@tablation/crew 0.51.0 → 0.52.0

package/dist/cli.js

@@ -11608,7 +11608,8 @@ function keyIsAdmin(route) {
   return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
 }
 var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
-var MEMBER_NO_KEY = "no agent key for this seat \u2014 minting needs a workspace admin key";
+var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
+var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
 function seatKeySlug(workspaceSlug, agentId) {
   return `${workspaceSlug}#agent:${agentId}`;
 }
@@ -11644,6 +11645,13 @@ async function resolveSeatKey(route, role, getStore = getSessionStore2) {
     return ship("OS keychain unavailable");
   }
 }
+function describeStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/User interaction is not allowed/i.test(msg)) {
+    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+  }
+  return "keychain unavailable (could not write to the OS keychain)";
+}
 async function mintMissingSeatKeys(route, o) {
   const out = [];
   if (!route.resolved) return out;
@@ -11660,11 +11668,27 @@ async function mintMissingSeatKeys(route, o) {
     return targets.map(({ role }) => ({
       role,
       action: "failed",
-      detail: `OS keychain unavailable: ${e.message}`
+      detail: describeStoreError(e)
     }));
   }
   const host = hostFromUrl2(route.baseUrl);
   const base = route.baseUrl.replace(/\/+$/, "");
+  if (!o.dryRun) {
+    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
+    try {
+      await store.set(host, probeSlug, {
+        apiKey: "probe",
+        shipId: "",
+        workspaceId: resolved.workspaceId,
+        identityId: "_probe",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await store.clear(host, probeSlug);
+    } catch (e) {
+      const detail = `${describeStoreError(e)}; no keys minted`;
+      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
+    }
+  }
   for (const { role, agentId } of targets) {
     if (!agentId) {
       out.push({ role, action: "no_agent" });
@@ -11689,6 +11713,10 @@ async function mintMissingSeatKeys(route, o) {
         },
         body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
       });
+      if (res.status === 403) {
+        out.push({ role, action: "forbidden" });
+        break;
+      }
       if (!res.ok) {
         out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
         continue;
@@ -11698,16 +11726,39 @@ async function mintMissingSeatKeys(route, o) {
         out.push({ role, action: "failed", detail: "response carried no key" });
         continue;
       }
-      await store.set(host, slug, {
-        apiKey: body.key,
-        shipId: o.shipName ?? "",
-        workspaceId: resolved.workspaceId,
-        identityId: agentId,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
+      try {
+        const session = {
+          apiKey: body.key,
+          shipId: o.shipName ?? "",
+          workspaceId: resolved.workspaceId,
+          identityId: agentId,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...body.id ? { keyId: body.id } : {}
+        };
+        await store.set(host, slug, session);
+      } catch (e) {
+        let revoked = false;
+        if (body.id) {
+          try {
+            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+            });
+            revoked = del2.ok;
+          } catch {
+            revoked = false;
+          }
+        }
+        out.push({
+          role,
+          action: "failed",
+          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
+        });
+        continue;
+      }
       out.push({ role, action: "minted" });
     } catch (e) {
-      out.push({ role, action: "failed", detail: e.message });
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
     }
   }
   return out;
@@ -11720,10 +11771,92 @@ function describeMintOutcome(o) {
       return `${o.role}: agent key already stored`;
     case "no_agent":
       return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "forbidden":
+      return FORBIDDEN_LINE;
     case "failed":
       return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
   }
 }
+async function revokeSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
+  }
+  const host = hostFromUrl2(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
+    try {
+      const session = await store.get(host, slug);
+      if (!session?.apiKey) {
+        out.push({ role, action: "not_stored" });
+        continue;
+      }
+      if (!session.keyId) {
+        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "revoked", detail: "dry run" });
+        continue;
+      }
+      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+      });
+      if (!del2.ok && del2.status !== 404) {
+        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
+        continue;
+      }
+      await store.clear(host, slug);
+      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+    }
+  }
+  return out;
+}
+function describeRevokeOutcome(o) {
+  switch (o.action) {
+    case "revoked":
+      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
+    case "not_stored":
+      return `${o.role}: no agent key stored on this ship`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row`;
+    case "failed":
+      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
+  }
+}
+async function canMintAgentKeys(route, o = {}) {
+  const resolved = route.resolved;
+  if (!resolved) return void 0;
+  const agentId = seatAgentId(route, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route, r)).find(Boolean);
+  if (!agentId) return void 0;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(`${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return true;
+    return res.status === 403 ? false : void 0;
+  } catch {
+    return void 0;
+  }
+}
 
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
@@ -13622,7 +13755,7 @@ function usage() {
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
   crew connect                  resolve a workspace's ids into a crew.yaml block (--no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
-  crew agents sync [route] [--force]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
+  crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
   crew agents prompt R [route] print one persona's current prompt (e.g. R=pair, for a SessionStart hook; --harness H adds which CLI it serves)
   crew skills sync [route]      push only crew's skill files (e.g. grill-me) into the workspace Agent Skills table
   crew repos add [ROUTE] [NAME] [PATH]  attach a local checkout to a route in crew.yaml (--dry-run previews)
@@ -15143,7 +15276,7 @@ ${changed2.map((c) => `  - ${c}
         break;
       }
       if (sub !== "sync") {
-        process.stderr.write("crew agents sync [route] [--force]    push crew's personas (Developer/Design/QA/Triage/Pair) AND skill files (e.g. grill-me) into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)\n");
+        process.stderr.write("crew agents sync [route] [--force]    push crew's personas (Developer/Design/QA/Triage/Pair) AND skill files (e.g. grill-me) into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt; --revoke-seat-keys deletes this ship's seat keys server-side and from the keychain, so the next sync mints fresh ones)\n");
         process.stderr.write(`crew agents prompt <role> [route]     print a persona's current prompt (roles: ${ROLE_NAMES.join(", ")})
 `);
         process.exit(2);
@@ -15226,7 +15359,12 @@ ${changed2.map((c) => `  - ${c}
       }
       if (readOnly) {
         process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
-        process.stdout.write("seat keys: not minted (needs a workspace admin key)\n");
+      }
+      if (flag("revoke-seat-keys")) {
+        for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun })) {
+          process.stdout.write(`${describeRevokeOutcome(o)}
+`);
+        }
       } else {
         for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
           process.stdout.write(`${describeMintOutcome(o)}
@@ -16631,6 +16769,9 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       const keyRole = route.resolved?.role ?? await fetchKeyRole(route, cfg.ship.userAgent);
       const roleRoute = route.resolved && keyRole ? { ...route, resolved: { ...route.resolved, role: keyRole } } : route;
       process.stdout.write(`api key role:     ${keyRole ?? "unknown"}
+`);
+      const canMint = await canMintAgentKeys(roleRoute, { userAgent: cfg.ship.userAgent });
+      process.stdout.write(`can mint agent keys: ${canMint === void 0 ? "unknown" : canMint ? "yes" : "no"}
 `);
       for (const role of SEAT_KEY_ROLES) {
         if (!route.resolved?.seats[role]) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",