@tablation/crew 0.63.1 → 0.64.0

package/dist/cli.js

@@ -5183,7 +5183,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname18, join as join31, basename as basename10 } from "path";
+import { resolve as resolve5, dirname as dirname19, join as join32, basename as basename10 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir8 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
@@ -5209,6 +5209,7 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "repo",
   "role",
   "route",
+  "recipes",
   "ship-name",
   "tail",
   "ticket",
@@ -5762,15 +5763,52 @@ var State = class _State {
   }
 };
 
-// src/reset.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync8 } from "fs";
+// src/connect-resume.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname6, join as join14 } from "path";
+function lastSessionFile(stateDir) {
+  return join14(stateDir, "connect-session.json");
+}
+function readPointers(stateDir) {
+  try {
+    const parsed = JSON.parse(readFileSync13(lastSessionFile(stateDir), "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    return Object.fromEntries(Object.entries(parsed).filter((e) => typeof e[1] === "string"));
+  } catch {
+    return {};
+  }
+}
+function rememberSession(stateDir, host, workspaceSlug) {
+  try {
+    const file = lastSessionFile(stateDir);
+    mkdirSync7(dirname6(file), { recursive: true });
+    writeFileSync8(file, `${JSON.stringify({ ...readPointers(stateDir), [host]: workspaceSlug }, null, 2)}
+`, { mode: 384 });
+  } catch {
+  }
+}
+async function resumeKeychainSession(o) {
+  const workspace = readPointers(o.stateDir)[o.host];
+  if (!workspace) return void 0;
+  try {
+    const stored = await o.store.get(o.host, workspace);
+    if (!stored?.apiKey) return void 0;
+    if (!await o.verify(stored.apiKey)) return void 0;
+    return { workspace, apiKey: stored.apiKey };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/reset.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync14, readdirSync as readdirSync4, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, join as join15 } from "path";
 function clonedCheckoutsFile(stateDir) {
-  return join14(stateDir, "cloned-checkouts.json");
+  return join15(stateDir, "cloned-checkouts.json");
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync13(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync14(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -5780,8 +5818,8 @@ function recordClonedCheckout(stateDir, dir) {
   const known = readClonedCheckouts(stateDir);
   if (known.includes(dir)) return;
   const file = clonedCheckoutsFile(stateDir);
-  mkdirSync7(dirname6(file), { recursive: true });
-  writeFileSync8(file, `${JSON.stringify([...known, dir], null, 2)}
+  mkdirSync8(dirname7(file), { recursive: true });
+  writeFileSync9(file, `${JSON.stringify([...known, dir], null, 2)}
 `);
 }
 var mark = (dryRun) => dryRun ? "would-remove" : "removed";
@@ -5836,10 +5874,10 @@ function removeCheckout(dir, dryRun, fx) {
 }
 function removeState(stateDir, dryRun) {
   const out = [];
-  const targets = [join14(stateDir, "resolved"), join14(stateDir, "keys"), clonedCheckoutsFile(stateDir), join14(stateDir, "reload-requested"), join14(stateDir, "daemon.started")];
+  const targets = [join15(stateDir, "resolved"), join15(stateDir, "keys"), clonedCheckoutsFile(stateDir), join15(stateDir, "connect-session.json"), join15(stateDir, "reload-requested"), join15(stateDir, "daemon.started")];
   try {
     for (const name of readdirSync4(stateDir)) {
-      if (name.startsWith(".") && statSync5(join14(stateDir, name)).isFile()) targets.push(join14(stateDir, name));
+      if (name.startsWith(".") && statSync5(join15(stateDir, name)).isFile()) targets.push(join15(stateDir, name));
     }
   } catch {
   }
@@ -6113,18 +6151,18 @@ import { existsSync as existsSync16, statfsSync } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
 import {
   existsSync as existsSync15,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync3,
   closeSync as closeSync3,
   writeSync,
   statSync as statSync6,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync14,
-  writeFileSync as writeFileSync9,
+  readFileSync as readFileSync15,
+  writeFileSync as writeFileSync10,
   readdirSync as readdirSync5,
   rmSync as rmSync8
 } from "fs";
-import { dirname as dirname7, basename as basename5, join as join15 } from "path";
+import { dirname as dirname8, basename as basename5, join as join16 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -6490,7 +6528,7 @@ function recoverStrandedReleaseCheckouts(cwd) {
     if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
-      const root = dirname7(path);
+      const root = dirname8(path);
       if (basename5(root).startsWith("crew-release-")) rmSync8(root, { recursive: true, force: true });
     }
   }
@@ -6508,11 +6546,11 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
   }
   for (const name of names) {
     if (!name.startsWith("crew-release-")) continue;
-    const root = join15(tmp, name);
+    const root = join16(tmp, name);
     try {
       const st = statSync6(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync15(join15(root, "checkout"))) continue;
+      if (existsSync15(join16(root, "checkout"))) continue;
       rmSync8(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
@@ -6561,7 +6599,7 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
     );
   }
-  mkdirSync8(dirname7(dir), { recursive: true });
+  mkdirSync9(dirname8(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
     execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
@@ -6586,7 +6624,7 @@ function sleepSync(ms2) {
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
-  mkdirSync8(dirname7(lockPath), { recursive: true });
+  mkdirSync9(dirname8(lockPath), { recursive: true });
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -6626,14 +6664,14 @@ function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {
     if (!existsSync15(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync15(marker) && readFileSync14(marker, "utf8").split("\n")[0] === url) {
-        return { action: "clone-failed", detail: readFileSync14(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      if (existsSync15(marker) && readFileSync15(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync15(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
         ensureRepoCheckout(dir, githubRemote, clone);
       } catch (e) {
         if (!(e instanceof GitError)) throw e;
-        writeFileSync9(marker, `${url}
+        writeFileSync10(marker, `${url}
 ${e.message}`);
         return { action: "clone-failed", detail: e.message, repeat: false };
       }
@@ -8762,8 +8800,8 @@ function materializeBranchForTicket(dir, cfg, t, role, onProblem) {
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync10 } from "fs";
-import { join as join16 } from "path";
+import { writeFileSync as writeFileSync11 } from "fs";
+import { join as join17 } from "path";
 
 // src/stalled.ts
 var STALLED_AFTER_CYCLES = 30;
@@ -9054,7 +9092,7 @@ async function decideCycle(o) {
   }
   return decision;
 }
-var digestPath = (stateDir, route, role) => join16(stateDir, `digest-${route}-${role}.md`);
+var digestPath = (stateDir, route, role) => join17(stateDir, `digest-${route}-${role}.md`);
 function writeDigest(o, d, role, stateDir) {
   const me = o.route.resolved?.seats[role];
   if (!me) return false;
@@ -9118,7 +9156,7 @@ function writeDigest(o, d, role, stateDir) {
     };
     const text = role === "qa" ? qaDigest(input) : buildingDigest(input);
     const path = digestPath(stateDir, routeSlug(o.route.route), role);
-    writeFileSync10(path, text);
+    writeFileSync11(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -9496,12 +9534,12 @@ async function applyStrandedVerified(writer, s, contract, operatorId, memberId,
 
 // src/run-worktree.ts
 import { existsSync as existsSync18 } from "fs";
-import { dirname as dirname8, join as join18 } from "path";
+import { dirname as dirname9, join as join19 } from "path";
 
 // src/ports.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync17 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var run = (cmd, args) => {
   try {
     return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -9546,7 +9584,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync17(join17(parent, name, ".git"))) return true;
+    if (existsSync17(join18(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -9638,7 +9676,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
     if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
     return { action: "recut", path: existing.path, branch, base: baseRef };
   }
-  const path = join18(dirname8(dir), worktreeForTicket(dir, cfg, t, role));
+  const path = join19(dirname9(dir), worktreeForTicket(dir, cfg, t, role));
   if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
     return { action: "cut-remote", path, branch: located.branch };
   }
@@ -9960,8 +9998,8 @@ async function guardRunStrays(route, ship, tracker, role, workingId, since2, log
 }
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname9, join as join19 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync19, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
+import { delimiter, dirname as dirname10, join as join20 } from "path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync12 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
@@ -9983,7 +10021,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join19(dir, name);
+    const candidate = join20(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -10009,9 +10047,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname9(env.nodePath);
+  const nodeDir = dirname10(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname9(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname10(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -10022,7 +10060,7 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname9(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname10(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
@@ -10044,9 +10082,9 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text) {
-  mkdirSync9(dirname9(path), { recursive: true });
+  mkdirSync10(dirname10(path), { recursive: true });
   try {
-    writeFileSync11(path, text, { mode: 384, flag: "wx" });
+    writeFileSync12(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -10079,7 +10117,7 @@ Wrote ${o.configPath}.
 
 // src/connect-json.ts
 import { accessSync as accessSync3, constants as constants3 } from "fs";
-import { dirname as dirname10 } from "path";
+import { dirname as dirname11 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json, write) {
   return {
@@ -10127,7 +10165,7 @@ function flagWizardAnswers(f, env) {
   if (f.agentBin && !isExec(f.agentBin)) return { error: `--agent-bin ${f.agentBin} is not an executable file` };
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
   const dockerPath = f.hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = f.extraPath ?? deriveExtraPath([dirname10(env.nodePath), pnpmPath ? dirname10(pnpmPath) : void 0, dockerPath ? dirname10(dockerPath) : void 0]);
+  const extraPath = f.extraPath ?? deriveExtraPath([dirname11(env.nodePath), pnpmPath ? dirname11(pnpmPath) : void 0, dockerPath ? dirname11(dockerPath) : void 0]);
   return {
     answers: {
       name: f.shipName?.trim() || env.hostname,
@@ -10140,8 +10178,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync12, existsSync as existsSync20, copyFileSync, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, rmSync as rmSync9 } from "fs";
-import { dirname as dirname11, join as join20 } from "path";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync13, existsSync as existsSync20, copyFileSync, mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync2, rmSync as rmSync9 } from "fs";
+import { dirname as dirname12, join as join21 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/release.ts
@@ -10829,13 +10867,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join20(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join21(o.cwd, f));
   const first = files[0];
   if (!existsSync20(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync15(first, "utf8")).version;
+  const current = JSON.parse(readFileSync16(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -10848,27 +10886,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync15(f, "utf8");
+    const src = readFileSync16(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync12(f, out);
+    writeFileSync13(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join20(o.cwd, file);
+  const path = join21(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync20(path) ? readFileSync15(path, "utf8") : "# Changelog\n";
-  writeFileSync12(path, insertChangelogSection(existing, section));
+  const existing = existsSync20(path) ? readFileSync16(path, "utf8") : "# Changelog\n";
+  writeFileSync13(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -10961,8 +10999,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join20(tmpdir3(), "crew-release-"));
-  const dir = join20(root, "checkout");
+  const root = mkdtempSync2(join21(tmpdir3(), "crew-release-"));
+  const dir = join21(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -10972,10 +11010,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join20(o.cwd, f);
+    const src = join21(o.cwd, f);
     if (!existsSync20(src)) continue;
-    mkdirSync10(dirname11(join20(dir, f)), { recursive: true });
-    copyFileSync(src, join20(dir, f));
+    mkdirSync11(dirname12(join21(dir, f)), { recursive: true });
+    copyFileSync(src, join21(dir, f));
   }
   return { dir, branch, close };
 }
@@ -12769,8 +12807,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname12 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname13 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -12803,12 +12841,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync22(resolvedPath) ? JSON.parse(readFileSync16(resolvedPath, "utf8")) : {};
+    const raw = existsSync22(resolvedPath) ? JSON.parse(readFileSync17(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync11(dirname12(resolvedPath), { recursive: true });
-    writeFileSync13(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync12(dirname13(resolvedPath), { recursive: true });
+    writeFileSync14(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -12915,7 +12953,7 @@ import { isMap as isMap2, parseDocument as parseDocument2, YAMLMap } from "yaml"
 
 // src/repos-cmd.ts
 import { homedir as homedir7 } from "os";
-import { basename as basename7, join as join21, resolve as resolve3 } from "path";
+import { basename as basename7, join as join22, resolve as resolve3 } from "path";
 import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -13113,7 +13151,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join21(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join22(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name });
   return { ...add, remote, target };
 }
@@ -13167,17 +13205,62 @@ var DETECTORS = [
   { source: "pyproject.toml", detect: fromPyproject },
   { source: "Makefile", detect: fromMakefile }
 ];
+var WORKFLOW_RE = /\.ya?ml$/;
+function detectRecipes(f) {
+  const workflows = (f.list?.(".github/workflows") ?? []).filter((n) => WORKFLOW_RE.test(n)).sort();
+  if (workflows.length === 0) return [];
+  const evidence = workflows.map((n) => `.github/workflows/${n}`);
+  return [
+    {
+      id: "github-actions-release",
+      title: "Releases run in GitHub Actions",
+      description: "CI publishes the release after the crew merges; the crew watches `gh release view` for the live tag.",
+      evidence,
+      // `ltrimstr` because `verify.match: version` compares the bare version, not `v1.2.3`.
+      hooks: { released: `gh release view --json tagName -q '.tagName | ltrimstr("v")'` },
+      release: { mode: "ci_auto", ci: "github", verifyMatch: "version" },
+      writable: true,
+      defaultOn: true
+    },
+    {
+      id: "github-actions-ci-status",
+      title: "Check CI status before hand-off",
+      description: "Ask GitHub whether the latest run on the branch passed before a ticket is handed to QA. The repo spec has no hook for this yet, so it is reported but cannot be written.",
+      evidence,
+      hooks: {},
+      check: `gh run list --branch "$CREW_BRANCH" --limit 1 --json conclusion -q '.[0].conclusion == "success"'`,
+      writable: false,
+      defaultOn: false
+    }
+  ];
+}
 function suggestHooks(f) {
+  const recipes = detectRecipes(f);
   const found = DETECTORS.flatMap((d) => {
     const hooks = d.detect(f);
     return hooks && Object.keys(hooks).length > 0 ? [{ source: d.source, hooks }] : [];
   });
   if (found.length === 0) {
-    return { source: null, hooks: {}, notes: ["no package.json scripts, Package.swift, pyproject.toml or Makefile test/build targets found \u2014 nothing to propose"] };
+    return { source: null, hooks: {}, notes: ["no package.json scripts, Package.swift, pyproject.toml or Makefile test/build targets found \u2014 nothing to propose"], recipes };
   }
   const [first, ...others] = found;
   const notes = others.length > 0 ? [`also found ${others.map((o) => o.source).join(", ")}; proposing from ${first.source} only`] : [];
-  return { source: first.source, hooks: first.hooks, notes };
+  return { source: first.source, hooks: first.hooks, notes, recipes };
+}
+function selectRecipes(s, ids) {
+  const chosen = ids.map((id) => {
+    const r = s.recipes.find((x) => x.id === id);
+    if (!r) throw new ReposError(`no recipe "${id}" here (have: ${s.recipes.map((x) => x.id).join(", ") || "none"})`);
+    if (!r.writable) throw new ReposError(`recipe "${id}" cannot be written: ${r.description}`);
+    return r;
+  });
+  let hooks = { ...s.hooks };
+  let release;
+  for (const r of chosen) {
+    hooks = { ...r.hooks, ...hooks };
+    release ??= r.release;
+  }
+  return { hooks, ...release ? { release } : {} };
 }
 function parseHooksArgs(args, routes) {
   const rest = [...args];
@@ -13187,7 +13270,7 @@ function parseHooksArgs(args, routes) {
     if (routes.length === 1) route = routes[0];
     else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
   }
-  if (rest.length !== 1) throw new ReposError("expected: crew repos hooks [route] <name> [--suggest] [--write route|repo] [--json]");
+  if (rest.length !== 1) throw new ReposError("expected: crew repos hooks [route] <name> [--suggest] [--agent] [--write route|repo] [--recipes ID,ID] [--json]");
   return { route, name: rest[0] };
 }
 function repoDirOf(text, base, route, name) {
@@ -13233,7 +13316,7 @@ function planRouteHooks(text, route, name, hooks) {
   }
   return { text: String(doc), written, kept };
 }
-function starterRepoConfig(hooks) {
+function starterRepoConfig(hooks, release) {
   const lines = [
     "# Starter .crew.yaml proposed by `crew repos hooks --write repo`.",
     "# Review the hooks, then commit this file; it is the durable home for them",
@@ -13246,7 +13329,12 @@ function starterRepoConfig(hooks) {
   const entries = Object.entries(hooks).filter(([, v]) => v !== void 0);
   if (entries.length === 0) lines.push('  # test: "..."', '  # build: "..."');
   for (const [k, v] of entries) lines.push(`  ${k}: ${JSON.stringify(v)}`);
-  lines.push("", "release:", "  # integrate: merging to the base branch is the release; nothing is deployed.", "  mode: integrate", "");
+  if (release) {
+    lines.push("", "release:", `  mode: ${release.mode}`);
+    if (release.ci) lines.push(`  ci: { provider: ${release.ci} }`);
+    if (release.verifyMatch) lines.push("  verify:", `    match: ${release.verifyMatch}`);
+    lines.push("");
+  } else lines.push("", "release:", "  # integrate: merging to the base branch is the release; nothing is deployed.", "  mode: integrate", "");
   const text = lines.join("\n");
   parseRepoConfig(text, ".crew.yaml");
   return text;
@@ -13255,8 +13343,180 @@ function existingRepoConfig(f) {
   return REPO_CONFIG_FILENAMES.find((n) => f.exists(n));
 }
 
+// src/repos-hooks-agent.ts
+import { spawn as spawn4, execFileSync as execFileSync4 } from "child_process";
+import { realpathSync as realpathSync2 } from "fs";
+import { isAbsolute as isAbsolute2, relative } from "path";
+var AgentSuggestError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+};
+var HOOK_KEYS = ["test", "build", "version", "bump", "released"];
+var READ_ONLY_TOOLS = ["Read", "Grep", "Glob"];
+var WRITING_TOOLS = ["Bash", "Edit", "Write", "NotebookEdit", "WebFetch", "WebSearch", "Task", "Agent"];
+var DEFAULT_TIMEOUT_MS = 18e4;
+function buildAgentPrompt(sniff) {
+  return [
+    "You are reviewing a git checkout (the current directory) to work out how to test and build it.",
+    "Read README*, CLAUDE.md, AGENTS.md, GEMINI.md, package/build manifests and .github/workflows/* as needed.",
+    "You may only read files. Do not modify anything and do not run commands.",
+    "",
+    `A file sniff already proposed: ${JSON.stringify(sniff.hooks)}.`,
+    "Propose the commands a contributor should run, using the repo's own documented ones over guesses.",
+    "Omit any hook you cannot support from a file you read.",
+    "",
+    "Answer with ONLY one JSON object, no prose and no code fence:",
+    '{"hooks": {"test": "...", "build": "...", "version": "...", "bump": "...", "released": "..."}, "notes": ["..."]}',
+    "`version` prints the bare version, `bump` bumps by $CREW_BUMP (patch|minor|major) and prints the new version,",
+    "`released` prints what is live (a version or sha). Keys you cannot support are left out."
+  ].join("\n");
+}
+function agentInvocation(spec, model) {
+  if (spec.harness !== "claude") {
+    throw new AgentSuggestError("unsupported_harness", `--agent supports the claude harness only (toolchain "${spec.name}" is ${spec.harness})`);
+  }
+  return wrapInvocation(spec, {
+    model,
+    args: [
+      "-p",
+      "--allowedTools",
+      ...READ_ONLY_TOOLS,
+      "--disallowedTools",
+      ...WRITING_TOOLS,
+      "--model",
+      model,
+      "--output-format",
+      "stream-json",
+      "--verbose",
+      ...spec.args
+    ]
+  });
+}
+function parseAgentStream(out, dir) {
+  let text = "";
+  let isError = false;
+  const files = /* @__PURE__ */ new Set();
+  let base = dir;
+  try {
+    base = realpathSync2(dir);
+  } catch {
+  }
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    let ev;
+    try {
+      ev = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (ev?.type === "assistant" && Array.isArray(ev.message?.content)) {
+      for (const b of ev.message.content) {
+        const p = b?.type === "tool_use" && b.name === "Read" ? b.input?.file_path : void 0;
+        if (typeof p === "string") files.add(isAbsolute2(p) ? relative(base, p) : p);
+      }
+    } else if (ev?.type === "result") {
+      text = typeof ev.result === "string" ? ev.result : "";
+      isError = ev.is_error === true;
+    }
+  }
+  return { text, isError, filesRead: [...files].sort() };
+}
+function parseAgentHooks(text) {
+  const start = text.indexOf("{");
+  const end = text.lastIndexOf("}");
+  if (start < 0 || end <= start) throw new AgentSuggestError("bad_output", "the toolchain did not answer with a JSON object");
+  let obj;
+  try {
+    obj = JSON.parse(text.slice(start, end + 1));
+  } catch {
+    throw new AgentSuggestError("bad_output", "the toolchain's answer was not valid JSON");
+  }
+  const raw = obj && typeof obj === "object" && obj.hooks && typeof obj.hooks === "object" ? obj.hooks : {};
+  const hooks = {};
+  for (const k of HOOK_KEYS) if (typeof raw[k] === "string" && raw[k].trim()) hooks[k] = raw[k].trim();
+  const notes = Array.isArray(obj.notes) ? obj.notes.filter((n) => typeof n === "string") : [];
+  return { hooks, notes };
+}
+var SIGNED_OUT = /not logged in|\/login|invalid api key|authentication|unauthori[sz]ed|\b401\b|credit balance/i;
+function classifyFailure(o) {
+  if (o.spawnError?.code === "ENOENT") return "not_installed";
+  return SIGNED_OUT.test(o.output) ? "not_signed_in" : "failed";
+}
+function porcelain(dir) {
+  try {
+    return execFileSync4("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
+  } catch {
+    return void 0;
+  }
+}
+async function runAgentSuggest(o) {
+  const model = o.model ?? o.spec.model;
+  const { bin, args } = agentInvocation(o.spec, model);
+  const adapter = adapterFor(o.spec.harness);
+  const env = { ...process.env, ...adapter.runEnv(o.spec) };
+  for (const v of adapter.unsetEnv) delete env[v];
+  delete env.CREW_API_KEY;
+  const before = porcelain(o.dir);
+  const timeout = AbortSignal.timeout(o.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  const signal = o.signal ? AbortSignal.any([o.signal, timeout]) : timeout;
+  const run2 = await new Promise((resolve6) => {
+    let out = "";
+    let err = "";
+    const child = spawn4(bin, args, { cwd: o.dir, env, detached: true, stdio: ["pipe", "pipe", "pipe"] });
+    let settled = false;
+    const settle = (r) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      resolve6(r);
+    };
+    const onAbort = () => {
+      try {
+        if (child.pid) process.kill(-child.pid, "SIGTERM");
+      } catch {
+        child.kill("SIGTERM");
+      }
+      child.stdout.destroy();
+      child.stderr.destroy();
+      settle({ code: null, out, err, aborted: true });
+    };
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+    child.stdout.on("data", (d) => {
+      out += d.toString();
+    });
+    child.stderr.on("data", (d) => {
+      err += d.toString();
+    });
+    child.on("error", (e) => settle({ code: null, out, err, spawnError: e, aborted: false }));
+    child.on("close", (code) => settle({ code, out, err, aborted: false }));
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(buildAgentPrompt(o.sniff));
+  });
+  if (run2.aborted || signal.aborted) {
+    throw new AgentSuggestError(o.signal?.aborted ? "cancelled" : "timeout", o.signal?.aborted ? "cancelled" : "the toolchain did not answer in time");
+  }
+  const after = porcelain(o.dir);
+  if (before !== void 0 && after !== before) {
+    throw new AgentSuggestError("modified_checkout", "the checkout changed during --agent; inspect it with `git status` (the agent result was discarded)");
+  }
+  const parsed = parseAgentStream(run2.out, o.dir);
+  if (run2.spawnError || run2.code !== 0 || parsed.isError) {
+    const reason = classifyFailure({ code: run2.code, ...run2.spawnError ? { spawnError: run2.spawnError } : {}, output: `${parsed.text}
+${run2.err}` });
+    throw new AgentSuggestError(reason, reason === "not_installed" ? `${bin} is not installed` : reason === "not_signed_in" ? `${o.spec.name} is not signed in` : (parsed.text || run2.err).trim().slice(0, 300) || `exited ${run2.code}`);
+  }
+  const { hooks, notes } = parseAgentHooks(parsed.text);
+  const differsFromSniff = HOOK_KEYS.filter((k) => hooks[k] !== void 0 && hooks[k] !== o.sniff.hooks[k]);
+  return { source: "agent", hooks, filesRead: parsed.filesRead, differsFromSniff, notes, toolchain: o.spec.name, model };
+}
+
 // src/sample-ticket.ts
-import { basename as basename8, dirname as dirname14, join as join22 } from "path";
+import { basename as basename8, dirname as dirname15, join as join23 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -13279,8 +13539,8 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join22(dirname14(existing[0]), SAMPLE_REPO);
-  return join22(reposBase, workspace, SAMPLE_REPO);
+  if (existing.length > 0) return join23(dirname15(existing[0]), SAMPLE_REPO);
+  return join23(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
 function sampleDescription() {
@@ -13361,8 +13621,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync23, readFileSync as readFileSync17, readdirSync as readdirSync6 } from "fs";
-import { basename as basename9, dirname as dirname15, join as join23, resolve as resolve4 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync18, readdirSync as readdirSync6 } from "fs";
+import { basename as basename9, dirname as dirname16, join as join24, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -13416,7 +13676,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname15(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname16(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename9(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
@@ -13429,7 +13689,7 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join23(parent, name);
+    const path = join24(parent, name);
     if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
   }
   return out;
@@ -13532,7 +13792,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync17(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync18(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -13638,13 +13898,13 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 
 // src/stream-sweep.ts
 import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync10, statSync as statSync8 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join24(stateDir, "streams");
+  const dir = join25(stateDir, "streams");
   if (!existsSync24(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync7(dir).map((name) => join24(dir, name)).filter((path) => {
+  return readdirSync7(dir).map((name) => join25(dir, name)).filter((path) => {
     try {
       return statSync8(path).mtimeMs < cutoff;
     } catch {
@@ -13672,7 +13932,7 @@ function applyStreamSweep(paths, dryRun, log) {
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
   if (!existsSync24(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync7(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join24(stateDir, name)).filter((path) => {
+  return readdirSync7(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join25(stateDir, name)).filter((path) => {
     try {
       return statSync8(path).mtimeMs < cutoff;
     } catch {
@@ -13682,26 +13942,26 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync2, readFileSync as readFileSync24, existsSync as existsSync31, mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync25, existsSync as existsSync31, mkdirSync as mkdirSync18, writeFileSync as writeFileSync19, rmSync as rmSync12, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync2, statSync as statSync10, readdirSync as readdirSync12 } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, chmodSync } from "fs";
-import { dirname as dirname16, join as join25 } from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, readFileSync as readFileSync19, chmodSync } from "fs";
+import { dirname as dirname17, join as join26 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join25(stateDir, "ssh", "id_ed25519");
+  return join26(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
   if (!existsSync25(privateKeyPath)) {
-    mkdirSync12(dirname16(privateKeyPath), { recursive: true });
+    mkdirSync13(dirname17(privateKeyPath), { recursive: true });
     try {
-      execFileSync4("ssh-keygen", [
+      execFileSync5("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -13722,12 +13982,12 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync25(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync18(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync19(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync4("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync5("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -13735,18 +13995,18 @@ function sshKeygenAvailable() {
 }
 
 // src/machine-id.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname17, join as join26 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname18, join as join27 } from "path";
 function machineIdPathFor(stateDir) {
-  return join26(stateDir, "machine-id");
+  return join27(stateDir, "machine-id");
 }
 var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
-      const out = execFileSync5("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      const out = execFileSync6("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -13754,7 +14014,7 @@ function readRawMachineId(platform2 = process.platform) {
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       if (existsSync26(p)) {
-        const id = readFileSync19(p, "utf8").trim();
+        const id = readFileSync20(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -13766,14 +14026,14 @@ function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
   if (existsSync26(path)) {
-    const cached = readFileSync19(path, "utf8").trim();
+    const cached = readFileSync20(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync13(dirname17(path), { recursive: true });
-  writeFileSync14(path, `${hashed}
+  mkdirSync14(dirname18(path), { recursive: true });
+  writeFileSync15(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -13785,11 +14045,11 @@ function matchShipRows(ships, shipName2, machineId) {
 }
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync6 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 import { createHash as createHash5 } from "crypto";
 var realExec = (cmd, args) => {
   try {
-    return execFileSync6(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync7(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -13987,12 +14247,12 @@ function syncAllPassengerCheckouts(cfg) {
 }
 
 // src/tunnel.ts
-import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
+import { spawn as spawn5 } from "child_process";
+import { existsSync as existsSync27, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync16, unlinkSync as unlinkSync3, readdirSync as readdirSync8 } from "fs";
 import { randomInt } from "crypto";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
-var defaultSpawn = (cmd, args) => spawn4(cmd, args, DEFAULT_SPAWN_OPTIONS);
+var defaultSpawn = (cmd, args) => spawn5(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 var SLUG_LENGTH = 12;
 function generateTunnelSlug() {
@@ -14057,21 +14317,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join27(stateDir, "passengers", `${workspaceId}.json`);
+  return join28(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync27(path)) return void 0;
   try {
-    return JSON.parse(readFileSync20(path, "utf8"));
+    return JSON.parse(readFileSync21(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync14(join27(stateDir, "passengers"), { recursive: true });
-  writeFileSync15(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync15(join28(stateDir, "passengers"), { recursive: true });
+  writeFileSync16(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -14168,7 +14428,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join27(stateDir, "passengers");
+  const dir = join28(stateDir, "passengers");
   if (!existsSync27(dir)) return [];
   return readdirSync8(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
@@ -14288,10 +14548,10 @@ async function unregisterEndpoint(workspaceId, info, d) {
 
 // src/passenger-sync-daemon.ts
 import { createServer as createHttpServer } from "http";
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync16, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync16, readFileSync as readFileSync22, writeFileSync as writeFileSync17, unlinkSync as unlinkSync4, readdirSync as readdirSync9 } from "fs";
+import { join as join29 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -14375,26 +14635,26 @@ function runSyncDaemonFromEnv(env = process.env) {
   return server;
 }
 var defaultSpawn2 = (cmd, args, env) => {
-  const child = spawn5(cmd, args, { detached: true, stdio: "ignore", env });
+  const child = spawn6(cmd, args, { detached: true, stdio: "ignore", env });
   child.unref();
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join28(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join29(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync28(path)) return void 0;
   try {
-    return JSON.parse(readFileSync21(path, "utf8"));
+    return JSON.parse(readFileSync22(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync15(join28(stateDir, "passengers"), { recursive: true });
-  writeFileSync16(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync16(join29(stateDir, "passengers"), { recursive: true });
+  writeFileSync17(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -14414,7 +14674,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join28(stateDir, "passengers");
+  const dir = join29(stateDir, "passengers");
   if (!existsSync28(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync9(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
@@ -14472,12 +14732,12 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync16, readFileSync as readFileSync23, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync17 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync17, readFileSync as readFileSync24, readdirSync as readdirSync11, rmSync as rmSync11, statSync as statSync9, writeFileSync as writeFileSync18 } from "fs";
+import { join as join31 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync29, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync10, readFileSync as readFileSync23 } from "fs";
+import { join as join30 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14498,19 +14758,19 @@ function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
   if (!existsSync29(path)) return false;
   try {
-    return JSON.parse(readFileSync22(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync23(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join29(o.stateDir, "streams");
+  const dir = join30(o.stateDir, "streams");
   if (!existsSync29(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join29(dir, name);
+    const streamPath = join30(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14610,7 +14870,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync11(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join30(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join31(path, entry.name)));
   }
   return latest;
 }
@@ -14622,20 +14882,20 @@ function makeStaleChecker(paths, opts = {}) {
   return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync30(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join30(stateDir, "reload-requested");
+  return join31(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join30(stateDir, "daemon.started");
+  return join31(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync16(stateDir, { recursive: true });
+  mkdirSync17(stateDir, { recursive: true });
   rmSync11(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync17(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync18(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync23(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync24(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -14695,7 +14955,7 @@ async function runOnePassUnguarded(o) {
   await hydrateApiKeys([o.route], o.getSessionStore);
   const emit = o.newEmitter();
   const decide = o.decide ?? decideCycle;
-  const spawn6 = o.spawnRoleAgent ?? runRoleAgent;
+  const spawn7 = o.spawnRoleAgent ?? runRoleAgent;
   const breaker = o.spawnBreaker ?? new SpawnBreaker();
   const ctx = { route: o.route, ship: o.ship, state: o.state, emit, getSessionStore: o.getSessionStore };
   try {
@@ -14756,7 +15016,7 @@ async function runOnePassUnguarded(o) {
       continue;
     }
     started.push(role);
-    const run2 = spawn6(role, decision, ctx).then(() => {
+    const run2 = spawn7(role, decision, ctx).then(() => {
       breaker.recordSuccess(role);
       clearShipAttention(o.state, `role_parked:${role}`);
     }).catch(async (e) => {
@@ -15001,7 +15261,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname18(process.execPath) : resolve5(dirname18(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname19(process.execPath) : resolve5(dirname19(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -15147,7 +15407,7 @@ function usage() {
                                  resume with no argument clears only the whole-crew pause; a role or release pause needs its own resume
   crew log [route]               tail the log
   crew inbox [--member NAME]    your tickets across every workspace (or a colleague's)
-  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one; --dry-run works with no crew.yaml and writes none: no file, no rows, no seat keys \u2014 the device approval and workspace credential behave as in a real run)
+  crew connect                  resolve a workspace's ids into a crew.yaml block, then (admin key) sync personas/skills and mint seat keys (--no-agents-sync skips that; --no-mcp skips registering the Tablation MCP server with Claude Code; --mcp replace overwrites a different one; --dry-run works with no crew.yaml and writes none: no file, no rows, no seat keys \u2014 the device approval and workspace credential behave as in a real run; with no workspace named it first reuses the keychain session a previous dry-run stored for the host, falling back to device approval when that is missing or rejected, and the signed_in event's session field says which)
   crew disconnect               remove what connect installed for Pair (Claude MCP; Codex/Gemini instructions block and MCP entry per ship.pair)
   crew disconnect --reset [--remove-checkouts] [--dry-run] [--json]   remove everything connect and install wrote on this machine: scheduler units, Pair/MCP entries, seat keys, keychain credential, resolved state, then crew.yaml (--remove-checkouts also deletes checkouts crew cloned, never one with local changes)
   crew agents sync [route] [--force] [--revoke-seat-keys]   push crew's personas AND skill files into the workspace Agents/Agent Skills tables (--force overwrites even a diverged persona or skill; never one marked Customize prompt)
@@ -15155,7 +15415,7 @@ function usage() {
   crew skills sync [route]      push only crew's skill files (e.g. grill-me) into the workspace Agent Skills table
   crew repos add [ROUTE] [NAME] [PATH]  attach a local checkout to a route in crew.yaml (--dry-run previews)
   crew repos clone [ROUTE] NAME  clone a Repos row's remote into the route directory and attach it (--dir PATH, --dry-run, --json)
-  crew repos hooks [ROUTE] NAME suggest test/build hooks for a checkout (--write route|repo, --json)
+  crew repos hooks [ROUTE] NAME suggest test/build hooks for a checkout (--agent, --write route|repo, --recipes, --json)
   crew repos list ROUTE         the checkouts a route has, with the tracker's Repos row each matches
   crew logbook list [route]     recent Agent Log entries, filterable by --role/--ticket
   crew logbook show [route] ID [--prompt]   one entry; --prompt reconstructs and verifies its prompt
@@ -15568,7 +15828,7 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join31(homedir8(), ".config", "systemd", "user", `${label}.timer`);
+      const staleTimer = join32(homedir8(), ".config", "systemd", "user", `${label}.timer`);
       if (existsSync31(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
@@ -15630,7 +15890,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync18(cfg.configFile, planEnable(readFileSync24(cfg.configFile, "utf8"), a.route));
+          writeFileSync19(cfg.configFile, planEnable(readFileSync25(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -16084,10 +16344,12 @@ ${changed2.map((c) => `  - ${c}
     lock?.release();
     lock = void 0;
   };
+  let sigintOwnedByCommand = false;
   if (!dryRun) {
     process.on("exit", dropLock);
     for (const sig of ["SIGINT", "SIGTERM"]) {
       process.on(sig, () => {
+        if (sig === "SIGINT" && sigintOwnedByCommand) return;
         dropLock();
         process.exit(0);
       });
@@ -16629,7 +16891,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join31(CREW_HOME, "src"), join31(CREW_HOME, "dist"), join31(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join32(CREW_HOME, "src"), join32(CREW_HOME, "dist"), join32(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -16830,10 +17092,10 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync24(resolvedPath, "utf8")) : {};
+        const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync25(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync17(dirOf(resolvedPath), { recursive: true });
-        writeFileSync18(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync18(dirOf(resolvedPath), { recursive: true });
+        writeFileSync19(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -16842,19 +17104,25 @@ ${changed2.map((c) => `  - ${c}
     case "repos": {
       const sub = positional[1];
       const usage2 = () => {
-        process.stderr.write("crew repos add [workspace/project] [name] [path] [--name N] [--project P] [--dry-run] [--no-create]\ncrew repos clone [workspace/project] <name> [--dir PATH] [--dry-run] [--json]\ncrew repos list <workspace/project>\ncrew repos hooks [workspace/project] <name> [--suggest] [--write route|repo] [--json]\n");
+        process.stderr.write("crew repos add [workspace/project] [name] [path] [--name N] [--project P] [--dry-run] [--no-create]\ncrew repos clone [workspace/project] <name> [--dir PATH] [--dry-run] [--json]\ncrew repos list <workspace/project>\ncrew repos hooks [workspace/project] <name> [--suggest] [--agent] [--write route|repo] [--recipes ID,ID] [--json]\n");
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks") usage2();
-      const configText = readFileSync24(cfg.configFile, "utf8");
+      const configText = readFileSync25(cfg.configFile, "utf8");
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname18(cfg.configFile), a.route, a.name);
+          const dir = repoDirOf(configText, dirname19(cfg.configFile), a.route, a.name);
           if (!existsSync31(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync31(resolvePath(dir, r)), read: (r) => {
+          const files = { exists: (r) => existsSync31(resolvePath(dir, r)), list: (r) => {
+            try {
+              return readdirSync12(resolvePath(dir, r));
+            } catch {
+              return [];
+            }
+          }, read: (r) => {
             try {
-              return readFileSync24(resolvePath(dir, r), "utf8");
+              return readFileSync25(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -16862,21 +17130,43 @@ ${changed2.map((c) => `  - ${c}
           const suggestion = suggestHooks(files);
           const write = value("write");
           if (write !== void 0 && write !== "route" && write !== "repo") throw new ReposError(`--write takes "route" or "repo" (got "${write}")`);
+          const recipeIds = (value("recipes") ?? "").split(",").map((x) => x.trim()).filter((x) => x && x !== "none");
+          if (recipeIds.length > 0 && !write) throw new ReposError("--recipes only applies with --write route|repo");
+          if (flag("agent") && write) throw new ReposError("--agent is read-only; drop --write (write the sniffed hooks, then re-run --agent to compare)");
+          let agent = null;
+          let agentError = null;
+          if (flag("agent")) {
+            const ac = new AbortController();
+            const onSigint = () => ac.abort();
+            process.once("SIGINT", onSigint);
+            sigintOwnedByCommand = true;
+            try {
+              const routeCfg = cfg.routes.find((r) => r.route === a.route);
+              agent = await runAgentSuggest({ spec: resolveToolchain(cfg.ship, routeCfg, a.name), dir, sniff: suggestion, signal: ac.signal });
+            } catch (e) {
+              if (!(e instanceof AgentSuggestError)) throw e;
+              agentError = { reason: e.reason, message: e.message };
+            } finally {
+              process.off("SIGINT", onSigint);
+              sigintOwnedByCommand = false;
+            }
+          }
+          const picked = selectRecipes(suggestion, recipeIds);
           let written;
-          if (write && suggestion.source === null) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
+          if (write && suggestion.source === null && recipeIds.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
-            const plan = planRouteHooks(configText, a.route, a.name, suggestion.hooks);
-            writeFileSync18(cfg.configFile, plan.text);
+            const plan = planRouteHooks(configText, a.route, a.name, picked.hooks);
+            writeFileSync19(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync18(file, starterRepoConfig(suggestion.hooks), { flag: "wx" });
-            written = { target: "repo", file, hooks: Object.keys(suggestion.hooks), kept: [] };
+            writeFileSync19(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [] };
           }
           if (flag("json")) {
-            process.stdout.write(`${JSON.stringify({ route: a.route, repo: a.name, dir, ...suggestion, written: written ?? null })}
+            process.stdout.write(`${JSON.stringify({ route: a.route, repo: a.name, dir, ...suggestion, agent, agentError, written: written ?? null })}
 `);
           } else {
             if (suggestion.source) process.stdout.write(`${a.name}: proposed from ${suggestion.source}
@@ -16884,6 +17174,18 @@ ${changed2.map((c) => `  - ${c}
             for (const [k, v] of Object.entries(suggestion.hooks)) process.stdout.write(`  ${k}: ${v}
 `);
             for (const n of suggestion.notes) process.stdout.write(`note: ${n}
+`);
+            for (const r of suggestion.recipes) process.stdout.write(`recipe ${r.id}${r.defaultOn ? " (default on)" : ""}${r.writable ? "" : " (advisory)"}: ${r.title} [${r.evidence.join(", ")}]
+`);
+            if (agent) {
+              process.stdout.write(`agent (${agent.toolchain}, ${agent.model}) read ${agent.filesRead.join(", ") || "no files"}
+`);
+              for (const [k, v] of Object.entries(agent.hooks)) process.stdout.write(`  ${k}: ${v}${agent.differsFromSniff.includes(k) ? "   (differs from file sniff)" : ""}
+`);
+              for (const n of agent.notes) process.stdout.write(`note: ${n}
+`);
+            }
+            if (agentError) process.stderr.write(`crew repos: --agent failed (${agentError.reason}): ${agentError.message}
 `);
             if (written) {
               process.stdout.write(`wrote ${written.hooks.join(", ") || "nothing new"} to ${written.file}
@@ -16891,8 +17193,11 @@ ${changed2.map((c) => `  - ${c}
               if (written.kept.length) process.stdout.write(`kept existing route hooks: ${written.kept.join(", ")}
 `);
               if (written.target === "repo") process.stdout.write("review it and commit it to the repository\n");
+              if (written.target === "route" && picked.release) process.stdout.write(`note: release.mode ${picked.release.mode} is repo-level; use --write repo to set it
+`);
             }
           }
+          if (agentError) process.exitCode = 1;
         } catch (e) {
           if (e instanceof ReposError) {
             process.stderr.write(`crew repos: ${e.message}
@@ -16940,13 +17245,13 @@ ${changed2.map((c) => `  - ${c}
       let resolvedRemotes;
       if (existsSync31(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync25(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname18(cfg.configFile);
+      const base = dirname19(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -16987,7 +17292,7 @@ ${changed2.map((c) => `  - ${c}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync18(cfg.configFile, plan2.text);
+          writeFileSync19(cfg.configFile, plan2.text);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
@@ -17042,14 +17347,14 @@ ${changed2.map((c) => `  - ${c}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync31(resolvedFile)) {
-            const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync19(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync18(cfg.configFile, plan.text);
+        writeFileSync19(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -17179,6 +17484,30 @@ ${reconstruction.prompt}
         } catch {
         }
       }
+      let signInSource = apiKey ? "key" : "device";
+      if (!apiKey && !workspace && dryRun && store) {
+        const resumed = await resumeKeychainSession({
+          store,
+          stateDir: cfg.ship.stateDir,
+          host: hostFromUrl3(baseUrl),
+          verify: async (k) => {
+            try {
+              await get({ baseUrl, apiKey: k, userAgent: cfg.ship.userAgent }, "/auth/me");
+              return true;
+            } catch {
+              return false;
+            }
+          }
+        });
+        if (resumed) {
+          apiKey = resumed.apiKey;
+          workspace = resumed.workspace;
+          keychainBacked = true;
+          signInSource = "keychain";
+          process.stderr.write(`Reusing the existing keychain session for ${hostFromUrl3(baseUrl)}/${workspace}.
+`);
+        }
+      }
       let mintedFromDevice = false;
       let signedInEmitted = false;
       if (!apiKey) {
@@ -17231,7 +17560,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         signedInEmitted = true;
         connectEvents.emit("signed_in", `signed in as ${result.identity.email}`, {
           identity: { id: result.identity.id, email: result.identity.email },
-          workspaces: [{ slug: result.workspace.slug, name: result.workspace.name }]
+          workspaces: [{ slug: result.workspace.slug, name: result.workspace.name }],
+          session: "device"
         });
         const deviceWorkspace = "path" in result.workspace && typeof result.workspace.path === "string" ? result.workspace.path : result.workspace.slug;
         if (!workspace) workspace = deviceWorkspace;
@@ -17245,6 +17575,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
               createdAt: result.apiKey.createdAt
             });
             keychainBacked = true;
+            rememberSession(cfg.ship.stateDir, hostFromUrl3(baseUrl), deviceWorkspace);
             process.stderr.write(
               `API key stored in the OS keychain for ${hostFromUrl3(baseUrl)}/${deviceWorkspace}.
 `
@@ -17290,7 +17621,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           signedInEmitted = true;
           connectEvents.emit("signed_in", `key belongs to ${found.meEmail ?? found.meId}`, {
             identity: { id: found.meId, email: found.meEmail, name: found.meName },
-            workspaces: [{ slug: found.workspaceSlug, name: found.workspaceName, role: found.role }]
+            workspaces: [{ slug: found.workspaceSlug, name: found.workspaceName, role: found.role }],
+            session: signInSource
           });
         }
         connectEvents.emit("workspace_resolved", `workspace ${found.workspaceSlug}`, {
@@ -17380,7 +17712,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync31(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync24(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync25(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -17489,10 +17821,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync17(dirname18(resolvedPath), { recursive: true });
+          mkdirSync18(dirname19(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync18(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync19(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync2(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -17527,8 +17859,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync17(dirname18(apiKeyFile), { recursive: true });
-            writeFileSync18(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync18(dirname19(apiKeyFile), { recursive: true });
+            writeFileSync19(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -17537,7 +17869,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const keyPersisted = keychainBacked || apiKeyFile !== void 0;
         const wizard = firstRun;
         const writeFirstRun = wizard !== void 0 && !dryRun && keyPersisted;
-        const routeDir = value("dir") ?? (writeFirstRun ? join31(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
+        const routeDir = value("dir") ?? (writeFirstRun ? join32(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
         const routeBlock = renderConnection(
           found,
           route2,
@@ -18175,13 +18507,13 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         },
         inspectCheckout(dir) {
           const dirty = status(dir).map((c) => c.path);
-          const linkedWorktrees = worktrees(dir).map((w) => w.path).filter((p) => realpathSync2(p) !== realpathSync2(dir));
+          const linkedWorktrees = worktrees(dir).map((w) => w.path).filter((p) => realpathSync3(p) !== realpathSync3(dir));
           return { dirty, linkedWorktrees };
         }
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync24(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync25(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -18223,8 +18555,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync17(cfg.ship.stateDir, { recursive: true });
-      writeFileSync18(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync18(cfg.ship.stateDir, { recursive: true });
+      writeFileSync19(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -18275,7 +18607,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync24(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync25(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -18298,8 +18630,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync24(cfg.configFile, "utf8");
-      const cfgBase = dirname18(cfg.configFile);
+      const configText = readFileSync25(cfg.configFile, "utf8");
+      const cfgBase = dirname19(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -18327,7 +18659,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync18(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync19(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -18336,28 +18668,28 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         if (row) {
           await tracker.deleteRepoRow(row.id);
           if (existsSync31(resolvedFile)) {
-            const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync19(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync31(join31(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
+        if (existsSync31(join32(dir, ".git")) && basename10(dir) === SAMPLE_REPO) rmSync12(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync31(join31(dir, ".git"));
+      const fresh = !existsSync31(join32(dir, ".git"));
       if (existsSync31(dir) && fresh && readdirSync12(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync17(dir, { recursive: true });
-        writeFileSync18(join31(dir, "README.md"), SAMPLE_README);
-        writeFileSync18(join31(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync18(dir, { recursive: true });
+        writeFileSync19(join32(dir, "README.md"), SAMPLE_README);
+        writeFileSync19(join32(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync6("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -18376,16 +18708,16 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         });
         repoId = (await tracker.createRepoRow(payload)).id;
         if (existsSync31(resolvedFile)) {
-          const raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+          const raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync18(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync19(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync18(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync19(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -18718,7 +19050,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync24(p, "utf8");
+            return readFileSync25(p, "utf8");
           } catch {
             return null;
           }