@tablation/crew 0.46.0 → 0.47.0

package/dist/cli.js

@@ -1963,6 +1963,11 @@ var ROLE_LABEL = {
 };
 var ConfigError = class extends Error {
 };
+function parseCloneScheme(v) {
+  if (v === void 0 || v === null || v === "") return void 0;
+  if (v === "ssh" || v === "https") return v;
+  throw new ConfigError(`ship.cloneScheme must be "ssh" or "https", got ${JSON.stringify(v)}`);
+}
 var SHIP_KEYS = /* @__PURE__ */ new Set([
   "name",
   "platform",
@@ -1987,7 +1992,8 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "relayPort",
   "relayHttpPort",
   "relayPublicDomain",
-  "passengerImage"
+  "passengerImage",
+  "cloneScheme"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -2250,6 +2256,7 @@ function parseResolved(raw, m, where) {
     holds: holds2,
     contract: raw.contract ?? void 0,
     ...typeof raw.releaseSeat === "string" && raw.releaseSeat ? { releaseSeat: raw.releaseSeat } : {},
+    ...typeof raw.releaseAgentId === "string" && raw.releaseAgentId ? { releaseAgentId: raw.releaseAgentId } : {},
     ...Object.keys(agentPersonas).length > 0 ? { agentPersonas } : {},
     ...Object.keys(agentSkills).length > 0 ? { agentSkills } : {}
   };
@@ -2355,7 +2362,8 @@ Create the first of those:
       relayPort: shipRaw.relayPort !== void 0 ? Number(shipRaw.relayPort) : 2222,
       relayHttpPort: shipRaw.relayHttpPort !== void 0 ? Number(shipRaw.relayHttpPort) : 443,
       relayPublicDomain: shipRaw.relayPublicDomain ? String(shipRaw.relayPublicDomain) : void 0,
-      passengerImage: shipRaw.passengerImage ? String(shipRaw.passengerImage) : void 0
+      passengerImage: shipRaw.passengerImage ? String(shipRaw.passengerImage) : void 0,
+      cloneScheme: parseCloneScheme(shipRaw.cloneScheme)
     },
     routes,
     crewHome,
@@ -4020,17 +4028,22 @@ import {
   closeSync as closeSync2,
   writeSync,
   statSync as statSync4,
-  unlinkSync as unlinkSync2
+  unlinkSync as unlinkSync2,
+  readFileSync as readFileSync9,
+  writeFileSync as writeFileSync6
 } from "fs";
 import { dirname as dirname5, basename as basename4 } from "path";
 var GitError = class extends Error {
 };
+function streamText(x) {
+  return String(x ?? "").trim();
+}
 function gitRaw(cwd, args) {
   try {
     return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
-    const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
+    const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
     throw new GitError(`git ${args.join(" ")}: ${why || err.message.trim()}`);
   }
 }
@@ -4039,7 +4052,7 @@ function git(cwd, args) {
     return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err = e;
-    const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
+    const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
     throw new GitError(`git ${args.join(" ")}: ${why || err.message.trim()}`);
   }
 }
@@ -4382,10 +4395,19 @@ function worktrees(cwd) {
   if (current.path) list.push({ path: current.path, branch: current.branch ?? null, prunable: current.prunable ?? false });
   return list;
 }
-function cloneUrlFor(remote) {
-  return `git@github.com:${remote}.git`;
+function cloneUrlFor(remote, opts = {}) {
+  const origin = opts.originUrl?.trim() ?? "";
+  const scheme = /^https?:\/\//i.test(origin) ? "https" : /^(git@|ssh:\/\/)/i.test(origin) ? "ssh" : opts.scheme ?? "ssh";
+  return scheme === "https" ? `https://github.com/${remote}.git` : `git@github.com:${remote}.git`;
+}
+function originUrlOf(dir, remoteName) {
+  try {
+    return git(dir, ["remote", "get-url", remoteName]) || null;
+  } catch {
+    return null;
+  }
 }
-function ensureRepoCheckout(dir, remote) {
+function ensureRepoCheckout(dir, remote, opts = {}) {
   if (existsSync9(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
@@ -4393,12 +4415,13 @@ function ensureRepoCheckout(dir, remote) {
     );
   }
   mkdirSync5(dirname5(dir), { recursive: true });
+  const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync("git", ["clone", cloneUrlFor(remote), dir], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
-    const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
-    throw new GitError(`git clone ${cloneUrlFor(remote)} ${dir}: ${why || err.message.trim()}`);
+    const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
+    throw new GitError(`git clone ${url} ${dir}: ${why || err.message.trim()}`);
   }
   return true;
 }
@@ -4445,10 +4468,31 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
     }
   }
 }
-function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base) {
+function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (ensureRepoCheckout(dir, githubRemote)) {
+    if (!existsSync9(`${dir}/.git`) && githubRemote) {
+      const url = cloneUrlFor(githubRemote, clone);
+      const marker = cloneFailureMarker(dir);
+      if (existsSync9(marker) && readFileSync9(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync9(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      }
+      try {
+        ensureRepoCheckout(dir, githubRemote, clone);
+      } catch (e) {
+        if (!(e instanceof GitError)) throw e;
+        writeFileSync6(marker, `${url}
+${e.message}`);
+        return { action: "clone-failed", detail: e.message, repeat: false };
+      }
+      try {
+        unlinkSync2(marker);
+      } catch {
+      }
+      if (currentBranch(dir) !== base) git(dir, ["checkout", base]);
+      return { action: "cloned", detail: `cloned ${githubRemote} into ${dir}` };
+    }
+    if (ensureRepoCheckout(dir, githubRemote, clone)) {
       if (currentBranch(dir) !== base) git(dir, ["checkout", base]);
       return { action: "cloned", detail: `cloned ${githubRemote} into ${dir}` };
     }
@@ -4457,6 +4501,9 @@ function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base) {
     release();
   }
 }
+function cloneFailureMarker(dir) {
+  return `${dir}.clone-failed`;
+}
 
 // src/ship-attention.ts
 var RELEASE_STALE_AFTER_INTERVALS = 3;
@@ -6220,7 +6267,7 @@ function materializeBranchForTicket(dir, cfg, t, role) {
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync6 } from "fs";
+import { writeFileSync as writeFileSync7 } from "fs";
 import { join as join10 } from "path";
 
 // src/stalled.ts
@@ -6560,7 +6607,7 @@ function writeDigest(o, d, role, stateDir) {
     };
     const text = role === "qa" ? qaDigest(input) : buildingDigest(input);
     const path = digestPath(stateDir, routeSlug(o.route.route), role);
-    writeFileSync6(path, text);
+    writeFileSync7(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -6944,7 +6991,7 @@ var alreadyReported = (ticket, g, events) => events.some((e) => e.record_id ===
 
 // src/agent.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync11, existsSync as existsSync12, statSync as statSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7, createWriteStream } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync12, statSync as statSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, createWriteStream } from "fs";
 import { finished } from "stream/promises";
 import { join as join13, dirname as dirname6 } from "path";
 import { createHash as createHash2 } from "crypto";
@@ -7361,13 +7408,13 @@ function expandSkillMarkers(text, lookup, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync3, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync3, existsSync as existsSync11 } from "fs";
 import { join as join12 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError8, TablationApiError as TablationApiError2 } from "@tablation/client";
 
 // src/agents.ts
-import { readFileSync as readFileSync9, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
 import { join as join11 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError7, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -7384,10 +7431,10 @@ var AgentsSyncError = class extends Error {
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join11(promptsDir, "personas", `lane-${role}.md`);
   if (!existsSync10(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync9(briefPath, "utf8");
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync10(briefPath, "utf8");
   const commonPath = join11(promptsDir, "personas", "common.md");
-  if (!existsSync10(commonPath)) return readFileSync9(briefPath, "utf8");
-  return `${readFileSync9(commonPath, "utf8")}${readFileSync9(briefPath, "utf8")}`;
+  if (!existsSync10(commonPath)) return readFileSync10(briefPath, "utf8");
+  return `${readFileSync10(commonPath, "utf8")}${readFileSync10(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route, role, opts) {
   const cached = route.resolved?.agentPersonas?.[role]?.agentId;
@@ -7502,6 +7549,8 @@ function needsBaselineBackfill(model, row) {
 function isPromptGateRejection(e) {
   return e instanceof TablationApiError && e.status === 422;
 }
+var RELEASE_AGENT_NAME = "Release agent";
+var RELEASE_AGENT_PROMPT = "Principal for the crew release phase (merge, deploy, release comments). It runs no model; this row only gives those tracker writes an agent identity.";
 async function syncPersonas(route, opts) {
   if (!route.resolved) {
     throw new AgentsSyncError(`route "${route.route}" has no resolved ids \u2014 run \`crew connect\` first`);
@@ -7633,7 +7682,24 @@ async function syncPersonas(route, opts) {
     }
   }
   const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent);
-  return { outcomes, agentPersonas, crewLinks };
+  const releaseAgentId = opts.dryRun ? route.resolved.releaseAgentId : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent);
+  return { outcomes, agentPersonas, crewLinks, ...releaseAgentId ? { releaseAgentId } : {} };
+}
+async function linkReleaseSeat(route, client2, agentsModel, userAgent) {
+  const seatId = route.resolved.releaseSeat;
+  if (!seatId) return void 0;
+  const rows = await client2.records.list(agentsModel.id, { limit: 200 });
+  const agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id ?? (await client2.records.create(agentsModel.id, {
+    name: RELEASE_AGENT_NAME,
+    prompt: RELEASE_AGENT_PROMPT,
+    ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
+  })).id;
+  const crewModelId = route.resolved.models.crew;
+  const crewModel = await client2.dataModels.get(crewModelId);
+  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  const seatRow = await client2.records.get(crewModelId, seatId);
+  if (seatRow[CREW_AGENT_COLUMN] !== agentId) await client2.records.update(crewModelId, seatId, { [columnName]: agentId });
+  return agentId;
 }
 async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent) {
   const seats2 = route.resolved.seats;
@@ -7733,7 +7799,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text = readFileSync10(path, "utf8");
+  const text = readFileSync11(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -7994,10 +8060,10 @@ function planAgentRun(o) {
   let ageSeconds;
   if (existsSync12(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync5(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync11(digestPath2, "utf8");
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync12(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync11(commonPath, "utf8") : "";
-  const brief = readFileSync11(briefPath, "utf8");
+  const common = usesCommon ? readFileSync12(commonPath, "utf8") : "";
+  const brief = readFileSync12(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = o.divergedPrompt ?? brief;
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -8223,7 +8289,7 @@ function spawnAgent(plan, emit) {
         provider: plan.provider ?? LEGACY_TOOLCHAIN_PROVIDER
       };
       try {
-        writeFileSync7(`${plan.streamPath}.meta.json`, JSON.stringify({
+        writeFileSync8(`${plan.streamPath}.meta.json`, JSON.stringify({
           route: plan.route,
           role: plan.role,
           ticket: plan.ticket ?? null,
@@ -8630,7 +8696,7 @@ async function retireRunWorktree(tracker, dir, cfg, t, role, seatId, shipName2,
 
 // src/connect-wizard.ts
 import { delimiter, dirname as dirname8, join as join16 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
@@ -8715,7 +8781,7 @@ ${routeBlock}`;
 function writeNewConfig(path, text) {
   mkdirSync7(dirname8(path), { recursive: true });
   try {
-    writeFileSync8(path, text, { mode: 384, flag: "wx" });
+    writeFileSync9(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -8747,7 +8813,7 @@ Wrote ${o.configPath}.
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync16, copyFileSync, mkdirSync as mkdirSync8, mkdtempSync, rmSync as rmSync6 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync16, copyFileSync, mkdirSync as mkdirSync8, mkdtempSync, rmSync as rmSync6 } from "fs";
 import { dirname as dirname9, join as join17 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
@@ -9412,7 +9478,7 @@ async function bump(o, size) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync12(first, "utf8")).version;
+  const current = JSON.parse(readFileSync13(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -9425,13 +9491,13 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync12(f, "utf8");
+    const src = readFileSync13(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync9(f, out);
+    writeFileSync10(f, out);
   }
   return version;
 }
@@ -9444,8 +9510,8 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync16(path) ? readFileSync12(path, "utf8") : "# Changelog\n";
-  writeFileSync9(path, insertChangelogSection(existing, section));
+  const existing = existsSync16(path) ? readFileSync13(path, "utf8") : "# Changelog\n";
+  writeFileSync10(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -10824,6 +10890,18 @@ function slugFor(route, agentId) {
 function seatAgentId(route, role) {
   return route.resolved?.agentPersonas?.[role]?.agentId;
 }
+async function resolveReleaseKey(route, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  const agentId = route.resolved?.releaseAgentId;
+  if (!agentId) return ship("release seat has no linked Agents row (run `crew agents sync`)");
+  try {
+    const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship("no agent key stored for the release seat (run `crew agents sync`)");
+  } catch {
+    return ship("OS keychain unavailable");
+  }
+}
 async function resolveSeatKey(route, role, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
@@ -10842,12 +10920,15 @@ async function mintMissingSeatKeys(route, o) {
   if (!route.resolved) return out;
   const resolved = route.resolved;
   const doFetch = o.fetchImpl ?? fetch;
-  const seated = SEAT_KEY_ROLES.filter((r) => resolved.seats[r]);
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
   let store;
   try {
     store = (o.getStore ?? getSessionStore2)();
   } catch (e) {
-    return seated.map((role) => ({
+    return targets.map(({ role }) => ({
       role,
       action: "failed",
       detail: `OS keychain unavailable: ${e.message}`
@@ -10855,8 +10936,7 @@ async function mintMissingSeatKeys(route, o) {
   }
   const host = hostFromUrl2(route.baseUrl);
   const base = route.baseUrl.replace(/\/+$/, "");
-  for (const role of seated) {
-    const agentId = seatAgentId(route, role);
+  for (const { role, agentId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
       continue;
@@ -11414,13 +11494,13 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync17, existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync18, existsSync as existsSync24, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync13, chmodSync } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync14, chmodSync } from "fs";
 import { dirname as dirname11, join as join19 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -11454,7 +11534,7 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync20(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync13(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync14(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -11652,7 +11732,9 @@ function passengerCheckoutSyncSpecs(cfg, workspaceId) {
         dir: target.dir,
         remote: target.remote,
         gitRemoteName: effective.branch.remote,
-        base: effective.branch.base
+        base: effective.branch.base,
+        originUrl: ordinary ? originUrlOf(ordinary.dir, effective.branch.remote) : null,
+        cloneScheme: cfg.ship.cloneScheme
       });
     }
   }
@@ -11662,13 +11744,13 @@ function syncAllPassengerCheckouts(cfg) {
   return passengerCheckoutSyncSpecs(cfg).map((spec) => ({
     name: spec.name,
     workspaceId: spec.workspaceId,
-    outcome: syncPassengerCheckout(spec.dir, spec.remote, spec.gitRemoteName, spec.base)
+    outcome: syncPassengerCheckout(spec.dir, spec.remote, spec.gitRemoteName, spec.base, { originUrl: spec.originUrl, scheme: spec.cloneScheme })
   }));
 }
 
 // src/tunnel.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync10, unlinkSync as unlinkSync3, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync11, unlinkSync as unlinkSync3, readdirSync as readdirSync5 } from "fs";
 import { randomInt } from "crypto";
 import { join as join20 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -11743,7 +11825,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync21(path)) return void 0;
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -11751,7 +11833,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
   mkdirSync10(join20(stateDir, "passengers"), { recursive: true });
-  writeFileSync10(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync11(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -11970,7 +12052,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn4 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync11, unlinkSync as unlinkSync4, readdirSync as readdirSync6 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync12, unlinkSync as unlinkSync4, readdirSync as readdirSync6 } from "fs";
 import { join as join21 } from "path";
 
 // src/secret-compare.ts
@@ -12025,7 +12107,7 @@ function createSyncDaemonServer(targets, secret) {
     try {
       const synced = targets.map((t) => ({
         name: t.name,
-        outcome: syncPassengerCheckout(t.dir, t.remote, t.gitRemoteName, t.base)
+        outcome: syncPassengerCheckout(t.dir, t.remote, t.gitRemoteName, t.base, { originUrl: t.originUrl, scheme: t.cloneScheme })
       }));
       res.writeHead(200, { "Content-Type": "application/json" }).end(JSON.stringify({ synced }));
     } catch (error) {
@@ -12066,7 +12148,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync22(path)) return void 0;
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -12074,7 +12156,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
   mkdirSync11(join21(stateDir, "passengers"), { recursive: true });
-  writeFileSync11(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync12(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -12152,7 +12234,7 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync16, readdirSync as readdirSync7, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync17, readdirSync as readdirSync7, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync13 } from "fs";
 import { join as join22 } from "path";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
@@ -12212,12 +12294,12 @@ function daemonStampFor(stateDir) {
 function noteDaemonStarted(stateDir, now = Date.now()) {
   mkdirSync12(stateDir, { recursive: true });
   rmSync8(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync12(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync13(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync16(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync17(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -12854,6 +12936,15 @@ if (command === "passenger-sync-daemon") {
     }
     try {
       for (const r of syncAllPassengerCheckouts(cfg)) {
+        if (r.outcome.action === "clone-failed") {
+          if (!r.outcome.repeat) {
+            emit.warn(
+              `passenger checkout for ${r.name} could not be cloned (not retried until its clone URL changes): ${r.outcome.detail}`,
+              { step: "passengers", data: { workspaceId: r.workspaceId, repo: r.name } }
+            );
+          }
+          continue;
+        }
         if (r.outcome.action === "diverged" || r.outcome.action === "ff-failed") {
           emit.warn(
             `passenger checkout for ${r.name} is stale: ${r.outcome.detail}`,
@@ -13084,7 +13175,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync13(cfg.configFile, planEnable(readFileSync17(cfg.configFile, "utf8"), a.route));
+          writeFileSync14(cfg.configFile, planEnable(readFileSync18(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -13220,7 +13311,9 @@ ${changed2.map((c) => `  - ${c}
         return { scope, tests: "skipped", outcome: "skipped", detail: note };
       }
       if (!dryRun && !c.enabled) return { scope, tests: "skipped", outcome: "skipped", detail: "route not enabled" };
-      const tracker = new Tracker(c, cfg.ship);
+      const releaseIdentity = await resolveReleaseKey(c);
+      if (releaseIdentity.kind === "ship") remit.warn(`release writes as the ship, not its own agent: ${releaseIdentity.reason}`, { step: "release" });
+      const tracker = new Tracker(c, cfg.ship, { apiKey: releaseIdentity.apiKey });
       if (!dryRun) {
         const force2 = command === "deploy" || flag("force");
         let seen = precheckTickets.get(c.route);
@@ -14177,15 +14270,17 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync17(resolvedPath, "utf8")) : {};
+        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync18(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
         raw.agentSkills = skillResult.agentSkills;
+        if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
-        writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (!dryRun) {
         target.resolved.agentPersonas = personaResult.agentPersonas;
+        if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
       }
       for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
         process.stdout.write(`${describeMintOutcome(o)}
@@ -14235,10 +14330,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync17(resolvedPath, "utf8")) : {};
+        const raw = existsSync24(resolvedPath) ? JSON.parse(readFileSync18(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
-        writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -14251,7 +14346,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list") usage2();
-      const configText = readFileSync17(cfg.configFile, "utf8");
+      const configText = readFileSync18(cfg.configFile, "utf8");
       let routeName = positional[2];
       let addPath = ".";
       let addName;
@@ -14275,7 +14370,7 @@ ${changed2.map((c) => `  - ${c}
       let resolvedRemotes;
       if (existsSync24(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync17(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync18(resolvedFile, "utf8"));
         } catch {
         }
       }
@@ -14347,14 +14442,14 @@ ${changed2.map((c) => `  - ${c}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync24(resolvedFile)) {
-            const raw = JSON.parse(readFileSync17(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync18(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync13(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync14(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync13(cfg.configFile, plan.text);
+        writeFileSync14(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -14596,7 +14691,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync24(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync17(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync18(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -14651,7 +14746,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           // role as "diverged by definition" on the next sync even though
           // nothing about its prompt actually changed.
           ...previous?.agentPersonas ? { agentPersonas: previous.agentPersonas } : {},
-          ...previous?.agentSkills ? { agentSkills: previous.agentSkills } : {}
+          ...previous?.agentSkills ? { agentSkills: previous.agentSkills } : {},
+          ...previous?.releaseAgentId ? { releaseAgentId: previous.releaseAgentId } : {}
         };
         if (dryRun) {
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
@@ -14660,7 +14756,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           mkdirSync13(dirname12(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync13(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync14(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -14686,7 +14782,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
           } else {
             mkdirSync13(dirname12(apiKeyFile), { recursive: true });
-            writeFileSync13(apiKeyFile, `${apiKeyVar}=${apiKey}
+            writeFileSync14(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -15224,7 +15320,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         break;
       }
       mkdirSync13(cfg.ship.stateDir, { recursive: true });
-      writeFileSync13(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      writeFileSync14(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -15275,7 +15371,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync17(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync18(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -15556,6 +15652,13 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const id = await resolveSeatKey(route, role);
         process.stdout.write(
           `seat identity:    ${role} writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
+`
+        );
+      }
+      if (route.resolved?.releaseSeat) {
+        const id = await resolveReleaseKey(route);
+        process.stdout.write(
+          `seat identity:    release writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `
         );
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",