@tablation/crew 0.57.0 → 0.59.0

package/dist/cli.js

@@ -31,6 +31,84 @@ function doctorBaseReport(r, base, health) {
   }
 }
 
+// src/doctor-checks.ts
+import { execFileSync } from "child_process";
+var PROBE_BRANCH = "crew-probe-branch";
+var realGit = (cwd, args, env) => {
+  execFileSync("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
+};
+function isSshRemote(url) {
+  return /^ssh:\/\//.test(url) || /^[\w.-]+@[\w.-]+:/.test(url);
+}
+function pushAuthHint(remoteUrl) {
+  return isSshRemote(remoteUrl) ? "make sure an SSH key is loaded for this host (ssh-add), and that the scheduler user can reach it" : "run `gh auth login`, then `gh auth setup-git`";
+}
+function probePushAuth(o, run2 = realGit, baseEnv = process.env) {
+  if (o.offline) return { state: "skipped", detail: "skipped (--offline)" };
+  if (!o.remoteUrl) return { state: "skipped", detail: `no remote "${o.remote}" configured` };
+  const env = { ...baseEnv, GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never", GIT_SSH_COMMAND: `${baseEnv.GIT_SSH_COMMAND ?? "ssh"} -o BatchMode=yes` };
+  try {
+    run2(o.dir, ["push", "--dry-run", o.remote, `HEAD:refs/heads/${PROBE_BRANCH}`], env);
+    return { state: "ok" };
+  } catch (e) {
+    const err = e;
+    const raw = (err.stderr ? String(err.stderr) : err.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
+    return { state: "failed", detail: raw || "push dry-run failed", hint: pushAuthHint(o.remoteUrl) };
+  }
+}
+var INSTALL_HINTS = {
+  gh: "install GitHub CLI: brew install gh (https://cli.github.com)",
+  node: "install Node: brew install node, or https://nodejs.org",
+  docker: "install Docker Desktop: https://docs.docker.com/get-docker/"
+};
+function mentionsNode(script) {
+  return !!script && /\b(node|npm|pnpm|npx|yarn)\b/.test(script);
+}
+function isPrBased(hooks) {
+  return !!hooks.pr || /\bgh\b/.test(hooks.merged ?? "");
+}
+function toolChecks(o, find) {
+  const mk = (name, need) => {
+    const path = find(name);
+    return { name, need, found: !!path, ...path ? { path } : {}, hint: INSTALL_HINTS[name] };
+  };
+  const node = mk("node", "optional");
+  if (o.hooksMentionNode) node.hint = `your repositories' hooks may need it \u2014 ${node.hint}`;
+  return [mk("gh", o.prBased ? "required" : "optional"), node, mk("docker", o.hostPassengers ? "required" : "optional")];
+}
+function formatToolCheck(t) {
+  const label = `${t.name}:`.padEnd(19);
+  if (t.found) return `${label}OK (${t.path}) [${t.need}]
+`;
+  return `${label}${t.need === "required" ? "NOT FOUND" : "not found"} [${t.need}] \u2014 ${t.hint}
+`;
+}
+function formatPushAuth(repo, r) {
+  const label = `push auth ${repo}:`.padEnd(19);
+  if (r.state === "ok") return `${label}ok
+`;
+  if (r.state === "skipped") return `${label}${r.detail}
+`;
+  return `${label}FAILED \u2014 ${r.detail}; ${r.hint}
+`;
+}
+async function settleRepos(items, nameOf, resolve6) {
+  const out = await Promise.all(items.map(async (t) => {
+    try {
+      return { ok: true, value: await resolve6(t) };
+    } catch (e) {
+      return { ok: false, repo: nameOf(t), detail: e.message };
+    }
+  }));
+  const settled = [];
+  const errors = [];
+  for (const o of out) {
+    if (o.ok) settled.push(o.value);
+    else errors.push({ repo: o.repo, detail: o.detail });
+  }
+  return { settled, errors };
+}
+
 // src/selftest.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
@@ -5104,7 +5182,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname14, join as join28, basename as basename9 } from "path";
+import { resolve as resolve5, dirname as dirname16, join as join29, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
@@ -6078,7 +6156,7 @@ function recoveredFailureHeadlines(o, route) {
 import { existsSync as existsSync15, statfsSync } from "fs";
 
 // src/git.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync7,
@@ -6100,7 +6178,7 @@ function streamText(x) {
 }
 function gitRaw(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -6109,7 +6187,7 @@ function gitRaw(cwd, args) {
 }
 function git(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -6266,9 +6344,9 @@ function keyCommitsInRange(cwd, key, range) {
 }
 function patchIdOf(cwd, from, to) {
   try {
-    const diff = execFileSync("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    const diff = execFileSync2("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (!diff) return null;
-    const out = execFileSync("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
+    const out = execFileSync2("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
     return out.split(" ")[0]?.trim() || null;
   } catch {
     return null;
@@ -6532,7 +6610,7 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
   mkdirSync7(dirname6(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -7201,6 +7279,25 @@ var Tracker = class {
     if (!model) throw new Error("this workspace has no Repos table");
     return this.client.records.create(model, fields);
   }
+  /** Every `Repos` row as `{ id, name }`, for finding one by name. */
+  async repoRows() {
+    const model = this.route.resolved?.reposModelId;
+    if (!model) return [];
+    return this.client.records.list(model, { limit: 200 });
+  }
+  /** Delete a `Repos` row (`crew sample-ticket --remove`). */
+  async deleteRepoRow(id) {
+    const model = this.route.resolved?.reposModelId;
+    if (!model) throw new Error("this workspace has no Repos table");
+    await this.client.records.remove(model, id);
+  }
+  /** Every ticket filed against one `Repos` row, any status. */
+  async ticketsForRepo(repoId) {
+    return this.client.records.list(this.models.issues, {
+      filters: encodeFilters([{ columnName: this.contract.columns.repo, operator: "EQ", value: repoId }]),
+      limit: 200
+    });
+  }
   /**
    * The Ships rows of this workspace, if it has a Ships table.
    *
@@ -9224,12 +9321,12 @@ import { existsSync as existsSync17 } from "fs";
 import { dirname as dirname7, join as join17 } from "path";
 
 // src/ports.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync16 } from "fs";
 import { join as join16 } from "path";
 var run = (cmd, args) => {
   try {
-    return execFileSync2(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return "";
   }
@@ -12420,6 +12517,60 @@ async function canMintAgentKeys(route, o = {}) {
   }
 }
 
+// src/agents-sync-run.ts
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11 } from "path";
+async function runAgentsSync(target, o) {
+  const dryRun = o.dryRun ?? false;
+  const force = o.force ?? false;
+  const keyRole = target.resolved?.role ?? await fetchKeyRole(target, o.userAgent);
+  let readOnly = !isAdminRole(keyRole);
+  const runPersonas = (ro) => syncPersonas(target, { userAgent: o.userAgent, dryRun, force, readOnly: ro });
+  let personaResult;
+  try {
+    personaResult = await runPersonas(readOnly);
+  } catch (e) {
+    if (readOnly || !isForbidden(e)) throw e;
+    readOnly = true;
+    personaResult = await runPersonas(true);
+  }
+  o.say(`route: ${target.route}`);
+  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
+  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
+  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
+  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
+  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
+  let skillResult;
+  if (!readOnly) {
+    try {
+      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
+    } catch (e) {
+      if (isForbidden(e)) readOnly = true;
+      else throw e;
+    }
+  }
+  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
+  if (!dryRun) {
+    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
+    const raw = existsSync21(resolvedPath) ? JSON.parse(readFileSync15(resolvedPath, "utf8")) : {};
+    raw.agentPersonas = personaResult.agentPersonas;
+    if (skillResult) raw.agentSkills = skillResult.agentSkills;
+    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
+    mkdirSync10(dirname11(resolvedPath), { recursive: true });
+    writeFileSync12(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+    if (target.resolved) {
+      target.resolved.agentPersonas = personaResult.agentPersonas;
+      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
+    }
+  }
+  if (readOnly) {
+    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
+  }
+  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
+  return { personaResult, skillResult, readOnly, diverged };
+}
+
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
@@ -12508,9 +12659,77 @@ async function showLogEntry(route, entryId, opts = {}) {
   };
 }
 
+// src/sample-ticket.ts
+import { basename as basename7, dirname as dirname12, join as join20 } from "path";
+var SAMPLE_REPO = "crew-sample";
+var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
+var SAMPLE_MARKER = "sample: true";
+var SAMPLE_CREW_YAML = `version: 1
+platform: unix
+branch:
+  base: main
+hooks:
+  test: "true"
+  build: "true"
+release:
+  mode: integrate
+  versioning: none
+  changelog: false
+`;
+var SAMPLE_README = `# crew-sample
+
+A throwaway repository created by \`crew sample-ticket\`. It exists so the crew
+has something safe to work on: its test and build hooks always pass, it has no
+remote, and \`crew sample-ticket --remove\` deletes it.
+`;
+function sampleDir(existing, reposBase, workspace) {
+  if (existing.length > 0) return join20(dirname12(existing[0]), SAMPLE_REPO);
+  return join20(reposBase, workspace, SAMPLE_REPO);
+}
+var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
+function sampleDescription() {
+  return [
+    SAMPLE_MARKER,
+    "",
+    "> This is a sample ticket filed by `crew sample-ticket` on a throwaway repository. Nothing here is real work.",
+    "",
+    "## What",
+    "",
+    "Add `greet.js` exporting `greet(name)`, which returns `Hello, <name>!` (and `Hello, world!` for no name),",
+    "with a JSDoc comment, and `greet.test.js` covering both cases using `node:test`.",
+    "",
+    "## Acceptance",
+    "",
+    '- `greet("Ada")` returns `Hello, Ada!`; `greet()` returns `Hello, world!`.',
+    "- The test file runs with `node --test` and passes.",
+    "- Add a line to the README saying the function exists.",
+    "",
+    "## Notes",
+    "",
+    "The repo has no remote: leave the branch local. The hooks in `.crew.yaml` always pass, so QA is checking the",
+    "diff against the acceptance list above."
+  ].join("\n");
+}
+function isSampleTicket(description) {
+  return (description ?? "").trimStart().startsWith(SAMPLE_MARKER);
+}
+function planSampleTicket(i) {
+  return {
+    title: SAMPLE_TITLE,
+    description: sampleDescription(),
+    report_type: "feature",
+    severity: "s4",
+    reporter_name: "crew sample-ticket",
+    status: i.approvedStatus,
+    project_id: i.projectId,
+    repo_id: i.repoId,
+    ...i.filedBy ? { filed_by_id: i.filedBy } : {}
+  };
+}
+
 // src/repos-cmd.ts
 import { homedir as homedir7 } from "os";
-import { basename as basename7, join as join20, resolve as resolve3 } from "path";
+import { basename as basename8, join as join21, resolve as resolve3 } from "path";
 import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -12582,7 +12801,7 @@ function configuredRepos(text, route, base) {
     });
   }
   const dir = m.get("dir");
-  return dir ? [{ name: basename7(String(dir)), dir: expandDir(String(dir), base) }] : [];
+  return dir ? [{ name: basename8(String(dir)), dir: expandDir(String(dir), base) }] : [];
 }
 function planRepoAdd(i) {
   const doc = parseDocument(i.text);
@@ -12594,7 +12813,7 @@ function planRepoAdd(i) {
     throw new ReposError(`${target} is already configured on route ${i.route}`);
   }
   const matched = matchRepoName(i.origin, i.resolved);
-  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename7(target);
+  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename8(target);
   let warning;
   if (!matched) {
     const known = Object.values(i.resolved?.repoNames ?? {});
@@ -12621,6 +12840,28 @@ function planRepoAdd(i) {
   }
   return { text: String(doc), mode, name, block: renderBlock(m), warning, unmatched: !matched };
 }
+function planRepoRemove(text, base, route, path) {
+  const doc = parseDocument(text);
+  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
+  const m = routeMapOf(doc, route);
+  const target = expandDir(path, base);
+  const existing = configuredRepos(text, route, base);
+  const hit = existing.find((e) => e.dir === target);
+  if (!hit) throw new ReposError(`${target} is not configured on route ${route}`);
+  const repos = m.get("repos", true);
+  if (isMap(repos)) {
+    repos.delete(hit.name);
+    const left = existing.filter((e) => e !== hit);
+    if (left.length === 1) {
+      const pair = m.items.find((p) => p.key.value === "repos");
+      pair.key = doc.createNode("dir");
+      pair.value = doc.createNode(String(repos.get(left[0].name)));
+    } else if (left.length === 0) m.delete("repos");
+  } else {
+    m.delete("dir");
+  }
+  return { text: String(doc), name: hit.name };
+}
 function renderBlock(m) {
   return stringify2([m.toJSON()]).trimEnd();
 }
@@ -12686,7 +12927,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join20(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join21(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name });
   return { ...add, remote, target };
 }
@@ -12729,8 +12970,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync5 } from "fs";
-import { basename as basename8, dirname as dirname12, join as join21, resolve as resolve4 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "fs";
+import { basename as basename9, dirname as dirname14, join as join22, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -12761,7 +13002,7 @@ function ticketForWorktree(w, byNumber, contract) {
     const t = num ? byNumber.get(num) : void 0;
     if (t && ticketStems(t).has(stem)) return t;
   }
-  const dir = basename8(w.path);
+  const dir = basename9(w.path);
   const m = DIR_NUMBER.exec(dir);
   if (m && byNumber.has(m[1])) return byNumber.get(m[1]);
   if (!w.branch) {
@@ -12777,15 +13018,15 @@ function worktreeTicketNumbers(target) {
       const n = /-(\d+)$/.exec(BRANCH_STEM.exec(w.branch)?.[1] ?? "")?.[1];
       if (n) nums.add(n);
     }
-    const m = DIR_NUMBER_SUFFIXED.exec(basename8(w.path));
+    const m = DIR_NUMBER_SUFFIXED.exec(basename9(w.path));
     if (m) nums.add(m[1]);
   }
   for (const d of siblingWorktreeDirs(target)) nums.add(d.number);
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname12(target.dir.replace(/[/\\]+$/, ""));
-  const stem = `${basename8(target.dir.replace(/[/\\]+$/, ""))}-`;
+  const parent = dirname14(target.dir.replace(/[/\\]+$/, ""));
+  const stem = `${basename9(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
   try {
@@ -12797,7 +13038,7 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join21(parent, name);
+    const path = join22(parent, name);
     if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
   }
   return out;
@@ -12810,7 +13051,7 @@ function orphanedWorktreeDirs(target, tickets, contract) {
 }
 function warnOrphanedWorktreeDirs(paths, log, held) {
   for (const p of paths) {
-    const number = DIR_NUMBER_SUFFIXED.exec(basename8(p))?.[1];
+    const number = DIR_NUMBER_SUFFIXED.exec(basename9(p))?.[1];
     const when = held && number ? noteHeldWorktree(held.state, { repo: held.repo, path: p, ticket: number, status: "deployed", reason: "orphaned directory" }) : "first";
     if (when) {
       log.warn(`orphaned directory ${p}: its ticket is deployed but it is not a registered worktree; the sweep will not delete it \u2014 remove it by hand`, { step: "worktree" });
@@ -12832,7 +13073,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync21(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync22(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -12840,7 +13081,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync21(a.path)) {
+    if (!dryRun && existsSync22(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -12851,7 +13092,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync21(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync22(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -12900,7 +13141,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync15(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync16(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -12954,7 +13195,7 @@ function isTicketBranch(name, base, stems) {
 }
 function sweepCandidatesExist(cwd, base) {
   const linked = worktrees(cwd).slice(1);
-  if (linked.some((w) => DIR_NUMBER_SUFFIXED.test(basename8(w.path)) || w.branch && BRANCH_STEM.test(w.branch))) return true;
+  if (linked.some((w) => DIR_NUMBER_SUFFIXED.test(basename9(w.path)) || w.branch && BRANCH_STEM.test(w.branch))) return true;
   if (siblingWorktreeDirs({ name: "", dir: cwd }).length) return true;
   return localBranches(cwd).some((b) => b !== base && /-\d+(?:-.*)?$/.test(b));
 }
@@ -13005,14 +13246,14 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
+import { join as join23 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join22(stateDir, "streams");
-  if (!existsSync22(dir)) return [];
+  const dir = join23(stateDir, "streams");
+  if (!existsSync23(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync6(dir).map((name) => join22(dir, name)).filter((path) => {
+  return readdirSync6(dir).map((name) => join23(dir, name)).filter((path) => {
     try {
       return statSync7(path).mtimeMs < cutoff;
     } catch {
@@ -13038,9 +13279,9 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync22(stateDir)) return [];
+  if (!existsSync23(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync6(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join22(stateDir, name)).filter((path) => {
+  return readdirSync6(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join23(stateDir, name)).filter((path) => {
     try {
       return statSync7(path).mtimeMs < cutoff;
     } catch {
@@ -13050,26 +13291,26 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync21, existsSync as existsSync28, mkdirSync as mkdirSync14, writeFileSync as writeFileSync15, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
+import { readFileSync as readFileSync22, existsSync as existsSync29, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, rmSync as rmSync11, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync16, chmodSync } from "fs";
-import { dirname as dirname13, join as join23 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, chmodSync } from "fs";
+import { dirname as dirname15, join as join24 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join23(stateDir, "ssh", "id_ed25519");
+  return join24(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync23(privateKeyPath)) {
-    mkdirSync10(dirname13(privateKeyPath), { recursive: true });
+  if (!existsSync24(privateKeyPath)) {
+    mkdirSync11(dirname15(privateKeyPath), { recursive: true });
     try {
-      execFileSync3("ssh-keygen", [
+      execFileSync4("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -13087,15 +13328,15 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync(privateKeyPath, 384);
   }
-  if (!existsSync23(publicKeyPath)) {
+  if (!existsSync24(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync16(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync17(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync3("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync4("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -13103,11 +13344,11 @@ function sshKeygenAvailable() {
 }
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash4 } from "crypto";
 var realExec = (cmd, args) => {
   try {
-    return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync5(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -13306,9 +13547,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync12, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
 import { randomInt } from "crypto";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn4(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -13375,21 +13616,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join24(stateDir, "passengers", `${workspaceId}.json`);
+  return join25(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync24(path)) return void 0;
+  if (!existsSync25(path)) return void 0;
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    return JSON.parse(readFileSync18(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync11(join24(stateDir, "passengers"), { recursive: true });
-  writeFileSync12(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync12(join25(stateDir, "passengers"), { recursive: true });
+  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -13486,8 +13727,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join24(stateDir, "passengers");
-  if (!existsSync24(dir)) return [];
+  const dir = join25(stateDir, "passengers");
+  if (!existsSync25(dir)) return [];
   return readdirSync7(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -13608,8 +13849,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn5 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
+import { join as join26 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -13698,21 +13939,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join25(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join26(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync25(path)) return void 0;
+  if (!existsSync26(path)) return void 0;
   try {
-    return JSON.parse(readFileSync18(path, "utf8"));
+    return JSON.parse(readFileSync19(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync12(join25(stateDir, "passengers"), { recursive: true });
-  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync13(join26(stateDir, "passengers"), { recursive: true });
+  writeFileSync14(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -13732,8 +13973,8 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join25(stateDir, "passengers");
-  if (!existsSync25(dir)) return [];
+  const dir = join26(stateDir, "passengers");
+  if (!existsSync26(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync8(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -13790,12 +14031,12 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync13, readFileSync as readFileSync20, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync14 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync14, readFileSync as readFileSync21, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync15 } from "fs";
+import { join as join28 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync26, readdirSync as readdirSync9, readFileSync as readFileSync19 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync20 } from "fs";
+import { join as join27 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -13814,21 +14055,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync26(path)) return false;
+  if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync19(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync20(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join26(o.stateDir, "streams");
-  if (!existsSync26(dir)) return [];
+  const dir = join27(o.stateDir, "streams");
+  if (!existsSync27(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync9(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join26(dir, name);
+    const streamPath = join27(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -13928,7 +14169,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync10(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join27(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join28(path, entry.name)));
   }
   return latest;
 }
@@ -13937,23 +14178,23 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync27(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync28(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join27(stateDir, "reload-requested");
+  return join28(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join27(stateDir, "daemon.started");
+  return join28(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync13(stateDir, { recursive: true });
+  mkdirSync14(stateDir, { recursive: true });
   rmSync10(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync14(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync15(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync20(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync21(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -14309,7 +14550,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname14(process.execPath) : resolve5(dirname14(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname16(process.execPath) : resolve5(dirname16(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -14440,8 +14681,10 @@ function usage() {
   crew status [route] [--json]   paused/running state; --json for a machine reader
   crew projects [--route R] [--json]   the Projects rows each route can read (id, name, prefix, work mode)
   crew reload                    make the running daemon re-read crew.yaml (--now: restart it immediately)
-  crew doctor [route] [--fix]    preflight; --fix enables clean routes and offers crew install
+  crew doctor [route] [--fix] [--offline] [--json]   preflight; --fix enables clean routes and offers crew install;
+                                 --offline skips push probes; --json prints push-auth and tool checks only
   crew selftest [route] [--toolchain NAME] [--json]   launch each toolchain as a run would and prove it reaches the tracker
+  crew sample-ticket [route] [--remove] [--dry-run] [--json]   file one ticket on a throwaway repo that walks the dev, QA and release loop
   crew ports [route]             which checkout owns which ports, and what is up
   crew reap [route]              kill orphaned servers, drop worktrees for closed tickets
   crew drop [route] NNN          remove a merged ticket's worktree and branch
@@ -14453,7 +14696,7 @@ function usage() {
                                  resume with no argument clears only the whole-crew pause; a role or release pause needs its own resume
   crew log [route]               tail the log
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
-  crew connect                  resolve a workspace's ids into a crew.yaml block (--no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
+  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
   crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
   crew agents prompt R [route] print one persona's current prompt (e.g. R=pair, for a SessionStart hook; --harness H adds which CLI it serves)
@@ -14865,8 +15108,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join28(homedir8(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync28(staleTimer)) {
+      const staleTimer = join29(homedir8(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync29(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -14892,7 +15135,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync28(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync29(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -14910,7 +15153,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync28(p);
+    const unitExists = (p) => existsSync29(p);
     const crontab = o.host === "linux" ? spawnSync6("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -14927,7 +15170,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync15(cfg.configFile, planEnable(readFileSync21(cfg.configFile, "utf8"), a.route));
+          writeFileSync16(cfg.configFile, planEnable(readFileSync22(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -14944,7 +15187,10 @@ ${changed2.map((c) => `  - ${c}
 `).join("")}` : "fix: nothing changed\n");
   }
   async function resolvedRepos(c) {
-    return Promise.all(reposOf(c).map(async (t) => {
+    return Promise.all(reposOf(c).map((t) => resolveOneRepo(c, t)));
+  }
+  async function resolveOneRepo(c, t) {
+    {
       const id = repoIdForName(c, t.name);
       const o = c.repoOverrides[t.name];
       return {
@@ -14968,7 +15214,7 @@ ${changed2.map((c) => `  - ${c}
           worktrees: { prefix: shipWorktreePrefixFor(c) ?? await areaWorktreePrefix(c, id), nameOverride: o?.worktreeName }
         }, t.dir)
       };
-    }));
+    }
   }
   const worktreeLocations = async (c) => (await resolvedRepos(c)).map((r) => ({
     parent: resolvePath(r.dir, ".."),
@@ -15923,7 +16169,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join28(CREW_HOME, "src"), join28(CREW_HOME, "dist"), join28(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join29(CREW_HOME, "src"), join29(CREW_HOME, "dist"), join29(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -16050,69 +16296,27 @@ ${changed2.map((c) => `  - ${c}
 `);
         process.exit(2);
       }
-      const keyRole = target.resolved.role ?? await fetchKeyRole(target, cfg.ship.userAgent);
-      let readOnly = !isAdminRole(keyRole);
-      let personaResult;
-      const runPersonas = (ro) => syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force, readOnly: ro });
+      let run2;
       try {
-        try {
-          personaResult = await runPersonas(readOnly);
-        } catch (e) {
-          if (readOnly || !isForbidden(e)) throw e;
-          readOnly = true;
-          personaResult = await runPersonas(true);
-        }
+        run2 = await runAgentsSync(target, {
+          userAgent: cfg.ship.userAgent,
+          stateDir: cfg.ship.stateDir,
+          dryRun,
+          force,
+          say: (l) => process.stdout.write(`${l}
+`),
+          warn: (l) => process.stderr.write(`crew agents sync: ${l}
+`)
+        });
       } catch (e) {
-        if (e instanceof AgentsSyncError) {
+        if (e instanceof AgentsSyncError || e instanceof SkillSyncError) {
           process.stderr.write(`crew agents sync: ${e.message}
 `);
           process.exit(2);
         }
         throw e;
       }
-      process.stdout.write(`route: ${target.route}
-`);
-      for (const o of personaResult.outcomes) process.stdout.write(`${describeSyncOutcome(o)}
-`);
-      for (const o of personaResult.crewLinks) process.stdout.write(`${describeCrewLink(o)}
-`);
-      if (personaResult.releaseNote) process.stdout.write(`${personaResult.releaseNote}
-`);
-      const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
-      for (const w of skillMarkerWarnings(target.promptsDir, briefs)) process.stderr.write(`crew agents sync: warning: ${w}
-`);
-      let skillResult;
-      if (!readOnly) {
-        try {
-          skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
-        } catch (e) {
-          if (isForbidden(e)) readOnly = true;
-          else if (e instanceof SkillSyncError) {
-            process.stderr.write(`crew agents sync: ${e.message}
-`);
-            process.exit(2);
-          } else throw e;
-        }
-      }
-      for (const o of skillResult?.outcomes ?? []) process.stdout.write(`${describeSkillSyncOutcome(o)}
-`);
-      if (!dryRun) {
-        const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync28(resolvedPath) ? JSON.parse(readFileSync21(resolvedPath, "utf8")) : {};
-        raw.agentPersonas = personaResult.agentPersonas;
-        if (skillResult) raw.agentSkills = skillResult.agentSkills;
-        if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-        mkdirSync14(dirOf(resolvedPath), { recursive: true });
-        writeFileSync15(resolvedPath, `${JSON.stringify(raw, null, 2)}
-`);
-      }
-      if (!dryRun) {
-        target.resolved.agentPersonas = personaResult.agentPersonas;
-        if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
-      }
-      if (readOnly) {
-        process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
-      }
+      const { personaResult, skillResult } = run2;
       if (flag("revoke-seat-keys")) {
         for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun })) {
           process.stdout.write(`${describeRevokeOutcome(o)}
@@ -16124,9 +16328,7 @@ ${changed2.map((c) => `  - ${c}
 `);
         }
       }
-      if (personaResult.outcomes.some((o) => o.action === "diverged") || (skillResult?.outcomes.some((o) => o.action === "diverged") ?? false)) {
-        process.exitCode = 1;
-      }
+      if (run2.diverged) process.exitCode = 1;
       break;
     }
     case "skills": {
@@ -16168,10 +16370,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync28(resolvedPath) ? JSON.parse(readFileSync21(resolvedPath, "utf8")) : {};
+        const raw = existsSync29(resolvedPath) ? JSON.parse(readFileSync22(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync14(dirOf(resolvedPath), { recursive: true });
-        writeFileSync15(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync15(dirOf(resolvedPath), { recursive: true });
+        writeFileSync16(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16184,14 +16386,14 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone") usage2();
-      const configText = readFileSync21(cfg.configFile, "utf8");
+      const configText = readFileSync22(cfg.configFile, "utf8");
       let routeName = positional[2];
       let addPath = ".";
       let addName;
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync28(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync29(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -16220,15 +16422,15 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync28(resolvedFile)) {
+      if (existsSync29(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync22(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname14(cfg.configFile);
+      const base = dirname16(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16237,7 +16439,7 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync28(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync29(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -16249,9 +16451,9 @@ ${changed2.map((c) => `  - ${c}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir") });
-          if (existsSync28(plan2.target) && (existsSync28(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
+          if (existsSync29(plan2.target) && (existsSync29(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync28(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync29(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -16269,12 +16471,12 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync15(cfg.configFile, plan2.text);
+          writeFileSync16(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir8()));
-        const top = existsSync28(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync29(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -16323,15 +16525,15 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync28(resolvedFile)) {
-            const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          if (existsSync29(resolvedFile)) {
+            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync15(cfg.configFile, plan.text);
+        writeFileSync16(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -16641,10 +16843,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync28(resolvedPath);
+        const hadPreviousFile = existsSync29(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync21(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync22(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -16752,10 +16954,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync14(dirname14(resolvedPath), { recursive: true });
+          mkdirSync15(dirname16(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync15(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync16(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -16790,8 +16992,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync14(dirname14(apiKeyFile), { recursive: true });
-            writeFileSync15(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync15(dirname16(apiKeyFile), { recursive: true });
+            writeFileSync16(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -16800,7 +17002,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const keyPersisted = keychainBacked || apiKeyFile !== void 0;
         const wizard = firstRun;
         const writeFirstRun = wizard !== void 0 && !dryRun && keyPersisted;
-        const routeDir = value("dir") ?? (writeFirstRun ? join28(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
+        const routeDir = value("dir") ?? (writeFirstRun ? join29(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
         const routeBlock = renderConnection(
           found,
           route2,
@@ -16892,6 +17094,56 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `
           );
         }
+        if (!dryRun && !flag("no-agents-sync")) {
+          const skip = (why) => {
+            process.stderr.write(`
+  agents sync: skipped (${why})
+`);
+            connectEvents.emit("agents_synced", `agents sync skipped: ${why}`, { route: route2, skipped: why });
+          };
+          let syncRoute;
+          try {
+            const reloaded = loadConfig(CREW_HOME, wizard?.configPath ?? cfg.configFile, { allowNoRoutes: true });
+            syncRoute = reloaded.routes.find((r) => r.route === route2);
+            if (syncRoute) await hydrateApiKeys([syncRoute]);
+          } catch (e) {
+            skip(`config did not load: ${e.message}`);
+          }
+          if (syncRoute?.resolved) {
+            try {
+              process.stderr.write("\n");
+              const run2 = await runAgentsSync(syncRoute, {
+                userAgent: cfg.ship.userAgent,
+                stateDir: cfg.ship.stateDir,
+                say: (l) => process.stderr.write(`  ${l}
+`),
+                warn: (l) => process.stderr.write(`  agents sync: ${l}
+`)
+              });
+              const minted = await mintMissingSeatKeys(syncRoute, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
+              for (const m of minted) process.stderr.write(`  ${describeMintOutcome(m)}
+`);
+              if (run2.readOnly) {
+                const missing = run2.personaResult.outcomes.some((p) => p.action === "missing");
+                process.stderr.write(missing ? "  A workspace admin has to open the Crew app or run `crew agents sync` once before this ship's seats can run.\n" : "  Seats are linked to the workspace's existing personas.\n");
+              }
+              connectEvents.emit("agents_synced", run2.readOnly ? "agents linked (read-only key)" : "agents synced", {
+                route: route2,
+                admin: !run2.readOnly,
+                personas: run2.personaResult.outcomes,
+                skills: run2.skillResult?.outcomes ?? [],
+                diverged: run2.diverged
+              });
+              for (const m of minted) connectEvents.emit("seat_key", describeMintOutcome(m), { route: route2, ...m });
+              if (run2.diverged) process.exitCode = 1;
+            } catch (e) {
+              if (e instanceof AgentsSyncError || e instanceof SkillSyncError) skip(e.message);
+              else throw e;
+            }
+          } else if (!syncRoute) {
+            skip(`"${route2}" is not in crew.yaml yet; add the block above, then run \`crew agents sync\``);
+          }
+        }
         connectEvents.emit("done", `connected ${route2}`, {
           route: route2,
           resolvedPath: dryRun ? void 0 : resolvedPath,
@@ -17370,8 +17622,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync14(cfg.ship.stateDir, { recursive: true });
-      writeFileSync15(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync15(cfg.ship.stateDir, { recursive: true });
+      writeFileSync16(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -17422,7 +17674,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync21(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync22(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -17431,6 +17683,121 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       }
       break;
     }
+    case "sample-ticket": {
+      const json = flag("json");
+      const say = (event, extra, human) => process.stdout.write(json ? `${JSON.stringify({ event, ...extra })}
+` : `${human}
+`);
+      const fail = (msg) => {
+        if (json) process.stdout.write(`${JSON.stringify({ event: "error", message: msg })}
+`);
+        else process.stderr.write(`crew sample-ticket: ${msg}
+`);
+        return process.exit(2);
+      };
+      if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
+      const tracker = new Tracker(route, cfg.ship);
+      const configText = readFileSync22(cfg.configFile, "utf8");
+      const cfgBase = dirname16(cfg.configFile);
+      const configured = configuredRepos(configText, route.route, cfgBase);
+      const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
+      const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
+      const rows = await tracker.repoRows();
+      const row = rows.find((r) => r.name === SAMPLE_REPO);
+      if (flag("remove")) {
+        const closed = [];
+        if (row) {
+          const wontFix = tracker.contract.statuses.wontFix;
+          const resolved = new Set(tracker.contract.statuses.resolved);
+          for (const t of await tracker.ticketsForRepo(row.id)) {
+            if (resolved.has(t.status) || !isSampleTicket(t.description)) continue;
+            if (!dryRun) {
+              await tracker.updateTicket(t.id, {
+                [tracker.contract.columns.status]: wontFix,
+                [tracker.contract.columns.resolutionNote]: "Sample ticket removed by `crew sample-ticket --remove`; obsolete."
+              });
+            }
+            closed.push(t.issue_tag ?? t.issue_id);
+          }
+        }
+        if (dryRun) {
+          say("dry-run", { dir, row: row?.id ?? null, closed }, `would close ${closed.join(", ") || "no tickets"}, delete the Repos row, detach and delete ${dir}`);
+          break;
+        }
+        if (configured.some((r) => r.dir === dir)) {
+          try {
+            writeFileSync16(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+          } catch (e) {
+            if (e instanceof ReposError) fail(e.message);
+            throw e;
+          }
+        }
+        if (row) {
+          await tracker.deleteRepoRow(row.id);
+          if (existsSync29(resolvedFile)) {
+            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+            if (raw.repoNames) delete raw.repoNames[row.id];
+            if (raw.repoRemotes) delete raw.repoRemotes[row.id];
+            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
+`);
+          }
+        }
+        if (existsSync29(join29(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync11(dir, { recursive: true, force: true });
+        say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
+        break;
+      }
+      const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
+      const fresh = !existsSync29(join29(dir, ".git"));
+      if (existsSync29(dir) && fresh && readdirSync11(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      if (dryRun) {
+        say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
+        break;
+      }
+      if (fresh) {
+        mkdirSync15(dir, { recursive: true });
+        writeFileSync16(join29(dir, "README.md"), SAMPLE_README);
+        writeFileSync16(join29(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        const g = (...a) => {
+          const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
+          if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
+        };
+        g("init", "-b", "main");
+        g("add", ".");
+        g("-c", "user.name=crew", "-c", "user.email=crew@localhost", "commit", "-m", "Initial commit");
+      }
+      let repoId = row?.id;
+      if (!repoId) {
+        const payload = planRepoRow({
+          name: SAMPLE_REPO,
+          origin: SAMPLE_REMOTE,
+          projectId,
+          spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
+        });
+        repoId = (await tracker.createRepoRow(payload)).id;
+        if (existsSync29(resolvedFile)) {
+          const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+          raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
+          raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
+          writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
+`);
+        }
+      }
+      if (!configured.some((r) => r.dir === dir)) {
+        try {
+          writeFileSync16(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+        } catch (e) {
+          if (e instanceof ReposError) fail(e.message);
+          throw e;
+        }
+      }
+      const ticket = await tracker.fileTicket(
+        planSampleTicket({ projectId, repoId, approvedStatus: tracker.contract.statuses.approved }),
+        route.resolved.seats.dev ?? ""
+      );
+      const tag = ticket.issue_tag ?? ticket.issue_id;
+      say("filed", { ticket: tag, id: ticket.id, dir, repoId }, `filed ${tag} against ${dir}; follow it with \`crew watch\``);
+      break;
+    }
     case "selftest": {
       const wanted = value("toolchain");
       const all = shipToolchains(cfg.ship);
@@ -17609,7 +17976,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
               // `synthesis-tabl-123`. `worktreePrefix` above is kept for
               // config-provenance display; this is the field that actually
               // describes where a worktree lands by default.
-              worktreeDirPattern: r.config.worktrees.name ?? (r.config.provenance["worktrees.prefix"] !== "default" ? `${r.config.worktrees.prefix}<number>` : `${basename9(r.dir.replace(/[/\\]+$/, ""))}-<branch>`),
+              worktreeDirPattern: r.config.worktrees.name ?? (r.config.provenance["worktrees.prefix"] !== "default" ? `${r.config.worktrees.prefix}<number>` : `${basename10(r.dir.replace(/[/\\]+$/, ""))}-<branch>`),
               worktreeParent: resolvePath(r.dir, "..")
             })),
             waiting: waiting ? { ticket: waiting.ticket, since: waiting.since, streak: fairness.streak() } : null
@@ -17694,6 +18061,40 @@ watermark:  ${state.watermark()}
     }
     case "doctor": {
       const host = hostPlatform();
+      const doctorSchedulerPath = pathFor(cfg.ship);
+      const pushAuth = [];
+      const toolRows = [];
+      {
+        const prBased = /* @__PURE__ */ new Set();
+        let mentionNode = false;
+        for (const c of [route]) {
+          const { settled: repos, errors } = await settleRepos(reposOf(c), (t) => t.name, (t) => resolveOneRepo(c, t));
+          for (const e of errors) {
+            pushAuth.push({ route: c.route, repo: e.repo, result: { state: "failed", detail: `could not resolve this repo's configuration: ${e.detail}`, hint: "fix the repo's .crew.yaml" } });
+          }
+          for (const r of repos) {
+            const remote = r.config.branch.remote;
+            if (existsSync29(r.dir)) {
+              pushAuth.push({
+                route: c.route,
+                repo: r.name,
+                result: probePushAuth({ dir: r.dir, remote, remoteUrl: originUrlOf(r.dir, remote), offline: flag("offline") })
+              });
+            }
+            if (isPrBased(r.config.hooks)) prBased.add(r.name);
+            if (Object.values(r.config.hooks).some((h) => typeof h === "string" && mentionsNode(h))) mentionNode = true;
+          }
+        }
+        toolRows.push(...toolChecks(
+          { prBased: prBased.size > 0, hostPassengers: cfg.routes.some((x) => x.enabled && x.hostPassengers), hooksMentionNode: mentionNode },
+          (bin) => findOnPath(bin, doctorSchedulerPath)
+        ));
+      }
+      if (flag("json")) {
+        process.stdout.write(`${JSON.stringify({ offline: flag("offline"), pushAuth, tools: toolRows }, null, 2)}
+`);
+        break;
+      }
       process.stdout.write(
         `ship:              ${cfg.ship.name} (${host})
 routes:            ${cfg.routes.map((c) => c.route).join(", ")}
@@ -17701,7 +18102,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync28(evFile) ? statSync9(evFile).size : 0;
+        const evSize = existsSync29(evFile) ? statSync9(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -17712,7 +18113,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync21(p, "utf8");
+            return readFileSync22(p, "utf8");
           } catch {
             return null;
           }
@@ -17742,7 +18143,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       for (const r of await resolvedRepos(route)) {
         const { config } = r;
-        const worktreePattern = config.worktrees.name ?? (config.provenance["worktrees.prefix"] !== "default" ? `${config.worktrees.prefix}<number>` : `${basename9(r.dir.replace(/[/\\]+$/, ""))}-${effectiveBranchTemplate(config, void 0)}`);
+        const worktreePattern = config.worktrees.name ?? (config.provenance["worktrees.prefix"] !== "default" ? `${config.worktrees.prefix}<number>` : `${basename10(r.dir.replace(/[/\\]+$/, ""))}-${effectiveBranchTemplate(config, void 0)}`);
         process.stdout.write(
           `${`repo ${r.name}:`.padEnd(19)}${r.dir}
                    worktrees at ../${worktreePattern} (${config.provenance["worktrees.name"] ?? config.provenance["worktrees.prefix"] ?? "default"}), branch ${config.branch.name}
@@ -17917,6 +18318,8 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
         if (ov.toolchain) process.stdout.write(`repo toolchain:    ${repoName} \u2192 ${ov.toolchain} (binary and MCP checked above, as for every ship toolchain)
 `);
       }
+      for (const p of pushAuth) process.stdout.write(formatPushAuth(`${p.repo}`, p.result));
+      for (const t of toolRows) process.stdout.write(formatToolCheck(t));
       process.stdout.write(`git:               ${gitPath ? `OK (${gitPath})` : "NOT FOUND on the scheduler PATH"}
 `);
       if (!allBinsFound || !gitPath) {