@tablation/crew 0.79.2 → 0.79.4

package/dist/cli.js

@@ -8942,6 +8942,285 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
   return { adopted, ...interrupted ? { interrupted } : {}, ms: ms2, ticket };
 }
 
+// src/seat-keys.ts
+import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
+var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
+function keyIsAdmin(route) {
+  const role = route.resolved?.role;
+  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
+}
+var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
+var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
+var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
+function seatKeySlug(workspaceSlug, agentId) {
+  return `${workspaceSlug}#agent:${agentId}`;
+}
+function slugFor(route, agentId) {
+  const [workspaceSlug] = splitRoute(route.route);
+  return seatKeySlug(workspaceSlug, agentId);
+}
+function seatAgentId(route, role) {
+  return route.resolved?.agentPersonas?.[role]?.agentId;
+}
+async function resolveReleaseKey(route, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  const agentId = route.resolved?.releaseAgentId;
+  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
+  try {
+    const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+  } catch (e) {
+    return ship(describeReadError(e));
+  }
+}
+async function resolveSeatKey(route, role, getStore = getSessionStore2) {
+  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
+  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
+  const agentId = seatAgentId(route, role);
+  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
+  try {
+    const session = await getStore().get(hostFromUrl2(route.baseUrl), slugFor(route, agentId));
+    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
+    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
+  } catch (e) {
+    return ship(describeReadError(e));
+  }
+}
+function safeStderrLine(e) {
+  const err = e;
+  const raw = typeof err?.stderr === "string" && err.stderr.trim() ? err.stderr : typeof err?.message === "string" ? err.message : "";
+  for (const line of raw.split("\n")) {
+    const t = line.trim();
+    if (!t || /^Command failed:/i.test(t) || /(^|\s)-w(\s|$)/.test(t)) continue;
+    return t.slice(0, 120);
+  }
+  return void 0;
+}
+function describeReadError(e) {
+  const code = e?.code;
+  const line = safeStderrLine(e);
+  const what = typeof code === "number" ? `security exited ${code}` : typeof code === "string" ? `security failed: ${code}` : void 0;
+  const detail = [what, line].filter(Boolean).join(what && line ? ": " : "");
+  return detail ? `OS keychain unavailable (${detail})` : "OS keychain unavailable";
+}
+function keychainExitCode(reason) {
+  const m = /security exited (\d+)/.exec(reason);
+  return m ? Number(m[1]) : void 0;
+}
+function describeStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/User interaction is not allowed/i.test(msg)) {
+    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
+  }
+  return "keychain unavailable (could not write to the OS keychain)";
+}
+async function mintMissingSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return targets.map(({ role }) => ({
+      role,
+      action: "failed",
+      detail: describeStoreError(e)
+    }));
+  }
+  const host = hostFromUrl2(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  if (!o.dryRun) {
+    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
+    try {
+      await store.set(host, probeSlug, {
+        apiKey: "probe",
+        shipId: "",
+        workspaceId: resolved.workspaceId,
+        identityId: "_probe",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await store.clear(host, probeSlug);
+    } catch (e) {
+      const detail = `${describeStoreError(e)}; no keys minted`;
+      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
+    }
+  }
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
+    try {
+      if ((await store.get(host, slug))?.apiKey) {
+        out.push({ role, action: "already_stored" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "minted", detail: "dry run" });
+        continue;
+      }
+      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${resolveApiKey(route)}`,
+          "Content-Type": "application/json",
+          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
+        },
+        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
+      });
+      if (res.status === 403) {
+        out.push({ role, action: "forbidden" });
+        break;
+      }
+      if (!res.ok) {
+        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
+        continue;
+      }
+      const body = await res.json();
+      if (!body.key) {
+        out.push({ role, action: "failed", detail: "response carried no key" });
+        continue;
+      }
+      try {
+        const session = {
+          apiKey: body.key,
+          shipId: o.shipName ?? "",
+          workspaceId: resolved.workspaceId,
+          identityId: agentId,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...body.id ? { keyId: body.id } : {}
+        };
+        await store.set(host, slug, session);
+      } catch (e) {
+        let revoked = false;
+        if (body.id) {
+          try {
+            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+            });
+            revoked = del2.ok;
+          } catch {
+            revoked = false;
+          }
+        }
+        out.push({
+          role,
+          action: "failed",
+          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
+        });
+        continue;
+      }
+      out.push({ role, action: "minted" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+    }
+  }
+  return out;
+}
+function describeMintOutcome(o) {
+  switch (o.action) {
+    case "minted":
+      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
+    case "already_stored":
+      return `${o.role}: agent key already stored`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
+    case "forbidden":
+      return FORBIDDEN_LINE;
+    case "failed":
+      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
+  }
+}
+async function revokeSeatKeys(route, o) {
+  const out = [];
+  if (!route.resolved) return out;
+  const resolved = route.resolved;
+  const doFetch = o.fetchImpl ?? fetch;
+  const targets = [
+    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
+    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
+  ];
+  let store;
+  try {
+    store = (o.getStore ?? getSessionStore2)();
+  } catch (e) {
+    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
+  }
+  const host = hostFromUrl2(route.baseUrl);
+  const base = route.baseUrl.replace(/\/+$/, "");
+  for (const { role, agentId } of targets) {
+    if (!agentId) {
+      out.push({ role, action: "no_agent" });
+      continue;
+    }
+    const slug = slugFor(route, agentId);
+    try {
+      const session = await store.get(host, slug);
+      if (!session?.apiKey) {
+        out.push({ role, action: "not_stored" });
+        continue;
+      }
+      if (!session.keyId) {
+        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
+        continue;
+      }
+      if (o.dryRun) {
+        out.push({ role, action: "revoked", detail: "dry run" });
+        continue;
+      }
+      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+      });
+      if (!del2.ok && del2.status !== 404) {
+        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
+        continue;
+      }
+      await store.clear(host, slug);
+      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
+    } catch (e) {
+      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
+    }
+  }
+  return out;
+}
+function describeRevokeOutcome(o) {
+  switch (o.action) {
+    case "revoked":
+      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
+    case "not_stored":
+      return `${o.role}: no agent key stored on this ship`;
+    case "no_agent":
+      return `${o.role}: no linked Agents row`;
+    case "failed":
+      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
+  }
+}
+async function canMintAgentKeys(route, o = {}) {
+  const resolved = route.resolved;
+  if (!resolved) return void 0;
+  const agentId = seatAgentId(route, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route, r)).find(Boolean);
+  if (!agentId) return void 0;
+  try {
+    const res = await (o.fetchImpl ?? fetch)(`${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
+      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+    });
+    if (res.ok) return true;
+    return res.status === 403 ? false : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/selftest.ts
 var SELFTEST_TIMEOUT_MS = 12e4;
 var KEY_VAR = "CREW_API_KEY";
@@ -9052,6 +9331,7 @@ var REMEDY = {
   "mcp-unavailable": "register the tracker MCP server (`crew doctor` shows how), then re-run `crew selftest`",
   "key-refused": "the dev seat's key was refused \u2014 ask a workspace admin to mint a fresh one (`crew agents sync`)",
   "keychain-locked": "unlock the OS keychain from a logged-in session (`security unlock-keychain`), then re-run",
+  "keychain-error": "run `security find-generic-password -s com.tablation.cli -g` by hand, and check `security list-keychains -d user` and `security default-keychain -d user`",
   timeout: "the harness did not answer in time \u2014 run it by hand to see where it stalls",
   "wrong-answer": "the agent answered but did not name the workspace \u2014 run it by hand to see what it said"
 };
@@ -9085,7 +9365,10 @@ async function runSelftest(i, deps = realDeps) {
   const base = { toolchain: spec.name, harness: spec.harness, model: spec.model };
   const finish = (r) => ({ ...base, ...r, ms: now() - started, ranAt: new Date(started).toISOString() });
   const failed = (failure, what) => finish({ ok: false, failure, detail: `${what} \u2014 ${REMEDY[failure]}` });
-  if (!i.apiKey) return failed("keychain-locked", i.keyProblem ?? "no seat key could be read");
+  if (!i.apiKey) {
+    const locked = keychainExitCode(i.keyProblem ?? "") === 36;
+    return failed(locked ? "keychain-locked" : "keychain-error", i.keyProblem ?? "no seat key could be read");
+  }
   const adapter = adapterFor(spec.harness);
   const invocation = adapter.invocation(spec, { role: "dev", model: spec.model, mcp: { url: `${i.baseUrl.replace(/\/+$/, "")}/api/mcp`, keyVar: KEY_VAR } });
   const env = {
@@ -9412,7 +9695,7 @@ async function signOutSessions(o) {
 // src/reset.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync12, readFileSync as readFileSync19, readdirSync as readdirSync7, rmSync as rmSync11, statSync as statSync6, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname9, join as join22 } from "path";
-import { hostFromUrl as hostFromUrl2 } from "@tablation/client";
+import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
   return join22(stateDir, "cloned-checkouts.json");
 }
@@ -9458,7 +9741,7 @@ async function runReset(o, fx) {
       steps.push({ step: "credential", target: route.route, action: "failed", detail: e.message });
     }
   }
-  const covered = new Set([...o.routes, ...o.droppedRoutes ?? []].map((r) => `${hostFromUrl2(r.baseUrl)}/${splitRoute(r.route)[0]}`));
+  const covered = new Set([...o.routes, ...o.droppedRoutes ?? []].map((r) => `${hostFromUrl3(r.baseUrl)}/${splitRoute(r.route)[0]}`));
   try {
     for (const s of await fx.hostSessions(o.stateDir)) {
       const target = `${s.host}/${s.workspace}`;
@@ -12887,264 +13170,6 @@ function formatWhoami(report) {
 `;
 }
 
-// src/seat-keys.ts
-import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl3 } from "@tablation/client";
-var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
-function keyIsAdmin(route) {
-  const role = route.resolved?.role;
-  return role === void 0 || role === "WORKSPACE_ADMIN" || role === "PLATFORM_ADMIN";
-}
-var MEMBER_NO_ROW = "has no linked Agents row \u2014 a workspace admin's `crew agents sync` creates the persona rows; run it here afterwards to link this ship's seats";
-var MEMBER_NO_KEY = 'no agent key for this seat \u2014 run `crew agents sync` (needs the "Mint agent keys" capability on your role)';
-var FORBIDDEN_LINE = 'seat keys: not minted \u2014 your role does not grant "Mint agent keys"; ask a workspace admin to add it to your project role (or run sync with an admin key)';
-function seatKeySlug(workspaceSlug, agentId) {
-  return `${workspaceSlug}#agent:${agentId}`;
-}
-function slugFor(route, agentId) {
-  const [workspaceSlug] = splitRoute(route.route);
-  return seatKeySlug(workspaceSlug, agentId);
-}
-function seatAgentId(route, role) {
-  return route.resolved?.agentPersonas?.[role]?.agentId;
-}
-async function resolveReleaseKey(route, getStore = getSessionStore2) {
-  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
-  const agentId = route.resolved?.releaseAgentId;
-  if (!agentId) return ship(keyIsAdmin(route) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
-  try {
-    const session = await getStore().get(hostFromUrl3(route.baseUrl), slugFor(route, agentId));
-    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship(keyIsAdmin(route) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
-  } catch {
-    return ship("OS keychain unavailable");
-  }
-}
-async function resolveSeatKey(route, role, getStore = getSessionStore2) {
-  const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route), reason });
-  if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
-  const agentId = seatAgentId(route, role);
-  if (!agentId) return ship(keyIsAdmin(route) ? "seat has no linked Agents row (run `crew agents sync`)" : `seat ${MEMBER_NO_ROW}`);
-  try {
-    const session = await getStore().get(hostFromUrl3(route.baseUrl), slugFor(route, agentId));
-    if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
-    return ship(keyIsAdmin(route) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
-  } catch {
-    return ship("OS keychain unavailable");
-  }
-}
-function describeStoreError(e) {
-  const msg = e instanceof Error ? e.message : String(e);
-  if (/User interaction is not allowed/i.test(msg)) {
-    return "keychain unavailable (User interaction is not allowed \u2014 run from a logged-in session, or `security unlock-keychain` first)";
-  }
-  return "keychain unavailable (could not write to the OS keychain)";
-}
-async function mintMissingSeatKeys(route, o) {
-  const out = [];
-  if (!route.resolved) return out;
-  const resolved = route.resolved;
-  const doFetch = o.fetchImpl ?? fetch;
-  const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
-  ];
-  let store;
-  try {
-    store = (o.getStore ?? getSessionStore2)();
-  } catch (e) {
-    return targets.map(({ role }) => ({
-      role,
-      action: "failed",
-      detail: describeStoreError(e)
-    }));
-  }
-  const host = hostFromUrl3(route.baseUrl);
-  const base = route.baseUrl.replace(/\/+$/, "");
-  if (!o.dryRun) {
-    const probeSlug = seatKeySlug(splitRoute(route.route)[0], "_probe");
-    try {
-      await store.set(host, probeSlug, {
-        apiKey: "probe",
-        shipId: "",
-        workspaceId: resolved.workspaceId,
-        identityId: "_probe",
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      await store.clear(host, probeSlug);
-    } catch (e) {
-      const detail = `${describeStoreError(e)}; no keys minted`;
-      return targets.map(({ role, agentId }) => agentId ? { role, action: "failed", detail } : { role, action: "no_agent" });
-    }
-  }
-  for (const { role, agentId } of targets) {
-    if (!agentId) {
-      out.push({ role, action: "no_agent" });
-      continue;
-    }
-    const slug = slugFor(route, agentId);
-    try {
-      if ((await store.get(host, slug))?.apiKey) {
-        out.push({ role, action: "already_stored" });
-        continue;
-      }
-      if (o.dryRun) {
-        out.push({ role, action: "minted", detail: "dry run" });
-        continue;
-      }
-      const res = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${resolveApiKey(route)}`,
-          "Content-Type": "application/json",
-          "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0"
-        },
-        body: JSON.stringify({ name: `crew ${o.shipName ?? "ship"} ${role}` })
-      });
-      if (res.status === 403) {
-        out.push({ role, action: "forbidden" });
-        break;
-      }
-      if (!res.ok) {
-        out.push({ role, action: "failed", detail: `${res.status} ${res.statusText}` });
-        continue;
-      }
-      const body = await res.json();
-      if (!body.key) {
-        out.push({ role, action: "failed", detail: "response carried no key" });
-        continue;
-      }
-      try {
-        const session = {
-          apiKey: body.key,
-          shipId: o.shipName ?? "",
-          workspaceId: resolved.workspaceId,
-          identityId: agentId,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          ...body.id ? { keyId: body.id } : {}
-        };
-        await store.set(host, slug, session);
-      } catch (e) {
-        let revoked = false;
-        if (body.id) {
-          try {
-            const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${body.id}`, {
-              method: "DELETE",
-              headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-            });
-            revoked = del2.ok;
-          } catch {
-            revoked = false;
-          }
-        }
-        out.push({
-          role,
-          action: "failed",
-          detail: revoked ? `minted but could not be stored (${describeStoreError(e)}); revoked` : `a key for ${role} is live on the server and not stored (${describeStoreError(e)}) \u2014 revoke it from that seat's Agents row`
-        });
-        continue;
-      }
-      out.push({ role, action: "minted" });
-    } catch (e) {
-      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
-    }
-  }
-  return out;
-}
-function describeMintOutcome(o) {
-  switch (o.action) {
-    case "minted":
-      return `${o.role}: agent key minted${o.detail ? ` (${o.detail})` : ""}`;
-    case "already_stored":
-      return `${o.role}: agent key already stored`;
-    case "no_agent":
-      return `${o.role}: no linked Agents row \u2014 writes as the ship until \`crew agents sync\` links one`;
-    case "forbidden":
-      return FORBIDDEN_LINE;
-    case "failed":
-      return `${o.role}: could not mint an agent key (${o.detail ?? "unknown"}) \u2014 writes as the ship`;
-  }
-}
-async function revokeSeatKeys(route, o) {
-  const out = [];
-  if (!route.resolved) return out;
-  const resolved = route.resolved;
-  const doFetch = o.fetchImpl ?? fetch;
-  const targets = [
-    ...SEAT_KEY_ROLES.filter((r) => resolved.seats[r]).map((role) => ({ role, agentId: seatAgentId(route, role) })),
-    ...resolved.releaseSeat ? [{ role: "release", agentId: resolved.releaseAgentId }] : []
-  ];
-  let store;
-  try {
-    store = (o.getStore ?? getSessionStore2)();
-  } catch (e) {
-    return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
-  }
-  const host = hostFromUrl3(route.baseUrl);
-  const base = route.baseUrl.replace(/\/+$/, "");
-  for (const { role, agentId } of targets) {
-    if (!agentId) {
-      out.push({ role, action: "no_agent" });
-      continue;
-    }
-    const slug = slugFor(route, agentId);
-    try {
-      const session = await store.get(host, slug);
-      if (!session?.apiKey) {
-        out.push({ role, action: "not_stored" });
-        continue;
-      }
-      if (!session.keyId) {
-        out.push({ role, action: "failed", detail: "no key id was recorded when this key was minted \u2014 revoke it from the seat's Agents row" });
-        continue;
-      }
-      if (o.dryRun) {
-        out.push({ role, action: "revoked", detail: "dry run" });
-        continue;
-      }
-      const del2 = await doFetch(`${base}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys/${session.keyId}`, {
-        method: "DELETE",
-        headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-      });
-      if (!del2.ok && del2.status !== 404) {
-        out.push({ role, action: "failed", detail: `${del2.status} ${del2.statusText}` });
-        continue;
-      }
-      await store.clear(host, slug);
-      out.push({ role, action: "revoked", detail: del2.ok ? void 0 : "server already had no such key" });
-    } catch (e) {
-      out.push({ role, action: "failed", detail: /Command failed|security|sk_|-w /i.test(e.message) ? describeStoreError(e) : e.message });
-    }
-  }
-  return out;
-}
-function describeRevokeOutcome(o) {
-  switch (o.action) {
-    case "revoked":
-      return `${o.role}: agent key revoked and cleared from the keychain${o.detail ? ` (${o.detail})` : ""}`;
-    case "not_stored":
-      return `${o.role}: no agent key stored on this ship`;
-    case "no_agent":
-      return `${o.role}: no linked Agents row`;
-    case "failed":
-      return `${o.role}: could not revoke the agent key (${o.detail ?? "unknown"}) \u2014 left in the keychain`;
-  }
-}
-async function canMintAgentKeys(route, o = {}) {
-  const resolved = route.resolved;
-  if (!resolved) return void 0;
-  const agentId = seatAgentId(route, "dev") ?? SEAT_KEY_ROLES.map((r) => seatAgentId(route, r)).find(Boolean);
-  if (!agentId) return void 0;
-  try {
-    const res = await (o.fetchImpl ?? fetch)(`${route.baseUrl.replace(/\/+$/, "")}/api/workspaces/${resolved.workspaceId}/agents/${agentId}/api-keys`, {
-      headers: { Authorization: `Bearer ${resolveApiKey(route)}`, "User-Agent": o.userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-    });
-    if (res.ok) return true;
-    return res.status === 403 ? false : void 0;
-  } catch {
-    return void 0;
-  }
-}
-
 // src/seat-read-probe.ts
 var SEAT_NO_READ_REMEDY = "the project has no default role for agent keys \u2014 update the Issues app's template, then re-mint with `crew agents sync --revoke-seat-keys`, or assign the Crew seat role to the agent members";
 function probeTables(route) {
@@ -21061,7 +21086,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           baseUrl,
           workspaceId: route.resolved.workspaceId,
           apiKey,
-          keyProblem: keychainDown ? `${seatKey.kind === "ship" ? seatKey.reason : ""} \u2014 ${REMEDY["keychain-locked"]}` : void 0,
+          // Only the seat's reason: runSelftest appends the remedy itself, as for every other class.
+          keyProblem: keychainDown && seatKey.kind === "ship" ? seatKey.reason : void 0,
           workspaceName
         }));
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.79.2",
+  "version": "0.79.4",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",