@tablation/crew 0.58.0 → 0.59.0

package/README.md

@@ -71,7 +71,11 @@ demand. `crew agents sync [route]` pushes both personas and skills in one
 run — "agents" here means every agent-shaped resource crew owns, not just
 the Agents table; `crew skills sync [route]` is the same create/update/
 diverged sync narrowed to skills alone, for when you've only touched
-`skills/`. Example use — a Pair session invoked via an Epic's
+`skills/`. `crew connect` runs this same sync (then the seat key mint) at the
+end for an admin key, so a fresh workspace needs no second command; a member
+key links seats to the existing rows and is told an admin has to run it once.
+`--no-agents-sync` skips it, and `--json` adds `agents_synced` and `seat_key`
+events on stdout. Example use — a Pair session invoked via an Epic's
 `grill_link` looks up the `Grill-Me` skill through the Tablation MCP tool
 `agent_skills_controller_get_skill` and follows it. `prompts/default/skills/
 grill-me.md` is one shipped example; the rest are the building lanes'

package/dist/cli.js

@@ -31,6 +31,84 @@ function doctorBaseReport(r, base, health) {
   }
 }
 
+// src/doctor-checks.ts
+import { execFileSync } from "child_process";
+var PROBE_BRANCH = "crew-probe-branch";
+var realGit = (cwd, args, env) => {
+  execFileSync("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
+};
+function isSshRemote(url) {
+  return /^ssh:\/\//.test(url) || /^[\w.-]+@[\w.-]+:/.test(url);
+}
+function pushAuthHint(remoteUrl) {
+  return isSshRemote(remoteUrl) ? "make sure an SSH key is loaded for this host (ssh-add), and that the scheduler user can reach it" : "run `gh auth login`, then `gh auth setup-git`";
+}
+function probePushAuth(o, run2 = realGit, baseEnv = process.env) {
+  if (o.offline) return { state: "skipped", detail: "skipped (--offline)" };
+  if (!o.remoteUrl) return { state: "skipped", detail: `no remote "${o.remote}" configured` };
+  const env = { ...baseEnv, GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never", GIT_SSH_COMMAND: `${baseEnv.GIT_SSH_COMMAND ?? "ssh"} -o BatchMode=yes` };
+  try {
+    run2(o.dir, ["push", "--dry-run", o.remote, `HEAD:refs/heads/${PROBE_BRANCH}`], env);
+    return { state: "ok" };
+  } catch (e) {
+    const err = e;
+    const raw = (err.stderr ? String(err.stderr) : err.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
+    return { state: "failed", detail: raw || "push dry-run failed", hint: pushAuthHint(o.remoteUrl) };
+  }
+}
+var INSTALL_HINTS = {
+  gh: "install GitHub CLI: brew install gh (https://cli.github.com)",
+  node: "install Node: brew install node, or https://nodejs.org",
+  docker: "install Docker Desktop: https://docs.docker.com/get-docker/"
+};
+function mentionsNode(script) {
+  return !!script && /\b(node|npm|pnpm|npx|yarn)\b/.test(script);
+}
+function isPrBased(hooks) {
+  return !!hooks.pr || /\bgh\b/.test(hooks.merged ?? "");
+}
+function toolChecks(o, find) {
+  const mk = (name, need) => {
+    const path = find(name);
+    return { name, need, found: !!path, ...path ? { path } : {}, hint: INSTALL_HINTS[name] };
+  };
+  const node = mk("node", "optional");
+  if (o.hooksMentionNode) node.hint = `your repositories' hooks may need it \u2014 ${node.hint}`;
+  return [mk("gh", o.prBased ? "required" : "optional"), node, mk("docker", o.hostPassengers ? "required" : "optional")];
+}
+function formatToolCheck(t) {
+  const label = `${t.name}:`.padEnd(19);
+  if (t.found) return `${label}OK (${t.path}) [${t.need}]
+`;
+  return `${label}${t.need === "required" ? "NOT FOUND" : "not found"} [${t.need}] \u2014 ${t.hint}
+`;
+}
+function formatPushAuth(repo, r) {
+  const label = `push auth ${repo}:`.padEnd(19);
+  if (r.state === "ok") return `${label}ok
+`;
+  if (r.state === "skipped") return `${label}${r.detail}
+`;
+  return `${label}FAILED \u2014 ${r.detail}; ${r.hint}
+`;
+}
+async function settleRepos(items, nameOf, resolve6) {
+  const out = await Promise.all(items.map(async (t) => {
+    try {
+      return { ok: true, value: await resolve6(t) };
+    } catch (e) {
+      return { ok: false, repo: nameOf(t), detail: e.message };
+    }
+  }));
+  const settled = [];
+  const errors = [];
+  for (const o of out) {
+    if (o.ok) settled.push(o.value);
+    else errors.push({ repo: o.repo, detail: o.detail });
+  }
+  return { settled, errors };
+}
+
 // src/selftest.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
@@ -5104,7 +5182,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname15, join as join29, basename as basename10 } from "path";
+import { resolve as resolve5, dirname as dirname16, join as join29, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
@@ -6078,7 +6156,7 @@ function recoveredFailureHeadlines(o, route) {
 import { existsSync as existsSync15, statfsSync } from "fs";
 
 // src/git.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync7,
@@ -6100,7 +6178,7 @@ function streamText(x) {
 }
 function gitRaw(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -6109,7 +6187,7 @@ function gitRaw(cwd, args) {
 }
 function git(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -6266,9 +6344,9 @@ function keyCommitsInRange(cwd, key, range) {
 }
 function patchIdOf(cwd, from, to) {
   try {
-    const diff = execFileSync("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    const diff = execFileSync2("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (!diff) return null;
-    const out = execFileSync("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
+    const out = execFileSync2("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
     return out.split(" ")[0]?.trim() || null;
   } catch {
     return null;
@@ -6532,7 +6610,7 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
   mkdirSync7(dirname6(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -9243,12 +9321,12 @@ import { existsSync as existsSync17 } from "fs";
 import { dirname as dirname7, join as join17 } from "path";
 
 // src/ports.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync16 } from "fs";
 import { join as join16 } from "path";
 var run = (cmd, args) => {
   try {
-    return execFileSync2(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return "";
   }
@@ -12439,6 +12517,60 @@ async function canMintAgentKeys(route, o = {}) {
   }
 }
 
+// src/agents-sync-run.ts
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11 } from "path";
+async function runAgentsSync(target, o) {
+  const dryRun = o.dryRun ?? false;
+  const force = o.force ?? false;
+  const keyRole = target.resolved?.role ?? await fetchKeyRole(target, o.userAgent);
+  let readOnly = !isAdminRole(keyRole);
+  const runPersonas = (ro) => syncPersonas(target, { userAgent: o.userAgent, dryRun, force, readOnly: ro });
+  let personaResult;
+  try {
+    personaResult = await runPersonas(readOnly);
+  } catch (e) {
+    if (readOnly || !isForbidden(e)) throw e;
+    readOnly = true;
+    personaResult = await runPersonas(true);
+  }
+  o.say(`route: ${target.route}`);
+  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
+  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
+  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
+  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
+  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
+  let skillResult;
+  if (!readOnly) {
+    try {
+      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
+    } catch (e) {
+      if (isForbidden(e)) readOnly = true;
+      else throw e;
+    }
+  }
+  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
+  if (!dryRun) {
+    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
+    const raw = existsSync21(resolvedPath) ? JSON.parse(readFileSync15(resolvedPath, "utf8")) : {};
+    raw.agentPersonas = personaResult.agentPersonas;
+    if (skillResult) raw.agentSkills = skillResult.agentSkills;
+    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
+    mkdirSync10(dirname11(resolvedPath), { recursive: true });
+    writeFileSync12(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+    if (target.resolved) {
+      target.resolved.agentPersonas = personaResult.agentPersonas;
+      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
+    }
+  }
+  if (readOnly) {
+    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
+  }
+  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
+  return { personaResult, skillResult, readOnly, diverged };
+}
+
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
@@ -12528,7 +12660,7 @@ async function showLogEntry(route, entryId, opts = {}) {
 }
 
 // src/sample-ticket.ts
-import { basename as basename7, dirname as dirname11, join as join20 } from "path";
+import { basename as basename7, dirname as dirname12, join as join20 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -12551,7 +12683,7 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join20(dirname11(existing[0]), SAMPLE_REPO);
+  if (existing.length > 0) return join20(dirname12(existing[0]), SAMPLE_REPO);
   return join20(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
@@ -12838,8 +12970,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync5 } from "fs";
-import { basename as basename9, dirname as dirname13, join as join22, resolve as resolve4 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "fs";
+import { basename as basename9, dirname as dirname14, join as join22, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -12893,7 +13025,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname13(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname14(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename9(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
@@ -12941,7 +13073,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync21(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync22(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -12949,7 +13081,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync21(a.path)) {
+    if (!dryRun && existsSync22(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -12960,7 +13092,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync21(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync22(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -13009,7 +13141,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync15(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync16(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -13114,12 +13246,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
 import { join as join23 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join23(stateDir, "streams");
-  if (!existsSync22(dir)) return [];
+  if (!existsSync23(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync6(dir).map((name) => join23(dir, name)).filter((path) => {
     try {
@@ -13147,7 +13279,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync22(stateDir)) return [];
+  if (!existsSync23(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync6(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join23(stateDir, name)).filter((path) => {
     try {
@@ -13159,14 +13291,14 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync21, existsSync as existsSync28, mkdirSync as mkdirSync14, writeFileSync as writeFileSync15, rmSync as rmSync11, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
+import { readFileSync as readFileSync22, existsSync as existsSync29, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, rmSync as rmSync11, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync16, chmodSync } from "fs";
-import { dirname as dirname14, join as join24 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, chmodSync } from "fs";
+import { dirname as dirname15, join as join24 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
@@ -13175,10 +13307,10 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync23(privateKeyPath)) {
-    mkdirSync10(dirname14(privateKeyPath), { recursive: true });
+  if (!existsSync24(privateKeyPath)) {
+    mkdirSync11(dirname15(privateKeyPath), { recursive: true });
     try {
-      execFileSync3("ssh-keygen", [
+      execFileSync4("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -13196,15 +13328,15 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync(privateKeyPath, 384);
   }
-  if (!existsSync23(publicKeyPath)) {
+  if (!existsSync24(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync16(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync17(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync3("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync4("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -13212,11 +13344,11 @@ function sshKeygenAvailable() {
 }
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash4 } from "crypto";
 var realExec = (cmd, args) => {
   try {
-    return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync5(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -13415,7 +13547,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync12, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
 import { randomInt } from "crypto";
 import { join as join25 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -13488,17 +13620,17 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync24(path)) return void 0;
+  if (!existsSync25(path)) return void 0;
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    return JSON.parse(readFileSync18(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync11(join25(stateDir, "passengers"), { recursive: true });
-  writeFileSync12(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync12(join25(stateDir, "passengers"), { recursive: true });
+  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -13596,7 +13728,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join25(stateDir, "passengers");
-  if (!existsSync24(dir)) return [];
+  if (!existsSync25(dir)) return [];
   return readdirSync7(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -13717,7 +13849,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn5 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
 import { join as join26 } from "path";
 
 // src/secret-compare.ts
@@ -13811,17 +13943,17 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync25(path)) return void 0;
+  if (!existsSync26(path)) return void 0;
   try {
-    return JSON.parse(readFileSync18(path, "utf8"));
+    return JSON.parse(readFileSync19(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync12(join26(stateDir, "passengers"), { recursive: true });
-  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync13(join26(stateDir, "passengers"), { recursive: true });
+  writeFileSync14(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -13842,7 +13974,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join26(stateDir, "passengers");
-  if (!existsSync25(dir)) return [];
+  if (!existsSync26(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync8(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -13899,11 +14031,11 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync13, readFileSync as readFileSync20, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync14, readFileSync as readFileSync21, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync15 } from "fs";
 import { join as join28 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync26, readdirSync as readdirSync9, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync20 } from "fs";
 import { join as join27 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
@@ -13923,16 +14055,16 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync26(path)) return false;
+  if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync19(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync20(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
   const dir = join27(o.stateDir, "streams");
-  if (!existsSync26(dir)) return [];
+  if (!existsSync27(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync9(dir)) {
@@ -14046,7 +14178,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync27(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync28(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join28(stateDir, "reload-requested");
@@ -14055,14 +14187,14 @@ function daemonStampFor(stateDir) {
   return join28(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync13(stateDir, { recursive: true });
+  mkdirSync14(stateDir, { recursive: true });
   rmSync10(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync14(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync15(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync20(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync21(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -14418,7 +14550,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname15(process.execPath) : resolve5(dirname15(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname16(process.execPath) : resolve5(dirname16(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -14549,7 +14681,8 @@ function usage() {
   crew status [route] [--json]   paused/running state; --json for a machine reader
   crew projects [--route R] [--json]   the Projects rows each route can read (id, name, prefix, work mode)
   crew reload                    make the running daemon re-read crew.yaml (--now: restart it immediately)
-  crew doctor [route] [--fix]    preflight; --fix enables clean routes and offers crew install
+  crew doctor [route] [--fix] [--offline] [--json]   preflight; --fix enables clean routes and offers crew install;
+                                 --offline skips push probes; --json prints push-auth and tool checks only
   crew selftest [route] [--toolchain NAME] [--json]   launch each toolchain as a run would and prove it reaches the tracker
   crew sample-ticket [route] [--remove] [--dry-run] [--json]   file one ticket on a throwaway repo that walks the dev, QA and release loop
   crew ports [route]             which checkout owns which ports, and what is up
@@ -14563,7 +14696,7 @@ function usage() {
                                  resume with no argument clears only the whole-crew pause; a role or release pause needs its own resume
   crew log [route]               tail the log
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
-  crew connect                  resolve a workspace's ids into a crew.yaml block (--no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
+  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
   crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
   crew agents prompt R [route] print one persona's current prompt (e.g. R=pair, for a SessionStart hook; --harness H adds which CLI it serves)
@@ -14976,7 +15109,7 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join29(homedir8(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync28(staleTimer)) {
+      if (existsSync29(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -15002,7 +15135,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync28(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync29(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -15020,7 +15153,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync28(p);
+    const unitExists = (p) => existsSync29(p);
     const crontab = o.host === "linux" ? spawnSync6("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -15037,7 +15170,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync15(cfg.configFile, planEnable(readFileSync21(cfg.configFile, "utf8"), a.route));
+          writeFileSync16(cfg.configFile, planEnable(readFileSync22(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -15054,7 +15187,10 @@ ${changed2.map((c) => `  - ${c}
 `).join("")}` : "fix: nothing changed\n");
   }
   async function resolvedRepos(c) {
-    return Promise.all(reposOf(c).map(async (t) => {
+    return Promise.all(reposOf(c).map((t) => resolveOneRepo(c, t)));
+  }
+  async function resolveOneRepo(c, t) {
+    {
       const id = repoIdForName(c, t.name);
       const o = c.repoOverrides[t.name];
       return {
@@ -15078,7 +15214,7 @@ ${changed2.map((c) => `  - ${c}
           worktrees: { prefix: shipWorktreePrefixFor(c) ?? await areaWorktreePrefix(c, id), nameOverride: o?.worktreeName }
         }, t.dir)
       };
-    }));
+    }
   }
   const worktreeLocations = async (c) => (await resolvedRepos(c)).map((r) => ({
     parent: resolvePath(r.dir, ".."),
@@ -16160,69 +16296,27 @@ ${changed2.map((c) => `  - ${c}
 `);
         process.exit(2);
       }
-      const keyRole = target.resolved.role ?? await fetchKeyRole(target, cfg.ship.userAgent);
-      let readOnly = !isAdminRole(keyRole);
-      let personaResult;
-      const runPersonas = (ro) => syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force, readOnly: ro });
+      let run2;
       try {
-        try {
-          personaResult = await runPersonas(readOnly);
-        } catch (e) {
-          if (readOnly || !isForbidden(e)) throw e;
-          readOnly = true;
-          personaResult = await runPersonas(true);
-        }
+        run2 = await runAgentsSync(target, {
+          userAgent: cfg.ship.userAgent,
+          stateDir: cfg.ship.stateDir,
+          dryRun,
+          force,
+          say: (l) => process.stdout.write(`${l}
+`),
+          warn: (l) => process.stderr.write(`crew agents sync: ${l}
+`)
+        });
       } catch (e) {
-        if (e instanceof AgentsSyncError) {
+        if (e instanceof AgentsSyncError || e instanceof SkillSyncError) {
           process.stderr.write(`crew agents sync: ${e.message}
 `);
           process.exit(2);
         }
         throw e;
       }
-      process.stdout.write(`route: ${target.route}
-`);
-      for (const o of personaResult.outcomes) process.stdout.write(`${describeSyncOutcome(o)}
-`);
-      for (const o of personaResult.crewLinks) process.stdout.write(`${describeCrewLink(o)}
-`);
-      if (personaResult.releaseNote) process.stdout.write(`${personaResult.releaseNote}
-`);
-      const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
-      for (const w of skillMarkerWarnings(target.promptsDir, briefs)) process.stderr.write(`crew agents sync: warning: ${w}
-`);
-      let skillResult;
-      if (!readOnly) {
-        try {
-          skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
-        } catch (e) {
-          if (isForbidden(e)) readOnly = true;
-          else if (e instanceof SkillSyncError) {
-            process.stderr.write(`crew agents sync: ${e.message}
-`);
-            process.exit(2);
-          } else throw e;
-        }
-      }
-      for (const o of skillResult?.outcomes ?? []) process.stdout.write(`${describeSkillSyncOutcome(o)}
-`);
-      if (!dryRun) {
-        const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync28(resolvedPath) ? JSON.parse(readFileSync21(resolvedPath, "utf8")) : {};
-        raw.agentPersonas = personaResult.agentPersonas;
-        if (skillResult) raw.agentSkills = skillResult.agentSkills;
-        if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-        mkdirSync14(dirOf(resolvedPath), { recursive: true });
-        writeFileSync15(resolvedPath, `${JSON.stringify(raw, null, 2)}
-`);
-      }
-      if (!dryRun) {
-        target.resolved.agentPersonas = personaResult.agentPersonas;
-        if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
-      }
-      if (readOnly) {
-        process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
-      }
+      const { personaResult, skillResult } = run2;
       if (flag("revoke-seat-keys")) {
         for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun })) {
           process.stdout.write(`${describeRevokeOutcome(o)}
@@ -16234,9 +16328,7 @@ ${changed2.map((c) => `  - ${c}
 `);
         }
       }
-      if (personaResult.outcomes.some((o) => o.action === "diverged") || (skillResult?.outcomes.some((o) => o.action === "diverged") ?? false)) {
-        process.exitCode = 1;
-      }
+      if (run2.diverged) process.exitCode = 1;
       break;
     }
     case "skills": {
@@ -16278,10 +16370,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync28(resolvedPath) ? JSON.parse(readFileSync21(resolvedPath, "utf8")) : {};
+        const raw = existsSync29(resolvedPath) ? JSON.parse(readFileSync22(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync14(dirOf(resolvedPath), { recursive: true });
-        writeFileSync15(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync15(dirOf(resolvedPath), { recursive: true });
+        writeFileSync16(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16294,14 +16386,14 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone") usage2();
-      const configText = readFileSync21(cfg.configFile, "utf8");
+      const configText = readFileSync22(cfg.configFile, "utf8");
       let routeName = positional[2];
       let addPath = ".";
       let addName;
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync28(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync29(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -16330,15 +16422,15 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync28(resolvedFile)) {
+      if (existsSync29(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync22(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname15(cfg.configFile);
+      const base = dirname16(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16347,7 +16439,7 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync28(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync29(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -16359,9 +16451,9 @@ ${changed2.map((c) => `  - ${c}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir") });
-          if (existsSync28(plan2.target) && (existsSync28(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
+          if (existsSync29(plan2.target) && (existsSync29(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync28(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync29(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -16379,12 +16471,12 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync15(cfg.configFile, plan2.text);
+          writeFileSync16(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir8()));
-        const top = existsSync28(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync29(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -16433,15 +16525,15 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync28(resolvedFile)) {
-            const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          if (existsSync29(resolvedFile)) {
+            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync15(cfg.configFile, plan.text);
+        writeFileSync16(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -16751,10 +16843,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync28(resolvedPath);
+        const hadPreviousFile = existsSync29(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync21(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync22(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -16862,10 +16954,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync14(dirname15(resolvedPath), { recursive: true });
+          mkdirSync15(dirname16(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync15(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync16(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -16900,8 +16992,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync14(dirname15(apiKeyFile), { recursive: true });
-            writeFileSync15(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync15(dirname16(apiKeyFile), { recursive: true });
+            writeFileSync16(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -17002,6 +17094,56 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `
           );
         }
+        if (!dryRun && !flag("no-agents-sync")) {
+          const skip = (why) => {
+            process.stderr.write(`
+  agents sync: skipped (${why})
+`);
+            connectEvents.emit("agents_synced", `agents sync skipped: ${why}`, { route: route2, skipped: why });
+          };
+          let syncRoute;
+          try {
+            const reloaded = loadConfig(CREW_HOME, wizard?.configPath ?? cfg.configFile, { allowNoRoutes: true });
+            syncRoute = reloaded.routes.find((r) => r.route === route2);
+            if (syncRoute) await hydrateApiKeys([syncRoute]);
+          } catch (e) {
+            skip(`config did not load: ${e.message}`);
+          }
+          if (syncRoute?.resolved) {
+            try {
+              process.stderr.write("\n");
+              const run2 = await runAgentsSync(syncRoute, {
+                userAgent: cfg.ship.userAgent,
+                stateDir: cfg.ship.stateDir,
+                say: (l) => process.stderr.write(`  ${l}
+`),
+                warn: (l) => process.stderr.write(`  agents sync: ${l}
+`)
+              });
+              const minted = await mintMissingSeatKeys(syncRoute, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
+              for (const m of minted) process.stderr.write(`  ${describeMintOutcome(m)}
+`);
+              if (run2.readOnly) {
+                const missing = run2.personaResult.outcomes.some((p) => p.action === "missing");
+                process.stderr.write(missing ? "  A workspace admin has to open the Crew app or run `crew agents sync` once before this ship's seats can run.\n" : "  Seats are linked to the workspace's existing personas.\n");
+              }
+              connectEvents.emit("agents_synced", run2.readOnly ? "agents linked (read-only key)" : "agents synced", {
+                route: route2,
+                admin: !run2.readOnly,
+                personas: run2.personaResult.outcomes,
+                skills: run2.skillResult?.outcomes ?? [],
+                diverged: run2.diverged
+              });
+              for (const m of minted) connectEvents.emit("seat_key", describeMintOutcome(m), { route: route2, ...m });
+              if (run2.diverged) process.exitCode = 1;
+            } catch (e) {
+              if (e instanceof AgentsSyncError || e instanceof SkillSyncError) skip(e.message);
+              else throw e;
+            }
+          } else if (!syncRoute) {
+            skip(`"${route2}" is not in crew.yaml yet; add the block above, then run \`crew agents sync\``);
+          }
+        }
         connectEvents.emit("done", `connected ${route2}`, {
           route: route2,
           resolvedPath: dryRun ? void 0 : resolvedPath,
@@ -17480,8 +17622,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync14(cfg.ship.stateDir, { recursive: true });
-      writeFileSync15(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync15(cfg.ship.stateDir, { recursive: true });
+      writeFileSync16(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -17532,7 +17674,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync21(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync22(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -17555,8 +17697,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync21(cfg.configFile, "utf8");
-      const cfgBase = dirname15(cfg.configFile);
+      const configText = readFileSync22(cfg.configFile, "utf8");
+      const cfgBase = dirname16(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -17584,7 +17726,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync15(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync16(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -17592,29 +17734,29 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync28(resolvedFile)) {
-            const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          if (existsSync29(resolvedFile)) {
+            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync28(join29(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync11(dir, { recursive: true, force: true });
+        if (existsSync29(join29(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync11(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync28(join29(dir, ".git"));
-      if (existsSync28(dir) && fresh && readdirSync11(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync29(join29(dir, ".git"));
+      if (existsSync29(dir) && fresh && readdirSync11(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync14(dir, { recursive: true });
-        writeFileSync15(join29(dir, "README.md"), SAMPLE_README);
-        writeFileSync15(join29(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync15(dir, { recursive: true });
+        writeFileSync16(join29(dir, "README.md"), SAMPLE_README);
+        writeFileSync16(join29(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -17632,17 +17774,17 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync28(resolvedFile)) {
-          const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+        if (existsSync29(resolvedFile)) {
+          const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync15(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync16(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -17919,6 +18061,40 @@ watermark:  ${state.watermark()}
     }
     case "doctor": {
       const host = hostPlatform();
+      const doctorSchedulerPath = pathFor(cfg.ship);
+      const pushAuth = [];
+      const toolRows = [];
+      {
+        const prBased = /* @__PURE__ */ new Set();
+        let mentionNode = false;
+        for (const c of [route]) {
+          const { settled: repos, errors } = await settleRepos(reposOf(c), (t) => t.name, (t) => resolveOneRepo(c, t));
+          for (const e of errors) {
+            pushAuth.push({ route: c.route, repo: e.repo, result: { state: "failed", detail: `could not resolve this repo's configuration: ${e.detail}`, hint: "fix the repo's .crew.yaml" } });
+          }
+          for (const r of repos) {
+            const remote = r.config.branch.remote;
+            if (existsSync29(r.dir)) {
+              pushAuth.push({
+                route: c.route,
+                repo: r.name,
+                result: probePushAuth({ dir: r.dir, remote, remoteUrl: originUrlOf(r.dir, remote), offline: flag("offline") })
+              });
+            }
+            if (isPrBased(r.config.hooks)) prBased.add(r.name);
+            if (Object.values(r.config.hooks).some((h) => typeof h === "string" && mentionsNode(h))) mentionNode = true;
+          }
+        }
+        toolRows.push(...toolChecks(
+          { prBased: prBased.size > 0, hostPassengers: cfg.routes.some((x) => x.enabled && x.hostPassengers), hooksMentionNode: mentionNode },
+          (bin) => findOnPath(bin, doctorSchedulerPath)
+        ));
+      }
+      if (flag("json")) {
+        process.stdout.write(`${JSON.stringify({ offline: flag("offline"), pushAuth, tools: toolRows }, null, 2)}
+`);
+        break;
+      }
       process.stdout.write(
         `ship:              ${cfg.ship.name} (${host})
 routes:            ${cfg.routes.map((c) => c.route).join(", ")}
@@ -17926,7 +18102,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync28(evFile) ? statSync9(evFile).size : 0;
+        const evSize = existsSync29(evFile) ? statSync9(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -17937,7 +18113,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync21(p, "utf8");
+            return readFileSync22(p, "utf8");
           } catch {
             return null;
           }
@@ -18142,6 +18318,8 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
         if (ov.toolchain) process.stdout.write(`repo toolchain:    ${repoName} \u2192 ${ov.toolchain} (binary and MCP checked above, as for every ship toolchain)
 `);
       }
+      for (const p of pushAuth) process.stdout.write(formatPushAuth(`${p.repo}`, p.result));
+      for (const t of toolRows) process.stdout.write(formatToolCheck(t));
       process.stdout.write(`git:               ${gitPath ? `OK (${gitPath})` : "NOT FOUND on the scheduler PATH"}
 `);
       if (!allBinsFound || !gitPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",