@tablation/crew 0.51.0 → 0.51.1

package/dist/cli.js

@@ -11644,6 +11644,13 @@ async function resolveSeatKey(route, role, getStore = getSessionStore2) {
     return ship("OS keychain unavailable");
   }
 }
+function describeStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/User interaction is not allowed/i.test(msg)) {
+    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+  }
+  return "keychain unavailable (could not write to the OS keychain)";
+}
 async function mintMissingSeatKeys(route, o) {
   const out = [];
   if (!route.resolved) return out;
@@ -11660,11 +11667,27 @@ async function mintMissingSeatKeys(route, o) {
     return targets.map(({ role }) => ({
       role,
       action: "failed",
-      detail: `OS keychain unavailable: ${e.message}`
+      detail: describeStoreError(e)
     }));
   }
   const host = hostFromUrl2(route.baseUrl);
   const base = route.baseUrl.replace(/\/+$/, "");
+  if (!o.dryRun) {
+    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
+    try {
+      await store.set(host, probeSlug, {
+        apiKey: "probe",
+        shipId: "",
+        workspaceId: resolved.workspaceId,
+        identityId: "_probe",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await store.clear(host, probeSlug);
+    } catch (e) {
+      const detail = `${describeStoreError(e)}; no keys minted`;
+      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
+    }
+  }
   for (const { role, agentId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
@@ -11698,16 +11721,37 @@ async function mintMissingSeatKeys(route, o) {
         out.push({ role, action: "failed", detail: "response carried no key" });
         continue;
       }
-      await store.set(host, slug, {
-        apiKey: body.key,
-        shipId: o.shipName ?? "",
-        workspaceId: resolved.workspaceId,
-        identityId: agentId,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
+      try {
+        await store.set(host, slug, {
+          apiKey: body.key,
+          shipId: o.shipName ?? "",
+          workspaceId: resolved.workspaceId,
+          identityId: agentId,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      } catch (e) {
+        let revoked = false;
+        if (body.id) {
+          try {
+            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+            });
+            revoked = del2.ok;
+          } catch {
+            revoked = false;
+          }
+        }
+        out.push({
+          role,
+          action: "failed",
+          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
+        });
+        continue;
+      }
       out.push({ role, action: "minted" });
     } catch (e) {
-      out.push({ role, action: "failed", detail: e.message });
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
   }
   return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.51.0",
+  "version": "0.51.1",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",