@tablation/crew 0.79.0 → 0.79.2

package/dist/cli.js

@@ -11388,14 +11388,14 @@ function dedupeChangelogEntries(entries, ticket) {
   return out;
 }
 var BUMP_LINE = /^Bump:[ \t]*(major|minor|patch)\b/gim;
-function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => branchForIssue(cwd, t.issue_id), base = "main", blockerInfo) {
+function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => branchForIssue(cwd, t.issue_id), base = "main", blockerInfo, ref = "HEAD") {
   const held = new Set(heldByBlockers(tickets, contract.statuses.verified, blockerInfo).map((h) => h.ticket.id));
   const verified = tickets.filter((t) => t.status === contract.statuses.verified && !held.has(t.id)).sort((a, b) => Number.parseInt(a.issue_id.replace(/^\D+/, ""), 10) - Number.parseInt(b.issue_id.replace(/^\D+/, ""), 10));
   return verified.map((ticket) => {
     const branch = branchFor(ticket);
     if (!branch) {
       const keys = referenceKeys(ticket);
-      const unreleased = lastReleased ? findKeyInRange(cwd, keys, `${lastReleased}..HEAD`) : null;
+      const unreleased = lastReleased ? findKeyInRange(cwd, keys, `${lastReleased}..${ref}`) : null;
       if (unreleased) {
         return {
           ticket,
@@ -11407,7 +11407,7 @@ function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => bran
           skipReason: "already-merged"
         };
       }
-      const anywhere = findKeyInRange(cwd, keys, "HEAD");
+      const anywhere = findKeyInRange(cwd, keys, ref);
       if (anywhere) {
         return {
           ticket,
@@ -11504,21 +11504,22 @@ ${section}`;
   return [...lines.slice(0, anchor), section, ...lines.slice(anchor)].join("\n");
 }
 var RELEASE_COMMIT_SUBJECT = /^Release \S+$/;
-function subjectsSince(cwd, sha) {
-  if (!isAncestor(cwd, sha, "HEAD")) return null;
-  return (gitOk(cwd, ["log", "--format=%h %s", `${sha}..HEAD`]) ?? "").split("\n").filter(Boolean);
+function subjectsSince(cwd, sha, ref = "HEAD") {
+  if (!isAncestor(cwd, sha, ref)) return null;
+  return (gitOk(cwd, ["log", "--format=%h %s", `${sha}..${ref}`]) ?? "").split("\n").filter(Boolean);
 }
 var isReleaseCommitLine = (line) => RELEASE_COMMIT_SUBJECT.test(line.replace(/^\S+ /, ""));
 function decideRelease(cwd, tickets, contract, opts = {}) {
   const pattern = opts.tagPattern ?? "v*";
   const base = opts.base ?? "main";
-  const block = checkGuards(cwd, base);
-  const lastTag = latestReleaseTag(cwd, pattern, "HEAD");
+  const ref = opts.ref ?? "HEAD";
+  const block = opts.guard === false ? null : checkGuards(cwd, base);
+  const lastTag = latestReleaseTag(cwd, pattern, ref);
   const lastReleased = lastTag ? tagCommit(cwd, lastTag) : null;
-  const head = resolve2(cwd, "HEAD") ?? "";
-  const merges = block ? [] : planMerge(cwd, tickets, contract, lastReleased, opts.branchFor ?? ((t) => branchForIssue(cwd, t.issue_id)), base, opts.blockerInfo);
-  const unreleasedCommits = lastReleased ? countCommits(cwd, `${lastReleased}..HEAD`) : 0;
-  const unreleasedWork = lastReleased ? (gitOk(cwd, ["log", "--format=%s", `${lastReleased}..HEAD`]) ?? "").split("\n").filter((l) => l && !RELEASE_COMMIT_SUBJECT.test(l)).length : 0;
+  const head = resolve2(cwd, ref) ?? "";
+  const merges = block ? [] : planMerge(cwd, tickets, contract, lastReleased, opts.branchFor ?? ((t) => branchForIssue(cwd, t.issue_id)), opts.ref ?? base, opts.blockerInfo, ref);
+  const unreleasedCommits = lastReleased ? countCommits(cwd, `${lastReleased}..${ref}`) : 0;
+  const unreleasedWork = lastReleased ? (gitOk(cwd, ["log", "--format=%s", `${lastReleased}..${ref}`]) ?? "").split("\n").filter((l) => l && !RELEASE_COMMIT_SUBJECT.test(l)).length : 0;
   return {
     block,
     merges,
@@ -12233,10 +12234,14 @@ async function runReleaseCycle(o, movedPast2, localRefSkips) {
     }
     if (drop.size) releasable = releasable.filter((t) => !drop.has(t.id));
   }
+  const { remote, base } = o.repo.branch;
+  const inPlace = o.dryRun || !!o.mergeOnly || !remoteBranchExists(o.cwd, remote, base);
+  const remoteRef = `${remote}/${base}`;
   const decision = decideRelease(o.cwd, releasable, o.contract, {
     tagPattern,
-    base: o.repo.branch.base,
+    base,
     blockerInfo: o.blockerInfo,
+    ...inPlace ? {} : { ref: remoteRef, guard: false },
     // CREW-1364: a branch another ship built and pushed at `fixed` exists
     // here only on the remote. Materialize it so the squash below has a ref.
     // A dry run only looks.
@@ -12265,7 +12270,7 @@ async function runReleaseCycle(o, movedPast2, localRefSkips) {
   o.state?.clearBlocked();
   const failedAt = o.state?.deployFailedSha();
   if (!o.force && failedAt) {
-    const since2 = failedAt === decision.head ? [] : subjectsSince(o.cwd, failedAt);
+    const since2 = failedAt === decision.head ? [] : subjectsSince(o.cwd, failedAt, inPlace ? "HEAD" : remoteRef);
     const real = since2?.filter((l) => !isReleaseCommitLine(l)) ?? null;
     if (real && real.length === 0) {
       o.emit.warn(
@@ -12292,10 +12297,13 @@ async function runReleaseCycle(o, movedPast2, localRefSkips) {
     const review = await reviewHandoff(o, externalClosures, decision.merges, reviewing);
     return { merged: [], deployed: false, stopped: "external", decision, externalClosures, review };
   }
-  const { remote, base } = o.repo.branch;
-  if (o.dryRun || o.mergeOnly || !remoteBranchExists(o.cwd, remote, base)) {
+  if (inPlace) {
     return mergeAndRelease(o, decision, fresh);
   }
+  const primary = checkGuards(o.cwd, base);
+  if (primary) {
+    o.emit.emit(scoped(`primary checkout not fast-forwarded: ${primary.detail}; its dist/ is stale until rebuilt`), { step: "release" });
+  }
   let checkout;
   const stranded = recoverStrandedReleaseCheckouts(o.cwd);
   if (stranded.length > 0) o.emit.warn(scoped(`dropped release checkout(s) stranded by a crash: ${stranded.join(", ")}`));
@@ -13139,10 +13147,19 @@ async function canMintAgentKeys(route, o = {}) {
 
 // src/seat-read-probe.ts
 var SEAT_NO_READ_REMEDY = "the project has no default role for agent keys \u2014 update the Issues app's template, then re-mint with `crew agents sync --revoke-seat-keys`, or assign the Crew seat role to the agent members";
-async function probeIssuesRead(route, apiKey, o = {}) {
-  const resolved = route.resolved;
-  if (!resolved?.models?.issues) return { state: "unknown", detail: "route has no resolved Issues table" };
-  const url = `${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/data-models/${resolved.models.issues}/records?limit=1`;
+function probeTables(route) {
+  const m = route.resolved?.models;
+  if (!m) return [];
+  const r = route.resolved;
+  return [
+    { name: "Issues", modelId: m.issues },
+    { name: "Comments", modelId: m.comments },
+    { name: "Crew", modelId: m.crew },
+    { name: "Ships", modelId: r?.shipsModelId ?? "" }
+  ].filter((t) => !!t.modelId);
+}
+async function probeTableRead(route, modelId, apiKey, o = {}) {
+  const url = `${route.baseUrl.replace(/\/+$/, "")}/api/data-models/${modelId}/records?limit=1`;
   try {
     const res = await (o.fetchImpl ?? fetch)(url, {
       headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
@@ -13160,12 +13177,46 @@ async function probeSeatReads(route, o = {}) {
   for (const role of roles) {
     const id = role === "release" ? await resolveReleaseKey(route, o.getStore) : await resolveSeatKey(route, role, o.getStore);
     if (id.kind !== "agent") continue;
-    out.push({ role, ...await probeIssuesRead(route, id.apiKey, o) });
+    const tables = [];
+    for (const t of probeTables(route)) tables.push({ table: t.name, ...await probeTableRead(route, t.modelId, id.apiKey, o) });
+    const bad = tables.find((t) => t.state === "forbidden") ?? tables.find((t) => t.state === "unknown");
+    out.push({ role, state: bad?.state ?? (tables.length ? "ok" : "unknown"), detail: bad?.detail ?? (tables.length ? void 0 : "route has no resolved tables"), tables });
   }
   return out;
 }
-function describeSeatForbidden(role) {
-  return `seat read:        ERROR ${role} agent key cannot read Issues (403) \u2014 ${SEAT_NO_READ_REMEDY}`;
+function forbiddenDetail(e, route) {
+  const msg = e instanceof Error ? e.message : String(e);
+  const m = /^([A-Z]+) (\S+) -> 403/.exec(msg);
+  const verb = /No (READ|WRITE) access/i.exec(msg)?.[1]?.toUpperCase();
+  const modelId = /\/data-models\/([\w-]+)/i.exec(m?.[2] ?? "")?.[1];
+  const r = route?.resolved;
+  const known = [
+    [r?.models?.issues, "Issues"],
+    [r?.models?.comments, "Comments"],
+    [r?.models?.crew, "Crew"],
+    [r?.shipsModelId, "Ships"],
+    [r?.locksModelId, "Locks"],
+    [r?.epicsModelId, "Epics"],
+    [r?.reposModelId, "Repos"]
+  ];
+  const table2 = modelId ? known.find(([id]) => id && id === modelId)?.[1] ?? `table ${modelId}` : void 0;
+  return { method: m?.[1], path: m?.[2], table: table2, verb };
+}
+function remedyFor(d, roleName = "the agent role") {
+  if (d.table && d.verb && !(d.table === "Issues" && d.verb === "READ")) {
+    return `grant ${d.verb} on ${d.table} to ${roleName}`;
+  }
+  return SEAT_NO_READ_REMEDY;
+}
+function describeSeatForbidden(role, tables = []) {
+  const bad = tables.filter((t) => t.state === "forbidden").map((t) => t.table);
+  const what = bad.length ? bad.join(", ") : "Issues";
+  const remedy = bad.length && !(bad.length === 1 && bad[0] === "Issues") ? bad.map((t) => remedyFor({ table: t, verb: "READ" })).join("; ") : SEAT_NO_READ_REMEDY;
+  return `seat read:        ERROR ${role} agent key cannot read ${what} (403) \u2014 ${remedy}`;
+}
+function describeSeatTables(role, tables) {
+  const cells = tables.map((t) => `${t.table} ${t.state === "ok" ? "ok" : t.state === "forbidden" ? "403" : `error (${t.detail ?? "?"})`}`);
+  return `seat read:        ${role}: ${cells.join(", ")}`;
 }
 function isForbiddenError(e) {
   const status2 = e?.status;
@@ -13173,16 +13224,18 @@ function isForbiddenError(e) {
   return /\b403\b/.test(e instanceof Error ? e.message : String(e));
 }
 var SEAT_FORBIDDEN_KEY = "seat_forbidden:release";
-function seatForbiddenItem(now = /* @__PURE__ */ new Date()) {
+function seatForbiddenItem(now = /* @__PURE__ */ new Date(), e, route) {
+  const d = e === void 0 ? {} : forbiddenDetail(e, route);
+  const what = d.method && d.table ? `${d.method} ${d.table}${d.verb ? ` -> 403 No ${d.verb} access` : " -> 403"}` : "cannot read the Issues table (403)";
   return {
     kind: "seat_forbidden",
     key: SEAT_FORBIDDEN_KEY,
-    message: `release seat cannot read the Issues table (403) \u2014 ${SEAT_NO_READ_REMEDY}`,
+    message: `release seat: ${what} \u2014 ${remedyFor(d)}`,
     since: now.toISOString()
   };
 }
 function seatForbiddenRepoLine(scope) {
-  return `${scope}: skipped \u2014 release seat cannot read Issues (see attention)`;
+  return `${scope}: skipped \u2014 release seat was refused by the tracker (see attention)`;
 }
 
 // src/cli.ts
@@ -17952,9 +18005,11 @@ ${changed2.map((c) => `  - ${c}
           preModes
         );
         reportUnplaceable(c.route, preUnplaceable, tracker.contract.statuses.verified, remit);
+        const remoteBase = remoteBranchExists(target.dir, repo.branch.remote, repo.branch.base);
         const d = decideRelease(target.dir, pre, tracker.contract, {
           tagPattern: repo.release.tagPattern ?? "v*",
-          base: repo.branch.base
+          base: repo.branch.base,
+          ...remoteBase ? { ref: `${repo.branch.remote}/${repo.branch.base}`, guard: false } : {}
         });
         const unstamped = planReleasedBranches(
           target.dir,
@@ -18253,7 +18308,7 @@ ${changed2.map((c) => `  - ${c}
       return summary;
     } catch (e) {
       if (isForbiddenError(e)) {
-        await raiseShipAttention({ state, emit: remit, route: c, ship: cfg.ship }, seatForbiddenItem());
+        await raiseShipAttention({ state, emit: remit, route: c, ship: cfg.ship }, seatForbiddenItem(/* @__PURE__ */ new Date(), e, c));
         const line = seatForbiddenRepoLine(scope);
         remit.warn(line, { step: "release" });
         return { scope, tests: "skipped", outcome: "error", detail: line };
@@ -19014,7 +19069,7 @@ ${changed2.map((c) => `  - ${c}
         if (!dryRun) {
           for (const p of await probeSeatReads(target, { userAgent: cfg.ship.userAgent })) {
             if (p.state === "forbidden") {
-              process.stdout.write(`${describeSeatForbidden(p.role)}
+              process.stdout.write(`${describeSeatForbidden(p.role, p.tables)}
 `);
               process.exitCode = 1;
             }
@@ -19997,7 +20052,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             for (const o of mintOutcomes) process.stderr.write(`${describeMintOutcome(o)}
 `);
             for (const p of await probeSeatReads({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent })) {
-              if (p.state === "forbidden") process.stderr.write(`${describeSeatForbidden(p.role)}
+              if (p.state === "forbidden") process.stderr.write(`${describeSeatForbidden(p.role, p.tables)}
 `);
             }
           } catch (e) {
@@ -20176,7 +20231,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
               for (const m of minted) process.stderr.write(`  ${describeMintOutcome(m)}
 `);
               for (const p of await probeSeatReads(syncRoute, { userAgent: cfg.ship.userAgent })) {
-                if (p.state === "forbidden") process.stderr.write(`  ${describeSeatForbidden(p.role)}
+                if (p.state === "forbidden") process.stderr.write(`  ${describeSeatForbidden(p.role, p.tables)}
 `);
               }
               if (run2.readOnly) {
@@ -21303,7 +21358,7 @@ watermark:  ${state.watermark()}
         if (!flag("offline")) {
           for (const p of await probeSeatReads(route, { userAgent: cfg.ship.userAgent })) {
             if (p.state === "forbidden") {
-              problems.push({ severity: "blocker", kind: "seat_cannot_read_issues", route: route.route, message: `${p.role} agent key cannot read Issues (403)`, remedy: SEAT_NO_READ_REMEDY });
+              problems.push({ severity: "blocker", kind: "seat_cannot_read_issues", route: route.route, message: `${p.role} agent key refused on ${p.tables.filter((t) => t.state === "forbidden").map((t) => t.table).join(", ")} (403)`, remedy: describeSeatForbidden(p.role, p.tables).replace(/^.*?— /, "") });
             } else if (p.state === "ok") passed++;
           }
         }
@@ -21449,11 +21504,11 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       if (!flag("offline")) {
         for (const p of await probeSeatReads(roleRoute, { userAgent: cfg.ship.userAgent })) {
           if (p.state === "forbidden") {
-            process.stdout.write(`${describeSeatForbidden(p.role)}
+            process.stdout.write(`${describeSeatForbidden(p.role, p.tables)}
 `);
             process.exitCode = 1;
           } else {
-            process.stdout.write(p.state === "ok" ? `seat read:        ${p.role} can read Issues
+            process.stdout.write(p.state === "ok" ? `${describeSeatTables(p.role, p.tables)}
 ` : `seat read:        ${p.role} could not be checked (${p.detail})
 `);
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.79.0",
+  "version": "0.79.2",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",