@tablation/crew 0.45.3 → 0.46.0

package/dist/cli.js

@@ -4822,7 +4822,12 @@ var Tracker = class {
   authorship;
   attachments;
   stateDir;
-  constructor(route, ship) {
+  /**
+   * `opts.apiKey` overrides the route's ship key (CREW-1603): a lane's own
+   * writes pass its seat's agent key so the event log and rule context see an
+   * agent, not the ship's human principal.
+   */
+  constructor(route, ship, opts = {}) {
     this.route = route;
     if (!route.resolved) {
       throw new ConfigError(
@@ -4836,7 +4841,7 @@ var Tracker = class {
     this.stateDir = ship.stateDir;
     this.client = new TablationClient({
       baseUrl: `${route.baseUrl}/api`,
-      apiKey: resolveApiKey(route),
+      apiKey: opts.apiKey ?? resolveApiKey(route),
       // Cloudflare 403s (error 1010) default agents on this host.
       headers: { "User-Agent": ship.userAgent }
     });
@@ -10799,13 +10804,118 @@ ${opts.hostPassengers ? "    hostPassengers: true\n" : ""}${apiKeyFileLine}${api
 
 // src/cli.ts
 import {
-  getSessionStore as getSessionStore2,
-  hostFromUrl as hostFromUrl2,
+  getSessionStore as getSessionStore3,
+  hostFromUrl as hostFromUrl3,
   loginWithDeviceCode,
   getOrCreateShipId,
   DeviceLoginError
 } from "@tablation/client";
 
+// src/seat-keys.ts
+import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
+var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function seatKeySlug(workspaceSlug, agentId) {
+  return `${workspaceSlug}#agent:${agentId}`;
+}
+function slugFor(route, agentId) {
+  const [workspaceSlug] = splitRoute(route.route);
+  return seatKeySlug(workspaceSlug, agentId);
+}
+function seatAgentId(route, role) {
+  return route.resolved?.agentPersonas?.[role]?.agentId;
+}
+async function resolveSeatKey(route, role, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
+  const agentId = seatAgentId(route, role);
+  if (!agentId) return ship("seat has no linked Agents row (run `crew agents sync`)");
+  try {
+    const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship("no agent key stored for this seat (run `crew agents sync`)");
+  } catch {
+    return ship("OS keychain unavailable");
+  }
+}
+async function mintMissingSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const seated = SEAT_KEY_ROLES.filter((r) => resolved.seats[r]);
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return seated.map((role) => ({
+      role,
+      action: "failed",
+      detail: `OS keychain unavailable: ${e.message}`
+    }));
+  }
+  const host = hostFromUrl2(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  for (const role of seated) {
+    const agentId = seatAgentId(route, role);
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
+    try {
+      if ((await store.get(host, slug))?.apiKey) {
+        out.push({ role, action: "already_stored" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "minted", detail: "dry run" });
+        continue;
+      }
+      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${resolveApiKey(route)}`,
+          "Content-Type": "application/json",
+          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+        },
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
+      });
+      if (!res.ok) {
+        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
+        continue;
+      }
+      const body = await res.json();
+      if (!body.key) {
+        out.push({ role, action: "failed", detail: "response carried no key" });
+        continue;
+      }
+      await store.set(host, slug, {
+        apiKey: body.key,
+        shipId: o.shipName ?? "",
+        workspaceId: resolved.workspaceId,
+        identityId: agentId,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      out.push({ role, action: "minted" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: e.message });
+    }
+  }
+  return out;
+}
+function describeMintOutcome(o) {
+  switch (o.action) {
+    case "minted":
+      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
+    case "already_stored":
+      return `${o.role}: agent key already stored`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "failed":
+      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
+  }
+}
+
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
@@ -12159,7 +12269,7 @@ async function runOnePass(o) {
   const decide = o.decide ?? decideCycle;
   const spawn5 = o.spawnRoleAgent ?? runRoleAgent;
   const breaker = o.spawnBreaker ?? new SpawnBreaker();
-  const ctx = { route: o.route, ship: o.ship, state: o.state, emit };
+  const ctx = { route: o.route, ship: o.ship, state: o.state, emit, getSessionStore: o.getSessionStore };
   const decision = await decide(ctx);
   o.state.attention(o.route.route).persist(decision.attention);
   if (decision.sweep.length) {
@@ -12259,7 +12369,13 @@ async function publishShipAttention(o) {
 }
 async function runRoleAgent(role, decision, ctx) {
   const { route, ship, emit } = ctx;
-  const tracker = new Tracker(route, ship);
+  const identity = await resolveSeatKey(route, role, ctx.getSessionStore);
+  if (identity.kind === "ship" && SEAT_KEY_ROLES.includes(role)) {
+    emit.warn(`${role} writes as the ship, not its own agent: ${identity.reason}`, { step: "agent", role });
+  } else if (identity.kind === "agent") {
+    emit.emit(`${role} writes as its own agent principal`, { step: "agent", role });
+  }
+  const tracker = new Tracker(route, ship, { apiKey: identity.apiKey });
   let ticketHint = decision.actionable.top?.issue_id;
   let ticketRepo = repoTargetFor(route, decision.actionable.top?.repo_id)?.name;
   let workingId = decision.actionable.top?.id ?? null;
@@ -12336,7 +12452,7 @@ async function runRoleAgent(role, decision, ctx) {
     stateDir: ship.stateDir,
     roster: rosterFor(decision, route, role),
     environment: await buildEnvironment(route, ship, ticketHint),
-    apiKey: resolveApiKey(route),
+    apiKey: identity.apiKey,
     cycle: emit.cycle,
     ticket: ticketHint,
     repo: ticketRepo,
@@ -14066,6 +14182,13 @@ ${changed2.map((c) => `  - ${c}
         raw.agentSkills = skillResult.agentSkills;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
         writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+      }
+      if (!dryRun) {
+        target.resolved.agentPersonas = personaResult.agentPersonas;
+      }
+      for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
+        process.stdout.write(`${describeMintOutcome(o)}
 `);
       }
       if (personaResult.outcomes.some((o) => o.action === "diverged") || skillResult.outcomes.some((o) => o.action === "diverged")) {
@@ -14332,18 +14455,18 @@ ${reconstruction.prompt}
       let apiKey = value("key") ?? process.env.CREW_CONNECT_KEY ?? cfg.routes.find((c) => c.apiKey)?.apiKey;
       let store;
       try {
-        store = getSessionStore2();
+        store = getSessionStore3();
       } catch {
         store = void 0;
       }
       let keychainBacked = false;
       if (!apiKey && workspace && store) {
         try {
-          const existing = await store.get(hostFromUrl2(baseUrl), workspace);
+          const existing = await store.get(hostFromUrl3(baseUrl), workspace);
           if (existing?.apiKey) {
             apiKey = existing.apiKey;
             keychainBacked = true;
-            process.stderr.write(`Reusing the existing keychain session for ${hostFromUrl2(baseUrl)}/${workspace}.
+            process.stderr.write(`Reusing the existing keychain session for ${hostFromUrl3(baseUrl)}/${workspace}.
 `);
           }
         } catch {
@@ -14397,7 +14520,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         if (!workspace) workspace = result.workspace.slug;
         if (store) {
           try {
-            await store.set(hostFromUrl2(baseUrl), result.workspace.slug, {
+            await store.set(hostFromUrl3(baseUrl), result.workspace.slug, {
               apiKey: result.apiKey.key,
               shipId: getOrCreateShipId(),
               workspaceId: result.workspace.id,
@@ -14406,7 +14529,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             });
             keychainBacked = true;
             process.stderr.write(
-              `API key stored in the OS keychain for ${hostFromUrl2(baseUrl)}/${result.workspace.slug}.
+              `API key stored in the OS keychain for ${hostFromUrl3(baseUrl)}/${result.workspace.slug}.
 `
             );
           } catch (e) {
@@ -14543,6 +14666,17 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`Resolved ids written to ${resolvedPath}
 `);
         }
+        if (!dryRun && previous?.agentPersonas && existingRoute?.resolved) {
+          try {
+            for (const o of await mintMissingSeatKeys({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name })) {
+              process.stderr.write(`${describeMintOutcome(o)}
+`);
+            }
+          } catch (e) {
+            process.stderr.write(`seat keys: skipped (${e.message})
+`);
+          }
+        }
         let apiKeyFile;
         const apiKeyVar = "CREW_API_KEY";
         if (mintedFromDevice && !keychainBacked) {
@@ -15417,6 +15551,14 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       process.stdout.write(
         route.resolved?.releaseSeat ? "release seat:    this ship has its own Release Crew row\n" : "release seat:    none \u2014 release comments are credited to the dev seat; run `crew connect` once the Crew table has this ship's row\n"
       );
+      for (const role of SEAT_KEY_ROLES) {
+        if (!route.resolved?.seats[role]) continue;
+        const id = await resolveSeatKey(route, role);
+        process.stdout.write(
+          `seat identity:    ${role} writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
+`
+        );
+      }
       const [ships, crewRows] = await Promise.all([tracker.shipRows(), tracker.crewRows()]);
       if (ships.length === 0) {
         process.stdout.write("ship record:       this workspace has no Ships table (fine)\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.45.3",
+  "version": "0.46.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",

package/prompts/default/skills/crew-lane-agent.md

@@ -45,6 +45,13 @@ request — a default client user agent is rejected before it reaches the API,
 and the failure looks like a network problem. Do not guess column names; the
 Environment section lists them for this workspace.
 
+A write to a record can be refused by a rule on the table. The response is a
+422 whose `message` says what is missing and whose `fieldErrors` names the
+field. Do not retry the same write. If the missing value is yours to supply
+(a resolution note when closing, a duplicate target), supply it and write
+once more; otherwise leave the ticket where it is and say so in your
+hand-off comment.
+
 Your identity is the Crew row named for your seat in the `## Your crew`
 roster at the top of this prompt. Use its id as the assignee and as the
 comment author. Every agent and every person who touches this tracker has

package/prompts/dev-qa/skills/crew-lane-agent.md

@@ -46,6 +46,13 @@ request — a default client user agent is rejected before it reaches the API,
 and the failure looks like a network problem. Do not guess column names; the
 Environment section lists them for this workspace.
 
+A write to a record can be refused by a rule on the table. The response is a
+422 whose `message` says what is missing and whose `fieldErrors` names the
+field. Do not retry the same write. If the missing value is yours to supply
+(a resolution note when closing, a duplicate target), supply it and write
+once more; otherwise leave the ticket where it is and say so in your
+hand-off comment.
+
 Your identity is the Crew row named for your seat in the `## Your crew`
 roster at the top of this prompt. Use its id as the assignee and as the
 comment author. Every agent and every person who touches this tracker has