@tablation/crew 0.90.0 → 0.91.0

package/dist/cli.js

@@ -223,8 +223,8 @@ function shellInitScript(shell) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync9, existsSync as existsSync8 } from "fs";
-import { resolve, dirname as dirname3, isAbsolute, join as join10, basename as basename3 } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync9 } from "fs";
+import { resolve, dirname as dirname4, isAbsolute, join as join11, basename as basename3 } from "path";
 import { homedir as homedir6, tmpdir } from "os";
 import { parse as parse2 } from "yaml";
 
@@ -1581,6 +1581,242 @@ function resolveSeat(ship, route, role, persona = {}, repo) {
   return { toolchain, model, toolchainWhy, modelWhy, warnings };
 }
 
+// src/forges.ts
+import { execFileSync } from "child_process";
+import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync8, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname3, join as join9 } from "path";
+var ForgeError = class extends Error {
+};
+var DEFAULT_FORGE_USERNAME = "x-access-token";
+var DEFAULT_KEYCHAIN_SERVICE = "crew-forge";
+function defaultTokenFilePath(stateDir, host) {
+  return join9(stateDir, "forges", `${host.replace(/[^a-z0-9.-]/gi, "_")}.token`);
+}
+var envSource = {
+  read: (s, c) => c.env[s.var]?.trim() || null,
+  describe: (s) => `environment variable ${s.var}`
+};
+var fileSource = {
+  read(s, c) {
+    const path = s.path ?? defaultTokenFilePath(c.stateDir, c.host);
+    if (!existsSync7(path)) return null;
+    const mode = statSync2(path).mode & 511;
+    if (mode & 63) {
+      throw new ForgeError(
+        `${path} is mode ${mode.toString(8).padStart(3, "0")}; a forge token file must be owner-only (chmod 600 ${path})`
+      );
+    }
+    return readFileSync8(path, "utf8").trim() || null;
+  },
+  write(s, token, c) {
+    const path = s.path ?? defaultTokenFilePath(c.stateDir, c.host);
+    mkdirSync5(dirname3(path), { recursive: true, mode: 448 });
+    writeFileSync6(path, `${token}
+`, { mode: 384 });
+    chmodSync(path, 384);
+  },
+  describe: (s, c) => `key file ${s.path ?? defaultTokenFilePath(c.stateDir, c.host)}`
+};
+var keychainService = (s) => s.service ?? DEFAULT_KEYCHAIN_SERVICE;
+var keychainSource = {
+  read(s, c) {
+    try {
+      if (process.platform === "darwin") {
+        return execFileSync(
+          "security",
+          ["find-generic-password", "-s", keychainService(s), "-a", c.host, "-w"],
+          { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+        ).trim() || null;
+      }
+      return execFileSync(
+        "secret-tool",
+        ["lookup", "service", keychainService(s), "account", c.host],
+        { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+      ).trim() || null;
+    } catch {
+      return null;
+    }
+  },
+  write(s, token, c) {
+    try {
+      if (process.platform === "darwin") {
+        const q = (v) => `"${v.replace(/(["\\])/g, "\\$1")}"`;
+        execFileSync("security", ["-i"], {
+          input: `add-generic-password -U -s ${q(keychainService(s))} -a ${q(c.host)} -w ${q(token)}
+`,
+          stdio: ["pipe", "ignore", "pipe"]
+        });
+      } else {
+        execFileSync(
+          "secret-tool",
+          ["store", "--label", `crew ${c.host}`, "service", keychainService(s), "account", c.host],
+          { input: token, stdio: ["pipe", "ignore", "pipe"] }
+        );
+      }
+    } catch (e) {
+      throw new ForgeError(`could not write to the OS secret store: ${e.message.split("\n")[0]}`);
+    }
+  },
+  describe: (s) => `OS secret store (service ${keychainService(s)})`
+};
+var TOKEN_SOURCES = {
+  env: envSource,
+  file: fileSource,
+  keychain: keychainSource
+};
+function impl(s) {
+  const found = TOKEN_SOURCES[s.source];
+  if (!found) throw new ForgeError(`unknown token source "${s.source}"`);
+  return found;
+}
+function bareHost(host) {
+  return host.toLowerCase().replace(/:\d+$/, "");
+}
+function forgeFor(forges, host) {
+  const want = bareHost(host);
+  for (const [h, entry] of Object.entries(forges ?? {})) {
+    if (bareHost(h) === want) return { host: h, entry };
+  }
+  return void 0;
+}
+function readForgeToken(forges, host, stateDir, env = process.env) {
+  const f = forgeFor(forges, host);
+  if (!f) return null;
+  return impl(f.entry.token).read(f.entry.token, { host: f.host, stateDir, env });
+}
+function describeForgeSource(forges, host, stateDir) {
+  const f = forgeFor(forges, host);
+  return f ? impl(f.entry.token).describe(f.entry.token, { host: f.host, stateDir, env: process.env }) : null;
+}
+function hasForgeToken(forges, host, stateDir, env = process.env) {
+  try {
+    return !!readForgeToken(forges, host, stateDir, env);
+  } catch {
+    return false;
+  }
+}
+function storeForgeToken(forges, host, token, stateDir, env = process.env) {
+  const f = forgeFor(forges, host);
+  if (!f) throw new ForgeError(`no forges.${host} entry in crew.yaml`);
+  const i = impl(f.entry.token);
+  if (!i.write) throw new ForgeError(`forges.${host} reads its token from ${i.describe(f.entry.token, { host: f.host, stateDir, env })}, which crew cannot write`);
+  if (!token.trim()) throw new ForgeError("empty token");
+  i.write(f.entry.token, token.trim(), { host: f.host, stateDir, env });
+}
+function parseCredentialInput(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    if (line === "") break;
+    const eq2 = line.indexOf("=");
+    if (eq2 > 0) out[line.slice(0, eq2)] = line.slice(eq2 + 1);
+  }
+  return out;
+}
+function answerCredential(action, input, forges, stateDir, env = process.env) {
+  if (action !== "get") return "";
+  if (input.protocol && input.protocol !== "https") return "";
+  if (!input.host) return "";
+  const f = forgeFor(forges, input.host);
+  if (!f) return "";
+  const token = impl(f.entry.token).read(f.entry.token, { host: f.host, stateDir, env });
+  if (!token) return "";
+  return `username=${f.entry.username}
+password=${token}
+`;
+}
+function gitCredentialEnv(o, base = process.env) {
+  const start = Number.parseInt(base.GIT_CONFIG_COUNT ?? "0", 10) || 0;
+  const helper = `!${o.crewCommand} credential`;
+  for (let i = 0; i < start; i++) {
+    if (base[`GIT_CONFIG_KEY_${i}`] === "credential.helper" && base[`GIT_CONFIG_VALUE_${i}`] === helper) {
+      return { GIT_TERMINAL_PROMPT: "0", ...o.configFile ? { CREW_CONFIG: o.configFile } : {} };
+    }
+  }
+  const out = {
+    GIT_CONFIG_COUNT: String(start + 2),
+    [`GIT_CONFIG_KEY_${start}`]: "credential.helper",
+    [`GIT_CONFIG_VALUE_${start}`]: "",
+    [`GIT_CONFIG_KEY_${start + 1}`]: "credential.helper",
+    [`GIT_CONFIG_VALUE_${start + 1}`]: helper,
+    GIT_TERMINAL_PROMPT: "0"
+  };
+  if (o.configFile) out.CREW_CONFIG = o.configFile;
+  return out;
+}
+var shq = (v) => `'${v.replace(/'/g, `'\\''`)}'`;
+function crewCommandLine() {
+  return [process.execPath, ...process.execArgv, process.argv[1] ?? "crew"].map(shq).join(" ");
+}
+function tokenEnvFor(host, token) {
+  const out = { CREW_FORGE_TOKEN: token };
+  if (bareHost(host) === "github.com") {
+    out.GH_TOKEN = token;
+    out.GITHUB_TOKEN = token;
+  }
+  return out;
+}
+function forgeRunEnv(forges, o, base = process.env) {
+  const hosts = Object.keys(forges ?? {});
+  if (hosts.length === 0) return {};
+  const out = gitCredentialEnv(o, base);
+  for (const h of hosts) {
+    let token = null;
+    try {
+      token = readForgeToken(forges, h, o.stateDir, base);
+    } catch {
+    }
+    if (token) {
+      Object.assign(out, tokenEnvFor(h, token));
+      break;
+    }
+  }
+  return out;
+}
+function parseForges(raw) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "object" || Array.isArray(raw)) throw new ForgeError("ship.forges must be a map of host to entry");
+  const out = {};
+  for (const [host, v] of Object.entries(raw)) {
+    const where = `ship.forges.${host}`;
+    if (/[/:@\s]/.test(host)) throw new ForgeError(`${where}: the key must be a bare host name like github.com`);
+    if (!v || typeof v !== "object" || Array.isArray(v)) throw new ForgeError(`${where} must be a map`);
+    const e = v;
+    for (const k of Object.keys(e)) {
+      if (!["username", "token"].includes(k)) throw new ForgeError(`${where}: unknown key "${k}" (have: username, token)`);
+    }
+    const t = e.token;
+    if (!t || typeof t !== "object" || Array.isArray(t)) throw new ForgeError(`${where}.token must be a map with a "source"`);
+    const tok = t;
+    const source = tok.source;
+    let token;
+    if (source === "env") {
+      if (typeof tok.var !== "string" || !tok.var) throw new ForgeError(`${where}.token.var is required for source "env"`);
+      token = { source: "env", var: tok.var };
+    } else if (source === "file") {
+      token = typeof tok.path === "string" && tok.path ? { source: "file", path: tok.path } : { source: "file" };
+    } else if (source === "keychain") {
+      token = typeof tok.service === "string" && tok.service ? { source: "keychain", service: tok.service } : { source: "keychain" };
+    } else {
+      throw new ForgeError(`${where}.token.source must be one of: ${Object.keys(TOKEN_SOURCES).join(", ")}`);
+    }
+    out[host.toLowerCase()] = {
+      username: typeof e.username === "string" && e.username ? e.username : DEFAULT_FORGE_USERNAME,
+      token
+    };
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function hostOfRemote(url) {
+  if (!url) return null;
+  const m = /^[a-z+]+:\/\/(?:[^@/]*@)?([^/:]+)/i.exec(url) ?? /^[\w.-]+@([\w.-]+):/.exec(url);
+  return m ? m[1].toLowerCase() : null;
+}
+function forgeOfRemote(forges, remoteUrl, hasToken) {
+  const host = hostOfRemote(remoteUrl);
+  const f = host ? forgeFor(forges, host) : void 0;
+  return f ? { host: f.host, hasToken: hasToken(f.host) } : void 0;
+}
+
 // src/config.ts
 import { getSessionStore, hostFromUrl } from "@tablation/client";
 
@@ -1621,8 +1857,8 @@ function explain(ship, required) {
 }
 
 // src/repo-config.ts
-import { readFileSync as readFileSync8, existsSync as existsSync7 } from "fs";
-import { join as join9, basename as basename2 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync8 } from "fs";
+import { join as join10, basename as basename2 } from "path";
 import { parse } from "yaml";
 var SPEC_VERSION = 1;
 var REPO_CONFIG_FILENAMES = [".crew.yaml", ".crew.yml", ".crew.json"];
@@ -1706,8 +1942,8 @@ var MODES = ["local", "integrate", "ci_manual", "ci_auto", "external"];
 var PROVIDERS = ["github", "buildkite", "other", "none"];
 function findRepoConfig(dir) {
   for (const name of REPO_CONFIG_FILENAMES) {
-    const p = join9(dir, name);
-    if (existsSync7(p)) return p;
+    const p = join10(dir, name);
+    if (existsSync8(p)) return p;
   }
   return null;
 }
@@ -1945,7 +2181,7 @@ function parseRepoConfig(text, file) {
 function loadRepoConfig(dir) {
   const file = findRepoConfig(dir);
   if (!file) return null;
-  return parseRepoConfig(readFileSync8(file, "utf8"), file);
+  return parseRepoConfig(readFileSync9(file, "utf8"), file);
 }
 function hookLabel(cfg, hook2) {
   return cfg.labels[hook2] ?? cfg.hooks[hook2] ?? hook2;
@@ -2229,6 +2465,14 @@ function parseCloneScheme(v) {
   if (v === "ssh" || v === "https") return v;
   throw new ConfigError(`ship.cloneScheme must be "ssh" or "https", got ${JSON.stringify(v)}`);
 }
+function parseShipForges(v) {
+  try {
+    return parseForges(v);
+  } catch (e) {
+    if (e instanceof ForgeError) throw new ConfigError(e.message);
+    throw e;
+  }
+}
 var SHIP_KEYS = /* @__PURE__ */ new Set([
   "name",
   "platform",
@@ -2256,6 +2500,7 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "relayPublicDomain",
   "passengerImage",
   "cloneScheme",
+  "forges",
   "previewHost",
   "maxPeriscopes",
   "periscopeIdleMinutes"
@@ -2406,11 +2651,11 @@ function expand(p, base) {
   return isAbsolute(out) ? out : resolve(base, out);
 }
 function resolvePromptsDir(promptSet, crewHome, base) {
-  if (!promptSet) return join10(crewHome, "prompts", "default");
+  if (!promptSet) return join11(crewHome, "prompts", "default");
   if (promptSet.includes("/") || promptSet.startsWith(".") || promptSet.startsWith("~")) {
     return expand(promptSet, base);
   }
-  return join10(crewHome, "prompts", promptSet);
+  return join11(crewHome, "prompts", promptSet);
 }
 var Missing = class {
   paths = [];
@@ -2434,7 +2679,7 @@ var Missing = class {
 };
 function crewVersion(crewHome) {
   try {
-    const pkg = JSON.parse(readFileSync9(join10(crewHome, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync10(join11(crewHome, "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -2444,26 +2689,26 @@ function configSearchPath(crewHome) {
   if (process.env.CREW_CONFIG) return [resolve(process.env.CREW_CONFIG)];
   const xdg = process.env.XDG_CONFIG_HOME;
   return [
-    ...xdg ? [join10(xdg, "crew", "crew.yaml")] : [],
-    join10(homedir6(), ".config", "crew", "crew.yaml"),
+    ...xdg ? [join11(xdg, "crew", "crew.yaml")] : [],
+    join11(homedir6(), ".config", "crew", "crew.yaml"),
     resolve(crewHome, "crew.yaml")
   ];
 }
 function findConfigFile(crewHome) {
   const candidates = configSearchPath(crewHome);
-  return candidates.find((c) => existsSync8(c)) ?? candidates[candidates.length - 1];
+  return candidates.find((c) => existsSync9(c)) ?? candidates[candidates.length - 1];
 }
-var defaultConfigPath = () => join10(process.env.XDG_CONFIG_HOME ?? join10(homedir6(), ".config"), "crew", "crew.yaml");
+var defaultConfigPath = () => join11(process.env.XDG_CONFIG_HOME ?? join11(homedir6(), ".config"), "crew", "crew.yaml");
 function routeSlug(route) {
   return route.replace(/\//g, "-");
 }
 function resolvedPathFor(stateDir, route) {
   const [workspace, project] = splitRoute(route);
-  return join10(stateDir, "resolved", workspace, `${project}.json`);
+  return join11(stateDir, "resolved", workspace, `${project}.json`);
 }
 function apiKeyPathFor(stateDir, route) {
   const [workspace, project] = splitRoute(route);
-  return join10(stateDir, "keys", workspace, `${project}.env`);
+  return join11(stateDir, "keys", workspace, `${project}.env`);
 }
 function splitRoute(route) {
   const parts = route.split("/");
@@ -2474,9 +2719,9 @@ function splitRoute(route) {
 }
 function readResolvedFile(stateDir, route) {
   const path = resolvedPathFor(stateDir, route);
-  if (!existsSync8(path)) return void 0;
+  if (!existsSync9(path)) return void 0;
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch (e) {
     throw new ConfigError(`${path}: not valid JSON \u2014 ${e.message}`);
   }
@@ -2536,23 +2781,23 @@ function parseResolved(raw, m, where) {
 }
 function loadConfig(crewHome, configFile, opts = {}) {
   const file = configFile ?? findConfigFile(crewHome);
-  if (opts.text === void 0 && !existsSync8(file)) {
+  if (opts.text === void 0 && !existsSync9(file)) {
     throw new ConfigError(
       `no config found. Looked in:
 ` + configSearchPath(crewHome).map((c) => `  - ${c}`).join("\n") + `
 
 Create the first of those:
-  mkdir -p ${dirname3(defaultConfigPath())} && cp ${join10(crewHome, "crew.example.yaml")} ${defaultConfigPath()}`
+  mkdir -p ${dirname4(defaultConfigPath())} && cp ${join11(crewHome, "crew.example.yaml")} ${defaultConfigPath()}`
     );
   }
   let raw;
   try {
-    raw = parse2(opts.text ?? readFileSync9(file, "utf8"));
+    raw = parse2(opts.text ?? readFileSync10(file, "utf8"));
   } catch (e) {
     throw new ConfigError(`${file}: not valid YAML \u2014 ${e.message}`);
   }
   if (!raw || typeof raw !== "object") throw new ConfigError(`${file} is empty or not a mapping`);
-  const base = dirname3(file);
+  const base = dirname4(file);
   const missing = new Missing();
   rejectUnknownKeys(raw, /* @__PURE__ */ new Set(["ship", "routes"]), "top-level", file);
   const shipRaw = raw.ship ?? {};
@@ -2657,7 +2902,7 @@ Create the first of those:
       useNvm: shipRaw.useNvm !== false,
       nvmSh: shipRaw.nvmSh,
       stateDir,
-      logFile: expand(shipRaw.logFile ?? join10(tmpdir(), "crew.log"), base),
+      logFile: expand(shipRaw.logFile ?? join11(tmpdir(), "crew.log"), base),
       userAgent: shipRaw.userAgent ?? `Mozilla/5.0 CrewAgent/${crewVersion(crewHome)}`,
       maxConcurrentAgents,
       maxConcurrentAgentsSet,
@@ -2671,6 +2916,7 @@ Create the first of those:
       relayPublicDomain: shipRaw.relayPublicDomain ? String(shipRaw.relayPublicDomain) : void 0,
       passengerImage: shipRaw.passengerImage ? String(shipRaw.passengerImage) : void 0,
       cloneScheme: parseCloneScheme(shipRaw.cloneScheme),
+      forges: parseShipForges(shipRaw.forges),
       previewHost: shipRaw.previewHost ? String(shipRaw.previewHost).trim() || void 0 : void 0,
       maxPeriscopes,
       periscopeIdleMinutes
@@ -2817,7 +3063,7 @@ function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, t
   const hasRepos = Object.keys(repoDirs).length > 0;
   const reposBasePath = expand(String(c?.reposBasePath ?? raw.ship?.reposBasePath ?? DEFAULT_REPOS_BASE_PATH), base);
   const dirIsCloneBase = !c?.dir && !hasRepos && !Array.isArray(c?.repos);
-  const dir = c?.dir ? expand(String(c.dir), base) : hasRepos ? Object.values(repoDirs)[0] : dirIsCloneBase ? join10(reposBasePath, splitRoute(route)[0]) : "";
+  const dir = c?.dir ? expand(String(c.dir), base) : hasRepos ? Object.values(repoDirs)[0] : dirIsCloneBase ? join11(reposBasePath, splitRoute(route)[0]) : "";
   const weight = c?.weight === void 0 ? void 0 : Number(c.weight);
   if (weight !== void 0 && !(Number.isFinite(weight) && weight > 0)) {
     missing.add(`${where}.weight must be a positive number (got "${c?.weight}")`);
@@ -2879,7 +3125,7 @@ function locateDir(cfg, dir, commonDirOf) {
   const direct = find(target);
   if (direct) return direct;
   const common = commonDirOf?.(target);
-  return common ? find(dirname3(resolve(target, common))) : void 0;
+  return common ? find(dirname4(resolve(target, common))) : void 0;
 }
 function findRoute(cfg, route) {
   if (!route) {
@@ -2914,8 +3160,8 @@ function repoIdForName(r, name) {
 }
 function resolveApiKey(r) {
   if (r.apiKey) return r.apiKey;
-  if (r.apiKeyFile && r.apiKeyVar && existsSync8(r.apiKeyFile)) {
-    for (const line of readFileSync9(r.apiKeyFile, "utf8").split("\n")) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync9(r.apiKeyFile)) {
+    for (const line of readFileSync10(r.apiKeyFile, "utf8").split("\n")) {
       const m = line.match(new RegExp(`^${r.apiKeyVar}=(.*)$`));
       if (m) return (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
     }
@@ -2928,9 +3174,9 @@ function resolveApiKey(r) {
 }
 function credentialSource(r) {
   if (r.apiKey) return KEYCHAIN_ELIGIBLE_ROUTES.has(r) ? "keychain" : "inline";
-  if (r.apiKeyFile && r.apiKeyVar && existsSync8(r.apiKeyFile)) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync9(r.apiKeyFile)) {
     const re = new RegExp(`^${r.apiKeyVar}=`);
-    if (readFileSync9(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
+    if (readFileSync10(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
   }
   return process.env.CREW_API_KEY?.trim() ? "CREW_API_KEY" : "none";
 }
@@ -2986,7 +3232,7 @@ function configuredMembers(rt) {
   return out;
 }
 function defaultRepoDir(basePath, workspace, repoName) {
-  return join10(basePath, workspace, repoName);
+  return join11(basePath, workspace, repoName);
 }
 function reposOf(r) {
   const named = Object.entries(r.repos);
@@ -3019,7 +3265,7 @@ function passengerRepoTargets(r) {
   return reposOf(r).filter((t) => r.repoOverrides[t.name]?.hostPassengers !== false);
 }
 function passengerCheckoutDir(basePath, workspace, repoName) {
-  return join10(basePath, workspace, ".passenger-checkouts", repoName);
+  return join11(basePath, workspace, ".passenger-checkouts", repoName);
 }
 function passengerCheckoutTargets(r) {
   if (!r.hostPassengers) return [];
@@ -3306,9 +3552,9 @@ function recoveredFailureHeadlines(o, route) {
 }
 
 // src/install.ts
-import { dirname as dirname4, join as join11, extname } from "path";
+import { dirname as dirname5, join as join12, extname } from "path";
 import { homedir as homedir7 } from "os";
-import { accessSync, constants, existsSync as existsSync9, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync2, writeFileSync as writeFileSync6, unlinkSync, realpathSync } from "fs";
+import { accessSync, constants, existsSync as existsSync10, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync3, writeFileSync as writeFileSync7, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 
@@ -3320,7 +3566,7 @@ function isCompiledBinary(moduleUrl) {
 // src/install.ts
 function crewInvocation(crewHome) {
   if (isCompiledBinary(import.meta.url)) return [process.execPath];
-  return [process.execPath, join11(crewHome, "bin", "crew")];
+  return [process.execPath, join12(crewHome, "bin", "crew")];
 }
 var INTERVAL_SECONDS = 120;
 function labelFor(crewHome, job) {
@@ -3351,36 +3597,36 @@ function schedulerLogFor(crewLog, job) {
   return `${stem}.${suffix}${ext || ".log"}`;
 }
 function pathFor(ship) {
-  const nodeBinDir = dirname4(process.execPath);
+  const nodeBinDir = dirname5(process.execPath);
   const parts = [nodeBinDir];
   if (ship.extraPath) parts.push(ship.extraPath);
   parts.push("/usr/bin", "/bin", "/usr/sbin", "/sbin");
   return parts.join(":");
 }
 function findOnPath(bin, searchPath) {
-  const candidates = bin.includes("/") ? [bin] : searchPath.split(":").filter(Boolean).map((dir) => join11(dir, bin));
+  const candidates = bin.includes("/") ? [bin] : searchPath.split(":").filter(Boolean).map((dir) => join12(dir, bin));
   for (const candidate of candidates) {
     try {
       accessSync(candidate, constants.X_OK);
-      if (statSync2(candidate).isFile()) return candidate;
+      if (statSync3(candidate).isFile()) return candidate;
     } catch {
     }
   }
   return void 0;
 }
-var COMMON_DOCKER_DIRS = ["/usr/local/bin", "/opt/homebrew/bin", join11(homedir7(), ".docker", "bin")].join(":");
+var COMMON_DOCKER_DIRS = ["/usr/local/bin", "/opt/homebrew/bin", join12(homedir7(), ".docker", "bin")].join(":");
 function dockerPathProblem(ship, shellPath = process.env.PATH ?? "") {
   const schedulerPath = pathFor(ship);
   if (findOnPath("docker", schedulerPath)) return void 0;
   const inShell = findOnPath("docker", shellPath);
-  return inShell ? `\`docker\` is not on the scheduler PATH (${schedulerPath}) but is at ${inShell} in your shell; add ${dirname4(inShell)} to ship.extraPath in crew.yaml and run \`crew install\`` : `\`docker\` is not on the scheduler PATH (${schedulerPath}) or your shell PATH; install Docker, then add its directory to ship.extraPath in crew.yaml and run \`crew install\``;
+  return inShell ? `\`docker\` is not on the scheduler PATH (${schedulerPath}) but is at ${inShell} in your shell; add ${dirname5(inShell)} to ship.extraPath in crew.yaml and run \`crew install\`` : `\`docker\` is not on the scheduler PATH (${schedulerPath}) or your shell PATH; install Docker, then add its directory to ship.extraPath in crew.yaml and run \`crew install\``;
 }
 function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 function planLaunchd(ship, crewHome, job) {
   const label = labelFor(crewHome, job);
-  const unitPath = join11(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+  const unitPath = join12(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const persistent = job === "run";
@@ -3434,8 +3680,8 @@ ${scheduleKeys}
 }
 function planSystemd(ship, crewHome, job) {
   const label = labelFor(crewHome, job);
-  const unitDir = join11(homedir7(), ".config", "systemd", "user");
-  const servicePath = join11(unitDir, `${label}.service`);
+  const unitDir = join12(homedir7(), ".config", "systemd", "user");
+  const servicePath = join12(unitDir, `${label}.service`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const description = job === "release" ? "Tablation crew \u2014 release" : job === "passengers" ? "Tablation crew \u2014 Host Passengers sync" : "Tablation crew \u2014 persistent supervisor loop";
@@ -3475,7 +3721,7 @@ WantedBy=default.target
       schedulerLog
     };
   }
-  const timerPath = join11(unitDir, `${label}.timer`);
+  const timerPath = join12(unitDir, `${label}.timer`);
   const service = `# Written by \`crew install\` \u2014 re-run it rather than hand-editing this file.
 [Unit]
 Description=${description}
@@ -3549,7 +3795,7 @@ function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
 function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
   const label = labelFor(crewHome, job);
   if (hostShip === "macos") {
-    const unitPath = join11(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = join12(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
     return {
       mechanism: "launchd",
       unitPaths: [unitPath],
@@ -3559,18 +3805,18 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
     };
   }
   if (hostShip === "linux" && hasSystemd) {
-    const unitDir = join11(homedir7(), ".config", "systemd", "user");
+    const unitDir = join12(homedir7(), ".config", "systemd", "user");
     if (job === "run") {
       return {
         mechanism: "systemd",
-        unitPaths: [join11(unitDir, `${label}.service`)],
+        unitPaths: [join12(unitDir, `${label}.service`)],
         crontabLine: null,
         unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.service`]]
       };
     }
     return {
       mechanism: "systemd",
-      unitPaths: [join11(unitDir, `${label}.service`), join11(unitDir, `${label}.timer`)],
+      unitPaths: [join12(unitDir, `${label}.service`), join12(unitDir, `${label}.timer`)],
       crontabLine: null,
       unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.timer`]]
     };
@@ -3588,7 +3834,7 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
 function planDaemonControl(crewHome, hostShip, hasSystemd) {
   const label = labelFor(crewHome, "run");
   if (hostShip === "macos") {
-    const unitPath = join11(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = join12(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
     return {
       mechanism: "launchd",
       startCommand: ["launchctl", "load", unitPath],
@@ -3628,8 +3874,8 @@ async function applyInstall(plan, crewHome, dryRun, log) {
       log.emit(`would write ${path}`);
       continue;
     }
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync6(path, plan.unitContent[path]);
+    mkdirSync6(dirname5(path), { recursive: true });
+    writeFileSync7(path, plan.unitContent[path]);
     log.emit(`wrote ${path}`);
   }
   if (plan.crontabLine) {
@@ -3683,7 +3929,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
     }
   }
   for (const path of plan.unitPaths) {
-    if (!existsSync9(path)) continue;
+    if (!existsSync10(path)) continue;
     if (dryRun) {
       log.emit(`would remove ${path}`);
       continue;
@@ -3702,7 +3948,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
 }
 var CREW_LAUNCHD_PREFIX = "com.tablation.crew";
 function launchAgentsDir() {
-  return join11(homedir7(), "Library", "LaunchAgents");
+  return join12(homedir7(), "Library", "LaunchAgents");
 }
 function xmlUnescape(s) {
   return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
@@ -3719,25 +3965,25 @@ function loadedCrewLabels() {
   return [...parseLaunchctlList(list.stdout ?? "").keys()].filter((l) => l.startsWith(CREW_LAUNCHD_PREFIX));
 }
 function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
-  const files = existsSync9(dir) ? readdirSync3(dir) : [];
+  const files = existsSync10(dir) ? readdirSync3(dir) : [];
   const units = files.filter((f) => f.startsWith(CREW_LAUNCHD_PREFIX) && f.endsWith(".plist")).sort().map((f) => {
-    const plistPath = join11(dir, f);
+    const plistPath = join12(dir, f);
     let program = null;
     try {
-      program = programFromPlist(readFileSync10(plistPath, "utf8"));
+      program = programFromPlist(readFileSync11(plistPath, "utf8"));
     } catch {
     }
     return {
       label: f.slice(0, -".plist".length),
       plistPath,
       program,
-      programExists: program !== null && existsSync9(program)
+      programExists: program !== null && existsSync10(program)
     };
   });
   const seen = new Set(units.map((u) => u.label));
   for (const label of [...loaded].sort()) {
     if (!label.startsWith(CREW_LAUNCHD_PREFIX) || seen.has(label)) continue;
-    units.push({ label, plistPath: join11(dir, `${label}.plist`), program: null, programExists: false, orphan: true });
+    units.push({ label, plistPath: join12(dir, `${label}.plist`), program: null, programExists: false, orphan: true });
   }
   return units;
 }
@@ -3750,9 +3996,9 @@ function removeLaunchdUnit(unit, dryRun, log) {
     log.emit(`would unload and remove ${unit.label}`);
     return;
   }
-  if (existsSync9(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
+  if (existsSync10(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
   spawnSync4("launchctl", ["remove", unit.label], { encoding: "utf8" });
-  if (existsSync9(unit.plistPath)) unlinkSync(unit.plistPath);
+  if (existsSync10(unit.plistPath)) unlinkSync(unit.plistPath);
   log.emit(`removed ${unit.label} (${unit.plistPath})`);
 }
 function clearForeignLaunchdUnits(crewHome, replace, dryRun, log, dir, loaded) {
@@ -3830,24 +4076,24 @@ function detectSystemd() {
 }
 
 // src/ship-attention.ts
-import { existsSync as existsSync11, statfsSync } from "fs";
+import { existsSync as existsSync12, statfsSync } from "fs";
 
 // src/git.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import {
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync7,
   openSync as openSync2,
   closeSync as closeSync2,
   writeSync,
-  statSync as statSync3,
+  statSync as statSync4,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync11,
-  writeFileSync as writeFileSync7,
+  readFileSync as readFileSync12,
+  writeFileSync as writeFileSync8,
   readdirSync as readdirSync4,
   rmSync as rmSync6
 } from "fs";
-import { dirname as dirname5, basename as basename4, join as join12 } from "path";
+import { dirname as dirname6, basename as basename4, join as join13 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -3855,7 +4101,7 @@ function streamText(x) {
 }
 function gitRaw(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -3864,7 +4110,7 @@ function gitRaw(cwd, args) {
 }
 function git(cwd, args) {
   try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -4035,9 +4281,9 @@ function keyCommitsInRange(cwd, key, range) {
 }
 function patchIdOf(cwd, from, to) {
   try {
-    const diff = execFileSync("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    const diff = execFileSync2("git", ["diff", from, to], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
     if (!diff) return null;
-    const out = execFileSync("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
+    const out = execFileSync2("git", ["patch-id", "--stable"], { cwd, encoding: "utf8", input: diff });
     return out.split(" ")[0]?.trim() || null;
   } catch {
     return null;
@@ -4227,7 +4473,7 @@ function recoverStrandedReleaseCheckouts(cwd) {
     if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
-      const root = dirname5(path);
+      const root = dirname6(path);
       if (basename4(root).startsWith("crew-release-")) rmSync6(root, { recursive: true, force: true });
     }
   }
@@ -4245,11 +4491,11 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
   }
   for (const name of names) {
     if (!name.startsWith("crew-release-")) continue;
-    const root = join12(tmp, name);
+    const root = join13(tmp, name);
     try {
-      const st = statSync3(root);
+      const st = statSync4(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync10(join12(root, "checkout"))) continue;
+      if (existsSync11(join13(root, "checkout"))) continue;
       rmSync6(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
@@ -4282,9 +4528,13 @@ function worktrees(cwd) {
   if (current.path) list.push({ path: current.path, branch: current.branch ?? null, prunable: current.prunable ?? false });
   return list;
 }
+var tokenHosts = /* @__PURE__ */ new Set();
+function setForgeTokenHosts(hosts) {
+  tokenHosts = new Set([...hosts].map((h) => h.toLowerCase()));
+}
 function cloneUrlFor(remote, opts = {}) {
   const origin = opts.originUrl?.trim() ?? "";
-  const scheme = /^https?:\/\//i.test(origin) ? "https" : /^(git@|ssh:\/\/)/i.test(origin) ? "ssh" : opts.scheme ?? "ssh";
+  const scheme = tokenHosts.has("github.com") ? "https" : /^https?:\/\//i.test(origin) ? "https" : /^(git@|ssh:\/\/)/i.test(origin) ? "ssh" : opts.scheme ?? "ssh";
   return scheme === "https" ? `https://github.com/${remote}.git` : `git@github.com:${remote}.git`;
 }
 function originUrlOf(dir, remoteName) {
@@ -4295,16 +4545,16 @@ function originUrlOf(dir, remoteName) {
   }
 }
 function ensureRepoCheckout(dir, remote, opts = {}) {
-  if (existsSync10(`${dir}/.git`)) return false;
+  if (existsSync11(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
     );
   }
-  mkdirSync6(dirname5(dir), { recursive: true });
+  mkdirSync7(dirname6(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
-    execFileSync("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map(streamText).filter(Boolean).join(" / ");
@@ -4326,7 +4576,7 @@ function sleepSync(ms3) {
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
-  mkdirSync6(dirname5(lockPath), { recursive: true });
+  mkdirSync7(dirname6(lockPath), { recursive: true });
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -4344,7 +4594,7 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
       const err = e;
       if (err.code !== "EEXIST") throw err;
       try {
-        if (Date.now() - statSync3(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
+        if (Date.now() - statSync4(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
           try {
             unlinkSync2(lockPath);
           } catch {
@@ -4363,17 +4613,17 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
 function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (!existsSync10(`${dir}/.git`) && githubRemote) {
+    if (!existsSync11(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync10(marker) && readFileSync11(marker, "utf8").split("\n")[0] === url) {
-        return { action: "clone-failed", detail: readFileSync11(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      if (existsSync11(marker) && readFileSync12(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync12(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
         ensureRepoCheckout(dir, githubRemote, clone);
       } catch (e) {
         if (!(e instanceof GitError)) throw e;
-        writeFileSync7(marker, `${url}
+        writeFileSync8(marker, `${url}
 ${e.message}`);
         return { action: "clone-failed", detail: e.message, repeat: false };
       }
@@ -4580,7 +4830,7 @@ function noteHeldWorktree(state, h, nowMs = Date.now()) {
 function reconcileHeldWorktrees(state, repo, log, stillRefused) {
   for (const i of state.shipAttention().previous()) {
     if (i.kind !== "worktree_held" || !i.held || i.held.repo !== repo) continue;
-    const gone = !existsSync11(i.held.path);
+    const gone = !existsSync12(i.held.path);
     if (!gone && !(stillRefused && !stillRefused.has(i.held.path))) continue;
     clearShipAttention(state, i.key);
     log.emit(
@@ -4706,10 +4956,10 @@ function attentionProblems(items, already) {
 }
 
 // src/doctor-checks.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 var PROBE_BRANCH = "crew-probe-branch";
 var realGit = (cwd, args, env) => {
-  execFileSync2("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
+  execFileSync3("git", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
 };
 function isSshRemote(url) {
   return /^ssh:\/\//.test(url) || /^[\w.-]+@[\w.-]+:/.test(url);
@@ -4727,7 +4977,30 @@ function probePushAuth(o, run2 = realGit, baseEnv = process.env) {
   } catch (e) {
     const err = e;
     const raw = (err.stderr ? String(err.stderr) : err.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
-    return { state: "failed", detail: raw || "push dry-run failed", hint: pushAuthHint(o.remoteUrl) };
+    const detail = raw || "push dry-run failed";
+    const f = o.forge;
+    if (!f) return { state: "failed", detail, hint: pushAuthHint(o.remoteUrl) };
+    if (!f.hasToken) {
+      return {
+        state: "failed",
+        detail: `no token for forge ${f.host}: ${detail}`,
+        hint: `set one with \`crew forge set ${f.host}\` (forges.${f.host} in crew.yaml)`
+      };
+    }
+    try {
+      run2(o.dir, ["ls-remote", "--exit-code", o.remote, "HEAD"], env);
+      return {
+        state: "failed",
+        detail: `the token for forge ${f.host} is read-only (fetch works, push refused): ${detail}`,
+        hint: `replace it with one that can write contents: \`crew forge rotate ${f.host}\``
+      };
+    } catch {
+      return {
+        state: "failed",
+        detail: `the token for forge ${f.host} was refused: ${detail}`,
+        hint: `check that it is current and has access to this repository: \`crew forge rotate ${f.host}\``
+      };
+    }
   }
 }
 var INSTALL_HINTS = {
@@ -4808,30 +5081,30 @@ function roleCapWarnings(ship) {
 
 // src/selftest.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync20, mkdirSync as mkdirSync11, mkdtempSync, readFileSync as readFileSync18, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync19, rmSync as rmSync10, writeFileSync as writeFileSync13 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 
 // src/agent.ts
 import { spawn as spawn2, spawnSync as spawnSync5 } from "child_process";
-import { readFileSync as readFileSync17, existsSync as existsSync19, statSync as statSync5, mkdirSync as mkdirSync10, writeFileSync as writeFileSync11, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
+import { readFileSync as readFileSync18, existsSync as existsSync20, statSync as statSync6, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
-import { join as join20, dirname as dirname7, basename as basename7 } from "path";
+import { join as join21, dirname as dirname8, basename as basename7 } from "path";
 import { createHash as createHash3 } from "crypto";
 
 // src/state.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, existsSync as existsSync12, mkdirSync as mkdirSync7, rmSync as rmSync7, statSync as statSync4, readdirSync as readdirSync5 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync13, mkdirSync as mkdirSync8, rmSync as rmSync7, statSync as statSync5, readdirSync as readdirSync5 } from "fs";
+import { join as join14 } from "path";
 var EPOCH = "1970-01-01T00:00:00.000Z";
 var State = class _State {
   dir;
   constructor(dir) {
     this.dir = dir;
-    mkdirSync7(dir, { recursive: true });
+    mkdirSync8(dir, { recursive: true });
   }
   path(...parts) {
-    return join13(this.dir, ...parts);
+    return join14(this.dir, ...parts);
   }
   /**
    * The timestamp every "new since last poll" check is measured against.
@@ -4842,14 +5115,14 @@ var State = class _State {
    */
   watermark() {
     try {
-      const v = readFileSync12(this.path(".poll-watermark"), "utf8").trim();
+      const v = readFileSync13(this.path(".poll-watermark"), "utf8").trim();
       return v || EPOCH;
     } catch {
       return EPOCH;
     }
   }
   setWatermark(at) {
-    writeFileSync8(this.path(".poll-watermark"), `${at}
+    writeFileSync9(this.path(".poll-watermark"), `${at}
 `);
   }
   /**
@@ -4867,16 +5140,16 @@ var State = class _State {
   }
   /** Whole-crew pause, and the per-role sentinels one level down. */
   isPaused() {
-    return existsSync12(this.path(".crew-paused"));
+    return existsSync13(this.path(".crew-paused"));
   }
   isRolePaused(role) {
-    return existsSync12(this.path(`.role-paused-${role}`));
+    return existsSync13(this.path(`.role-paused-${role}`));
   }
   pausedRoles(roles) {
     return new Set(roles.filter((r) => this.isRolePaused(r)));
   }
   pause(role) {
-    writeFileSync8(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), "");
+    writeFileSync9(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), "");
   }
   resume(role) {
     rmSync7(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), { force: true });
@@ -4887,10 +5160,10 @@ var State = class _State {
    * while agents keep working.
    */
   isReleasePaused() {
-    return existsSync12(this.path(".release-paused"));
+    return existsSync13(this.path(".release-paused"));
   }
   setReleasePaused(paused) {
-    if (paused) writeFileSync8(this.path(".release-paused"), "");
+    if (paused) writeFileSync9(this.path(".release-paused"), "");
     else rmSync7(this.path(".release-paused"), { force: true });
   }
   /**
@@ -4928,7 +5201,7 @@ var State = class _State {
     const name = _State.safe(rawName);
     const file = this.path(`.${name}.lock`);
     try {
-      const existing = Number.parseInt(readFileSync12(file, "utf8").trim(), 10);
+      const existing = Number.parseInt(readFileSync13(file, "utf8").trim(), 10);
       if (Number.isFinite(existing) && existing > 0) {
         try {
           process.kill(existing, 0);
@@ -4938,7 +5211,7 @@ var State = class _State {
       }
     } catch {
     }
-    writeFileSync8(file, `${process.pid}
+    writeFileSync9(file, `${process.pid}
 `);
     return {
       ok: true,
@@ -4966,7 +5239,7 @@ var State = class _State {
       if (!/^\.release-.+\.lock$/.test(n)) continue;
       let pid = 0;
       try {
-        pid = Number.parseInt(readFileSync12(this.path(n), "utf8").trim(), 10);
+        pid = Number.parseInt(readFileSync13(this.path(n), "utf8").trim(), 10);
       } catch {
         continue;
       }
@@ -5052,7 +5325,7 @@ var State = class _State {
   ticketInFlight(recordId) {
     const file = this.path(`.${_State.safe(`crew-ticket-${recordId}`)}.lock`);
     try {
-      const pid = Number.parseInt(readFileSync12(file, "utf8").trim(), 10);
+      const pid = Number.parseInt(readFileSync13(file, "utf8").trim(), 10);
       if (!Number.isFinite(pid) || pid <= 0) return false;
       process.kill(pid, 0);
       return true;
@@ -5086,7 +5359,7 @@ var State = class _State {
     const heldReported = `.release-held-${suffix}`;
     const read = (f) => {
       try {
-        return readFileSync12(this.path(f), "utf8").trim() || null;
+        return readFileSync13(this.path(f), "utf8").trim() || null;
       } catch {
         return null;
       }
@@ -5095,7 +5368,7 @@ var State = class _State {
       blockedCount: () => Number.parseInt(read(blocked) ?? "", 10) || 0,
       noteBlocked: () => {
         const n = (Number.parseInt(read(blocked) ?? "", 10) || 0) + 1;
-        writeFileSync8(this.path(blocked), `${n}
+        writeFileSync9(this.path(blocked), `${n}
 `);
         return n;
       },
@@ -5112,7 +5385,7 @@ var State = class _State {
        */
       deployFailedSha: () => read(failed),
       noteDeployFailed: (sha) => {
-        writeFileSync8(this.path(failed), `${sha}
+        writeFileSync9(this.path(failed), `${sha}
 `);
       },
       clearDeployFailed: () => {
@@ -5126,7 +5399,7 @@ var State = class _State {
       noteTestGateFailed: (sha) => {
         const [prev, n] = (read(gateFailed) ?? "").split(" ");
         const next = prev === sha ? (Number.parseInt(n ?? "", 10) || 0) + 1 : 1;
-        writeFileSync8(this.path(gateFailed), `${sha} ${next}
+        writeFileSync9(this.path(gateFailed), `${sha} ${next}
 `);
         return next;
       },
@@ -5136,13 +5409,13 @@ var State = class _State {
       /** Whether the board was already told about this head's red gate. */
       heldReported: () => {
         try {
-          return readFileSync12(this.path(heldReported), "utf8").replace(/\n$/, "") || null;
+          return readFileSync13(this.path(heldReported), "utf8").replace(/\n$/, "") || null;
         } catch {
           return null;
         }
       },
       noteHeldReported: (signature) => {
-        writeFileSync8(this.path(heldReported), `${signature}
+        writeFileSync9(this.path(heldReported), `${signature}
 `);
       },
       clearHeldReported: () => {
@@ -5150,7 +5423,7 @@ var State = class _State {
       },
       testGateReported: (sha) => read(gateReported) === sha,
       noteTestGateReported: (sha) => {
-        writeFileSync8(this.path(gateReported), `${sha}
+        writeFileSync9(this.path(gateReported), `${sha}
 `);
       }
     };
@@ -5173,7 +5446,7 @@ var State = class _State {
     const ticketStreakFile = `.fairness-ticket-streak-${suffix}`;
     const read = (f) => {
       try {
-        return readFileSync12(this.path(f), "utf8").trim() || null;
+        return readFileSync13(this.path(f), "utf8").trim() || null;
       } catch {
         return null;
       }
@@ -5206,18 +5479,18 @@ var State = class _State {
           clear2();
           return;
         }
-        writeFileSync8(this.path(streakFile), `${this.readInt(streakFile) + 1}
+        writeFileSync9(this.path(streakFile), `${this.readInt(streakFile) + 1}
 `);
         const prior = read(ticketFile);
         if (topTicket && topTicket === prior) {
-          writeFileSync8(this.path(ticketStreakFile), `${this.readInt(ticketStreakFile) + 1}
+          writeFileSync9(this.path(ticketStreakFile), `${this.readInt(ticketStreakFile) + 1}
 `);
         } else if (topTicket) {
-          writeFileSync8(this.path(ticketFile), `${topTicket}
+          writeFileSync9(this.path(ticketFile), `${topTicket}
 `);
-          writeFileSync8(this.path(sinceFile), `${(/* @__PURE__ */ new Date()).toISOString()}
+          writeFileSync9(this.path(sinceFile), `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
-          writeFileSync8(this.path(ticketStreakFile), "1\n");
+          writeFileSync9(this.path(ticketStreakFile), "1\n");
         }
       }
     };
@@ -5238,14 +5511,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync12(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync13(this.path(file), "utf8"));
           return parsed && typeof parsed === "object" ? parsed : {};
         } catch {
           return {};
         }
       },
       persist: (next) => {
-        writeFileSync8(this.path(file), JSON.stringify(next));
+        writeFileSync9(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -5261,14 +5534,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync12(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync13(this.path(file), "utf8"));
           return Array.isArray(parsed) ? parsed.filter((x) => typeof x === "string") : [];
         } catch {
           return [];
         }
       },
       persist: (next) => {
-        writeFileSync8(this.path(file), JSON.stringify(next));
+        writeFileSync9(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -5282,14 +5555,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync12(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync13(this.path(file), "utf8"));
           return Array.isArray(parsed) ? parsed : [];
         } catch {
           return [];
         }
       },
       persist: (next) => {
-        writeFileSync8(this.path(file), JSON.stringify(next));
+        writeFileSync9(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -5302,11 +5575,11 @@ var State = class _State {
     const file = ".release-last-run";
     return {
       touch: () => {
-        writeFileSync8(this.path(file), (/* @__PURE__ */ new Date()).toISOString());
+        writeFileSync9(this.path(file), (/* @__PURE__ */ new Date()).toISOString());
       },
       at: () => {
         try {
-          return statSync4(this.path(file)).mtimeMs;
+          return statSync5(this.path(file)).mtimeMs;
         } catch {
           return null;
         }
@@ -5315,7 +5588,7 @@ var State = class _State {
   }
   readInt(file) {
     try {
-      return Number.parseInt(readFileSync12(this.path(file), "utf8").trim(), 10) || 0;
+      return Number.parseInt(readFileSync13(this.path(file), "utf8").trim(), 10) || 0;
     } catch {
       return 0;
     }
@@ -5798,8 +6071,8 @@ var PERISCOPE_COLUMNS = [
 ];
 
 // src/agent-log.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync8, readdirSync as readdirSync6, readFileSync as readFileSync13, rmSync as rmSync8, writeFileSync as writeFileSync9 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync6, readFileSync as readFileSync14, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "fs";
+import { join as join15 } from "path";
 
 // src/pending-backoff.ts
 var sleepBackoff = (attempts) => Math.min(6e4 * 2 ** Math.max(0, attempts - 1), 30 * 6e4);
@@ -5971,20 +6244,20 @@ async function addRunToTicket(target, t, recordId, run2) {
     };
   }
 }
-var queueDir = (stateDir) => join14(stateDir, "pending-agent-logs");
+var queueDir = (stateDir) => join15(stateDir, "pending-agent-logs");
 function queueAgentRun(stateDir, name, q) {
-  mkdirSync8(queueDir(stateDir), { recursive: true });
-  writeFileSync9(join14(queueDir(stateDir), `${name}.json`), JSON.stringify(q));
+  mkdirSync9(queueDir(stateDir), { recursive: true });
+  writeFileSync10(join15(queueDir(stateDir), `${name}.json`), JSON.stringify(q));
 }
 async function replayQueuedAgentRuns(stateDir, route, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = queueDir(stateDir);
-  if (!existsSync13(dir)) return 0;
+  if (!existsSync14(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
-    const path = join14(dir, f);
+    const path = join15(dir, f);
     let q;
     try {
-      q = JSON.parse(readFileSync13(path, "utf8"));
+      q = JSON.parse(readFileSync14(path, "utf8"));
     } catch {
       continue;
     }
@@ -6013,7 +6286,7 @@ async function replayQueuedAgentRuns(stateDir, route, keyFor, log, now = /* @__P
         continue;
       }
       const attempts = q.attempts + 1;
-      writeFileSync9(path, JSON.stringify({
+      writeFileSync10(path, JSON.stringify({
         ...q,
         attempts,
         warned: true,
@@ -6024,20 +6297,20 @@ async function replayQueuedAgentRuns(stateDir, route, keyFor, log, now = /* @__P
   }
   return sent;
 }
-var countersDir = (stateDir) => join14(stateDir, "pending-ticket-counters");
+var countersDir = (stateDir) => join15(stateDir, "pending-ticket-counters");
 function queueTicketCounters(stateDir, name, q) {
-  mkdirSync8(countersDir(stateDir), { recursive: true });
-  writeFileSync9(join14(countersDir(stateDir), `${name}.json`), JSON.stringify(q));
+  mkdirSync9(countersDir(stateDir), { recursive: true });
+  writeFileSync10(join15(countersDir(stateDir), `${name}.json`), JSON.stringify(q));
 }
 async function replayQueuedTicketCounters(stateDir, route, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = countersDir(stateDir);
-  if (!existsSync13(dir)) return 0;
+  if (!existsSync14(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
-    const path = join14(dir, f);
+    const path = join15(dir, f);
     let q;
     try {
-      q = JSON.parse(readFileSync13(path, "utf8"));
+      q = JSON.parse(readFileSync14(path, "utf8"));
     } catch {
       continue;
     }
@@ -6056,7 +6329,7 @@ async function replayQueuedTicketCounters(stateDir, route, keyFor, log, now = /*
         continue;
       }
       const attempts = q.attempts + 1;
-      writeFileSync9(path, JSON.stringify({
+      writeFileSync10(path, JSON.stringify({
         ...q,
         attempts,
         warned: true,
@@ -6259,8 +6532,8 @@ var HandoffTranscriptTracker = class {
 };
 
 // src/pending-handoff.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync14, rmSync as rmSync9, writeFileSync as writeFileSync10 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync10, readdirSync as readdirSync7, readFileSync as readFileSync15, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "fs";
+import { join as join18 } from "path";
 
 // src/ticket-branch.ts
 import { basename as basename6 } from "path";
@@ -7343,16 +7616,16 @@ function holdWarnings(tickets, ships, contract, humanHolds, now = Date.now()) {
 }
 
 // src/run-worktree.ts
-import { existsSync as existsSync15 } from "fs";
-import { dirname as dirname6, join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { dirname as dirname7, join as join17 } from "path";
 
 // src/ports.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync14 } from "fs";
-import { join as join15 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync15 } from "fs";
+import { join as join16 } from "path";
 var run = (cmd, args) => {
   try {
-    return execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return "";
   }
@@ -7394,7 +7667,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync14(join15(parent, name, ".git"))) return true;
+    if (existsSync15(join16(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -7477,7 +7750,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const existing = worktreeForNumber(dir, num);
   const located = locateBranchForTicket(dir, cfg, t, role);
   const baseRef = hasRemote ? `${remote}/${base}` : base;
-  if (existing && !existing.prunable && existsSync15(existing.path)) {
+  if (existing && !existing.prunable && existsSync16(existing.path)) {
     const branch = existing.branch;
     if (status(existing.path).length > 0) {
       return { action: opts.resumeInterrupted ? "resume-dirty" : "leave-dirty", path: existing.path, branch };
@@ -7493,7 +7766,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
     if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
     return { action: "recut", path: existing.path, branch, base: baseRef };
   }
-  const path = join16(dirname6(dir), worktreeForTicket(dir, cfg, t, role));
+  const path = join17(dirname7(dir), worktreeForTicket(dir, cfg, t, role));
   if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
     return { action: "cut-remote", path, branch: located.branch };
   }
@@ -7547,7 +7820,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
   if (remoteConfigured(dir, remote) && remoteBranchExists(dir, remote, branch)) return false;
   if (countCommits(dir, `${baseRef}..${branch}`) !== 0) return false;
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (wt && existsSync15(wt.path)) {
+  if (wt && existsSync16(wt.path)) {
     if (status(wt.path).length > 0) return false;
     if (gitOk(dir, ["worktree", "remove", wt.path]) === null) return false;
   }
@@ -7555,7 +7828,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
 }
 async function finishRunWorktree(dir, cfg, branch) {
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (!wt || !existsSync15(wt.path)) return { kind: "none" };
+  if (!wt || !existsSync16(wt.path)) return { kind: "none" };
   if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
   if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
   if (remoteConfigured(dir, cfg.branch.remote) && worktreeHoldsUnpushed(wt.path, cfg.branch.remote)) {
@@ -7567,7 +7840,7 @@ async function finishRunWorktree(dir, cfg, branch) {
     if (pids.length) await killGently(pids);
   }
   gitOk(dir, ["worktree", "remove", wt.path]);
-  return existsSync15(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+  return existsSync16(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
 }
 
 // src/handoff-guard.ts
@@ -7950,20 +8223,20 @@ async function guardRunStrays(route, ship, tracker, role, workingId, since2, log
 
 // src/pending-handoff.ts
 var PENDING_MAX_AGE_MS = 48 * 36e5;
-var pendingDirFor = (stateDir) => join17(stateDir, "pending-handoffs");
-var stateDirOfStream = (streamPath) => join17(streamPath, "..", "..");
+var pendingDirFor = (stateDir) => join18(stateDir, "pending-handoffs");
+var stateDirOfStream = (streamPath) => join18(streamPath, "..", "..");
 function writePendingHandoff(stateDir, rec) {
   const dir = pendingDirFor(stateDir);
-  mkdirSync9(dir, { recursive: true });
-  writeFileSync10(join17(dir, `${rec.ticketRecordId}.json`), JSON.stringify(rec, null, 2));
+  mkdirSync10(dir, { recursive: true });
+  writeFileSync11(join18(dir, `${rec.ticketRecordId}.json`), JSON.stringify(rec, null, 2));
 }
 function listPendingHandoffs(stateDir, route) {
   const dir = pendingDirFor(stateDir);
-  if (!existsSync16(dir)) return [];
+  if (!existsSync17(dir)) return [];
   const out = [];
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     try {
-      const rec = JSON.parse(readFileSync14(join17(dir, f), "utf8"));
+      const rec = JSON.parse(readFileSync15(join18(dir, f), "utf8"));
       if (rec.version === 1 && rec.ticketRecordId && (!route || rec.route === route)) out.push(rec);
     } catch {
     }
@@ -7971,7 +8244,7 @@ function listPendingHandoffs(stateDir, route) {
   return out;
 }
 function removePendingHandoff(stateDir, ticketRecordId) {
-  rmSync9(join17(pendingDirFor(stateDir), `${ticketRecordId}.json`), { force: true });
+  rmSync9(join18(pendingDirFor(stateDir), `${ticketRecordId}.json`), { force: true });
 }
 function pendingHandoffFor(stateDir, ticketRecordId) {
   return listPendingHandoffs(stateDir).find((r) => r.ticketRecordId === ticketRecordId);
@@ -8081,8 +8354,8 @@ function expandSkillMarkers(text, lookup2, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync16, readdirSync as readdirSync8, existsSync as existsSync18 } from "fs";
-import { join as join19 } from "path";
+import { readFileSync as readFileSync17, readdirSync as readdirSync8, existsSync as existsSync19 } from "fs";
+import { join as join20 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError3, TablationApiError as TablationApiError2 } from "@tablation/client";
 
@@ -8098,8 +8371,8 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync15, existsSync as existsSync17 } from "fs";
-import { join as join18 } from "path";
+import { readFileSync as readFileSync16, existsSync as existsSync18 } from "fs";
+import { join as join19 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError2, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
   dev: "Developer",
@@ -8113,12 +8386,12 @@ var CREW_AGENT_COLUMN = "agent_id";
 var AgentsSyncError = class extends Error {
 };
 function personaDefaultPrompt(promptsDir, role) {
-  const briefPath = join18(promptsDir, "personas", `lane-${role}.md`);
-  if (!existsSync17(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync15(briefPath, "utf8");
-  const commonPath = join18(promptsDir, "personas", "common.md");
-  if (!existsSync17(commonPath)) return readFileSync15(briefPath, "utf8");
-  return `${readFileSync15(commonPath, "utf8")}${readFileSync15(briefPath, "utf8")}`;
+  const briefPath = join19(promptsDir, "personas", `lane-${role}.md`);
+  if (!existsSync18(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync16(briefPath, "utf8");
+  const commonPath = join19(promptsDir, "personas", "common.md");
+  if (!existsSync18(commonPath)) return readFileSync16(briefPath, "utf8");
+  return `${readFileSync16(commonPath, "utf8")}${readFileSync16(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route, role, opts) {
   const cached = route.resolved?.agentPersonas?.[role]?.agentId;
@@ -8565,7 +8838,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text = readFileSync16(path, "utf8");
+  const text = readFileSync17(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -8578,9 +8851,9 @@ function parseSkillFile(path) {
   return { name: meta.name, description: meta.description, prompt: body, file: path };
 }
 function listLocalSkills(promptsDir) {
-  const dir = join19(promptsDir, "skills");
-  if (!existsSync18(dir)) return [];
-  return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join19(dir, f)));
+  const dir = join20(promptsDir, "skills");
+  if (!existsSync19(dir)) return [];
+  return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join20(dir, f)));
 }
 async function syncSkills(route, opts) {
   if (!route.resolved) {
@@ -8782,26 +9055,26 @@ var AgentError = class extends Error {
 };
 var AgentSpawnError = class extends AgentError {
 };
-var digestPathFor = (stateDir, routeLabel, role, runId) => join20(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
+var digestPathFor = (stateDir, routeLabel, role, runId) => join21(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
 function planAgentRun(o) {
-  const briefPath = join20(o.route.promptsDir, "personas", `lane-${o.role}.md`);
-  if (!existsSync19(briefPath)) {
+  const briefPath = join21(o.route.promptsDir, "personas", `lane-${o.role}.md`);
+  if (!existsSync20(briefPath)) {
     throw new AgentError(`no brief at ${briefPath} \u2014 refusing to run an unscoped session`);
   }
-  const commonPath = join20(o.route.promptsDir, "personas", "common.md");
-  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync19(commonPath);
+  const commonPath = join21(o.route.promptsDir, "personas", "common.md");
+  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync20(commonPath);
   const now = o.now ?? (() => Date.now());
   const routeLabel = routeSlug(o.route.route);
   const ownDigest = o.runId ? digestPathFor(o.stateDir, routeLabel, o.role, o.runId) : void 0;
-  const digestPath2 = ownDigest && existsSync19(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
+  const digestPath2 = ownDigest && existsSync20(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
   let digest;
   let ageSeconds;
-  if (existsSync19(digestPath2)) {
-    ageSeconds = Math.floor((now() - statSync5(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync17(digestPath2, "utf8");
+  if (existsSync20(digestPath2)) {
+    ageSeconds = Math.floor((now() - statSync6(digestPath2).mtimeMs) / 1e3);
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync18(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync17(commonPath, "utf8") : "";
-  const brief = readFileSync17(briefPath, "utf8");
+  const common = usesCommon ? readFileSync18(commonPath, "utf8") : "";
+  const brief = readFileSync18(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = appendAdditions(o.divergedPrompt ?? brief, o.personaAdditions);
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -8823,7 +9096,7 @@ function planAgentRun(o) {
     digest
   });
   const promptSha = createHash3("sha256").update(expanded.text).digest("hex");
-  const streamsDir = join20(o.stateDir, "streams");
+  const streamsDir = join21(o.stateDir, "streams");
   const base = `${routeLabel}-${o.role}-${o.cycle}${o.runId ? `-${o.runId}` : ""}`;
   const seat = resolveSeat(o.ship, o.route, o.role, o.agentPersona ?? (o.agentModel ? { model: o.agentModel } : {}), o.repo);
   const { toolchain, model } = seat;
@@ -8888,13 +9161,16 @@ function planAgentRun(o) {
       // ticket attached, which silently no-ops and strands the ticket
       // in_progress (ISSUE-490, ISSUE-591). Setting this is what lets that
       // hook tell the two apart; it has nothing to do with the run itself.
-      [CREW_LANE_ROLE_VAR]: o.role
+      [CREW_LANE_ROLE_VAR]: o.role,
+      // CREW-2783: the ship's forge credential — git helper config plus the
+      // token as an env var for `gh` and friends. Empty without `forges:`.
+      ...forgeRunEnv(o.ship.forges, { crewCommand: crewCommandLine(), configFile: process.env.CREW_CONFIG, stateDir: o.stateDir })
     },
     digestAttached: digest !== void 0,
     digestAgeSeconds: ageSeconds,
     model,
-    streamPath: join20(streamsDir, `${base}.jsonl`),
-    eventsPath: join20(streamsDir, `${base}.events.jsonl`),
+    streamPath: join21(streamsDir, `${base}.jsonl`),
+    eventsPath: join21(streamsDir, `${base}.events.jsonl`),
     ticket: o.ticket,
     ticketRecordId: o.ticketRecordId ?? null,
     repo: o.repo ?? null,
@@ -8925,7 +9201,7 @@ function describePlan(p) {
 var pidPathFor = (streamPath) => `${streamPath}.pid`;
 function readRunSidecar(streamPath) {
   try {
-    const sc = JSON.parse(readFileSync17(pidPathFor(streamPath), "utf8"));
+    const sc = JSON.parse(readFileSync18(pidPathFor(streamPath), "utf8"));
     return typeof sc.pid === "number" && typeof sc.spawnedAt === "string" && typeof sc.role === "string" ? sc : null;
   } catch {
     return null;
@@ -8961,7 +9237,7 @@ function identityOf(plan, adapterHarness) {
 var withoutKey = ({ apiKey: _apiKey, ...rest }) => rest;
 function openSink(path) {
   try {
-    mkdirSync10(dirname7(path), { recursive: true });
+    mkdirSync11(dirname8(path), { recursive: true });
     return createWriteStream(path, { flags: "a" });
   } catch {
     return void 0;
@@ -9143,7 +9419,7 @@ var RunObserver = class {
 };
 function writeRunMeta(id, startedAt, liveTicket, extra) {
   try {
-    writeFileSync11(`${id.streamPath}.meta.json`, JSON.stringify({
+    writeFileSync12(`${id.streamPath}.meta.json`, JSON.stringify({
       route: id.route,
       role: id.role,
       hint: id.ticket,
@@ -9303,7 +9579,7 @@ function spawnAgent(plan, emit, hintMoved) {
   return new Promise((resolve6, reject) => {
     let streamFd;
     try {
-      mkdirSync10(dirname7(plan.streamPath), { recursive: true });
+      mkdirSync11(dirname8(plan.streamPath), { recursive: true });
       streamFd = openSync3(plan.streamPath, "a");
     } catch (e) {
       void endSink(eventsSink);
@@ -9338,7 +9614,7 @@ function spawnAgent(plan, emit, hintMoved) {
         promptSha: plan.promptSha
       };
       try {
-        writeFileSync11(pidPathFor(plan.streamPath), JSON.stringify(sidecar));
+        writeFileSync12(pidPathFor(plan.streamPath), JSON.stringify(sidecar));
       } catch {
       }
     }
@@ -9841,7 +10117,7 @@ async function runSelftest(i, deps = realDeps) {
     ...adapter.runEnv(spec),
     [KEY_VAR]: i.apiKey
   };
-  const cwd = mkdtempSync(join21(tmpdir2(), "crew-selftest-"));
+  const cwd = mkdtempSync(join22(tmpdir2(), "crew-selftest-"));
   try {
     const run2 = await deps.run({
       bin: invocation.bin,
@@ -9874,11 +10150,11 @@ function formatResult(r) {
   const secs = `${(r.ms / 1e3).toFixed(1)}s`;
   return r.ok ? `${r.toolchain}: PASS ${r.detail} (${secs}${tok})` : `${r.toolchain}: FAIL ${r.failure} \u2014 ${r.detail} (${secs})`;
 }
-var fileFor2 = (stateDir) => join21(stateDir, "selftest.json");
+var fileFor2 = (stateDir) => join22(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync20(p) ? JSON.parse(readFileSync18(p, "utf8")) : {};
+    return existsSync21(p) ? JSON.parse(readFileSync19(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -9886,8 +10162,8 @@ function readSelftest(stateDir) {
 function recordSelftest(stateDir, results) {
   const all = readSelftest(stateDir);
   for (const r of results) all[r.toolchain] = r;
-  mkdirSync11(stateDir, { recursive: true });
-  writeFileSync12(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
+  mkdirSync12(stateDir, { recursive: true });
+  writeFileSync13(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
 `);
 }
 function doctorSelftestLines(stored, toolchains) {
@@ -9899,7 +10175,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname20, join as join41, basename as basename12 } from "path";
+import { resolve as resolve5, dirname as dirname21, join as join42, basename as basename12 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir10 } from "os";
 import { spawnSync as spawnSync7 } from "child_process";
@@ -9937,6 +10213,11 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "workspace",
   "workspace-id",
   "write",
+  "token",
+  "source",
+  "var",
+  "path",
+  "service",
   "topic",
   "assignee",
   "issue",
@@ -10084,14 +10365,14 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/connect-resume.ts
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, rmSync as rmSync11, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname8, join as join22 } from "path";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync20, rmSync as rmSync11, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname9, join as join23 } from "path";
 function lastSessionFile(stateDir) {
-  return join22(stateDir, "connect-session.json");
+  return join23(stateDir, "connect-session.json");
 }
 function readPointers(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync19(lastSessionFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync20(lastSessionFile(stateDir), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const out = {};
     for (const [host, v] of Object.entries(parsed)) {
@@ -10105,8 +10386,8 @@ function readPointers(stateDir) {
 }
 function writePointers(stateDir, pointers) {
   const file = lastSessionFile(stateDir);
-  mkdirSync12(dirname8(file), { recursive: true });
-  writeFileSync13(file, `${JSON.stringify(pointers, null, 2)}
+  mkdirSync13(dirname9(file), { recursive: true });
+  writeFileSync14(file, `${JSON.stringify(pointers, null, 2)}
 `, { mode: 384 });
 }
 function rememberSession(stateDir, host, workspaceSlug) {
@@ -10191,15 +10472,15 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync13, readFileSync as readFileSync20, readdirSync as readdirSync9, rmSync as rmSync12, statSync as statSync6, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname9, join as join23 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync14, readFileSync as readFileSync21, readdirSync as readdirSync9, rmSync as rmSync12, statSync as statSync7, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname10, join as join24 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
-  return join23(stateDir, "cloned-checkouts.json");
+  return join24(stateDir, "cloned-checkouts.json");
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync20(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync21(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -10209,8 +10490,8 @@ function recordClonedCheckout(stateDir, dir) {
   const known = readClonedCheckouts(stateDir);
   if (known.includes(dir)) return;
   const file = clonedCheckoutsFile(stateDir);
-  mkdirSync13(dirname9(file), { recursive: true });
-  writeFileSync14(file, `${JSON.stringify([...known, dir], null, 2)}
+  mkdirSync14(dirname10(file), { recursive: true });
+  writeFileSync15(file, `${JSON.stringify([...known, dir], null, 2)}
 `);
 }
 var mark = (dryRun) => dryRun ? "would-remove" : "removed";
@@ -10262,7 +10543,7 @@ async function runReset(o, fx) {
     for (const dir of readClonedCheckouts(o.stateDir)) steps.push(removeCheckout(dir, o.dryRun, fx));
   }
   steps.push(...removeState(o.stateDir, o.dryRun));
-  if (existsSync21(o.configFile)) {
+  if (existsSync22(o.configFile)) {
     if (!o.dryRun) rmSync12(o.configFile, { force: true });
     steps.push({ step: "config", target: o.configFile, action: mark(o.dryRun) });
   } else {
@@ -10271,7 +10552,7 @@ async function runReset(o, fx) {
   return steps;
 }
 function removeCheckout(dir, dryRun, fx) {
-  if (!existsSync21(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
+  if (!existsSync22(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
   const { dirty, linkedWorktrees } = fx.inspectCheckout(dir);
   if (dirty.length) {
     return { step: "checkout", target: dir, action: "kept", detail: `has uncommitted changes (${dirty.length} path${dirty.length === 1 ? "" : "s"}: ${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? ", \u2026" : ""})` };
@@ -10284,15 +10565,15 @@ function removeCheckout(dir, dryRun, fx) {
 }
 function removeState(stateDir, dryRun) {
   const out = [];
-  const targets = [join23(stateDir, "resolved"), join23(stateDir, "keys"), clonedCheckoutsFile(stateDir), join23(stateDir, "connect-session.json"), join23(stateDir, "reload-requested"), join23(stateDir, "daemon.started")];
+  const targets = [join24(stateDir, "resolved"), join24(stateDir, "keys"), clonedCheckoutsFile(stateDir), join24(stateDir, "connect-session.json"), join24(stateDir, "reload-requested"), join24(stateDir, "daemon.started")];
   try {
     for (const name of readdirSync9(stateDir)) {
-      if (name.startsWith(".") && statSync6(join23(stateDir, name)).isFile()) targets.push(join23(stateDir, name));
+      if (name.startsWith(".") && statSync7(join24(stateDir, name)).isFile()) targets.push(join24(stateDir, name));
     }
   } catch {
   }
   for (const t of targets) {
-    if (!existsSync21(t)) continue;
+    if (!existsSync22(t)) continue;
     if (!dryRun) rmSync12(t, { recursive: true, force: true });
     out.push({ step: "state", target: t, action: mark(dryRun) });
   }
@@ -11080,8 +11361,8 @@ ${waiting.map((t) => `| ${displayKey2(t)} | ${t.status} | ${blockers(t, i)} |`).
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync15 } from "fs";
-import { join as join24 } from "path";
+import { writeFileSync as writeFileSync16 } from "fs";
+import { join as join25 } from "path";
 
 // src/stalled.ts
 var STALLED_AFTER_CYCLES = 30;
@@ -11388,7 +11669,7 @@ async function decideCycle(o) {
   }
   return decision;
 }
-var digestPath = (stateDir, route, role, runId) => join24(stateDir, `digest-${route}-${role}${runId ? `-${runId}` : ""}.md`);
+var digestPath = (stateDir, route, role, runId) => join25(stateDir, `digest-${route}-${role}${runId ? `-${runId}` : ""}.md`);
 function otherRunsRemoved(tickets, own) {
   if (!own) return tickets;
   return tickets.filter((t) => t.id === own.ticket.id || !own.inFlight(t.id));
@@ -11466,7 +11747,7 @@ function writeDigest(o, d, role, stateDir, runId, own) {
 
 ${body}` : body;
     const path = digestPath(stateDir, routeSlug(o.route.route), role, runId);
-    writeFileSync15(path, text);
+    writeFileSync16(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -11949,13 +12230,13 @@ Ship ${shipName2} found: ${problem}. The release refuses to squash a ref nobody
 var localRefSkipReported = (ticket, problem, events) => events.some((e) => e.record_id === ticket.id && e.event_type === "local_ref_skip" && (e.message ?? "").includes(problem));
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname10, join as join25 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync22, mkdirSync as mkdirSync14, writeFileSync as writeFileSync16 } from "fs";
+import { delimiter, dirname as dirname11, join as join26 } from "path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync23, mkdirSync as mkdirSync15, writeFileSync as writeFileSync17 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync22;
+  const exists = opts.configExists ?? existsSync23;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -11972,7 +12253,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join25(dir, name);
+    const candidate = join26(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -11998,9 +12279,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname10(env.nodePath);
+  const nodeDir = dirname11(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname10(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname11(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -12011,7 +12292,7 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname10(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname11(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
@@ -12033,9 +12314,9 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text) {
-  mkdirSync14(dirname10(path), { recursive: true });
+  mkdirSync15(dirname11(path), { recursive: true });
   try {
-    writeFileSync16(path, text, { mode: 384, flag: "wx" });
+    writeFileSync17(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -12069,7 +12350,7 @@ Wrote ${o.configPath}.
 // src/connect-json.ts
 import { accessSync as accessSync3, constants as constants3 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname11, join as join26 } from "path";
+import { dirname as dirname12, join as join27 } from "path";
 import { delimiter as delimiter2 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json, write) {
@@ -12108,12 +12389,12 @@ function agentBinSearchDirs(home, pathEnv, extraPath) {
   const dirs = [
     ...pathEnv.split(delimiter2),
     ...(extraPath ?? "").split(delimiter2),
-    join26(home, ".local/bin"),
-    join26(home, ".claude/local"),
+    join27(home, ".local/bin"),
+    join27(home, ".claude/local"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    join26(home, ".npm-global/bin"),
-    join26(home, ".volta/bin")
+    join27(home, ".npm-global/bin"),
+    join27(home, ".volta/bin")
   ];
   return [...new Set(dirs.filter(Boolean))];
 }
@@ -12135,7 +12416,7 @@ function flagWizardAnswers(f, env) {
   const agentBin = f.agentBin ?? found?.bin;
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
   const dockerPath = f.hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = f.extraPath ?? deriveExtraPath([dirname11(env.nodePath), pnpmPath ? dirname11(pnpmPath) : void 0, dockerPath ? dirname11(dockerPath) : void 0]);
+  const extraPath = f.extraPath ?? deriveExtraPath([dirname12(env.nodePath), pnpmPath ? dirname12(pnpmPath) : void 0, dockerPath ? dirname12(dockerPath) : void 0]);
   return {
     answers: {
       name: f.shipName?.trim() || env.hostname,
@@ -12149,8 +12430,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync17, existsSync as existsSync23, copyFileSync, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync2, rmSync as rmSync13 } from "fs";
-import { dirname as dirname12, join as join27 } from "path";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync18, existsSync as existsSync24, copyFileSync, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync2, rmSync as rmSync13 } from "fs";
+import { dirname as dirname13, join as join28 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/release.ts
@@ -12891,13 +13172,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join27(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join28(o.cwd, f));
   const first = files[0];
-  if (!existsSync23(first)) {
+  if (!existsSync24(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync21(first, "utf8")).version;
+  const current = JSON.parse(readFileSync22(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -12910,27 +13191,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync21(f, "utf8");
+    const src = readFileSync22(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync17(f, out);
+    writeFileSync18(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join27(o.cwd, file);
+  const path = join28(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync23(path) ? readFileSync21(path, "utf8") : "# Changelog\n";
-  writeFileSync17(path, insertChangelogSection(existing, section));
+  const existing = existsSync24(path) ? readFileSync22(path, "utf8") : "# Changelog\n";
+  writeFileSync18(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -13023,8 +13304,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join27(tmpdir3(), "crew-release-"));
-  const dir = join27(root, "checkout");
+  const root = mkdtempSync2(join28(tmpdir3(), "crew-release-"));
+  const dir = join28(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -13034,10 +13315,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join27(o.cwd, f);
-    if (!existsSync23(src)) continue;
-    mkdirSync15(dirname12(join27(dir, f)), { recursive: true });
-    copyFileSync(src, join27(dir, f));
+    const src = join28(o.cwd, f);
+    if (!existsSync24(src)) continue;
+    mkdirSync16(dirname13(join28(dir, f)), { recursive: true });
+    copyFileSync(src, join28(dir, f));
   }
   return { dir, branch, close };
 }
@@ -13738,12 +14019,12 @@ Passed: ${passed}.${willClose ? " Closing this alert." : ""}`,
 }
 
 // src/live-runs.ts
-import { existsSync as existsSync25, readdirSync as readdirSync11 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync26, readdirSync as readdirSync11 } from "fs";
+import { join as join30 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync24, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync10, readFileSync as readFileSync23 } from "fs";
+import { join as join29 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -13762,21 +14043,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync24(path)) return false;
+  if (!existsSync25(path)) return false;
   try {
-    return JSON.parse(readFileSync22(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync23(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join28(o.stateDir, "streams");
-  if (!existsSync24(dir)) return [];
+  const dir = join29(o.stateDir, "streams");
+  if (!existsSync25(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join28(dir, name);
+    const streamPath = join29(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -13830,12 +14111,12 @@ async function reconcileRuns(o) {
 
 // src/live-runs.ts
 function liveRuns(stateDir, isAlive = runIsAlive) {
-  const dir = join29(stateDir, "streams");
-  if (!existsSync25(dir)) return [];
+  const dir = join30(stateDir, "streams");
+  if (!existsSync26(dir)) return [];
   const out = [];
   for (const name of readdirSync11(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join29(dir, name);
+    const streamPath = join30(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || !isAlive(sidecar)) continue;
@@ -13934,6 +14215,70 @@ function formatProjectsReport(report) {
 `;
 }
 
+// src/forge-cmd.ts
+import { parseDocument } from "yaml";
+function runCredential(action, stdin, forges, stateDir, env = process.env) {
+  try {
+    return { code: 0, out: answerCredential(action ?? "", parseCredentialInput(stdin), forges, stateDir, env), err: "" };
+  } catch (e) {
+    return { code: 0, out: "", err: `crew credential: ${e.message}
+` };
+  }
+}
+function sourceFromArgs(a) {
+  const source = a.source ?? "file";
+  if (!(source in TOKEN_SOURCES)) return `--source must be one of: ${Object.keys(TOKEN_SOURCES).join(", ")}`;
+  if (source === "env") return a.var ? { source: "env", var: a.var } : "--source env needs --var NAME";
+  if (source === "file") return a.path ? { source: "file", path: a.path } : { source: "file" };
+  return a.service ? { source: "keychain", service: a.service } : { source: "keychain" };
+}
+function runForge(a, io) {
+  const fail = (m, code = 2) => ({ code, out: "", err: `crew forge: ${m}
+` });
+  const sub = a.sub ?? "list";
+  if (sub === "list") {
+    const rows = Object.keys(io.forges ?? {}).map((h) => {
+      let state;
+      try {
+        state = hasForgeToken(io.forges, h, io.stateDir, io.env) ? "token present" : "NO TOKEN";
+      } catch {
+        state = "unreadable";
+      }
+      return `${h.padEnd(20)} ${state.padEnd(14)} ${describeForgeSource(io.forges, h, io.stateDir)}`;
+    });
+    return { code: 0, out: rows.length ? `${rows.join("\n")}
+` : "no forges configured (ship.forges in crew.yaml)\n", err: "" };
+  }
+  if (sub !== "set" && sub !== "rotate") return fail(`unknown subcommand "${sub}" (have: set, rotate, list)`);
+  if (!a.host) return fail(`crew forge ${sub} <host> [--token T | --token-stdin] [--source file|keychain|env] [--var NAME] [--path P] [--service S]`);
+  const host = a.host.toLowerCase();
+  let existing = forgeFor(io.forges, host);
+  if (sub === "rotate" && !existing) return fail(`no forges.${host} entry to rotate; use \`crew forge set ${host}\``);
+  if (!existing) {
+    const tok = sourceFromArgs(a);
+    if (typeof tok === "string") return fail(tok);
+    const doc = parseDocument(io.readFile(io.configFile));
+    doc.setIn(["ship", "forges", host, "token"], tok);
+    io.writeFile(io.configFile, doc.toString());
+    io.forges = { ...io.forges ?? {}, [host]: { username: "x-access-token", token: tok } };
+    existing = forgeFor(io.forges, host);
+  }
+  if (existing.entry.token.source === "env") {
+    return { code: 0, out: `forges.${host} reads ${describeForgeSource(io.forges, host, io.stateDir)}; export it where crew runs
+`, err: "" };
+  }
+  const token = a.tokenStdin ? io.stdin().trim() : a.token ?? io.env.CREW_FORGE_TOKEN;
+  if (!token?.trim()) return fail("no token given (use --token, --token-stdin or CREW_FORGE_TOKEN in the environment)");
+  try {
+    storeForgeToken(io.forges, host, token, io.stateDir, io.env);
+  } catch (e) {
+    if (e instanceof ForgeError) return fail(e.message, 1);
+    throw e;
+  }
+  return { code: 0, out: `${sub === "rotate" ? "rotated" : "stored"} the ${host} token in ${describeForgeSource(io.forges, host, io.stateDir)}
+`, err: "" };
+}
+
 // src/whoami.ts
 async function buildWhoami(routes, deps = {}) {
   const doFetch = deps.fetch ?? fetch;
@@ -14105,7 +14450,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync26, statSync as statSync7, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync27, statSync as statSync8, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -14206,8 +14551,8 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync26(file)) return { events: [], offset: from };
-  const size = statSync7(file).size;
+  if (!existsSync27(file)) return { events: [], offset: from };
+  const size = statSync8(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
   const fd = openSync4(file, "r");
@@ -14449,31 +14794,31 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync24, renameSync as renameSync2, writeFileSync as writeFileSync19 } from "fs";
-import { dirname as dirname14 } from "path";
-import { parseDocument } from "yaml";
+import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync25, renameSync as renameSync2, writeFileSync as writeFileSync20 } from "fs";
+import { dirname as dirname15 } from "path";
+import { parseDocument as parseDocument2 } from "yaml";
 
 // src/machine-id.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync16, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname13, join as join30 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync24, writeFileSync as writeFileSync19 } from "fs";
+import { dirname as dirname14, join as join31 } from "path";
 function machineIdPathFor(stateDir) {
-  return join30(stateDir, "machine-id");
+  return join31(stateDir, "machine-id");
 }
 var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
-      const out = execFileSync4("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      const out = execFileSync5("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync27(p)) {
-        const id = readFileSync23(p, "utf8").trim();
+      if (existsSync28(p)) {
+        const id = readFileSync24(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -14484,15 +14829,15 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync27(path)) {
-    const cached = readFileSync23(path, "utf8").trim();
+  if (existsSync28(path)) {
+    const cached = readFileSync24(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync16(dirname13(path), { recursive: true });
-  writeFileSync18(path, `${hashed}
+  mkdirSync17(dirname14(path), { recursive: true });
+  writeFileSync19(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -14521,11 +14866,11 @@ function planNameSync(local, row, lastSynced) {
   return { drift: "local", action: "push" };
 }
 function shipNameOfYaml(text) {
-  const v = parseDocument(text).getIn(["ship", "name"]);
+  const v = parseDocument2(text).getIn(["ship", "name"]);
   return typeof v === "string" && v.trim() ? v.trim() : void 0;
 }
 function setShipNameInYaml(text, name) {
-  const doc = parseDocument(text);
+  const doc = parseDocument2(text);
   doc.setIn(["ship", "name"], name);
   return doc.toString();
 }
@@ -14563,34 +14908,34 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync28(resolvedFile)) return void 0;
+  if (!existsSync29(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync24(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync25(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync28(resolvedFile)) return;
+  if (!existsSync29(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync24(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
   } catch {
     return;
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync17(dirname14(resolvedFile), { recursive: true });
+  mkdirSync18(dirname15(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync19(tmp, `${JSON.stringify(raw, null, 2)}
+  writeFileSync20(tmp, `${JSON.stringify(raw, null, 2)}
 `);
   renameSync2(tmp, resolvedFile);
 }
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync24(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync25(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -14614,8 +14959,8 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text = readFileSync24(i.configFile, "utf8");
-    writeFileSync19(i.configFile, setShipNameInYaml(text, result.name));
+    const text = readFileSync25(i.configFile, "utf8");
+    writeFileSync20(i.configFile, setShipNameInYaml(text, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
       i.emit?.warn(
@@ -15265,8 +15610,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "fs";
-import { dirname as dirname15 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "fs";
+import { dirname as dirname16 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -15299,12 +15644,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync29(resolvedPath) ? JSON.parse(readFileSync25(resolvedPath, "utf8")) : {};
+    const raw = existsSync30(resolvedPath) ? JSON.parse(readFileSync26(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync18(dirname15(resolvedPath), { recursive: true });
-    writeFileSync20(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync19(dirname16(resolvedPath), { recursive: true });
+    writeFileSync21(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -15408,7 +15753,7 @@ async function showLogEntry(route, entryId, opts = {}) {
 
 // src/repos-check.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 import { basename as basename8 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
 function checkHookSyntax(script, shell) {
@@ -15449,7 +15794,7 @@ function checkRepoSpec(dir, opts = {}) {
   }
   let parsed;
   try {
-    parsed = parseRepoConfig(readFileSync26(file, "utf8"), file);
+    parsed = parseRepoConfig(readFileSync27(file, "utf8"), file);
   } catch (e) {
     if (!(e instanceof RepoConfigError)) throw e;
     return { ...empty, file, error: e.message, exitCode: 1 };
@@ -15502,12 +15847,12 @@ function renderRepoCheck(r) {
 }
 
 // src/repos-hooks.ts
-import { isMap as isMap2, parseDocument as parseDocument3, YAMLMap } from "yaml";
+import { isMap as isMap2, parseDocument as parseDocument4, YAMLMap } from "yaml";
 
 // src/repos-cmd.ts
 import { homedir as homedir9 } from "os";
-import { basename as basename9, join as join31, resolve as resolve3 } from "path";
-import { isMap, isSeq, parseDocument as parseDocument2, stringify as stringify2 } from "yaml";
+import { basename as basename9, join as join32, resolve as resolve3 } from "path";
+import { isMap, isSeq, parseDocument as parseDocument3, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
 function normalizeRemote(url) {
@@ -15531,7 +15876,7 @@ function matchRepoName(origin, resolved) {
   return void 0;
 }
 function routeNamesOf(text) {
-  const routes = parseDocument2(text).get("routes", true);
+  const routes = parseDocument3(text).get("routes", true);
   if (!isSeq(routes)) return [];
   return routes.items.flatMap((i) => isMap(i) && typeof i.get("route") === "string" ? [i.get("route")] : []);
 }
@@ -15566,7 +15911,7 @@ function routeMapOf(doc, route) {
   throw new ReposError(`no route "${route}" in the config (have: ${have})`);
 }
 function configuredRepos(text, route, base) {
-  const doc = parseDocument2(text);
+  const doc = parseDocument3(text);
   const m = routeMapOf(doc, route);
   const repos = m.get("repos");
   if (isMap(repos)) {
@@ -15581,7 +15926,7 @@ function configuredRepos(text, route, base) {
   return dir ? [{ name: basename9(String(dir)), dir: expandDir(String(dir), base) }] : [];
 }
 function cloneBaseOf(text, route, base, isCheckout) {
-  const m = routeMapOf(parseDocument2(text), route);
+  const m = routeMapOf(parseDocument3(text), route);
   const repos = m.get("repos", true);
   if (isMap(repos) && repos.items.length > 0) return null;
   const dir = m.get("dir");
@@ -15590,7 +15935,7 @@ function cloneBaseOf(text, route, base, isCheckout) {
   return isCheckout(abs) ? null : abs;
 }
 function routeSetsHooks(text, route, name) {
-  const m = routeMapOf(parseDocument2(text), route);
+  const m = routeMapOf(parseDocument3(text), route);
   const repos = m.get("repos", true);
   let target = m;
   if (isMap(repos)) target = repos.get(name, true);
@@ -15647,7 +15992,7 @@ function listRepoRows(i) {
   return rows;
 }
 function planRepoAdd(i) {
-  const doc = parseDocument2(i.text);
+  const doc = parseDocument3(i.text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, i.route);
   let existing = configuredRepos(i.text, i.route, i.base);
@@ -15698,7 +16043,7 @@ function planRepoAdd(i) {
   return { text: String(doc), mode, name, block: renderBlock(m), warning, unmatched: !matched, droppedDir };
 }
 function planRepoRemove(text, base, route, path) {
-  const doc = parseDocument2(text);
+  const doc = parseDocument3(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route);
   const target = expandDir(path, base);
@@ -15776,7 +16121,7 @@ function planRepoClone(i) {
       `the Repos row "${name}" has no remote to clone from \u2014 attach an existing checkout with \`crew repos add ${i.route} ${name} <path>\`, or set the row's remote in the tracker and re-run \`crew connect\``
     );
   }
-  const doc = parseDocument2(i.text);
+  const doc = parseDocument3(i.text);
   const m = routeMapOf(doc, i.route);
   const existing = configuredRepos(i.text, i.route, i.base);
   if (existing.some((e) => e.name.toLowerCase() === name.toLowerCase())) {
@@ -15784,7 +16129,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join31(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join32(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
   return { ...add, remote, target };
 }
@@ -15930,7 +16275,7 @@ function repoDirOf(text, base, route, name) {
   return hit.dir;
 }
 function planRouteHooks(text, route, name, hooks, opts = {}) {
-  const doc = parseDocument3(text);
+  const doc = parseDocument4(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route);
   const repos = m.get("repos", true);
@@ -15967,7 +16312,7 @@ function planRouteHooks(text, route, name, hooks, opts = {}) {
   return { text: String(doc), written, kept, replaced };
 }
 function clearRouteHooks(text, route, name) {
-  const doc = parseDocument3(text);
+  const doc = parseDocument4(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route);
   const repos = m.get("repos", true);
@@ -16011,7 +16356,7 @@ function existingRepoConfig(f) {
 }
 
 // src/repos-hooks-agent.ts
-import { spawn as spawn4, execFileSync as execFileSync5 } from "child_process";
+import { spawn as spawn4, execFileSync as execFileSync6 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
 import { isAbsolute as isAbsolute2, relative } from "path";
 var AgentSuggestError = class extends Error {
@@ -16114,7 +16459,7 @@ function classifyFailure(o) {
 }
 function porcelain(dir) {
   try {
-    return execFileSync5("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
+    return execFileSync6("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8" });
   } catch {
     return void 0;
   }
@@ -16183,7 +16528,7 @@ ${run2.err}` });
 }
 
 // src/sample-ticket.ts
-import { basename as basename10, dirname as dirname17, join as join32 } from "path";
+import { basename as basename10, dirname as dirname18, join as join33 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -16206,8 +16551,8 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join32(dirname17(existing[0]), SAMPLE_REPO);
-  return join32(reposBase, workspace, SAMPLE_REPO);
+  if (existing.length > 0) return join33(dirname18(existing[0]), SAMPLE_REPO);
+  return join33(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
 function sampleDescription() {
@@ -16251,7 +16596,7 @@ function planSampleTicket(i) {
 }
 
 // src/doctor-fix.ts
-import { parseDocument as parseDocument4 } from "yaml";
+import { parseDocument as parseDocument5 } from "yaml";
 var sound = (r) => r.hasRepos && r.problems.length === 0;
 function planFix(f) {
   const actions = [];
@@ -16289,7 +16634,7 @@ function routesInScope(routes, named) {
   return named ? routes.filter((r) => r.route === named) : routes;
 }
 function planEnable(text, route) {
-  const doc = parseDocument4(text);
+  const doc = parseDocument5(text);
   routeMapOf(doc, route).set("enabled", true);
   return String(doc);
 }
@@ -16299,8 +16644,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync30, readFileSync as readFileSync27, readdirSync as readdirSync12 } from "fs";
-import { basename as basename11, dirname as dirname18, join as join33, resolve as resolve4 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync28, readdirSync as readdirSync12 } from "fs";
+import { basename as basename11, dirname as dirname19, join as join34, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -16364,7 +16709,7 @@ function worktreeTicketNumbers(target) {
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname18(target.dir.replace(/[/\\]+$/, ""));
+  const parent = dirname19(target.dir.replace(/[/\\]+$/, ""));
   const stem = `${basename11(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
@@ -16377,7 +16722,7 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join33(parent, name);
+    const path = join34(parent, name);
     if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
   }
   return out;
@@ -16412,7 +16757,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync30(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync31(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -16420,7 +16765,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync30(a.path)) {
+    if (!dryRun && existsSync31(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -16431,7 +16776,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync30(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync31(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -16480,7 +16825,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync27(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync28(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -16585,16 +16930,16 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync31, readdirSync as readdirSync13, rmSync as rmSync14, statSync as statSync8 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync32, readdirSync as readdirSync13, rmSync as rmSync14, statSync as statSync9 } from "fs";
+import { join as join35 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join34(stateDir, "streams");
-  if (!existsSync31(dir)) return [];
+  const dir = join35(stateDir, "streams");
+  if (!existsSync32(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync13(dir).map((name) => join34(dir, name)).filter((path) => {
+  return readdirSync13(dir).map((name) => join35(dir, name)).filter((path) => {
     try {
-      return statSync8(path).mtimeMs < cutoff;
+      return statSync9(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -16618,11 +16963,11 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync31(stateDir)) return [];
+  if (!existsSync32(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync13(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join34(stateDir, name)).filter((path) => {
+  return readdirSync13(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join35(stateDir, name)).filter((path) => {
     try {
-      return statSync8(path).mtimeMs < cutoff;
+      return statSync9(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -16630,30 +16975,30 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync33, existsSync as existsSync37, mkdirSync as mkdirSync24, writeFileSync as writeFileSync25, rmSync as rmSync17, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync3, statSync as statSync11, readdirSync as readdirSync17 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync34, existsSync as existsSync38, mkdirSync as mkdirSync25, writeFileSync as writeFileSync26, rmSync as rmSync17, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync3, statSync as statSync12, readdirSync as readdirSync17 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync28, rmSync as rmSync15, writeFileSync as writeFileSync21 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync20, readFileSync as readFileSync29, rmSync as rmSync15, writeFileSync as writeFileSync22 } from "fs";
+import { join as join36 } from "path";
 var PeriscopeError = class extends Error {
 };
-var priorDir = (stateDir) => join35(stateDir, "periscope-priors");
-var priorPath = (stateDir, ticketRecordId) => join35(priorDir(stateDir), `${ticketRecordId}.json`);
+var priorDir = (stateDir) => join36(stateDir, "periscope-priors");
+var priorPath = (stateDir, ticketRecordId) => join36(priorDir(stateDir), `${ticketRecordId}.json`);
 function removePeriscopePrior(stateDir, ticketRecordId) {
   rmSync15(priorPath(stateDir, ticketRecordId), { force: true });
 }
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
-    mkdirSync19(priorDir(stateDir), { recursive: true });
-    writeFileSync21(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
+    mkdirSync20(priorDir(stateDir), { recursive: true });
+    writeFileSync22(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
 }
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync32(p) ? JSON.parse(readFileSync28(p, "utf8")) : void 0;
+    return existsSync33(p) ? JSON.parse(readFileSync29(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -17044,14 +17389,14 @@ ${tail2(preview.output)}`);
 }
 
 // src/periscope-idle.ts
-import { execFileSync as execFileSync6 } from "child_process";
-import { statSync as statSync9 } from "fs";
-import { join as join36 } from "path";
+import { execFileSync as execFileSync7 } from "child_process";
+import { statSync as statSync10 } from "fs";
+import { join as join37 } from "path";
 var MAX_SCANNED_FILES = 2e4;
 function newestWorktreeMtime(root) {
   let listing;
   try {
-    listing = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    listing = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       cwd: root,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -17066,7 +17411,7 @@ function newestWorktreeMtime(root) {
     if (!rel) continue;
     if (++scanned > MAX_SCANNED_FILES) break;
     try {
-      const m = statSync9(join36(root, rel)).mtimeMs;
+      const m = statSync10(join37(root, rel)).mtimeMs;
       if (newest === null || m > newest) newest = m;
     } catch {
     }
@@ -17141,21 +17486,21 @@ async function runPeriscopeIdlePass(d) {
 import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync33, mkdirSync as mkdirSync20, readFileSync as readFileSync29, chmodSync } from "fs";
-import { dirname as dirname19, join as join37 } from "path";
+import { execFileSync as execFileSync8 } from "child_process";
+import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync30, chmodSync as chmodSync2 } from "fs";
+import { dirname as dirname20, join as join38 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join37(stateDir, "ssh", "id_ed25519");
+  return join38(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync33(privateKeyPath)) {
-    mkdirSync20(dirname19(privateKeyPath), { recursive: true });
+  if (!existsSync34(privateKeyPath)) {
+    mkdirSync21(dirname20(privateKeyPath), { recursive: true });
     try {
-      execFileSync7("ssh-keygen", [
+      execFileSync8("ssh-keygen", [
         "-t",
         "ed25519",
         "-N",
@@ -17171,17 +17516,17 @@ function ensureShipSshKeypair(stateDir) {
       const err = e;
       throw new SshKeyError(`ssh-keygen failed: ${err.stderr?.toString().trim() || err.message}`);
     }
-    chmodSync(privateKeyPath, 384);
+    chmodSync2(privateKeyPath, 384);
   }
-  if (!existsSync33(publicKeyPath)) {
+  if (!existsSync34(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync29(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync30(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
   try {
-    execFileSync7("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync8("ssh-keygen", ["-V"], { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -17189,11 +17534,11 @@ function sshKeygenAvailable() {
 }
 
 // src/passenger-containers.ts
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync9 } from "child_process";
 import { createHash as createHash6 } from "crypto";
 var realExec = (cmd, args, opts) => {
   try {
-    return execFileSync8(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
+    return execFileSync9(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
   } catch (e) {
     const err = e;
     const why = [err.stderr, err.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
@@ -17393,9 +17738,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync30, writeFileSync as writeFileSync22, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync31, writeFileSync as writeFileSync23, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
 import { randomInt } from "crypto";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn5(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -17462,21 +17807,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join38(stateDir, "passengers", `${workspaceId}.json`);
+  return join39(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync34(path)) return void 0;
+  if (!existsSync35(path)) return void 0;
   try {
-    return JSON.parse(readFileSync30(path, "utf8"));
+    return JSON.parse(readFileSync31(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync21(join38(stateDir, "passengers"), { recursive: true });
-  writeFileSync22(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync22(join39(stateDir, "passengers"), { recursive: true });
+  writeFileSync23(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -17573,8 +17918,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join38(stateDir, "passengers");
-  if (!existsSync34(dir)) return [];
+  const dir = join39(stateDir, "passengers");
+  if (!existsSync35(dir)) return [];
   return readdirSync14(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -17695,8 +18040,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn6 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync31, writeFileSync as writeFileSync23, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync23, readFileSync as readFileSync32, writeFileSync as writeFileSync24, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
+import { join as join40 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -17785,21 +18130,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join39(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join40(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync35(path)) return void 0;
+  if (!existsSync36(path)) return void 0;
   try {
-    return JSON.parse(readFileSync31(path, "utf8"));
+    return JSON.parse(readFileSync32(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync22(join39(stateDir, "passengers"), { recursive: true });
-  writeFileSync23(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync23(join40(stateDir, "passengers"), { recursive: true });
+  writeFileSync24(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -17819,8 +18164,8 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join39(stateDir, "passengers");
-  if (!existsSync35(dir)) return [];
+  const dir = join40(stateDir, "passengers");
+  if (!existsSync36(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync15(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -17908,8 +18253,8 @@ function describeCause(err) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync23, readFileSync as readFileSync32, readdirSync as readdirSync16, rmSync as rmSync16, statSync as statSync10, writeFileSync as writeFileSync24 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync24, readFileSync as readFileSync33, readdirSync as readdirSync16, rmSync as rmSync16, statSync as statSync11, writeFileSync as writeFileSync25 } from "fs";
+import { join as join41 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
@@ -17972,7 +18317,7 @@ async function runDaemonLoop(o) {
 function latestMtime(path) {
   let stat;
   try {
-    stat = statSync10(path);
+    stat = statSync11(path);
   } catch {
     return 0;
   }
@@ -17980,7 +18325,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync16(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join40(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join41(path, entry.name)));
   }
   return latest;
 }
@@ -17989,23 +18334,23 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync36(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync37(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join40(stateDir, "reload-requested");
+  return join41(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join40(stateDir, "daemon.started");
+  return join41(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync23(stateDir, { recursive: true });
+  mkdirSync24(stateDir, { recursive: true });
   rmSync16(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync24(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync25(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync32(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync33(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -18014,7 +18359,7 @@ function readDaemonStarted(stateDir) {
 function configChangedAfter(files, startedAt) {
   for (const f of files) {
     try {
-      if (statSync10(f).mtimeMs > startedAt) return f;
+      if (statSync11(f).mtimeMs > startedAt) return f;
     } catch {
     }
   }
@@ -18485,7 +18830,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname20(process.execPath) : resolve5(dirname20(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname21(process.execPath) : resolve5(dirname21(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -18617,6 +18962,8 @@ function usage(problem, requested = false) {
   crew --version [--json]        print the crew version on one line (also: crew version); --json adds home and compiled
   crew status [route] [--json]   paused/running state; --json for a machine reader
   crew projects [--route R] [--json]   the Projects rows each route can read (id, name, prefix, work mode)
+  crew forge [set|rotate <host>] [--token T | --token-stdin] [--source file|keychain|env]   this ship's git-forge tokens (ship.forges)
+  crew credential get|store|erase   git credential helper answering from ship.forges (git runs it; not for hand use)
   crew whoami [route] [--json]   the signed-in identity, key role, operator Crew row and credential source per route
   crew reload                    make the running daemon re-read crew.yaml (--now: restart it immediately)
   crew doctor [route] [--fix] [--offline] [--json]   preflight; --fix enables clean routes and offers crew install;
@@ -18714,6 +19061,8 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "passenger-sync-daemon",
   "agents",
   "connect",
+  "credential",
+  "forge",
   "daemon",
   "deploy",
   "disconnect",
@@ -18917,9 +19266,9 @@ if (command === "passenger-sync-daemon") {
       firstRun = { answers, configPath };
       cfg = loadConfig(CREW_HOME, configPath, { text: renderShipBlock(answers), allowNoRoutes: true });
     } else {
-      const toleratesNoRoutes = command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "connect" && flag("sign-out");
+      const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset");
-      if (configless && !existsSync37(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync38(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -18933,6 +19282,33 @@ if (command === "passenger-sync-daemon") {
     }
     throw e;
   }
+  if (command === "credential") {
+    const r = runCredential(positional[1], readFileSync34(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    process.stdout.write(r.out);
+    process.stderr.write(r.err);
+    process.exit(r.code);
+  }
+  if (command === "forge") {
+    const r = runForge(
+      { sub: positional[1], host: positional[2], token: value("token"), tokenStdin: flag("token-stdin"), source: value("source"), var: value("var"), path: value("path"), service: value("service") },
+      {
+        forges: cfg.ship.forges,
+        stateDir: cfg.ship.stateDir,
+        configFile: cfg.configFile,
+        readFile: (p) => readFileSync34(p, "utf8"),
+        writeFile: (p, t) => writeFileSync26(p, t),
+        stdin: () => readFileSync34(0, "utf8"),
+        env: process.env
+      }
+    );
+    process.stdout.write(r.out);
+    process.stderr.write(r.err);
+    process.exit(r.code);
+  }
+  if (cfg.ship.forges) {
+    Object.assign(process.env, gitCredentialEnv({ crewCommand: crewCommandLine(), configFile: cfg.configFile }));
+    setForgeTokenHosts(Object.keys(cfg.ship.forges).filter((h) => hasForgeToken(cfg.ship.forges, h, cfg.ship.stateDir)));
+  }
   await hydrateApiKeys(cfg.routes);
   for (const w of cfg.warnings) process.stderr.write(`crew: warning: ${w}
 `);
@@ -19157,8 +19533,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join41(homedir10(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync37(staleTimer)) {
+      const staleTimer = join42(homedir10(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync38(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -19185,7 +19561,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync37(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync38(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -19203,7 +19579,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync37(p);
+    const unitExists = (p) => existsSync38(p);
     const crontab = o.host === "linux" ? spawnSync7("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -19220,7 +19596,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync25(cfg.configFile, planEnable(readFileSync33(cfg.configFile, "utf8"), a.route));
+          writeFileSync26(cfg.configFile, planEnable(readFileSync34(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -20324,7 +20700,7 @@ ${cu.tail.trimEnd()}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join41(CREW_HOME, "src"), join41(CREW_HOME, "dist"), join41(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join42(CREW_HOME, "src"), join42(CREW_HOME, "dist"), join42(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -20553,10 +20929,10 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync37(resolvedPath) ? JSON.parse(readFileSync33(resolvedPath, "utf8")) : {};
+        const raw = existsSync38(resolvedPath) ? JSON.parse(readFileSync34(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync24(dirOf2(resolvedPath), { recursive: true });
-        writeFileSync25(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync25(dirOf2(resolvedPath), { recursive: true });
+        writeFileSync26(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -20579,7 +20955,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync25(cfg.configFile, setShipNameInYaml(readFileSync33(cfg.configFile, "utf8"), newName));
+      writeFileSync26(cfg.configFile, setShipNameInYaml(readFileSync34(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -20626,14 +21002,14 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync33(cfg.configFile, "utf8");
+      const configText = readFileSync34(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
           const found = cfg.routes.find((r) => r.route === routeArg);
           if (!found) throw new ReposError(`no route "${routeArg}" in the config (have: ${cfg.routes.map((r) => r.route).join(", ") || "none"})`);
           const named2 = value("route") ? void 0 : positional[3];
-          const dir = named2 ? repoDirOf(configText, dirname20(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
+          const dir = named2 ? repoDirOf(configText, dirname21(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
           const target = reposOf(found).find((t) => resolvePath(t.dir) === dir || t.name === named2);
           const o = target ? found.repoOverrides[target.name] : void 0;
           runReposCheck(dir, {
@@ -20656,9 +21032,9 @@ ${cu.tail.trimEnd()}
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname20(cfg.configFile), a.route, a.name);
-          if (!existsSync37(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync37(resolvePath(dir, r)), list: (r) => {
+          const dir = repoDirOf(configText, dirname21(cfg.configFile), a.route, a.name);
+          if (!existsSync38(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync38(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync17(resolvePath(dir, r));
             } catch {
@@ -20666,7 +21042,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync33(resolvePath(dir, r), "utf8");
+              return readFileSync34(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -20708,19 +21084,19 @@ ${cu.tail.trimEnd()}
           let cleared;
           if (clear2) {
             const plan = clearRouteHooks(configText, a.route, a.name);
-            if (plan.removed.length > 0) writeFileSync25(cfg.configFile, plan.text);
+            if (plan.removed.length > 0) writeFileSync26(cfg.configFile, plan.text);
             cleared = { file: cfg.configFile, removed: plan.removed };
           }
           if (write && suggestion.source === null && recipeIds.length === 0 && hookSpecs.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, picked.hooks, { replace: flag("replace") });
-            writeFileSync25(cfg.configFile, plan.text);
+            writeFileSync26(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept, replaced: plan.replaced };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync25(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            writeFileSync26(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [], replaced: [] };
           }
           if (flag("json")) {
@@ -20776,7 +21152,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync37(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync38(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -20805,16 +21181,16 @@ ${cu.tail.trimEnd()}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync37(resolvedFile)) {
+      if (existsSync38(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync33(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync34(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname20(cfg.configFile);
-      const isCheckout = (d) => existsSync37(`${d}/.git`);
+      const base = dirname21(cfg.configFile);
+      const isCheckout = (d) => existsSync38(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -20824,11 +21200,11 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync37(d),
+              exists: (d) => existsSync38(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
-                  return Object.keys(parseRepoConfig(readFileSync33(resolvePath(d, f), "utf8"), f).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync34(resolvePath(d, f), "utf8"), f).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -20845,7 +21221,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync37(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync38(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -20857,9 +21233,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync37(plan2.target) && (existsSync37(`${plan2.target}/.git`) || readdirSync17(plan2.target).length > 0)) {
+          if (existsSync38(plan2.target) && (existsSync38(`${plan2.target}/.git`) || readdirSync17(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync37(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync38(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -20877,14 +21253,14 @@ ${cu.tail.trimEnd()}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync25(cfg.configFile, plan2.text);
+          writeFileSync26(cfg.configFile, plan2.text);
           if (plan2.droppedDir) process.stderr.write(`crew repos: dropped dir: ${plan2.droppedDir} from route ${routeName} \u2014 it is not a checkout (the clone base); checkouts now live under repos:
 `);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir10()));
-        const top = existsSync37(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync38(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -20936,15 +21312,15 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync37(resolvedFile)) {
-            const raw = JSON.parse(readFileSync33(resolvedFile, "utf8"));
+          if (existsSync38(resolvedFile)) {
+            const raw = JSON.parse(readFileSync34(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync25(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync26(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync25(cfg.configFile, plan.text);
+        writeFileSync26(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -21311,7 +21687,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync25(cfg.configFile, setShipNameInYaml(readFileSync33(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync26(cfg.configFile, setShipNameInYaml(readFileSync34(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -21354,10 +21730,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync37(resolvedPath);
+        const hadPreviousFile = existsSync38(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync33(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync34(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -21486,10 +21862,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync24(dirname20(resolvedPath), { recursive: true });
+          mkdirSync25(dirname21(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync25(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync26(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync3(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -21535,8 +21911,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync24(dirname20(apiKeyFile), { recursive: true });
-            writeFileSync25(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync25(dirname21(apiKeyFile), { recursive: true });
+            writeFileSync26(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -22270,7 +22646,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync37(p),
+            worktreeExists: (p) => existsSync38(p),
             caps: periscopeCaps(cfg.ship),
             runHook: async (name, cwd, env) => {
               const script = hit?.repo.config.hooks[name];
@@ -22364,10 +22740,10 @@ ${where.join("\n")}`);
           },
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
-              const src = join41(repoP.dir, f);
-              if (!existsSync37(src)) continue;
-              mkdirSync24(dirOf2(join41(path, f)), { recursive: true });
-              copyFileSync2(src, join41(path, f));
+              const src = join42(repoP.dir, f);
+              if (!existsSync38(src)) continue;
+              mkdirSync25(dirOf2(join42(path, f)), { recursive: true });
+              copyFileSync2(src, join42(path, f));
             }
             const setup = repoP.config.hooks.setup;
             return setup ? runScript(setup, { cwd: path, shell: shellP, onLine: (l) => {
@@ -22642,7 +23018,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync33(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync34(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -22684,8 +23060,8 @@ ${where.join("\n")}`);
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync24(cfg.ship.stateDir, { recursive: true });
-      writeFileSync25(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync25(cfg.ship.stateDir, { recursive: true });
+      writeFileSync26(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -22736,7 +23112,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text = readFileSync33(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync34(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -22759,8 +23135,8 @@ ${where.join("\n")}`);
       };
       if (!route.resolved) fail(`route ${route.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route, cfg.ship);
-      const configText = readFileSync33(cfg.configFile, "utf8");
-      const cfgBase = dirname20(cfg.configFile);
+      const configText = readFileSync34(cfg.configFile, "utf8");
+      const cfgBase = dirname21(cfg.configFile);
       const configured = configuredRepos(configText, route.route, cfgBase);
       const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route.reposBasePath, route.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route.route);
@@ -22788,7 +23164,7 @@ ${where.join("\n")}`);
         }
         if (configured.some((r) => r.dir === dir)) {
           try {
-            writeFileSync25(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
+            writeFileSync26(cfg.configFile, planRepoRemove(configText, cfgBase, route.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -22796,29 +23172,29 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync37(resolvedFile)) {
-            const raw = JSON.parse(readFileSync33(resolvedFile, "utf8"));
+          if (existsSync38(resolvedFile)) {
+            const raw = JSON.parse(readFileSync34(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync25(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync26(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync37(join41(dir, ".git")) && basename12(dir) === SAMPLE_REPO) rmSync17(dir, { recursive: true, force: true });
+        if (existsSync38(join42(dir, ".git")) && basename12(dir) === SAMPLE_REPO) rmSync17(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync37(join41(dir, ".git"));
-      if (existsSync37(dir) && fresh && readdirSync17(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync38(join42(dir, ".git"));
+      if (existsSync38(dir) && fresh && readdirSync17(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync24(dir, { recursive: true });
-        writeFileSync25(join41(dir, "README.md"), SAMPLE_README);
-        writeFileSync25(join41(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync25(dir, { recursive: true });
+        writeFileSync26(join42(dir, "README.md"), SAMPLE_README);
+        writeFileSync26(join42(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync7("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -22836,17 +23212,17 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync37(resolvedFile)) {
-          const raw = JSON.parse(readFileSync33(resolvedFile, "utf8"));
+        if (existsSync38(resolvedFile)) {
+          const raw = JSON.parse(readFileSync34(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync25(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync26(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured.some((r) => r.dir === dir)) {
         try {
-          writeFileSync25(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync26(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -23181,11 +23557,17 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync37(r.dir)) {
+            if (existsSync38(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
-                result: probePushAuth({ dir: r.dir, remote, remoteUrl: originUrlOf(r.dir, remote), offline: flag("offline") })
+                result: probePushAuth({
+                  dir: r.dir,
+                  remote,
+                  remoteUrl: originUrlOf(r.dir, remote),
+                  offline: flag("offline"),
+                  forge: forgeOfRemote(cfg.ship.forges, originUrlOf(r.dir, remote), (h) => hasForgeToken(cfg.ship.forges, h, cfg.ship.stateDir))
+                })
               });
             }
             if (isPrBased(r.config.hooks)) prBased.add(r.name);
@@ -23258,7 +23640,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync37(evFile) ? statSync11(evFile).size : 0;
+        const evSize = existsSync38(evFile) ? statSync12(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -23269,7 +23651,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync33(p, "utf8");
+            return readFileSync34(p, "utf8");
           } catch {
             return null;
           }
@@ -23285,7 +23667,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const changed2 = configChangedAfter(daemonConfigPaths(cfg), daemonStartedAt);
         if (changed2) {
           process.stdout.write(
-            `daemon config:     WARN ${changed2} changed at ${new Date(statSync11(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
+            `daemon config:     WARN ${changed2} changed at ${new Date(statSync12(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
 `
           );
         }