@tablation/crew 0.50.3 → 0.51.1

package/dist/cli.js

@@ -11281,6 +11281,7 @@ async function discover(o) {
     out.role = me.role;
     out.meEmail = me.email;
     out.meId = me.id;
+    out.meName = me.name;
   } catch {
   }
   if (o.project) {
@@ -11504,18 +11505,72 @@ async function discover(o) {
       }
     }
     const seatIds = /* @__PURE__ */ new Set([...Object.values(out.seats), ...out.releaseSeat ? [out.releaseSeat] : []]);
-    out.holds = rows.filter((r) => !seatIds.has(r.id)).map((r) => ({ id: r.id, name: r.name ?? "" }));
-    if (out.holds.length === 0) {
-      problems.push("no non-seat Crew rows \u2014 which row is the operator?");
-    } else if (out.meEmail) {
-      const holdRows = rows.filter((r) => !seatIds.has(r.id));
-      const matches2 = holdRows.filter((r) => eq(r.email, out.meEmail));
-      if (matches2.length === 1) out.operator = matches2[0].id;
+    const holdRows = rows.filter((r) => !seatIds.has(r.id));
+    out.holds = holdRows.map((r) => ({ id: r.id, name: r.name ?? "", email: r.email, user_id: r.user_id }));
+    out.crewModelId = out.models.crew;
+    if (!out.meId) {
+      if (out.holds.length === 0) problems.push("no non-seat Crew rows \u2014 which row is the operator?");
+      else {
+        const byEmail = out.meEmail ? holdRows.filter((r) => eq(r.email, out.meEmail)) : [];
+        if (byEmail.length === 1) out.operator = byEmail[0].id;
+        else if (out.holds.length === 1) out.operator = out.holds[0].id;
+      }
+    } else {
+      const candidates = holdRows.filter((r) => !r.user_id || r.user_id === out.meId);
+      const mine = holdRows.find((r) => r.user_id === out.meId);
+      const byEmail = out.meEmail ? candidates.filter((r) => eq(r.email, out.meEmail)) : [];
+      const only = holdRows.length === 1 && candidates.length === 1 ? candidates[0] : void 0;
+      const pick = mine ?? (byEmail.length === 1 ? byEmail[0] : only);
+      if (pick) {
+        out.operator = pick.id;
+        if (pick.user_id !== out.meId && o.ship) await linkOperatorRow(o, out, pick);
+      } else if (o.ship && (!o.interactive || candidates.length === 0)) {
+        await createOperatorRow(o, out);
+      }
     }
-    if (!out.operator && out.holds.length === 1) out.operator = out.holds[0].id;
   }
   return out;
 }
+async function linkOperatorRow(o, found, row) {
+  const name = row.name || row.id;
+  if (!found.meId || !found.crewModelId) return;
+  if (o.dryRun) {
+    found.provisioning.push(`would link Crew row "${name}" to your account`);
+    return;
+  }
+  const body = { user_id: found.meId };
+  if (!row.email && found.meEmail) body.email = found.meEmail;
+  try {
+    await patch(o, `/data-models/${found.crewModelId}/records/${row.id}`, body);
+    found.provisioning.push(`linked Crew row "${name}" to your account`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push(
+      `could not link your Crew row (no write access) \u2014 ask a workspace admin to set user_id on "${name}"`
+    );
+  }
+}
+async function createOperatorRow(o, found) {
+  if (!found.meId || !found.crewModelId) return;
+  const name = found.meName || found.meEmail || "Operator";
+  if (o.dryRun) {
+    found.provisioning.push(`would create Crew row "${name}" for you`);
+    return;
+  }
+  try {
+    const created = await post2(o, `/data-models/${found.crewModelId}/records`, {
+      name,
+      ...found.meEmail ? { email: found.meEmail } : {},
+      user_id: found.meId
+    });
+    found.operator = created.id;
+    found.holds.push({ id: created.id, name, email: found.meEmail, user_id: found.meId });
+    found.provisioning.push(`created Crew row "${name}" for you`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push("could not create your Crew row (no write access) \u2014 ask a workspace admin to add one with your user_id");
+  }
+}
 function renderConnection(d, route, dir, opts = {}) {
   const apiKeyFileLine = opts.keychainBacked ? `    # apiKey: resolved automatically from the OS keychain (crew connect) \u2014 no apiKeyFile needed` : opts.apiKeyFile ? `    apiKeyFile: "${opts.apiKeyFile}"` : `    apiKeyFile: "REPLACE \u2014 a file holding this workspace's key"`;
   const apiKeyVarLine = opts.keychainBacked ? "" : opts.apiKeyVar ? `
@@ -11589,6 +11644,13 @@ async function resolveSeatKey(route, role, getStore = getSessionStore2) {
     return ship("OS keychain unavailable");
   }
 }
+function describeStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/User interaction is not allowed/i.test(msg)) {
+    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+  }
+  return "keychain unavailable (could not write to the OS keychain)";
+}
 async function mintMissingSeatKeys(route, o) {
   const out = [];
   if (!route.resolved) return out;
@@ -11605,11 +11667,27 @@ async function mintMissingSeatKeys(route, o) {
     return targets.map(({ role }) => ({
       role,
       action: "failed",
-      detail: `OS keychain unavailable: ${e.message}`
+      detail: describeStoreError(e)
     }));
   }
   const host = hostFromUrl2(route.baseUrl);
   const base = route.baseUrl.replace(/\/+$/, "");
+  if (!o.dryRun) {
+    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
+    try {
+      await store.set(host, probeSlug, {
+        apiKey: "probe",
+        shipId: "",
+        workspaceId: resolved.workspaceId,
+        identityId: "_probe",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await store.clear(host, probeSlug);
+    } catch (e) {
+      const detail = `${describeStoreError(e)}; no keys minted`;
+      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
+    }
+  }
   for (const { role, agentId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
@@ -11643,16 +11721,37 @@ async function mintMissingSeatKeys(route, o) {
         out.push({ role, action: "failed", detail: "response carried no key" });
         continue;
       }
-      await store.set(host, slug, {
-        apiKey: body.key,
-        shipId: o.shipName ?? "",
-        workspaceId: resolved.workspaceId,
-        identityId: agentId,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
+      try {
+        await store.set(host, slug, {
+          apiKey: body.key,
+          shipId: o.shipName ?? "",
+          workspaceId: resolved.workspaceId,
+          identityId: agentId,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      } catch (e) {
+        let revoked = false;
+        if (body.id) {
+          try {
+            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+            });
+            revoked = del2.ok;
+          } catch {
+            revoked = false;
+          }
+        }
+        out.push({
+          role,
+          action: "failed",
+          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
+        });
+        continue;
+      }
       out.push({ role, action: "minted" });
     } catch (e) {
-      out.push({ role, action: "failed", detail: e.message });
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
   }
   return out;
@@ -13466,20 +13565,25 @@ function terminalPrompter() {
     }
   };
 }
-async function pickOperator(holds2) {
+async function pickOperator(holds2, me) {
+  const choices = holds2.filter((h) => !h.user_id || h.user_id === me.id);
+  const canCreate = !!me.id;
   process.stderr.write("\nWhich of these Crew rows is you?\n");
-  holds2.forEach((h, i) => process.stderr.write(`  ${i + 1}. ${h.name || h.id}
+  choices.forEach((h, i) => process.stderr.write(`  ${i + 1}. ${h.name || h.id}
 `));
+  if (canCreate) process.stderr.write(`  0. Create a new Crew row for ${me.name ?? ""} ${me.email ?? ""}`.trimEnd() + "\n");
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = (await rl.question("Enter a number (blank to skip): ")).trim();
+    const fallback = canCreate && choices.length === 0 ? "0" : "";
+    const answer = (await rl.question(`Enter a number (blank to ${fallback ? "create one" : "skip"}): `)).trim() || fallback;
     const n = Number(answer);
-    if (!answer || !Number.isInteger(n) || n < 1 || n > holds2.length) return void 0;
-    return holds2[n - 1].id;
+    if (!answer || !Number.isInteger(n) || n < 0 || n > choices.length) return void 0;
+    return n === 0 ? canCreate ? NEW_OPERATOR_ROW : void 0 : choices[n - 1].id;
   } finally {
     rl.close();
   }
 }
+var NEW_OPERATOR_ROW = "new";
 async function pickResolvedStatuses(unrecognized) {
   process.stderr.write(
     "\nThis workspace has status values the default contract doesn't know the meaning of.\nFor each: does it mean the ticket is DONE \u2014 resolved/terminal (shipped, closed, won't-fix) \u2014 so a ticket blocked by it should stop being blocked?\n"
@@ -15542,11 +15646,11 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         sshPublicKey
       };
       const runConnect = async (ws, proj) => {
-        let found = await discover({ ...authOpts, workspace: ws, project: proj, area: value("area"), ship, dryRun });
+        let found = await discover({ ...authOpts, workspace: ws, project: proj, area: value("area"), ship, dryRun, interactive: !!(process.stdin.isTTY && process.stdout.isTTY) });
         if (!found.projectId && found.offerTemplateInstall && process.stdin.isTTY && process.stdout.isTTY) {
           const installedSlug = await offerTemplateInstall(authOpts, found.workspaceId);
           if (installedSlug) {
-            found = await discover({ ...authOpts, workspace: ws, project: installedSlug, area: value("area"), ship, dryRun });
+            found = await discover({ ...authOpts, workspace: ws, project: installedSlug, area: value("area"), ship, dryRun, interactive: !!(process.stdin.isTTY && process.stdout.isTTY) });
           }
         }
         if (!found.projectId) {
@@ -15572,7 +15676,15 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         let operator = found.operator;
         if (!operator && found.holds.length > 0 && process.stdin.isTTY && process.stdout.isTTY) {
-          operator = await pickOperator(found.holds);
+          const picked = await pickOperator(found.holds, { id: found.meId, name: found.meName, email: found.meEmail });
+          if (picked === NEW_OPERATOR_ROW) {
+            await createOperatorRow({ ...authOpts, dryRun }, found);
+            operator = found.operator;
+          } else if (picked) {
+            operator = picked;
+            const row = found.holds.find((h) => h.id === picked);
+            if (row && found.meId && row.user_id !== found.meId) await linkOperatorRow({ ...authOpts, dryRun }, found, row);
+          }
         }
         let previous;
         const hadPreviousFile = existsSync26(resolvedPath);
@@ -16614,7 +16726,7 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
           process.exitCode = 1;
         } else if (!row.user_id) {
           process.stdout.write(
-            `operator identity: ERROR Crew row "${row.name ?? op}" has no user_id \u2014 their UI comments will read "(no identity)"; link it to the account they sign in with
+            `operator identity: ERROR Crew row "${row.name ?? op}" has no user_id \u2014 their UI comments will read "(no identity)"; re-run \`crew connect\` to link it
 `
           );
           process.exitCode = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.50.3",
+  "version": "0.51.1",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",