@tablation/crew 0.51.1 → 0.53.0

package/dist/cli.js

@@ -1435,8 +1435,8 @@ var TOP_LEVEL = /* @__PURE__ */ new Set([
   "labels",
   "release"
 ]);
-var BRANCH_KEYS = /* @__PURE__ */ new Set(["base", "name", "push", "remote"]);
-var PLACEHOLDER = /\{(key|number|slug|role|prefix|tag)\}/g;
+var BRANCH_KEYS = /* @__PURE__ */ new Set(["base", "name", "push", "remote", "lowercase"]);
+var PLACEHOLDER = /\{(key|number|slug|role|prefix|tag|issue)\}/g;
 var WORKTREE_PLACEHOLDERS = ["dir", "issue", "number", "key", "slug", "role", "prefix", "tag"];
 function worktreeNameProblem(template) {
   const valid = `Valid placeholders: ${WORKTREE_PLACEHOLDERS.map((p) => `{${p}}`).join(" ")}.`;
@@ -1528,7 +1528,7 @@ function parseRepoConfig(text, file) {
   if (!PLACEHOLDER.test(branchName)) {
     PLACEHOLDER.lastIndex = 0;
     throw new RepoConfigError(
-      `${file}: branch.name ("${branchName}") names no placeholder \u2014 every ticket would get the same branch. Use at least one of {key} {number} {slug} {role}.`
+      `${file}: branch.name ("${branchName}") names no placeholder \u2014 every ticket would get the same branch. Use at least one of {key} {number} {slug} {role} {prefix} {tag} {issue}.`
     );
   }
   PLACEHOLDER.lastIndex = 0;
@@ -1536,7 +1536,8 @@ function parseRepoConfig(text, file) {
     base: String(raw.branch?.base ?? "main"),
     name: branchName,
     push: String(raw.branch?.push ?? branchName),
-    remote: String(raw.branch?.remote ?? "origin")
+    remote: String(raw.branch?.remote ?? "origin"),
+    ...raw.branch?.lowercase !== void 0 ? { lowercase: parseLowercase(raw.branch.lowercase, file) } : {}
   };
   const copyRaw = raw.worktrees?.copy;
   if (copyRaw !== void 0 && !Array.isArray(copyRaw)) {
@@ -1733,9 +1734,13 @@ function slugify(title, maxLength = 40) {
   const s = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLength).replace(/-+$/, "");
   return s || "work";
 }
+function parseLowercase(v, where) {
+  if (typeof v !== "boolean") throw new RepoConfigError(`${where}: branch.lowercase must be true or false`);
+  return v;
+}
 function renderBranchName(template, ctx) {
   const number = ctx.key.replace(/^\D+/, "");
-  return template.replace(PLACEHOLDER, (_m, name) => {
+  const rendered = template.replace(PLACEHOLDER, (_m, name) => {
     switch (name) {
       case "key":
         return ctx.key;
@@ -1749,14 +1754,16 @@ function renderBranchName(template, ctx) {
         return ctx.tag ?? ctx.key;
       case "prefix":
         return ctx.prefix ?? "";
+      case "issue":
+        return (ctx.tag ?? ctx.key).toLowerCase();
       default:
         return "";
     }
   });
+  return ctx.lowercase ? rendered.toLowerCase() : rendered;
 }
 function renderWorktreeName(template, ctx) {
-  const issue = (ctx.tag ?? ctx.key).toLowerCase();
-  return renderBranchName(template.replace(/\{dir\}/g, ctx.dir).replace(/\{issue\}/g, issue), ctx);
+  return renderBranchName(template.replace(/\{dir\}/g, ctx.dir), ctx);
 }
 function defaultWorktreePrefix(dir) {
   const name = basename2(dir.replace(/[/\\]+$/, ""));
@@ -1856,7 +1863,8 @@ function resolveRepoConfig(repo, ship, dir) {
         repo?.branch.remote === "origin" ? void 0 : repo?.branch.remote,
         ship?.branch?.remote,
         "origin"
-      )
+      ),
+      ...pick("branch.lowercase", repo?.branch.lowercase, ship?.branch?.lowercase, false) ? { lowercase: true } : {}
     },
     // Unlike every other field here, platform has no ship-level fallback: what
     // a repo needs of a host is a fact about that repo alone (its build
@@ -2055,7 +2063,7 @@ function parseWorktreeName(v, where, file) {
   return String(v);
 }
 var REPO_ENTRY_KEYS = /* @__PURE__ */ new Set(["dir", "hooks", "labels", "release", "branch", "hostPassengers", "worktreeName", "toolchain"]);
-var BRANCH_OVERRIDE_KEYS = /* @__PURE__ */ new Set(["base", "name", "push", "remote"]);
+var BRANCH_OVERRIDE_KEYS = /* @__PURE__ */ new Set(["base", "name", "push", "remote", "lowercase"]);
 var RELEASE_OVERRIDE_KEYS = /* @__PURE__ */ new Set([
   "mode",
   "ci",
@@ -2139,8 +2147,12 @@ function parseBranchOverride(raw, where, file) {
   const name = raw.name !== void 0 ? String(raw.name) : void 0;
   const push = raw.push !== void 0 ? String(raw.push) : void 0;
   const remote = raw.remote !== void 0 ? String(raw.remote) : void 0;
-  if (base === void 0 && name === void 0 && push === void 0 && remote === void 0) return void 0;
-  return { base, name, push, remote };
+  if (raw.lowercase !== void 0 && typeof raw.lowercase !== "boolean") {
+    throw new ConfigError(`${file}: ${where}.branch.lowercase must be true or false`);
+  }
+  const lowercase = raw.lowercase;
+  if (base === void 0 && name === void 0 && push === void 0 && remote === void 0 && lowercase === void 0) return void 0;
+  return { base, name, push, remote, ...lowercase !== void 0 ? { lowercase } : {} };
 }
 function mergeRouteRelease(route, override) {
   const provider = override?.ci?.provider ?? route.ci?.provider;
@@ -6355,13 +6367,13 @@ ${waiting.map((t) => `| ${displayKey2(t)} | ${t.status} | ${blockers(t, i)} |`).
 
 // src/ticket-branch.ts
 import { basename as basename5 } from "path";
-function branchRenderer(t, role) {
+function branchRenderer(t, role, lowercase) {
   const { tag, prefix } = ticketBranchContext(t);
-  return (template) => renderBranchName(template, { key: t.issue_id, title: t.title ?? void 0, role, tag, prefix });
+  return (template) => renderBranchName(template, { key: t.issue_id, title: t.title ?? void 0, role, tag, prefix, lowercase });
 }
 function worktreeForTicket(dir, cfg, t, role) {
   const { prefix } = ticketBranchContext(t);
-  const branchName = branchRenderer(t, role)(effectiveBranchTemplate(cfg, prefix));
+  const branchName = branchRenderer(t, role, cfg.branch.lowercase)(effectiveBranchTemplate(cfg, prefix));
   const number = t.issue_id.replace(/^\D+/, "");
   const { tag } = ticketBranchContext(t);
   return effectiveWorktreeDirName(cfg, dir, branchName, number, (template) => renderWorktreeName(template, {
@@ -6380,10 +6392,10 @@ function branchTemplates(cfg, t) {
   return { name, push };
 }
 function pushedBranchForTicket(cfg, t, role) {
-  return branchRenderer(t, role)(branchTemplates(cfg, t).push);
+  return branchRenderer(t, role, cfg.branch.lowercase)(branchTemplates(cfg, t).push);
 }
 function existingBranchForTicket(dir, cfg, t, role) {
-  return branchForIssue(dir, t.issue_id, branchTemplates(cfg, t), branchRenderer(t, role));
+  return branchForIssue(dir, t.issue_id, branchTemplates(cfg, t), branchRenderer(t, role, cfg.branch.lowercase));
 }
 function locateBranchForTicket(dir, cfg, t, role, fetchedDirs) {
   const local = existingBranchForTicket(dir, cfg, t, role);
@@ -6394,7 +6406,7 @@ function locateBranchForTicket(dir, cfg, t, role, fetchedDirs) {
     fetchedDirs.add(dir);
     fetchRemote(dir, remote);
   }
-  const found = remoteBranchForIssue(dir, remote, t.issue_id, branchTemplates(cfg, t), branchRenderer(t, role));
+  const found = remoteBranchForIssue(dir, remote, t.issue_id, branchTemplates(cfg, t), branchRenderer(t, role, cfg.branch.lowercase));
   return found ? { branch: found, where: "remote" } : null;
 }
 function materializeBranchForTicket(dir, cfg, t, role, onProblem) {
@@ -6712,14 +6724,14 @@ function writeDigest(o, d, role, stateDir) {
     };
     const fetchedDirs = /* @__PURE__ */ new Set();
     const dirFor = (t) => dirForRepo(o.route, t.repo_id);
-    const render2 = (t) => branchRenderer(t, role);
+    const render2 = (t, lowercase) => branchRenderer(t, role, lowercase);
     const input = {
       dirFor,
       repoStop: repoStopFor(openShipAttention(o.state), o.route),
       branchFor: (t) => {
         const cfg = repoFor(dirFor(t) ?? o.route.dir);
         const { prefix } = ticketBranchContext(t);
-        return render2(t)(effectiveBranchTemplate(cfg, prefix));
+        return render2(t, cfg.branch.lowercase)(effectiveBranchTemplate(cfg, prefix));
       },
       // ISSUE-1028: the agent previously had to derive this itself from the
       // Environment section's own worked example, which is rendered before
@@ -7210,7 +7222,7 @@ function repoPrefix(repo) {
 function branchExample(repo, key) {
   const prefix = repoPrefix(repo);
   const template = effectiveBranchTemplate(repo, prefix);
-  return renderBranchName(template, { key, title: "Fix the widget", role: "dev", prefix });
+  return renderBranchName(template, { key, title: "Fix the widget", role: "dev", prefix, lowercase: repo.branch.lowercase });
 }
 function repoSection(r, key, heading) {
   const repo = r.config;
@@ -8957,7 +8969,7 @@ var describeRunWorktreePlan = (p) => {
 var planIsUsable = (p) => p.action !== "leave-dirty" && p.action !== "leave-unpushed";
 function newBranchName(cfg, t, role) {
   const { prefix } = ticketBranchContext(t);
-  return branchRenderer(t, role)(effectiveBranchTemplate(cfg, prefix));
+  return branchRenderer(t, role, cfg.branch.lowercase)(effectiveBranchTemplate(cfg, prefix));
 }
 function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const { remote, base } = cfg.branch;
@@ -9721,9 +9733,9 @@ function reviewProblems(repo, contract) {
   if (!reviewApplies(repo, contract)) return [];
   const problems = [];
   const template = repo.branch.push ?? repo.branch.name;
-  if (!/\{(key|number|tag)\}/.test(template)) {
+  if (!/\{(key|number|tag|issue)\}/.test(template)) {
     problems.push(
-      `branch.push "${template}" names none of {key}, {number} or {tag} \u2014 with release.mode "external" and a reviewing status, the pushed branch is the only link back to its ticket`
+      `branch.push "${template}" names none of {key}, {number}, {tag} or {issue} \u2014 with release.mode "external" and a reviewing status, the pushed branch is the only link back to its ticket`
     );
   }
   return problems;
@@ -11608,7 +11620,8 @@ function keyIsAdmin(route) {
   return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
 }
 var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
-var MEMBER_NO_KEY = "no agent key for this seat \u2014 minting needs a workspace admin key";
+var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
+var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
 function seatKeySlug(workspaceSlug, agentId) {
   return `${workspaceSlug}#agent:${agentId}`;
 }
@@ -11712,6 +11725,10 @@ async function mintMissingSeatKeys(route, o) {
         },
         body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
       });
+      if (res.status === 403) {
+        out.push({ role, action: "forbidden" });
+        break;
+      }
       if (!res.ok) {
         out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
         continue;
@@ -11722,13 +11739,15 @@ async function mintMissingSeatKeys(route, o) {
         continue;
       }
       try {
-        await store.set(host, slug, {
+        const session = {
           apiKey: body.key,
           shipId: o.shipName ?? "",
           workspaceId: resolved.workspaceId,
           identityId: agentId,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...body.id ? { keyId: body.id } : {}
+        };
+        await store.set(host, slug, session);
       } catch (e) {
         let revoked = false;
         if (body.id) {
@@ -11764,10 +11783,92 @@ function describeMintOutcome(o) {
       return `${o.role}: agent key already stored`;
     case "no_agent":
       return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "forbidden":
+      return FORBIDDEN_LINE;
     case "failed":
       return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
   }
 }
+async function revokeSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
+  }
+  const host = hostFromUrl2(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
+    try {
+      const session = await store.get(host, slug);
+      if (!session?.apiKey) {
+        out.push({ role, action: "not_stored" });
+        continue;
+      }
+      if (!session.keyId) {
+        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "revoked", detail: "dry run" });
+        continue;
+      }
+      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+      });
+      if (!del2.ok && del2.status !== 404) {
+        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
+        continue;
+      }
+      await store.clear(host, slug);
+      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+    }
+  }
+  return out;
+}
+function describeRevokeOutcome(o) {
+  switch (o.action) {
+    case "revoked":
+      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
+    case "not_stored":
+      return `${o.role}: no agent key stored on this ship`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row`;
+    case "failed":
+      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
+  }
+}
+async function canMintAgentKeys(route, o = {}) {
+  const resolved = route.resolved;
+  if (!resolved) return void 0;
+  const agentId = seatAgentId(route, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route, r)).find(Boolean);
+  if (!agentId) return void 0;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(`${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return true;
+    return res.status === 403 ? false : void 0;
+  } catch {
+    return void 0;
+  }
+}
 
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
@@ -13666,7 +13767,7 @@ function usage() {
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
   crew connect                  resolve a workspace's ids into a crew.yaml block (--no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
-  crew agents sync [route] [--force]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
+  crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
   crew agents prompt R [route] print one persona's current prompt (e.g. R=pair, for a SessionStart hook; --harness H adds which CLI it serves)
   crew skills sync [route]      push only crew's skill files (e.g. grill-me) into the workspace Agent Skills table
   crew repos add [ROUTE] [NAME] [PATH]  attach a local checkout to a route in crew.yaml (--dry-run previews)
@@ -15187,7 +15288,7 @@ ${changed2.map((c) => `  - ${c}
         break;
       }
       if (sub !== "sync") {
-        process.stderr.write("crew agents sync [route] [--force]    push crew's personas (Developer/Design/QA/Triage/Pair) AND skill files (e.g. grill-me) into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)\n");
+        process.stderr.write("crew agents sync [route] [--force]    push crew's personas (Developer/Design/QA/Triage/Pair) AND skill files (e.g. grill-me) into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt; --revoke-seat-keys deletes this ship's seat keys server-side and from the keychain, so the next sync mints fresh ones)\n");
         process.stderr.write(`crew agents prompt <role> [route]     print a persona's current prompt (roles: ${ROLE_NAMES.join(", ")})
 `);
         process.exit(2);
@@ -15270,7 +15371,12 @@ ${changed2.map((c) => `  - ${c}
       }
       if (readOnly) {
         process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
-        process.stdout.write("seat keys: not minted (needs a workspace admin key)\n");
+      }
+      if (flag("revoke-seat-keys")) {
+        for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun })) {
+          process.stdout.write(`${describeRevokeOutcome(o)}
+`);
+        }
       } else {
         for (const o of await mintMissingSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun, shipName: cfg.ship.name })) {
           process.stdout.write(`${describeMintOutcome(o)}
@@ -16045,7 +16151,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       const branch = found.branch ?? branchForIssue(target.dir, `ISSUE-${n}`, {
         name: target.config.branch.name,
         push: target.config.branch.push
-      }, (t) => renderBranchName(t, { key: `ISSUE-${n}` }));
+      }, (t) => renderBranchName(t, { key: `ISSUE-${n}`, lowercase: target.config.branch.lowercase }));
       const pids = pidsInWorktree(wt, num);
       if (pids.length) {
         emit.emit(`${dryRun ? "would kill" : "killing"} processes still inside ${wt}: ${pids.join(" ")}`);
@@ -16675,6 +16781,9 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       const keyRole = route.resolved?.role ?? await fetchKeyRole(route, cfg.ship.userAgent);
       const roleRoute = route.resolved && keyRole ? { ...route, resolved: { ...route.resolved, role: keyRole } } : route;
       process.stdout.write(`api key role:     ${keyRole ?? "unknown"}
+`);
+      const canMint = await canMintAgentKeys(roleRoute, { userAgent: cfg.ship.userAgent });
+      process.stdout.write(`can mint agent keys: ${canMint === void 0 ? "unknown" : canMint ? "yes" : "no"}
 `);
       for (const role of SEAT_KEY_ROLES) {
         if (!route.resolved?.seats[role]) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.51.1",
+  "version": "0.53.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",