
+    }));
+  }
+  for (const k of secretKeys) create2.push("--env-from", k);
+  create2.push("--", "sleep", String(3 * 3600));
+  const t0 = Date.now();
+  const deleteQuietly = async () => {
+    try {
+      await run3(cfg.bin, ["sandbox", "delete", name], process.env);
+    } catch {
+    }
+  };
+  try {
+    await run3(cfg.bin, create2, secrets);
+  } catch (e) {
+    await deleteQuietly();
+    throw new Error(`openshell could not create the release sandbox: ${describe(e)}`);
+  }
+  o.emit.emit(`sandbox_created: ${name}`, { role: "release", data: { event: "sandbox_created", sandbox: name, role: "release", repo: o.repoName, ms: Date.now() - t0 } });
+  if (generated) {
+    o.emit.emit(`sandbox_policy: ${endpointsOf(generated).length} allowed endpoint(s)`, {
+      role: "release",
+      data: { event: "sandbox_policy", sandbox: name, file: policyFile, allowed: endpointsOf(generated), declared: generated.extraHosts }
+    });
+  }
+  const closeSandbox = async () => {
+    try {
+      const { stdout } = await run3(cfg.bin, ["logs", name], process.env);
+      for (const d of parseDeniedRequests(stdout)) {
+        const where = `${d.host}${d.port !== void 0 ? `:${d.port}` : ""}${d.binary ? ` by ${d.binary}` : ""}`;
+        o.emit.warn(`sandbox_denied: ${where}${d.count > 1 ? ` (${d.count}x)` : ""} \u2014 blocked by the sandbox policy`, { data: { event: "sandbox_denied", sandbox: name, ...d } });
+      }
+    } catch {
+    }
+    const t1 = Date.now();
+    await deleteQuietly();
+    o.emit.emit(`sandbox_deleted: ${name}`, { role: "release", data: { event: "sandbox_deleted", sandbox: name, ms: Date.now() - t1 } });
+  };
+  try {
+    const clone = `${releaseCloneScript({
+      mirrorDir: cfg.mirrorDir,
+      repo: o.repo,
+      workDir: cfg.workDir,
+      origin: o.origin,
+      base: o.base,
+      branches: o.branches,
+      tagPattern: o.tagPattern
+    })}
+${containerEngineStubScript()}`;
+    await run3(cfg.bin, ["sandbox", "exec", "-n", name, "--no-login-shell", "--", "sh", "-c", clone], process.env);
+  } catch (e) {
+    await closeSandbox();
+    throw new Error(`could not make the release clone in ${name}: ${describe(e)}`);
+  }
+  const dir = registerRemoteDir({
+    bin: cfg.bin,
+    sandbox: name,
+    workDir: cfg.workDir,
+    prelude: `${sandboxEnvExports()}PATH=${shQuote2(SANDBOX_STUB_DIR)}:"$PATH"; export PATH; `
+  });
+  let closed = false;
+  return {
+    dir,
+    sandbox: name,
+    async close() {
+      if (closed) return;
+      closed = true;
+      unregisterRemoteDir(dir);
+      await closeSandbox();
+    }
+  };
+}
+
 // src/whoami.ts
 async function buildWhoami(routes, deps = {}) {
   const doFetch = deps.fetch ?? fetch;
@@ -19851,7 +20110,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync41, statSync as statSync11, openSync as openSync5, readSync as readSync2, closeSync as closeSync5 } from "fs";
+import { watch as watchFile, existsSync as existsSync40, statSync as statSync11, openSync as openSync5, readSync as readSync2, closeSync as closeSync5 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -19952,7 +20211,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync41(file)) return { events: [], offset: from };
+  if (!existsSync40(file)) return { events: [], offset: from };
   const size = statSync11(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -20195,8 +20454,8 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, renameSync as renameSync5, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname26 } from "path";
+import { existsSync as existsSync41, mkdirSync as mkdirSync31, readFileSync as readFileSync38, renameSync as renameSync5, writeFileSync as writeFileSync33 } from "fs";
+import { dirname as dirname27 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
 };
@@ -20257,7 +20516,7 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync42(resolvedFile)) return void 0;
+  if (!existsSync41(resolvedFile)) return void 0;
   try {
     const v = JSON.parse(readFileSync38(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
@@ -20266,7 +20525,7 @@ function readSyncedName(resolvedFile) {
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync42(resolvedFile)) return;
+  if (!existsSync41(resolvedFile)) return;
   let raw;
   try {
     raw = JSON.parse(readFileSync38(resolvedFile, "utf8"));
@@ -20275,9 +20534,9 @@ function writeSyncedName(resolvedFile, name) {
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync30(dirname26(resolvedFile), { recursive: true });
+  mkdirSync31(dirname27(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync32(tmp, `${JSON.stringify(raw, null, 2)}
+  writeFileSync33(tmp, `${JSON.stringify(raw, null, 2)}
 `);
   renameSync5(tmp, resolvedFile);
 }
@@ -20309,7 +20568,7 @@ async function reconcileShipName(i) {
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
     const text2 = readFileSync38(i.configFile, "utf8");
-    writeFileSync32(i.configFile, setShipNameInYaml(text2, result.name));
+    writeFileSync33(i.configFile, setShipNameInYaml(text2, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
       i.emit?.warn(
@@ -20968,8 +21227,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync43, mkdirSync as mkdirSync31, readFileSync as readFileSync39, writeFileSync as writeFileSync33 } from "fs";
-import { dirname as dirname27 } from "path";
+import { existsSync as existsSync42, mkdirSync as mkdirSync32, readFileSync as readFileSync39, writeFileSync as writeFileSync34 } from "fs";
+import { dirname as dirname28 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -21002,12 +21261,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync43(resolvedPath) ? JSON.parse(readFileSync39(resolvedPath, "utf8")) : {};
+    const raw = existsSync42(resolvedPath) ? JSON.parse(readFileSync39(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync31(dirname27(resolvedPath), { recursive: true });
-    writeFileSync33(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync32(dirname28(resolvedPath), { recursive: true });
+    writeFileSync34(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -21461,7 +21720,7 @@ function existingRepoConfig(f) {
 }
 
 // src/repos-hooks-agent.ts
-import { spawn as spawn8, execFileSync as execFileSync11 } from "child_process";
+import { spawn as spawn8, execFileSync as execFileSync12 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
 import { isAbsolute as isAbsolute3, relative } from "path";
 var AgentSuggestError = class extends Error {
@@ -21564,7 +21823,7 @@ function classifyFailure(o) {
 }
 function porcelain(dir) {
   try {
-    return execFileSync11("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
+    return execFileSync12("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
   } catch {
     return void 0;
   }
@@ -21633,7 +21892,7 @@ ${run3.err}` });
 }
 
 // src/sample-ticket.ts
-import { basename as basename12, dirname as dirname28, join as join44 } from "path";
+import { basename as basename12, dirname as dirname29, join as join44 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -21656,7 +21915,7 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join44(dirname28(existing[0]), SAMPLE_REPO);
+  if (existing.length > 0) return join44(dirname29(existing[0]), SAMPLE_REPO);
   return join44(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
@@ -21701,8 +21960,8 @@ function planSampleTicket(i) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync44, readFileSync as readFileSync41, readdirSync as readdirSync14 } from "fs";
-import { basename as basename13, dirname as dirname29, join as join45, resolve as resolve5 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync41, readdirSync as readdirSync14 } from "fs";
+import { basename as basename13, dirname as dirname30, join as join45, resolve as resolve5 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -21766,7 +22025,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname29(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname30(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename13(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve5(w.path)));
   let names;
@@ -21814,7 +22073,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync44(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync43(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -21822,7 +22081,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync44(a.path)) {
+    if (!dryRun && existsSync43(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -21833,7 +22092,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync44(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync43(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse2(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -21987,12 +22246,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync45, readdirSync as readdirSync15, rmSync as rmSync20, statSync as statSync12 } from "fs";
+import { existsSync as existsSync44, readdirSync as readdirSync15, rmSync as rmSync20, statSync as statSync12 } from "fs";
 import { join as join46 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join46(stateDir, "streams");
-  if (!existsSync45(dir)) return [];
+  if (!existsSync44(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync15(dir).map((name) => join46(dir, name)).filter((path) => {
     try {
@@ -22020,7 +22279,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync45(stateDir)) return [];
+  if (!existsSync44(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync15(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join46(stateDir, name)).filter((path) => {
     try {
@@ -22032,11 +22291,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync47, existsSync as existsSync52, mkdirSync as mkdirSync38, writeFileSync as writeFileSync38, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync47, existsSync as existsSync51, mkdirSync as mkdirSync39, writeFileSync as writeFileSync39, rmSync as rmSync25, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync16, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync42, rmSync as rmSync21, writeFileSync as writeFileSync34 } from "fs";
+import { existsSync as existsSync45, mkdirSync as mkdirSync33, readFileSync as readFileSync42, rmSync as rmSync21, writeFileSync as writeFileSync35 } from "fs";
 import { join as join47 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -22054,15 +22313,15 @@ function removePeriscopePrior(stateDir, ticketRecordId) {
 }
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
-    mkdirSync32(priorDir(stateDir), { recursive: true });
-    writeFileSync34(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
+    mkdirSync33(priorDir(stateDir), { recursive: true });
+    writeFileSync35(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
 }
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync46(p) ? JSON.parse(readFileSync42(p, "utf8")) : void 0;
+    return existsSync45(p) ? JSON.parse(readFileSync42(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -22514,7 +22773,7 @@ ${tail2(preview.output)}`);
 }
 
 // src/periscope-idle.ts
-import { execFileSync as execFileSync12 } from "child_process";
+import { execFileSync as execFileSync13 } from "child_process";
 import { statSync as statSync13 } from "fs";
 import { join as join48 } from "path";
 var MAX_SCANNED_FILES = 2e4;
@@ -22526,7 +22785,7 @@ function newestWorktreeMtime(root) {
 function newestTrackedMtime(root) {
   let listing;
   try {
-    listing = execFileSync12("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    listing = execFileSync13("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       cwd: root,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -22617,9 +22876,9 @@ async function runPeriscopeIdlePass(d) {
 import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync13 } from "child_process";
-import { existsSync as existsSync47, mkdirSync as mkdirSync33, readFileSync as readFileSync43, chmodSync as chmodSync3 } from "fs";
-import { dirname as dirname30, join as join49 } from "path";
+import { execFileSync as execFileSync14 } from "child_process";
+import { existsSync as existsSync46, mkdirSync as mkdirSync34, readFileSync as readFileSync43, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname31, join as join49 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
@@ -22628,10 +22887,10 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync47(privateKeyPath)) {
-    mkdirSync33(dirname30(privateKeyPath), { recursive: true });
+  if (!existsSync46(privateKeyPath)) {
+    mkdirSync34(dirname31(privateKeyPath), { recursive: true });
     try {
-      execFileSync13("ssh-keygen", [
+      execFileSync14("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -22649,7 +22908,7 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync47(publicKeyPath)) {
+  if (!existsSync46(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
   const publicKey = readFileSync43(publicKeyPath, "utf8").trim();
@@ -22657,7 +22916,7 @@ function ensureShipSshKeypair(stateDir) {
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync13("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync14("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -22816,7 +23075,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn9 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync48, mkdirSync as mkdirSync34, readFileSync as readFileSync44, writeFileSync as writeFileSync35, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync47, mkdirSync as mkdirSync35, readFileSync as readFileSync44, writeFileSync as writeFileSync36, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
 import { join as join50 } from "path";
 
 // src/secret-compare.ts
@@ -22914,7 +23173,7 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync48(path)) return void 0;
+  if (!existsSync47(path)) return void 0;
   try {
     return JSON.parse(readFileSync44(path, "utf8"));
   } catch {
@@ -22923,8 +23182,8 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync34(join50(stateDir, "passengers"), { recursive: true });
-  writeFileSync35(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync35(join50(stateDir, "passengers"), { recursive: true });
+  writeFileSync36(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -22945,7 +23204,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join50(stateDir, "passengers");
-  if (!existsSync48(dir)) return [];
+  if (!existsSync47(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync16(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -23003,12 +23262,12 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 
 // src/periscope-proxy.ts
 import { spawn as spawn10 } from "child_process";
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync35 } from "fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync36 } from "fs";
 import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { connect as netConnect } from "net";
 import { connect as tlsConnect } from "tls";
-import { dirname as dirname31, isAbsolute as isAbsolute4 } from "path";
+import { dirname as dirname32, isAbsolute as isAbsolute4 } from "path";
 import { brotliDecompressSync, gunzipSync, inflateSync } from "zlib";
 
 // src/periscope-inspector.ts
@@ -23122,7 +23381,7 @@ function parsePointedBody(raw) {
   return entry;
 }
 function appendPointed(file, entry, now = /* @__PURE__ */ new Date()) {
-  mkdirSync35(dirname31(file), { recursive: true });
+  mkdirSync36(dirname32(file), { recursive: true });
   appendFileSync3(file, `${JSON.stringify({ ...entry, at: now.toISOString() })}
 `);
 }
@@ -23465,7 +23724,7 @@ function contractFixers(dir, baseRef, tickets, locate) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync49, mkdirSync as mkdirSync36, readFileSync as readFileSync45, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync36 } from "fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync37, readFileSync as readFileSync45, readdirSync as readdirSync17, rmSync as rmSync22, statSync as statSync14, writeFileSync as writeFileSync37 } from "fs";
 import { join as join52 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -23563,7 +23822,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync49(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync48(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join52(stateDir, "reload-requested");
@@ -23579,9 +23838,9 @@ function daemonStampFor(stateDir) {
   return join52(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync36(stateDir, { recursive: true });
+  mkdirSync37(stateDir, { recursive: true });
   rmSync22(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync36(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync37(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
@@ -24204,7 +24463,7 @@ import { createHash as createHash11 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync6,
-  existsSync as existsSync50,
+  existsSync as existsSync49,
   fstatSync,
   openSync as openSync6,
   readSync as readSync3,
@@ -24215,8 +24474,8 @@ import {
 } from "fs";
 import { createConnection } from "net";
 import { createServer as createServer2 } from "http";
-import { basename as basename14, dirname as dirname32, join as join53 } from "path";
-import { execFile as execFile3, spawn as spawn12 } from "child_process";
+import { basename as basename14, dirname as dirname33, join as join53 } from "path";
+import { execFile as execFile4, spawn as spawn12 } from "child_process";
 
 // src/periscope-control.ts
 import { spawn as spawn11 } from "child_process";
@@ -24531,7 +24790,7 @@ function candidates(live, rotated) {
   const out = [live];
   if (!rotated) return out;
   try {
-    for (const n of readdirSync18(dirname32(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join53(dirname32(live), n));
+    for (const n of readdirSync18(dirname33(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join53(dirname33(live), n));
   } catch {
   }
   return out;
@@ -24575,7 +24834,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync50(live)) {
+  if (!existsSync49(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -24691,7 +24950,7 @@ async function tailReply(path, q2, rotated, abort) {
   const deadline = Date.now() + Math.min(wait, MAX_WAIT_SECONDS) * 1e3;
   let r = readTail(path, { after, tail: tail3, rotated });
   while (after && !r.lines.length && !r.reset && Date.now() < deadline && !abort.aborted) {
-    await waitForChange(dirname32(path), deadline - Date.now(), abort);
+    await waitForChange(dirname33(path), deadline - Date.now(), abort);
     r = readTail(path, { after: r.cursor, rotated });
   }
   return reply2(200, r);
@@ -24732,7 +24991,7 @@ async function route(deps, method, url, req, abort) {
     const run3 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run3) || run3.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run3)) return err2(400, "not a run name");
     const file = join53(deps.stateDir, "streams", run3.endsWith(".jsonl") ? run3 : `${run3}.jsonl`);
-    if (!existsSync50(file)) return err2(404, "no such run");
+    if (!existsSync49(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -24776,7 +25035,7 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync50(path)) return false;
+  if (!existsSync49(path)) return false;
   return new Promise((resolve8) => {
     const c = createConnection(path);
     c.once("connect", () => {
@@ -24795,7 +25054,7 @@ async function startControlServer(deps) {
     return null;
   }
   if (await socketIsStale(path)) rmSync23(path, { force: true });
-  else if (existsSync50(path)) {
+  else if (existsSync49(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -24868,7 +25127,7 @@ function schedulerHandler(control, run3 = runDetached) {
 }
 function crewJson(args, timeoutMs = 6e4) {
   return new Promise((resolve8) => {
-    execFile3(process.execPath, [process.argv[1] ?? "", ...args], { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 }, (_e, stdout) => {
+    execFile4(process.execPath, [process.argv[1] ?? "", ...args], { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 }, (_e, stdout) => {
       try {
         const v = JSON.parse(String(stdout));
         resolve8(v && typeof v === "object" && !Array.isArray(v) ? v : null);
@@ -24881,24 +25140,24 @@ function crewJson(args, timeoutMs = 6e4) {
 
 // src/periscope-mcp.ts
 import { lstat, mkdir, readdir, readFile, readlink, realpath, rm, stat, writeFile } from "fs/promises";
-import { basename as basename15, dirname as dirname33, isAbsolute as isAbsolute5, join as join55, relative as relative2, resolve as resolve6, sep } from "path";
+import { basename as basename15, dirname as dirname34, isAbsolute as isAbsolute5, join as join55, relative as relative2, resolve as resolve6, sep } from "path";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync51, mkdirSync as mkdirSync37, readdirSync as readdirSync19, readFileSync as readFileSync46, rmSync as rmSync24, writeFileSync as writeFileSync37 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync50, mkdirSync as mkdirSync38, readdirSync as readdirSync19, readFileSync as readFileSync46, rmSync as rmSync24, writeFileSync as writeFileSync38 } from "fs";
 import { join as join54 } from "path";
 var secretDir = (stateDir) => join54(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join54(secretDir(stateDir), `${id}.json`);
 var endpointDir = (stateDir) => join54(stateDir, "periscope-endpoints");
 var endpointFile = (stateDir, id) => join54(endpointDir(stateDir), `${id}.json`);
 function mintPeriscopeSecret(stateDir, ticketRecordId) {
-  mkdirSync37(secretDir(stateDir), { recursive: true, mode: 448 });
+  mkdirSync38(secretDir(stateDir), { recursive: true, mode: 448 });
   const secret = randomBytes3(32).toString("base64url");
   const file = secretFile(stateDir, ticketRecordId);
-  writeFileSync37(file, `${JSON.stringify({ secret })}
+  writeFileSync38(file, `${JSON.stringify({ secret })}
 `, { mode: 384 });
   chmodSync5(file, 384);
   return secret;
@@ -24922,8 +25181,8 @@ function readPeriscopeEndpoint(stateDir, ticketRecordId) {
   }
 }
 function writePeriscopeEndpoint(stateDir, rec) {
-  mkdirSync37(endpointDir(stateDir), { recursive: true });
-  writeFileSync37(endpointFile(stateDir, rec.ticketRecordId), `${JSON.stringify(rec, null, 2)}
+  mkdirSync38(endpointDir(stateDir), { recursive: true });
+  writeFileSync38(endpointFile(stateDir, rec.ticketRecordId), `${JSON.stringify(rec, null, 2)}
 `);
 }
 function removePeriscopeEndpointRecord(stateDir, ticketRecordId) {
@@ -24931,7 +25190,7 @@ function removePeriscopeEndpointRecord(stateDir, ticketRecordId) {
 }
 function listPeriscopeEndpoints(stateDir) {
   const dir = endpointDir(stateDir);
-  if (!existsSync51(dir)) return [];
+  if (!existsSync50(dir)) return [];
   const out = [];
   for (const name of readdirSync19(dir)) {
     if (!name.endsWith(".json")) continue;
@@ -25019,10 +25278,10 @@ async function realAncestor(p) {
     }
     if (isLink) {
       if (++hops > 40) throw new PathRefusal(`too many symbolic links resolving ${p}`);
-      cur = resolve6(dirname33(cur), await readlink(cur));
+      cur = resolve6(dirname34(cur), await readlink(cur));
       continue;
     }
-    const parent = dirname33(cur);
+    const parent = dirname34(cur);
     if (parent === cur) throw new PathRefusal(`cannot resolve ${p}`);
     tail3.push(basename15(cur));
     cur = parent;
@@ -25133,7 +25392,7 @@ function createPeriscopeMcpServer(d, sc) {
     if (Buffer.byteLength(content) > MAX_WRITE_BYTES) return text(`content exceeds ${MAX_WRITE_BYTES} bytes`, true);
     const abs = await inTree(path);
     if (abs === await realpath(root)) return text("path must name a file", true);
-    await mkdir(dirname33(abs), { recursive: true });
+    await mkdir(dirname34(abs), { recursive: true });
     await inTree(path);
     await writeFile(abs, content);
     return text(`Wrote ${Buffer.byteLength(content)} bytes to ${await rel(abs)}`);
@@ -25173,7 +25432,7 @@ function createPeriscopeMcpServer(d, sc) {
     inputSchema: { path: z.string() },
     annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
   }, async ({ path }) => {
-    const parent = await inTree(dirname33(path) === "" ? "." : dirname33(path));
+    const parent = await inTree(dirname34(path) === "" ? "." : dirname34(path));
     const abs = join55(parent, basename15(path));
     if (basename15(path) === ".git" || abs === parent) return text("path must name a file", true);
     const st = await lstat(abs).catch(() => void 0);
@@ -25295,7 +25554,7 @@ function findPeriscope(sidecars, segment) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname34(process.execPath) : resolve7(dirname34(fileURLToPath2(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname35(process.execPath) : resolve7(dirname35(fileURLToPath2(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -25814,7 +26073,7 @@ if (command === "passenger-sync-daemon") {
     let images;
     for (const t of reposOf(c)) {
       const origin = originUrlOf(t.dir, "origin");
-      const repo = origin ? parseRemote(origin) : null;
+      const repo = cacheRepoOfTarget(ship, t, origin);
       if (!repo) continue;
       let token = null;
       try {
@@ -25914,7 +26173,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "deprovision" || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset") || command === "deprovision";
-      if (configless && !existsSync52(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync51(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -25942,7 +26201,7 @@ if (command === "passenger-sync-daemon") {
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
         readFile: (p) => readFileSync47(p, "utf8"),
-        writeFile: (p, t) => writeFileSync38(p, t),
+        writeFile: (p, t) => writeFileSync39(p, t),
         stdin: () => readFileSync47(0, "utf8"),
         env: process.env
       }
@@ -26267,13 +26526,13 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join56(homedir11(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync52(staleTimer)) {
+      if (existsSync51(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
         );
         if (!dryRun) {
-          spawnSync12("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
+          spawnSync12("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME, env: withUserBusEnv() });
           try {
             unlinkSync5(staleTimer);
           } catch {
@@ -26296,7 +26555,7 @@ if (command === "passenger-sync-daemon") {
     const { settled: doctorRepos, errors: refusedRepos } = await settleRepos(reposOf(c), (t) => t.name, (t) => resolveOneRepo(c, t));
     for (const e of refusedRepos) problems.push(`repo ${e.repo}: ${e.detail}`);
     for (const r of doctorRepos) {
-      if (!existsSync52(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync51(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -26323,7 +26582,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync52(p);
+    const unitExists = (p) => existsSync51(p);
     const crontab = o.host === "linux" ? spawnSync12("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -26340,7 +26599,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync38(cfg.configFile, planEnable(readFileSync47(cfg.configFile, "utf8"), a.route));
+          writeFileSync39(cfg.configFile, planEnable(readFileSync47(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -26384,6 +26643,13 @@ ${changed2.map((c) => `  - ${c}
     return [...out.values()];
   }
   const withShipSandbox = (declared) => cfg.ship.runner === "sandbox" ? [shipSandboxRef(), ...declared] : declared;
+  async function loadContractOf(c, t) {
+    if (!lacksCheckout(cfg.ship, t.dir)) return loadRepoConfig(t.dir);
+    const settings = cacheSettingsOf(cfg.ship.sandbox);
+    const mirror = mirrorRepoOfTarget(t);
+    if (!settings || !mirror) return null;
+    return readMirrorContract(new SandboxCache(settings), mirror, c.branch?.base ?? "main");
+  }
   async function resolveOneRepo(c, t) {
     {
       const id = repoIdForName(c, t.name);
@@ -26392,7 +26658,7 @@ ${changed2.map((c) => `  - ${c}
         name: t.name,
         dir: t.dir,
         id,
-        config: resolveRepoConfig(loadRepoConfig(t.dir), {
+        config: resolveRepoConfig(await loadContractOf(c, t), {
           hooks: { ...c.hooks, ...o?.hooks },
           labels: { ...c.labels, ...o?.labels },
           release: mergeRouteRelease(c.release, o?.release),
@@ -26448,6 +26714,7 @@ ${changed2.map((c) => `  - ${c}
     return `${who2}; ${lock2}`;
   }
   async function sweepClosedTickets(c, target, branch, tracker, dryRun2, remit, idle = false) {
+    if (remoteOf(target.dir)) return;
     try {
       if (!dryRun2) reconcileHeldWorktrees(state, target.name, remit);
       if (idle && !sweepCandidatesExist(target.dir, branch.base)) return;
@@ -26477,20 +26744,86 @@ ${changed2.map((c) => `  - ${c}
   }
   const precheckTickets = /* @__PURE__ */ new Map();
   const scope0 = (c, t) => releaseLockScope(c.route, t.name);
+  async function releaseFromSandbox(c, target, contract, mirror, opts) {
+    const scope = releaseLockScope(c.route, target.name);
+    const remit = emit.forRoute(c.route);
+    const identity = await resolveReleaseKey(c);
+    const tracker = new Tracker(c, cfg.ship, { apiKey: identity.apiKey });
+    const { byRepo } = ticketsByRepo(c, await tracker.openTickets());
+    const modes = { modes: await tracker.projectWorkModes(), agentAssignees: /* @__PURE__ */ new Set() };
+    const verified = withoutManualVerified(byRepo.get(target.name) ?? [], tracker.contract.statuses.verified, modes).filter((t) => t.status === tracker.contract.statuses.verified);
+    const force2 = command === "deploy" || flag("force");
+    if (!dryRun && verified.length === 0 && !force2) {
+      return { scope, tests: "skipped", outcome: "skipped", detail: "nothing verified \u2014 no release sandbox created" };
+    }
+    const o = c.repoOverrides[target.name];
+    const effective = resolveRepoConfig(contract, {
+      hooks: { ...c.hooks, ...o?.hooks },
+      labels: { ...c.labels, ...o?.labels },
+      release: mergeRouteRelease(c.release, o?.release),
+      branch: { ...c.branch, ...o?.branch },
+      worktrees: { prefix: shipWorktreePrefixFor(c), nameOverride: o?.worktreeName }
+    }, target.dir);
+    const forgeHost = mirror.host;
+    let token = null;
+    try {
+      token = readForgeToken(cfg.ship.forges, forgeHost, cfg.ship.stateDir);
+    } catch {
+    }
+    const sandbox = await openReleaseSandbox({
+      sandbox: cfg.ship.sandbox ?? {},
+      route: c.route,
+      repoName: target.name,
+      image: sandboxImageForRun(readSandboxState(cfg.ship.stateDir), target.name, Boolean(contract.sandbox)) ?? void 0,
+      policy: {
+        forgeHosts: [...new Set(reposOf(c).map((r) => r.forgeHost ?? "github.com"))],
+        tablationUrl: c.baseUrl,
+        authMode: "workspace",
+        provider: "anthropic",
+        harnessBin: "claude",
+        ...contract.sandboxNetwork ? { extraHosts: contract.sandboxNetwork.hosts, toolchains: contract.sandboxNetwork.toolchains } : {}
+      },
+      policyFile: join56(cfg.ship.stateDir, "release", `${target.name}.policy.yaml`),
+      repo: mirror,
+      origin: forgeDescriptorFor(forgeHost).httpsUrl(mirror.host, mirror.path),
+      base: effective.branch.base,
+      branches: verified.map((t) => pushedBranchForTicket(effective, t)),
+      tagPattern: effective.release.tagPattern ?? "v*",
+      token,
+      username: forgeFor(cfg.ship.forges, forgeHost)?.entry.username || forgeDescriptorFor(forgeHost).credentialUsername,
+      emit: remit
+    }).catch((e) => {
+      remit.warn(`${scope}: could not start the release sandbox: ${e.message}`, { step: "release" });
+      return null;
+    });
+    if (!sandbox) return { scope, tests: "skipped", outcome: "skipped", detail: "could not start the release sandbox" };
+    remit.emit(`${scope}: releasing from sandbox ${sandbox.sandbox}`, { step: "release", data: { event: "release_sandbox", sandbox: sandbox.sandbox } });
+    try {
+      const summary = await releasePhase(c, { ...target, dir: sandbox.dir }, opts);
+      return { ...summary, detail: `${summary.detail ? `${summary.detail}; ` : ""}ran in sandbox ${sandbox.sandbox}` };
+    } finally {
+      await sandbox.close();
+    }
+  }
   async function releasePhase(c, target, opts = {}) {
     const scope = releaseLockScope(c.route, target.name);
     const remit = emit.forRoute(c.route);
     if (lacksCheckout(cfg.ship, target.dir)) {
       let mode = null;
+      let contract = null;
       const settings = cacheSettingsOf(cfg.ship.sandbox);
       const mirror = mirrorRepoOfTarget(target);
       if (settings && mirror) {
         try {
-          mode = (await readMirrorContract(new SandboxCache(settings), mirror, c.branch?.base ?? "main"))?.release.mode ?? null;
+          contract = await readMirrorContract(new SandboxCache(settings), mirror, c.branch?.base ?? "main");
+          mode = contract?.release.mode ?? null;
         } catch (e) {
           if (firstReport(`${scope0(c, target)}:contract`)) remit.warn(`${target.name}: could not read the contract from the mirror: ${e.message}`, { step: "release" });
         }
       }
+      if (releasesFromSandbox(mode) && settings && mirror && contract) {
+        return releaseFromSandbox(c, target, contract, mirror, opts);
+      }
       const note = noCheckoutReleaseNote(target.name, mode);
       if (firstReport(`${scope0(c, target)}:release`)) remit.emit(note, { step: "release" });
       return { scope: releaseLockScope(c.route, target.name), tests: "skipped", outcome: "skipped", detail: note };
@@ -27495,7 +27828,7 @@ ${cu.tail.trimEnd()}
           }
           let failed = false;
           for (const cmd2 of commands) {
-            const res2 = spawnSync12(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+            const res2 = spawnSync12(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8", env: withUserBusEnv() });
             if (res2.stdout) process.stdout.write(res2.stdout);
             if (res2.stderr) process.stderr.write(res2.stderr);
             if (cmd2 === control.startCommand && (res2.error || res2.status !== 0)) {
@@ -27513,7 +27846,7 @@ ${cu.tail.trimEnd()}
 `);
           break;
         }
-        const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+        const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8", env: withUserBusEnv() });
         if (res.stdout) process.stdout.write(res.stdout);
         if (res.stderr) process.stderr.write(res.stderr);
         if (daemonSub !== "status" && (res.error || res.status !== 0)) {
@@ -27841,10 +28174,10 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync52(resolvedPath) ? JSON.parse(readFileSync47(resolvedPath, "utf8")) : {};
+        const raw = existsSync51(resolvedPath) ? JSON.parse(readFileSync47(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync38(dirOf2(resolvedPath), { recursive: true });
-        writeFileSync38(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync39(dirOf2(resolvedPath), { recursive: true });
+        writeFileSync39(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -27867,7 +28200,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), newName));
+      writeFileSync39(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -27921,7 +28254,7 @@ ${cu.tail.trimEnd()}
           const found = cfg.routes.find((r) => r.route === routeArg);
           if (!found) throw new ReposError(`no route "${routeArg}" in the config (have: ${cfg.routes.map((r) => r.route).join(", ") || "none"})`);
           const named2 = value("route") ? void 0 : positional[3];
-          const dir = named2 ? repoDirOf(configText, dirname34(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
+          const dir = named2 ? repoDirOf(configText, dirname35(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
           const target = reposOf(found).find((t) => resolvePath(t.dir) === dir || t.name === named2);
           const o = target ? found.repoOverrides[target.name] : void 0;
           runReposCheck(dir, {
@@ -27945,9 +28278,9 @@ ${cu.tail.trimEnd()}
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname34(cfg.configFile), a.route, a.name);
-          if (!existsSync52(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync52(resolvePath(dir, r)), list: (r) => {
+          const dir = repoDirOf(configText, dirname35(cfg.configFile), a.route, a.name);
+          if (!existsSync51(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync51(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync20(resolvePath(dir, r));
             } catch {
@@ -27997,19 +28330,19 @@ ${cu.tail.trimEnd()}
           let cleared;
           if (clear2) {
             const plan = clearRouteHooks(configText, a.route, a.name);
-            if (plan.removed.length > 0) writeFileSync38(cfg.configFile, plan.text);
+            if (plan.removed.length > 0) writeFileSync39(cfg.configFile, plan.text);
             cleared = { file: cfg.configFile, removed: plan.removed };
           }
           if (write && suggestion.source === null && recipeIds.length === 0 && hookSpecs.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, picked.hooks, { replace: flag("replace") });
-            writeFileSync38(cfg.configFile, plan.text);
+            writeFileSync39(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept, replaced: plan.replaced };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync38(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            writeFileSync39(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [], replaced: [] };
           }
           if (flag("json")) {
@@ -28065,7 +28398,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync52(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync51(resolvePath(p.replace(/^~(?=\/|$)/, homedir11()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -28095,7 +28428,7 @@ ${cu.tail.trimEnd()}
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       if (sub === "list" || sub === "add") {
         const liveRoute = cfg.routes.find((r) => r.route === routeName);
-        if (liveRoute?.resolved?.reposModelId && existsSync52(resolvedFile) && !dryRun) {
+        if (liveRoute?.resolved?.reposModelId && existsSync51(resolvedFile) && !dryRun) {
           try {
             await hydrateApiKeys([liveRoute]);
             persistRepoRows(cfg.ship.stateDir, liveRoute.route, await new Tracker(liveRoute, cfg.ship).repoRowsForMap());
@@ -28104,7 +28437,7 @@ ${cu.tail.trimEnd()}
         }
       }
       let resolvedRemotes;
-      if (existsSync52(resolvedFile)) {
+      if (existsSync51(resolvedFile)) {
         try {
           resolvedRemotes = JSON.parse(readFileSync47(resolvedFile, "utf8"));
         } catch {
@@ -28112,8 +28445,8 @@ ${cu.tail.trimEnd()}
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text2 = configText;
-      const base = dirname34(cfg.configFile);
-      const isCheckout = (d) => existsSync52(`${d}/.git`);
+      const base = dirname35(cfg.configFile);
+      const isCheckout = (d) => existsSync51(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -28123,7 +28456,7 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync52(d),
+              exists: (d) => existsSync51(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
@@ -28145,7 +28478,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync52(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync51(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -28157,9 +28490,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text: text2, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync52(plan2.target) && (existsSync52(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
+          if (existsSync51(plan2.target) && (existsSync51(`${plan2.target}/.git`) || readdirSync20(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync52(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync51(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -28177,14 +28510,14 @@ ${cu.tail.trimEnd()}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync38(cfg.configFile, plan2.text);
+          writeFileSync39(cfg.configFile, plan2.text);
           if (plan2.droppedDir) process.stderr.write(`crew repos: dropped dir: ${plan2.droppedDir} from route ${routeName} \u2014 it is not a checkout (the clone base); checkouts now live under repos:
 `);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir11()));
-        const top = existsSync52(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync51(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -28236,15 +28569,15 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync52(resolvedFile)) {
+          if (existsSync51(resolvedFile)) {
             const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync39(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync38(cfg.configFile, plan.text);
+        writeFileSync39(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -28616,7 +28949,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync38(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync39(cfg.configFile, setShipNameInYaml(readFileSync47(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -28659,7 +28992,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync52(resolvedPath);
+        const hadPreviousFile = existsSync51(resolvedPath);
         if (hadPreviousFile) {
           try {
             previous = JSON.parse(readFileSync47(resolvedPath, "utf8"));
@@ -28792,10 +29125,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync38(dirname34(resolvedPath), { recursive: true });
+          mkdirSync39(dirname35(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync38(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync39(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync6(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -28841,8 +29174,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync38(dirname34(apiKeyFile), { recursive: true });
-            writeFileSync38(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync39(dirname35(apiKeyFile), { recursive: true });
+            writeFileSync39(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -29546,8 +29879,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           prepare: async (path) => {
             for (const f of repoWt.config.worktrees.copy) {
               const src = join56(repoWt.dir, f);
-              if (!existsSync52(src) || existsSync52(join56(path, f))) continue;
-              mkdirSync38(dirOf2(join56(path, f)), { recursive: true });
+              if (!existsSync51(src) || existsSync51(join56(path, f))) continue;
+              mkdirSync39(dirOf2(join56(path, f)), { recursive: true });
               copyFileSync2(src, join56(path, f));
             }
             const setup = repoWt.config.hooks.setup;
@@ -29769,7 +30102,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync52(p),
+            worktreeExists: (p) => existsSync51(p),
             prepareDropFile,
             startProxy: (wt, url, n) => launchProxy(crewInvocation(CREW_HOME), wt, url, Number(n), { host: hit.row.host || "localhost", inject: hit.repo.config.periscope?.inspector !== "repo" }),
             caps: periscopeCaps(cfg.ship),
@@ -29866,8 +30199,8 @@ ${where.join("\n")}`);
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
               const src = join56(repoP.dir, f);
-              if (!existsSync52(src)) continue;
-              mkdirSync38(dirOf2(join56(path, f)), { recursive: true });
+              if (!existsSync51(src)) continue;
+              mkdirSync39(dirOf2(join56(path, f)), { recursive: true });
               copyFileSync2(src, join56(path, f));
             }
             const setup = repoP.config.hooks.setup;
@@ -30226,7 +30559,7 @@ ${where.join("\n")}`);
       }
       const host = hostPlatform();
       const control = host === "windows" ? null : planDaemonControl(CREW_HOME, host, detectSystemd());
-      const unitStatus = control?.statusCommand ? spawnSync12(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
+      const unitStatus = control?.statusCommand ? spawnSync12(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8", env: withUserBusEnv() }) : null;
       const unitRunning = unitStatus !== null && !unitStatus.error && unitStatus.status === 0;
       if (!unitRunning && control?.mechanism === "systemd" && control.startCommand) {
         const res = spawnSync12(control.startCommand[0], control.startCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
@@ -30243,15 +30576,15 @@ ${where.join("\n")}`);
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync38(cfg.ship.stateDir, { recursive: true });
-      writeFileSync38(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync39(cfg.ship.stateDir, { recursive: true });
+      writeFileSync39(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write(
         "crew reload: requested \u2014 the daemon relaunches with the new config once its running agents end (it starts no new work meanwhile); if it is busy, `crew reload --now` forces the relaunch and interrupts them\n"
       );
       if (flag("now") && control?.stopCommand && control.startCommand) {
         for (const cmd of [control.stopCommand, control.startCommand]) {
-          const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+          const res = spawnSync12(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8", env: withUserBusEnv() });
           if (cmd === control.startCommand && (res.error || res.status !== 0)) {
             process.stderr.write(`crew reload: ${cmd.join(" ")} exited ${res.status ?? "error"}
 `);
@@ -30333,7 +30666,7 @@ ${where.join("\n")}`);
       if (!route2.resolved) fail2(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
       const configText = readFileSync47(cfg.configFile, "utf8");
-      const cfgBase = dirname34(cfg.configFile);
+      const cfgBase = dirname35(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route2.route);
@@ -30361,7 +30694,7 @@ ${where.join("\n")}`);
         }
         if (configured2.some((r) => r.dir === dir)) {
           try {
-            writeFileSync38(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
+            writeFileSync39(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail2(e.message);
             throw e;
@@ -30369,29 +30702,29 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync52(resolvedFile)) {
+          if (existsSync51(resolvedFile)) {
             const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync39(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync52(join56(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync25(dir, { recursive: true, force: true });
+        if (existsSync51(join56(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync25(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync52(join56(dir, ".git"));
-      if (existsSync52(dir) && fresh && readdirSync20(dir).length > 0) fail2(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync51(join56(dir, ".git"));
+      if (existsSync51(dir) && fresh && readdirSync20(dir).length > 0) fail2(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync38(dir, { recursive: true });
-        writeFileSync38(join56(dir, "README.md"), SAMPLE_README);
-        writeFileSync38(join56(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync39(dir, { recursive: true });
+        writeFileSync39(join56(dir, "README.md"), SAMPLE_README);
+        writeFileSync39(join56(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync12("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail2(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -30409,17 +30742,17 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync52(resolvedFile)) {
+        if (existsSync51(resolvedFile)) {
           const raw = JSON.parse(readFileSync47(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync38(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync39(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured2.some((r) => r.dir === dir)) {
         try {
-          writeFileSync38(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync39(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail2(e.message);
           throw e;
@@ -30765,7 +31098,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync52(r.dir)) {
+            if (existsSync51(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -30829,6 +31162,8 @@ watermark:  ${state.watermark()}
           }
         }
         for (const message of roleCapWarnings(cfg.ship)) problems.push({ severity: "note", kind: "role_cap_above_ship_cap", message });
+        const runtimeDir = runtimeDirWarning(process.platform, process.getuid?.() ?? null, existsSync51, userInfo2().username);
+        if (runtimeDir) problems.push({ severity: "attention", kind: "runtime_dir_missing", message: runtimeDir });
         if (!flag("offline")) {
           const shipKind = await doctorShipKind(route2, cfg.ship);
           for (const message of managedRuntimeWarnings(shipKind, cfg.ship)) problems.push({ severity: "attention", kind: "managed_runtime_default", message });
@@ -30888,7 +31223,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync52(evFile) ? statSync16(evFile).size : 0;
+        const evSize = existsSync51(evFile) ? statSync16(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -30913,7 +31248,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       if (host === "linux" && detectSystemd()) {
         const ctl = planDaemonControl(CREW_HOME, host, true);
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, true, "run", installContext());
-        if (ctl.statusCommand && unitPlan.unitPaths.some((p) => existsSync52(p))) {
+        if (ctl.statusCommand && unitPlan.unitPaths.some((p) => existsSync51(p))) {
           const st = spawnSync12(ctl.statusCommand[0], ctl.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
           if (!st.error && st.status !== 0) {
             process.stdout.write("daemon unit:      WARN installed but not running \u2014 no work is picked up; run `crew reload` (or `crew daemon start`), and `crew install` if the unit still says Restart=on-failure\n");