@tablation/crew 0.45.4 → 0.46.1

package/dist/cli.js

@@ -1963,6 +1963,11 @@ var ROLE_LABEL = {
 };
 var ConfigError = class extends Error {
 };
+function parseCloneScheme(v) {
+  if (v === void 0 || v === null || v === "") return void 0;
+  if (v === "ssh" || v === "https") return v;
+  throw new ConfigError(`ship.cloneScheme must be "ssh" or "https", got ${JSON.stringify(v)}`);
+}
 var SHIP_KEYS = /* @__PURE__ */ new Set([
   "name",
   "platform",
@@ -1987,7 +1992,8 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "relayPort",
   "relayHttpPort",
   "relayPublicDomain",
-  "passengerImage"
+  "passengerImage",
+  "cloneScheme"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -2355,7 +2361,8 @@ Create the first of those:
       relayPort: shipRaw.relayPort !== void 0 ? Number(shipRaw.relayPort) : 2222,
       relayHttpPort: shipRaw.relayHttpPort !== void 0 ? Number(shipRaw.relayHttpPort) : 443,
       relayPublicDomain: shipRaw.relayPublicDomain ? String(shipRaw.relayPublicDomain) : void 0,
-      passengerImage: shipRaw.passengerImage ? String(shipRaw.passengerImage) : void 0
+      passengerImage: shipRaw.passengerImage ? String(shipRaw.passengerImage) : void 0,
+      cloneScheme: parseCloneScheme(shipRaw.cloneScheme)
     },
     routes,
     crewHome,
@@ -4020,17 +4027,22 @@ import {
   closeSync as closeSync2,
   writeSync,
   statSync as statSync4,
-  unlinkSync as unlinkSync2
+  unlinkSync as unlinkSync2,
+  readFileSync as readFileSync9,
+  writeFileSync as writeFileSync6
 } from "fs";
 import { dirname as dirname5, basename as basename4 } from "path";
 var GitError = class extends Error {
 };
+function streamText(x) {
+  return String(x ?? "").trim();
+}
 function gitRaw(cwd, args) {
   try {
     return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
-    const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
+    const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
     throw new GitError(`git ${args.join(" ")}: ${why || err.message.trim()}`);
   }
 }
@@ -4039,7 +4051,7 @@ function git(cwd, args) {
     return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err = e;
-    const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
+    const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
     throw new GitError(`git ${args.join(" ")}: ${why || err.message.trim()}`);
   }
 }
@@ -4382,10 +4394,19 @@ function worktrees(cwd) {
   if (current.path) list.push({ path: current.path, branch: current.branch ?? null, prunable: current.prunable ?? false });
   return list;
 }
-function cloneUrlFor(remote) {
-  return `git@github.com:${remote}.git`;
+function cloneUrlFor(remote, opts = {}) {
+  const origin = opts.originUrl?.trim() ?? "";
+  const scheme = /^https?:\/\//i.test(origin) ? "https" : /^(git@|ssh:\/\/)/i.test(origin) ? "ssh" : opts.scheme ?? "ssh";
+  return scheme === "https" ? `https://github.com/${remote}.git` : `git@github.com:${remote}.git`;
+}
+function originUrlOf(dir, remoteName) {
+  try {
+    return git(dir, ["remote", "get-url", remoteName]) || null;
+  } catch {
+    return null;
+  }
 }
-function ensureRepoCheckout(dir, remote) {
+function ensureRepoCheckout(dir, remote, opts = {}) {
   if (existsSync9(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
@@ -4393,12 +4414,13 @@ function ensureRepoCheckout(dir, remote) {
     );
   }
   mkdirSync5(dirname5(dir), { recursive: true });
+  const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync("git", ["clone", cloneUrlFor(remote), dir], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
-    const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
-    throw new GitError(`git clone ${cloneUrlFor(remote)} ${dir}: ${why || err.message.trim()}`);
+    const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
+    throw new GitError(`git clone ${url} ${dir}: ${why || err.message.trim()}`);
   }
   return true;
 }
@@ -4445,10 +4467,31 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
     }
   }
 }
-function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base) {
+function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (ensureRepoCheckout(dir, githubRemote)) {
+    if (!existsSync9(`${dir}/.git`) && githubRemote) {
+      const url = cloneUrlFor(githubRemote, clone);
+      const marker = cloneFailureMarker(dir);
+      if (existsSync9(marker) && readFileSync9(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync9(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      }
+      try {
+        ensureRepoCheckout(dir, githubRemote, clone);
+      } catch (e) {
+        if (!(e instanceof GitError)) throw e;
+        writeFileSync6(marker, `${url}
+${e.message}`);
+        return { action: "clone-failed", detail: e.message, repeat: false };
+      }
+      try {
+        unlinkSync2(marker);
+      } catch {
+      }
+      if (currentBranch(dir) !== base) git(dir, ["checkout", base]);
+      return { action: "cloned", detail: `cloned ${githubRemote} into ${dir}` };
+    }
+    if (ensureRepoCheckout(dir, githubRemote, clone)) {
       if (currentBranch(dir) !== base) git(dir, ["checkout", base]);
       return { action: "cloned", detail: `cloned ${githubRemote} into ${dir}` };
     }
@@ -4457,6 +4500,9 @@ function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base) {
     release();
   }
 }
+function cloneFailureMarker(dir) {
+  return `${dir}.clone-failed`;
+}
 
 // src/ship-attention.ts
 var RELEASE_STALE_AFTER_INTERVALS = 3;
@@ -4822,7 +4868,12 @@ var Tracker = class {
   authorship;
   attachments;
   stateDir;
-  constructor(route, ship) {
+  /**
+   * `opts.apiKey` overrides the route's ship key (CREW-1603): a lane's own
+   * writes pass its seat's agent key so the event log and rule context see an
+   * agent, not the ship's human principal.
+   */
+  constructor(route, ship, opts = {}) {
     this.route = route;
     if (!route.resolved) {
       throw new ConfigError(
@@ -4836,7 +4887,7 @@ var Tracker = class {
     this.stateDir = ship.stateDir;
     this.client = new TablationClient({
       baseUrl: `${route.baseUrl}/api`,
-      apiKey: resolveApiKey(route),
+      apiKey: opts.apiKey ?? resolveApiKey(route),
       // Cloudflare 403s (error 1010) default agents on this host.
       headers: { "User-Agent": ship.userAgent }
     });
@@ -6215,7 +6266,7 @@ function materializeBranchForTicket(dir, cfg, t, role) {
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync6 } from "fs";
+import { writeFileSync as writeFileSync7 } from "fs";
 import { join as join10 } from "path";
 
 // src/stalled.ts
@@ -6555,7 +6606,7 @@ function writeDigest(o, d, role, stateDir) {
     };
     const text = role === "qa" ? qaDigest(input) : buildingDigest(input);
     const path = digestPath(stateDir, routeSlug(o.route.route), role);
-    writeFileSync6(path, text);
+    writeFileSync7(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -6939,7 +6990,7 @@ var alreadyReported = (ticket, g, events) => events.some((e) => e.record_id ===
 
 // src/agent.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync11, existsSync as existsSync12, statSync as statSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7, createWriteStream } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync12, statSync as statSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, createWriteStream } from "fs";
 import { finished } from "stream/promises";
 import { join as join13, dirname as dirname6 } from "path";
 import { createHash as createHash2 } from "crypto";
@@ -7356,13 +7407,13 @@ function expandSkillMarkers(text, lookup, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync3, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync3, existsSync as existsSync11 } from "fs";
 import { join as join12 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError8, TablationApiError as TablationApiError2 } from "@tablation/client";
 
 // src/agents.ts
-import { readFileSync as readFileSync9, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
 import { join as join11 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError7, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -7379,10 +7430,10 @@ var AgentsSyncError = class extends Error {
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join11(promptsDir, "personas", `lane-${role}.md`);
   if (!existsSync10(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync9(briefPath, "utf8");
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync10(briefPath, "utf8");
   const commonPath = join11(promptsDir, "personas", "common.md");
-  if (!existsSync10(commonPath)) return readFileSync9(briefPath, "utf8");
-  return `${readFileSync9(commonPath, "utf8")}${readFileSync9(briefPath, "utf8")}`;
+  if (!existsSync10(commonPath)) return readFileSync10(briefPath, "utf8");
+  return `${readFileSync10(commonPath, "utf8")}${readFileSync10(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route, role, opts) {
   const cached = route.resolved?.agentPersonas?.[role]?.agentId;
@@ -7728,7 +7779,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text = readFileSync10(path, "utf8");
+  const text = readFileSync11(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -7989,10 +8040,10 @@ function planAgentRun(o) {
   let ageSeconds;
   if (existsSync12(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync5(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync11(digestPath2, "utf8");
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync12(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync11(commonPath, "utf8") : "";
-  const brief = readFileSync11(briefPath, "utf8");
+  const common = usesCommon ? readFileSync12(commonPath, "utf8") : "";
+  const brief = readFileSync12(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = o.divergedPrompt ?? brief;
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -8218,7 +8269,7 @@ function spawnAgent(plan, emit) {
         provider: plan.provider ?? LEGACY_TOOLCHAIN_PROVIDER
       };
       try {
-        writeFileSync7(`${plan.streamPath}.meta.json`, JSON.stringify({
+        writeFileSync8(`${plan.streamPath}.meta.json`, JSON.stringify({
           route: plan.route,
           role: plan.role,
           ticket: plan.ticket ?? null,
@@ -8625,7 +8676,7 @@ async function retireRunWorktree(tracker, dir, cfg, t, role, seatId, shipName2,
 
 // src/connect-wizard.ts
 import { delimiter, dirname as dirname8, join as join16 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
@@ -8710,7 +8761,7 @@ ${routeBlock}`;
 function writeNewConfig(path, text) {
   mkdirSync7(dirname8(path), { recursive: true });
   try {
-    writeFileSync8(path, text, { mode: 384, flag: "wx" });
+    writeFileSync9(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -8742,7 +8793,7 @@ Wrote ${o.configPath}.
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync16, copyFileSync, mkdirSync as mkdirSync8, mkdtempSync, rmSync as rmSync6 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync16, copyFileSync, mkdirSync as mkdirSync8, mkdtempSync, rmSync as rmSync6 } from "fs";
 import { dirname as dirname9, join as join17 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
@@ -9407,7 +9458,7 @@ async function bump(o, size) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync12(first, "utf8")).version;
+  const current = JSON.parse(readFileSync13(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -9420,13 +9471,13 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync12(f, "utf8");
+    const src = readFileSync13(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync9(f, out);
+    writeFileSync10(f, out);
   }
   return version;
 }
@@ -9439,8 +9490,8 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync16(path) ? readFileSync12(path, "utf8") : "# Changelog\n";
-  writeFileSync9(path, insertChangelogSection(existing, section));
+  const existing = existsSync16(path) ? readFileSync13(path, "utf8") : "# Changelog\n";
+  writeFileSync10(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -10799,13 +10850,118 @@ ${opts.hostPassengers ? "    hostPassengers: true\n" : ""}${apiKeyFileLine}${api
 
 // src/cli.ts
 import {
-  getSessionStore as getSessionStore2,
-  hostFromUrl as hostFromUrl2,
+  getSessionStore as getSessionStore3,
+  hostFromUrl as hostFromUrl3,
   loginWithDeviceCode,
   getOrCreateShipId,
   DeviceLoginError
 } from "@tablation/client";
 
+// src/seat-keys.ts
+import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
+var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function seatKeySlug(workspaceSlug, agentId) {
+  return `${workspaceSlug}#agent:${agentId}`;
+}
+function slugFor(route, agentId) {
+  const [workspaceSlug] = splitRoute(route.route);
+  return seatKeySlug(workspaceSlug, agentId);
+}
+function seatAgentId(route, role) {
+  return route.resolved?.agentPersonas?.[role]?.agentId;
+}
+async function resolveSeatKey(route, role, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
+  const agentId = seatAgentId(route, role);
+  if (!agentId) return ship("seat has no linked Agents row (run `crew agents sync`)");
+  try {
+    const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship("no agent key stored for this seat (run `crew agents sync`)");
+  } catch {
+    return ship("OS keychain unavailable");
+  }
+}
+async function mintMissingSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const seated = SEAT_KEY_ROLES.filter((r) => resolved.seats[r]);
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return seated.map((role) => ({
+      role,
+      action: "failed",
+      detail: `OS keychain unavailable: ${e.message}`
+    }));
+  }
+  const host = hostFromUrl2(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  for (const role of seated) {
+    const agentId = seatAgentId(route, role);
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
+    try {
+      if ((await store.get(host, slug))?.apiKey) {
+        out.push({ role, action: "already_stored" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "minted", detail: "dry run" });
+        continue;
+      }
+      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${resolveApiKey(route)}`,
+          "Content-Type": "application/json",
+          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+        },
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
+      });
+      if (!res.ok) {
+        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
+        continue;
+      }
+      const body = await res.json();
+      if (!body.key) {
+        out.push({ role, action: "failed", detail: "response carried no key" });
+        continue;
+      }
+      await store.set(host, slug, {
+        apiKey: body.key,
+        shipId: o.shipName ?? "",
+        workspaceId: resolved.workspaceId,
+        identityId: agentId,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      out.push({ role, action: "minted" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: e.message });
+    }
+  }
+  return out;
+}
+function describeMintOutcome(o) {
+  switch (o.action) {
+    case "minted":
+      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
+    case "already_stored":
+      return `${o.role}: agent key already stored`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "failed":
+      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
+  }
+}
+
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
@@ -11304,13 +11460,13 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync17, existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync18, existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync13, chmodSync } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync14, chmodSync } from "fs";
 import { dirname as dirname11, join as join19 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -11344,7 +11500,7 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync20(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync13(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync14(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -11542,7 +11698,9 @@ function passengerCheckoutSyncSpecs(cfg, workspaceId) {
         dir: target.dir,
         remote: target.remote,
         gitRemoteName: effective.branch.remote,
-        base: effective.branch.base
+        base: effective.branch.base,
+        originUrl: ordinary ? originUrlOf(ordinary.dir, effective.branch.remote) : null,
+        cloneScheme: cfg.ship.cloneScheme
       });
     }
   }
@@ -11552,13 +11710,13 @@ function syncAllPassengerCheckouts(cfg) {
   return passengerCheckoutSyncSpecs(cfg).map((spec) => ({
     name: spec.name,
     workspaceId: spec.workspaceId,
-    outcome: syncPassengerCheckout(spec.dir, spec.remote, spec.gitRemoteName, spec.base)
+    outcome: syncPassengerCheckout(spec.dir, spec.remote, spec.gitRemoteName, spec.base, { originUrl: spec.originUrl, scheme: spec.cloneScheme })
   }));
 }
 
 // src/tunnel.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync10, unlinkSync as unlinkSync3, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync11, unlinkSync as unlinkSync3, readdirSync as readdirSync5 } from "fs";
 import { randomInt } from "crypto";
 import { join as join20 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -11633,7 +11791,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync21(path)) return void 0;
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -11641,7 +11799,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
   mkdirSync10(join20(stateDir, "passengers"), { recursive: true });
-  writeFileSync10(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync11(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -11860,7 +12018,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn4 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync11, unlinkSync as unlinkSync4, readdirSync as readdirSync6 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync12, unlinkSync as unlinkSync4, readdirSync as readdirSync6 } from "fs";
 import { join as join21 } from "path";
 
 // src/secret-compare.ts
@@ -11915,7 +12073,7 @@ function createSyncDaemonServer(targets, secret) {
     try {
       const synced = targets.map((t) => ({
         name: t.name,
-        outcome: syncPassengerCheckout(t.dir, t.remote, t.gitRemoteName, t.base)
+        outcome: syncPassengerCheckout(t.dir, t.remote, t.gitRemoteName, t.base, { originUrl: t.originUrl, scheme: t.cloneScheme })
       }));
       res.writeHead(200, { "Content-Type": "application/json" }).end(JSON.stringify({ synced }));
     } catch (error) {
@@ -11956,7 +12114,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync22(path)) return void 0;
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -11964,7 +12122,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
   mkdirSync11(join21(stateDir, "passengers"), { recursive: true });
-  writeFileSync11(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync12(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -12042,7 +12200,7 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync16, readdirSync as readdirSync7, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync17, readdirSync as readdirSync7, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync13 } from "fs";
 import { join as join22 } from "path";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
@@ -12102,12 +12260,12 @@ function daemonStampFor(stateDir) {
 function noteDaemonStarted(stateDir, now = Date.now()) {
   mkdirSync12(stateDir, { recursive: true });
   rmSync8(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync12(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync13(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync16(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync17(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -12159,7 +12317,7 @@ async function runOnePass(o) {
   const decide = o.decide ?? decideCycle;
   const spawn5 = o.spawnRoleAgent ?? runRoleAgent;
   const breaker = o.spawnBreaker ?? new SpawnBreaker();
-  const ctx = { route: o.route, ship: o.ship, state: o.state, emit };
+  const ctx = { route: o.route, ship: o.ship, state: o.state, emit, getSessionStore: o.getSessionStore };
   const decision = await decide(ctx);
   o.state.attention(o.route.route).persist(decision.attention);
   if (decision.sweep.length) {
@@ -12259,7 +12417,13 @@ async function publishShipAttention(o) {
 }
 async function runRoleAgent(role, decision, ctx) {
   const { route, ship, emit } = ctx;
-  const tracker = new Tracker(route, ship);
+  const identity = await resolveSeatKey(route, role, ctx.getSessionStore);
+  if (identity.kind === "ship" && SEAT_KEY_ROLES.includes(role)) {
+    emit.warn(`${role} writes as the ship, not its own agent: ${identity.reason}`, { step: "agent", role });
+  } else if (identity.kind === "agent") {
+    emit.emit(`${role} writes as its own agent principal`, { step: "agent", role });
+  }
+  const tracker = new Tracker(route, ship, { apiKey: identity.apiKey });
   let ticketHint = decision.actionable.top?.issue_id;
   let ticketRepo = repoTargetFor(route, decision.actionable.top?.repo_id)?.name;
   let workingId = decision.actionable.top?.id ?? null;
@@ -12336,7 +12500,7 @@ async function runRoleAgent(role, decision, ctx) {
     stateDir: ship.stateDir,
     roster: rosterFor(decision, route, role),
     environment: await buildEnvironment(route, ship, ticketHint),
-    apiKey: resolveApiKey(route),
+    apiKey: identity.apiKey,
     cycle: emit.cycle,
     ticket: ticketHint,
     repo: ticketRepo,
@@ -12738,6 +12902,15 @@ if (command === "passenger-sync-daemon") {
     }
     try {
       for (const r of syncAllPassengerCheckouts(cfg)) {
+        if (r.outcome.action === "clone-failed") {
+          if (!r.outcome.repeat) {
+            emit.warn(
+              `passenger checkout for ${r.name} could not be cloned (not retried until its clone URL changes): ${r.outcome.detail}`,
+              { step: "passengers", data: { workspaceId: r.workspaceId, repo: r.name } }
+            );
+          }
+          continue;
+        }
         if (r.outcome.action === "diverged" || r.outcome.action === "ff-failed") {
           emit.warn(
             `passenger checkout for ${r.name} is stale: ${r.outcome.detail}`,
@@ -12968,7 +13141,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync13(cfg.configFile, planEnable(readFileSync17(cfg.configFile, "utf8"), a.route));
+          writeFileSync14(cfg.configFile, planEnable(readFileSync18(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -14061,11 +14234,18 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync17(resolvedPath, "utf8")) : {};
+        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync18(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
         raw.agentSkills = skillResult.agentSkills;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
-        writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+      }
+      if (!dryRun) {
+        target.resolved.agentPersonas = personaResult.agentPersonas;
+      }
+      for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
+        process.stdout.write(`${describeMintOutcome(o)}
 `);
       }
       if (personaResult.outcomes.some((o) => o.action === "diverged") || skillResult.outcomes.some((o) => o.action === "diverged")) {
@@ -14112,10 +14292,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync17(resolvedPath, "utf8")) : {};
+        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync18(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
-        writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -14128,7 +14308,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list") usage2();
-      const configText = readFileSync17(cfg.configFile, "utf8");
+      const configText = readFileSync18(cfg.configFile, "utf8");
       let routeName = positional[2];
       let addPath = ".";
       let addName;
@@ -14152,7 +14332,7 @@ ${changed2.map((c) => `  - ${c}
       let resolvedRemotes;
       if (existsSync24(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync17(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync18(resolvedFile, "utf8"));
         } catch {
         }
       }
@@ -14224,14 +14404,14 @@ ${changed2.map((c) => `  - ${c}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync24(resolvedFile)) {
-            const raw = JSON.parse(readFileSync17(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync18(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync13(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync14(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync13(cfg.configFile, plan.text);
+        writeFileSync14(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -14332,18 +14512,18 @@ ${reconstruction.prompt}
       let apiKey = value("key") ?? process.env.CREW_CONNECT_KEY ?? cfg.routes.find((c) => c.apiKey)?.apiKey;
       let store;
       try {
-        store = getSessionStore2();
+        store = getSessionStore3();
       } catch {
         store = void 0;
       }
       let keychainBacked = false;
       if (!apiKey && workspace && store) {
         try {
-          const existing = await store.get(hostFromUrl2(baseUrl), workspace);
+          const existing = await store.get(hostFromUrl3(baseUrl), workspace);
           if (existing?.apiKey) {
             apiKey = existing.apiKey;
             keychainBacked = true;
-            process.stderr.write(`Reusing the existing keychain session for ${hostFromUrl2(baseUrl)}/${workspace}.
+            process.stderr.write(`Reusing the existing keychain session for ${hostFromUrl3(baseUrl)}/${workspace}.
 `);
           }
         } catch {
@@ -14397,7 +14577,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         if (!workspace) workspace = result.workspace.slug;
         if (store) {
           try {
-            await store.set(hostFromUrl2(baseUrl), result.workspace.slug, {
+            await store.set(hostFromUrl3(baseUrl), result.workspace.slug, {
               apiKey: result.apiKey.key,
               shipId: getOrCreateShipId(),
               workspaceId: result.workspace.id,
@@ -14406,7 +14586,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             });
             keychainBacked = true;
             process.stderr.write(
-              `API key stored in the OS keychain for ${hostFromUrl2(baseUrl)}/${result.workspace.slug}.
+              `API key stored in the OS keychain for ${hostFromUrl3(baseUrl)}/${result.workspace.slug}.
 `
             );
           } catch (e) {
@@ -14473,7 +14653,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync24(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync17(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync18(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -14537,12 +14717,23 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           mkdirSync13(dirname12(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync13(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync14(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
 `);
         }
+        if (!dryRun && previous?.agentPersonas && existingRoute?.resolved) {
+          try {
+            for (const o of await mintMissingSeatKeys({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name })) {
+              process.stderr.write(`${describeMintOutcome(o)}
+`);
+            }
+          } catch (e) {
+            process.stderr.write(`seat keys: skipped (${e.message})
+`);
+          }
+        }
         let apiKeyFile;
         const apiKeyVar = "CREW_API_KEY";
         if (mintedFromDevice && !keychainBacked) {
@@ -14552,7 +14743,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
           } else {
             mkdirSync13(dirname12(apiKeyFile), { recursive: true });
-            writeFileSync13(apiKeyFile, `${apiKeyVar}=${apiKey}
+            writeFileSync14(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -15090,7 +15281,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         break;
       }
       mkdirSync13(cfg.ship.stateDir, { recursive: true });
-      writeFileSync13(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      writeFileSync14(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -15141,7 +15332,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync17(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync18(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -15417,6 +15608,14 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       process.stdout.write(
         route.resolved?.releaseSeat ? "release seat:    this ship has its own Release Crew row\n" : "release seat:    none \u2014 release comments are credited to the dev seat; run `crew connect` once the Crew table has this ship's row\n"
       );
+      for (const role of SEAT_KEY_ROLES) {
+        if (!route.resolved?.seats[role]) continue;
+        const id = await resolveSeatKey(route, role);
+        process.stdout.write(
+          `seat identity:    ${role} writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
+`
+        );
+      }
       const [ships, crewRows] = await Promise.all([tracker.shipRows(), tracker.crewRows()]);
       if (ships.length === 0) {
         process.stdout.write("ship record:       this workspace has no Ships table (fine)\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.45.4",
+  "version": "0.46.1",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",