@tablation/crew 0.61.0 → 0.63.0

package/dist/cli.js

@@ -5183,7 +5183,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname17, join as join30, basename as basename10 } from "path";
+import { resolve as resolve5, dirname as dirname18, join as join31, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
@@ -5859,154 +5859,8 @@ function resetIncomplete(steps) {
   return steps.some((s) => s.action === "failed" || s.action === "kept");
 }
 
-// src/tracker.ts
-import { hostname } from "os";
-import { TablationClient as TablationClient3 } from "@tablation/client";
-
-// src/contract.ts
-var DEFAULT_CONTRACT = {
-  columns: {
-    key: "issue_id",
-    tag: "issue_tag",
-    title: "title",
-    status: "status",
-    assignee: "assignee_id",
-    priority: "priority",
-    severity: "severity",
-    slice: "project_id",
-    repo: "repo_id",
-    parent: "parent_id",
-    blockedBy: "blocked_by",
-    updatedAt: "updated_at",
-    needsDesign: "needs_design",
-    attachments: "attachments",
-    workMode: "work_mode",
-    reportType: "report_type",
-    epic: "epic_id",
-    author: "filed_by_id",
-    ship: "ship_id",
-    heldBy: "held_by_ship_id",
-    resolutionNote: "resolution_note",
-    verifiedSha: "verified_sha",
-    prRef: "pr_ref",
-    position: "position"
-  },
-  comments: {
-    parent: "ticket_id",
-    body: "body",
-    author: "team_member_id",
-    createdAt: "created_at",
-    ship: "ship_id",
-    publicReply: "is_public_reply",
-    authorName: "author_name"
-  },
-  statuses: {
-    open: ["new", "accepted", "blocked", "in_progress", "needs_info", "fixed", "qa", "verified"],
-    resolved: [
-      "verified",
-      "closed_deployed",
-      "closed_wont_fix",
-      "closed_duplicate",
-      "closed_completed",
-      "closed_cant_reproduce"
-    ],
-    approved: "accepted",
-    parked: "blocked",
-    building: "in_progress",
-    handoff: "fixed",
-    verifying: "qa",
-    verified: "verified",
-    deployed: "closed_deployed",
-    needsHuman: "needs_info",
-    reviewing: null,
-    wontFix: "closed_wont_fix",
-    draft: "draft"
-  },
-  epics: {
-    statusColumn: "status",
-    keyColumn: "epic_id",
-    statuses: { planned: "planned", building: "in_progress", done: "done", cancelled: "cancelled" }
-  },
-  priorityOrder: ["p0", "p1", "p2", "p3"],
-  severityOrder: ["s1", "s2", "s3", "s4"],
-  unknownPriorityRank: 2,
-  coordinatingValue: "coordinating",
-  manualWorkMode: "manual",
-  hybridWorkMode: "hybrid",
-  repoExemptReportTypes: ["coordinating", "question", "investigation"]
-};
-function closedStatuses(c) {
-  return c.statuses.resolved.filter((s) => s !== c.statuses.verified);
-}
-function resolveContract(override) {
-  if (!override) return DEFAULT_CONTRACT;
-  return {
-    columns: { ...DEFAULT_CONTRACT.columns, ...override.columns },
-    comments: { ...DEFAULT_CONTRACT.comments, ...override.comments },
-    statuses: { ...DEFAULT_CONTRACT.statuses, ...override.statuses },
-    epics: {
-      ...DEFAULT_CONTRACT.epics,
-      ...override.epics,
-      statuses: { ...DEFAULT_CONTRACT.epics.statuses, ...override.epics?.statuses }
-    },
-    priorityOrder: override.priorityOrder ?? DEFAULT_CONTRACT.priorityOrder,
-    severityOrder: override.severityOrder ?? DEFAULT_CONTRACT.severityOrder,
-    unknownPriorityRank: override.unknownPriorityRank ?? DEFAULT_CONTRACT.unknownPriorityRank,
-    coordinatingValue: override.coordinatingValue ?? DEFAULT_CONTRACT.coordinatingValue,
-    manualWorkMode: override.manualWorkMode ?? DEFAULT_CONTRACT.manualWorkMode,
-    hybridWorkMode: override.hybridWorkMode ?? DEFAULT_CONTRACT.hybridWorkMode,
-    // A workspace overriding `coordinatingValue` alone (renaming the rollup
-    // marker) still gets that renamed value exempted here by default,
-    // without also having to repeat it — only an explicit
-    // `repoExemptReportTypes` overrides this derived default.
-    repoExemptReportTypes: override.repoExemptReportTypes ?? (override.coordinatingValue ? [override.coordinatingValue, "question", "investigation"] : DEFAULT_CONTRACT.repoExemptReportTypes)
-  };
-}
-function validateContract(c) {
-  const problems = [];
-  const open = new Set(c.statuses.open);
-  const resolved = new Set(c.statuses.resolved);
-  for (const role of ["approved", "parked", "building", "handoff", "verifying", "needsHuman"]) {
-    const v = c.statuses[role];
-    if (!open.has(v)) problems.push(`statuses.${role} ("${v}") is not listed in statuses.open`);
-  }
-  if (c.statuses.reviewing && !open.has(c.statuses.reviewing)) {
-    problems.push(`statuses.reviewing ("${c.statuses.reviewing}") is not listed in statuses.open`);
-  }
-  if (!resolved.has(c.statuses.deployed)) {
-    problems.push(`statuses.deployed ("${c.statuses.deployed}") is not listed in statuses.resolved`);
-  }
-  if (resolved.has(c.statuses.handoff)) {
-    problems.push(
-      `statuses.handoff ("${c.statuses.handoff}") is listed as resolved \u2014 it means built-but-unchecked, so a ticket blocked by it is still blocked; calling it resolved would build on unverified work`
-    );
-  }
-  if (!resolved.has(c.statuses.wontFix)) {
-    problems.push(`statuses.wontFix ("${c.statuses.wontFix}") is not listed in statuses.resolved`);
-  }
-  if (c.statuses.reviewing && resolved.has(c.statuses.reviewing)) {
-    problems.push(
-      `statuses.reviewing ("${c.statuses.reviewing}") is listed as resolved \u2014 it is unmerged work under review, so a ticket blocked by it is still blocked`
-    );
-  }
-  if (resolved.has(c.statuses.approved)) {
-    problems.push(`statuses.approved ("${c.statuses.approved}") is listed as resolved`);
-  }
-  if (c.statuses.parked === c.statuses.approved) {
-    problems.push("statuses.parked and statuses.approved are the same value \u2014 parking would be a no-op");
-  }
-  const epicValues = Object.values(c.epics.statuses);
-  if (new Set(epicValues).size !== epicValues.length) {
-    problems.push("epics.statuses names the same value twice \u2014 the epic sync could not tell those states apart");
-  }
-  if (c.priorityOrder.length === 0) problems.push("priorityOrder is empty");
-  if (c.severityOrder.length === 0) problems.push("severityOrder is empty");
-  for (const [name, order] of [["priorityOrder", c.priorityOrder], ["severityOrder", c.severityOrder]]) {
-    if (new Set(order).size !== order.length) problems.push(`${name} contains duplicates`);
-  }
-  return problems;
-}
-var EVENT_LOG_MISSING = "the Issues table has no event log \u2014 crew writes its audit trail there (CREW-1574). In the app, open the Issues table's Data & lifecycle tab and turn on Event log, then rerun.";
+// src/crew-floor.ts
+import { TablationApiError as TablationApiError3 } from "@tablation/client";
 
 // src/callout.ts
 var calloutHeader = (kind, label) => `> [!${kind}]
@@ -7055,6 +6909,223 @@ var SHELL_WORDS = /* @__PURE__ */ new Set([
   "ok"
 ]);
 
+// src/crew-floor.ts
+var CREW_OUTDATED_KEY = "crew_outdated";
+function parseVersion(v) {
+  const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function compareVersions(a, b) {
+  const pa = parseVersion(a);
+  const pb = parseVersion(b);
+  if (!pa || !pb) return null;
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] - pb[i];
+  return 0;
+}
+function belowFloor(have, floor) {
+  if (!floor) return false;
+  const c = compareVersions(have, floor);
+  return c !== null && c < 0;
+}
+function outdatedItem(have, floor, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  return {
+    kind: "crew_outdated",
+    key: CREW_OUTDATED_KEY,
+    since: nowIso,
+    message: `crew ${have} is below this workspace's minimum ${floor} \u2014 no ticket will be picked until it is updated (the Crew app updates it, or \`npm install -g @tablation/crew\`). Resumes automatically once the version satisfies the floor`
+  };
+}
+function sentVersion(ship) {
+  return /CrewAgent\/(\d+\.\d+\.\d+\S*)/.exec(ship.userAgent)?.[1] ?? null;
+}
+async function readCrewFloor(route, ship) {
+  const r = route.resolved;
+  if (!r?.projectId) return void 0;
+  try {
+    const res = await fetch(`${route.baseUrl}/api/projects/${encodeURIComponent(r.projectId)}?workspaceId=${r.workspaceId}`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": ship.userAgent }
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.crewMinVersion ?? null;
+  } catch {
+    return void 0;
+  }
+}
+async function checkCrewFloor(o, deps = {}) {
+  const have = deps.version ?? sentVersion(o.ship);
+  if (!have) return null;
+  const floor = await (deps.read ?? readCrewFloor)(o.route, o.ship);
+  if (floor === void 0) return openOutdated(o.state);
+  if (belowFloor(have, floor)) {
+    const item = outdatedItem(have, floor);
+    await raiseShipAttention(o, item);
+    return item.message;
+  }
+  clearShipAttention(o.state, CREW_OUTDATED_KEY);
+  return null;
+}
+function openOutdated(state) {
+  return state.shipAttention().previous().find((i) => i.key === CREW_OUTDATED_KEY)?.message ?? null;
+}
+function isUpgradeRequired(err) {
+  return err instanceof TablationApiError3 && err.status === 426;
+}
+async function raiseFromUpgradeRequired(o, err) {
+  const have = sentVersion(o.ship) ?? "unknown";
+  const floor = /(\d+\.\d+\.\d+)/.exec(err.message.replace(have, ""))?.[1] ?? "a newer version";
+  await raiseShipAttention(o, outdatedItem(have, floor));
+}
+
+// src/tracker.ts
+import { hostname } from "os";
+import { TablationClient as TablationClient3 } from "@tablation/client";
+
+// src/contract.ts
+var DEFAULT_CONTRACT = {
+  columns: {
+    key: "issue_id",
+    tag: "issue_tag",
+    title: "title",
+    status: "status",
+    assignee: "assignee_id",
+    priority: "priority",
+    severity: "severity",
+    slice: "project_id",
+    repo: "repo_id",
+    parent: "parent_id",
+    blockedBy: "blocked_by",
+    updatedAt: "updated_at",
+    needsDesign: "needs_design",
+    attachments: "attachments",
+    workMode: "work_mode",
+    reportType: "report_type",
+    epic: "epic_id",
+    author: "filed_by_id",
+    ship: "ship_id",
+    heldBy: "held_by_ship_id",
+    resolutionNote: "resolution_note",
+    verifiedSha: "verified_sha",
+    prRef: "pr_ref",
+    position: "position"
+  },
+  comments: {
+    parent: "ticket_id",
+    body: "body",
+    author: "team_member_id",
+    createdAt: "created_at",
+    ship: "ship_id",
+    publicReply: "is_public_reply",
+    authorName: "author_name"
+  },
+  statuses: {
+    open: ["new", "accepted", "blocked", "in_progress", "needs_info", "fixed", "qa", "verified"],
+    resolved: [
+      "verified",
+      "closed_deployed",
+      "closed_wont_fix",
+      "closed_duplicate",
+      "closed_completed",
+      "closed_cant_reproduce"
+    ],
+    approved: "accepted",
+    parked: "blocked",
+    building: "in_progress",
+    handoff: "fixed",
+    verifying: "qa",
+    verified: "verified",
+    deployed: "closed_deployed",
+    needsHuman: "needs_info",
+    reviewing: null,
+    wontFix: "closed_wont_fix",
+    draft: "draft"
+  },
+  epics: {
+    statusColumn: "status",
+    keyColumn: "epic_id",
+    statuses: { planned: "planned", building: "in_progress", done: "done", cancelled: "cancelled" }
+  },
+  priorityOrder: ["p0", "p1", "p2", "p3"],
+  severityOrder: ["s1", "s2", "s3", "s4"],
+  unknownPriorityRank: 2,
+  coordinatingValue: "coordinating",
+  manualWorkMode: "manual",
+  hybridWorkMode: "hybrid",
+  repoExemptReportTypes: ["coordinating", "question", "investigation"]
+};
+function closedStatuses(c) {
+  return c.statuses.resolved.filter((s) => s !== c.statuses.verified);
+}
+function resolveContract(override) {
+  if (!override) return DEFAULT_CONTRACT;
+  return {
+    columns: { ...DEFAULT_CONTRACT.columns, ...override.columns },
+    comments: { ...DEFAULT_CONTRACT.comments, ...override.comments },
+    statuses: { ...DEFAULT_CONTRACT.statuses, ...override.statuses },
+    epics: {
+      ...DEFAULT_CONTRACT.epics,
+      ...override.epics,
+      statuses: { ...DEFAULT_CONTRACT.epics.statuses, ...override.epics?.statuses }
+    },
+    priorityOrder: override.priorityOrder ?? DEFAULT_CONTRACT.priorityOrder,
+    severityOrder: override.severityOrder ?? DEFAULT_CONTRACT.severityOrder,
+    unknownPriorityRank: override.unknownPriorityRank ?? DEFAULT_CONTRACT.unknownPriorityRank,
+    coordinatingValue: override.coordinatingValue ?? DEFAULT_CONTRACT.coordinatingValue,
+    manualWorkMode: override.manualWorkMode ?? DEFAULT_CONTRACT.manualWorkMode,
+    hybridWorkMode: override.hybridWorkMode ?? DEFAULT_CONTRACT.hybridWorkMode,
+    // A workspace overriding `coordinatingValue` alone (renaming the rollup
+    // marker) still gets that renamed value exempted here by default,
+    // without also having to repeat it — only an explicit
+    // `repoExemptReportTypes` overrides this derived default.
+    repoExemptReportTypes: override.repoExemptReportTypes ?? (override.coordinatingValue ? [override.coordinatingValue, "question", "investigation"] : DEFAULT_CONTRACT.repoExemptReportTypes)
+  };
+}
+function validateContract(c) {
+  const problems = [];
+  const open = new Set(c.statuses.open);
+  const resolved = new Set(c.statuses.resolved);
+  for (const role of ["approved", "parked", "building", "handoff", "verifying", "needsHuman"]) {
+    const v = c.statuses[role];
+    if (!open.has(v)) problems.push(`statuses.${role} ("${v}") is not listed in statuses.open`);
+  }
+  if (c.statuses.reviewing && !open.has(c.statuses.reviewing)) {
+    problems.push(`statuses.reviewing ("${c.statuses.reviewing}") is not listed in statuses.open`);
+  }
+  if (!resolved.has(c.statuses.deployed)) {
+    problems.push(`statuses.deployed ("${c.statuses.deployed}") is not listed in statuses.resolved`);
+  }
+  if (resolved.has(c.statuses.handoff)) {
+    problems.push(
+      `statuses.handoff ("${c.statuses.handoff}") is listed as resolved \u2014 it means built-but-unchecked, so a ticket blocked by it is still blocked; calling it resolved would build on unverified work`
+    );
+  }
+  if (!resolved.has(c.statuses.wontFix)) {
+    problems.push(`statuses.wontFix ("${c.statuses.wontFix}") is not listed in statuses.resolved`);
+  }
+  if (c.statuses.reviewing && resolved.has(c.statuses.reviewing)) {
+    problems.push(
+      `statuses.reviewing ("${c.statuses.reviewing}") is listed as resolved \u2014 it is unmerged work under review, so a ticket blocked by it is still blocked`
+    );
+  }
+  if (resolved.has(c.statuses.approved)) {
+    problems.push(`statuses.approved ("${c.statuses.approved}") is listed as resolved`);
+  }
+  if (c.statuses.parked === c.statuses.approved) {
+    problems.push("statuses.parked and statuses.approved are the same value \u2014 parking would be a no-op");
+  }
+  const epicValues = Object.values(c.epics.statuses);
+  if (new Set(epicValues).size !== epicValues.length) {
+    problems.push("epics.statuses names the same value twice \u2014 the epic sync could not tell those states apart");
+  }
+  if (c.priorityOrder.length === 0) problems.push("priorityOrder is empty");
+  if (c.severityOrder.length === 0) problems.push("severityOrder is empty");
+  for (const [name, order] of [["priorityOrder", c.priorityOrder], ["severityOrder", c.severityOrder]]) {
+    if (new Set(order).size !== order.length) problems.push(`${name} contains duplicates`);
+  }
+  return problems;
+}
+var EVENT_LOG_MISSING = "the Issues table has no event log \u2014 crew writes its audit trail there (CREW-1574). In the app, open the Issues table's Data & lifecycle tab and turn on Event log, then rerun.";
+
 // src/work-mode.ts
 function projectWorkModes(rows, contract) {
   const out = /* @__PURE__ */ new Map();
@@ -8928,8 +8999,10 @@ async function decideCycle(o) {
     emit.emit(`${what}: no longer missing from the scheduler PATH \u2014 stop cleared`, { step: "select" });
   }
   await checkRepoDisks({ state, emit, route, ship });
+  const floorStop = await checkCrewFloor({ state, emit, route, ship });
+  const itemStop = repoStopFor(openShipAttention(state), route);
   const selectionInput = {
-    repoStop: repoStopFor(openShipAttention(state), route),
+    repoStop: floorStop ? () => floorStop : itemStop,
     workModes,
     tickets,
     comments,
@@ -12162,24 +12235,49 @@ async function discover(o) {
       o,
       `/data-models/${out.shipsModelId}/records?limit=200`
     );
-    const mine = shipRows.filter((r) => (r.name ?? "").trim() === o.ship.name.trim());
     const hostPassengers = o.ship.hostPassengers ?? false;
     const sshPublicKey = o.ship.sshPublicKey;
+    let shipColumns = /* @__PURE__ */ new Set();
+    try {
+      const shipsModel = await get(o, `/data-models/${out.shipsModelId}`);
+      shipColumns = new Set((shipsModel.fields ?? []).map((f) => f.columnName));
+    } catch {
+    }
     let ownerId;
     if (out.meId) {
-      let hasOwnerColumn = false;
-      try {
-        const shipsModel = await get(o, `/data-models/${out.shipsModelId}`);
-        hasOwnerColumn = (shipsModel.fields ?? []).some((f) => f.columnName === "owner_id");
-      } catch {
-      }
-      if (hasOwnerColumn) ownerId = out.meId;
+      if (shipColumns.has("owner_id")) ownerId = out.meId;
       else provisioning.push("could not record the ship owner \u2014 the Ships table has no owner_id column yet (update the Issues template)");
     }
+    const machineId = shipColumns.has("machine_id") ? o.ship.machineId : void 0;
+    let mine;
+    let matchedBy = "name";
+    let writeMachineId = false;
+    const byName = shipRows.filter((r) => (r.name ?? "").trim() === o.ship.name.trim());
+    if (machineId) {
+      const byId = shipRows.filter((r) => (r.machine_id ?? "") === machineId);
+      if (byId.length > 0) {
+        mine = byId;
+        matchedBy = "machine_id";
+      } else {
+        mine = byName.filter((r) => !r.machine_id);
+        writeMachineId = true;
+      }
+    } else {
+      mine = byName;
+    }
     if (mine.length === 1) {
       shipRowId = mine[0].id;
-      out.shipRow = { id: shipRowId, name: o.ship.name, action: "matched" };
+      out.shipRow = { id: shipRowId, name: o.ship.name, action: "matched", matchedBy };
       const patchBody = {};
+      if (matchedBy === "machine_id") {
+        const keptName = (mine[0].name ?? "").trim();
+        if (keptName !== o.ship.name.trim()) {
+          out.shipRow.name = keptName;
+          provisioning.push(`matched Ships row "${keptName}" by machine id \u2014 this host is now called "${o.ship.name}"; the row's name is kept`);
+        }
+        patchBody.last_seen = (/* @__PURE__ */ new Date()).toISOString();
+      }
+      if (writeMachineId) patchBody.machine_id = machineId;
       if ((mine[0].host_passengers ?? false) !== hostPassengers) patchBody.host_passengers = hostPassengers;
       if (sshPublicKey !== void 0 && (mine[0].ssh_public_key ?? "") !== sshPublicKey) {
         patchBody.ssh_public_key = sshPublicKey;
@@ -12197,13 +12295,16 @@ async function discover(o) {
         ...o.ship.platform ? { platform: o.ship.platform } : {},
         host_passengers: hostPassengers,
         ...sshPublicKey !== void 0 ? { ssh_public_key: sshPublicKey } : {},
-        ...ownerId !== void 0 ? { owner_id: ownerId } : {}
+        ...ownerId !== void 0 ? { owner_id: ownerId } : {},
+        ...writeMachineId ? { machine_id: machineId } : {}
       });
       shipRowId = created.id;
-      out.shipRow = { id: shipRowId, name: o.ship.name, action: "created" };
+      out.shipRow = { id: shipRowId, name: o.ship.name, action: "created", matchedBy };
       provisioning.push(`created Ships row "${o.ship.name}"`);
     } else {
-      problems.push(`${mine.length} Ships rows named "${o.ship.name}" \u2014 which one is this machine?`);
+      problems.push(
+        matchedBy === "machine_id" ? `${mine.length} Ships rows carry this machine's id \u2014 which one is this machine?` : `${mine.length} Ships rows named "${o.ship.name}" \u2014 which one is this machine?`
+      );
     }
   }
   let agentIdFor = () => void 0;
@@ -13581,7 +13682,7 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync2, readFileSync as readFileSync23, existsSync as existsSync30, mkdirSync as mkdirSync16, writeFileSync as writeFileSync17, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
+import { realpathSync as realpathSync2, readFileSync as readFileSync24, existsSync as existsSync31, mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
@@ -13633,12 +13734,62 @@ function sshKeygenAvailable() {
   }
 }
 
-// src/passenger-containers.ts
+// src/machine-id.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname17, join as join26 } from "path";
+function machineIdPathFor(stateDir) {
+  return join26(stateDir, "machine-id");
+}
+var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
+function readRawMachineId(platform2 = process.platform) {
+  try {
+    if (platform2 === "darwin") {
+      const out = execFileSync5("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
+    }
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      if (existsSync26(p)) {
+        const id = readFileSync19(p, "utf8").trim();
+        if (id) return id;
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+function ensureMachineId(stateDir, opts = {}) {
+  if (opts.override?.trim()) return sha256(opts.override.trim());
+  const path = machineIdPathFor(stateDir);
+  if (existsSync26(path)) {
+    const cached = readFileSync19(path, "utf8").trim();
+    if (/^[0-9a-f]{64}$/.test(cached)) return cached;
+  }
+  const raw = (opts.read ?? readRawMachineId)();
+  if (!raw) return void 0;
+  const hashed = sha256(raw);
+  mkdirSync13(dirname17(path), { recursive: true });
+  writeFileSync14(path, `${hashed}
+`, { mode: 384 });
+  return hashed;
+}
+function matchShipRows(ships, shipName2, machineId) {
+  const hasColumn = ships.some((r) => "machine_id" in r);
+  const byId = hasColumn && machineId ? ships.filter((r) => r.machine_id === machineId) : [];
+  if (byId.length > 0) return { rows: byId, by: "machine_id", hasColumn };
+  return { rows: ships.filter((r) => (r.name ?? "").trim() === shipName2.trim()), by: "name", hasColumn };
+}
+
+// src/passenger-containers.ts
+import { execFileSync as execFileSync6 } from "child_process";
+import { createHash as createHash5 } from "crypto";
 var realExec = (cmd, args) => {
   try {
-    return execFileSync5(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync6(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -13672,12 +13823,12 @@ function containerNameFor(workspaceId) {
   return `crew-passenger-${workspaceId}`;
 }
 function portFor(workspaceId, base = 28765, span = 1e3) {
-  const digest = createHash4("sha256").update(workspaceId).digest();
+  const digest = createHash5("sha256").update(workspaceId).digest();
   return base + digest.readUInt32BE(0) % span;
 }
 function mountsDigest(mounts, image) {
   const sorted2 = [...mounts].sort((a, b) => a.containerPath.localeCompare(b.containerPath));
-  return createHash4("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
 }
 function planContainers(cfg) {
   const byWorkspace = /* @__PURE__ */ new Map();
@@ -13837,9 +13988,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
 import { randomInt } from "crypto";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn4(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -13906,21 +14057,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join26(stateDir, "passengers", `${workspaceId}.json`);
+  return join27(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync26(path)) return void 0;
+  if (!existsSync27(path)) return void 0;
   try {
-    return JSON.parse(readFileSync19(path, "utf8"));
+    return JSON.parse(readFileSync20(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync13(join26(stateDir, "passengers"), { recursive: true });
-  writeFileSync14(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync14(join27(stateDir, "passengers"), { recursive: true });
+  writeFileSync15(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -14017,13 +14168,13 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join26(stateDir, "passengers");
-  if (!existsSync26(dir)) return [];
+  const dir = join27(stateDir, "passengers");
+  if (!existsSync27(dir)) return [];
   return readdirSync8(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
 // src/mcp-endpoint-registry.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function endpointsUrl(api, workspaceId, id) {
   const base = `${api.baseUrl.replace(/\/+$/, "")}/api/workspaces/${workspaceId}/mcp-endpoints`;
   return id ? `${base}/${id}` : base;
@@ -14091,7 +14242,7 @@ async function probeEndpointAccess(api, workspaceId) {
 }
 var REGISTER_MCP_ENDPOINTS_HINT = "give this key's role the REGISTER_MCP_ENDPOINTS capability, e.g. via the group that holds the Crew project role";
 function registrationKey(url, mcpSecret) {
-  return createHash5("sha256").update(`${url}
+  return createHash6("sha256").update(`${url}
 ${mcpSecret ?? ""}`).digest("hex").slice(0, 16);
 }
 async function reconcileEndpoint(workspaceId, d) {
@@ -14139,8 +14290,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn5 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync16, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
+import { join as join28 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -14229,21 +14380,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join27(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join28(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync27(path)) return void 0;
+  if (!existsSync28(path)) return void 0;
   try {
-    return JSON.parse(readFileSync20(path, "utf8"));
+    return JSON.parse(readFileSync21(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync14(join27(stateDir, "passengers"), { recursive: true });
-  writeFileSync15(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync15(join28(stateDir, "passengers"), { recursive: true });
+  writeFileSync16(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -14263,8 +14414,8 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join27(stateDir, "passengers");
-  if (!existsSync27(dir)) return [];
+  const dir = join28(stateDir, "passengers");
+  if (!existsSync28(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync9(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -14321,12 +14472,12 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync15, readFileSync as readFileSync22, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync16 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync16, readFileSync as readFileSync23, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync17 } from "fs";
+import { join as join30 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync28, readdirSync as readdirSync10, readFileSync as readFileSync21 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "fs";
+import { join as join29 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14345,21 +14496,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync28(path)) return false;
+  if (!existsSync29(path)) return false;
   try {
-    return JSON.parse(readFileSync21(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync22(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join28(o.stateDir, "streams");
-  if (!existsSync28(dir)) return [];
+  const dir = join29(o.stateDir, "streams");
+  if (!existsSync29(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join28(dir, name);
+    const streamPath = join29(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14459,7 +14610,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync11(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join29(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join30(path, entry.name)));
   }
   return latest;
 }
@@ -14468,23 +14619,23 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync29(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync30(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join29(stateDir, "reload-requested");
+  return join30(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join29(stateDir, "daemon.started");
+  return join30(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync15(stateDir, { recursive: true });
+  mkdirSync16(stateDir, { recursive: true });
   rmSync11(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync16(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync17(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync22(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync23(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -14530,6 +14681,16 @@ var SpawnBreaker = class {
   }
 };
 async function runOnePass(o) {
+  try {
+    return await runOnePassUnguarded(o);
+  } catch (e) {
+    if (!isUpgradeRequired(e)) throw e;
+    const emit = o.newEmitter();
+    await raiseFromUpgradeRequired({ state: o.state, emit, route: o.route, ship: o.ship }, e);
+    return { pending: [], started: [], skipped: [] };
+  }
+}
+async function runOnePassUnguarded(o) {
   if (o.state.isPaused()) return { pending: [], started: [], skipped: [] };
   await hydrateApiKeys([o.route], o.getSessionStore);
   const emit = o.newEmitter();
@@ -14840,7 +15001,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname17(process.execPath) : resolve5(dirname17(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname18(process.execPath) : resolve5(dirname18(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -15002,7 +15163,7 @@ function usage() {
   crew install                  write and load this platform's scheduler unit
   crew uninstall                unload and remove it
      --workspace-id ID --key K [--project NAME] [--area NAME] [--dir PATH] [--name N]
-     --json  --ship-name N --agent-bin PATH --extra-path DIRS --host-passengers --no-wizard --choose KEY=VALUE   (non-interactive: docs/commands.md)
+     --json  --machine-id ID  --ship-name N --agent-bin PATH --extra-path DIRS --host-passengers --no-wizard --choose KEY=VALUE   (non-interactive: docs/commands.md)
 
 Options:
   --dry-run      decide everything, perform nothing
@@ -15109,13 +15270,19 @@ if (command === "passenger-sync-daemon") {
     if (!why) return false;
     emit.emit(`${why} \u2014 release skipped`, { step: "release" });
     return true;
+  }, doctorMachineId = function(stateDir) {
+    try {
+      return ensureMachineId(stateDir, { override: value("machine-id") });
+    } catch {
+      return void 0;
+    }
   }, baseHealth = function(r) {
     const { remote, base } = r.config.branch;
     const out = refreshBaseBranch(r.dir, remote, base, true);
     const unsafe = baseBranchUnsafe(out);
     return { action: out.action, unsafe, detail: unsafe ? describeUnsafeBase(out, remote, base) : out.detail };
   };
-  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, baseHealth2 = baseHealth;
+  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, doctorMachineId2 = doctorMachineId, baseHealth2 = baseHealth;
   let cfg;
   let firstRun;
   let firstRunFromFlags = false;
@@ -15401,8 +15568,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join30(homedir8(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync30(staleTimer)) {
+      const staleTimer = join31(homedir8(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync31(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -15428,14 +15595,14 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync30(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync31(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
     try {
       const ships = await tracker.shipRows();
       if (ships.length > 0) {
-        const mine = ships.filter((s2) => (s2.name ?? "").trim() === cfg.ship.name.trim());
+        const mine = matchShipRows(ships, cfg.ship.name, doctorMachineId(cfg.ship.stateDir)).rows;
         if (mine.length !== 1) problems.push(`ship record: ${mine.length} rows named "${cfg.ship.name}"`);
         else if (mine[0].platform && mine[0].platform !== host) problems.push(`ship record: declares ${mine[0].platform}, this host is ${host}`);
       }
@@ -15446,7 +15613,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync30(p);
+    const unitExists = (p) => existsSync31(p);
     const crontab = o.host === "linux" ? spawnSync6("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -15463,7 +15630,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync17(cfg.configFile, planEnable(readFileSync23(cfg.configFile, "utf8"), a.route));
+          writeFileSync18(cfg.configFile, planEnable(readFileSync24(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -16462,7 +16629,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join30(CREW_HOME, "src"), join30(CREW_HOME, "dist"), join30(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join31(CREW_HOME, "src"), join31(CREW_HOME, "dist"), join31(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -16663,10 +16830,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync30(resolvedPath) ? JSON.parse(readFileSync23(resolvedPath, "utf8")) : {};
+        const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync24(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync16(dirOf(resolvedPath), { recursive: true });
-        writeFileSync17(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync17(dirOf(resolvedPath), { recursive: true });
+        writeFileSync18(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16679,15 +16846,15 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks") usage2();
-      const configText = readFileSync23(cfg.configFile, "utf8");
+      const configText = readFileSync24(cfg.configFile, "utf8");
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname17(cfg.configFile), a.route, a.name);
-          if (!existsSync30(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync30(resolvePath(dir, r)), read: (r) => {
+          const dir = repoDirOf(configText, dirname18(cfg.configFile), a.route, a.name);
+          if (!existsSync31(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync31(resolvePath(dir, r)), read: (r) => {
             try {
-              return readFileSync23(resolvePath(dir, r), "utf8");
+              return readFileSync24(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -16699,13 +16866,13 @@ ${changed2.map((c) => `  - ${c}
           if (write && suggestion.source === null) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, suggestion.hooks);
-            writeFileSync17(cfg.configFile, plan.text);
+            writeFileSync18(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync17(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
+            writeFileSync18(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(suggestion.hooks), kept: [] };
           }
           if (flag("json")) {
@@ -16742,7 +16909,7 @@ ${changed2.map((c) => `  - ${c}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync30(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync31(resolvePath(p.replace(/^~(?=\/|$)/, homedir8()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -16771,15 +16938,15 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync30(resolvedFile)) {
+      if (existsSync31(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync23(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync24(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname17(cfg.configFile);
+      const base = dirname18(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16788,7 +16955,7 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync30(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync31(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -16800,9 +16967,9 @@ ${changed2.map((c) => `  - ${c}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir") });
-          if (existsSync30(plan2.target) && (existsSync30(`${plan2.target}/.git`) || readdirSync12(plan2.target).length > 0)) {
+          if (existsSync31(plan2.target) && (existsSync31(`${plan2.target}/.git`) || readdirSync12(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync30(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync31(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -16820,12 +16987,12 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync17(cfg.configFile, plan2.text);
+          writeFileSync18(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir8()));
-        const top = existsSync30(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync31(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -16874,15 +17041,15 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync30(resolvedFile)) {
-            const raw = JSON.parse(readFileSync23(resolvedFile, "utf8"));
+          if (existsSync31(resolvedFile)) {
+            const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync17(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync17(cfg.configFile, plan.text);
+        writeFileSync18(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -17103,9 +17270,17 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
         }
       }
+      let machineId;
+      try {
+        machineId = ensureMachineId(cfg.ship.stateDir, { override: value("machine-id") });
+      } catch (e) {
+        process.stderr.write(`(no machine id \u2014 ${e.message})
+`);
+      }
       const ship = {
         name: cfg.ship.name,
         platform: cfg.ship.platform,
+        machineId,
         hostPassengers: firstRun?.answers.hostPassengers ?? existingRoute?.hostPassengers === true,
         sshPublicKey
       };
@@ -17202,10 +17377,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync30(resolvedPath);
+        const hadPreviousFile = existsSync31(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync23(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync24(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -17314,10 +17489,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync16(dirname17(resolvedPath), { recursive: true });
+          mkdirSync17(dirname18(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync17(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync18(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -17352,8 +17527,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync16(dirname17(apiKeyFile), { recursive: true });
-            writeFileSync17(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync17(dirname18(apiKeyFile), { recursive: true });
+            writeFileSync18(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -17362,7 +17537,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const keyPersisted = keychainBacked || apiKeyFile !== void 0;
         const wizard = firstRun;
         const writeFirstRun = wizard !== void 0 && !dryRun && keyPersisted;
-        const routeDir = value("dir") ?? (writeFirstRun ? join30(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
+        const routeDir = value("dir") ?? (writeFirstRun ? join31(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
         const routeBlock = renderConnection(
           found,
           route2,
@@ -18006,7 +18181,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync23(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync24(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -18048,8 +18223,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync16(cfg.ship.stateDir, { recursive: true });
-      writeFileSync17(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync17(cfg.ship.stateDir, { recursive: true });
+      writeFileSync18(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -18100,7 +18275,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync23(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync24(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -18123,8 +18298,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync23(cfg.configFile, "utf8");
-      const cfgBase = dirname17(cfg.configFile);
+      const configText = readFileSync24(cfg.configFile, "utf8");
+      const cfgBase = dirname18(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -18152,7 +18327,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync17(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync18(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -18160,29 +18335,29 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync30(resolvedFile)) {
-            const raw = JSON.parse(readFileSync23(resolvedFile, "utf8"));
+          if (existsSync31(resolvedFile)) {
+            const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync17(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync30(join30(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
+        if (existsSync31(join31(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync30(join30(dir, ".git"));
-      if (existsSync30(dir) && fresh && readdirSync12(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync31(join31(dir, ".git"));
+      if (existsSync31(dir) && fresh && readdirSync12(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync16(dir, { recursive: true });
-        writeFileSync17(join30(dir, "README.md"), SAMPLE_README);
-        writeFileSync17(join30(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync17(dir, { recursive: true });
+        writeFileSync18(join31(dir, "README.md"), SAMPLE_README);
+        writeFileSync18(join31(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -18200,17 +18375,17 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync30(resolvedFile)) {
-          const raw = JSON.parse(readFileSync23(resolvedFile, "utf8"));
+        if (existsSync31(resolvedFile)) {
+          const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync17(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync17(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync18(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -18312,6 +18487,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       const issueLabelById = new Map(engagedTickets.map((t) => [t.id, t.issue_id]));
       const todo = await statusTracker.openTickets().then((open) => operatorTodo(open, statusTracker.contract, route.resolved?.operator ?? "")).catch(() => []);
       const projects = projectModeLabels(await statusTracker.projectRowsWithModes().catch(() => []));
+      const crewMinVersion = await readCrewFloor(route, cfg.ship) ?? null;
       if (flag("json")) {
         const repos = await resolvedRepos(route);
         const seatIds = route.resolved?.seats ?? {};
@@ -18371,6 +18547,9 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           watermark: state.watermark(),
           route: {
             name: route.route,
+            // Additive (CREW-2248): the running version and the workspace's floor. `version` stays 1.
+            crewVersion: sentVersion(cfg.ship),
+            crewMinVersion,
             // Additive (CREW-1496): each project and its work mode. `version` stays 1.
             projects: projects.map((p) => ({ id: p.id, name: p.name, workMode: p.mode })),
             dir: route.dir,
@@ -18500,7 +18679,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync30(r.dir)) {
+            if (existsSync31(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -18528,7 +18707,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync30(evFile) ? statSync10(evFile).size : 0;
+        const evSize = existsSync31(evFile) ? statSync10(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -18539,7 +18718,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync23(p, "utf8");
+            return readFileSync24(p, "utf8");
           } catch {
             return null;
           }
@@ -18561,6 +18740,19 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         }
       }
       const tracker = new Tracker(route, cfg.ship);
+      {
+        const have = sentVersion(cfg.ship);
+        const floor = await readCrewFloor(route, cfg.ship);
+        if (have && floor) {
+          process.stdout.write(
+            `crew version:      ${belowFloor(have, floor) ? "WARN " : ""}${have} (workspace requires ${floor})${belowFloor(have, floor) ? " \u2014 update crew (the Crew app, or `npm install -g @tablation/crew`)" : ""}
+`
+          );
+        } else if (have) {
+          process.stdout.write(`crew version:      ${have}${floor === null ? " (workspace sets no minimum)" : ""}
+`);
+        }
+      }
       const contractProblems = validateContract(tracker.contract);
       process.stdout.write(
         contractProblems.length ? `contract:          ${contractProblems.length} problem(s)
@@ -18640,7 +18832,12 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       if (ships.length === 0) {
         process.stdout.write("ship record:       this workspace has no Ships table (fine)\n");
       } else {
-        const mine = ships.filter((s2) => (s2.name ?? "").trim() === cfg.ship.name.trim());
+        const matched = matchShipRows(ships, cfg.ship.name, doctorMachineId(cfg.ship.stateDir));
+        const mine = matched.rows;
+        process.stdout.write(
+          matched.hasColumn ? `ship row:          ${mine.length === 1 ? `matched by ${matched.by === "machine_id" ? "machine id" : "name"}` : "not matched"}
+` : "ship row:          matched by name only \u2014 the Ships table has no machine_id column (update the Issues template)\n"
+        );
         if (mine.length === 0) {
           process.stdout.write(
             `ship record:       NO row named "${cfg.ship.name}" \u2014 have: ${ships.map((s2) => s2.name).join(", ")}
@@ -18923,4 +19120,5 @@ var passengerApiKeys2;
 var endpointApiFor2;
 var endpointReconcileDeps2;
 var releaseRefused2;
+var doctorMachineId2;
 var baseHealth2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",