@tablation/crew 0.50.1 → 0.50.3

package/dist/cli.js

@@ -1,5 +1,36 @@
 #!/usr/bin/env node
 
+// src/doctor-repo.ts
+import { existsSync } from "fs";
+function doctorBaseReport(r, base, health) {
+  const pad = "                   ";
+  if (!existsSync(r.dir)) {
+    return {
+      text: `${pad}- ${r.dir} is missing on disk \u2014 no .crew.yaml read, settings above are defaults
+`,
+      failed: true,
+      skipRest: true
+    };
+  }
+  try {
+    const bh = health(r);
+    if (bh.action === "not-applicable") return { text: "", failed: false, skipRest: false };
+    return {
+      text: `${pad}base ${base}: ${bh.unsafe ? "ERROR \u2014 " : ""}${bh.detail}
+`,
+      failed: bh.unsafe,
+      skipRest: false
+    };
+  } catch (e) {
+    return {
+      text: `${pad}base ${base}: could not check \u2014 ${e instanceof Error ? e.message : String(e)}
+`,
+      failed: true,
+      skipRest: false
+    };
+  }
+}
+
 // src/cli.ts
 import { resolve as resolve4, dirname as dirname12, join as join25, basename as basename9 } from "path";
 import { fileURLToPath } from "url";
@@ -62,7 +93,7 @@ function pickWorktreeRoute(ticketNumber, candidates) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 import { resolve, dirname as dirname3, isAbsolute, join as join7, basename as basename3 } from "path";
 import { homedir as homedir5, tmpdir } from "os";
 import { parse as parse2 } from "yaml";
@@ -71,7 +102,7 @@ import { parse as parse2 } from "yaml";
 import {
   appendFileSync,
   mkdirSync,
-  existsSync,
+  existsSync as existsSync2,
   statSync,
   renameSync,
   openSync,
@@ -90,7 +121,7 @@ var ROTATED_EVENTS_RE = /^events\.\d{8}T\d{6}Z(?:-\d+)?\.jsonl$/;
 var ROTATE_LOCK_STALE_MS = 6e4;
 function rotateEventsFile(file, maxBytes, now = /* @__PURE__ */ new Date()) {
   try {
-    if (!existsSync(file) || statSync(file).size <= maxBytes) return void 0;
+    if (!existsSync2(file) || statSync(file).size <= maxBytes) return void 0;
   } catch {
     return void 0;
   }
@@ -111,7 +142,7 @@ function rotateEventsFile(file, maxBytes, now = /* @__PURE__ */ new Date()) {
       if (statSync(file).size <= maxBytes) return void 0;
       const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
       let dest = join(dirname(file), `events.${stamp}.jsonl`);
-      for (let n = 1; existsSync(dest); n++) dest = join(dirname(file), `events.${stamp}-${n}.jsonl`);
+      for (let n = 1; existsSync2(dest); n++) dest = join(dirname(file), `events.${stamp}-${n}.jsonl`);
       renameSync(file, dest);
       return dest;
     } finally {
@@ -213,7 +244,7 @@ var Emitter = class _Emitter {
 var eventFileFor = (stateDir) => join(stateDir, "events.jsonl");
 
 // src/pair-install.ts
-import { existsSync as existsSync4, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 import { homedir as homedir4 } from "os";
 import { join as join5 } from "path";
@@ -342,7 +373,7 @@ function removeClaudeMcp(o) {
 
 // src/launcher.ts
 import { basename, join as join3 } from "path";
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync } from "fs";
 import { homedir as homedir2 } from "os";
 function isOriLauncher(spec) {
   return !!spec.launcher && basename(spec.launcher) === "ori";
@@ -405,7 +436,7 @@ function omlxModelPresent(model, dirs) {
 }
 function readOmlxSettings(home = homedir2()) {
   const p = join3(home, ".omlx", "settings.json");
-  return existsSync2(p) ? parseOmlxSettings(readFileSync3(p, "utf8")) : void 0;
+  return existsSync3(p) ? parseOmlxSettings(readFileSync3(p, "utf8")) : void 0;
 }
 
 // src/capability.ts
@@ -542,7 +573,7 @@ import { join as join4 } from "path";
 import { rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
 
 // src/pair-files.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync, rmSync as rmSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 var PAIR_BLOCK_START = "<!-- crew:pair start -->";
 var PAIR_BLOCK_END = "<!-- crew:pair end -->";
@@ -583,7 +614,7 @@ function removePairBlock(text) {
   return text.replace(new RegExp(`\\n*${BLOCK_RE.source}`), "\n").replace(/^\n+/, "").replace(/\n{3,}/g, "\n\n");
 }
 function readIfExists(path) {
-  return existsSync3(path) ? readFileSync4(path, "utf8") : void 0;
+  return existsSync4(path) ? readFileSync4(path, "utf8") : void 0;
 }
 function writeFileMkdir(path, text) {
   mkdirSync2(dirname2(path), { recursive: true });
@@ -980,7 +1011,7 @@ function vscodeUserDirs(o) {
   const platform2 = o.platform ?? process.platform;
   const root = platform2 === "darwin" ? join5(home, "Library", "Application Support") : platform2 === "win32" ? process.env.APPDATA ?? join5(home, "AppData", "Roaming") : join5(home, ".config");
   const all = VSCODE_FLAVOURS.map((f) => join5(root, f, "User"));
-  const present = all.filter((d) => existsSync4(d));
+  const present = all.filter((d) => existsSync5(d));
   return present.length > 0 ? present : [all[0]];
 }
 var COPILOT_FRONTMATTER = '---\napplyTo: "**"\n---\n\n';
@@ -1372,7 +1403,7 @@ function explain(ship, required) {
 }
 
 // src/repo-config.ts
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
 import { join as join6, basename as basename2 } from "path";
 import { parse } from "yaml";
 var SPEC_VERSION = 1;
@@ -1456,7 +1487,7 @@ var PROVIDERS = ["github", "buildkite", "other", "none"];
 function findRepoConfig(dir) {
   for (const name of REPO_CONFIG_FILENAMES) {
     const p = join6(dir, name);
-    if (existsSync5(p)) return p;
+    if (existsSync6(p)) return p;
   }
   return null;
 }
@@ -2181,7 +2212,7 @@ function configSearchPath(crewHome) {
 }
 function findConfigFile(crewHome) {
   const candidates = configSearchPath(crewHome);
-  return candidates.find((c) => existsSync6(c)) ?? candidates[candidates.length - 1];
+  return candidates.find((c) => existsSync7(c)) ?? candidates[candidates.length - 1];
 }
 var defaultConfigPath = () => join7(process.env.XDG_CONFIG_HOME ?? join7(homedir5(), ".config"), "crew", "crew.yaml");
 function routeSlug(route) {
@@ -2204,7 +2235,7 @@ function splitRoute(route) {
 }
 function readResolvedFile(stateDir, route) {
   const path = resolvedPathFor(stateDir, route);
-  if (!existsSync6(path)) return void 0;
+  if (!existsSync7(path)) return void 0;
   try {
     return JSON.parse(readFileSync6(path, "utf8"));
   } catch (e) {
@@ -2257,13 +2288,14 @@ function parseResolved(raw, m, where) {
     contract: raw.contract ?? void 0,
     ...typeof raw.releaseSeat === "string" && raw.releaseSeat ? { releaseSeat: raw.releaseSeat } : {},
     ...typeof raw.releaseAgentId === "string" && raw.releaseAgentId ? { releaseAgentId: raw.releaseAgentId } : {},
+    ...typeof raw.role === "string" && raw.role ? { role: raw.role } : {},
     ...Object.keys(agentPersonas).length > 0 ? { agentPersonas } : {},
     ...Object.keys(agentSkills).length > 0 ? { agentSkills } : {}
   };
 }
 function loadConfig(crewHome, configFile, opts = {}) {
   const file = configFile ?? findConfigFile(crewHome);
-  if (opts.text === void 0 && !existsSync6(file)) {
+  if (opts.text === void 0 && !existsSync7(file)) {
     throw new ConfigError(
       `no config found. Looked in:
 ` + configSearchPath(crewHome).map((c) => `  - ${c}`).join("\n") + `
@@ -2573,7 +2605,7 @@ function repoIdForName(r, name) {
 }
 function resolveApiKey(r) {
   if (r.apiKey) return r.apiKey;
-  if (r.apiKeyFile && r.apiKeyVar && existsSync6(r.apiKeyFile)) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync7(r.apiKeyFile)) {
     for (const line of readFileSync6(r.apiKeyFile, "utf8").split("\n")) {
       const m = line.match(new RegExp(`^${r.apiKeyVar}=(.*)$`));
       if (m) return (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
@@ -2793,7 +2825,7 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/state.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync3, rmSync as rmSync5, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync3, rmSync as rmSync5, statSync as statSync2 } from "fs";
 import { join as join8 } from "path";
 var EPOCH = "1970-01-01T00:00:00.000Z";
 var State = class _State {
@@ -2839,10 +2871,10 @@ var State = class _State {
   }
   /** Whole-crew pause, and the per-role sentinels one level down. */
   isPaused() {
-    return existsSync7(this.path(".crew-paused"));
+    return existsSync8(this.path(".crew-paused"));
   }
   isRolePaused(role) {
-    return existsSync7(this.path(`.role-paused-${role}`));
+    return existsSync8(this.path(`.role-paused-${role}`));
   }
   pausedRoles(roles) {
     return new Set(roles.filter((r) => this.isRolePaused(r)));
@@ -2859,7 +2891,7 @@ var State = class _State {
    * while agents keep working.
    */
   isReleasePaused() {
-    return existsSync7(this.path(".release-paused"));
+    return existsSync8(this.path(".release-paused"));
   }
   setReleasePaused(paused) {
     if (paused) writeFileSync4(this.path(".release-paused"), "");
@@ -3507,7 +3539,7 @@ function describeRelease(o, route) {
 // src/install.ts
 import { dirname as dirname4, join as join9, extname } from "path";
 import { homedir as homedir6 } from "os";
-import { accessSync, constants, existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync8, statSync as statSync3, writeFileSync as writeFileSync5, unlinkSync, realpathSync } from "fs";
+import { accessSync, constants, existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync8, statSync as statSync3, writeFileSync as writeFileSync5, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { createHash } from "crypto";
 
@@ -3882,7 +3914,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
     }
   }
   for (const path of plan.unitPaths) {
-    if (!existsSync8(path)) continue;
+    if (!existsSync9(path)) continue;
     if (dryRun) {
       log.emit(`would remove ${path}`);
       continue;
@@ -3918,7 +3950,7 @@ function loadedCrewLabels() {
   return [...parseLaunchctlList(list.stdout ?? "").keys()].filter((l) => l.startsWith(CREW_LAUNCHD_PREFIX));
 }
 function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
-  const files = existsSync8(dir) ? readdirSync2(dir) : [];
+  const files = existsSync9(dir) ? readdirSync2(dir) : [];
   const units = files.filter((f) => f.startsWith(CREW_LAUNCHD_PREFIX) && f.endsWith(".plist")).sort().map((f) => {
     const plistPath = join9(dir, f);
     let program = null;
@@ -3930,7 +3962,7 @@ function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
       label: f.slice(0, -".plist".length),
       plistPath,
       program,
-      programExists: program !== null && existsSync8(program)
+      programExists: program !== null && existsSync9(program)
     };
   });
   const seen = new Set(units.map((u) => u.label));
@@ -3949,9 +3981,9 @@ function removeLaunchdUnit(unit, dryRun, log) {
     log.emit(`would unload and remove ${unit.label}`);
     return;
   }
-  if (existsSync8(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
+  if (existsSync9(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
   spawnSync4("launchctl", ["remove", unit.label], { encoding: "utf8" });
-  if (existsSync8(unit.plistPath)) unlinkSync(unit.plistPath);
+  if (existsSync9(unit.plistPath)) unlinkSync(unit.plistPath);
   log.emit(`removed ${unit.label} (${unit.plistPath})`);
 }
 function clearForeignLaunchdUnits(crewHome, replace, dryRun, log, dir, loaded) {
@@ -4034,7 +4066,7 @@ import { statfsSync } from "fs";
 // src/git.ts
 import { execFileSync } from "child_process";
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync5,
   openSync as openSync2,
   closeSync as closeSync2,
@@ -4434,7 +4466,7 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
     try {
       const st = statSync4(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync9(join10(root, "checkout"))) continue;
+      if (existsSync10(join10(root, "checkout"))) continue;
       rmSync6(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
@@ -4477,7 +4509,7 @@ function originUrlOf(dir, remoteName) {
   }
 }
 function ensureRepoCheckout(dir, remote, opts = {}) {
-  if (existsSync9(`${dir}/.git`)) return false;
+  if (existsSync10(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
@@ -4540,10 +4572,10 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
 function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (!existsSync9(`${dir}/.git`) && githubRemote) {
+    if (!existsSync10(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync9(marker) && readFileSync9(marker, "utf8").split("\n")[0] === url) {
+      if (existsSync10(marker) && readFileSync9(marker, "utf8").split("\n")[0] === url) {
         return { action: "clone-failed", detail: readFileSync9(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
@@ -7126,7 +7158,7 @@ var alreadyReported = (ticket, g, events) => events.some((e) => e.record_id ===
 
 // src/agent.ts
 import { spawn as spawn2, spawnSync as spawnSync5 } from "child_process";
-import { readFileSync as readFileSync12, existsSync as existsSync12, statSync as statSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync13, statSync as statSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
 import { join as join14, dirname as dirname6 } from "path";
@@ -7544,7 +7576,7 @@ function expandSkillMarkers(text, lookup, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync4, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync4, existsSync as existsSync12 } from "fs";
 import { join as join13 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError8, TablationApiError as TablationApiError2 } from "@tablation/client";
@@ -7561,7 +7593,7 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync11 } from "fs";
 import { join as join12 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError7, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -7577,10 +7609,10 @@ var AgentsSyncError = class extends Error {
 };
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join12(promptsDir, "personas", `lane-${role}.md`);
-  if (!existsSync10(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
+  if (!existsSync11(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
   if (SELF_CONTAINED_ROLES.has(role)) return readFileSync10(briefPath, "utf8");
   const commonPath = join12(promptsDir, "personas", "common.md");
-  if (!existsSync10(commonPath)) return readFileSync10(briefPath, "utf8");
+  if (!existsSync11(commonPath)) return readFileSync10(briefPath, "utf8");
   return `${readFileSync10(commonPath, "utf8")}${readFileSync10(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route, role, opts) {
@@ -7693,6 +7725,25 @@ async function fetchLatestHistoryId(route, agentsModelId, recordId, userAgent) {
     return void 0;
   }
 }
+function isAdminRole(role) {
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+async function fetchKeyRole(route, userAgent) {
+  if (!route.resolved) return void 0;
+  try {
+    const res = await fetch(`${route.baseUrl.replace(/\/+$/, "")}/api/auth/me?workspaceId=${route.resolved.workspaceId}`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (!res.ok) return void 0;
+    const me = await res.json();
+    return typeof me.role === "string" ? me.role : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isForbidden(e) {
+  return e instanceof TablationApiError && e.status === 403;
+}
 function promptSourceFields(model, prompt) {
   return model.fields?.some((f) => f.columnName === "prompt_baseline") ? { prompt_source: "crew", prompt_baseline: prompt } : {};
 }
@@ -7736,6 +7787,16 @@ async function syncPersonas(route, opts) {
     const name = PERSONA_NAME[role];
     const defaultPrompt = personaDefaultPrompt(route.promptsDir, role);
     const row = rows.find((r) => r.name === name);
+    if (opts.readOnly) {
+      if (!row) {
+        outcomes.push({ role, action: "missing", agentId: "" });
+        continue;
+      }
+      const prior = cache[role]?.agentId === row.id ? cache[role] : void 0;
+      agentPersonas[role] = { agentId: row.id, lastSyncedUpdatedAt: prior?.lastSyncedUpdatedAt ?? row.updated_at, ...prior?.historyId ? { historyId: prior.historyId } : {} };
+      outcomes.push({ role, action: "adopted", agentId: row.id });
+      continue;
+    }
     if (!row) {
       if (opts.dryRun) {
         outcomes.push({ role, action: "created", agentId: "(dry run)" });
@@ -7837,35 +7898,70 @@ async function syncPersonas(route, opts) {
       throw e;
     }
   }
-  const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent);
-  const releaseAgentId = opts.dryRun ? route.resolved.releaseAgentId : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent);
-  return { outcomes, agentPersonas, crewLinks, ...releaseAgentId ? { releaseAgentId } : {} };
+  const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent, opts.readOnly === true);
+  const release = opts.dryRun ? { agentId: route.resolved.releaseAgentId } : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent, opts.readOnly === true);
+  return {
+    outcomes,
+    agentPersonas,
+    crewLinks,
+    ...release.agentId ? { releaseAgentId: release.agentId } : {},
+    ...release.note ? { releaseNote: release.note } : {},
+    ...opts.readOnly ? { readOnly: true } : {}
+  };
 }
-async function linkReleaseSeat(route, client2, agentsModel, userAgent) {
+async function linkReleaseSeat(route, client2, agentsModel, userAgent, readOnly) {
   const seatId = route.resolved.releaseSeat;
-  if (!seatId) return void 0;
+  if (!seatId) return {};
   const rows = await client2.records.list(agentsModel.id, { limit: 200 });
-  const agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id ?? (await client2.records.create(agentsModel.id, {
-    name: RELEASE_AGENT_NAME,
-    prompt: RELEASE_AGENT_PROMPT,
-    ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
-  })).id;
+  let agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id;
+  if (!agentId) {
+    if (readOnly) return { note: `Release: no "${RELEASE_AGENT_NAME}" Agents row in this workspace \u2014 writes as the ship until a workspace admin runs \`crew agents sync\`` };
+    try {
+      agentId = (await client2.records.create(agentsModel.id, {
+        name: RELEASE_AGENT_NAME,
+        prompt: RELEASE_AGENT_PROMPT,
+        ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
+      })).id;
+    } catch (e) {
+      if (isForbidden(e)) return { note: `Release: could not create the "${RELEASE_AGENT_NAME}" Agents row (${NO_WRITE_NOTE}) \u2014 writes as the ship` };
+      throw e;
+    }
+  }
   const crewModelId = route.resolved.models.crew;
   const crewModel = await client2.dataModels.get(crewModelId);
-  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  let columnName;
+  try {
+    columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  } catch (e) {
+    if (e instanceof CrewAgentFieldMissing) return { note: `Release: ${CREW_FIELD_MISSING_NOTE}` };
+    throw e;
+  }
   const seatRow = await client2.records.get(crewModelId, seatId);
   if (seatRow[CREW_AGENT_COLUMN] !== agentId) await client2.records.update(crewModelId, seatId, { [columnName]: agentId });
-  return agentId;
+  return { agentId };
 }
-async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent) {
+var NO_WRITE_NOTE = "this key has no write access to the Agents table";
+var CREW_FIELD_MISSING_NOTE = "Crew table has no Agent field yet \u2014 a workspace admin's `crew agents sync` adds it";
+var CrewAgentFieldMissing = class extends Error {
+};
+async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent, readOnly) {
   const seats2 = route.resolved.seats;
   const rolesWithSeats = ROLE_NAMES.filter((role) => seats2[role] && agentPersonas[role]);
   if (rolesWithSeats.length === 0) {
+    if (readOnly) return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "no_agents_row" : "no_seat" }));
     return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "persona_diverged" : "no_seat" }));
   }
   const crewModelId = route.resolved.models.crew;
   const crewModel = await client2.dataModels.get(crewModelId);
-  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModelId, userAgent);
+  let columnName;
+  try {
+    columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModelId, userAgent);
+  } catch (e) {
+    if (e instanceof CrewAgentFieldMissing) {
+      return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "no_agent_field" : "no_seat" }));
+    }
+    throw e;
+  }
   const outcomes = [];
   for (const role of ROLE_NAMES) {
     const seatId = seats2[role];
@@ -7875,7 +7971,7 @@ async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userA
       continue;
     }
     if (!agentId) {
-      outcomes.push({ role, action: "persona_diverged" });
+      outcomes.push({ role, action: readOnly ? "no_agents_row" : "persona_diverged" });
       continue;
     }
     const seatRow = await client2.records.get(crewModelId, seatId);
@@ -7916,6 +8012,7 @@ async function ensureCrewAgentField(route, client2, crewModel, agentsModelId, us
       description: "The Agents-table row backing this seat's persona \u2014 set by `crew agents sync` (ISSUE-416), never edited by hand."
     })
   });
+  if (createRes.status === 403) throw new CrewAgentFieldMissing();
   if (!createRes.ok) throw new AgentsSyncError(`creating the Crew table's Agent field failed: ${createRes.status} ${createRes.statusText}`);
   const created = await createRes.json();
   return created.columnName;
@@ -7933,6 +8030,10 @@ function describeSyncOutcome(o) {
       return `${label}: HAS LOCAL EDITS \u2014 crew's default is newer but was NOT applied; review ${o.agentId} in the app before syncing again`;
     case "overridden":
       return `${label}: override in place \u2014 prompt not synced (clear "Customize prompt" on the Agents row to resume)`;
+    case "adopted":
+      return `${label}: using the workspace's existing Agents row (${o.agentId})`;
+    case "missing":
+      return `${label}: no Agents row in this workspace \u2014 writes as the ship until a workspace admin runs \`crew agents sync\``;
     case "forced":
       return `${label}: --force overwrote local edits (previous prompt was: ${JSON.stringify(o.previousPrompt ?? "")})`;
   }
@@ -7946,6 +8047,10 @@ function describeCrewLink(o) {
       return `${label}: Crew row already references its Agents row`;
     case "no_seat":
       return `${label}: no seat configured for this role \u2014 skipped linking`;
+    case "no_agent_field":
+      return `${label}: ${CREW_FIELD_MISSING_NOTE}`;
+    case "no_agents_row":
+      return `${label}: no Agents row to link yet \u2014 a workspace admin's \`crew agents sync\` creates it; run it here afterwards to link this seat`;
     case "persona_diverged":
       return `${label}: persona has local edits and was not synced this pass \u2014 skipped linking until it's resolved`;
   }
@@ -7969,7 +8074,7 @@ function parseSkillFile(path) {
 }
 function listLocalSkills(promptsDir) {
   const dir = join13(promptsDir, "skills");
-  if (!existsSync11(dir)) return [];
+  if (!existsSync12(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join13(dir, f)));
 }
 async function syncSkills(route, opts) {
@@ -8222,17 +8327,17 @@ var AgentSpawnError = class extends AgentError {
 };
 function planAgentRun(o) {
   const briefPath = join14(o.route.promptsDir, "personas", `lane-${o.role}.md`);
-  if (!existsSync12(briefPath)) {
+  if (!existsSync13(briefPath)) {
     throw new AgentError(`no brief at ${briefPath} \u2014 refusing to run an unscoped session`);
   }
   const commonPath = join14(o.route.promptsDir, "personas", "common.md");
-  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync12(commonPath);
+  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync13(commonPath);
   const now = o.now ?? (() => Date.now());
   const routeLabel = routeSlug(o.route.route);
   const digestPath2 = join14(o.stateDir, `digest-${routeLabel}-${o.role}.md`);
   let digest;
   let ageSeconds;
-  if (existsSync12(digestPath2)) {
+  if (existsSync13(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync5(digestPath2).mtimeMs) / 1e3);
     if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync12(digestPath2, "utf8");
   }
@@ -8735,12 +8840,12 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
 }
 
 // src/run-worktree.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { dirname as dirname7, join as join16 } from "path";
 
 // src/ports.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { join as join15 } from "path";
 var run = (cmd, args) => {
   try {
@@ -8786,7 +8891,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync13(join15(parent, name, ".git"))) return true;
+    if (existsSync14(join15(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -8862,7 +8967,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const existing = worktreeForNumber(dir, num);
   const located = locateBranchForTicket(dir, cfg, t, role);
   const baseRef = hasRemote ? `${remote}/${base}` : base;
-  if (existing && !existing.prunable && existsSync14(existing.path)) {
+  if (existing && !existing.prunable && existsSync15(existing.path)) {
     const branch = existing.branch;
     if (status(existing.path).length > 0) {
       return { action: opts.resumeInterrupted ? "resume-dirty" : "leave-dirty", path: existing.path, branch };
@@ -8927,7 +9032,7 @@ function worktreeHoldsUnpushed(path, remote) {
 }
 async function finishRunWorktree(dir, cfg, branch) {
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (!wt || !existsSync14(wt.path)) return { kind: "none" };
+  if (!wt || !existsSync15(wt.path)) return { kind: "none" };
   if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
   if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
   if (remoteConfigured(dir, cfg.branch.remote) && worktreeHoldsUnpushed(wt.path, cfg.branch.remote)) {
@@ -8939,7 +9044,7 @@ async function finishRunWorktree(dir, cfg, branch) {
     if (pids.length) await killGently(pids);
   }
   gitOk(dir, ["worktree", "remove", wt.path]);
-  return existsSync14(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+  return existsSync15(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
 }
 
 // src/handoff-guard.ts
@@ -9175,12 +9280,12 @@ async function guardRunStrays(route, ship, tracker, role, workingId, since2, log
 
 // src/connect-wizard.ts
 import { delimiter, dirname as dirname8, join as join17 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync16, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync15;
+  const exists = opts.configExists ?? existsSync16;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -9292,7 +9397,7 @@ Wrote ${o.configPath}.
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync16, copyFileSync, mkdirSync as mkdirSync8, mkdtempSync, rmSync as rmSync7 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync17, copyFileSync, mkdirSync as mkdirSync8, mkdtempSync, rmSync as rmSync7 } from "fs";
 import { dirname as dirname9, join as join18 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
@@ -9983,7 +10088,7 @@ async function bump(o, size) {
   }
   const files = o.repo.release.versionFiles.map((f) => join18(o.cwd, f));
   const first = files[0];
-  if (!existsSync16(first)) {
+  if (!existsSync17(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
@@ -10019,7 +10124,7 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync16(path) ? readFileSync13(path, "utf8") : "# Changelog\n";
+  const existing = existsSync17(path) ? readFileSync13(path, "utf8") : "# Changelog\n";
   writeFileSync10(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
@@ -10125,7 +10230,7 @@ function openReleaseCheckout(o) {
   }
   for (const f of o.repo.worktrees.copy) {
     const src = join18(o.cwd, f);
-    if (!existsSync16(src)) continue;
+    if (!existsSync17(src)) continue;
     mkdirSync8(dirname9(join18(dir, f)), { recursive: true });
     copyFileSync(src, join18(dir, f));
   }
@@ -10710,7 +10815,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync17, statSync as statSync6, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync18, statSync as statSync6, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -10811,7 +10916,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync17(file)) return { events: [], offset: from };
+  if (!existsSync18(file)) return { events: [], offset: from };
   const size = statSync6(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -11443,6 +11548,12 @@ import {
 // src/seat-keys.ts
 import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
 var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function keyIsAdmin(route) {
+  const role = route.resolved?.role;
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
+var MEMBER_NO_KEY = "no agent key for this seat \u2014 minting needs a workspace admin key";
 function seatKeySlug(workspaceSlug, agentId) {
   return `${workspaceSlug}#agent:${agentId}`;
 }
@@ -11456,11 +11567,11 @@ function seatAgentId(route, role) {
 async function resolveReleaseKey(route, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   const agentId = route.resolved?.releaseAgentId;
-  if (!agentId) return ship("release seat has no linked Agents row (run `crew agents sync`)");
+  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
   try {
     const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship("no agent key stored for the release seat (run `crew agents sync`)");
+    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch {
     return ship("OS keychain unavailable");
   }
@@ -11469,11 +11580,11 @@ async function resolveSeatKey(route, role, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
   const agentId = seatAgentId(route, role);
-  if (!agentId) return ship("seat has no linked Agents row (run `crew agents sync`)");
+  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
   try {
     const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship("no agent key stored for this seat (run `crew agents sync`)");
+    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch {
     return ship("OS keychain unavailable");
   }
@@ -11830,7 +11941,7 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 import { basename as basename8 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -11866,7 +11977,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin")
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && existsSync18(a.path)) {
+    if (!dryRun && existsSync19(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -11880,7 +11991,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin")
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync18(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync19(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       log.warn(
         `not removing worktree ${a.path} for ${a.ticket.issue_id} (${a.ticket.status}): ${a.branch} has commits that are not on ${remote}`,
         { ticket: a.ticket.issue_id, step: "worktree" }
@@ -12012,12 +12123,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync19, readdirSync as readdirSync5, rmSync as rmSync8, statSync as statSync7 } from "fs";
+import { existsSync as existsSync20, readdirSync as readdirSync5, rmSync as rmSync8, statSync as statSync7 } from "fs";
 import { join as join19 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join19(stateDir, "streams");
-  if (!existsSync19(dir)) return [];
+  if (!existsSync20(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync5(dir).map((name) => join19(dir, name)).filter((path) => {
     try {
@@ -12045,7 +12156,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync19(stateDir)) return [];
+  if (!existsSync20(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync5(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join19(stateDir, name)).filter((path) => {
     try {
@@ -12057,13 +12168,13 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync19, existsSync as existsSync25, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync19, existsSync as existsSync26, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync14, chmodSync } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync14, chmodSync } from "fs";
 import { dirname as dirname11, join as join20 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -12073,7 +12184,7 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync20(privateKeyPath)) {
+  if (!existsSync21(privateKeyPath)) {
     mkdirSync9(dirname11(privateKeyPath), { recursive: true });
     try {
       execFileSync3("ssh-keygen", [
@@ -12094,7 +12205,7 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync(privateKeyPath, 384);
   }
-  if (!existsSync20(publicKeyPath)) {
+  if (!existsSync21(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
   const publicKey = readFileSync14(publicKeyPath, "utf8").trim();
@@ -12313,7 +12424,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync11, unlinkSync as unlinkSync3, readdirSync as readdirSync6 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync11, unlinkSync as unlinkSync3, readdirSync as readdirSync6 } from "fs";
 import { randomInt } from "crypto";
 import { join as join21 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -12386,7 +12497,7 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync21(path)) return void 0;
+  if (!existsSync22(path)) return void 0;
   try {
     return JSON.parse(readFileSync15(path, "utf8"));
   } catch {
@@ -12494,7 +12605,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join21(stateDir, "passengers");
-  if (!existsSync21(dir)) return [];
+  if (!existsSync22(dir)) return [];
   return readdirSync6(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -12615,7 +12726,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn4 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync12, unlinkSync as unlinkSync4, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync12, unlinkSync as unlinkSync4, readdirSync as readdirSync7 } from "fs";
 import { join as join22 } from "path";
 
 // src/secret-compare.ts
@@ -12709,7 +12820,7 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync22(path)) return void 0;
+  if (!existsSync23(path)) return void 0;
   try {
     return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
@@ -12740,7 +12851,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join22(stateDir, "passengers");
-  if (!existsSync22(dir)) return [];
+  if (!existsSync23(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync7(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -12797,11 +12908,11 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync18, readdirSync as readdirSync9, rmSync as rmSync9, statSync as statSync8, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, readdirSync as readdirSync9, rmSync as rmSync9, statSync as statSync8, writeFileSync as writeFileSync13 } from "fs";
 import { join as join24 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync23, readdirSync as readdirSync8, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync24, readdirSync as readdirSync8, readFileSync as readFileSync17 } from "fs";
 import { join as join23 } from "path";
 var INTERRUPTED_MARKER = "<!-- crew:interrupted -->";
 function interruptedComment(b) {
@@ -12820,7 +12931,7 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync23(path)) return false;
+  if (!existsSync24(path)) return false;
   try {
     return JSON.parse(readFileSync17(path, "utf8")).running !== true;
   } catch {
@@ -12829,7 +12940,7 @@ function runFinished(streamPath) {
 }
 function orphanedStreams(o) {
   const dir = join23(o.stateDir, "streams");
-  if (!existsSync23(dir)) return [];
+  if (!existsSync24(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync8(dir)) {
@@ -12943,7 +13054,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync24(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync25(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join24(stateDir, "reload-requested");
@@ -13829,7 +13940,7 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join25(homedir8(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync25(staleTimer)) {
+      if (existsSync26(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -13855,7 +13966,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync25(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync26(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -13873,7 +13984,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync25(p);
+    const unitExists = (p) => existsSync26(p);
     const crontab = o.host === "linux" ? spawnSync6("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -14993,9 +15104,18 @@ ${changed2.map((c) => `  - ${c}
 `);
         process.exit(2);
       }
+      const keyRole = target.resolved.role ?? await fetchKeyRole(target, cfg.ship.userAgent);
+      let readOnly = !isAdminRole(keyRole);
       let personaResult;
+      const runPersonas = (ro) => syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force, readOnly: ro });
       try {
-        personaResult = await syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force });
+        try {
+          personaResult = await runPersonas(readOnly);
+        } catch (e) {
+          if (readOnly || !isForbidden(e)) throw e;
+          readOnly = true;
+          personaResult = await runPersonas(true);
+        }
       } catch (e) {
         if (e instanceof AgentsSyncError) {
           process.stderr.write(`crew agents sync: ${e.message}
@@ -15009,28 +15129,32 @@ ${changed2.map((c) => `  - ${c}
       for (const o of personaResult.outcomes) process.stdout.write(`${describeSyncOutcome(o)}
 `);
       for (const o of personaResult.crewLinks) process.stdout.write(`${describeCrewLink(o)}
+`);
+      if (personaResult.releaseNote) process.stdout.write(`${personaResult.releaseNote}
 `);
       const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
       for (const w of skillMarkerWarnings(target.promptsDir, briefs)) process.stderr.write(`crew agents sync: warning: ${w}
 `);
       let skillResult;
-      try {
-        skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
-      } catch (e) {
-        if (e instanceof SkillSyncError) {
-          process.stderr.write(`crew agents sync: ${e.message}
+      if (!readOnly) {
+        try {
+          skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
+        } catch (e) {
+          if (isForbidden(e)) readOnly = true;
+          else if (e instanceof SkillSyncError) {
+            process.stderr.write(`crew agents sync: ${e.message}
 `);
-          process.exit(2);
+            process.exit(2);
+          } else throw e;
         }
-        throw e;
       }
-      for (const o of skillResult.outcomes) process.stdout.write(`${describeSkillSyncOutcome(o)}
+      for (const o of skillResult?.outcomes ?? []) process.stdout.write(`${describeSkillSyncOutcome(o)}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync25(resolvedPath) ? JSON.parse(readFileSync19(resolvedPath, "utf8")) : {};
+        const raw = existsSync26(resolvedPath) ? JSON.parse(readFileSync19(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
-        raw.agentSkills = skillResult.agentSkills;
+        if (skillResult) raw.agentSkills = skillResult.agentSkills;
         if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
         writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -15040,11 +15164,16 @@ ${changed2.map((c) => `  - ${c}
         target.resolved.agentPersonas = personaResult.agentPersonas;
         if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
       }
-      for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
-        process.stdout.write(`${describeMintOutcome(o)}
+      if (readOnly) {
+        process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
+        process.stdout.write("seat keys: not minted (needs a workspace admin key)\n");
+      } else {
+        for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
+          process.stdout.write(`${describeMintOutcome(o)}
 `);
+        }
       }
-      if (personaResult.outcomes.some((o) => o.action === "diverged") || skillResult.outcomes.some((o) => o.action === "diverged")) {
+      if (personaResult.outcomes.some((o) => o.action === "diverged") || (skillResult?.outcomes.some((o) => o.action === "diverged") ?? false)) {
         process.exitCode = 1;
       }
       break;
@@ -15088,7 +15217,7 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync25(resolvedPath) ? JSON.parse(readFileSync19(resolvedPath, "utf8")) : {};
+        const raw = existsSync26(resolvedPath) ? JSON.parse(readFileSync19(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
         writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -15111,7 +15240,7 @@ ${changed2.map((c) => `  - ${c}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync25(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync26(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -15126,7 +15255,7 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync25(resolvedFile)) {
+      if (existsSync26(resolvedFile)) {
         try {
           resolvedRemotes = JSON.parse(readFileSync19(resolvedFile, "utf8"));
         } catch {
@@ -15143,14 +15272,14 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync25(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync26(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir8()));
-        const top = existsSync25(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync26(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -15199,7 +15328,7 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync25(resolvedFile)) {
+          if (existsSync26(resolvedFile)) {
             const raw = JSON.parse(readFileSync19(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
@@ -15446,7 +15575,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           operator = await pickOperator(found.holds);
         }
         let previous;
-        const hadPreviousFile = existsSync25(resolvedPath);
+        const hadPreviousFile = existsSync26(resolvedPath);
         if (hadPreviousFile) {
           try {
             previous = JSON.parse(readFileSync19(resolvedPath, "utf8"));
@@ -15493,6 +15622,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           seats: found.seats,
           holds: found.holds.map((h) => ({ id: h.id, role: h.name })),
           ...found.releaseSeat ? { releaseSeat: found.releaseSeat } : {},
+          ...found.role ?? previous?.role ? { role: found.role ?? previous?.role } : {},
           ...operator ? { operator } : {},
           ...contract ? { contract } : {},
           ...reviewedStatuses.length > 0 ? { reviewedStatuses } : {},
@@ -16351,7 +16481,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync25(evFile) ? statSync9(evFile).size : 0;
+        const evSize = existsSync26(evFile) ? statSync9(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -16409,12 +16539,10 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
           process.stdout.write(`                   - ${p2}
 `);
         }
-        const bh = baseHealth(r);
-        if (bh.action !== "not-applicable") {
-          process.stdout.write(`                   base ${config.branch.base}: ${bh.unsafe ? "ERROR \u2014 " : ""}${bh.detail}
-`);
-          if (bh.unsafe) process.exitCode = 1;
-        }
+        const dh = doctorBaseReport(r, config.branch.base, baseHealth);
+        process.stdout.write(dh.text);
+        if (dh.failed) process.exitCode = 1;
+        if (dh.skipRest) continue;
         if (config.release.ship) {
           process.stdout.write(`                   release.ship ${config.release.ship}${config.release.ship === cfg.ship.name ? " (this ship)" : ""}
 `);
@@ -16432,16 +16560,20 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       process.stdout.write(
         route.resolved?.releaseSeat ? "release seat:    this ship has its own Release Crew row\n" : "release seat:    none \u2014 release comments are credited to the dev seat; run `crew connect` once the Crew table has this ship's row\n"
       );
+      const keyRole = route.resolved?.role ?? await fetchKeyRole(route, cfg.ship.userAgent);
+      const roleRoute = route.resolved && keyRole ? { ...route, resolved: { ...route.resolved, role: keyRole } } : route;
+      process.stdout.write(`api key role:     ${keyRole ?? "unknown"}
+`);
       for (const role of SEAT_KEY_ROLES) {
         if (!route.resolved?.seats[role]) continue;
-        const id = await resolveSeatKey(route, role);
+        const id = await resolveSeatKey(roleRoute, role);
         process.stdout.write(
           `seat identity:    ${role} writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `
         );
       }
       if (route.resolved?.releaseSeat) {
-        const id = await resolveReleaseKey(route);
+        const id = await resolveReleaseKey(roleRoute);
         process.stdout.write(
           `seat identity:    release writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.50.1",
+  "version": "0.50.3",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",