@tablation/crew 0.130.0 → 0.130.1

package/dist/cli.js

@@ -7314,6 +7314,27 @@ async function revokeSeatKeys(route2, o) {
   }
   const host = hostFromUrl2(route2.baseUrl);
   const base = route2.baseUrl.replace(/\/+$/, "");
+  const headers = { Authorization: `Bearer ${resolveApiKey(route2)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" };
+  const sweepNamedKeys = async (role, agentId) => {
+    const prefix = `crew ${o.shipName} `;
+    try {
+      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, { headers });
+      if (!res.ok) return;
+      const keys = await res.json();
+      for (const k of Array.isArray(keys) ? keys : []) {
+        if (!k.id || k.revokedAt || !k.name?.startsWith(prefix)) continue;
+        if (o.dryRun) {
+          out.push({ role, action: "revoked", detail: `dry run; key "${k.name}" found on the server` });
+          continue;
+        }
+        const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${k.id}`, { method: "DELETE", headers });
+        if (del2.ok || del2.status === 404) out.push({ role, action: "revoked", detail: `key "${k.name}" found on the server, not in the keychain` });
+        else out.push({ role, action: "failed", detail: `key "${k.name}": ${del2.status} ${del2.statusText}` });
+      }
+    } catch (e) {
+      out.push({ role, action: "failed", detail: `could not sweep keys named for this ship (${e.message})` });
+    }
+  };
   for (const { role, agentId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
@@ -7324,6 +7345,7 @@ async function revokeSeatKeys(route2, o) {
       const session = await store.get(host, slug2);
       if (!session?.apiKey) {
         out.push({ role, action: "not_stored" });
+        if (o.shipName) await sweepNamedKeys(role, agentId);
         continue;
       }
       if (!session.keyId) {
@@ -7344,6 +7366,7 @@ async function revokeSeatKeys(route2, o) {
       }
       await store.clear(host, slug2);
       out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
+      if (o.shipName) await sweepNamedKeys(role, agentId);
     } catch (e) {
       out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
@@ -12904,7 +12927,12 @@ function labeledDocker() {
   if (!dockerAvailable()) return { volumes: [], images: [] };
   return {
     volumes: lines(docker(["volume", "ls", "-q", "--filter", `label=${DOCKER_LABEL_OWNER}`, "--filter", `label=${DOCKER_LABEL_CACHE}`])),
-    images: lines(docker(["image", "ls", "-q", "--filter", `label=${DOCKER_LABEL_OWNER}`, "--filter", `label=${DOCKER_LABEL_REPO_LAYER}`]))
+    // CREW-2984: the repository and ship layers are tagged `crew-sandbox/<name>:<hash>` but carry only an `io.crew.sandbox.*` label,
+    // so the label filter alone missed them. The tag namespace is crew's own; the base and crew layers are `crew-sandbox-base`/`-crew`.
+    images: [.../* @__PURE__ */ new Set([
+      ...lines(docker(["image", "ls", "--format", "{{.Repository}}:{{.Tag}}", "--filter", "reference=crew-sandbox/*"])),
+      ...lines(docker(["image", "ls", "-q", "--filter", `label=${DOCKER_LABEL_OWNER}`, "--filter", `label=${DOCKER_LABEL_REPO_LAYER}`]))
+    ])]
   };
 }
 function realDeprovisionDeps(cfg, emit, crewHome, getStore) {
@@ -28212,7 +28240,7 @@ ${cu.tail.trimEnd()}
       }
       const { personaResult, skillResult } = run3;
       if (flag("revoke-seat-keys")) {
-        for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun })) {
+        for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
           process.stdout.write(`${describeRevokeOutcome(o)}
 `);
         }
@@ -30585,7 +30613,7 @@ ${where.join("\n")}`);
         },
         removePair: removePairEntries,
         async revokeSeatKeys(r, dry) {
-          const outcomes = await revokeSeatKeys(r, { userAgent: cfg.ship.userAgent, dryRun: dry });
+          const outcomes = await revokeSeatKeys(r, { userAgent: cfg.ship.userAgent, dryRun: dry, shipName: cfg.ship.name });
           return outcomes.map((o) => ({ line: describeRevokeOutcome(o), ok: o.action !== "failed" }));
         },
         async credential(r) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.130.0",
+  "version": "0.130.1",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",