@tablation/crew 0.58.0 → 0.60.0

package/dist/cli.js

@@ -31,6 +31,84 @@ function doctorBaseReport(r, base, health) {
   }
 }
 
+// src/doctor-checks.ts
+import { execFileSync } from "child_process";
+var PROBE_BRANCH = "crew-probe-branch";
+var realGit = (cwd, args, env) => {
+  execFileSync("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
+};
+function isSshRemote(url) {
+  return /^ssh:\/\//.test(url) || /^[\w.-]+@[\w.-]+:/.test(url);
+}
+function pushAuthHint(remoteUrl) {
+  return isSshRemote(remoteUrl) ? "make sure an SSH key is loaded for this host (ssh-add), and that the scheduler user can reach it" : "run `gh auth login`, then `gh auth setup-git`";
+}
+function probePushAuth(o, run2 = realGit, baseEnv = process.env) {
+  if (o.offline) return { state: "skipped", detail: "skipped (--offline)" };
+  if (!o.remoteUrl) return { state: "skipped", detail: `no remote "${o.remote}" configured` };
+  const env = { ...baseEnv, GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never", GIT_SSH_COMMAND: `${baseEnv.GIT_SSH_COMMAND ?? "ssh"} -o BatchMode=yes` };
+  try {
+    run2(o.dir, ["push", "--dry-run", o.remote, `HEAD:refs/heads/${PROBE_BRANCH}`], env);
+    return { state: "ok" };
+  } catch (e) {
+    const err = e;
+    const raw = (err.stderr ? String(err.stderr) : err.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
+    return { state: "failed", detail: raw || "push dry-run failed", hint: pushAuthHint(o.remoteUrl) };
+  }
+}
+var INSTALL_HINTS = {
+  gh: "install GitHub CLI: brew install gh (https://cli.github.com)",
+  node: "install Node: brew install node, or https://nodejs.org",
+  docker: "install Docker Desktop: https://docs.docker.com/get-docker/"
+};
+function mentionsNode(script) {
+  return !!script && /\b(node|npm|pnpm|npx|yarn)\b/.test(script);
+}
+function isPrBased(hooks) {
+  return !!hooks.pr || /\bgh\b/.test(hooks.merged ?? "");
+}
+function toolChecks(o, find) {
+  const mk = (name, need) => {
+    const path = find(name);
+    return { name, need, found: !!path, ...path ? { path } : {}, hint: INSTALL_HINTS[name] };
+  };
+  const node = mk("node", "optional");
+  if (o.hooksMentionNode) node.hint = `your repositories' hooks may need it \u2014 ${node.hint}`;
+  return [mk("gh", o.prBased ? "required" : "optional"), node, mk("docker", o.hostPassengers ? "required" : "optional")];
+}
+function formatToolCheck(t) {
+  const label = `${t.name}:`.padEnd(19);
+  if (t.found) return `${label}OK (${t.path}) [${t.need}]
+`;
+  return `${label}${t.need === "required" ? "NOT FOUND" : "not found"} [${t.need}] \u2014 ${t.hint}
+`;
+}
+function formatPushAuth(repo, r) {
+  const label = `push auth ${repo}:`.padEnd(19);
+  if (r.state === "ok") return `${label}ok
+`;
+  if (r.state === "skipped") return `${label}${r.detail}
+`;
+  return `${label}FAILED \u2014 ${r.detail}; ${r.hint}
+`;
+}
+async function settleRepos(items, nameOf, resolve6) {
+  const out = await Promise.all(items.map(async (t) => {
+    try {
+      return { ok: true, value: await resolve6(t) };
+    } catch (e) {
+      return { ok: false, repo: nameOf(t), detail: e.message };
+    }
+  }));
+  const settled = [];
+  const errors = [];
+  for (const o of out) {
+    if (o.ok) settled.push(o.value);
+    else errors.push({ repo: o.repo, detail: o.detail });
+  }
+  return { settled, errors };
+}
+
 // src/selftest.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
@@ -5104,7 +5182,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname15, join as join29, basename as basename10 } from "path";
+import { resolve as resolve5, dirname as dirname16, join as join29, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
@@ -5133,7 +5211,8 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "tail",
   "ticket",
   "workspace",
-  "workspace-id"
+  "workspace-id",
+  "write"
 ]);
 function positionalArgs(argv2) {
   const out = [];
@@ -6078,7 +6157,7 @@ function recoveredFailureHeadlines(o, route) {
 import { existsSync as existsSync15, statfsSync } from "fs";
 
 // src/git.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync7,
@@ -6100,7 +6179,7 @@ function streamText(x) {
 }
 function gitRaw(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -6109,7 +6188,7 @@ function gitRaw(cwd, args) {
 }
 function git(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -6266,9 +6345,9 @@ function keyCommitsInRange(cwd, key, range) {
 }
 function patchIdOf(cwd, from, to) {
   try {
-    const diff = execFileSync("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    const diff = execFileSync2("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (!diff) return null;
-    const out = execFileSync("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
+    const out = execFileSync2("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
     return out.split(" ")[0]?.trim() || null;
   } catch {
     return null;
@@ -6532,7 +6611,7 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
   mkdirSync7(dirname6(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -9243,12 +9322,12 @@ import { existsSync as existsSync17 } from "fs";
 import { dirname as dirname7, join as join17 } from "path";
 
 // src/ports.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync16 } from "fs";
 import { join as join16 } from "path";
 var run = (cmd, args) => {
   try {
-    return execFileSync2(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return "";
   }
@@ -12439,6 +12518,60 @@ async function canMintAgentKeys(route, o = {}) {
   }
 }
 
+// src/agents-sync-run.ts
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11 } from "path";
+async function runAgentsSync(target, o) {
+  const dryRun = o.dryRun ?? false;
+  const force = o.force ?? false;
+  const keyRole = target.resolved?.role ?? await fetchKeyRole(target, o.userAgent);
+  let readOnly = !isAdminRole(keyRole);
+  const runPersonas = (ro) => syncPersonas(target, { userAgent: o.userAgent, dryRun, force, readOnly: ro });
+  let personaResult;
+  try {
+    personaResult = await runPersonas(readOnly);
+  } catch (e) {
+    if (readOnly || !isForbidden(e)) throw e;
+    readOnly = true;
+    personaResult = await runPersonas(true);
+  }
+  o.say(`route: ${target.route}`);
+  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
+  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
+  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
+  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
+  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
+  let skillResult;
+  if (!readOnly) {
+    try {
+      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
+    } catch (e) {
+      if (isForbidden(e)) readOnly = true;
+      else throw e;
+    }
+  }
+  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
+  if (!dryRun) {
+    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
+    const raw = existsSync21(resolvedPath) ? JSON.parse(readFileSync15(resolvedPath, "utf8")) : {};
+    raw.agentPersonas = personaResult.agentPersonas;
+    if (skillResult) raw.agentSkills = skillResult.agentSkills;
+    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
+    mkdirSync10(dirname11(resolvedPath), { recursive: true });
+    writeFileSync12(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+    if (target.resolved) {
+      target.resolved.agentPersonas = personaResult.agentPersonas;
+      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
+    }
+  }
+  if (readOnly) {
+    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
+  }
+  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
+  return { personaResult, skillResult, readOnly, diverged };
+}
+
 // src/logbook.ts
 import { createHash as createHash3 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
@@ -12527,77 +12660,12 @@ async function showLogEntry(route, entryId, opts = {}) {
   };
 }
 
-// src/sample-ticket.ts
-import { basename as basename7, dirname as dirname11, join as join20 } from "path";
-var SAMPLE_REPO = "crew-sample";
-var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
-var SAMPLE_MARKER = "sample: true";
-var SAMPLE_CREW_YAML = `version: 1
-platform: unix
-branch:
-  base: main
-hooks:
-  test: "true"
-  build: "true"
-release:
-  mode: integrate
-  versioning: none
-  changelog: false
-`;
-var SAMPLE_README = `# crew-sample
-
-A throwaway repository created by \`crew sample-ticket\`. It exists so the crew
-has something safe to work on: its test and build hooks always pass, it has no
-remote, and \`crew sample-ticket --remove\` deletes it.
-`;
-function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join20(dirname11(existing[0]), SAMPLE_REPO);
-  return join20(reposBase, workspace, SAMPLE_REPO);
-}
-var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
-function sampleDescription() {
-  return [
-    SAMPLE_MARKER,
-    "",
-    "> This is a sample ticket filed by `crew sample-ticket` on a throwaway repository. Nothing here is real work.",
-    "",
-    "## What",
-    "",
-    "Add `greet.js` exporting `greet(name)`, which returns `Hello, <name>!` (and `Hello, world!` for no name),",
-    "with a JSDoc comment, and `greet.test.js` covering both cases using `node:test`.",
-    "",
-    "## Acceptance",
-    "",
-    '- `greet("Ada")` returns `Hello, Ada!`; `greet()` returns `Hello, world!`.',
-    "- The test file runs with `node --test` and passes.",
-    "- Add a line to the README saying the function exists.",
-    "",
-    "## Notes",
-    "",
-    "The repo has no remote: leave the branch local. The hooks in `.crew.yaml` always pass, so QA is checking the",
-    "diff against the acceptance list above."
-  ].join("\n");
-}
-function isSampleTicket(description) {
-  return (description ?? "").trimStart().startsWith(SAMPLE_MARKER);
-}
-function planSampleTicket(i) {
-  return {
-    title: SAMPLE_TITLE,
-    description: sampleDescription(),
-    report_type: "feature",
-    severity: "s4",
-    reporter_name: "crew sample-ticket",
-    status: i.approvedStatus,
-    project_id: i.projectId,
-    repo_id: i.repoId,
-    ...i.filedBy ? { filed_by_id: i.filedBy } : {}
-  };
-}
+// src/repos-hooks.ts
+import { isMap as isMap2, parseDocument as parseDocument2, YAMLMap } from "yaml";
 
 // src/repos-cmd.ts
 import { homedir as homedir7 } from "os";
-import { basename as basename8, join as join21, resolve as resolve3 } from "path";
+import { basename as basename7, join as join20, resolve as resolve3 } from "path";
 import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -12669,7 +12737,7 @@ function configuredRepos(text, route, base) {
     });
   }
   const dir = m.get("dir");
-  return dir ? [{ name: basename8(String(dir)), dir: expandDir(String(dir), base) }] : [];
+  return dir ? [{ name: basename7(String(dir)), dir: expandDir(String(dir), base) }] : [];
 }
 function planRepoAdd(i) {
   const doc = parseDocument(i.text);
@@ -12681,7 +12749,7 @@ function planRepoAdd(i) {
     throw new ReposError(`${target} is already configured on route ${i.route}`);
   }
   const matched = matchRepoName(i.origin, i.resolved);
-  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename8(target);
+  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename7(target);
   let warning;
   if (!matched) {
     const known = Object.values(i.resolved?.repoNames ?? {});
@@ -12795,13 +12863,218 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join21(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join20(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name });
   return { ...add, remote, target };
 }
 
+// src/repos-hooks.ts
+function packageManager(f) {
+  if (f.exists("pnpm-lock.yaml")) return "pnpm";
+  if (f.exists("yarn.lock")) return "yarn";
+  if (f.exists("bun.lock") || f.exists("bun.lockb")) return "bun";
+  return "npm";
+}
+function fromPackageJson(f) {
+  const text = f.read("package.json");
+  if (text === void 0) return void 0;
+  let pkg;
+  try {
+    pkg = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!pkg || typeof pkg !== "object") return void 0;
+  const pm = packageManager(f);
+  const scripts = pkg.scripts && typeof pkg.scripts === "object" ? pkg.scripts : {};
+  const out = {};
+  if (typeof scripts.test === "string") out.test = `${pm} test`;
+  if (typeof scripts.build === "string") out.build = pm === "yarn" ? "yarn build" : `${pm} run build`;
+  if (typeof pkg.version === "string") {
+    out.version = `node -p "require('./package.json').version"`;
+    out.bump = `npm version "$CREW_BUMP" --no-git-tag-version | sed 's/^v//'`;
+  }
+  return out;
+}
+function fromPackageSwift(f) {
+  return f.exists("Package.swift") ? { test: "swift test", build: "swift build" } : void 0;
+}
+function fromPyproject(f) {
+  return f.exists("pyproject.toml") ? { test: "pytest" } : void 0;
+}
+function fromMakefile(f) {
+  const text = f.read("Makefile") ?? f.read("makefile") ?? f.read("GNUmakefile");
+  if (text === void 0) return void 0;
+  const out = {};
+  for (const target of ["test", "build"]) {
+    if (new RegExp(`^${target}\\s*:`, "m").test(text)) out[target] = `make ${target}`;
+  }
+  return out;
+}
+var DETECTORS = [
+  { source: "package.json", detect: fromPackageJson },
+  { source: "Package.swift", detect: fromPackageSwift },
+  { source: "pyproject.toml", detect: fromPyproject },
+  { source: "Makefile", detect: fromMakefile }
+];
+function suggestHooks(f) {
+  const found = DETECTORS.flatMap((d) => {
+    const hooks = d.detect(f);
+    return hooks && Object.keys(hooks).length > 0 ? [{ source: d.source, hooks }] : [];
+  });
+  if (found.length === 0) {
+    return { source: null, hooks: {}, notes: ["no package.json scripts, Package.swift, pyproject.toml or Makefile test/build targets found \u2014 nothing to propose"] };
+  }
+  const [first, ...others] = found;
+  const notes = others.length > 0 ? [`also found ${others.map((o) => o.source).join(", ")}; proposing from ${first.source} only`] : [];
+  return { source: first.source, hooks: first.hooks, notes };
+}
+function parseHooksArgs(args, routes) {
+  const rest = [...args];
+  let route;
+  if (rest.length > 1 && routes.includes(rest[0])) route = rest.shift();
+  if (!route) {
+    if (routes.length === 1) route = routes[0];
+    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
+  }
+  if (rest.length !== 1) throw new ReposError("expected: crew repos hooks [route] <name> [--suggest] [--write route|repo] [--json]");
+  return { route, name: rest[0] };
+}
+function repoDirOf(text, base, route, name) {
+  const repos = configuredRepos(text, route, base);
+  const hit = repos.find((r) => r.name === name);
+  if (!hit) {
+    throw new ReposError(`route ${route} has no repo named "${name}" (have: ${repos.map((r) => r.name).join(", ") || "none"})`);
+  }
+  return hit.dir;
+}
+function planRouteHooks(text, route, name, hooks) {
+  const doc = parseDocument2(text);
+  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
+  const m = routeMapOf(doc, route);
+  const repos = m.get("repos", true);
+  let target = m;
+  if (isMap2(repos)) {
+    const entry = repos.get(name, true);
+    if (isMap2(entry)) target = entry;
+    else {
+      const created = new YAMLMap();
+      created.set("dir", String(repos.get(name)));
+      repos.set(name, created);
+      target = created;
+    }
+  }
+  const current = target.get("hooks", true);
+  let hooksMap;
+  if (isMap2(current)) hooksMap = current;
+  else {
+    hooksMap = new YAMLMap();
+    target.set("hooks", hooksMap);
+  }
+  const written = [];
+  const kept = [];
+  for (const [k, v] of Object.entries(hooks)) {
+    if (v === void 0) continue;
+    if (hooksMap.has(k)) kept.push(k);
+    else {
+      hooksMap.set(k, v);
+      written.push(k);
+    }
+  }
+  return { text: String(doc), written, kept };
+}
+function starterRepoConfig(hooks) {
+  const lines = [
+    "# Starter .crew.yaml proposed by `crew repos hooks --write repo`.",
+    "# Review the hooks, then commit this file; it is the durable home for them",
+    "# (docs/REPO_SPEC.md). A route-level copy in crew.yaml is shadowed by it.",
+    `version: ${SPEC_VERSION}`,
+    "platform: any",
+    "",
+    "hooks:"
+  ];
+  const entries = Object.entries(hooks).filter(([, v]) => v !== void 0);
+  if (entries.length === 0) lines.push('  # test: "..."', '  # build: "..."');
+  for (const [k, v] of entries) lines.push(`  ${k}: ${JSON.stringify(v)}`);
+  lines.push("", "release:", "  # integrate: merging to the base branch is the release; nothing is deployed.", "  mode: integrate", "");
+  const text = lines.join("\n");
+  parseRepoConfig(text, ".crew.yaml");
+  return text;
+}
+function existingRepoConfig(f) {
+  return REPO_CONFIG_FILENAMES.find((n) => f.exists(n));
+}
+
+// src/sample-ticket.ts
+import { basename as basename8, dirname as dirname13, join as join21 } from "path";
+var SAMPLE_REPO = "crew-sample";
+var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
+var SAMPLE_MARKER = "sample: true";
+var SAMPLE_CREW_YAML = `version: 1
+platform: unix
+branch:
+  base: main
+hooks:
+  test: "true"
+  build: "true"
+release:
+  mode: integrate
+  versioning: none
+  changelog: false
+`;
+var SAMPLE_README = `# crew-sample
+
+A throwaway repository created by \`crew sample-ticket\`. It exists so the crew
+has something safe to work on: its test and build hooks always pass, it has no
+remote, and \`crew sample-ticket --remove\` deletes it.
+`;
+function sampleDir(existing, reposBase, workspace) {
+  if (existing.length > 0) return join21(dirname13(existing[0]), SAMPLE_REPO);
+  return join21(reposBase, workspace, SAMPLE_REPO);
+}
+var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
+function sampleDescription() {
+  return [
+    SAMPLE_MARKER,
+    "",
+    "> This is a sample ticket filed by `crew sample-ticket` on a throwaway repository. Nothing here is real work.",
+    "",
+    "## What",
+    "",
+    "Add `greet.js` exporting `greet(name)`, which returns `Hello, <name>!` (and `Hello, world!` for no name),",
+    "with a JSDoc comment, and `greet.test.js` covering both cases using `node:test`.",
+    "",
+    "## Acceptance",
+    "",
+    '- `greet("Ada")` returns `Hello, Ada!`; `greet()` returns `Hello, world!`.',
+    "- The test file runs with `node --test` and passes.",
+    "- Add a line to the README saying the function exists.",
+    "",
+    "## Notes",
+    "",
+    "The repo has no remote: leave the branch local. The hooks in `.crew.yaml` always pass, so QA is checking the",
+    "diff against the acceptance list above."
+  ].join("\n");
+}
+function isSampleTicket(description) {
+  return (description ?? "").trimStart().startsWith(SAMPLE_MARKER);
+}
+function planSampleTicket(i) {
+  return {
+    title: SAMPLE_TITLE,
+    description: sampleDescription(),
+    report_type: "feature",
+    severity: "s4",
+    reporter_name: "crew sample-ticket",
+    status: i.approvedStatus,
+    project_id: i.projectId,
+    repo_id: i.repoId,
+    ...i.filedBy ? { filed_by_id: i.filedBy } : {}
+  };
+}
+
 // src/doctor-fix.ts
-import { parseDocument as parseDocument2 } from "yaml";
+import { parseDocument as parseDocument3 } from "yaml";
 var sound = (r) => r.hasRepos && r.problems.length === 0;
 function planFix(f) {
   const actions = [];
@@ -12828,7 +13101,7 @@ function routesInScope(routes, named) {
   return named ? routes.filter((r) => r.route === named) : routes;
 }
 function planEnable(text, route) {
-  const doc = parseDocument2(text);
+  const doc = parseDocument3(text);
   routeMapOf(doc, route).set("enabled", true);
   return String(doc);
 }
@@ -12838,8 +13111,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync5 } from "fs";
-import { basename as basename9, dirname as dirname13, join as join22, resolve as resolve4 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "fs";
+import { basename as basename9, dirname as dirname14, join as join22, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -12893,7 +13166,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname13(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname14(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename9(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
@@ -12941,7 +13214,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync21(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync22(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -12949,7 +13222,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync21(a.path)) {
+    if (!dryRun && existsSync22(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -12960,7 +13233,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync21(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync22(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -13009,7 +13282,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync15(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync16(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -13114,12 +13387,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
 import { join as join23 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join23(stateDir, "streams");
-  if (!existsSync22(dir)) return [];
+  if (!existsSync23(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync6(dir).map((name) => join23(dir, name)).filter((path) => {
     try {
@@ -13147,7 +13420,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync22(stateDir)) return [];
+  if (!existsSync23(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync6(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join23(stateDir, name)).filter((path) => {
     try {
@@ -13159,14 +13432,14 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync21, existsSync as existsSync28, mkdirSync as mkdirSync14, writeFileSync as writeFileSync15, rmSync as rmSync11, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
+import { readFileSync as readFileSync22, existsSync as existsSync29, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, rmSync as rmSync11, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync16, chmodSync } from "fs";
-import { dirname as dirname14, join as join24 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, chmodSync } from "fs";
+import { dirname as dirname15, join as join24 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
@@ -13175,10 +13448,10 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync23(privateKeyPath)) {
-    mkdirSync10(dirname14(privateKeyPath), { recursive: true });
+  if (!existsSync24(privateKeyPath)) {
+    mkdirSync11(dirname15(privateKeyPath), { recursive: true });
     try {
-      execFileSync3("ssh-keygen", [
+      execFileSync4("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -13196,15 +13469,15 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync(privateKeyPath, 384);
   }
-  if (!existsSync23(publicKeyPath)) {
+  if (!existsSync24(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync16(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync17(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync3("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync4("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -13212,11 +13485,11 @@ function sshKeygenAvailable() {
 }
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash4 } from "crypto";
 var realExec = (cmd, args) => {
   try {
-    return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync5(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -13415,7 +13688,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync12, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
 import { randomInt } from "crypto";
 import { join as join25 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -13488,17 +13761,17 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync24(path)) return void 0;
+  if (!existsSync25(path)) return void 0;
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    return JSON.parse(readFileSync18(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync11(join25(stateDir, "passengers"), { recursive: true });
-  writeFileSync12(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync12(join25(stateDir, "passengers"), { recursive: true });
+  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -13596,7 +13869,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join25(stateDir, "passengers");
-  if (!existsSync24(dir)) return [];
+  if (!existsSync25(dir)) return [];
   return readdirSync7(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -13717,7 +13990,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn5 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
 import { join as join26 } from "path";
 
 // src/secret-compare.ts
@@ -13811,17 +14084,17 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync25(path)) return void 0;
+  if (!existsSync26(path)) return void 0;
   try {
-    return JSON.parse(readFileSync18(path, "utf8"));
+    return JSON.parse(readFileSync19(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync12(join26(stateDir, "passengers"), { recursive: true });
-  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync13(join26(stateDir, "passengers"), { recursive: true });
+  writeFileSync14(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -13842,7 +14115,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join26(stateDir, "passengers");
-  if (!existsSync25(dir)) return [];
+  if (!existsSync26(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync8(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -13899,11 +14172,11 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync13, readFileSync as readFileSync20, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync14, readFileSync as readFileSync21, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync15 } from "fs";
 import { join as join28 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync26, readdirSync as readdirSync9, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync20 } from "fs";
 import { join as join27 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
@@ -13923,16 +14196,16 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync26(path)) return false;
+  if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync19(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync20(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
   const dir = join27(o.stateDir, "streams");
-  if (!existsSync26(dir)) return [];
+  if (!existsSync27(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync9(dir)) {
@@ -14046,7 +14319,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync27(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync28(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join28(stateDir, "reload-requested");
@@ -14055,14 +14328,14 @@ function daemonStampFor(stateDir) {
   return join28(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync13(stateDir, { recursive: true });
+  mkdirSync14(stateDir, { recursive: true });
   rmSync10(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync14(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync15(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync20(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync21(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -14418,7 +14691,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname15(process.execPath) : resolve5(dirname15(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname16(process.execPath) : resolve5(dirname16(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -14549,7 +14822,8 @@ function usage() {
   crew status [route] [--json]   paused/running state; --json for a machine reader
   crew projects [--route R] [--json]   the Projects rows each route can read (id, name, prefix, work mode)
   crew reload                    make the running daemon re-read crew.yaml (--now: restart it immediately)
-  crew doctor [route] [--fix]    preflight; --fix enables clean routes and offers crew install
+  crew doctor [route] [--fix] [--offline] [--json]   preflight; --fix enables clean routes and offers crew install;
+                                 --offline skips push probes; --json prints push-auth and tool checks only
   crew selftest [route] [--toolchain NAME] [--json]   launch each toolchain as a run would and prove it reaches the tracker
   crew sample-ticket [route] [--remove] [--dry-run] [--json]   file one ticket on a throwaway repo that walks the dev, QA and release loop
   crew ports [route]             which checkout owns which ports, and what is up
@@ -14563,13 +14837,14 @@ function usage() {
                                  resume with no argument clears only the whole-crew pause; a role or release pause needs its own resume
   crew log [route]               tail the log
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
-  crew connect                  resolve a workspace's ids into a crew.yaml block (--no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
+  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
   crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
   crew agents prompt R [route] print one persona's current prompt (e.g. R=pair, for a SessionStart hook; --harness H adds which CLI it serves)
   crew skills sync [route]      push only crew's skill files (e.g. grill-me) into the workspace Agent Skills table
   crew repos add [ROUTE] [NAME] [PATH]  attach a local checkout to a route in crew.yaml (--dry-run previews)
   crew repos clone [ROUTE] NAME  clone a Repos row's remote into the route directory and attach it (--dir PATH, --dry-run, --json)
+  crew repos hooks [ROUTE] NAME suggest test/build hooks for a checkout (--write route|repo, --json)
   crew repos list ROUTE         the checkouts a route has, with the tracker's Repos row each matches
   crew logbook list [route]     recent Agent Log entries, filterable by --role/--ticket
   crew logbook show [route] ID [--prompt]   one entry; --prompt reconstructs and verifies its prompt
@@ -14976,7 +15251,7 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join29(homedir8(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync28(staleTimer)) {
+      if (existsSync29(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -15002,7 +15277,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync28(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync29(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -15020,7 +15295,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync28(p);
+    const unitExists = (p) => existsSync29(p);
     const crontab = o.host === "linux" ? spawnSync6("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -15037,7 +15312,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync15(cfg.configFile, planEnable(readFileSync21(cfg.configFile, "utf8"), a.route));
+          writeFileSync16(cfg.configFile, planEnable(readFileSync22(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -15054,7 +15329,10 @@ ${changed2.map((c) => `  - ${c}
 `).join("")}` : "fix: nothing changed\n");
   }
   async function resolvedRepos(c) {
-    return Promise.all(reposOf(c).map(async (t) => {
+    return Promise.all(reposOf(c).map((t) => resolveOneRepo(c, t)));
+  }
+  async function resolveOneRepo(c, t) {
+    {
       const id = repoIdForName(c, t.name);
       const o = c.repoOverrides[t.name];
       return {
@@ -15078,7 +15356,7 @@ ${changed2.map((c) => `  - ${c}
           worktrees: { prefix: shipWorktreePrefixFor(c) ?? await areaWorktreePrefix(c, id), nameOverride: o?.worktreeName }
         }, t.dir)
       };
-    }));
+    }
   }
   const worktreeLocations = async (c) => (await resolvedRepos(c)).map((r) => ({
     parent: resolvePath(r.dir, ".."),
@@ -16160,69 +16438,27 @@ ${changed2.map((c) => `  - ${c}
 `);
         process.exit(2);
       }
-      const keyRole = target.resolved.role ?? await fetchKeyRole(target, cfg.ship.userAgent);
-      let readOnly = !isAdminRole(keyRole);
-      let personaResult;
-      const runPersonas = (ro) => syncPersonas(target, { userAgent: cfg.ship.userAgent, dryRun, force, readOnly: ro });
+      let run2;
       try {
-        try {
-          personaResult = await runPersonas(readOnly);
-        } catch (e) {
-          if (readOnly || !isForbidden(e)) throw e;
-          readOnly = true;
-          personaResult = await runPersonas(true);
-        }
+        run2 = await runAgentsSync(target, {
+          userAgent: cfg.ship.userAgent,
+          stateDir: cfg.ship.stateDir,
+          dryRun,
+          force,
+          say: (l) => process.stdout.write(`${l}
+`),
+          warn: (l) => process.stderr.write(`crew agents sync: ${l}
+`)
+        });
       } catch (e) {
-        if (e instanceof AgentsSyncError) {
+        if (e instanceof AgentsSyncError || e instanceof SkillSyncError) {
           process.stderr.write(`crew agents sync: ${e.message}
 `);
           process.exit(2);
         }
         throw e;
       }
-      process.stdout.write(`route: ${target.route}
-`);
-      for (const o of personaResult.outcomes) process.stdout.write(`${describeSyncOutcome(o)}
-`);
-      for (const o of personaResult.crewLinks) process.stdout.write(`${describeCrewLink(o)}
-`);
-      if (personaResult.releaseNote) process.stdout.write(`${personaResult.releaseNote}
-`);
-      const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
-      for (const w of skillMarkerWarnings(target.promptsDir, briefs)) process.stderr.write(`crew agents sync: warning: ${w}
-`);
-      let skillResult;
-      if (!readOnly) {
-        try {
-          skillResult = await syncSkills(target, { userAgent: cfg.ship.userAgent, dryRun, force });
-        } catch (e) {
-          if (isForbidden(e)) readOnly = true;
-          else if (e instanceof SkillSyncError) {
-            process.stderr.write(`crew agents sync: ${e.message}
-`);
-            process.exit(2);
-          } else throw e;
-        }
-      }
-      for (const o of skillResult?.outcomes ?? []) process.stdout.write(`${describeSkillSyncOutcome(o)}
-`);
-      if (!dryRun) {
-        const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync28(resolvedPath) ? JSON.parse(readFileSync21(resolvedPath, "utf8")) : {};
-        raw.agentPersonas = personaResult.agentPersonas;
-        if (skillResult) raw.agentSkills = skillResult.agentSkills;
-        if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-        mkdirSync14(dirOf(resolvedPath), { recursive: true });
-        writeFileSync15(resolvedPath, `${JSON.stringify(raw, null, 2)}
-`);
-      }
-      if (!dryRun) {
-        target.resolved.agentPersonas = personaResult.agentPersonas;
-        if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
-      }
-      if (readOnly) {
-        process.stdout.write("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)\n");
-      }
+      const { personaResult, skillResult } = run2;
       if (flag("revoke-seat-keys")) {
         for (const o of await revokeSeatKeys(target, { userAgent: cfg.ship.userAgent, dryRun })) {
           process.stdout.write(`${describeRevokeOutcome(o)}
@@ -16234,9 +16470,7 @@ ${changed2.map((c) => `  - ${c}
 `);
         }
       }
-      if (personaResult.outcomes.some((o) => o.action === "diverged") || (skillResult?.outcomes.some((o) => o.action === "diverged") ?? false)) {
-        process.exitCode = 1;
-      }
+      if (run2.diverged) process.exitCode = 1;
       break;
     }
     case "skills": {
@@ -16278,10 +16512,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync28(resolvedPath) ? JSON.parse(readFileSync21(resolvedPath, "utf8")) : {};
+        const raw = existsSync29(resolvedPath) ? JSON.parse(readFileSync22(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync14(dirOf(resolvedPath), { recursive: true });
-        writeFileSync15(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync15(dirOf(resolvedPath), { recursive: true });
+        writeFileSync16(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16290,18 +16524,74 @@ ${changed2.map((c) => `  - ${c}
     case "repos": {
       const sub = positional[1];
       const usage2 = () => {
-        process.stderr.write("crew repos add [workspace/project] [name] [path] [--name N] [--project P] [--dry-run] [--no-create]\ncrew repos clone [workspace/project] <name> [--dir PATH] [--dry-run] [--json]\ncrew repos list <workspace/project>\n");
+        process.stderr.write("crew repos add [workspace/project] [name] [path] [--name N] [--project P] [--dry-run] [--no-create]\ncrew repos clone [workspace/project] <name> [--dir PATH] [--dry-run] [--json]\ncrew repos list <workspace/project>\ncrew repos hooks [workspace/project] <name> [--suggest] [--write route|repo] [--json]\n");
         process.exit(2);
       };
-      if (sub !== "add" && sub !== "list" && sub !== "clone") usage2();
-      const configText = readFileSync21(cfg.configFile, "utf8");
+      if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks") usage2();
+      const configText = readFileSync22(cfg.configFile, "utf8");
+      if (sub === "hooks") {
+        try {
+          const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
+          const dir = repoDirOf(configText, dirname16(cfg.configFile), a.route, a.name);
+          if (!existsSync29(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync29(resolvePath(dir, r)), read: (r) => {
+            try {
+              return readFileSync22(resolvePath(dir, r), "utf8");
+            } catch {
+              return void 0;
+            }
+          } };
+          const suggestion = suggestHooks(files);
+          const write = value("write");
+          if (write !== void 0 && write !== "route" && write !== "repo") throw new ReposError(`--write takes "route" or "repo" (got "${write}")`);
+          let written;
+          if (write && suggestion.source === null) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
+          if (write === "route") {
+            const plan = planRouteHooks(configText, a.route, a.name, suggestion.hooks);
+            writeFileSync16(cfg.configFile, plan.text);
+            written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept };
+          } else if (write === "repo") {
+            const have = existingRepoConfig(files);
+            if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
+            const file = resolvePath(dir, ".crew.yaml");
+            writeFileSync16(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
+            written = { target: "repo", file, hooks: Object.keys(suggestion.hooks), kept: [] };
+          }
+          if (flag("json")) {
+            process.stdout.write(`${JSON.stringify({ route: a.route, repo: a.name, dir, ...suggestion, written: written ?? null })}
+`);
+          } else {
+            if (suggestion.source) process.stdout.write(`${a.name}: proposed from ${suggestion.source}
+`);
+            for (const [k, v] of Object.entries(suggestion.hooks)) process.stdout.write(`  ${k}: ${v}
+`);
+            for (const n of suggestion.notes) process.stdout.write(`note: ${n}
+`);
+            if (written) {
+              process.stdout.write(`wrote ${written.hooks.join(", ") || "nothing new"} to ${written.file}
+`);
+              if (written.kept.length) process.stdout.write(`kept existing route hooks: ${written.kept.join(", ")}
+`);
+              if (written.target === "repo") process.stdout.write("review it and commit it to the repository\n");
+            }
+          }
+        } catch (e) {
+          if (e instanceof ReposError) {
+            process.stderr.write(`crew repos: ${e.message}
+`);
+            process.exit(2);
+          }
+          throw e;
+        }
+        break;
+      }
       let routeName = positional[2];
       let addPath = ".";
       let addName;
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync28(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync29(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -16330,15 +16620,15 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync28(resolvedFile)) {
+      if (existsSync29(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync22(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname15(cfg.configFile);
+      const base = dirname16(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16347,7 +16637,7 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync28(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync29(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -16359,9 +16649,9 @@ ${changed2.map((c) => `  - ${c}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir") });
-          if (existsSync28(plan2.target) && (existsSync28(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
+          if (existsSync29(plan2.target) && (existsSync29(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync28(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync29(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -16379,12 +16669,12 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync15(cfg.configFile, plan2.text);
+          writeFileSync16(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir8()));
-        const top = existsSync28(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync29(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -16433,15 +16723,15 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync28(resolvedFile)) {
-            const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          if (existsSync29(resolvedFile)) {
+            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync15(cfg.configFile, plan.text);
+        writeFileSync16(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -16751,10 +17041,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync28(resolvedPath);
+        const hadPreviousFile = existsSync29(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync21(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync22(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -16862,10 +17152,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync14(dirname15(resolvedPath), { recursive: true });
+          mkdirSync15(dirname16(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync15(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync16(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -16900,8 +17190,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync14(dirname15(apiKeyFile), { recursive: true });
-            writeFileSync15(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync15(dirname16(apiKeyFile), { recursive: true });
+            writeFileSync16(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -17002,6 +17292,56 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `
           );
         }
+        if (!dryRun && !flag("no-agents-sync")) {
+          const skip = (why) => {
+            process.stderr.write(`
+  agents sync: skipped (${why})
+`);
+            connectEvents.emit("agents_synced", `agents sync skipped: ${why}`, { route: route2, skipped: why });
+          };
+          let syncRoute;
+          try {
+            const reloaded = loadConfig(CREW_HOME, wizard?.configPath ?? cfg.configFile, { allowNoRoutes: true });
+            syncRoute = reloaded.routes.find((r) => r.route === route2);
+            if (syncRoute) await hydrateApiKeys([syncRoute]);
+          } catch (e) {
+            skip(`config did not load: ${e.message}`);
+          }
+          if (syncRoute?.resolved) {
+            try {
+              process.stderr.write("\n");
+              const run2 = await runAgentsSync(syncRoute, {
+                userAgent: cfg.ship.userAgent,
+                stateDir: cfg.ship.stateDir,
+                say: (l) => process.stderr.write(`  ${l}
+`),
+                warn: (l) => process.stderr.write(`  agents sync: ${l}
+`)
+              });
+              const minted = await mintMissingSeatKeys(syncRoute, { userAgent: cfg.ship.userAgent, shipName: cfg.ship.name });
+              for (const m of minted) process.stderr.write(`  ${describeMintOutcome(m)}
+`);
+              if (run2.readOnly) {
+                const missing = run2.personaResult.outcomes.some((p) => p.action === "missing");
+                process.stderr.write(missing ? "  A workspace admin has to open the Crew app or run `crew agents sync` once before this ship's seats can run.\n" : "  Seats are linked to the workspace's existing personas.\n");
+              }
+              connectEvents.emit("agents_synced", run2.readOnly ? "agents linked (read-only key)" : "agents synced", {
+                route: route2,
+                admin: !run2.readOnly,
+                personas: run2.personaResult.outcomes,
+                skills: run2.skillResult?.outcomes ?? [],
+                diverged: run2.diverged
+              });
+              for (const m of minted) connectEvents.emit("seat_key", describeMintOutcome(m), { route: route2, ...m });
+              if (run2.diverged) process.exitCode = 1;
+            } catch (e) {
+              if (e instanceof AgentsSyncError || e instanceof SkillSyncError) skip(e.message);
+              else throw e;
+            }
+          } else if (!syncRoute) {
+            skip(`"${route2}" is not in crew.yaml yet; add the block above, then run \`crew agents sync\``);
+          }
+        }
         connectEvents.emit("done", `connected ${route2}`, {
           route: route2,
           resolvedPath: dryRun ? void 0 : resolvedPath,
@@ -17480,8 +17820,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync14(cfg.ship.stateDir, { recursive: true });
-      writeFileSync15(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync15(cfg.ship.stateDir, { recursive: true });
+      writeFileSync16(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -17532,7 +17872,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync21(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync22(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -17555,8 +17895,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync21(cfg.configFile, "utf8");
-      const cfgBase = dirname15(cfg.configFile);
+      const configText = readFileSync22(cfg.configFile, "utf8");
+      const cfgBase = dirname16(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -17584,7 +17924,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync15(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync16(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -17592,29 +17932,29 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync28(resolvedFile)) {
-            const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+          if (existsSync29(resolvedFile)) {
+            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync28(join29(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync11(dir, { recursive: true, force: true });
+        if (existsSync29(join29(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync11(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync28(join29(dir, ".git"));
-      if (existsSync28(dir) && fresh && readdirSync11(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync29(join29(dir, ".git"));
+      if (existsSync29(dir) && fresh && readdirSync11(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync14(dir, { recursive: true });
-        writeFileSync15(join29(dir, "README.md"), SAMPLE_README);
-        writeFileSync15(join29(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync15(dir, { recursive: true });
+        writeFileSync16(join29(dir, "README.md"), SAMPLE_README);
+        writeFileSync16(join29(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -17632,17 +17972,17 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync28(resolvedFile)) {
-          const raw = JSON.parse(readFileSync21(resolvedFile, "utf8"));
+        if (existsSync29(resolvedFile)) {
+          const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync15(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync15(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync16(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -17919,6 +18259,40 @@ watermark:  ${state.watermark()}
     }
     case "doctor": {
       const host = hostPlatform();
+      const doctorSchedulerPath = pathFor(cfg.ship);
+      const pushAuth = [];
+      const toolRows = [];
+      {
+        const prBased = /* @__PURE__ */ new Set();
+        let mentionNode = false;
+        for (const c of [route]) {
+          const { settled: repos, errors } = await settleRepos(reposOf(c), (t) => t.name, (t) => resolveOneRepo(c, t));
+          for (const e of errors) {
+            pushAuth.push({ route: c.route, repo: e.repo, result: { state: "failed", detail: `could not resolve this repo's configuration: ${e.detail}`, hint: "fix the repo's .crew.yaml" } });
+          }
+          for (const r of repos) {
+            const remote = r.config.branch.remote;
+            if (existsSync29(r.dir)) {
+              pushAuth.push({
+                route: c.route,
+                repo: r.name,
+                result: probePushAuth({ dir: r.dir, remote, remoteUrl: originUrlOf(r.dir, remote), offline: flag("offline") })
+              });
+            }
+            if (isPrBased(r.config.hooks)) prBased.add(r.name);
+            if (Object.values(r.config.hooks).some((h) => typeof h === "string" && mentionsNode(h))) mentionNode = true;
+          }
+        }
+        toolRows.push(...toolChecks(
+          { prBased: prBased.size > 0, hostPassengers: cfg.routes.some((x) => x.enabled && x.hostPassengers), hooksMentionNode: mentionNode },
+          (bin) => findOnPath(bin, doctorSchedulerPath)
+        ));
+      }
+      if (flag("json")) {
+        process.stdout.write(`${JSON.stringify({ offline: flag("offline"), pushAuth, tools: toolRows }, null, 2)}
+`);
+        break;
+      }
       process.stdout.write(
         `ship:              ${cfg.ship.name} (${host})
 routes:            ${cfg.routes.map((c) => c.route).join(", ")}
@@ -17926,7 +18300,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync28(evFile) ? statSync9(evFile).size : 0;
+        const evSize = existsSync29(evFile) ? statSync9(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -17937,7 +18311,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync21(p, "utf8");
+            return readFileSync22(p, "utf8");
           } catch {
             return null;
           }
@@ -18142,6 +18516,8 @@ crew manifest:     ${seats2.length ? seats2.map((c) => c.name).join(", ") : "non
         if (ov.toolchain) process.stdout.write(`repo toolchain:    ${repoName} \u2192 ${ov.toolchain} (binary and MCP checked above, as for every ship toolchain)
 `);
       }
+      for (const p of pushAuth) process.stdout.write(formatPushAuth(`${p.repo}`, p.result));
+      for (const t of toolRows) process.stdout.write(formatToolCheck(t));
       process.stdout.write(`git:               ${gitPath ? `OK (${gitPath})` : "NOT FOUND on the scheduler PATH"}
 `);
       if (!allBinsFound || !gitPath) {