@tablation/crew 0.60.0 → 0.61.0

package/dist/cli.js

@@ -2332,6 +2332,7 @@ function parseResolved(raw, m, where) {
     ...typeof raw.releaseSeat === "string" && raw.releaseSeat ? { releaseSeat: raw.releaseSeat } : {},
     ...typeof raw.releaseAgentId === "string" && raw.releaseAgentId ? { releaseAgentId: raw.releaseAgentId } : {},
     ...typeof raw.role === "string" && raw.role ? { role: raw.role } : {},
+    ...Array.isArray(raw.capabilityMisses) && raw.capabilityMisses.length > 0 ? { capabilityMisses: raw.capabilityMisses.filter((x) => typeof x === "string") } : {},
     ...Object.keys(agentPersonas).length > 0 ? { agentPersonas } : {},
     ...Object.keys(agentSkills).length > 0 ? { agentSkills } : {}
   };
@@ -5182,10 +5183,11 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname16, join as join29, basename as basename10 } from "path";
+import { resolve as resolve5, dirname as dirname17, join as join30, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
+import { parse as parseYaml2 } from "yaml";
 
 // src/argv.ts
 var VALUE_FLAGS = /* @__PURE__ */ new Set([
@@ -5760,6 +5762,103 @@ var State = class _State {
   }
 };
 
+// src/reset.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname6, join as join14 } from "path";
+function clonedCheckoutsFile(stateDir) {
+  return join14(stateDir, "cloned-checkouts.json");
+}
+function readClonedCheckouts(stateDir) {
+  try {
+    const parsed = JSON.parse(readFileSync13(clonedCheckoutsFile(stateDir), "utf8"));
+    return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function recordClonedCheckout(stateDir, dir) {
+  const known = readClonedCheckouts(stateDir);
+  if (known.includes(dir)) return;
+  const file = clonedCheckoutsFile(stateDir);
+  mkdirSync7(dirname6(file), { recursive: true });
+  writeFileSync8(file, `${JSON.stringify([...known, dir], null, 2)}
+`);
+}
+var mark = (dryRun) => dryRun ? "would-remove" : "removed";
+async function runReset(o, fx) {
+  const steps = [];
+  for (const line of await fx.uninstallUnits(o.dryRun)) steps.push({ step: "scheduler", target: line, action: mark(o.dryRun) });
+  const urls = [...new Set(o.routes.map((r) => r.baseUrl))];
+  for (const url of urls) {
+    for (const line of fx.removePair(url, o.dryRun)) steps.push({ step: "pair", target: line, action: mark(o.dryRun) });
+  }
+  for (const route of o.routes) {
+    for (const r of await fx.revokeSeatKeys(route, o.dryRun)) {
+      steps.push({ step: "seat-keys", target: `${route.route}: ${r.line}`, action: r.ok ? mark(o.dryRun) : "failed" });
+    }
+  }
+  for (const route of [...o.routes, ...o.droppedRoutes ?? []]) {
+    try {
+      const cred = await fx.credential(route);
+      if (!cred.stored) {
+        steps.push({ step: "credential", target: route.route, action: "absent", detail: "no workspace credential in the keychain" });
+        continue;
+      }
+      if (!o.dryRun) await cred.clear();
+      steps.push({ step: "credential", target: route.route, action: mark(o.dryRun), detail: "workspace credential in the keychain" });
+    } catch (e) {
+      steps.push({ step: "credential", target: route.route, action: "failed", detail: e.message });
+    }
+  }
+  if (o.removeCheckouts) {
+    for (const dir of readClonedCheckouts(o.stateDir)) steps.push(removeCheckout(dir, o.dryRun, fx));
+  }
+  steps.push(...removeState(o.stateDir, o.dryRun));
+  if (existsSync14(o.configFile)) {
+    if (!o.dryRun) rmSync7(o.configFile, { force: true });
+    steps.push({ step: "config", target: o.configFile, action: mark(o.dryRun) });
+  } else {
+    steps.push({ step: "config", target: o.configFile, action: "absent" });
+  }
+  return steps;
+}
+function removeCheckout(dir, dryRun, fx) {
+  if (!existsSync14(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
+  const { dirty, linkedWorktrees } = fx.inspectCheckout(dir);
+  if (dirty.length) {
+    return { step: "checkout", target: dir, action: "kept", detail: `has uncommitted changes (${dirty.length} path${dirty.length === 1 ? "" : "s"}: ${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? ", \u2026" : ""})` };
+  }
+  if (linkedWorktrees.length) {
+    return { step: "checkout", target: dir, action: "kept", detail: `has linked worktrees (${linkedWorktrees.join(", ")}); remove them first` };
+  }
+  if (!dryRun) rmSync7(dir, { recursive: true, force: true });
+  return { step: "checkout", target: dir, action: mark(dryRun) };
+}
+function removeState(stateDir, dryRun) {
+  const out = [];
+  const targets = [join14(stateDir, "resolved"), join14(stateDir, "keys"), clonedCheckoutsFile(stateDir), join14(stateDir, "reload-requested"), join14(stateDir, "daemon.started")];
+  try {
+    for (const name of readdirSync4(stateDir)) {
+      if (name.startsWith(".") && statSync5(join14(stateDir, name)).isFile()) targets.push(join14(stateDir, name));
+    }
+  } catch {
+  }
+  for (const t of targets) {
+    if (!existsSync14(t)) continue;
+    if (!dryRun) rmSync7(t, { recursive: true, force: true });
+    out.push({ step: "state", target: t, action: mark(dryRun) });
+  }
+  if (!out.length) out.push({ step: "state", target: stateDir, action: "absent", detail: "nothing to remove" });
+  return out;
+}
+function describeResetStep(s) {
+  const verb = { removed: "removed", "would-remove": "would remove", absent: "nothing to remove", kept: "KEPT", failed: "FAILED" }[s.action];
+  return `${s.step}: ${verb}: ${s.target}${s.detail ? ` (${s.detail})` : ""}`;
+}
+function resetIncomplete(steps) {
+  return steps.some((s) => s.action === "failed" || s.action === "kept");
+}
+
 // src/tracker.ts
 import { hostname } from "os";
 import { TablationClient as TablationClient3 } from "@tablation/client";
@@ -6154,24 +6253,24 @@ function recoveredFailureHeadlines(o, route) {
 }
 
 // src/ship-attention.ts
-import { existsSync as existsSync15, statfsSync } from "fs";
+import { existsSync as existsSync16, statfsSync } from "fs";
 
 // src/git.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import {
-  existsSync as existsSync14,
-  mkdirSync as mkdirSync7,
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync8,
   openSync as openSync3,
   closeSync as closeSync3,
   writeSync,
-  statSync as statSync5,
+  statSync as statSync6,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync13,
-  writeFileSync as writeFileSync8,
-  readdirSync as readdirSync4,
-  rmSync as rmSync7
+  readFileSync as readFileSync14,
+  writeFileSync as writeFileSync9,
+  readdirSync as readdirSync5,
+  rmSync as rmSync8
 } from "fs";
-import { dirname as dirname6, basename as basename5, join as join14 } from "path";
+import { dirname as dirname7, basename as basename5, join as join15 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -6537,8 +6636,8 @@ function recoverStrandedReleaseCheckouts(cwd) {
     if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
-      const root = dirname6(path);
-      if (basename5(root).startsWith("crew-release-")) rmSync7(root, { recursive: true, force: true });
+      const root = dirname7(path);
+      if (basename5(root).startsWith("crew-release-")) rmSync8(root, { recursive: true, force: true });
     }
   }
   const stranded = (gitOk(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/crew/release-*"]) ?? "").split("\n").filter(Boolean);
@@ -6549,18 +6648,18 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
   const removed = [];
   let names;
   try {
-    names = readdirSync4(tmp);
+    names = readdirSync5(tmp);
   } catch {
     return removed;
   }
   for (const name of names) {
     if (!name.startsWith("crew-release-")) continue;
-    const root = join14(tmp, name);
+    const root = join15(tmp, name);
     try {
-      const st = statSync5(root);
+      const st = statSync6(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync14(join14(root, "checkout"))) continue;
-      rmSync7(root, { recursive: true, force: true });
+      if (existsSync15(join15(root, "checkout"))) continue;
+      rmSync8(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
     }
@@ -6602,13 +6701,13 @@ function originUrlOf(dir, remoteName) {
   }
 }
 function ensureRepoCheckout(dir, remote, opts = {}) {
-  if (existsSync14(`${dir}/.git`)) return false;
+  if (existsSync15(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
     );
   }
-  mkdirSync7(dirname6(dir), { recursive: true });
+  mkdirSync8(dirname7(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
     execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
@@ -6617,8 +6716,13 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
     throw new GitError(`git clone ${url} ${dir}: ${why || err.message.trim()}`);
   }
+  cloneRecorder?.(dir);
   return true;
 }
+var cloneRecorder;
+function setCloneRecorder(fn) {
+  cloneRecorder = fn;
+}
 var CHECKOUT_LOCK_STALE_MS = 5 * 60 * 1e3;
 function checkoutLockPath(dir) {
   return `${dir}.sync.lock`;
@@ -6628,7 +6732,7 @@ function sleepSync(ms2) {
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
-  mkdirSync7(dirname6(lockPath), { recursive: true });
+  mkdirSync8(dirname7(lockPath), { recursive: true });
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -6646,7 +6750,7 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
       const err = e;
       if (err.code !== "EEXIST") throw err;
       try {
-        if (Date.now() - statSync5(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
+        if (Date.now() - statSync6(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
           try {
             unlinkSync2(lockPath);
           } catch {
@@ -6665,17 +6769,17 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
 function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (!existsSync14(`${dir}/.git`) && githubRemote) {
+    if (!existsSync15(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync14(marker) && readFileSync13(marker, "utf8").split("\n")[0] === url) {
-        return { action: "clone-failed", detail: readFileSync13(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      if (existsSync15(marker) && readFileSync14(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync14(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
         ensureRepoCheckout(dir, githubRemote, clone);
       } catch (e) {
         if (!(e instanceof GitError)) throw e;
-        writeFileSync8(marker, `${url}
+        writeFileSync9(marker, `${url}
 ${e.message}`);
         return { action: "clone-failed", detail: e.message, repeat: false };
       }
@@ -6873,7 +6977,7 @@ function noteHeldWorktree(state, h, nowMs = Date.now()) {
 function reconcileHeldWorktrees(state, repo, log, stillRefused) {
   for (const i of state.shipAttention().previous()) {
     if (i.kind !== "worktree_held" || !i.held || i.held.repo !== repo) continue;
-    const gone = !existsSync15(i.held.path);
+    const gone = !existsSync16(i.held.path);
     if (!gone && !(stillRefused && !stillRefused.has(i.held.path))) continue;
     clearShipAttention(state, i.key);
     log.emit(
@@ -8587,8 +8691,8 @@ function materializeBranchForTicket(dir, cfg, t, role, onProblem) {
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync9 } from "fs";
-import { join as join15 } from "path";
+import { writeFileSync as writeFileSync10 } from "fs";
+import { join as join16 } from "path";
 
 // src/stalled.ts
 var STALLED_AFTER_CYCLES = 30;
@@ -8877,7 +8981,7 @@ async function decideCycle(o) {
   }
   return decision;
 }
-var digestPath = (stateDir, route, role) => join15(stateDir, `digest-${route}-${role}.md`);
+var digestPath = (stateDir, route, role) => join16(stateDir, `digest-${route}-${role}.md`);
 function writeDigest(o, d, role, stateDir) {
   const me = o.route.resolved?.seats[role];
   if (!me) return false;
@@ -8941,7 +9045,7 @@ function writeDigest(o, d, role, stateDir) {
     };
     const text = role === "qa" ? qaDigest(input) : buildingDigest(input);
     const path = digestPath(stateDir, routeSlug(o.route.route), role);
-    writeFileSync9(path, text);
+    writeFileSync10(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -9318,13 +9422,13 @@ async function applyStrandedVerified(writer, s, contract, operatorId, memberId,
 }
 
 // src/run-worktree.ts
-import { existsSync as existsSync17 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { dirname as dirname8, join as join18 } from "path";
 
 // src/ports.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync16 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { join as join17 } from "path";
 var run = (cmd, args) => {
   try {
     return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -9369,7 +9473,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync16(join16(parent, name, ".git"))) return true;
+    if (existsSync17(join17(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -9445,7 +9549,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const existing = worktreeForNumber(dir, num);
   const located = locateBranchForTicket(dir, cfg, t, role);
   const baseRef = hasRemote ? `${remote}/${base}` : base;
-  if (existing && !existing.prunable && existsSync17(existing.path)) {
+  if (existing && !existing.prunable && existsSync18(existing.path)) {
     const branch = existing.branch;
     if (status(existing.path).length > 0) {
       return { action: opts.resumeInterrupted ? "resume-dirty" : "leave-dirty", path: existing.path, branch };
@@ -9461,7 +9565,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
     if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
     return { action: "recut", path: existing.path, branch, base: baseRef };
   }
-  const path = join17(dirname7(dir), worktreeForTicket(dir, cfg, t, role));
+  const path = join18(dirname8(dir), worktreeForTicket(dir, cfg, t, role));
   if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
     return { action: "cut-remote", path, branch: located.branch };
   }
@@ -9510,7 +9614,7 @@ function worktreeHoldsUnpushed(path, remote) {
 }
 async function finishRunWorktree(dir, cfg, branch) {
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (!wt || !existsSync17(wt.path)) return { kind: "none" };
+  if (!wt || !existsSync18(wt.path)) return { kind: "none" };
   if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
   if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
   if (remoteConfigured(dir, cfg.branch.remote) && worktreeHoldsUnpushed(wt.path, cfg.branch.remote)) {
@@ -9522,7 +9626,7 @@ async function finishRunWorktree(dir, cfg, branch) {
     if (pids.length) await killGently(pids);
   }
   gitOk(dir, ["worktree", "remove", wt.path]);
-  return existsSync17(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+  return existsSync18(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
 }
 
 // src/handoff-guard.ts
@@ -9783,13 +9887,13 @@ async function guardRunStrays(route, ship, tracker, role, workingId, since2, log
 }
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname8, join as join18 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync18, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
+import { delimiter, dirname as dirname9, join as join19 } from "path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync19, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync18;
+  const exists = opts.configExists ?? existsSync19;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -9806,7 +9910,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join18(dir, name);
+    const candidate = join19(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -9832,9 +9936,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname8(env.nodePath);
+  const nodeDir = dirname9(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname8(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname9(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -9845,7 +9949,7 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname8(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname9(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
@@ -9867,9 +9971,9 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text) {
-  mkdirSync8(dirname8(path), { recursive: true });
+  mkdirSync9(dirname9(path), { recursive: true });
   try {
-    writeFileSync10(path, text, { mode: 384, flag: "wx" });
+    writeFileSync11(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -9902,7 +10006,7 @@ Wrote ${o.configPath}.
 
 // src/connect-json.ts
 import { accessSync as accessSync3, constants as constants3 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json, write) {
   return {
@@ -9950,7 +10054,7 @@ function flagWizardAnswers(f, env) {
   if (f.agentBin && !isExec(f.agentBin)) return { error: `--agent-bin ${f.agentBin} is not an executable file` };
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
   const dockerPath = f.hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = f.extraPath ?? deriveExtraPath([dirname9(env.nodePath), pnpmPath ? dirname9(pnpmPath) : void 0, dockerPath ? dirname9(dockerPath) : void 0]);
+  const extraPath = f.extraPath ?? deriveExtraPath([dirname10(env.nodePath), pnpmPath ? dirname10(pnpmPath) : void 0, dockerPath ? dirname10(dockerPath) : void 0]);
   return {
     answers: {
       name: f.shipName?.trim() || env.hostname,
@@ -9963,8 +10067,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync11, existsSync as existsSync19, copyFileSync, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, rmSync as rmSync8 } from "fs";
-import { dirname as dirname10, join as join19 } from "path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync12, existsSync as existsSync20, copyFileSync, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, rmSync as rmSync9 } from "fs";
+import { dirname as dirname11, join as join20 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/release.ts
@@ -10652,13 +10756,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join19(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join20(o.cwd, f));
   const first = files[0];
-  if (!existsSync19(first)) {
+  if (!existsSync20(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync14(first, "utf8")).version;
+  const current = JSON.parse(readFileSync15(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -10671,27 +10775,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync14(f, "utf8");
+    const src = readFileSync15(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync11(f, out);
+    writeFileSync12(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join19(o.cwd, file);
+  const path = join20(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync19(path) ? readFileSync14(path, "utf8") : "# Changelog\n";
-  writeFileSync11(path, insertChangelogSection(existing, section));
+  const existing = existsSync20(path) ? readFileSync15(path, "utf8") : "# Changelog\n";
+  writeFileSync12(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -10774,7 +10878,7 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
     run2(cwd, ["worktree", "remove", "--force", dir]);
   } finally {
     try {
-      rmSync8(root, { recursive: true, force: true });
+      rmSync9(root, { recursive: true, force: true });
     } finally {
       run2(cwd, ["worktree", "prune"]);
       run2(cwd, ["branch", "-D", branch]);
@@ -10784,8 +10888,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join19(tmpdir3(), "crew-release-"));
-  const dir = join19(root, "checkout");
+  const root = mkdtempSync2(join20(tmpdir3(), "crew-release-"));
+  const dir = join20(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -10795,10 +10899,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join19(o.cwd, f);
-    if (!existsSync19(src)) continue;
-    mkdirSync9(dirname10(join19(dir, f)), { recursive: true });
-    copyFileSync(src, join19(dir, f));
+    const src = join20(o.cwd, f);
+    if (!existsSync20(src)) continue;
+    mkdirSync10(dirname11(join20(dir, f)), { recursive: true });
+    copyFileSync(src, join20(dir, f));
   }
   return { dir, branch, close };
 }
@@ -11466,7 +11570,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync20, statSync as statSync6, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync21, statSync as statSync7, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -11567,8 +11671,8 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync20(file)) return { events: [], offset: from };
-  const size = statSync6(file).size;
+  if (!existsSync21(file)) return { events: [], offset: from };
+  const size = statSync7(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
   const fd = openSync4(file, "r");
@@ -12518,9 +12622,54 @@ async function canMintAgentKeys(route, o = {}) {
   }
 }
 
+// src/capability-check.ts
+var WRITE_LEVELS = /* @__PURE__ */ new Set(["WRITE", "DELETE"]);
+async function canWriteTable(o, modelId) {
+  try {
+    const { access } = await get(o, `/data-models/${modelId}/access`);
+    return access === void 0 ? void 0 : WRITE_LEVELS.has(access);
+  } catch {
+    return void 0;
+  }
+}
+async function projectCapabilities(o, projectId) {
+  if (!projectId) return void 0;
+  try {
+    return await get(o, `/projects/${projectId}/capabilities`);
+  } catch {
+    return void 0;
+  }
+}
+async function checkCapabilities(o, found) {
+  const admin = isAdminRole(found.role);
+  const table2 = async (key, label, tableName2, modelId, askFor) => {
+    if (!modelId) return { key, label, status: "skipped", note: `no ${tableName2} table in this project` };
+    const ok = await canWriteTable(o, modelId);
+    if (ok === void 0) return { key, label, status: "skipped", note: "could not read access" };
+    return ok ? { key, label, status: "ok" } : { key, label, status: "missing", askFor };
+  };
+  const [crew, ships, repos, caps] = await Promise.all([
+    table2("crew-table", "write the Crew table", "Crew", found.crewModelId ?? found.models.crew, "WRITE access on the Crew table"),
+    table2("ships-table", "write the Ships table", "Ships", found.shipsModelId, "WRITE access on the Ships table"),
+    table2("repos-table", "create Repos rows", "Repos", found.reposModelId, "WRITE access on the Repos table"),
+    projectCapabilities(o, found.projectId)
+  ]);
+  const mint = admin || caps?.MINT_AGENT_KEYS ? { key: "mint-agent-keys", label: "mint agent keys", status: "ok" } : caps ? { key: "mint-agent-keys", label: "mint agent keys", status: "missing", askFor: 'the "Mint agent keys" capability' } : { key: "mint-agent-keys", label: "mint agent keys", status: "skipped", note: "could not read capabilities" };
+  const sync = admin ? { key: "sync-personas", label: "sync personas and skills", status: "ok" } : { key: "sync-personas", label: "sync personas and skills", status: "missing", askFor: "the workspace admin role (personas and skills are workspace-level tables)" };
+  return [crew, ships, repos, mint, sync];
+}
+function missLine(i) {
+  return `${i.label} \u2014 ask a workspace admin for ${i.askFor ?? "access"}`;
+}
+function describeCapability(i) {
+  if (i.status === "ok") return `ok       ${i.label}`;
+  if (i.status === "skipped") return `skipped  ${i.label} (${i.note ?? "not checked"})`;
+  return `missing  ${missLine(i)}`;
+}
+
 // src/agents-sync-run.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname11 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname12 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -12553,12 +12702,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync21(resolvedPath) ? JSON.parse(readFileSync15(resolvedPath, "utf8")) : {};
+    const raw = existsSync22(resolvedPath) ? JSON.parse(readFileSync16(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync10(dirname11(resolvedPath), { recursive: true });
-    writeFileSync12(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync11(dirname12(resolvedPath), { recursive: true });
+    writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -12665,7 +12814,7 @@ import { isMap as isMap2, parseDocument as parseDocument2, YAMLMap } from "yaml"
 
 // src/repos-cmd.ts
 import { homedir as homedir7 } from "os";
-import { basename as basename7, join as join20, resolve as resolve3 } from "path";
+import { basename as basename7, join as join21, resolve as resolve3 } from "path";
 import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -12863,7 +13012,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join20(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join21(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name });
   return { ...add, remote, target };
 }
@@ -13006,7 +13155,7 @@ function existingRepoConfig(f) {
 }
 
 // src/sample-ticket.ts
-import { basename as basename8, dirname as dirname13, join as join21 } from "path";
+import { basename as basename8, dirname as dirname14, join as join22 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -13029,8 +13178,8 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join21(dirname13(existing[0]), SAMPLE_REPO);
-  return join21(reposBase, workspace, SAMPLE_REPO);
+  if (existing.length > 0) return join22(dirname14(existing[0]), SAMPLE_REPO);
+  return join22(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
 function sampleDescription() {
@@ -13111,8 +13260,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "fs";
-import { basename as basename9, dirname as dirname14, join as join22, resolve as resolve4 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync17, readdirSync as readdirSync6 } from "fs";
+import { basename as basename9, dirname as dirname15, join as join23, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -13166,12 +13315,12 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname14(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname15(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename9(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
   try {
-    names = readdirSync5(parent);
+    names = readdirSync6(parent);
   } catch {
     return [];
   }
@@ -13179,7 +13328,7 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join22(parent, name);
+    const path = join23(parent, name);
     if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
   }
   return out;
@@ -13214,7 +13363,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync22(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync23(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -13222,7 +13371,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync22(a.path)) {
+    if (!dryRun && existsSync23(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -13233,7 +13382,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync22(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync23(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -13282,7 +13431,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync16(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync17(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -13387,16 +13536,16 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync9, statSync as statSync7 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync10, statSync as statSync8 } from "fs";
+import { join as join24 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join23(stateDir, "streams");
-  if (!existsSync23(dir)) return [];
+  const dir = join24(stateDir, "streams");
+  if (!existsSync24(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync6(dir).map((name) => join23(dir, name)).filter((path) => {
+  return readdirSync7(dir).map((name) => join24(dir, name)).filter((path) => {
     try {
-      return statSync7(path).mtimeMs < cutoff;
+      return statSync8(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -13410,7 +13559,7 @@ function applyStreamSweep(paths, dryRun, log) {
       continue;
     }
     try {
-      rmSync9(path, { force: true });
+      rmSync10(path, { force: true });
       removed++;
       log.emit(`removed stream artifact ${path}`, { step: "worktree" });
     } catch (e) {
@@ -13420,11 +13569,11 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync23(stateDir)) return [];
+  if (!existsSync24(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync6(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join23(stateDir, name)).filter((path) => {
+  return readdirSync7(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join24(stateDir, name)).filter((path) => {
     try {
-      return statSync7(path).mtimeMs < cutoff;
+      return statSync8(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -13432,24 +13581,24 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync29, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, rmSync as rmSync11, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync9, readdirSync as readdirSync11 } from "fs";
+import { realpathSync as realpathSync2, readFileSync as readFileSync23, existsSync as existsSync30, mkdirSync as mkdirSync16, writeFileSync as writeFileSync17, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync17, chmodSync } from "fs";
-import { dirname as dirname15, join as join24 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, chmodSync } from "fs";
+import { dirname as dirname16, join as join25 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join24(stateDir, "ssh", "id_ed25519");
+  return join25(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync24(privateKeyPath)) {
-    mkdirSync11(dirname15(privateKeyPath), { recursive: true });
+  if (!existsSync25(privateKeyPath)) {
+    mkdirSync12(dirname16(privateKeyPath), { recursive: true });
     try {
       execFileSync4("ssh-keygen", [
         "-t",
@@ -13469,10 +13618,10 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync(privateKeyPath, 384);
   }
-  if (!existsSync24(publicKeyPath)) {
+  if (!existsSync25(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync17(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync18(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -13688,9 +13837,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync3, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
 import { randomInt } from "crypto";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn4(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -13757,21 +13906,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join25(stateDir, "passengers", `${workspaceId}.json`);
+  return join26(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync25(path)) return void 0;
+  if (!existsSync26(path)) return void 0;
   try {
-    return JSON.parse(readFileSync18(path, "utf8"));
+    return JSON.parse(readFileSync19(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync12(join25(stateDir, "passengers"), { recursive: true });
-  writeFileSync13(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync13(join26(stateDir, "passengers"), { recursive: true });
+  writeFileSync14(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -13868,9 +14017,9 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join25(stateDir, "passengers");
-  if (!existsSync25(dir)) return [];
-  return readdirSync7(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
+  const dir = join26(stateDir, "passengers");
+  if (!existsSync26(dir)) return [];
+  return readdirSync8(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
 // src/mcp-endpoint-registry.ts
@@ -13990,8 +14139,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn5 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync4, readdirSync as readdirSync8 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
+import { join as join27 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -14080,21 +14229,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join26(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join27(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync26(path)) return void 0;
+  if (!existsSync27(path)) return void 0;
   try {
-    return JSON.parse(readFileSync19(path, "utf8"));
+    return JSON.parse(readFileSync20(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync13(join26(stateDir, "passengers"), { recursive: true });
-  writeFileSync14(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync14(join27(stateDir, "passengers"), { recursive: true });
+  writeFileSync15(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -14114,10 +14263,10 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join26(stateDir, "passengers");
-  if (!existsSync26(dir)) return [];
+  const dir = join27(stateDir, "passengers");
+  if (!existsSync27(dir)) return [];
   const suffix = "-sync.json";
-  return readdirSync8(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
+  return readdirSync9(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
 function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
@@ -14172,12 +14321,12 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync14, readFileSync as readFileSync21, readdirSync as readdirSync10, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync15 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync15, readFileSync as readFileSync22, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync16 } from "fs";
+import { join as join29 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync27, readdirSync as readdirSync9, readFileSync as readFileSync20 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync10, readFileSync as readFileSync21 } from "fs";
+import { join as join28 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14196,21 +14345,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync27(path)) return false;
+  if (!existsSync28(path)) return false;
   try {
-    return JSON.parse(readFileSync20(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync21(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join27(o.stateDir, "streams");
-  if (!existsSync27(dir)) return [];
+  const dir = join28(o.stateDir, "streams");
+  if (!existsSync28(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
-  for (const name of readdirSync9(dir)) {
+  for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join27(dir, name);
+    const streamPath = join28(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14302,15 +14451,15 @@ async function runDaemonLoop(o) {
 function latestMtime(path) {
   let stat;
   try {
-    stat = statSync8(path);
+    stat = statSync9(path);
   } catch {
     return 0;
   }
   if (stat.isFile()) return stat.mtimeMs;
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
-  for (const entry of readdirSync10(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join28(path, entry.name)));
+  for (const entry of readdirSync11(path, { withFileTypes: true })) {
+    latest = Math.max(latest, latestMtime(join29(path, entry.name)));
   }
   return latest;
 }
@@ -14319,23 +14468,23 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync28(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync29(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join28(stateDir, "reload-requested");
+  return join29(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join28(stateDir, "daemon.started");
+  return join29(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync14(stateDir, { recursive: true });
-  rmSync10(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync15(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  mkdirSync15(stateDir, { recursive: true });
+  rmSync11(reloadSentinelFor(stateDir), { force: true });
+  writeFileSync16(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync21(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync22(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -14344,7 +14493,7 @@ function readDaemonStarted(stateDir) {
 function configChangedAfter(files, startedAt) {
   for (const f of files) {
     try {
-      if (statSync8(f).mtimeMs > startedAt) return f;
+      if (statSync9(f).mtimeMs > startedAt) return f;
     } catch {
     }
   }
@@ -14691,7 +14840,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname16(process.execPath) : resolve5(dirname16(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname17(process.execPath) : resolve5(dirname17(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -14839,6 +14988,7 @@ function usage() {
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
   crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
+  crew disconnect --reset [--remove-checkouts] [--dry-run] [--json]   remove everything connect and install wrote on this machine: scheduler units, Pair/MCP entries, seat keys, keychain credential, resolved state, then crew.yaml (--remove-checkouts also deletes checkouts crew cloned, never one with local changes)
   crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
   crew agents prompt R [route] print one persona's current prompt (e.g. R=pair, for a SessionStart hook; --harness H adds which CLI it serves)
   crew skills sync [route]      push only crew's skill files (e.g. grill-me) into the workspace Agent Skills table
@@ -15017,7 +15167,7 @@ if (command === "passenger-sync-daemon") {
       firstRun = { answers, configPath };
       cfg = loadConfig(CREW_HOME, configPath, { text: renderShipBlock(answers), allowNoRoutes: true });
     } else {
-      cfg = loadConfig(CREW_HOME, void 0, command === "repos" ? { allowNoRoutes: true } : {});
+      cfg = loadConfig(CREW_HOME, void 0, command === "repos" || command === "disconnect" && flag("reset") ? { allowNoRoutes: true } : {});
     }
   } catch (e) {
     if (e instanceof ConfigError) {
@@ -15048,6 +15198,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   const state = new State(cfg.ship.stateDir);
+  setCloneRecorder((dir) => recordClonedCheckout(cfg.ship.stateDir, dir));
   const dryRun = flag("dry-run");
   const force = flag("force");
   const EXCLUSIVE = { passengers: "passengers" };
@@ -15250,8 +15401,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join29(homedir8(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync29(staleTimer)) {
+      const staleTimer = join30(homedir8(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync30(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -15277,7 +15428,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync29(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync30(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -15295,7 +15446,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync29(p);
+    const unitExists = (p) => existsSync30(p);
     const crontab = o.host === "linux" ? spawnSync6("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -15312,7 +15463,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync16(cfg.configFile, planEnable(readFileSync22(cfg.configFile, "utf8"), a.route));
+          writeFileSync17(cfg.configFile, planEnable(readFileSync23(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -16311,7 +16462,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join29(CREW_HOME, "src"), join29(CREW_HOME, "dist"), join29(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join30(CREW_HOME, "src"), join30(CREW_HOME, "dist"), join30(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -16512,10 +16663,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync29(resolvedPath) ? JSON.parse(readFileSync22(resolvedPath, "utf8")) : {};
+        const raw = existsSync30(resolvedPath) ? JSON.parse(readFileSync23(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync15(dirOf(resolvedPath), { recursive: true });
-        writeFileSync16(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync16(dirOf(resolvedPath), { recursive: true });
+        writeFileSync17(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16528,15 +16679,15 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks") usage2();
-      const configText = readFileSync22(cfg.configFile, "utf8");
+      const configText = readFileSync23(cfg.configFile, "utf8");
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname16(cfg.configFile), a.route, a.name);
-          if (!existsSync29(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync29(resolvePath(dir, r)), read: (r) => {
+          const dir = repoDirOf(configText, dirname17(cfg.configFile), a.route, a.name);
+          if (!existsSync30(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync30(resolvePath(dir, r)), read: (r) => {
             try {
-              return readFileSync22(resolvePath(dir, r), "utf8");
+              return readFileSync23(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -16548,13 +16699,13 @@ ${changed2.map((c) => `  - ${c}
           if (write && suggestion.source === null) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, suggestion.hooks);
-            writeFileSync16(cfg.configFile, plan.text);
+            writeFileSync17(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync16(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
+            writeFileSync17(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(suggestion.hooks), kept: [] };
           }
           if (flag("json")) {
@@ -16591,7 +16742,7 @@ ${changed2.map((c) => `  - ${c}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync29(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync30(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -16620,15 +16771,15 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync29(resolvedFile)) {
+      if (existsSync30(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync23(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname16(cfg.configFile);
+      const base = dirname17(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16637,7 +16788,7 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync29(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync30(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -16649,9 +16800,9 @@ ${changed2.map((c) => `  - ${c}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir") });
-          if (existsSync29(plan2.target) && (existsSync29(`${plan2.target}/.git`) || readdirSync11(plan2.target).length > 0)) {
+          if (existsSync30(plan2.target) && (existsSync30(`${plan2.target}/.git`) || readdirSync12(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync29(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync30(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -16669,12 +16820,12 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync16(cfg.configFile, plan2.text);
+          writeFileSync17(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir8()));
-        const top = existsSync29(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync30(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -16723,15 +16874,15 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync29(resolvedFile)) {
-            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+          if (existsSync30(resolvedFile)) {
+            const raw = JSON.parse(readFileSync23(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync17(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync16(cfg.configFile, plan.text);
+        writeFileSync17(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -17016,6 +17167,16 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         const route2 = `${found.workspaceSlug}/${found.projectSlug ?? found.projectId}`;
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, route2);
+        const capabilities = await checkCapabilities(authOpts, found);
+        if (flag("json")) {
+          process.stdout.write(`${JSON.stringify({ event: "capabilities", route: route2, items: capabilities })}
+`);
+        } else {
+          process.stderr.write("capabilities for this key:\n");
+          for (const i of capabilities) process.stderr.write(`  ${describeCapability(i)}
+`);
+        }
+        const capabilityMisses = capabilities.filter((i) => i.status === "missing").map(missLine);
         if (found.locksModelId && !dryRun) {
           const configured = cfg.routes.find((r) => r.route === route2);
           const repoNames = [...Object.values(found.repoNames ?? {}), ...configured ? reposOf(configured).map((t) => t.name) : []].filter((n) => !!n);
@@ -17041,10 +17202,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync29(resolvedPath);
+        const hadPreviousFile = existsSync30(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync22(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync23(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -17134,6 +17295,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           holds: found.holds.map((h) => ({ id: h.id, role: h.name })),
           ...found.releaseSeat ? { releaseSeat: found.releaseSeat } : {},
           ...found.role ?? previous?.role ? { role: found.role ?? previous?.role } : {},
+          ...capabilityMisses.length > 0 ? { capabilityMisses } : {},
           ...operator ? { operator } : {},
           ...contract ? { contract } : {},
           ...reviewedStatuses.length > 0 ? { reviewedStatuses } : {},
@@ -17152,10 +17314,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync15(dirname16(resolvedPath), { recursive: true });
+          mkdirSync16(dirname17(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync16(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync17(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -17190,8 +17352,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync15(dirname16(apiKeyFile), { recursive: true });
-            writeFileSync16(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync16(dirname17(apiKeyFile), { recursive: true });
+            writeFileSync17(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -17200,7 +17362,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const keyPersisted = keychainBacked || apiKeyFile !== void 0;
         const wizard = firstRun;
         const writeFirstRun = wizard !== void 0 && !dryRun && keyPersisted;
-        const routeDir = value("dir") ?? (writeFirstRun ? join29(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
+        const routeDir = value("dir") ?? (writeFirstRun ? join30(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
         const routeBlock = renderConnection(
           found,
           route2,
@@ -17795,10 +17957,76 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     case "disconnect": {
       const url = mcpUrlFor(value("base-url") ?? cfg.routes[0]?.baseUrl ?? DEFAULT_BASE_URL);
       const disconnectHarnesses = /* @__PURE__ */ new Set([...shipPair(cfg.ship), ...shipToolchains(cfg.ship).map((t) => t.harness).filter(isPairHarness)]);
-      for (const h of disconnectHarnesses) {
-        process.stderr.write(`${pairInstallerFor(h).removePair({ url, bin: cfg.ship.agent.bin, dryRun })}
+      const removePairEntries = (mcpUrl, dry) => [...disconnectHarnesses].map((h) => pairInstallerFor(h).removePair({ url: mcpUrl, bin: cfg.ship.agent.bin, dryRun: dry }));
+      if (!flag("reset")) {
+        for (const line of removePairEntries(url, dryRun)) process.stderr.write(`${line}
 `);
+        break;
       }
+      const host = hostPlatform();
+      let resetStore;
+      try {
+        resetStore = getSessionStore3();
+      } catch {
+        resetStore = void 0;
+      }
+      const effects = {
+        async uninstallUnits(dry) {
+          const lines = [];
+          if (host === "windows") return lines;
+          const log = { emit: (m) => {
+            lines.push(m);
+          }, warn: (m) => {
+            lines.push(m);
+          } };
+          for (const job of ["run", "release", "passengers"]) {
+            await applyUninstall(planUninstall(cfg.ship, CREW_HOME, host, detectSystemd(), job), CREW_HOME, dry, log);
+          }
+          return lines;
+        },
+        removePair: removePairEntries,
+        async revokeSeatKeys(r, dry) {
+          const outcomes = await revokeSeatKeys(r, { userAgent: cfg.ship.userAgent, dryRun: dry });
+          return outcomes.map((o) => ({ line: describeRevokeOutcome(o), ok: o.action !== "failed" }));
+        },
+        async credential(r) {
+          if (!resetStore) return { stored: false, clear: async () => {
+          } };
+          const store = resetStore;
+          const h = hostFromUrl3(r.baseUrl);
+          const [slug] = splitRoute(r.route);
+          const session = await store.get(h, slug);
+          return { stored: Boolean(session?.apiKey), clear: () => store.clear(h, slug) };
+        },
+        inspectCheckout(dir) {
+          const dirty = status(dir).map((c) => c.path);
+          const linkedWorktrees = worktrees(dir).map((w) => w.path).filter((p) => realpathSync2(p) !== realpathSync2(dir));
+          return { dirty, linkedWorktrees };
+        }
+      };
+      const droppedRoutes = [];
+      try {
+        const rawCfg = parseYaml2(readFileSync23(cfg.configFile, "utf8"));
+        for (const r of rawCfg?.routes ?? []) {
+          if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
+          try {
+            splitRoute(r.route);
+          } catch {
+            continue;
+          }
+          droppedRoutes.push({ route: r.route, baseUrl: typeof r.baseUrl === "string" ? r.baseUrl : rawCfg?.ship?.baseUrl ?? DEFAULT_BASE_URL });
+        }
+      } catch {
+      }
+      const steps = await runReset(
+        { routes: cfg.routes, droppedRoutes, stateDir: cfg.ship.stateDir, configFile: cfg.configFile, dryRun, removeCheckouts: flag("remove-checkouts") },
+        effects
+      );
+      if (flag("json")) process.stdout.write(`${JSON.stringify({ dryRun, ok: !resetIncomplete(steps), steps })}
+`);
+      else for (const s of steps) process.stdout.write(`${describeResetStep(s)}
+`);
+      if (resetIncomplete(steps)) process.exitCode = 1;
       break;
     }
     case "install": {
@@ -17820,8 +18048,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync15(cfg.ship.stateDir, { recursive: true });
-      writeFileSync16(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync16(cfg.ship.stateDir, { recursive: true });
+      writeFileSync17(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -17872,7 +18100,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync22(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync23(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -17895,8 +18123,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync22(cfg.configFile, "utf8");
-      const cfgBase = dirname16(cfg.configFile);
+      const configText = readFileSync23(cfg.configFile, "utf8");
+      const cfgBase = dirname17(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -17924,7 +18152,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync16(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync17(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -17932,29 +18160,29 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync29(resolvedFile)) {
-            const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+          if (existsSync30(resolvedFile)) {
+            const raw = JSON.parse(readFileSync23(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync17(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync29(join29(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync11(dir, { recursive: true, force: true });
+        if (existsSync30(join30(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync29(join29(dir, ".git"));
-      if (existsSync29(dir) && fresh && readdirSync11(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync30(join30(dir, ".git"));
+      if (existsSync30(dir) && fresh && readdirSync12(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync15(dir, { recursive: true });
-        writeFileSync16(join29(dir, "README.md"), SAMPLE_README);
-        writeFileSync16(join29(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync16(dir, { recursive: true });
+        writeFileSync17(join30(dir, "README.md"), SAMPLE_README);
+        writeFileSync17(join30(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -17972,17 +18200,17 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync29(resolvedFile)) {
-          const raw = JSON.parse(readFileSync22(resolvedFile, "utf8"));
+        if (existsSync30(resolvedFile)) {
+          const raw = JSON.parse(readFileSync23(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync16(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync17(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync16(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync17(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -18272,7 +18500,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync29(r.dir)) {
+            if (existsSync30(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -18300,7 +18528,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync29(evFile) ? statSync9(evFile).size : 0;
+        const evSize = existsSync30(evFile) ? statSync10(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -18311,7 +18539,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync22(p, "utf8");
+            return readFileSync23(p, "utf8");
           } catch {
             return null;
           }
@@ -18327,7 +18555,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const changed2 = configChangedAfter(daemonConfigPaths(cfg), daemonStartedAt);
         if (changed2) {
           process.stdout.write(
-            `daemon config:     WARN ${changed2} changed at ${new Date(statSync9(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
+            `daemon config:     WARN ${changed2} changed at ${new Date(statSync10(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
 `
           );
         }
@@ -18387,6 +18615,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       const keyRole = route.resolved?.role ?? await fetchKeyRole(route, cfg.ship.userAgent);
       const roleRoute = route.resolved && keyRole ? { ...route, resolved: { ...route.resolved, role: keyRole } } : route;
       process.stdout.write(`api key role:     ${keyRole ?? "unknown"}
+`);
+      for (const m of route.resolved?.capabilityMisses ?? []) process.stdout.write(`capability:       MISSING ${m} (re-run \`crew connect\` once granted)
 `);
       const canMint = await canMintAgentKeys(roleRoute, { userAgent: cfg.ship.userAgent });
       process.stdout.write(`can mint agent keys: ${canMint === void 0 ? "unknown" : canMint ? "yes" : "no"}