@tablation/crew 0.63.0 → 0.63.2

package/dist/cli.js

@@ -5183,7 +5183,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname18, join as join31, basename as basename10 } from "path";
+import { resolve as resolve5, dirname as dirname19, join as join32, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
@@ -5762,15 +5762,52 @@ var State = class _State {
   }
 };
 
-// src/reset.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync8 } from "fs";
+// src/connect-resume.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname6, join as join14 } from "path";
+function lastSessionFile(stateDir) {
+  return join14(stateDir, "connect-session.json");
+}
+function readPointers(stateDir) {
+  try {
+    const parsed = JSON.parse(readFileSync13(lastSessionFile(stateDir), "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    return Object.fromEntries(Object.entries(parsed).filter((e) => typeof e[1] === "string"));
+  } catch {
+    return {};
+  }
+}
+function rememberSession(stateDir, host, workspaceSlug) {
+  try {
+    const file = lastSessionFile(stateDir);
+    mkdirSync7(dirname6(file), { recursive: true });
+    writeFileSync8(file, `${JSON.stringify({ ...readPointers(stateDir), [host]: workspaceSlug }, null, 2)}
+`, { mode: 384 });
+  } catch {
+  }
+}
+async function resumeKeychainSession(o) {
+  const workspace = readPointers(o.stateDir)[o.host];
+  if (!workspace) return void 0;
+  try {
+    const stored = await o.store.get(o.host, workspace);
+    if (!stored?.apiKey) return void 0;
+    if (!await o.verify(stored.apiKey)) return void 0;
+    return { workspace, apiKey: stored.apiKey };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/reset.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync14, readdirSync as readdirSync4, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, join as join15 } from "path";
 function clonedCheckoutsFile(stateDir) {
-  return join14(stateDir, "cloned-checkouts.json");
+  return join15(stateDir, "cloned-checkouts.json");
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync13(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync14(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -5780,8 +5817,8 @@ function recordClonedCheckout(stateDir, dir) {
   const known = readClonedCheckouts(stateDir);
   if (known.includes(dir)) return;
   const file = clonedCheckoutsFile(stateDir);
-  mkdirSync7(dirname6(file), { recursive: true });
-  writeFileSync8(file, `${JSON.stringify([...known, dir], null, 2)}
+  mkdirSync8(dirname7(file), { recursive: true });
+  writeFileSync9(file, `${JSON.stringify([...known, dir], null, 2)}
 `);
 }
 var mark = (dryRun) => dryRun ? "would-remove" : "removed";
@@ -5836,10 +5873,10 @@ function removeCheckout(dir, dryRun, fx) {
 }
 function removeState(stateDir, dryRun) {
   const out = [];
-  const targets = [join14(stateDir, "resolved"), join14(stateDir, "keys"), clonedCheckoutsFile(stateDir), join14(stateDir, "reload-requested"), join14(stateDir, "daemon.started")];
+  const targets = [join15(stateDir, "resolved"), join15(stateDir, "keys"), clonedCheckoutsFile(stateDir), join15(stateDir, "connect-session.json"), join15(stateDir, "reload-requested"), join15(stateDir, "daemon.started")];
   try {
     for (const name of readdirSync4(stateDir)) {
-      if (name.startsWith(".") && statSync5(join14(stateDir, name)).isFile()) targets.push(join14(stateDir, name));
+      if (name.startsWith(".") && statSync5(join15(stateDir, name)).isFile()) targets.push(join15(stateDir, name));
     }
   } catch {
   }
@@ -6113,18 +6150,18 @@ import { existsSync as existsSync16, statfsSync } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
 import {
   existsSync as existsSync15,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync3,
   closeSync as closeSync3,
   writeSync,
   statSync as statSync6,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync14,
-  writeFileSync as writeFileSync9,
+  readFileSync as readFileSync15,
+  writeFileSync as writeFileSync10,
   readdirSync as readdirSync5,
   rmSync as rmSync8
 } from "fs";
-import { dirname as dirname7, basename as basename5, join as join15 } from "path";
+import { dirname as dirname8, basename as basename5, join as join16 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -6490,7 +6527,7 @@ function recoverStrandedReleaseCheckouts(cwd) {
     if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
-      const root = dirname7(path);
+      const root = dirname8(path);
       if (basename5(root).startsWith("crew-release-")) rmSync8(root, { recursive: true, force: true });
     }
   }
@@ -6508,11 +6545,11 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
   }
   for (const name of names) {
     if (!name.startsWith("crew-release-")) continue;
-    const root = join15(tmp, name);
+    const root = join16(tmp, name);
     try {
       const st = statSync6(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync15(join15(root, "checkout"))) continue;
+      if (existsSync15(join16(root, "checkout"))) continue;
       rmSync8(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
@@ -6561,7 +6598,7 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
     );
   }
-  mkdirSync8(dirname7(dir), { recursive: true });
+  mkdirSync9(dirname8(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
     execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
@@ -6586,7 +6623,7 @@ function sleepSync(ms2) {
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
-  mkdirSync8(dirname7(lockPath), { recursive: true });
+  mkdirSync9(dirname8(lockPath), { recursive: true });
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -6626,14 +6663,14 @@ function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {
     if (!existsSync15(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync15(marker) && readFileSync14(marker, "utf8").split("\n")[0] === url) {
-        return { action: "clone-failed", detail: readFileSync14(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      if (existsSync15(marker) && readFileSync15(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync15(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
         ensureRepoCheckout(dir, githubRemote, clone);
       } catch (e) {
         if (!(e instanceof GitError)) throw e;
-        writeFileSync9(marker, `${url}
+        writeFileSync10(marker, `${url}
 ${e.message}`);
         return { action: "clone-failed", detail: e.message, repeat: false };
       }
@@ -8762,8 +8799,8 @@ function materializeBranchForTicket(dir, cfg, t, role, onProblem) {
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync10 } from "fs";
-import { join as join16 } from "path";
+import { writeFileSync as writeFileSync11 } from "fs";
+import { join as join17 } from "path";
 
 // src/stalled.ts
 var STALLED_AFTER_CYCLES = 30;
@@ -9054,7 +9091,7 @@ async function decideCycle(o) {
   }
   return decision;
 }
-var digestPath = (stateDir, route, role) => join16(stateDir, `digest-${route}-${role}.md`);
+var digestPath = (stateDir, route, role) => join17(stateDir, `digest-${route}-${role}.md`);
 function writeDigest(o, d, role, stateDir) {
   const me = o.route.resolved?.seats[role];
   if (!me) return false;
@@ -9118,7 +9155,7 @@ function writeDigest(o, d, role, stateDir) {
     };
     const text = role === "qa" ? qaDigest(input) : buildingDigest(input);
     const path = digestPath(stateDir, routeSlug(o.route.route), role);
-    writeFileSync10(path, text);
+    writeFileSync11(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -9496,12 +9533,12 @@ async function applyStrandedVerified(writer, s, contract, operatorId, memberId,
 
 // src/run-worktree.ts
 import { existsSync as existsSync18 } from "fs";
-import { dirname as dirname8, join as join18 } from "path";
+import { dirname as dirname9, join as join19 } from "path";
 
 // src/ports.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync17 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var run = (cmd, args) => {
   try {
     return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -9546,7 +9583,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync17(join17(parent, name, ".git"))) return true;
+    if (existsSync17(join18(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -9638,7 +9675,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
     if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
     return { action: "recut", path: existing.path, branch, base: baseRef };
   }
-  const path = join18(dirname8(dir), worktreeForTicket(dir, cfg, t, role));
+  const path = join19(dirname9(dir), worktreeForTicket(dir, cfg, t, role));
   if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
     return { action: "cut-remote", path, branch: located.branch };
   }
@@ -9960,8 +9997,8 @@ async function guardRunStrays(route, ship, tracker, role, workingId, since2, log
 }
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname9, join as join19 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync19, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
+import { delimiter, dirname as dirname10, join as join20 } from "path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync12 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
@@ -9983,7 +10020,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join19(dir, name);
+    const candidate = join20(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -10009,9 +10046,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname9(env.nodePath);
+  const nodeDir = dirname10(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname9(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname10(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -10022,7 +10059,7 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname9(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname10(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
@@ -10044,9 +10081,9 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text) {
-  mkdirSync9(dirname9(path), { recursive: true });
+  mkdirSync10(dirname10(path), { recursive: true });
   try {
-    writeFileSync11(path, text, { mode: 384, flag: "wx" });
+    writeFileSync12(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -10079,7 +10116,7 @@ Wrote ${o.configPath}.
 
 // src/connect-json.ts
 import { accessSync as accessSync3, constants as constants3 } from "fs";
-import { dirname as dirname10 } from "path";
+import { dirname as dirname11 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json, write) {
   return {
@@ -10127,7 +10164,7 @@ function flagWizardAnswers(f, env) {
   if (f.agentBin && !isExec(f.agentBin)) return { error: `--agent-bin ${f.agentBin} is not an executable file` };
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
   const dockerPath = f.hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = f.extraPath ?? deriveExtraPath([dirname10(env.nodePath), pnpmPath ? dirname10(pnpmPath) : void 0, dockerPath ? dirname10(dockerPath) : void 0]);
+  const extraPath = f.extraPath ?? deriveExtraPath([dirname11(env.nodePath), pnpmPath ? dirname11(pnpmPath) : void 0, dockerPath ? dirname11(dockerPath) : void 0]);
   return {
     answers: {
       name: f.shipName?.trim() || env.hostname,
@@ -10140,8 +10177,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync12, existsSync as existsSync20, copyFileSync, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, rmSync as rmSync9 } from "fs";
-import { dirname as dirname11, join as join20 } from "path";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync13, existsSync as existsSync20, copyFileSync, mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync2, rmSync as rmSync9 } from "fs";
+import { dirname as dirname12, join as join21 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/release.ts
@@ -10829,13 +10866,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join20(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join21(o.cwd, f));
   const first = files[0];
   if (!existsSync20(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync15(first, "utf8")).version;
+  const current = JSON.parse(readFileSync16(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -10848,27 +10885,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync15(f, "utf8");
+    const src = readFileSync16(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync12(f, out);
+    writeFileSync13(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join20(o.cwd, file);
+  const path = join21(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync20(path) ? readFileSync15(path, "utf8") : "# Changelog\n";
-  writeFileSync12(path, insertChangelogSection(existing, section));
+  const existing = existsSync20(path) ? readFileSync16(path, "utf8") : "# Changelog\n";
+  writeFileSync13(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -10961,8 +10998,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join20(tmpdir3(), "crew-release-"));
-  const dir = join20(root, "checkout");
+  const root = mkdtempSync2(join21(tmpdir3(), "crew-release-"));
+  const dir = join21(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -10972,10 +11009,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join20(o.cwd, f);
+    const src = join21(o.cwd, f);
     if (!existsSync20(src)) continue;
-    mkdirSync10(dirname11(join20(dir, f)), { recursive: true });
-    copyFileSync(src, join20(dir, f));
+    mkdirSync11(dirname12(join21(dir, f)), { recursive: true });
+    copyFileSync(src, join21(dir, f));
   }
   return { dir, branch, close };
 }
@@ -12769,8 +12806,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname12 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname13 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -12803,12 +12840,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync22(resolvedPath) ? JSON.parse(readFileSync16(resolvedPath, "utf8")) : {};
+    const raw = existsSync22(resolvedPath) ? JSON.parse(readFileSync17(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync11(dirname12(resolvedPath), { recursive: true });
-    writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync12(dirname13(resolvedPath), { recursive: true });
+    writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -12915,7 +12952,7 @@ import { isMap as isMap2, parseDocument as parseDocument2, YAMLMap } from "yaml"
 
 // src/repos-cmd.ts
 import { homedir as homedir7 } from "os";
-import { basename as basename7, join as join21, resolve as resolve3 } from "path";
+import { basename as basename7, join as join22, resolve as resolve3 } from "path";
 import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -13113,7 +13150,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join21(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join22(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name });
   return { ...add, remote, target };
 }
@@ -13256,7 +13293,7 @@ function existingRepoConfig(f) {
 }
 
 // src/sample-ticket.ts
-import { basename as basename8, dirname as dirname14, join as join22 } from "path";
+import { basename as basename8, dirname as dirname15, join as join23 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -13279,8 +13316,8 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join22(dirname14(existing[0]), SAMPLE_REPO);
-  return join22(reposBase, workspace, SAMPLE_REPO);
+  if (existing.length > 0) return join23(dirname15(existing[0]), SAMPLE_REPO);
+  return join23(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
 function sampleDescription() {
@@ -13361,8 +13398,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync23, readFileSync as readFileSync17, readdirSync as readdirSync6 } from "fs";
-import { basename as basename9, dirname as dirname15, join as join23, resolve as resolve4 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync18, readdirSync as readdirSync6 } from "fs";
+import { basename as basename9, dirname as dirname16, join as join24, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -13416,7 +13453,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname15(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname16(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename9(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
@@ -13429,7 +13466,7 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join23(parent, name);
+    const path = join24(parent, name);
     if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
   }
   return out;
@@ -13532,7 +13569,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync17(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync18(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -13638,13 +13675,13 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 
 // src/stream-sweep.ts
 import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync10, statSync as statSync8 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join24(stateDir, "streams");
+  const dir = join25(stateDir, "streams");
   if (!existsSync24(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync7(dir).map((name) => join24(dir, name)).filter((path) => {
+  return readdirSync7(dir).map((name) => join25(dir, name)).filter((path) => {
     try {
       return statSync8(path).mtimeMs < cutoff;
     } catch {
@@ -13672,7 +13709,7 @@ function applyStreamSweep(paths, dryRun, log) {
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
   if (!existsSync24(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync7(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join24(stateDir, name)).filter((path) => {
+  return readdirSync7(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join25(stateDir, name)).filter((path) => {
     try {
       return statSync8(path).mtimeMs < cutoff;
     } catch {
@@ -13682,24 +13719,24 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync2, readFileSync as readFileSync24, existsSync as existsSync31, mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
+import { realpathSync as realpathSync2, readFileSync as readFileSync25, existsSync as existsSync31, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, chmodSync } from "fs";
-import { dirname as dirname16, join as join25 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, readFileSync as readFileSync19, chmodSync } from "fs";
+import { dirname as dirname17, join as join26 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join25(stateDir, "ssh", "id_ed25519");
+  return join26(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
   if (!existsSync25(privateKeyPath)) {
-    mkdirSync12(dirname16(privateKeyPath), { recursive: true });
+    mkdirSync13(dirname17(privateKeyPath), { recursive: true });
     try {
       execFileSync4("ssh-keygen", [
         "-t",
@@ -13722,7 +13759,7 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync25(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync18(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync19(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -13737,10 +13774,10 @@ function sshKeygenAvailable() {
 // src/machine-id.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname17, join as join26 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname18, join as join27 } from "path";
 function machineIdPathFor(stateDir) {
-  return join26(stateDir, "machine-id");
+  return join27(stateDir, "machine-id");
 }
 var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
@@ -13754,7 +13791,7 @@ function readRawMachineId(platform2 = process.platform) {
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       if (existsSync26(p)) {
-        const id = readFileSync19(p, "utf8").trim();
+        const id = readFileSync20(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -13766,14 +13803,14 @@ function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
   if (existsSync26(path)) {
-    const cached = readFileSync19(path, "utf8").trim();
+    const cached = readFileSync20(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync13(dirname17(path), { recursive: true });
-  writeFileSync14(path, `${hashed}
+  mkdirSync14(dirname18(path), { recursive: true });
+  writeFileSync15(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -13988,9 +14025,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync16, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
 import { randomInt } from "crypto";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn4(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -14057,21 +14094,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join27(stateDir, "passengers", `${workspaceId}.json`);
+  return join28(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync27(path)) return void 0;
   try {
-    return JSON.parse(readFileSync20(path, "utf8"));
+    return JSON.parse(readFileSync21(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync14(join27(stateDir, "passengers"), { recursive: true });
-  writeFileSync15(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync15(join28(stateDir, "passengers"), { recursive: true });
+  writeFileSync16(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -14168,7 +14205,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join27(stateDir, "passengers");
+  const dir = join28(stateDir, "passengers");
   if (!existsSync27(dir)) return [];
   return readdirSync8(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
@@ -14290,8 +14327,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn5 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync16, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync16, readFileSync as readFileSync22, writeFileSync as writeFileSync17, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
+import { join as join29 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -14380,21 +14417,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join28(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join29(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync28(path)) return void 0;
   try {
-    return JSON.parse(readFileSync21(path, "utf8"));
+    return JSON.parse(readFileSync22(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync15(join28(stateDir, "passengers"), { recursive: true });
-  writeFileSync16(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync16(join29(stateDir, "passengers"), { recursive: true });
+  writeFileSync17(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -14414,7 +14451,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join28(stateDir, "passengers");
+  const dir = join29(stateDir, "passengers");
   if (!existsSync28(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync9(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
@@ -14472,12 +14509,12 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync16, readFileSync as readFileSync23, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync17 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync17, readFileSync as readFileSync24, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync18 } from "fs";
+import { join as join31 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync29, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync10, readFileSync as readFileSync23 } from "fs";
+import { join as join30 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14498,19 +14535,19 @@ function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
   if (!existsSync29(path)) return false;
   try {
-    return JSON.parse(readFileSync22(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync23(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join29(o.stateDir, "streams");
+  const dir = join30(o.stateDir, "streams");
   if (!existsSync29(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join29(dir, name);
+    const streamPath = join30(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14610,7 +14647,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync11(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join30(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join31(path, entry.name)));
   }
   return latest;
 }
@@ -14622,20 +14659,20 @@ function makeStaleChecker(paths, opts = {}) {
   return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync30(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join30(stateDir, "reload-requested");
+  return join31(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join30(stateDir, "daemon.started");
+  return join31(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync16(stateDir, { recursive: true });
+  mkdirSync17(stateDir, { recursive: true });
   rmSync11(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync17(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync18(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync23(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync24(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -15001,7 +15038,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname18(process.execPath) : resolve5(dirname18(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname19(process.execPath) : resolve5(dirname19(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -15147,7 +15184,7 @@ function usage() {
                                  resume with no argument clears only the whole-crew pause; a role or release pause needs its own resume
   crew log [route]               tail the log
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
-  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one)
+  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one; --dry-run works with no crew.yaml and writes none: no file, no rows, no seat keys \u2014 the device approval and workspace credential behave as in a real run; with no workspace named it first reuses the keychain session a previous dry-run stored for the host, falling back to device approval when that is missing or rejected, and the signed_in event's session field says which)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
   crew disconnect --reset [--remove-checkouts] [--dry-run] [--json]   remove everything connect and install wrote on this machine: scheduler units, Pair/MCP entries, seat keys, keychain credential, resolved state, then crew.yaml (--remove-checkouts also deletes checkouts crew cloned, never one with local changes)
   crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
@@ -15295,7 +15332,7 @@ if (command === "passenger-sync-daemon") {
       hostPassengers: flag("host-passengers"),
       noWizard: flag("no-wizard")
     };
-    if (command === "connect" && !flag("dry-run") && usesFlagAnswers(wizardFlags, connectIsTTY) && shouldRunWizard({ isTTY: true, crewHome: CREW_HOME })) {
+    if (command === "connect" && usesFlagAnswers(wizardFlags, connectIsTTY) && shouldRunWizard({ isTTY: true, crewHome: CREW_HOME })) {
       const flagged = flagWizardAnswers(wizardFlags, {
         hostname: hostname2(),
         platform: hostPlatform(),
@@ -15313,7 +15350,7 @@ if (command === "passenger-sync-daemon") {
       firstRun = { answers: flagged.answers, configPath };
       firstRunFromFlags = true;
       cfg = loadConfig(CREW_HOME, configPath, { text: renderShipBlock(flagged.answers), allowNoRoutes: true });
-    } else if (command === "connect" && !flag("dry-run") && shouldRunWizard({
+    } else if (command === "connect" && shouldRunWizard({
       isTTY: connectIsTTY,
       crewHome: CREW_HOME
     })) {
@@ -15568,7 +15605,7 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join31(homedir8(), ".config", "systemd", "user", `${label}.timer`);
+      const staleTimer = join32(homedir8(), ".config", "systemd", "user", `${label}.timer`);
       if (existsSync31(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
@@ -15630,7 +15667,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync18(cfg.configFile, planEnable(readFileSync24(cfg.configFile, "utf8"), a.route));
+          writeFileSync19(cfg.configFile, planEnable(readFileSync25(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -16629,7 +16666,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join31(CREW_HOME, "src"), join31(CREW_HOME, "dist"), join31(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join32(CREW_HOME, "src"), join32(CREW_HOME, "dist"), join32(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -16830,10 +16867,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync24(resolvedPath, "utf8")) : {};
+        const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync25(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync17(dirOf(resolvedPath), { recursive: true });
-        writeFileSync18(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync18(dirOf(resolvedPath), { recursive: true });
+        writeFileSync19(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16846,15 +16883,15 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks") usage2();
-      const configText = readFileSync24(cfg.configFile, "utf8");
+      const configText = readFileSync25(cfg.configFile, "utf8");
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname18(cfg.configFile), a.route, a.name);
+          const dir = repoDirOf(configText, dirname19(cfg.configFile), a.route, a.name);
           if (!existsSync31(dir)) throw new ReposError(`${dir} does not exist on disk`);
           const files = { exists: (r) => existsSync31(resolvePath(dir, r)), read: (r) => {
             try {
-              return readFileSync24(resolvePath(dir, r), "utf8");
+              return readFileSync25(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -16866,13 +16903,13 @@ ${changed2.map((c) => `  - ${c}
           if (write && suggestion.source === null) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, suggestion.hooks);
-            writeFileSync18(cfg.configFile, plan.text);
+            writeFileSync19(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync18(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
+            writeFileSync19(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(suggestion.hooks), kept: [] };
           }
           if (flag("json")) {
@@ -16940,13 +16977,13 @@ ${changed2.map((c) => `  - ${c}
       let resolvedRemotes;
       if (existsSync31(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync25(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname18(cfg.configFile);
+      const base = dirname19(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16987,7 +17024,7 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync18(cfg.configFile, plan2.text);
+          writeFileSync19(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
@@ -17042,14 +17079,14 @@ ${changed2.map((c) => `  - ${c}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync31(resolvedFile)) {
-            const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync19(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync18(cfg.configFile, plan.text);
+        writeFileSync19(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -17179,6 +17216,30 @@ ${reconstruction.prompt}
         } catch {
         }
       }
+      let signInSource = apiKey ? "key" : "device";
+      if (!apiKey && !workspace && dryRun && store) {
+        const resumed = await resumeKeychainSession({
+          store,
+          stateDir: cfg.ship.stateDir,
+          host: hostFromUrl3(baseUrl),
+          verify: async (k) => {
+            try {
+              await get({ baseUrl, apiKey: k, userAgent: cfg.ship.userAgent }, "/auth/me");
+              return true;
+            } catch {
+              return false;
+            }
+          }
+        });
+        if (resumed) {
+          apiKey = resumed.apiKey;
+          workspace = resumed.workspace;
+          keychainBacked = true;
+          signInSource = "keychain";
+          process.stderr.write(`Reusing the existing keychain session for ${hostFromUrl3(baseUrl)}/${workspace}.
+`);
+        }
+      }
       let mintedFromDevice = false;
       let signedInEmitted = false;
       if (!apiKey) {
@@ -17231,7 +17292,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         signedInEmitted = true;
         connectEvents.emit("signed_in", `signed in as ${result.identity.email}`, {
           identity: { id: result.identity.id, email: result.identity.email },
-          workspaces: [{ slug: result.workspace.slug, name: result.workspace.name }]
+          workspaces: [{ slug: result.workspace.slug, name: result.workspace.name }],
+          session: "device"
         });
         const deviceWorkspace = "path" in result.workspace && typeof result.workspace.path === "string" ? result.workspace.path : result.workspace.slug;
         if (!workspace) workspace = deviceWorkspace;
@@ -17245,6 +17307,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
               createdAt: result.apiKey.createdAt
             });
             keychainBacked = true;
+            rememberSession(cfg.ship.stateDir, hostFromUrl3(baseUrl), deviceWorkspace);
             process.stderr.write(
               `API key stored in the OS keychain for ${hostFromUrl3(baseUrl)}/${deviceWorkspace}.
 `
@@ -17290,7 +17353,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           signedInEmitted = true;
           connectEvents.emit("signed_in", `key belongs to ${found.meEmail ?? found.meId}`, {
             identity: { id: found.meId, email: found.meEmail, name: found.meName },
-            workspaces: [{ slug: found.workspaceSlug, name: found.workspaceName, role: found.role }]
+            workspaces: [{ slug: found.workspaceSlug, name: found.workspaceName, role: found.role }],
+            session: signInSource
           });
         }
         connectEvents.emit("workspace_resolved", `workspace ${found.workspaceSlug}`, {
@@ -17380,7 +17444,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync31(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync24(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync25(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -17489,10 +17553,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync17(dirname18(resolvedPath), { recursive: true });
+          mkdirSync18(dirname19(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync18(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync19(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -17527,8 +17591,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync17(dirname18(apiKeyFile), { recursive: true });
-            writeFileSync18(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync18(dirname19(apiKeyFile), { recursive: true });
+            writeFileSync19(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -17537,7 +17601,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const keyPersisted = keychainBacked || apiKeyFile !== void 0;
         const wizard = firstRun;
         const writeFirstRun = wizard !== void 0 && !dryRun && keyPersisted;
-        const routeDir = value("dir") ?? (writeFirstRun ? join31(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
+        const routeDir = value("dir") ?? (writeFirstRun ? join32(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
         const routeBlock = renderConnection(
           found,
           route2,
@@ -18181,7 +18245,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync24(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync25(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -18223,8 +18287,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync17(cfg.ship.stateDir, { recursive: true });
-      writeFileSync18(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync18(cfg.ship.stateDir, { recursive: true });
+      writeFileSync19(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -18275,7 +18339,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync24(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync25(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -18298,8 +18362,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync24(cfg.configFile, "utf8");
-      const cfgBase = dirname18(cfg.configFile);
+      const configText = readFileSync25(cfg.configFile, "utf8");
+      const cfgBase = dirname19(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -18327,7 +18391,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync18(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync19(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -18336,28 +18400,28 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         if (row) {
           await tracker.deleteRepoRow(row.id);
           if (existsSync31(resolvedFile)) {
-            const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync19(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync31(join31(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
+        if (existsSync31(join32(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync31(join31(dir, ".git"));
+      const fresh = !existsSync31(join32(dir, ".git"));
       if (existsSync31(dir) && fresh && readdirSync12(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync17(dir, { recursive: true });
-        writeFileSync18(join31(dir, "README.md"), SAMPLE_README);
-        writeFileSync18(join31(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync18(dir, { recursive: true });
+        writeFileSync19(join32(dir, "README.md"), SAMPLE_README);
+        writeFileSync19(join32(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -18376,16 +18440,16 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         });
         repoId = (await tracker.createRepoRow(payload)).id;
         if (existsSync31(resolvedFile)) {
-          const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+          const raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync19(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync18(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync19(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -18718,7 +18782,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync24(p, "utf8");
+            return readFileSync25(p, "utf8");
           } catch {
             return null;
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.63.0",
+  "version": "0.63.2",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",