@tablation/crew 0.8.0 → 0.10.0

package/README.md

@@ -213,8 +213,8 @@ crew inbox [--member NAME]    your tickets across every workspace
 crew connect WS[/PROJECT]     resolve a workspace/project's ids into the state tree
 crew repos add [ROUTE] [NAME] [PATH]  attach a local checkout to a route in crew.yaml, creating its Repos row if missing (--dry-run previews)
 crew repos list ROUTE         the checkouts a route has, and the tracker Repos row each matches
-crew install                  write and load this platform's scheduler unit
-crew uninstall                unload and remove it
+crew install [--replace]     write and load this platform's scheduler unit (macOS: clears a crew installed from another path)
+crew uninstall [--all]        unload and remove it (--all: every crew launchd unit, whichever path it came from)
 ```
 
 Every command that could change something takes `--dry-run`.

package/dist/cli.js

@@ -1930,7 +1930,7 @@ function describeRelease(o, route) {
 // src/install.ts
 import { dirname as dirname3, join as join5, extname } from "path";
 import { homedir as homedir2 } from "os";
-import { accessSync, constants, existsSync as existsSync5, mkdirSync as mkdirSync3, statSync as statSync2, writeFileSync as writeFileSync2, unlinkSync, realpathSync } from "fs";
+import { accessSync, constants, existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync2, unlinkSync, realpathSync } from "fs";
 import { spawnSync } from "child_process";
 import { createHash } from "crypto";
 
@@ -2164,7 +2164,8 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
       mechanism: "launchd",
       unitPaths: [unitPath],
       crontabLine: null,
-      unloadCommands: [["launchctl", "unload", unitPath]]
+      unloadCommands: [["launchctl", "unload", unitPath]],
+      removeLabel: label
     };
   }
   if (hostShip === "linux" && hasSystemd) {
@@ -2282,6 +2283,15 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
       if (!ok) log.warn("unload command failed \u2014 it may not have been loaded; continuing to remove files");
     }
   }
+  if (plan.removeLabel) {
+    if (dryRun) {
+      log.emit(`would run: launchctl remove ${plan.removeLabel}`);
+    } else {
+      if (spawnSync("launchctl", ["remove", plan.removeLabel], { encoding: "utf8" }).status === 0) {
+        log.emit(`removed loaded job ${plan.removeLabel}`);
+      }
+    }
+  }
   for (const path of plan.unitPaths) {
     if (!existsSync5(path)) continue;
     if (dryRun) {
@@ -2300,6 +2310,91 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
     }
   }
 }
+var CREW_LAUNCHD_PREFIX = "com.tablation.crew";
+function launchAgentsDir() {
+  return join5(homedir2(), "Library", "LaunchAgents");
+}
+function xmlUnescape(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+function programFromPlist(text) {
+  const block = /<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(text);
+  if (!block) return null;
+  const args = [...block[1].matchAll(/<string>([\s\S]*?)<\/string>/g)].map((m) => xmlUnescape(m[1]));
+  return args.find((a) => a.endsWith("/bin/crew")) ?? args[0] ?? null;
+}
+function listLaunchdUnits(dir = launchAgentsDir()) {
+  if (!existsSync5(dir)) return [];
+  return readdirSync(dir).filter((f) => f.startsWith(CREW_LAUNCHD_PREFIX) && f.endsWith(".plist")).sort().map((f) => {
+    const plistPath = join5(dir, f);
+    let program = null;
+    try {
+      program = programFromPlist(readFileSync5(plistPath, "utf8"));
+    } catch {
+    }
+    return {
+      label: f.slice(0, -".plist".length),
+      plistPath,
+      program,
+      programExists: program !== null && existsSync5(program)
+    };
+  });
+}
+function foreignLaunchdUnits(crewHome, dir) {
+  const own = new Set(["run", "release", "passengers"].map((job) => labelFor(crewHome, job)));
+  return listLaunchdUnits(dir).filter((u) => !own.has(u.label));
+}
+function removeLaunchdUnit(unit, dryRun, log) {
+  if (dryRun) {
+    log.emit(`would unload and remove ${unit.label}`);
+    return;
+  }
+  if (existsSync5(unit.plistPath)) spawnSync("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
+  spawnSync("launchctl", ["remove", unit.label], { encoding: "utf8" });
+  if (existsSync5(unit.plistPath)) unlinkSync(unit.plistPath);
+  log.emit(`removed ${unit.label} (${unit.plistPath})`);
+}
+function clearForeignLaunchdUnits(crewHome, replace, dryRun, log, dir) {
+  const foreign = foreignLaunchdUnits(crewHome, dir);
+  const blocking = foreign.filter((u) => u.program === null || u.programExists);
+  if (blocking.length > 0 && !replace) {
+    log.warn(
+      `two crew installs target this machine: ${blocking.map((u) => `${u.label} runs ${u.program ?? "an unreadable ProgramArguments"}`).join("; ")}. Run \`crew uninstall\` from the other one, or pass --replace.`
+    );
+    return false;
+  }
+  for (const unit of foreign) {
+    const why = unit.program === null ? "replacing a unit with no readable ProgramArguments" : unit.programExists ? "replacing a live other install" : "removing a stale unit whose program is gone";
+    log.emit(`${why}: ${unit.label}`);
+    removeLaunchdUnit(unit, dryRun, log);
+  }
+  return true;
+}
+function removeAllLaunchdUnits(dryRun, log, dir) {
+  for (const unit of listLaunchdUnits(dir)) removeLaunchdUnit(unit, dryRun, log);
+}
+function parseLaunchctlList(text) {
+  const jobs = /* @__PURE__ */ new Map();
+  for (const line of text.split("\n")) {
+    const cols = line.split("	");
+    if (cols.length !== 3 || cols[2] === "Label") continue;
+    jobs.set(cols[2], { pid: cols[0], lastExit: cols[1] });
+  }
+  return jobs;
+}
+function describeForeignLaunchdUnits(crewHome, dir) {
+  const foreign = foreignLaunchdUnits(crewHome, dir);
+  if (foreign.length === 0) return [];
+  const list = spawnSync("launchctl", ["list"], { encoding: "utf8" });
+  const jobs = parseLaunchctlList(list.status === 0 ? list.stdout ?? "" : "");
+  return foreign.map((u) => {
+    const status2 = jobs.get(u.label);
+    const loaded = status2 ? `loaded, last exit ${status2.lastExit}` : "not loaded";
+    const program = u.program ? `${u.program} (${u.programExists ? "present" : "GONE"})` : "no readable ProgramArguments";
+    const stale = status2 && !u.programExists ? " \u2014 stale: `crew install` removes it" : "";
+    return `  ${u.label}: ${loaded}; runs ${program}${stale}`;
+  });
+}
 function readCrontab() {
   const res = spawnSync("crontab", ["-l"], { encoding: "utf8" });
   return res.status === 0 ? res.stdout ?? "" : "";
@@ -3860,6 +3955,13 @@ function fastForward(cwd, branch) {
   if (!s.canFastForward) return false;
   return gitOk(cwd, ["merge", "--ff-only", s.upstream]) !== null;
 }
+function baseBranchUnsafe(r) {
+  return r.action === "diverged" || r.action === "ahead" || r.action === "ff-failed";
+}
+function describeUnsafeBase(r, remote, base) {
+  const counts = r.action === "diverged" ? `${r.ahead} ahead, ${r.behind} behind ${remote}/${base}` : r.action === "ahead" ? `${r.ahead} ahead of ${remote}/${base}` : `${r.behind} behind ${remote}/${base}, cannot fast-forward`;
+  return `${r.detail} [${counts}] \u2014 reconcile it (\`crew sync\` afterwards), or \`git reset --hard ${remote}/${base}\` if the local commits duplicate a release`;
+}
 function refreshBaseBranch(cwd, remote, base, dryRun = false) {
   if (currentBranch(cwd) !== base || status(cwd).length > 0) {
     return { action: "not-applicable", detail: `${cwd} is not on a clean ${base}` };
@@ -3886,6 +3988,9 @@ function refreshBaseBranch(cwd, remote, base, dryRun = false) {
       detail: `${base} has diverged from ${upstream} (${ahead} ahead, ${behind} behind)`
     };
   }
+  if (behind === 0 && ahead > 0) {
+    return { action: "ahead", ahead, detail: `${base} has ${ahead} commit(s) ${upstream} does not` };
+  }
   if (behind === 0) return { action: "level", detail: `${base} is level with ${upstream}` };
   if (dryRun) {
     return { action: "would-fast-forward", behind, detail: `would fast-forward ${base}: ${behind} behind ${upstream}` };
@@ -4511,7 +4616,7 @@ var alreadyReported = (ticket, g, comments) => comments.some((c) => c.ticket_id
 
 // src/agent.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync5, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, createWriteStream } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, createWriteStream } from "fs";
 import { finished } from "stream/promises";
 import { join as join7, dirname as dirname5 } from "path";
 import { createHash as createHash2 } from "crypto";
@@ -4954,10 +5059,10 @@ function planAgentRun(o) {
   let ageSeconds;
   if (existsSync7(digestPath2)) {
     ageSeconds = Math.floor((now() - statSync4(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync5(digestPath2, "utf8");
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync6(digestPath2, "utf8");
   }
-  const common = readFileSync5(commonPath, "utf8");
-  const brief = readFileSync5(briefPath, "utf8");
+  const common = readFileSync6(commonPath, "utf8");
+  const brief = readFileSync6(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = o.divergedPrompt ?? brief;
   const prompt = assemblePrompt({
@@ -5337,7 +5442,7 @@ Wrote ${o.configPath}.
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
 import { join as join9 } from "path";
 
 // src/release.ts
@@ -5802,7 +5907,7 @@ async function bump(o, size) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync6(first, "utf8")).version;
+  const current = JSON.parse(readFileSync7(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -5815,7 +5920,7 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync6(f, "utf8");
+    const src = readFileSync7(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
@@ -5834,7 +5939,7 @@ function writeChangelog(o, version, entries) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync9(path) ? readFileSync6(path, "utf8") : "# Changelog\n";
+  const existing = existsSync9(path) ? readFileSync7(path, "utf8") : "# Changelog\n";
   writeFileSync6(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
@@ -5884,9 +5989,13 @@ function refreshBase(o) {
     // base. Fast-forwarding is impossible and merging would be this crew
     // inventing a resolution nobody asked for, on the branch everything
     // ships from.
+    // AHEAD is a stop too (CREW-1379): local commits nobody asked for on the
+    // base are how a second ship's release came to diverge from origin's.
+    // Releasing on top of a hand commit is the failure; reconcile it first.
+    case "ahead":
     case "diverged":
     case "ff-failed":
-      return { ok: false, why: r.detail };
+      return { ok: false, why: describeUnsafeBase(r, o.repo.branch.remote, o.repo.branch.base) };
   }
 }
 async function reconfirmLastRelease(o, decision) {
@@ -6682,7 +6791,7 @@ function nextRoles(decision, ran) {
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync7, existsSync as existsSync12 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync12 } from "fs";
 import { join as join11 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError6, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
@@ -6699,10 +6808,10 @@ var AgentsSyncError = class extends Error {
 function personaDefaultPrompt(promptsDir, role) {
   const briefPath = join11(promptsDir, "personas", `lane-${role}.md`);
   if (!existsSync12(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (role === "pair") return readFileSync7(briefPath, "utf8");
+  if (role === "pair") return readFileSync8(briefPath, "utf8");
   const commonPath = join11(promptsDir, "personas", "common.md");
   if (!existsSync12(commonPath)) throw new AgentsSyncError(`no shared policy at ${commonPath}`);
-  return `${readFileSync7(commonPath, "utf8")}${readFileSync7(briefPath, "utf8")}`;
+  return `${readFileSync8(commonPath, "utf8")}${readFileSync8(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route, role, opts) {
   const cached = route.resolved?.agentPersonas?.[role]?.agentId;
@@ -7323,14 +7432,14 @@ import {
 } from "@tablation/client";
 
 // src/skills.ts
-import { readFileSync as readFileSync8, readdirSync, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync9, readdirSync as readdirSync2, existsSync as existsSync13 } from "fs";
 import { join as join12 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError7, TablationApiError as TablationApiError2 } from "@tablation/client";
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text = readFileSync8(path, "utf8");
+  const text = readFileSync9(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -7345,7 +7454,7 @@ function parseSkillFile(path) {
 function listLocalSkills(promptsDir) {
   const dir = join12(promptsDir, "skills");
   if (!existsSync13(dir)) return [];
-  return readdirSync(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join12(dir, f)));
+  return readdirSync2(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join12(dir, f)));
 }
 async function syncSkills(route, opts) {
   if (!route.resolved) {
@@ -7670,7 +7779,7 @@ function resolveRepoProject(projects, opt, routeAreaId) {
 
 // src/claude-mcp.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join13 } from "path";
 var MCP_SERVER_NAME = "tablation";
@@ -7685,7 +7794,7 @@ function runClaude(bin, args) {
 }
 function userScopeEntry(home) {
   try {
-    const j = JSON.parse(readFileSync9(join13(home, ".claude.json"), "utf8"));
+    const j = JSON.parse(readFileSync10(join13(home, ".claude.json"), "utf8"));
     return j.mcpServers?.[MCP_SERVER_NAME];
   } catch {
     return void 0;
@@ -7884,14 +7993,14 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync15, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync6 } from "fs";
+import { existsSync as existsSync15, readdirSync as readdirSync3, rmSync as rmSync2, statSync as statSync6 } from "fs";
 import { join as join14 } from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join14(stateDir, "streams");
   if (!existsSync15(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS;
-  return readdirSync2(dir).map((name) => join14(dir, name)).filter((path) => {
+  return readdirSync3(dir).map((name) => join14(dir, name)).filter((path) => {
     try {
       return statSync6(path).mtimeMs < cutoff;
     } catch {
@@ -7918,13 +8027,13 @@ function applyStreamSweep(paths, dryRun, log) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync13, existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, copyFileSync, renameSync } from "fs";
+import { readFileSync as readFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, copyFileSync, renameSync } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync10, chmodSync } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync11, chmodSync } from "fs";
 import { dirname as dirname8, join as join15 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -7958,7 +8067,7 @@ function ensureShipSshKeypair(stateDir) {
   if (!existsSync16(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync10(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync11(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -8172,7 +8281,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync4 } from "fs";
 import { randomInt } from "crypto";
 import { join as join16 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -8247,7 +8356,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
   if (!existsSync17(path)) return void 0;
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -8354,7 +8463,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join16(stateDir, "passengers");
   if (!existsSync17(dir)) return [];
-  return readdirSync3(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
+  return readdirSync4(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
 // src/mcp-endpoint-registry.ts
@@ -8474,7 +8583,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn4 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync8, unlinkSync as unlinkSync4, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync8, unlinkSync as unlinkSync4, readdirSync as readdirSync5 } from "fs";
 import { join as join17 } from "path";
 
 // src/secret-compare.ts
@@ -8570,7 +8679,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
   if (!existsSync18(path)) return void 0;
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -8601,7 +8710,7 @@ function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join17(stateDir, "passengers");
   if (!existsSync18(dir)) return [];
   const suffix = "-sync.json";
-  return readdirSync4(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
+  return readdirSync5(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
 function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
@@ -8656,7 +8765,7 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 }
 
 // src/daemon.ts
-import { readdirSync as readdirSync5, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync6, statSync as statSync7 } from "fs";
 import { join as join18 } from "path";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
@@ -8695,7 +8804,7 @@ function latestMtime(path) {
   if (stat.isFile()) return stat.mtimeMs;
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
-  for (const entry of readdirSync5(path, { withFileTypes: true })) {
+  for (const entry of readdirSync6(path, { withFileTypes: true })) {
     latest = Math.max(latest, latestMtime(join18(path, entry.name)));
   }
   return latest;
@@ -9175,6 +9284,11 @@ if (command === "passenger-sync-daemon") {
     if (!why) return false;
     emit.emit(`${why} \u2014 release skipped`, { step: "release" });
     return true;
+  }, baseHealth = function(r) {
+    const { remote, base } = r.config.branch;
+    const out = refreshBaseBranch(r.dir, remote, base, true);
+    const unsafe = baseBranchUnsafe(out);
+    return { action: out.action, unsafe, detail: unsafe ? describeUnsafeBase(out, remote, base) : out.detail };
   }, reportUnplaceable = function(c, unplaceable, verified, emit2) {
     if (unplaceableReported.has(c.route)) return;
     unplaceableReported.add(c.route);
@@ -9183,7 +9297,7 @@ if (command === "passenger-sync-daemon") {
       else emit2.emit(note.message, { step: "release" });
     }
   };
-  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, reportUnplaceable2 = reportUnplaceable;
+  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, baseHealth2 = baseHealth, reportUnplaceable2 = reportUnplaceable;
   let cfg;
   let firstRun;
   try {
@@ -9374,12 +9488,21 @@ if (command === "passenger-sync-daemon") {
     const trimmed = typeof raw === "string" ? raw.trim() : "";
     return trimmed ? `${trimmed.toLowerCase()}-` : void 0;
   }
-  async function installScheduler() {
+  async function installScheduler(opts = {}) {
     const host = hostPlatform();
     if (host === "windows") {
       process.stderr.write("crew install: no scheduler support yet for Windows (Task Scheduler is planned, not built)\n");
       process.exit(2);
     }
+    if (host === "macos") {
+      const ok = clearForeignLaunchdUnits(CREW_HOME, !!opts.replace, dryRun, {
+        emit: (m) => process.stdout.write(`${m}
+`),
+        warn: (m) => process.stderr.write(`crew install: ${m}
+`)
+      });
+      if (!ok) return false;
+    }
     const installPathProblem = cfg.routes.some((r) => r.enabled && r.hostPassengers) ? dockerPathProblem(cfg.ship) : void 0;
     if (installPathProblem) {
       process.stderr.write(`crew install: Host Passengers is on but ${installPathProblem}
@@ -9431,6 +9554,7 @@ if (command === "passenger-sync-daemon") {
         }
       }
     }
+    return true;
   }
   async function routeProblems(c) {
     const host = hostPlatform();
@@ -9477,14 +9601,13 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync9(cfg.configFile, planEnable(readFileSync13(cfg.configFile, "utf8"), a.route));
+          writeFileSync9(cfg.configFile, planEnable(readFileSync14(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
           if (enabledSound.size === 0) continue;
           if (prompter && !await prompter.confirm("No scheduler is installed for this ship \u2014 run `crew install` now?", false)) continue;
-          await installScheduler();
-          changed2.push("ran `crew install` (scheduler units written and loaded)");
+          if (await installScheduler()) changed2.push("ran `crew install` (scheduler units written and loaded)");
         }
       }
     } finally {
@@ -10376,7 +10499,7 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync13(resolvedPath, "utf8")) : {};
+        const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
         raw.agentSkills = skillResult.agentSkills;
         mkdirSync10(dirOf(resolvedPath), { recursive: true });
@@ -10425,7 +10548,7 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync13(resolvedPath, "utf8")) : {};
+        const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync10(dirOf(resolvedPath), { recursive: true });
         writeFileSync9(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -10441,7 +10564,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list") usage2();
-      const configText = readFileSync13(cfg.configFile, "utf8");
+      const configText = readFileSync14(cfg.configFile, "utf8");
       let routeName = positional[2];
       let addPath = ".";
       let addName;
@@ -10465,7 +10588,7 @@ ${changed2.map((c) => `  - ${c}
       let resolvedRemotes;
       if (existsSync19(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync13(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync14(resolvedFile, "utf8"));
         } catch {
         }
       }
@@ -10536,7 +10659,7 @@ ${changed2.map((c) => `  - ${c}
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
           if (existsSync19(resolvedFile)) {
-            const raw = JSON.parse(readFileSync13(resolvedFile, "utf8"));
+            const raw = JSON.parse(readFileSync14(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
             writeFileSync9(resolvedFile, `${JSON.stringify(raw, null, 2)}
@@ -10771,7 +10894,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const hadPreviousFile = existsSync19(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync13(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync14(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -11214,14 +11337,16 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       let acted = 0;
       let baseChecked = 0;
       let baseActed = 0;
+      let baseUnsafe = 0;
       for (const r of await resolvedRepos(route)) {
         const base = refreshBaseBranch(r.dir, r.config.branch.remote, r.config.branch.base, dryRun);
         if (base.action !== "not-applicable") {
           baseChecked++;
           if (base.action === "fetch-failed") emit.warn(base.detail);
-          else if (base.action === "diverged" || base.action === "ff-failed") {
+          else if (baseBranchUnsafe(base)) {
             baseActed++;
-            emit.warn(base.detail);
+            baseUnsafe++;
+            emit.error(`${r.name}: DO NOT CUT A WORKTREE FROM THIS BASE \u2014 ${describeUnsafeBase(base, r.config.branch.remote, r.config.branch.base)}`);
           } else if (base.action === "would-fast-forward" || base.action === "fast-forwarded") {
             baseActed++;
             emit.emit(base.detail);
@@ -11253,6 +11378,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
       }
+      if (baseUnsafe > 0) process.exitCode = 1;
       if (baseChecked > 0 && baseActed === 0) emit.emit(`${baseChecked} base branch(es) checked, all level with the remote`);
       if (tracked === 0) emit.emit("no worktree tracks a remote branch \u2014 nothing to sync");
       else if (acted === 0) emit.emit(`${tracked} worktree(s) tracking a remote, all level with it`);
@@ -11274,7 +11400,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       break;
     }
     case "install": {
-      await installScheduler();
+      if (!await installScheduler({ replace: flag("replace") })) process.exit(2);
       break;
     }
     case "uninstall": {
@@ -11291,6 +11417,16 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           emit: (m) => process.stdout.write(`${m}
 `),
           warn: (m) => process.stderr.write(`crew uninstall: ${m}
+`)
+        });
+      }
+      if (flag("all") && host === "macos") {
+        process.stdout.write(`uninstalling every crew launchd unit${dryRun ? " (dry run)" : ""}
+`);
+        removeAllLaunchdUnits(dryRun, {
+          emit: (m) => process.stdout.write(`${m}
+`),
+          warn: (m) => process.stderr.write(`crew uninstall: ${m}
 `)
         });
       }
@@ -11302,7 +11438,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
     }
     case "log": {
       try {
-        const text = readFileSync13(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync14(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -11373,6 +11509,9 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             repos: repos.map((r) => ({
               name: r.name,
               dir: r.dir,
+              // Additive (CREW-1379): `unsafe` means a ship must not cut a
+              // worktree or release from this base. `version` stays 1.
+              baseBranch: baseHealth(r),
               worktreePrefix: r.config.worktrees.prefix,
               // A repo with no explicit `worktrees.prefix` no longer names its
               // worktrees `<prefix><number>` (ISSUE-969) — the checkout's own
@@ -11413,6 +11552,11 @@ watermark:  ${state.watermark()}
       }
       for (const i of openShipAttention(state)) {
         process.stdout.write(`attention:  ${i.kind} \u2014 ${i.message}
+`);
+      }
+      for (const r of await resolvedRepos(route)) {
+        const bh = baseHealth(r);
+        if (bh.unsafe) process.stdout.write(`base:       ${r.name} \u2014 UNSAFE, no worktree cuts or releases: ${bh.detail}
 `);
       }
       if (waiting) {
@@ -11467,6 +11611,12 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
           process.stdout.write(`                   - ${p2}
 `);
         }
+        const bh = baseHealth(r);
+        if (bh.action !== "not-applicable") {
+          process.stdout.write(`                   base ${config.branch.base}: ${bh.unsafe ? "ERROR \u2014 " : ""}${bh.detail}
+`);
+          if (bh.unsafe) process.exitCode = 1;
+        }
       }
       const missingAuthorship = await tracker.missingAuthorshipColumns();
       process.stdout.write(
@@ -11557,6 +11707,14 @@ git:               ${gitPath ? `OK (${gitPath})` : "NOT FOUND on the scheduler P
         process.stdout.write(`attention:         ${i.kind} \u2014 ${i.message} (since ${i.since})
 `);
       }
+      if (host === "macos") {
+        const foreign = describeForeignLaunchdUnits(CREW_HOME);
+        if (foreign.length > 0) {
+          process.stdout.write(`foreign launchd units (not this checkout's \u2014 \`crew install\` or \`crew uninstall --all\` clears them):
+${foreign.join("\n")}
+`);
+        }
+      }
       const passengerRoutes = cfg.routes.filter((r) => r.enabled && r.hostPassengers);
       if (passengerRoutes.length === 0) {
         process.stdout.write("host passengers:   off (no enabled route sets hostPassengers: true)\n");
@@ -11639,4 +11797,5 @@ var passengerApiKeys2;
 var endpointApiFor2;
 var endpointReconcileDeps2;
 var releaseRefused2;
+var baseHealth2;
 var reportUnplaceable2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",

package/prompts/default/personas/common.md

@@ -346,10 +346,13 @@ if `report_type` is either of those.
    missing commits another ship or a reviewer pushed since the last sync. It
    is quiet, not an alert, about a primary checkout that isn't cleanly on the
    base branch (something else may be mid-edit there) — that's expected, not
-   a fault, and just means this sync is a no-op. A genuinely DIVERGED base
-   branch is reported in `crew sync`'s own output; that's for the operator to
-   reconcile, not something to resolve yourself — carry on and cut the
-   worktree from whatever HEAD the primary checkout actually has. Then, from
+   a fault, and just means this sync is a no-op. A DIVERGED base
+   branch (local commits the remote lacks, or one that cannot fast-forward)
+   makes `crew sync` print `DO NOT CUT A WORKTREE FROM THIS BASE` and exit
+   non-zero. That is a hard stop: do not run `git worktree add`, do not try to
+   reconcile it yourself. Post a comment on the ticket naming the repo and the
+   counts `crew sync` printed, leave the ticket as you found it, and end the
+   run — the operator reconciles the checkout. Otherwise, from
    the primary checkout, `git worktree add` a sibling worktree for this
    ticket, on a new branch cut from the base branch's current HEAD. The
    digest's `worktree` and `branch` columns give this ticket's own directory

package/prompts/dev-qa/personas/common.md

@@ -327,10 +327,13 @@ if `report_type` is either of those.
    missing commits another ship or a reviewer pushed since the last sync. It
    is quiet, not an alert, about a primary checkout that isn't cleanly on the
    base branch (something else may be mid-edit there) — that's expected, not
-   a fault, and just means this sync is a no-op. A genuinely DIVERGED base
-   branch is reported in `crew sync`'s own output; that's for the operator to
-   reconcile, not something to resolve yourself — carry on and cut the
-   worktree from whatever HEAD the primary checkout actually has. Then, from
+   a fault, and just means this sync is a no-op. A DIVERGED base
+   branch (local commits the remote lacks, or one that cannot fast-forward)
+   makes `crew sync` print `DO NOT CUT A WORKTREE FROM THIS BASE` and exit
+   non-zero. That is a hard stop: do not run `git worktree add`, do not try to
+   reconcile it yourself. Post a comment on the ticket naming the repo and the
+   counts `crew sync` printed, leave the ticket as you found it, and end the
+   run — the operator reconciles the checkout. Otherwise, from
    the primary checkout, `git worktree add` a sibling worktree for this
    ticket, on a new branch cut from the base branch's current HEAD. The
    digest's `worktree` and `branch` columns give this ticket's own directory