@tablation/crew 0.50.2 → 0.50.3

package/dist/cli.js

@@ -2288,6 +2288,7 @@ function parseResolved(raw, m, where) {
     contract: raw.contract ?? void 0,
     ...typeof raw.releaseSeat === "string" && raw.releaseSeat ? { releaseSeat: raw.releaseSeat } : {},
     ...typeof raw.releaseAgentId === "string" && raw.releaseAgentId ? { releaseAgentId: raw.releaseAgentId } : {},
+    ...typeof raw.role === "string" && raw.role ? { role: raw.role } : {},
     ...Object.keys(agentPersonas).length > 0 ? { agentPersonas } : {},
     ...Object.keys(agentSkills).length > 0 ? { agentSkills } : {}
   };
@@ -7724,6 +7725,25 @@ async function fetchLatestHistoryId(route, agentsModelId, recordId, userAgent) {
     return void 0;
   }
 }
+function isAdminRole(role) {
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+async function fetchKeyRole(route, userAgent) {
+  if (!route.resolved) return void 0;
+  try {
+    const res = await fetch(`${route.baseUrl.replace(/\/+$/, "")}/api/auth/me?workspaceId=${route.resolved.workspaceId}`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (!res.ok) return void 0;
+    const me = await res.json();
+    return typeof me.role === "string" ? me.role : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isForbidden(e) {
+  return e instanceof TablationApiError && e.status === 403;
+}
 function promptSourceFields(model, prompt) {
   return model.fields?.some((f) => f.columnName === "prompt_baseline") ? { prompt_source: "crew", prompt_baseline: prompt } : {};
 }
@@ -7767,6 +7787,16 @@ async function syncPersonas(route, opts) {
     const name = PERSONA_NAME[role];
     const defaultPrompt = personaDefaultPrompt(route.promptsDir, role);
     const row = rows.find((r) => r.name === name);
+    if (opts.readOnly) {
+      if (!row) {
+        outcomes.push({ role, action: "missing", agentId: "" });
+        continue;
+      }
+      const prior = cache[role]?.agentId === row.id ? cache[role] : void 0;
+      agentPersonas[role] = { agentId: row.id, lastSyncedUpdatedAt: prior?.lastSyncedUpdatedAt ?? row.updated_at, ...prior?.historyId ? { historyId: prior.historyId } : {} };
+      outcomes.push({ role, action: "adopted", agentId: row.id });
+      continue;
+    }
     if (!row) {
       if (opts.dryRun) {
         outcomes.push({ role, action: "created", agentId: "(dry run)" });
@@ -7868,35 +7898,70 @@ async function syncPersonas(route, opts) {
       throw e;
     }
   }
-  const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent);
-  const releaseAgentId = opts.dryRun ? route.resolved.releaseAgentId : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent);
-  return { outcomes, agentPersonas, crewLinks, ...releaseAgentId ? { releaseAgentId } : {} };
+  const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent, opts.readOnly === true);
+  const release = opts.dryRun ? { agentId: route.resolved.releaseAgentId } : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent, opts.readOnly === true);
+  return {
+    outcomes,
+    agentPersonas,
+    crewLinks,
+    ...release.agentId ? { releaseAgentId: release.agentId } : {},
+    ...release.note ? { releaseNote: release.note } : {},
+    ...opts.readOnly ? { readOnly: true } : {}
+  };
 }
-async function linkReleaseSeat(route, client2, agentsModel, userAgent) {
+async function linkReleaseSeat(route, client2, agentsModel, userAgent, readOnly) {
   const seatId = route.resolved.releaseSeat;
-  if (!seatId) return void 0;
+  if (!seatId) return {};
   const rows = await client2.records.list(agentsModel.id, { limit: 200 });
-  const agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id ?? (await client2.records.create(agentsModel.id, {
-    name: RELEASE_AGENT_NAME,
-    prompt: RELEASE_AGENT_PROMPT,
-    ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
-  })).id;
+  let agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id;
+  if (!agentId) {
+    if (readOnly) return { note: `Release: no "${RELEASE_AGENT_NAME}" Agents row in this workspace \u2014 writes as the ship until a workspace admin runs \`crew agents sync\`` };
+    try {
+      agentId = (await client2.records.create(agentsModel.id, {
+        name: RELEASE_AGENT_NAME,
+        prompt: RELEASE_AGENT_PROMPT,
+        ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
+      })).id;
+    } catch (e) {
+      if (isForbidden(e)) return { note: `Release: could not create the "${RELEASE_AGENT_NAME}" Agents row (${NO_WRITE_NOTE}) \u2014 writes as the ship` };
+      throw e;
+    }
+  }
   const crewModelId = route.resolved.models.crew;
   const crewModel = await client2.dataModels.get(crewModelId);
-  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  let columnName;
+  try {
+    columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  } catch (e) {
+    if (e instanceof CrewAgentFieldMissing) return { note: `Release: ${CREW_FIELD_MISSING_NOTE}` };
+    throw e;
+  }
   const seatRow = await client2.records.get(crewModelId, seatId);
   if (seatRow[CREW_AGENT_COLUMN] !== agentId) await client2.records.update(crewModelId, seatId, { [columnName]: agentId });
-  return agentId;
+  return { agentId };
 }
-async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent) {
+var NO_WRITE_NOTE = "this key has no write access to the Agents table";
+var CREW_FIELD_MISSING_NOTE = "Crew table has no Agent field yet \u2014 a workspace admin's `crew agents sync` adds it";
+var CrewAgentFieldMissing = class extends Error {
+};
+async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent, readOnly) {
   const seats2 = route.resolved.seats;
   const rolesWithSeats = ROLE_NAMES.filter((role) => seats2[role] && agentPersonas[role]);
   if (rolesWithSeats.length === 0) {
+    if (readOnly) return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "no_agents_row" : "no_seat" }));
     return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "persona_diverged" : "no_seat" }));
   }
   const crewModelId = route.resolved.models.crew;
   const crewModel = await client2.dataModels.get(crewModelId);
-  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModelId, userAgent);
+  let columnName;
+  try {
+    columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModelId, userAgent);
+  } catch (e) {
+    if (e instanceof CrewAgentFieldMissing) {
+      return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "no_agent_field" : "no_seat" }));
+    }
+    throw e;
+  }
   const outcomes = [];
   for (const role of ROLE_NAMES) {
     const seatId = seats2[role];
@@ -7906,7 +7971,7 @@ async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userA
       continue;
     }
     if (!agentId) {
-      outcomes.push({ role, action: "persona_diverged" });
+      outcomes.push({ role, action: readOnly ? "no_agents_row" : "persona_diverged" });
       continue;
     }
     const seatRow = await client2.records.get(crewModelId, seatId);
@@ -7947,6 +8012,7 @@ async function ensureCrewAgentField(route, client2, crewModel, agentsModelId, us
       description: "The Agents-table row backing this seat's persona \u2014 set by `crew agents sync` (ISSUE-416), never edited by hand."
     })
   });
+  if (createRes.status === 403) throw new CrewAgentFieldMissing();
   if (!createRes.ok) throw new AgentsSyncError(`creating the Crew table's Agent field failed: ${createRes.status} ${createRes.statusText}`);
   const created = await createRes.json();
   return created.columnName;
@@ -7964,6 +8030,10 @@ function describeSyncOutcome(o) {
       return `${label}: HAS LOCAL EDITS \u2014 crew's default is newer but was NOT applied; review ${o.agentId} in the app before syncing again`;
     case "overridden":
       return `${label}: override in place \u2014 prompt not synced (clear "Customize prompt" on the Agents row to resume)`;
+    case "adopted":
+      return `${label}: using the workspace's existing Agents row (${o.agentId})`;
+    case "missing":
+      return `${label}: no Agents row in this workspace \u2014 writes as the ship until a workspace admin runs \`crew agents sync\``;
     case "forced":
       return `${label}: --force overwrote local edits (previous prompt was: ${JSON.stringify(o.previousPrompt ?? "")})`;
   }
@@ -7977,6 +8047,10 @@ function describeCrewLink(o) {
       return `${label}: Crew row already references its Agents row`;
     case "no_seat":
       return `${label}: no seat configured for this role \u2014 skipped linking`;
+    case "no_agent_field":
+      return `${label}: ${CREW_FIELD_MISSING_NOTE}`;
+    case "no_agents_row":
+      return `${label}: no Agents row to link yet \u2014 a workspace admin's \`crew agents sync\` creates it; run it here afterwards to link this seat`;
     case "persona_diverged":
       return `${label}: persona has local edits and was not synced this pass \u2014 skipped linking until it's resolved`;
   }
@@ -11474,6 +11548,12 @@ import {
 // src/seat-keys.ts
 import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
 var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function keyIsAdmin(route) {
+  const role = route.resolved?.role;
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
+var MEMBER_NO_KEY = "no agent key for this seat \u2014 minting needs a workspace admin key";
 function seatKeySlug(workspaceSlug, agentId) {
   return `${workspaceSlug}#agent:${agentId}`;
 }
@@ -11487,11 +11567,11 @@ function seatAgentId(route, role) {
 async function resolveReleaseKey(route, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   const agentId = route.resolved?.releaseAgentId;
-  if (!agentId) return ship("release seat has no linked Agents row (run `crew agents sync`)");
+  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
   try {
     const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship("no agent key stored for the release seat (run `crew agents sync`)");
+    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch {
     return ship("OS keychain unavailable");
   }
@@ -11500,11 +11580,11 @@ async function resolveSeatKey(route, role, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
   const agentId = seatAgentId(route, role);
-  if (!agentId) return ship("seat has no linked Agents row (run `crew agents sync`)");
+  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
   try {
     const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship("no agent key stored for this seat (run `crew agents sync`)");
+    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch {
     return ship("OS keychain unavailable");
   }
@@ -15024,9 +15104,18 @@ ${changed2.map((c) => `  - ${c}
 `);
         process.exit(2);
       }
+      const keyRole = target.resolved.role ?? await fetchKeyRole(target, cfg.ship.userAgent);
+      let readOnly = !isAdminRole(keyRole);
       let personaResult;
+      const runPersonas = (ro) => syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force, readOnly: ro });
       try {
-        personaResult = await syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force });
+        try {
+          personaResult = await runPersonas(readOnly);
+        } catch (e) {
+          if (readOnly || !isForbidden(e)) throw e;
+          readOnly = true;
+          personaResult = await runPersonas(true);
+        }
       } catch (e) {
         if (e instanceof AgentsSyncError) {
           process.stderr.write(`crew agents sync: ${e.message}
@@ -15040,28 +15129,32 @@ ${changed2.map((c) => `  - ${c}
       for (const o of personaResult.outcomes) process.stdout.write(`${describeSyncOutcome(o)}
 `);
       for (const o of personaResult.crewLinks) process.stdout.write(`${describeCrewLink(o)}
+`);
+      if (personaResult.releaseNote) process.stdout.write(`${personaResult.releaseNote}
 `);
       const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
       for (const w of skillMarkerWarnings(target.promptsDir, briefs)) process.stderr.write(`crew agents sync: warning: ${w}
 `);
       let skillResult;
-      try {
-        skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
-      } catch (e) {
-        if (e instanceof SkillSyncError) {
-          process.stderr.write(`crew agents sync: ${e.message}
+      if (!readOnly) {
+        try {
+          skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
+        } catch (e) {
+          if (isForbidden(e)) readOnly = true;
+          else if (e instanceof SkillSyncError) {
+            process.stderr.write(`crew agents sync: ${e.message}
 `);
-          process.exit(2);
+            process.exit(2);
+          } else throw e;
         }
-        throw e;
       }
-      for (const o of skillResult.outcomes) process.stdout.write(`${describeSkillSyncOutcome(o)}
+      for (const o of skillResult?.outcomes ?? []) process.stdout.write(`${describeSkillSyncOutcome(o)}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
         const raw = existsSync26(resolvedPath) ? JSON.parse(readFileSync19(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
-        raw.agentSkills = skillResult.agentSkills;
+        if (skillResult) raw.agentSkills = skillResult.agentSkills;
         if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
         writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -15071,11 +15164,16 @@ ${changed2.map((c) => `  - ${c}
         target.resolved.agentPersonas = personaResult.agentPersonas;
         if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
       }
-      for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
-        process.stdout.write(`${describeMintOutcome(o)}
+      if (readOnly) {
+        process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
+        process.stdout.write("seat keys: not minted (needs a workspace admin key)\n");
+      } else {
+        for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
+          process.stdout.write(`${describeMintOutcome(o)}
 `);
+        }
       }
-      if (personaResult.outcomes.some((o) => o.action === "diverged") || skillResult.outcomes.some((o) => o.action === "diverged")) {
+      if (personaResult.outcomes.some((o) => o.action === "diverged") || (skillResult?.outcomes.some((o) => o.action === "diverged") ?? false)) {
         process.exitCode = 1;
       }
       break;
@@ -15524,6 +15622,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           seats: found.seats,
           holds: found.holds.map((h) => ({ id: h.id, role: h.name })),
           ...found.releaseSeat ? { releaseSeat: found.releaseSeat } : {},
+          ...found.role ?? previous?.role ? { role: found.role ?? previous?.role } : {},
           ...operator ? { operator } : {},
           ...contract ? { contract } : {},
           ...reviewedStatuses.length > 0 ? { reviewedStatuses } : {},
@@ -16461,16 +16560,20 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       process.stdout.write(
         route.resolved?.releaseSeat ? "release seat:    this ship has its own Release Crew row\n" : "release seat:    none \u2014 release comments are credited to the dev seat; run `crew connect` once the Crew table has this ship's row\n"
       );
+      const keyRole = route.resolved?.role ?? await fetchKeyRole(route, cfg.ship.userAgent);
+      const roleRoute = route.resolved && keyRole ? { ...route, resolved: { ...route.resolved, role: keyRole } } : route;
+      process.stdout.write(`api key role:     ${keyRole ?? "unknown"}
+`);
       for (const role of SEAT_KEY_ROLES) {
         if (!route.resolved?.seats[role]) continue;
-        const id = await resolveSeatKey(route, role);
+        const id = await resolveSeatKey(roleRoute, role);
         process.stdout.write(
           `seat identity:    ${role} writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `
         );
       }
       if (route.resolved?.releaseSeat) {
-        const id = await resolveReleaseKey(route);
+        const id = await resolveReleaseKey(roleRoute);
         process.stdout.write(
           `seat identity:    release writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.50.2",
+  "version": "0.50.3",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",