@tablation/crew 0.50.2 → 0.51.0

package/dist/cli.js

@@ -2288,6 +2288,7 @@ function parseResolved(raw, m, where) {
     contract: raw.contract ?? void 0,
     ...typeof raw.releaseSeat === "string" && raw.releaseSeat ? { releaseSeat: raw.releaseSeat } : {},
     ...typeof raw.releaseAgentId === "string" && raw.releaseAgentId ? { releaseAgentId: raw.releaseAgentId } : {},
+    ...typeof raw.role === "string" && raw.role ? { role: raw.role } : {},
     ...Object.keys(agentPersonas).length > 0 ? { agentPersonas } : {},
     ...Object.keys(agentSkills).length > 0 ? { agentSkills } : {}
   };
@@ -7724,6 +7725,25 @@ async function fetchLatestHistoryId(route, agentsModelId, recordId, userAgent) {
     return void 0;
   }
 }
+function isAdminRole(role) {
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+async function fetchKeyRole(route, userAgent) {
+  if (!route.resolved) return void 0;
+  try {
+    const res = await fetch(`${route.baseUrl.replace(/\/+$/, "")}/api/auth/me?workspaceId=${route.resolved.workspaceId}`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (!res.ok) return void 0;
+    const me = await res.json();
+    return typeof me.role === "string" ? me.role : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isForbidden(e) {
+  return e instanceof TablationApiError && e.status === 403;
+}
 function promptSourceFields(model, prompt) {
   return model.fields?.some((f) => f.columnName === "prompt_baseline") ? { prompt_source: "crew", prompt_baseline: prompt } : {};
 }
@@ -7767,6 +7787,16 @@ async function syncPersonas(route, opts) {
     const name = PERSONA_NAME[role];
     const defaultPrompt = personaDefaultPrompt(route.promptsDir, role);
     const row = rows.find((r) => r.name === name);
+    if (opts.readOnly) {
+      if (!row) {
+        outcomes.push({ role, action: "missing", agentId: "" });
+        continue;
+      }
+      const prior = cache[role]?.agentId === row.id ? cache[role] : void 0;
+      agentPersonas[role] = { agentId: row.id, lastSyncedUpdatedAt: prior?.lastSyncedUpdatedAt ?? row.updated_at, ...prior?.historyId ? { historyId: prior.historyId } : {} };
+      outcomes.push({ role, action: "adopted", agentId: row.id });
+      continue;
+    }
     if (!row) {
       if (opts.dryRun) {
         outcomes.push({ role, action: "created", agentId: "(dry run)" });
@@ -7868,35 +7898,70 @@ async function syncPersonas(route, opts) {
       throw e;
     }
   }
-  const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent);
-  const releaseAgentId = opts.dryRun ? route.resolved.releaseAgentId : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent);
-  return { outcomes, agentPersonas, crewLinks, ...releaseAgentId ? { releaseAgentId } : {} };
+  const crewLinks = opts.dryRun ? [] : await linkCrewSeats(route, client2, agentsModel.id, agentPersonas, opts.userAgent, opts.readOnly === true);
+  const release = opts.dryRun ? { agentId: route.resolved.releaseAgentId } : await linkReleaseSeat(route, client2, agentsModel, opts.userAgent, opts.readOnly === true);
+  return {
+    outcomes,
+    agentPersonas,
+    crewLinks,
+    ...release.agentId ? { releaseAgentId: release.agentId } : {},
+    ...release.note ? { releaseNote: release.note } : {},
+    ...opts.readOnly ? { readOnly: true } : {}
+  };
 }
-async function linkReleaseSeat(route, client2, agentsModel, userAgent) {
+async function linkReleaseSeat(route, client2, agentsModel, userAgent, readOnly) {
   const seatId = route.resolved.releaseSeat;
-  if (!seatId) return void 0;
+  if (!seatId) return {};
   const rows = await client2.records.list(agentsModel.id, { limit: 200 });
-  const agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id ?? (await client2.records.create(agentsModel.id, {
-    name: RELEASE_AGENT_NAME,
-    prompt: RELEASE_AGENT_PROMPT,
-    ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
-  })).id;
+  let agentId = rows.find((r) => r.name === RELEASE_AGENT_NAME)?.id;
+  if (!agentId) {
+    if (readOnly) return { note: `Release: no "${RELEASE_AGENT_NAME}" Agents row in this workspace \u2014 writes as the ship until a workspace admin runs \`crew agents sync\`` };
+    try {
+      agentId = (await client2.records.create(agentsModel.id, {
+        name: RELEASE_AGENT_NAME,
+        prompt: RELEASE_AGENT_PROMPT,
+        ...promptSourceFields(agentsModel, RELEASE_AGENT_PROMPT)
+      })).id;
+    } catch (e) {
+      if (isForbidden(e)) return { note: `Release: could not create the "${RELEASE_AGENT_NAME}" Agents row (${NO_WRITE_NOTE}) \u2014 writes as the ship` };
+      throw e;
+    }
+  }
   const crewModelId = route.resolved.models.crew;
   const crewModel = await client2.dataModels.get(crewModelId);
-  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  let columnName;
+  try {
+    columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModel.id, userAgent);
+  } catch (e) {
+    if (e instanceof CrewAgentFieldMissing) return { note: `Release: ${CREW_FIELD_MISSING_NOTE}` };
+    throw e;
+  }
   const seatRow = await client2.records.get(crewModelId, seatId);
   if (seatRow[CREW_AGENT_COLUMN] !== agentId) await client2.records.update(crewModelId, seatId, { [columnName]: agentId });
-  return agentId;
+  return { agentId };
 }
-async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent) {
+var NO_WRITE_NOTE = "this key has no write access to the Agents table";
+var CREW_FIELD_MISSING_NOTE = "Crew table has no Agent field yet \u2014 a workspace admin's `crew agents sync` adds it";
+var CrewAgentFieldMissing = class extends Error {
+};
+async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userAgent, readOnly) {
   const seats2 = route.resolved.seats;
   const rolesWithSeats = ROLE_NAMES.filter((role) => seats2[role] && agentPersonas[role]);
   if (rolesWithSeats.length === 0) {
+    if (readOnly) return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "no_agents_row" : "no_seat" }));
     return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "persona_diverged" : "no_seat" }));
   }
   const crewModelId = route.resolved.models.crew;
   const crewModel = await client2.dataModels.get(crewModelId);
-  const columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModelId, userAgent);
+  let columnName;
+  try {
+    columnName = await ensureCrewAgentField(route, client2, crewModel, agentsModelId, userAgent);
+  } catch (e) {
+    if (e instanceof CrewAgentFieldMissing) {
+      return ROLE_NAMES.map((role) => ({ role, action: seats2[role] ? "no_agent_field" : "no_seat" }));
+    }
+    throw e;
+  }
   const outcomes = [];
   for (const role of ROLE_NAMES) {
     const seatId = seats2[role];
@@ -7906,7 +7971,7 @@ async function linkCrewSeats(route, client2, agentsModelId, agentPersonas, userA
       continue;
     }
     if (!agentId) {
-      outcomes.push({ role, action: "persona_diverged" });
+      outcomes.push({ role, action: readOnly ? "no_agents_row" : "persona_diverged" });
       continue;
     }
     const seatRow = await client2.records.get(crewModelId, seatId);
@@ -7947,6 +8012,7 @@ async function ensureCrewAgentField(route, client2, crewModel, agentsModelId, us
       description: "The Agents-table row backing this seat's persona \u2014 set by `crew agents sync` (ISSUE-416), never edited by hand."
     })
   });
+  if (createRes.status === 403) throw new CrewAgentFieldMissing();
   if (!createRes.ok) throw new AgentsSyncError(`creating the Crew table's Agent field failed: ${createRes.status} ${createRes.statusText}`);
   const created = await createRes.json();
   return created.columnName;
@@ -7964,6 +8030,10 @@ function describeSyncOutcome(o) {
       return `${label}: HAS LOCAL EDITS \u2014 crew's default is newer but was NOT applied; review ${o.agentId} in the app before syncing again`;
     case "overridden":
       return `${label}: override in place \u2014 prompt not synced (clear "Customize prompt" on the Agents row to resume)`;
+    case "adopted":
+      return `${label}: using the workspace's existing Agents row (${o.agentId})`;
+    case "missing":
+      return `${label}: no Agents row in this workspace \u2014 writes as the ship until a workspace admin runs \`crew agents sync\``;
     case "forced":
       return `${label}: --force overwrote local edits (previous prompt was: ${JSON.stringify(o.previousPrompt ?? "")})`;
   }
@@ -7977,6 +8047,10 @@ function describeCrewLink(o) {
       return `${label}: Crew row already references its Agents row`;
     case "no_seat":
       return `${label}: no seat configured for this role \u2014 skipped linking`;
+    case "no_agent_field":
+      return `${label}: ${CREW_FIELD_MISSING_NOTE}`;
+    case "no_agents_row":
+      return `${label}: no Agents row to link yet \u2014 a workspace admin's \`crew agents sync\` creates it; run it here afterwards to link this seat`;
     case "persona_diverged":
       return `${label}: persona has local edits and was not synced this pass \u2014 skipped linking until it's resolved`;
   }
@@ -11207,6 +11281,7 @@ async function discover(o) {
     out.role = me.role;
     out.meEmail = me.email;
     out.meId = me.id;
+    out.meName = me.name;
   } catch {
   }
   if (o.project) {
@@ -11430,18 +11505,72 @@ async function discover(o) {
       }
     }
     const seatIds = /* @__PURE__ */ new Set([...Object.values(out.seats), ...out.releaseSeat ? [out.releaseSeat] : []]);
-    out.holds = rows.filter((r) => !seatIds.has(r.id)).map((r) => ({ id: r.id, name: r.name ?? "" }));
-    if (out.holds.length === 0) {
-      problems.push("no non-seat Crew rows \u2014 which row is the operator?");
-    } else if (out.meEmail) {
-      const holdRows = rows.filter((r) => !seatIds.has(r.id));
-      const matches2 = holdRows.filter((r) => eq(r.email, out.meEmail));
-      if (matches2.length === 1) out.operator = matches2[0].id;
+    const holdRows = rows.filter((r) => !seatIds.has(r.id));
+    out.holds = holdRows.map((r) => ({ id: r.id, name: r.name ?? "", email: r.email, user_id: r.user_id }));
+    out.crewModelId = out.models.crew;
+    if (!out.meId) {
+      if (out.holds.length === 0) problems.push("no non-seat Crew rows \u2014 which row is the operator?");
+      else {
+        const byEmail = out.meEmail ? holdRows.filter((r) => eq(r.email, out.meEmail)) : [];
+        if (byEmail.length === 1) out.operator = byEmail[0].id;
+        else if (out.holds.length === 1) out.operator = out.holds[0].id;
+      }
+    } else {
+      const candidates = holdRows.filter((r) => !r.user_id || r.user_id === out.meId);
+      const mine = holdRows.find((r) => r.user_id === out.meId);
+      const byEmail = out.meEmail ? candidates.filter((r) => eq(r.email, out.meEmail)) : [];
+      const only = holdRows.length === 1 && candidates.length === 1 ? candidates[0] : void 0;
+      const pick = mine ?? (byEmail.length === 1 ? byEmail[0] : only);
+      if (pick) {
+        out.operator = pick.id;
+        if (pick.user_id !== out.meId && o.ship) await linkOperatorRow(o, out, pick);
+      } else if (o.ship && (!o.interactive || candidates.length === 0)) {
+        await createOperatorRow(o, out);
+      }
     }
-    if (!out.operator && out.holds.length === 1) out.operator = out.holds[0].id;
   }
   return out;
 }
+async function linkOperatorRow(o, found, row) {
+  const name = row.name || row.id;
+  if (!found.meId || !found.crewModelId) return;
+  if (o.dryRun) {
+    found.provisioning.push(`would link Crew row "${name}" to your account`);
+    return;
+  }
+  const body = { user_id: found.meId };
+  if (!row.email && found.meEmail) body.email = found.meEmail;
+  try {
+    await patch(o, `/data-models/${found.crewModelId}/records/${row.id}`, body);
+    found.provisioning.push(`linked Crew row "${name}" to your account`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push(
+      `could not link your Crew row (no write access) \u2014 ask a workspace admin to set user_id on "${name}"`
+    );
+  }
+}
+async function createOperatorRow(o, found) {
+  if (!found.meId || !found.crewModelId) return;
+  const name = found.meName || found.meEmail || "Operator";
+  if (o.dryRun) {
+    found.provisioning.push(`would create Crew row "${name}" for you`);
+    return;
+  }
+  try {
+    const created = await post2(o, `/data-models/${found.crewModelId}/records`, {
+      name,
+      ...found.meEmail ? { email: found.meEmail } : {},
+      user_id: found.meId
+    });
+    found.operator = created.id;
+    found.holds.push({ id: created.id, name, email: found.meEmail, user_id: found.meId });
+    found.provisioning.push(`created Crew row "${name}" for you`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push("could not create your Crew row (no write access) \u2014 ask a workspace admin to add one with your user_id");
+  }
+}
 function renderConnection(d, route, dir, opts = {}) {
   const apiKeyFileLine = opts.keychainBacked ? `    # apiKey: resolved automatically from the OS keychain (crew connect) \u2014 no apiKeyFile needed` : opts.apiKeyFile ? `    apiKeyFile: "${opts.apiKeyFile}"` : `    apiKeyFile: "REPLACE \u2014 a file holding this workspace's key"`;
   const apiKeyVarLine = opts.keychainBacked ? "" : opts.apiKeyVar ? `
@@ -11474,6 +11603,12 @@ import {
 // src/seat-keys.ts
 import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
 var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function keyIsAdmin(route) {
+  const role = route.resolved?.role;
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
+var MEMBER_NO_KEY = "no agent key for this seat \u2014 minting needs a workspace admin key";
 function seatKeySlug(workspaceSlug, agentId) {
   return `${workspaceSlug}#agent:${agentId}`;
 }
@@ -11487,11 +11622,11 @@ function seatAgentId(route, role) {
 async function resolveReleaseKey(route, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   const agentId = route.resolved?.releaseAgentId;
-  if (!agentId) return ship("release seat has no linked Agents row (run `crew agents sync`)");
+  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
   try {
     const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship("no agent key stored for the release seat (run `crew agents sync`)");
+    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch {
     return ship("OS keychain unavailable");
   }
@@ -11500,11 +11635,11 @@ async function resolveSeatKey(route, role, getStore = getSessionStore2) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
   if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
   const agentId = seatAgentId(route, role);
-  if (!agentId) return ship("seat has no linked Agents row (run `crew agents sync`)");
+  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
   try {
     const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship("no agent key stored for this seat (run `crew agents sync`)");
+    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch {
     return ship("OS keychain unavailable");
   }
@@ -13386,20 +13521,25 @@ function terminalPrompter() {
     }
   };
 }
-async function pickOperator(holds2) {
+async function pickOperator(holds2, me) {
+  const choices = holds2.filter((h) => !h.user_id || h.user_id === me.id);
+  const canCreate = !!me.id;
   process.stderr.write("\nWhich of these Crew rows is you?\n");
-  holds2.forEach((h, i) => process.stderr.write(`  ${i + 1}. ${h.name || h.id}
+  choices.forEach((h, i) => process.stderr.write(`  ${i + 1}. ${h.name || h.id}
 `));
+  if (canCreate) process.stderr.write(`  0. Create a new Crew row for ${me.name ?? ""} ${me.email ?? ""}`.trimEnd() + "\n");
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = (await rl.question("Enter a number (blank to skip): ")).trim();
+    const fallback = canCreate && choices.length === 0 ? "0" : "";
+    const answer = (await rl.question(`Enter a number (blank to ${fallback ? "create one" : "skip"}): `)).trim() || fallback;
     const n = Number(answer);
-    if (!answer || !Number.isInteger(n) || n < 1 || n > holds2.length) return void 0;
-    return holds2[n - 1].id;
+    if (!answer || !Number.isInteger(n) || n < 0 || n > choices.length) return void 0;
+    return n === 0 ? canCreate ? NEW_OPERATOR_ROW : void 0 : choices[n - 1].id;
   } finally {
     rl.close();
   }
 }
+var NEW_OPERATOR_ROW = "new";
 async function pickResolvedStatuses(unrecognized) {
   process.stderr.write(
     "\nThis workspace has status values the default contract doesn't know the meaning of.\nFor each: does it mean the ticket is DONE \u2014 resolved/terminal (shipped, closed, won't-fix) \u2014 so a ticket blocked by it should stop being blocked?\n"
@@ -15024,9 +15164,18 @@ ${changed2.map((c) => `  - ${c}
 `);
         process.exit(2);
       }
+      const keyRole = target.resolved.role ?? await fetchKeyRole(target, cfg.ship.userAgent);
+      let readOnly = !isAdminRole(keyRole);
       let personaResult;
+      const runPersonas = (ro) => syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force, readOnly: ro });
       try {
-        personaResult = await syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force });
+        try {
+          personaResult = await runPersonas(readOnly);
+        } catch (e) {
+          if (readOnly || !isForbidden(e)) throw e;
+          readOnly = true;
+          personaResult = await runPersonas(true);
+        }
       } catch (e) {
         if (e instanceof AgentsSyncError) {
           process.stderr.write(`crew agents sync: ${e.message}
@@ -15040,28 +15189,32 @@ ${changed2.map((c) => `  - ${c}
       for (const o of personaResult.outcomes) process.stdout.write(`${describeSyncOutcome(o)}
 `);
       for (const o of personaResult.crewLinks) process.stdout.write(`${describeCrewLink(o)}
+`);
+      if (personaResult.releaseNote) process.stdout.write(`${personaResult.releaseNote}
 `);
       const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
       for (const w of skillMarkerWarnings(target.promptsDir, briefs)) process.stderr.write(`crew agents sync: warning: ${w}
 `);
       let skillResult;
-      try {
-        skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
-      } catch (e) {
-        if (e instanceof SkillSyncError) {
-          process.stderr.write(`crew agents sync: ${e.message}
+      if (!readOnly) {
+        try {
+          skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
+        } catch (e) {
+          if (isForbidden(e)) readOnly = true;
+          else if (e instanceof SkillSyncError) {
+            process.stderr.write(`crew agents sync: ${e.message}
 `);
-          process.exit(2);
+            process.exit(2);
+          } else throw e;
         }
-        throw e;
       }
-      for (const o of skillResult.outcomes) process.stdout.write(`${describeSkillSyncOutcome(o)}
+      for (const o of skillResult?.outcomes ?? []) process.stdout.write(`${describeSkillSyncOutcome(o)}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
         const raw = existsSync26(resolvedPath) ? JSON.parse(readFileSync19(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
-        raw.agentSkills = skillResult.agentSkills;
+        if (skillResult) raw.agentSkills = skillResult.agentSkills;
         if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
         mkdirSync13(dirOf(resolvedPath), { recursive: true });
         writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -15071,11 +15224,16 @@ ${changed2.map((c) => `  - ${c}
         target.resolved.agentPersonas = personaResult.agentPersonas;
         if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
       }
-      for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
-        process.stdout.write(`${describeMintOutcome(o)}
+      if (readOnly) {
+        process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
+        process.stdout.write("seat keys: not minted (needs a workspace admin key)\n");
+      } else {
+        for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
+          process.stdout.write(`${describeMintOutcome(o)}
 `);
+        }
       }
-      if (personaResult.outcomes.some((o) => o.action === "diverged") || skillResult.outcomes.some((o) => o.action === "diverged")) {
+      if (personaResult.outcomes.some((o) => o.action === "diverged") || (skillResult?.outcomes.some((o) => o.action === "diverged") ?? false)) {
         process.exitCode = 1;
       }
       break;
@@ -15444,11 +15602,11 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         sshPublicKey
       };
       const runConnect = async (ws, proj) => {
-        let found = await discover({ ...authOpts, workspace: ws, project: proj, area: value("area"), ship, dryRun });
+        let found = await discover({ ...authOpts, workspace: ws, project: proj, area: value("area"), ship, dryRun, interactive: !!(process.stdin.isTTY && process.stdout.isTTY) });
         if (!found.projectId && found.offerTemplateInstall && process.stdin.isTTY && process.stdout.isTTY) {
           const installedSlug = await offerTemplateInstall(authOpts, found.workspaceId);
           if (installedSlug) {
-            found = await discover({ ...authOpts, workspace: ws, project: installedSlug, area: value("area"), ship, dryRun });
+            found = await discover({ ...authOpts, workspace: ws, project: installedSlug, area: value("area"), ship, dryRun, interactive: !!(process.stdin.isTTY && process.stdout.isTTY) });
           }
         }
         if (!found.projectId) {
@@ -15474,7 +15632,15 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         let operator = found.operator;
         if (!operator && found.holds.length > 0 && process.stdin.isTTY && process.stdout.isTTY) {
-          operator = await pickOperator(found.holds);
+          const picked = await pickOperator(found.holds, { id: found.meId, name: found.meName, email: found.meEmail });
+          if (picked === NEW_OPERATOR_ROW) {
+            await createOperatorRow({ ...authOpts, dryRun }, found);
+            operator = found.operator;
+          } else if (picked) {
+            operator = picked;
+            const row = found.holds.find((h) => h.id === picked);
+            if (row && found.meId && row.user_id !== found.meId) await linkOperatorRow({ ...authOpts, dryRun }, found, row);
+          }
         }
         let previous;
         const hadPreviousFile = existsSync26(resolvedPath);
@@ -15524,6 +15690,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           seats: found.seats,
           holds: found.holds.map((h) => ({ id: h.id, role: h.name })),
           ...found.releaseSeat ? { releaseSeat: found.releaseSeat } : {},
+          ...found.role ?? previous?.role ? { role: found.role ?? previous?.role } : {},
           ...operator ? { operator } : {},
           ...contract ? { contract } : {},
           ...reviewedStatuses.length > 0 ? { reviewedStatuses } : {},
@@ -16461,16 +16628,20 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       process.stdout.write(
         route.resolved?.releaseSeat ? "release seat:    this ship has its own Release Crew row\n" : "release seat:    none \u2014 release comments are credited to the dev seat; run `crew connect` once the Crew table has this ship's row\n"
       );
+      const keyRole = route.resolved?.role ?? await fetchKeyRole(route, cfg.ship.userAgent);
+      const roleRoute = route.resolved && keyRole ? { ...route, resolved: { ...route.resolved, role: keyRole } } : route;
+      process.stdout.write(`api key role:     ${keyRole ?? "unknown"}
+`);
       for (const role of SEAT_KEY_ROLES) {
         if (!route.resolved?.seats[role]) continue;
-        const id = await resolveSeatKey(route, role);
+        const id = await resolveSeatKey(roleRoute, role);
         process.stdout.write(
           `seat identity:    ${role} writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `
         );
       }
       if (route.resolved?.releaseSeat) {
-        const id = await resolveReleaseKey(route);
+        const id = await resolveReleaseKey(roleRoute);
         process.stdout.write(
           `seat identity:    release writes as ${id.kind === "agent" ? `its own agent (${id.agentId})` : `the ship (${id.reason})`}
 `
@@ -16511,7 +16682,7 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
           process.exitCode = 1;
         } else if (!row.user_id) {
           process.stdout.write(
-            `operator identity: ERROR Crew row "${row.name ?? op}" has no user_id \u2014 their UI comments will read "(no identity)"; link it to the account they sign in with
+            `operator identity: ERROR Crew row "${row.name ?? op}" has no user_id \u2014 their UI comments will read "(no identity)"; re-run \`crew connect\` to link it
 `
           );
           process.exitCode = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.50.2",
+  "version": "0.51.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",