@tablation/crew 0.79.1 → 0.79.3

package/dist/cli.js

@@ -13147,10 +13147,19 @@ async function canMintAgentKeys(route, o = {}) {
 
 // src/seat-read-probe.ts
 var SEAT_NO_READ_REMEDY = "the project has no default role for agent keys \u2014 update the Issues app's template, then re-mint with `crew agents sync --revoke-seat-keys`, or assign the Crew seat role to the agent members";
-async function probeIssuesRead(route, apiKey, o = {}) {
-  const resolved = route.resolved;
-  if (!resolved?.models?.issues) return { state: "unknown", detail: "route has no resolved Issues table" };
-  const url = `${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/data-models/${resolved.models.issues}/records?limit=1`;
+function probeTables(route) {
+  const m = route.resolved?.models;
+  if (!m) return [];
+  const r = route.resolved;
+  return [
+    { name: "Issues", modelId: m.issues },
+    { name: "Comments", modelId: m.comments },
+    { name: "Crew", modelId: m.crew },
+    { name: "Ships", modelId: r?.shipsModelId ?? "" }
+  ].filter((t) => !!t.modelId);
+}
+async function probeTableRead(route, modelId, apiKey, o = {}) {
+  const url = `${route.baseUrl.replace(/\/+$/, "")}/api/data-models/${modelId}/records?limit=1`;
   try {
     const res = await (o.fetchImpl ?? fetch)(url, {
       headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
@@ -13168,12 +13177,46 @@ async function probeSeatReads(route, o = {}) {
   for (const role of roles) {
     const id = role === "release" ? await resolveReleaseKey(route, o.getStore) : await resolveSeatKey(route, role, o.getStore);
     if (id.kind !== "agent") continue;
-    out.push({ role, ...await probeIssuesRead(route, id.apiKey, o) });
+    const tables = [];
+    for (const t of probeTables(route)) tables.push({ table: t.name, ...await probeTableRead(route, t.modelId, id.apiKey, o) });
+    const bad = tables.find((t) => t.state === "forbidden") ?? tables.find((t) => t.state === "unknown");
+    out.push({ role, state: bad?.state ?? (tables.length ? "ok" : "unknown"), detail: bad?.detail ?? (tables.length ? void 0 : "route has no resolved tables"), tables });
   }
   return out;
 }
-function describeSeatForbidden(role) {
-  return `seat read:        ERROR ${role} agent key cannot read Issues (403) \u2014 ${SEAT_NO_READ_REMEDY}`;
+function forbiddenDetail(e, route) {
+  const msg = e instanceof Error ? e.message : String(e);
+  const m = /^([A-Z]+) (\S+) -> 403/.exec(msg);
+  const verb = /No (READ|WRITE) access/i.exec(msg)?.[1]?.toUpperCase();
+  const modelId = /\/data-models\/([\w-]+)/i.exec(m?.[2] ?? "")?.[1];
+  const r = route?.resolved;
+  const known = [
+    [r?.models?.issues, "Issues"],
+    [r?.models?.comments, "Comments"],
+    [r?.models?.crew, "Crew"],
+    [r?.shipsModelId, "Ships"],
+    [r?.locksModelId, "Locks"],
+    [r?.epicsModelId, "Epics"],
+    [r?.reposModelId, "Repos"]
+  ];
+  const table2 = modelId ? known.find(([id]) => id && id === modelId)?.[1] ?? `table ${modelId}` : void 0;
+  return { method: m?.[1], path: m?.[2], table: table2, verb };
+}
+function remedyFor(d, roleName = "the agent role") {
+  if (d.table && d.verb && !(d.table === "Issues" && d.verb === "READ")) {
+    return `grant ${d.verb} on ${d.table} to ${roleName}`;
+  }
+  return SEAT_NO_READ_REMEDY;
+}
+function describeSeatForbidden(role, tables = []) {
+  const bad = tables.filter((t) => t.state === "forbidden").map((t) => t.table);
+  const what = bad.length ? bad.join(", ") : "Issues";
+  const remedy = bad.length && !(bad.length === 1 && bad[0] === "Issues") ? bad.map((t) => remedyFor({ table: t, verb: "READ" })).join("; ") : SEAT_NO_READ_REMEDY;
+  return `seat read:        ERROR ${role} agent key cannot read ${what} (403) \u2014 ${remedy}`;
+}
+function describeSeatTables(role, tables) {
+  const cells = tables.map((t) => `${t.table} ${t.state === "ok" ? "ok" : t.state === "forbidden" ? "403" : `error (${t.detail ?? "?"})`}`);
+  return `seat read:        ${role}: ${cells.join(", ")}`;
 }
 function isForbiddenError(e) {
   const status2 = e?.status;
@@ -13181,16 +13224,18 @@ function isForbiddenError(e) {
   return /\b403\b/.test(e instanceof Error ? e.message : String(e));
 }
 var SEAT_FORBIDDEN_KEY = "seat_forbidden:release";
-function seatForbiddenItem(now = /* @__PURE__ */ new Date()) {
+function seatForbiddenItem(now = /* @__PURE__ */ new Date(), e, route) {
+  const d = e === void 0 ? {} : forbiddenDetail(e, route);
+  const what = d.method && d.table ? `${d.method} ${d.table}${d.verb ? ` -> 403 No ${d.verb} access` : " -> 403"}` : "cannot read the Issues table (403)";
   return {
     kind: "seat_forbidden",
     key: SEAT_FORBIDDEN_KEY,
-    message: `release seat cannot read the Issues table (403) \u2014 ${SEAT_NO_READ_REMEDY}`,
+    message: `release seat: ${what} \u2014 ${remedyFor(d)}`,
     since: now.toISOString()
   };
 }
 function seatForbiddenRepoLine(scope) {
-  return `${scope}: skipped \u2014 release seat cannot read Issues (see attention)`;
+  return `${scope}: skipped \u2014 release seat was refused by the tracker (see attention)`;
 }
 
 // src/cli.ts
@@ -18263,7 +18308,7 @@ ${changed2.map((c) => `  - ${c}
       return summary;
     } catch (e) {
       if (isForbiddenError(e)) {
-        await raiseShipAttention({ state, emit: remit, route: c, ship: cfg.ship }, seatForbiddenItem());
+        await raiseShipAttention({ state, emit: remit, route: c, ship: cfg.ship }, seatForbiddenItem(/* @__PURE__ */ new Date(), e, c));
         const line = seatForbiddenRepoLine(scope);
         remit.warn(line, { step: "release" });
         return { scope, tests: "skipped", outcome: "error", detail: line };
@@ -19024,7 +19069,7 @@ ${changed2.map((c) => `  - ${c}
         if (!dryRun) {
           for (const p of await probeSeatReads(target, { userAgent: cfg.ship.userAgent })) {
             if (p.state === "forbidden") {
-              process.stdout.write(`${describeSeatForbidden(p.role)}
+              process.stdout.write(`${describeSeatForbidden(p.role, p.tables)}
 `);
               process.exitCode = 1;
             }
@@ -20007,7 +20052,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             for (const o of mintOutcomes) process.stderr.write(`${describeMintOutcome(o)}
 `);
             for (const p of await probeSeatReads({ ...existingRoute, resolved: { ...existingRoute.resolved, seats: found.seats } }, { userAgent: cfg.ship.userAgent })) {
-              if (p.state === "forbidden") process.stderr.write(`${describeSeatForbidden(p.role)}
+              if (p.state === "forbidden") process.stderr.write(`${describeSeatForbidden(p.role, p.tables)}
 `);
             }
           } catch (e) {
@@ -20186,7 +20231,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
               for (const m of minted) process.stderr.write(`  ${describeMintOutcome(m)}
 `);
               for (const p of await probeSeatReads(syncRoute, { userAgent: cfg.ship.userAgent })) {
-                if (p.state === "forbidden") process.stderr.write(`  ${describeSeatForbidden(p.role)}
+                if (p.state === "forbidden") process.stderr.write(`  ${describeSeatForbidden(p.role, p.tables)}
 `);
               }
               if (run2.readOnly) {
@@ -21016,7 +21061,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           baseUrl,
           workspaceId: route.resolved.workspaceId,
           apiKey,
-          keyProblem: keychainDown ? `${seatKey.kind === "ship" ? seatKey.reason : ""} \u2014 ${REMEDY["keychain-locked"]}` : void 0,
+          // Only the seat's reason: runSelftest appends the remedy itself, as for every other class.
+          keyProblem: keychainDown && seatKey.kind === "ship" ? seatKey.reason : void 0,
           workspaceName
         }));
       }
@@ -21313,7 +21359,7 @@ watermark:  ${state.watermark()}
         if (!flag("offline")) {
           for (const p of await probeSeatReads(route, { userAgent: cfg.ship.userAgent })) {
             if (p.state === "forbidden") {
-              problems.push({ severity: "blocker", kind: "seat_cannot_read_issues", route: route.route, message: `${p.role} agent key cannot read Issues (403)`, remedy: SEAT_NO_READ_REMEDY });
+              problems.push({ severity: "blocker", kind: "seat_cannot_read_issues", route: route.route, message: `${p.role} agent key refused on ${p.tables.filter((t) => t.state === "forbidden").map((t) => t.table).join(", ")} (403)`, remedy: describeSeatForbidden(p.role, p.tables).replace(/^.*?— /, "") });
             } else if (p.state === "ok") passed++;
           }
         }
@@ -21459,11 +21505,11 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       if (!flag("offline")) {
         for (const p of await probeSeatReads(roleRoute, { userAgent: cfg.ship.userAgent })) {
           if (p.state === "forbidden") {
-            process.stdout.write(`${describeSeatForbidden(p.role)}
+            process.stdout.write(`${describeSeatForbidden(p.role, p.tables)}
 `);
             process.exitCode = 1;
           } else {
-            process.stdout.write(p.state === "ok" ? `seat read:        ${p.role} can read Issues
+            process.stdout.write(p.state === "ok" ? `${describeSeatTables(p.role, p.tables)}
 ` : `seat read:        ${p.role} could not be checked (${p.detail})
 `);
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.79.1",
+  "version": "0.79.3",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",