@tablation/crew 0.92.0 → 0.93.0

package/dist/cli.js

@@ -223,8 +223,8 @@ function shellInitScript(shell) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync10, existsSync as existsSync9 } from "fs";
-import { resolve, dirname as dirname4, isAbsolute, join as join11, basename as basename3 } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
+import { resolve, dirname as dirname4, isAbsolute, join as join12, basename as basename3 } from "path";
 import { homedir as homedir6, tmpdir } from "os";
 import { parse as parse2 } from "yaml";
 
@@ -1818,7 +1818,144 @@ function forgeOfRemote(forges, remoteUrl, hasToken) {
 }
 
 // src/config.ts
-import { getSessionStore, hostFromUrl } from "@tablation/client";
+import { hostFromUrl } from "@tablation/client";
+
+// src/secret-store.ts
+import { createHash as createHash2 } from "crypto";
+import { accessSync, constants, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync6, statSync as statSync3, writeFileSync as writeFileSync7, chmodSync as chmodSync2 } from "fs";
+import { join as join10 } from "path";
+import { getSessionStore as getOsSessionStore } from "@tablation/client";
+var SECRET_STORE_MODES = ["auto", "os", "file"];
+function isSecretStoreMode(v) {
+  return typeof v === "string" && SECRET_STORE_MODES.includes(v);
+}
+var configured;
+function configureSecretStore(c) {
+  configured = c;
+}
+function keysDir(stateDir) {
+  return join10(stateDir, "keys");
+}
+function entryName(host, slug) {
+  return `${createHash2("sha256").update(`${host}\0${slug}`).digest("hex")}.json`;
+}
+var FileSessionStore = class {
+  dir;
+  constructor(dir) {
+    this.dir = dir;
+  }
+  ensureDir() {
+    mkdirSync6(this.dir, { recursive: true, mode: 448 });
+    if ((statSync3(this.dir).mode & 63) !== 0) chmodSync2(this.dir, 448);
+  }
+  async get(host, slug) {
+    const file = join10(this.dir, entryName(host, slug));
+    if (!existsSync8(this.dir)) return void 0;
+    accessSync(this.dir, constants.R_OK | constants.X_OK);
+    if (!existsSync8(file)) return void 0;
+    return JSON.parse(readFileSync9(file, "utf8"));
+  }
+  async set(host, slug, session) {
+    this.ensureDir();
+    const file = join10(this.dir, entryName(host, slug));
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync7(tmp, JSON.stringify(session), { mode: 384 });
+    renameSync2(tmp, file);
+  }
+  async clear(host, slug) {
+    if (!existsSync8(this.dir)) return;
+    rmSync6(join10(this.dir, entryName(host, slug)), { force: true });
+  }
+  /** Whether a key could be written here right now, without leaving anything behind. */
+  writable() {
+    try {
+      this.ensureDir();
+      accessSync(this.dir, constants.R_OK | constants.W_OK | constants.X_OK);
+      const probe = join10(this.dir, `.probe.${process.pid}`);
+      writeFileSync7(probe, "", { mode: 384 });
+      rmSync6(probe, { force: true });
+      return { ok: true };
+    } catch (e) {
+      return { ok: false, reason: e.code ?? e.message };
+    }
+  }
+};
+function crewifyStoreError(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (!/TABLATION_API_KEY/.test(msg)) return e instanceof Error ? e : new Error(msg);
+  const out = new Error(
+    msg.replace(
+      /Set TABLATION_API_KEY instead of running `login`\./,
+      "Set CREW_API_KEY for the ship key, or set `ship.secretStore: file` in crew.yaml to keep keys under the state directory."
+    ),
+    { cause: e }
+  );
+  return out;
+}
+var CrewHintedStore = class {
+  inner;
+  constructor(inner) {
+    this.inner = inner;
+  }
+  async get(host, slug) {
+    try {
+      return await this.inner.get(host, slug);
+    } catch (e) {
+      throw crewifyStoreError(e);
+    }
+  }
+  async set(host, slug, s) {
+    try {
+      await this.inner.set(host, slug, s);
+    } catch (e) {
+      throw crewifyStoreError(e);
+    }
+  }
+  async clear(host, slug) {
+    try {
+      await this.inner.clear(host, slug);
+    } catch (e) {
+      throw crewifyStoreError(e);
+    }
+  }
+};
+function osStoreReachable(env = process.env, platform2 = process.platform, hasBinary = onPath) {
+  if (platform2 !== "linux") return true;
+  if (!hasBinary("secret-tool")) return false;
+  if (env.DBUS_SESSION_BUS_ADDRESS) return true;
+  return !!env.XDG_RUNTIME_DIR && existsSync8(join10(env.XDG_RUNTIME_DIR, "bus"));
+}
+function onPath(name) {
+  for (const dir of (process.env.PATH ?? "").split(":")) {
+    if (dir && existsSync8(join10(dir, name))) return true;
+  }
+  return false;
+}
+function resolveStoreKind(mode, reachable = osStoreReachable()) {
+  if (mode === "file") return "file";
+  if (mode === "os") return "os";
+  return reachable ? "os" : "file";
+}
+function describeSecretStore(c = configured) {
+  const mode = c?.mode ?? "auto";
+  const kind = c ? resolveStoreKind(mode) : "os";
+  return kind === "file" && c ? { kind, mode, dir: keysDir(c.stateDir) } : { kind: "os", mode };
+}
+function getSessionStore(c = configured) {
+  const r = describeSecretStore(c);
+  if (r.kind === "file" && r.dir) return new FileSessionStore(r.dir);
+  return new CrewHintedStore(getOsSessionStore());
+}
+function describeKeyStore(ship) {
+  const c = { mode: ship.secretStore ?? "auto", stateDir: ship.stateDir };
+  const r = describeSecretStore(c);
+  const why = c.mode === "auto" ? " (auto: no desktop secret service reachable)" : ` (ship.secretStore: ${c.mode})`;
+  if (r.kind === "file" && r.dir) {
+    const w = new FileSessionStore(r.dir).writable();
+    return `file ${r.dir}${why} \u2014 ${w.ok ? "writable" : `NOT writable (${w.reason})`}`;
+  }
+  return `OS secret store${c.mode === "auto" ? "" : why}`;
+}
 
 // src/platform.ts
 var SHIP_PLATFORMS = ["macos", "linux", "windows"];
@@ -1857,8 +1994,8 @@ function explain(ship, required) {
 }
 
 // src/repo-config.ts
-import { readFileSync as readFileSync9, existsSync as existsSync8 } from "fs";
-import { join as join10, basename as basename2 } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync9 } from "fs";
+import { join as join11, basename as basename2 } from "path";
 import { parse } from "yaml";
 var SPEC_VERSION = 1;
 var REPO_CONFIG_FILENAMES = [".crew.yaml", ".crew.yml", ".crew.json"];
@@ -1942,8 +2079,8 @@ var MODES = ["local", "integrate", "ci_manual", "ci_auto", "external"];
 var PROVIDERS = ["github", "buildkite", "other", "none"];
 function findRepoConfig(dir) {
   for (const name of REPO_CONFIG_FILENAMES) {
-    const p = join10(dir, name);
-    if (existsSync8(p)) return p;
+    const p = join11(dir, name);
+    if (existsSync9(p)) return p;
   }
   return null;
 }
@@ -2181,7 +2318,7 @@ function parseRepoConfig(text, file) {
 function loadRepoConfig(dir) {
   const file = findRepoConfig(dir);
   if (!file) return null;
-  return parseRepoConfig(readFileSync9(file, "utf8"), file);
+  return parseRepoConfig(readFileSync10(file, "utf8"), file);
 }
 function hookLabel(cfg, hook2) {
   return cfg.labels[hook2] ?? cfg.hooks[hook2] ?? hook2;
@@ -2503,7 +2640,8 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "forges",
   "previewHost",
   "maxPeriscopes",
-  "periscopeIdleMinutes"
+  "periscopeIdleMinutes",
+  "secretStore"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -2651,11 +2789,11 @@ function expand(p, base) {
   return isAbsolute(out) ? out : resolve(base, out);
 }
 function resolvePromptsDir(promptSet, crewHome, base) {
-  if (!promptSet) return join11(crewHome, "prompts", "default");
+  if (!promptSet) return join12(crewHome, "prompts", "default");
   if (promptSet.includes("/") || promptSet.startsWith(".") || promptSet.startsWith("~")) {
     return expand(promptSet, base);
   }
-  return join11(crewHome, "prompts", promptSet);
+  return join12(crewHome, "prompts", promptSet);
 }
 var Missing = class {
   paths = [];
@@ -2679,7 +2817,7 @@ var Missing = class {
 };
 function crewVersion(crewHome) {
   try {
-    const pkg = JSON.parse(readFileSync10(join11(crewHome, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync11(join12(crewHome, "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -2689,26 +2827,26 @@ function configSearchPath(crewHome) {
   if (process.env.CREW_CONFIG) return [resolve(process.env.CREW_CONFIG)];
   const xdg = process.env.XDG_CONFIG_HOME;
   return [
-    ...xdg ? [join11(xdg, "crew", "crew.yaml")] : [],
-    join11(homedir6(), ".config", "crew", "crew.yaml"),
+    ...xdg ? [join12(xdg, "crew", "crew.yaml")] : [],
+    join12(homedir6(), ".config", "crew", "crew.yaml"),
     resolve(crewHome, "crew.yaml")
   ];
 }
 function findConfigFile(crewHome) {
   const candidates2 = configSearchPath(crewHome);
-  return candidates2.find((c) => existsSync9(c)) ?? candidates2[candidates2.length - 1];
+  return candidates2.find((c) => existsSync10(c)) ?? candidates2[candidates2.length - 1];
 }
-var defaultConfigPath = () => join11(process.env.XDG_CONFIG_HOME ?? join11(homedir6(), ".config"), "crew", "crew.yaml");
+var defaultConfigPath = () => join12(process.env.XDG_CONFIG_HOME ?? join12(homedir6(), ".config"), "crew", "crew.yaml");
 function routeSlug(route2) {
   return route2.replace(/\//g, "-");
 }
 function resolvedPathFor(stateDir, route2) {
   const [workspace, project] = splitRoute(route2);
-  return join11(stateDir, "resolved", workspace, `${project}.json`);
+  return join12(stateDir, "resolved", workspace, `${project}.json`);
 }
 function apiKeyPathFor(stateDir, route2) {
   const [workspace, project] = splitRoute(route2);
-  return join11(stateDir, "keys", workspace, `${project}.env`);
+  return join12(stateDir, "keys", workspace, `${project}.env`);
 }
 function splitRoute(route2) {
   const parts = route2.split("/");
@@ -2719,9 +2857,9 @@ function splitRoute(route2) {
 }
 function readResolvedFile(stateDir, route2) {
   const path = resolvedPathFor(stateDir, route2);
-  if (!existsSync9(path)) return void 0;
+  if (!existsSync10(path)) return void 0;
   try {
-    return JSON.parse(readFileSync10(path, "utf8"));
+    return JSON.parse(readFileSync11(path, "utf8"));
   } catch (e) {
     throw new ConfigError(`${path}: not valid JSON \u2014 ${e.message}`);
   }
@@ -2781,18 +2919,18 @@ function parseResolved(raw, m, where) {
 }
 function loadConfig(crewHome, configFile, opts = {}) {
   const file = configFile ?? findConfigFile(crewHome);
-  if (opts.text === void 0 && !existsSync9(file)) {
+  if (opts.text === void 0 && !existsSync10(file)) {
     throw new ConfigError(
       `no config found. Looked in:
 ` + configSearchPath(crewHome).map((c) => `  - ${c}`).join("\n") + `
 
 Create the first of those:
-  mkdir -p ${dirname4(defaultConfigPath())} && cp ${join11(crewHome, "crew.example.yaml")} ${defaultConfigPath()}`
+  mkdir -p ${dirname4(defaultConfigPath())} && cp ${join12(crewHome, "crew.example.yaml")} ${defaultConfigPath()}`
     );
   }
   let raw;
   try {
-    raw = parse2(opts.text ?? readFileSync10(file, "utf8"));
+    raw = parse2(opts.text ?? readFileSync11(file, "utf8"));
   } catch (e) {
     throw new ConfigError(`${file}: not valid YAML \u2014 ${e.message}`);
   }
@@ -2846,6 +2984,11 @@ Create the first of those:
   if (!Number.isInteger(periscopeIdleMinutes) || periscopeIdleMinutes < 1) {
     missing.add(`ship.periscopeIdleMinutes must be a positive integer (got "${shipRaw.periscopeIdleMinutes}")`);
   }
+  const secretStoreRaw = shipRaw.secretStore === void 0 ? "auto" : shipRaw.secretStore;
+  if (!isSecretStoreMode(secretStoreRaw)) {
+    missing.add(`ship.secretStore must be one of ${SECRET_STORE_MODES.join(" | ")} (got "${String(shipRaw.secretStore)}")`);
+  }
+  const secretStore = isSecretStoreMode(secretStoreRaw) ? secretStoreRaw : "auto";
   const eventsRotateBytes = shipRaw.eventsRotateBytes === void 0 ? DEFAULT_EVENTS_ROTATE_BYTES : Number(shipRaw.eventsRotateBytes);
   if (!Number.isInteger(eventsRotateBytes) || eventsRotateBytes < 1) {
     missing.add(`ship.eventsRotateBytes must be a positive integer (got "${shipRaw.eventsRotateBytes}")`);
@@ -2885,6 +3028,7 @@ Create the first of those:
   const dupe = seen.find((n, i) => n && seen.indexOf(n) !== i);
   if (dupe) missing.add(`routes: duplicate route "${dupe}" \u2014 a route addresses itself, so it must be unique`);
   missing.throwIfAny(file);
+  configureSecretStore({ mode: secretStore, stateDir });
   return {
     ship: {
       name: shipRaw.name ?? "this ship",
@@ -2902,7 +3046,7 @@ Create the first of those:
       useNvm: shipRaw.useNvm !== false,
       nvmSh: shipRaw.nvmSh,
       stateDir,
-      logFile: expand(shipRaw.logFile ?? join11(tmpdir(), "crew.log"), base),
+      logFile: expand(shipRaw.logFile ?? join12(tmpdir(), "crew.log"), base),
       userAgent: shipRaw.userAgent ?? `Mozilla/5.0 CrewAgent/${crewVersion(crewHome)}`,
       maxConcurrentAgents,
       maxConcurrentAgentsSet,
@@ -2919,7 +3063,8 @@ Create the first of those:
       forges: parseShipForges(shipRaw.forges),
       previewHost: shipRaw.previewHost ? String(shipRaw.previewHost).trim() || void 0 : void 0,
       maxPeriscopes,
-      periscopeIdleMinutes
+      periscopeIdleMinutes,
+      secretStore
     },
     routes,
     crewHome,
@@ -3063,7 +3208,7 @@ function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, t
   const hasRepos = Object.keys(repoDirs).length > 0;
   const reposBasePath = expand(String(c?.reposBasePath ?? raw.ship?.reposBasePath ?? DEFAULT_REPOS_BASE_PATH), base);
   const dirIsCloneBase = !c?.dir && !hasRepos && !Array.isArray(c?.repos);
-  const dir = c?.dir ? expand(String(c.dir), base) : hasRepos ? Object.values(repoDirs)[0] : dirIsCloneBase ? join11(reposBasePath, splitRoute(route2)[0]) : "";
+  const dir = c?.dir ? expand(String(c.dir), base) : hasRepos ? Object.values(repoDirs)[0] : dirIsCloneBase ? join12(reposBasePath, splitRoute(route2)[0]) : "";
   const weight = c?.weight === void 0 ? void 0 : Number(c.weight);
   if (weight !== void 0 && !(Number.isFinite(weight) && weight > 0)) {
     missing.add(`${where}.weight must be a positive number (got "${c?.weight}")`);
@@ -3160,8 +3305,8 @@ function repoIdForName(r, name) {
 }
 function resolveApiKey(r) {
   if (r.apiKey) return r.apiKey;
-  if (r.apiKeyFile && r.apiKeyVar && existsSync9(r.apiKeyFile)) {
-    for (const line of readFileSync10(r.apiKeyFile, "utf8").split("\n")) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync10(r.apiKeyFile)) {
+    for (const line of readFileSync11(r.apiKeyFile, "utf8").split("\n")) {
       const m = line.match(new RegExp(`^${r.apiKeyVar}=(.*)$`));
       if (m) return (m[1] ?? "").trim().replace(/^["']|["']$/g, "");
     }
@@ -3174,9 +3319,9 @@ function resolveApiKey(r) {
 }
 function credentialSource(r) {
   if (r.apiKey) return KEYCHAIN_ELIGIBLE_ROUTES.has(r) ? "keychain" : "inline";
-  if (r.apiKeyFile && r.apiKeyVar && existsSync9(r.apiKeyFile)) {
+  if (r.apiKeyFile && r.apiKeyVar && existsSync10(r.apiKeyFile)) {
     const re = new RegExp(`^${r.apiKeyVar}=`);
-    if (readFileSync10(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
+    if (readFileSync11(r.apiKeyFile, "utf8").split("\n").some((l) => re.test(l))) return "apiKeyFile";
   }
   return process.env.CREW_API_KEY?.trim() ? "CREW_API_KEY" : "none";
 }
@@ -3232,7 +3377,7 @@ function configuredMembers(rt) {
   return out;
 }
 function defaultRepoDir(basePath, workspace, repoName) {
-  return join11(basePath, workspace, repoName);
+  return join12(basePath, workspace, repoName);
 }
 function reposOf(r) {
   const named = Object.entries(r.repos);
@@ -3265,7 +3410,7 @@ function passengerRepoTargets(r) {
   return reposOf(r).filter((t) => r.repoOverrides[t.name]?.hostPassengers !== false);
 }
 function passengerCheckoutDir(basePath, workspace, repoName) {
-  return join11(basePath, workspace, ".passenger-checkouts", repoName);
+  return join12(basePath, workspace, ".passenger-checkouts", repoName);
 }
 function passengerCheckoutTargets(r) {
   if (!r.hostPassengers) return [];
@@ -3372,10 +3517,10 @@ import { platform } from "process";
 function defaultShell() {
   return platform === "win32" ? { bin: "powershell", args: ["-NoProfile", "-NonInteractive", "-Command"] } : { bin: "bash", args: ["-c"] };
 }
-function resolveShell(configured) {
-  if (!configured) return defaultShell();
-  if (typeof configured !== "string") return configured;
-  const bin = configured.trim();
+function resolveShell(configured2) {
+  if (!configured2) return defaultShell();
+  if (typeof configured2 !== "string") return configured2;
+  const bin = configured2.trim();
   if (/pwsh|powershell/i.test(bin)) {
     return { bin, args: ["-NoProfile", "-NonInteractive", "-Command"] };
   }
@@ -3552,11 +3697,11 @@ function recoveredFailureHeadlines(o, route2) {
 }
 
 // src/install.ts
-import { dirname as dirname5, join as join12, extname } from "path";
+import { dirname as dirname5, join as join13, extname } from "path";
 import { homedir as homedir7 } from "os";
-import { accessSync, constants, existsSync as existsSync10, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync3, writeFileSync as writeFileSync7, unlinkSync, realpathSync } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync4, writeFileSync as writeFileSync8, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // src/runtime-info.ts
 function isCompiledBinary(moduleUrl) {
@@ -3566,7 +3711,7 @@ function isCompiledBinary(moduleUrl) {
 // src/install.ts
 function crewInvocation(crewHome) {
   if (isCompiledBinary(import.meta.url)) return [process.execPath];
-  return [process.execPath, join12(crewHome, "bin", "crew")];
+  return [process.execPath, join13(crewHome, "bin", "crew")];
 }
 var INTERVAL_SECONDS = 120;
 function labelFor(crewHome, job) {
@@ -3577,7 +3722,7 @@ function labelFor(crewHome, job) {
       return crewHome;
     }
   })();
-  const hash = createHash2("sha1").update(real).digest("hex").slice(0, 8);
+  const hash = createHash3("sha1").update(real).digest("hex").slice(0, 8);
   const stem = job === "release" ? "com.tablation.crew-release" : job === "passengers" ? "com.tablation.crew-passengers" : "com.tablation.crew";
   return `${stem}.${hash}`;
 }
@@ -3604,17 +3749,17 @@ function pathFor(ship) {
   return parts.join(":");
 }
 function findOnPath(bin, searchPath) {
-  const candidates2 = bin.includes("/") ? [bin] : searchPath.split(":").filter(Boolean).map((dir) => join12(dir, bin));
+  const candidates2 = bin.includes("/") ? [bin] : searchPath.split(":").filter(Boolean).map((dir) => join13(dir, bin));
   for (const candidate of candidates2) {
     try {
-      accessSync(candidate, constants.X_OK);
-      if (statSync3(candidate).isFile()) return candidate;
+      accessSync2(candidate, constants2.X_OK);
+      if (statSync4(candidate).isFile()) return candidate;
     } catch {
     }
   }
   return void 0;
 }
-var COMMON_DOCKER_DIRS = ["/usr/local/bin", "/opt/homebrew/bin", join12(homedir7(), ".docker", "bin")].join(":");
+var COMMON_DOCKER_DIRS = ["/usr/local/bin", "/opt/homebrew/bin", join13(homedir7(), ".docker", "bin")].join(":");
 function dockerPathProblem(ship, shellPath = process.env.PATH ?? "") {
   const schedulerPath = pathFor(ship);
   if (findOnPath("docker", schedulerPath)) return void 0;
@@ -3626,7 +3771,7 @@ function xmlEscape(s) {
 }
 function planLaunchd(ship, crewHome, job) {
   const label = labelFor(crewHome, job);
-  const unitPath = join12(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+  const unitPath = join13(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const persistent = job === "run";
@@ -3680,8 +3825,8 @@ ${scheduleKeys}
 }
 function planSystemd(ship, crewHome, job) {
   const label = labelFor(crewHome, job);
-  const unitDir = join12(homedir7(), ".config", "systemd", "user");
-  const servicePath = join12(unitDir, `${label}.service`);
+  const unitDir = join13(homedir7(), ".config", "systemd", "user");
+  const servicePath = join13(unitDir, `${label}.service`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const description = job === "release" ? "Tablation crew \u2014 release" : job === "passengers" ? "Tablation crew \u2014 Host Passengers sync" : "Tablation crew \u2014 persistent supervisor loop";
@@ -3721,7 +3866,7 @@ WantedBy=default.target
       schedulerLog
     };
   }
-  const timerPath = join12(unitDir, `${label}.timer`);
+  const timerPath = join13(unitDir, `${label}.timer`);
   const service = `# Written by \`crew install\` \u2014 re-run it rather than hand-editing this file.
 [Unit]
 Description=${description}
@@ -3795,7 +3940,7 @@ function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
 function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
   const label = labelFor(crewHome, job);
   if (hostShip === "macos") {
-    const unitPath = join12(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = join13(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
     return {
       mechanism: "launchd",
       unitPaths: [unitPath],
@@ -3805,18 +3950,18 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
     };
   }
   if (hostShip === "linux" && hasSystemd) {
-    const unitDir = join12(homedir7(), ".config", "systemd", "user");
+    const unitDir = join13(homedir7(), ".config", "systemd", "user");
     if (job === "run") {
       return {
         mechanism: "systemd",
-        unitPaths: [join12(unitDir, `${label}.service`)],
+        unitPaths: [join13(unitDir, `${label}.service`)],
         crontabLine: null,
         unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.service`]]
       };
     }
     return {
       mechanism: "systemd",
-      unitPaths: [join12(unitDir, `${label}.service`), join12(unitDir, `${label}.timer`)],
+      unitPaths: [join13(unitDir, `${label}.service`), join13(unitDir, `${label}.timer`)],
       crontabLine: null,
       unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.timer`]]
     };
@@ -3834,7 +3979,7 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
 function planDaemonControl(crewHome, hostShip, hasSystemd) {
   const label = labelFor(crewHome, "run");
   if (hostShip === "macos") {
-    const unitPath = join12(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = join13(homedir7(), "Library", "LaunchAgents", `${label}.plist`);
     return {
       mechanism: "launchd",
       startCommand: ["launchctl", "load", unitPath],
@@ -3874,8 +4019,8 @@ async function applyInstall(plan, crewHome, dryRun, log) {
       log.emit(`would write ${path}`);
       continue;
     }
-    mkdirSync6(dirname5(path), { recursive: true });
-    writeFileSync7(path, plan.unitContent[path]);
+    mkdirSync7(dirname5(path), { recursive: true });
+    writeFileSync8(path, plan.unitContent[path]);
     log.emit(`wrote ${path}`);
   }
   if (plan.crontabLine) {
@@ -3929,7 +4074,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
     }
   }
   for (const path of plan.unitPaths) {
-    if (!existsSync10(path)) continue;
+    if (!existsSync11(path)) continue;
     if (dryRun) {
       log.emit(`would remove ${path}`);
       continue;
@@ -3948,7 +4093,7 @@ async function applyUninstall(plan, crewHome, dryRun, log) {
 }
 var CREW_LAUNCHD_PREFIX = "com.tablation.crew";
 function launchAgentsDir() {
-  return join12(homedir7(), "Library", "LaunchAgents");
+  return join13(homedir7(), "Library", "LaunchAgents");
 }
 function xmlUnescape(s) {
   return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
@@ -3965,25 +4110,25 @@ function loadedCrewLabels() {
   return [...parseLaunchctlList(list.stdout ?? "").keys()].filter((l) => l.startsWith(CREW_LAUNCHD_PREFIX));
 }
 function listLaunchdUnits(dir = launchAgentsDir(), loaded = []) {
-  const files = existsSync10(dir) ? readdirSync3(dir) : [];
+  const files = existsSync11(dir) ? readdirSync3(dir) : [];
   const units = files.filter((f) => f.startsWith(CREW_LAUNCHD_PREFIX) && f.endsWith(".plist")).sort().map((f) => {
-    const plistPath = join12(dir, f);
+    const plistPath = join13(dir, f);
     let program = null;
     try {
-      program = programFromPlist(readFileSync11(plistPath, "utf8"));
+      program = programFromPlist(readFileSync12(plistPath, "utf8"));
     } catch {
     }
     return {
       label: f.slice(0, -".plist".length),
       plistPath,
       program,
-      programExists: program !== null && existsSync10(program)
+      programExists: program !== null && existsSync11(program)
     };
   });
   const seen = new Set(units.map((u) => u.label));
   for (const label of [...loaded].sort()) {
     if (!label.startsWith(CREW_LAUNCHD_PREFIX) || seen.has(label)) continue;
-    units.push({ label, plistPath: join12(dir, `${label}.plist`), program: null, programExists: false, orphan: true });
+    units.push({ label, plistPath: join13(dir, `${label}.plist`), program: null, programExists: false, orphan: true });
   }
   return units;
 }
@@ -3996,9 +4141,9 @@ function removeLaunchdUnit(unit, dryRun, log) {
     log.emit(`would unload and remove ${unit.label}`);
     return;
   }
-  if (existsSync10(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
+  if (existsSync11(unit.plistPath)) spawnSync4("launchctl", ["unload", unit.plistPath], { encoding: "utf8" });
   spawnSync4("launchctl", ["remove", unit.label], { encoding: "utf8" });
-  if (existsSync10(unit.plistPath)) unlinkSync(unit.plistPath);
+  if (existsSync11(unit.plistPath)) unlinkSync(unit.plistPath);
   log.emit(`removed ${unit.label} (${unit.plistPath})`);
 }
 function clearForeignLaunchdUnits(crewHome, replace, dryRun, log, dir, loaded) {
@@ -4076,24 +4221,24 @@ function detectSystemd() {
 }
 
 // src/ship-attention.ts
-import { existsSync as existsSync12, statfsSync } from "fs";
+import { existsSync as existsSync13, statfsSync } from "fs";
 
 // src/git.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import {
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync7,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync8,
   openSync as openSync2,
   closeSync as closeSync2,
   writeSync,
-  statSync as statSync4,
+  statSync as statSync5,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync12,
-  writeFileSync as writeFileSync8,
+  readFileSync as readFileSync13,
+  writeFileSync as writeFileSync9,
   readdirSync as readdirSync4,
-  rmSync as rmSync6
+  rmSync as rmSync7
 } from "fs";
-import { dirname as dirname6, basename as basename4, join as join13 } from "path";
+import { dirname as dirname6, basename as basename4, join as join14 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -4474,7 +4619,7 @@ function recoverStrandedReleaseCheckouts(cwd) {
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
       const root = dirname6(path);
-      if (basename4(root).startsWith("crew-release-")) rmSync6(root, { recursive: true, force: true });
+      if (basename4(root).startsWith("crew-release-")) rmSync7(root, { recursive: true, force: true });
     }
   }
   const stranded = (gitOk(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/crew/release-*"]) ?? "").split("\n").filter(Boolean);
@@ -4491,12 +4636,12 @@ function sweepStaleReleaseRoots(tmp, now = Date.now(), maxAgeMs = 60 * 60 * 1e3)
   }
   for (const name of names) {
     if (!name.startsWith("crew-release-")) continue;
-    const root = join13(tmp, name);
+    const root = join14(tmp, name);
     try {
-      const st = statSync4(root);
+      const st = statSync5(root);
       if (!st.isDirectory() || now - st.mtimeMs < maxAgeMs) continue;
-      if (existsSync11(join13(root, "checkout"))) continue;
-      rmSync6(root, { recursive: true, force: true });
+      if (existsSync12(join14(root, "checkout"))) continue;
+      rmSync7(root, { recursive: true, force: true });
       removed.push(name);
     } catch {
     }
@@ -4545,13 +4690,13 @@ function originUrlOf(dir, remoteName) {
   }
 }
 function ensureRepoCheckout(dir, remote, opts = {}) {
-  if (existsSync11(`${dir}/.git`)) return false;
+  if (existsSync12(`${dir}/.git`)) return false;
   if (!remote) {
     throw new GitError(
       `${dir} does not exist and this repo has no discovered remote to clone from \u2014 re-run \`crew connect\`, or check out the repository yourself and point \`repos:\` at it`
     );
   }
-  mkdirSync7(dirname6(dir), { recursive: true });
+  mkdirSync8(dirname6(dir), { recursive: true });
   const url = cloneUrlFor(remote, opts);
   try {
     execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
@@ -4576,7 +4721,7 @@ function sleepSync(ms3) {
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
-  mkdirSync7(dirname6(lockPath), { recursive: true });
+  mkdirSync8(dirname6(lockPath), { recursive: true });
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -4594,7 +4739,7 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
       const err2 = e;
       if (err2.code !== "EEXIST") throw err2;
       try {
-        if (Date.now() - statSync4(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
+        if (Date.now() - statSync5(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
           try {
             unlinkSync2(lockPath);
           } catch {
@@ -4613,17 +4758,17 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
 function syncPassengerCheckout(dir, githubRemote, gitRemoteName, base, clone = {}) {
   const release = acquireCheckoutLock(dir);
   try {
-    if (!existsSync11(`${dir}/.git`) && githubRemote) {
+    if (!existsSync12(`${dir}/.git`) && githubRemote) {
       const url = cloneUrlFor(githubRemote, clone);
       const marker = cloneFailureMarker(dir);
-      if (existsSync11(marker) && readFileSync12(marker, "utf8").split("\n")[0] === url) {
-        return { action: "clone-failed", detail: readFileSync12(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
+      if (existsSync12(marker) && readFileSync13(marker, "utf8").split("\n")[0] === url) {
+        return { action: "clone-failed", detail: readFileSync13(marker, "utf8").split("\n").slice(1).join("\n"), repeat: true };
       }
       try {
         ensureRepoCheckout(dir, githubRemote, clone);
       } catch (e) {
         if (!(e instanceof GitError)) throw e;
-        writeFileSync8(marker, `${url}
+        writeFileSync9(marker, `${url}
 ${e.message}`);
         return { action: "clone-failed", detail: e.message, repeat: false };
       }
@@ -4689,6 +4834,15 @@ function baseAttention(repo, outcome, remote, base, nowIso = (/* @__PURE__ */ ne
   if (outcome.action === "level" || outcome.action === "fast-forwarded") return { clear: baseUnsafeKey(repo) };
   return null;
 }
+var seatKeyUnreadableKey = (route2, seat) => `seat_key_unreadable:${route2}:${seat}`;
+function seatKeyUnreadableItem(route2, seat, storeError, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  return {
+    kind: "seat_key_unreadable",
+    key: seatKeyUnreadableKey(route2, seat),
+    since: nowIso,
+    message: `${route2}: the ${seat} seat's agent key cannot be read (${storeError}) \u2014 its runs are refused until the key store is readable. Resumes automatically once it is; \`crew doctor\` names the store in use`
+  };
+}
 var agentLogRefusedKey = (route2) => `agent_log_refused:${route2}`;
 function agentLogRefusedItem(route2, role, status2, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
   return {
@@ -4756,7 +4910,7 @@ function repoStopFor(items, route2) {
   };
 }
 function recheckEnvironmentStops(state, route2, ship, deps = {}) {
-  const onPath = deps.onPath ?? findOnPath;
+  const onPath2 = deps.onPath ?? findOnPath;
   const dockerProblem = deps.dockerProblem ?? dockerPathProblem;
   const cleared = [];
   for (const item of state.shipAttention().previous()) {
@@ -4779,7 +4933,7 @@ function recheckEnvironmentStops(state, route2, ship, deps = {}) {
     }
     const script = cfg.hooks[h.hook];
     const cmd = script ? hookCommand(script) : null;
-    if (!cmd || onPath(cmd, pathFor(ship))) {
+    if (!cmd || onPath2(cmd, pathFor(ship))) {
       clearShipAttention(state, item.key);
       cleared.push(`${h.repo}/${h.hook}`);
     }
@@ -4830,7 +4984,7 @@ function noteHeldWorktree(state, h, nowMs = Date.now()) {
 function reconcileHeldWorktrees(state, repo, log, stillRefused) {
   for (const i of state.shipAttention().previous()) {
     if (i.kind !== "worktree_held" || !i.held || i.held.repo !== repo) continue;
-    const gone = !existsSync12(i.held.path);
+    const gone = !existsSync13(i.held.path);
     if (!gone && !(stillRefused && !stillRefused.has(i.held.path))) continue;
     clearShipAttention(state, i.key);
     log.emit(
@@ -5081,30 +5235,30 @@ function roleCapWarnings(ship) {
 
 // src/selftest.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync21, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync19, rmSync as rmSync10, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync13, mkdtempSync, readFileSync as readFileSync20, rmSync as rmSync11, writeFileSync as writeFileSync14 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // src/agent.ts
 import { spawn as spawn2, spawnSync as spawnSync5 } from "child_process";
-import { readFileSync as readFileSync18, existsSync as existsSync20, statSync as statSync6, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
+import { readFileSync as readFileSync19, existsSync as existsSync21, statSync as statSync7, mkdirSync as mkdirSync12, writeFileSync as writeFileSync13, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
-import { join as join21, dirname as dirname8, basename as basename7 } from "path";
-import { createHash as createHash3 } from "crypto";
+import { join as join22, dirname as dirname8, basename as basename7 } from "path";
+import { createHash as createHash4 } from "crypto";
 
 // src/state.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync13, mkdirSync as mkdirSync8, rmSync as rmSync7, statSync as statSync5, readdirSync as readdirSync5 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync10, existsSync as existsSync14, mkdirSync as mkdirSync9, rmSync as rmSync8, statSync as statSync6, readdirSync as readdirSync5 } from "fs";
+import { join as join15 } from "path";
 var EPOCH = "1970-01-01T00:00:00.000Z";
 var State = class _State {
   dir;
   constructor(dir) {
     this.dir = dir;
-    mkdirSync8(dir, { recursive: true });
+    mkdirSync9(dir, { recursive: true });
   }
   path(...parts) {
-    return join14(this.dir, ...parts);
+    return join15(this.dir, ...parts);
   }
   /**
    * The timestamp every "new since last poll" check is measured against.
@@ -5115,14 +5269,14 @@ var State = class _State {
    */
   watermark() {
     try {
-      const v = readFileSync13(this.path(".poll-watermark"), "utf8").trim();
+      const v = readFileSync14(this.path(".poll-watermark"), "utf8").trim();
       return v || EPOCH;
     } catch {
       return EPOCH;
     }
   }
   setWatermark(at) {
-    writeFileSync9(this.path(".poll-watermark"), `${at}
+    writeFileSync10(this.path(".poll-watermark"), `${at}
 `);
   }
   /**
@@ -5140,19 +5294,19 @@ var State = class _State {
   }
   /** Whole-crew pause, and the per-role sentinels one level down. */
   isPaused() {
-    return existsSync13(this.path(".crew-paused"));
+    return existsSync14(this.path(".crew-paused"));
   }
   isRolePaused(role) {
-    return existsSync13(this.path(`.role-paused-${role}`));
+    return existsSync14(this.path(`.role-paused-${role}`));
   }
   pausedRoles(roles) {
     return new Set(roles.filter((r) => this.isRolePaused(r)));
   }
   pause(role) {
-    writeFileSync9(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), "");
+    writeFileSync10(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), "");
   }
   resume(role) {
-    rmSync7(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), { force: true });
+    rmSync8(role ? this.path(`.role-paused-${role}`) : this.path(".crew-paused"), { force: true });
   }
   /**
    * The release phase (merge, deploy, release) has its own sentinel, one
@@ -5160,11 +5314,11 @@ var State = class _State {
    * while agents keep working.
    */
   isReleasePaused() {
-    return existsSync13(this.path(".release-paused"));
+    return existsSync14(this.path(".release-paused"));
   }
   setReleasePaused(paused) {
-    if (paused) writeFileSync9(this.path(".release-paused"), "");
-    else rmSync7(this.path(".release-paused"), { force: true });
+    if (paused) writeFileSync10(this.path(".release-paused"), "");
+    else rmSync8(this.path(".release-paused"), { force: true });
   }
   /**
    * Why a release cycle must not run right now, or null when it may. Every
@@ -5201,7 +5355,7 @@ var State = class _State {
     const name = _State.safe(rawName);
     const file = this.path(`.${name}.lock`);
     try {
-      const existing = Number.parseInt(readFileSync13(file, "utf8").trim(), 10);
+      const existing = Number.parseInt(readFileSync14(file, "utf8").trim(), 10);
       if (Number.isFinite(existing) && existing > 0) {
         try {
           process.kill(existing, 0);
@@ -5211,13 +5365,13 @@ var State = class _State {
       }
     } catch {
     }
-    writeFileSync9(file, `${process.pid}
+    writeFileSync10(file, `${process.pid}
 `);
     return {
       ok: true,
       release: () => {
         try {
-          rmSync7(file, { force: true });
+          rmSync8(file, { force: true });
         } catch {
         }
       }
@@ -5239,7 +5393,7 @@ var State = class _State {
       if (!/^\.release-.+\.lock$/.test(n)) continue;
       let pid = 0;
       try {
-        pid = Number.parseInt(readFileSync13(this.path(n), "utf8").trim(), 10);
+        pid = Number.parseInt(readFileSync14(this.path(n), "utf8").trim(), 10);
       } catch {
         continue;
       }
@@ -5325,7 +5479,7 @@ var State = class _State {
   ticketInFlight(recordId) {
     const file = this.path(`.${_State.safe(`crew-ticket-${recordId}`)}.lock`);
     try {
-      const pid = Number.parseInt(readFileSync13(file, "utf8").trim(), 10);
+      const pid = Number.parseInt(readFileSync14(file, "utf8").trim(), 10);
       if (!Number.isFinite(pid) || pid <= 0) return false;
       process.kill(pid, 0);
       return true;
@@ -5359,7 +5513,7 @@ var State = class _State {
     const heldReported = `.release-held-${suffix}`;
     const read = (f) => {
       try {
-        return readFileSync13(this.path(f), "utf8").trim() || null;
+        return readFileSync14(this.path(f), "utf8").trim() || null;
       } catch {
         return null;
       }
@@ -5368,12 +5522,12 @@ var State = class _State {
       blockedCount: () => Number.parseInt(read(blocked) ?? "", 10) || 0,
       noteBlocked: () => {
         const n = (Number.parseInt(read(blocked) ?? "", 10) || 0) + 1;
-        writeFileSync9(this.path(blocked), `${n}
+        writeFileSync10(this.path(blocked), `${n}
 `);
         return n;
       },
       clearBlocked: () => {
-        rmSync7(this.path(blocked), { force: true });
+        rmSync8(this.path(blocked), { force: true });
       },
       /**
        * The commit a deploy last failed on.
@@ -5385,11 +5539,11 @@ var State = class _State {
        */
       deployFailedSha: () => read(failed),
       noteDeployFailed: (sha) => {
-        writeFileSync9(this.path(failed), `${sha}
+        writeFileSync10(this.path(failed), `${sha}
 `);
       },
       clearDeployFailed: () => {
-        rmSync7(this.path(failed), { force: true });
+        rmSync8(this.path(failed), { force: true });
       },
       /**
        * Consecutive test-gate failures on the same head (CREW-1368). A failure
@@ -5399,31 +5553,31 @@ var State = class _State {
       noteTestGateFailed: (sha) => {
         const [prev, n] = (read(gateFailed) ?? "").split(" ");
         const next = prev === sha ? (Number.parseInt(n ?? "", 10) || 0) + 1 : 1;
-        writeFileSync9(this.path(gateFailed), `${sha} ${next}
+        writeFileSync10(this.path(gateFailed), `${sha} ${next}
 `);
         return next;
       },
       clearTestGateFailed: () => {
-        rmSync7(this.path(gateFailed), { force: true });
+        rmSync8(this.path(gateFailed), { force: true });
       },
       /** Whether the board was already told about this head's red gate. */
       heldReported: () => {
         try {
-          return readFileSync13(this.path(heldReported), "utf8").replace(/\n$/, "") || null;
+          return readFileSync14(this.path(heldReported), "utf8").replace(/\n$/, "") || null;
         } catch {
           return null;
         }
       },
       noteHeldReported: (signature) => {
-        writeFileSync9(this.path(heldReported), `${signature}
+        writeFileSync10(this.path(heldReported), `${signature}
 `);
       },
       clearHeldReported: () => {
-        rmSync7(this.path(heldReported), { force: true });
+        rmSync8(this.path(heldReported), { force: true });
       },
       testGateReported: (sha) => read(gateReported) === sha,
       noteTestGateReported: (sha) => {
-        writeFileSync9(this.path(gateReported), `${sha}
+        writeFileSync10(this.path(gateReported), `${sha}
 `);
       }
     };
@@ -5446,13 +5600,13 @@ var State = class _State {
     const ticketStreakFile = `.fairness-ticket-streak-${suffix}`;
     const read = (f) => {
       try {
-        return readFileSync13(this.path(f), "utf8").trim() || null;
+        return readFileSync14(this.path(f), "utf8").trim() || null;
       } catch {
         return null;
       }
     };
     const clear2 = () => {
-      for (const f of [streakFile, ticketFile, sinceFile, ticketStreakFile]) rmSync7(this.path(f), { force: true });
+      for (const f of [streakFile, ticketFile, sinceFile, ticketStreakFile]) rmSync8(this.path(f), { force: true });
     };
     return {
       /** Consecutive cycles this route had actionable work and did not win. */
@@ -5479,18 +5633,18 @@ var State = class _State {
           clear2();
           return;
         }
-        writeFileSync9(this.path(streakFile), `${this.readInt(streakFile) + 1}
+        writeFileSync10(this.path(streakFile), `${this.readInt(streakFile) + 1}
 `);
         const prior = read(ticketFile);
         if (topTicket && topTicket === prior) {
-          writeFileSync9(this.path(ticketStreakFile), `${this.readInt(ticketStreakFile) + 1}
+          writeFileSync10(this.path(ticketStreakFile), `${this.readInt(ticketStreakFile) + 1}
 `);
         } else if (topTicket) {
-          writeFileSync9(this.path(ticketFile), `${topTicket}
+          writeFileSync10(this.path(ticketFile), `${topTicket}
 `);
-          writeFileSync9(this.path(sinceFile), `${(/* @__PURE__ */ new Date()).toISOString()}
+          writeFileSync10(this.path(sinceFile), `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
-          writeFileSync9(this.path(ticketStreakFile), "1\n");
+          writeFileSync10(this.path(ticketStreakFile), "1\n");
         }
       }
     };
@@ -5511,14 +5665,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync13(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync14(this.path(file), "utf8"));
           return parsed && typeof parsed === "object" ? parsed : {};
         } catch {
           return {};
         }
       },
       persist: (next) => {
-        writeFileSync9(this.path(file), JSON.stringify(next));
+        writeFileSync10(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -5534,14 +5688,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync13(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync14(this.path(file), "utf8"));
           return Array.isArray(parsed) ? parsed.filter((x) => typeof x === "string") : [];
         } catch {
           return [];
         }
       },
       persist: (next) => {
-        writeFileSync9(this.path(file), JSON.stringify(next));
+        writeFileSync10(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -5555,14 +5709,14 @@ var State = class _State {
     return {
       previous: () => {
         try {
-          const parsed = JSON.parse(readFileSync13(this.path(file), "utf8"));
+          const parsed = JSON.parse(readFileSync14(this.path(file), "utf8"));
           return Array.isArray(parsed) ? parsed : [];
         } catch {
           return [];
         }
       },
       persist: (next) => {
-        writeFileSync9(this.path(file), JSON.stringify(next));
+        writeFileSync10(this.path(file), JSON.stringify(next));
       }
     };
   }
@@ -5575,11 +5729,11 @@ var State = class _State {
     const file = ".release-last-run";
     return {
       touch: () => {
-        writeFileSync9(this.path(file), (/* @__PURE__ */ new Date()).toISOString());
+        writeFileSync10(this.path(file), (/* @__PURE__ */ new Date()).toISOString());
       },
       at: () => {
         try {
-          return statSync5(this.path(file)).mtimeMs;
+          return statSync6(this.path(file)).mtimeMs;
         } catch {
           return null;
         }
@@ -5588,7 +5742,7 @@ var State = class _State {
   }
   readInt(file) {
     try {
-      return Number.parseInt(readFileSync13(this.path(file), "utf8").trim(), 10) || 0;
+      return Number.parseInt(readFileSync14(this.path(file), "utf8").trim(), 10) || 0;
     } catch {
       return 0;
     }
@@ -6071,8 +6225,8 @@ var PERISCOPE_COLUMNS = [
 ];
 
 // src/agent-log.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync6, readFileSync as readFileSync14, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync6, readFileSync as readFileSync15, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "fs";
+import { join as join16 } from "path";
 
 // src/pending-backoff.ts
 var sleepBackoff = (attempts) => Math.min(6e4 * 2 ** Math.max(0, attempts - 1), 30 * 6e4);
@@ -6244,20 +6398,20 @@ async function addRunToTicket(target, t, recordId, run2) {
     };
   }
 }
-var queueDir = (stateDir) => join15(stateDir, "pending-agent-logs");
+var queueDir = (stateDir) => join16(stateDir, "pending-agent-logs");
 function queueAgentRun(stateDir, name, q) {
-  mkdirSync9(queueDir(stateDir), { recursive: true });
-  writeFileSync10(join15(queueDir(stateDir), `${name}.json`), JSON.stringify(q));
+  mkdirSync10(queueDir(stateDir), { recursive: true });
+  writeFileSync11(join16(queueDir(stateDir), `${name}.json`), JSON.stringify(q));
 }
 async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = queueDir(stateDir);
-  if (!existsSync14(dir)) return 0;
+  if (!existsSync15(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
-    const path = join15(dir, f);
+    const path = join16(dir, f);
     let q;
     try {
-      q = JSON.parse(readFileSync14(path, "utf8"));
+      q = JSON.parse(readFileSync15(path, "utf8"));
     } catch {
       continue;
     }
@@ -6276,17 +6430,17 @@ async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__
         attempts: 0,
         nextAttemptAt: (/* @__PURE__ */ new Date()).toISOString()
       });
-      rmSync8(path, { force: true });
+      rmSync9(path, { force: true });
       sent += 1;
       log.emit(`sent a queued Agent Log report (${f})`);
     } catch (e) {
       if (!(e instanceof AgentLogUnreachableError)) {
-        rmSync8(path, { force: true });
+        rmSync9(path, { force: true });
         log.warn(`dropped a queued Agent Log report (${f}): ${e.message}`);
         continue;
       }
       const attempts = q.attempts + 1;
-      writeFileSync10(path, JSON.stringify({
+      writeFileSync11(path, JSON.stringify({
         ...q,
         attempts,
         warned: true,
@@ -6297,20 +6451,20 @@ async function replayQueuedAgentRuns(stateDir, route2, keyFor, log, now = /* @__
   }
   return sent;
 }
-var countersDir = (stateDir) => join15(stateDir, "pending-ticket-counters");
+var countersDir = (stateDir) => join16(stateDir, "pending-ticket-counters");
 function queueTicketCounters(stateDir, name, q) {
-  mkdirSync9(countersDir(stateDir), { recursive: true });
-  writeFileSync10(join15(countersDir(stateDir), `${name}.json`), JSON.stringify(q));
+  mkdirSync10(countersDir(stateDir), { recursive: true });
+  writeFileSync11(join16(countersDir(stateDir), `${name}.json`), JSON.stringify(q));
 }
 async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /* @__PURE__ */ new Date()) {
   const dir = countersDir(stateDir);
-  if (!existsSync14(dir)) return 0;
+  if (!existsSync15(dir)) return 0;
   let sent = 0;
   for (const f of readdirSync6(dir).filter((n) => n.endsWith(".json")).sort()) {
-    const path = join15(dir, f);
+    const path = join16(dir, f);
     let q;
     try {
-      q = JSON.parse(readFileSync14(path, "utf8"));
+      q = JSON.parse(readFileSync15(path, "utf8"));
     } catch {
       continue;
     }
@@ -6319,17 +6473,17 @@ async function replayQueuedTicketCounters(stateDir, route2, keyFor, log, now = /
       const apiKey = await keyFor(q.role);
       if (!apiKey) continue;
       await writeCounters({ ...q.target, apiKey }, q.write);
-      rmSync8(path, { force: true });
+      rmSync9(path, { force: true });
       sent += 1;
       log.emit(`added a queued run's spend to ${q.write.ticketReference ?? q.write.recordId} (${f})`);
     } catch (e) {
       if (!isRetryable(e)) {
-        rmSync8(path, { force: true });
+        rmSync9(path, { force: true });
         log.warn(`dropped a queued ticket counter update (${f}): ${e.message}`);
         continue;
       }
       const attempts = q.attempts + 1;
-      writeFileSync10(path, JSON.stringify({
+      writeFileSync11(path, JSON.stringify({
         ...q,
         attempts,
         warned: true,
@@ -6532,8 +6686,8 @@ var HandoffTranscriptTracker = class {
 };
 
 // src/pending-handoff.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readdirSync as readdirSync7, readFileSync as readFileSync15, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync11, readdirSync as readdirSync7, readFileSync as readFileSync16, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "fs";
+import { join as join19 } from "path";
 
 // src/ticket-branch.ts
 import { basename as basename6 } from "path";
@@ -7616,13 +7770,13 @@ function holdWarnings(tickets, ships, contract, humanHolds, now = Date.now()) {
 }
 
 // src/run-worktree.ts
-import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { dirname as dirname7, join as join18 } from "path";
 
 // src/ports.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync15 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join17 } from "path";
 var run = (cmd, args) => {
   try {
     return execFileSync4(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -7667,7 +7821,7 @@ function ticketForPort(port, s = DEFAULT_PORTS) {
 }
 function worktreeExists(parent, prefix, n) {
   for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync15(join16(parent, name, ".git"))) return true;
+    if (existsSync16(join17(parent, name, ".git"))) return true;
   }
   return false;
 }
@@ -7750,7 +7904,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
   const existing = worktreeForNumber(dir, num);
   const located = locateBranchForTicket(dir, cfg, t, role);
   const baseRef = hasRemote ? `${remote}/${base}` : base;
-  if (existing && !existing.prunable && existsSync16(existing.path)) {
+  if (existing && !existing.prunable && existsSync17(existing.path)) {
     const branch = existing.branch;
     if (status(existing.path).length > 0) {
       return { action: opts.resumeInterrupted ? "resume-dirty" : "leave-dirty", path: existing.path, branch };
@@ -7766,7 +7920,7 @@ function planRunWorktree(dir, cfg, t, role, opts = {}) {
     if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
     return { action: "recut", path: existing.path, branch, base: baseRef };
   }
-  const path = join17(dirname7(dir), worktreeForTicket(dir, cfg, t, role));
+  const path = join18(dirname7(dir), worktreeForTicket(dir, cfg, t, role));
   if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
     return { action: "cut-remote", path, branch: located.branch };
   }
@@ -7820,7 +7974,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
   if (remoteConfigured(dir, remote) && remoteBranchExists(dir, remote, branch)) return false;
   if (countCommits(dir, `${baseRef}..${branch}`) !== 0) return false;
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (wt && existsSync16(wt.path)) {
+  if (wt && existsSync17(wt.path)) {
     if (status(wt.path).length > 0) return false;
     if (gitOk(dir, ["worktree", "remove", wt.path]) === null) return false;
   }
@@ -7828,7 +7982,7 @@ function dropEmptyRunBranch(dir, cfg, branch) {
 }
 async function finishRunWorktree(dir, cfg, branch) {
   const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
-  if (!wt || !existsSync16(wt.path)) return { kind: "none" };
+  if (!wt || !existsSync17(wt.path)) return { kind: "none" };
   if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
   if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
   if (remoteConfigured(dir, cfg.branch.remote) && worktreeHoldsUnpushed(wt.path, cfg.branch.remote)) {
@@ -7840,7 +7994,7 @@ async function finishRunWorktree(dir, cfg, branch) {
     if (pids.length) await killGently(pids);
   }
   gitOk(dir, ["worktree", "remove", wt.path]);
-  return existsSync16(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+  return existsSync17(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
 }
 
 // src/handoff-guard.ts
@@ -8223,20 +8377,20 @@ async function guardRunStrays(route2, ship, tracker, role, workingId, since2, lo
 
 // src/pending-handoff.ts
 var PENDING_MAX_AGE_MS = 48 * 36e5;
-var pendingDirFor = (stateDir) => join18(stateDir, "pending-handoffs");
-var stateDirOfStream = (streamPath) => join18(streamPath, "..", "..");
+var pendingDirFor = (stateDir) => join19(stateDir, "pending-handoffs");
+var stateDirOfStream = (streamPath) => join19(streamPath, "..", "..");
 function writePendingHandoff(stateDir, rec) {
   const dir = pendingDirFor(stateDir);
-  mkdirSync10(dir, { recursive: true });
-  writeFileSync11(join18(dir, `${rec.ticketRecordId}.json`), JSON.stringify(rec, null, 2));
+  mkdirSync11(dir, { recursive: true });
+  writeFileSync12(join19(dir, `${rec.ticketRecordId}.json`), JSON.stringify(rec, null, 2));
 }
 function listPendingHandoffs(stateDir, route2) {
   const dir = pendingDirFor(stateDir);
-  if (!existsSync17(dir)) return [];
+  if (!existsSync18(dir)) return [];
   const out = [];
   for (const f of readdirSync7(dir).filter((n) => n.endsWith(".json")).sort()) {
     try {
-      const rec = JSON.parse(readFileSync15(join18(dir, f), "utf8"));
+      const rec = JSON.parse(readFileSync16(join19(dir, f), "utf8"));
       if (rec.version === 1 && rec.ticketRecordId && (!route2 || rec.route === route2)) out.push(rec);
     } catch {
     }
@@ -8244,7 +8398,7 @@ function listPendingHandoffs(stateDir, route2) {
   return out;
 }
 function removePendingHandoff(stateDir, ticketRecordId) {
-  rmSync9(join18(pendingDirFor(stateDir), `${ticketRecordId}.json`), { force: true });
+  rmSync10(join19(pendingDirFor(stateDir), `${ticketRecordId}.json`), { force: true });
 }
 function pendingHandoffFor(stateDir, ticketRecordId) {
   return listPendingHandoffs(stateDir).find((r) => r.ticketRecordId === ticketRecordId);
@@ -8354,8 +8508,8 @@ function expandSkillMarkers(text, lookup2, opts = {}) {
 }
 
 // src/skills.ts
-import { readFileSync as readFileSync17, readdirSync as readdirSync8, existsSync as existsSync19 } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync18, readdirSync as readdirSync8, existsSync as existsSync20 } from "fs";
+import { join as join21 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError3, TablationApiError as TablationApiError2 } from "@tablation/client";
 
@@ -8371,8 +8525,8 @@ ${additions}`;
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync16, existsSync as existsSync18 } from "fs";
-import { join as join19 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync19 } from "fs";
+import { join as join20 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError2, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
   dev: "Developer",
@@ -8386,12 +8540,12 @@ var CREW_AGENT_COLUMN = "agent_id";
 var AgentsSyncError = class extends Error {
 };
 function personaDefaultPrompt(promptsDir, role) {
-  const briefPath = join19(promptsDir, "personas", `lane-${role}.md`);
-  if (!existsSync18(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
-  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync16(briefPath, "utf8");
-  const commonPath = join19(promptsDir, "personas", "common.md");
-  if (!existsSync18(commonPath)) return readFileSync16(briefPath, "utf8");
-  return `${readFileSync16(commonPath, "utf8")}${readFileSync16(briefPath, "utf8")}`;
+  const briefPath = join20(promptsDir, "personas", `lane-${role}.md`);
+  if (!existsSync19(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
+  if (SELF_CONTAINED_ROLES.has(role)) return readFileSync17(briefPath, "utf8");
+  const commonPath = join20(promptsDir, "personas", "common.md");
+  if (!existsSync19(commonPath)) return readFileSync17(briefPath, "utf8");
+  return `${readFileSync17(commonPath, "utf8")}${readFileSync17(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route2, role, opts) {
   const cached = route2.resolved?.agentPersonas?.[role]?.agentId;
@@ -8838,7 +8992,7 @@ function describeCrewLink(o) {
 var SkillSyncError = class extends Error {
 };
 function parseSkillFile(path) {
-  const text = readFileSync17(path, "utf8");
+  const text = readFileSync18(path, "utf8");
   const match = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text);
   if (!match) throw new SkillSyncError(`${path}: missing YAML frontmatter (expected a leading --- block)`);
   const frontmatter = match[1];
@@ -8851,9 +9005,9 @@ function parseSkillFile(path) {
   return { name: meta.name, description: meta.description, prompt: body, file: path };
 }
 function listLocalSkills(promptsDir) {
-  const dir = join20(promptsDir, "skills");
-  if (!existsSync19(dir)) return [];
-  return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join20(dir, f)));
+  const dir = join21(promptsDir, "skills");
+  if (!existsSync20(dir)) return [];
+  return readdirSync8(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join21(dir, f)));
 }
 async function syncSkills(route2, opts) {
   if (!route2.resolved) {
@@ -9055,26 +9209,26 @@ var AgentError = class extends Error {
 };
 var AgentSpawnError = class extends AgentError {
 };
-var digestPathFor = (stateDir, routeLabel, role, runId) => join21(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
+var digestPathFor = (stateDir, routeLabel, role, runId) => join22(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
 function planAgentRun(o) {
-  const briefPath = join21(o.route.promptsDir, "personas", `lane-${o.role}.md`);
-  if (!existsSync20(briefPath)) {
+  const briefPath = join22(o.route.promptsDir, "personas", `lane-${o.role}.md`);
+  if (!existsSync21(briefPath)) {
     throw new AgentError(`no brief at ${briefPath} \u2014 refusing to run an unscoped session`);
   }
-  const commonPath = join21(o.route.promptsDir, "personas", "common.md");
-  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync20(commonPath);
+  const commonPath = join22(o.route.promptsDir, "personas", "common.md");
+  const usesCommon = !SELF_CONTAINED_ROLES.has(o.role) && existsSync21(commonPath);
   const now = o.now ?? (() => Date.now());
   const routeLabel = routeSlug(o.route.route);
   const ownDigest = o.runId ? digestPathFor(o.stateDir, routeLabel, o.role, o.runId) : void 0;
-  const digestPath2 = ownDigest && existsSync20(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
+  const digestPath2 = ownDigest && existsSync21(ownDigest) ? ownDigest : digestPathFor(o.stateDir, routeLabel, o.role);
   let digest;
   let ageSeconds;
-  if (existsSync20(digestPath2)) {
-    ageSeconds = Math.floor((now() - statSync6(digestPath2).mtimeMs) / 1e3);
-    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync18(digestPath2, "utf8");
+  if (existsSync21(digestPath2)) {
+    ageSeconds = Math.floor((now() - statSync7(digestPath2).mtimeMs) / 1e3);
+    if (ageSeconds <= DIGEST_MAX_AGE_SECONDS) digest = readFileSync19(digestPath2, "utf8");
   }
-  const common = usesCommon ? readFileSync18(commonPath, "utf8") : "";
-  const brief = readFileSync18(briefPath, "utf8");
+  const common = usesCommon ? readFileSync19(commonPath, "utf8") : "";
+  const brief = readFileSync19(briefPath, "utf8");
   const effectiveCommon = o.divergedPrompt ? "" : common;
   const effectiveBrief = appendAdditions(o.divergedPrompt ?? brief, o.personaAdditions);
   const localSkills = new Map(listLocalSkills(o.route.promptsDir).map((s) => [s.name, s.prompt]));
@@ -9095,8 +9249,8 @@ function planAgentRun(o) {
     brief: expanded.text,
     digest
   });
-  const promptSha = createHash3("sha256").update(expanded.text).digest("hex");
-  const streamsDir = join21(o.stateDir, "streams");
+  const promptSha = createHash4("sha256").update(expanded.text).digest("hex");
+  const streamsDir = join22(o.stateDir, "streams");
   const base = `${routeLabel}-${o.role}-${o.cycle}${o.runId ? `-${o.runId}` : ""}`;
   const seat = resolveSeat(o.ship, o.route, o.role, o.agentPersona ?? (o.agentModel ? { model: o.agentModel } : {}), o.repo);
   const { toolchain, model } = seat;
@@ -9169,8 +9323,8 @@ function planAgentRun(o) {
     digestAttached: digest !== void 0,
     digestAgeSeconds: ageSeconds,
     model,
-    streamPath: join21(streamsDir, `${base}.jsonl`),
-    eventsPath: join21(streamsDir, `${base}.events.jsonl`),
+    streamPath: join22(streamsDir, `${base}.jsonl`),
+    eventsPath: join22(streamsDir, `${base}.events.jsonl`),
     ticket: o.ticket,
     ticketRecordId: o.ticketRecordId ?? null,
     repo: o.repo ?? null,
@@ -9201,7 +9355,7 @@ function describePlan(p) {
 var pidPathFor = (streamPath) => `${streamPath}.pid`;
 function readRunSidecar(streamPath) {
   try {
-    const sc = JSON.parse(readFileSync18(pidPathFor(streamPath), "utf8"));
+    const sc = JSON.parse(readFileSync19(pidPathFor(streamPath), "utf8"));
     return typeof sc.pid === "number" && typeof sc.spawnedAt === "string" && typeof sc.role === "string" ? sc : null;
   } catch {
     return null;
@@ -9237,7 +9391,7 @@ function identityOf(plan, adapterHarness) {
 var withoutKey = ({ apiKey: _apiKey, ...rest }) => rest;
 function openSink(path) {
   try {
-    mkdirSync11(dirname8(path), { recursive: true });
+    mkdirSync12(dirname8(path), { recursive: true });
     return createWriteStream(path, { flags: "a" });
   } catch {
     return void 0;
@@ -9419,7 +9573,7 @@ var RunObserver = class {
 };
 function writeRunMeta(id, startedAt, liveTicket, extra) {
   try {
-    writeFileSync12(`${id.streamPath}.meta.json`, JSON.stringify({
+    writeFileSync13(`${id.streamPath}.meta.json`, JSON.stringify({
       route: id.route,
       role: id.role,
       hint: id.ticket,
@@ -9579,7 +9733,7 @@ function spawnAgent(plan, emit, hintMoved) {
   return new Promise((resolve6, reject) => {
     let streamFd;
     try {
-      mkdirSync11(dirname8(plan.streamPath), { recursive: true });
+      mkdirSync12(dirname8(plan.streamPath), { recursive: true });
       streamFd = openSync3(plan.streamPath, "a");
     } catch (e) {
       void endSink(eventsSink);
@@ -9614,7 +9768,7 @@ function spawnAgent(plan, emit, hintMoved) {
         promptSha: plan.promptSha
       };
       try {
-        writeFileSync12(pidPathFor(plan.streamPath), JSON.stringify(sidecar));
+        writeFileSync13(pidPathFor(plan.streamPath), JSON.stringify(sidecar));
       } catch {
       }
     }
@@ -9680,7 +9834,7 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
 }
 
 // src/seat-keys.ts
-import { getSessionStore as getSessionStore2, hostFromUrl as hostFromUrl2 } from "@tablation/client";
+import { hostFromUrl as hostFromUrl2 } from "@tablation/client";
 var SEAT_KEY_ROLES = ROLE_NAMES.filter((r) => r !== "pair");
 function keyIsAdmin(route2) {
   const role = route2.resolved?.role;
@@ -9699,7 +9853,7 @@ function slugFor(route2, agentId) {
 function seatAgentId(route2, role) {
   return route2.resolved?.agentPersonas?.[role]?.agentId;
 }
-async function resolveReleaseKey(route2, getStore = getSessionStore2) {
+async function resolveReleaseKey(route2, getStore = getSessionStore) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route2), reason });
   const agentId = route2.resolved?.releaseAgentId;
   if (!agentId) return ship(keyIsAdmin(route2) ? "release seat has no linked Agents row (run `crew agents sync`)" : `release seat ${MEMBER_NO_ROW}`);
@@ -9708,10 +9862,11 @@ async function resolveReleaseKey(route2, getStore = getSessionStore2) {
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
     return ship(keyIsAdmin(route2) ? "no agent key stored for the release seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch (e) {
-    return ship(describeReadError(e));
+    const reason = describeReadError(e);
+    return { kind: "ship", apiKey: resolveApiKey(route2), reason, storeError: reason };
   }
 }
-async function resolveSeatKey(route2, role, getStore = getSessionStore2) {
+async function resolveSeatKey(route2, role, getStore = getSessionStore) {
   const ship = (reason) => ({ kind: "ship", apiKey: resolveApiKey(route2), reason });
   if (!SEAT_KEY_ROLES.includes(role)) return ship(`${role} always writes as the ship`);
   const agentId = seatAgentId(route2, role);
@@ -9721,7 +9876,8 @@ async function resolveSeatKey(route2, role, getStore = getSessionStore2) {
     if (session?.apiKey) return { kind: "agent", apiKey: session.apiKey, agentId };
     return ship(keyIsAdmin(route2) ? "no agent key stored for this seat (run `crew agents sync`)" : MEMBER_NO_KEY);
   } catch (e) {
-    return ship(describeReadError(e));
+    const reason = describeReadError(e);
+    return { kind: "ship", apiKey: resolveApiKey(route2), reason, storeError: reason };
   }
 }
 function safeStderrLine(e) {
@@ -9735,6 +9891,8 @@ function safeStderrLine(e) {
   return void 0;
 }
 function describeReadError(e) {
+  const fsErr = e;
+  if (typeof fsErr?.path === "string" && typeof fsErr.code === "string") return `key file store unreadable (${fsErr.code})`;
   const code = e?.code;
   const line = safeStderrLine(e);
   const what = typeof code === "number" ? `security exited ${code}` : typeof code === "string" ? `security failed: ${code}` : void 0;
@@ -9763,7 +9921,7 @@ async function mintMissingSeatKeys(route2, o) {
   ];
   let store;
   try {
-    store = (o.getStore ?? getSessionStore2)();
+    store = (o.getStore ?? getSessionStore)();
   } catch (e) {
     return targets.map(({ role }) => ({
       role,
@@ -9886,7 +10044,7 @@ async function revokeSeatKeys(route2, o) {
   ];
   let store;
   try {
-    store = (o.getStore ?? getSessionStore2)();
+    store = (o.getStore ?? getSessionStore)();
   } catch (e) {
     return targets.map(({ role }) => ({ role, action: "failed", detail: describeStoreError(e) }));
   }
@@ -10117,7 +10275,7 @@ async function runSelftest(i, deps = realDeps) {
     ...adapter.runEnv(spec),
     [KEY_VAR]: i.apiKey
   };
-  const cwd = mkdtempSync(join22(tmpdir2(), "crew-selftest-"));
+  const cwd = mkdtempSync(join23(tmpdir2(), "crew-selftest-"));
   try {
     const run2 = await deps.run({
       bin: invocation.bin,
@@ -10139,7 +10297,7 @@ async function runSelftest(i, deps = realDeps) {
     return finish({ ok: false, failure, detail, ...usage2 });
   } finally {
     try {
-      rmSync10(cwd, { recursive: true, force: true });
+      rmSync11(cwd, { recursive: true, force: true });
     } catch {
     }
   }
@@ -10150,11 +10308,11 @@ function formatResult(r) {
   const secs = `${(r.ms / 1e3).toFixed(1)}s`;
   return r.ok ? `${r.toolchain}: PASS ${r.detail} (${secs}${tok})` : `${r.toolchain}: FAIL ${r.failure} \u2014 ${r.detail} (${secs})`;
 }
-var fileFor2 = (stateDir) => join22(stateDir, "selftest.json");
+var fileFor2 = (stateDir) => join23(stateDir, "selftest.json");
 function readSelftest(stateDir) {
   try {
     const p = fileFor2(stateDir);
-    return existsSync21(p) ? JSON.parse(readFileSync19(p, "utf8")) : {};
+    return existsSync22(p) ? JSON.parse(readFileSync20(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -10162,8 +10320,8 @@ function readSelftest(stateDir) {
 function recordSelftest(stateDir, results) {
   const all = readSelftest(stateDir);
   for (const r of results) all[r.toolchain] = r;
-  mkdirSync12(stateDir, { recursive: true });
-  writeFileSync13(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
+  mkdirSync13(stateDir, { recursive: true });
+  writeFileSync14(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
 `);
 }
 function doctorSelftestLines(stored, toolchains) {
@@ -10175,7 +10333,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve5, dirname as dirname22, join as join43, basename as basename13 } from "path";
+import { resolve as resolve5, dirname as dirname22, join as join44, basename as basename13 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir10 } from "os";
 import { spawnSync as spawnSync7 } from "child_process";
@@ -10296,10 +10454,10 @@ function seats(roster) {
 function holds(roster) {
   return [...roster.values()].filter((m) => m.kind === "hold");
 }
-function buildRoster(configured, crewRows) {
+function buildRoster(configured2, crewRows) {
   const rows = new Map(crewRows.map((r) => [r.id, r]));
   const roster = /* @__PURE__ */ new Map();
-  for (const c of configured) {
+  for (const c of configured2) {
     if (!c.id) continue;
     const row = rows.get(c.id);
     const name = (row?.name ?? "").trim();
@@ -10365,14 +10523,14 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/connect-resume.ts
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync20, rmSync as rmSync11, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname9, join as join23 } from "path";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync21, rmSync as rmSync12, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname9, join as join24 } from "path";
 function lastSessionFile(stateDir) {
-  return join23(stateDir, "connect-session.json");
+  return join24(stateDir, "connect-session.json");
 }
 function readPointers(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync20(lastSessionFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync21(lastSessionFile(stateDir), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const out = {};
     for (const [host, v] of Object.entries(parsed)) {
@@ -10386,8 +10544,8 @@ function readPointers(stateDir) {
 }
 function writePointers(stateDir, pointers) {
   const file = lastSessionFile(stateDir);
-  mkdirSync13(dirname9(file), { recursive: true });
-  writeFileSync14(file, `${JSON.stringify(pointers, null, 2)}
+  mkdirSync14(dirname9(file), { recursive: true });
+  writeFileSync15(file, `${JSON.stringify(pointers, null, 2)}
 `, { mode: 384 });
 }
 function rememberSession(stateDir, host, workspaceSlug) {
@@ -10404,7 +10562,7 @@ function forgetWorkspace(stateDir, host, workspaceSlug) {
     const { [host]: _old, ...rest } = all;
     const next = left.length ? { ...rest, [host]: left } : rest;
     if (Object.keys(next).length) writePointers(stateDir, next);
-    else rmSync11(lastSessionFile(stateDir), { force: true });
+    else rmSync12(lastSessionFile(stateDir), { force: true });
   } catch {
   }
 }
@@ -10444,7 +10602,7 @@ function forgetSession(stateDir, host) {
   try {
     const { [host]: _gone, ...rest } = readPointers(stateDir);
     if (Object.keys(rest).length) writePointers(stateDir, rest);
-    else rmSync11(lastSessionFile(stateDir), { force: true });
+    else rmSync12(lastSessionFile(stateDir), { force: true });
   } catch {
   }
 }
@@ -10472,15 +10630,15 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync14, readFileSync as readFileSync21, readdirSync as readdirSync9, rmSync as rmSync12, statSync as statSync7, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname10, join as join24 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync15, readFileSync as readFileSync22, readdirSync as readdirSync9, rmSync as rmSync13, statSync as statSync8, writeFileSync as writeFileSync16 } from "fs";
+import { dirname as dirname10, join as join25 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
-  return join24(stateDir, "cloned-checkouts.json");
+  return join25(stateDir, "cloned-checkouts.json");
 }
 function readClonedCheckouts(stateDir) {
   try {
-    const parsed = JSON.parse(readFileSync21(clonedCheckoutsFile(stateDir), "utf8"));
+    const parsed = JSON.parse(readFileSync22(clonedCheckoutsFile(stateDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((d) => typeof d === "string") : [];
   } catch {
     return [];
@@ -10490,8 +10648,8 @@ function recordClonedCheckout(stateDir, dir) {
   const known = readClonedCheckouts(stateDir);
   if (known.includes(dir)) return;
   const file = clonedCheckoutsFile(stateDir);
-  mkdirSync14(dirname10(file), { recursive: true });
-  writeFileSync15(file, `${JSON.stringify([...known, dir], null, 2)}
+  mkdirSync15(dirname10(file), { recursive: true });
+  writeFileSync16(file, `${JSON.stringify([...known, dir], null, 2)}
 `);
 }
 var mark = (dryRun) => dryRun ? "would-remove" : "removed";
@@ -10543,8 +10701,8 @@ async function runReset(o, fx) {
     for (const dir of readClonedCheckouts(o.stateDir)) steps.push(removeCheckout(dir, o.dryRun, fx));
   }
   steps.push(...removeState(o.stateDir, o.dryRun));
-  if (existsSync22(o.configFile)) {
-    if (!o.dryRun) rmSync12(o.configFile, { force: true });
+  if (existsSync23(o.configFile)) {
+    if (!o.dryRun) rmSync13(o.configFile, { force: true });
     steps.push({ step: "config", target: o.configFile, action: mark(o.dryRun) });
   } else {
     steps.push({ step: "config", target: o.configFile, action: "absent" });
@@ -10552,7 +10710,7 @@ async function runReset(o, fx) {
   return steps;
 }
 function removeCheckout(dir, dryRun, fx) {
-  if (!existsSync22(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
+  if (!existsSync23(dir)) return { step: "checkout", target: dir, action: "absent", detail: "already gone" };
   const { dirty, linkedWorktrees } = fx.inspectCheckout(dir);
   if (dirty.length) {
     return { step: "checkout", target: dir, action: "kept", detail: `has uncommitted changes (${dirty.length} path${dirty.length === 1 ? "" : "s"}: ${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? ", \u2026" : ""})` };
@@ -10560,21 +10718,21 @@ function removeCheckout(dir, dryRun, fx) {
   if (linkedWorktrees.length) {
     return { step: "checkout", target: dir, action: "kept", detail: `has linked worktrees (${linkedWorktrees.join(", ")}); remove them first` };
   }
-  if (!dryRun) rmSync12(dir, { recursive: true, force: true });
+  if (!dryRun) rmSync13(dir, { recursive: true, force: true });
   return { step: "checkout", target: dir, action: mark(dryRun) };
 }
 function removeState(stateDir, dryRun) {
   const out = [];
-  const targets = [join24(stateDir, "resolved"), join24(stateDir, "keys"), clonedCheckoutsFile(stateDir), join24(stateDir, "connect-session.json"), join24(stateDir, "reload-requested"), join24(stateDir, "daemon.started")];
+  const targets = [join25(stateDir, "resolved"), join25(stateDir, "keys"), clonedCheckoutsFile(stateDir), join25(stateDir, "connect-session.json"), join25(stateDir, "reload-requested"), join25(stateDir, "daemon.started")];
   try {
     for (const name of readdirSync9(stateDir)) {
-      if (name.startsWith(".") && statSync7(join24(stateDir, name)).isFile()) targets.push(join24(stateDir, name));
+      if (name.startsWith(".") && statSync8(join25(stateDir, name)).isFile()) targets.push(join25(stateDir, name));
     }
   } catch {
   }
   for (const t of targets) {
-    if (!existsSync22(t)) continue;
-    if (!dryRun) rmSync12(t, { recursive: true, force: true });
+    if (!existsSync23(t)) continue;
+    if (!dryRun) rmSync13(t, { recursive: true, force: true });
     out.push({ step: "state", target: t, action: mark(dryRun) });
   }
   if (!out.length) out.push({ step: "state", target: stateDir, action: "absent", detail: "nothing to remove" });
@@ -11361,8 +11519,8 @@ ${waiting.map((t) => `| ${displayKey2(t)} | ${t.status} | ${blockers(t, i)} |`).
 }
 
 // src/poll.ts
-import { writeFileSync as writeFileSync16 } from "fs";
-import { join as join25 } from "path";
+import { writeFileSync as writeFileSync17 } from "fs";
+import { join as join26 } from "path";
 
 // src/stalled.ts
 var STALLED_AFTER_CYCLES = 30;
@@ -11669,7 +11827,7 @@ async function decideCycle(o) {
   }
   return decision;
 }
-var digestPath = (stateDir, route2, role, runId) => join25(stateDir, `digest-${route2}-${role}${runId ? `-${runId}` : ""}.md`);
+var digestPath = (stateDir, route2, role, runId) => join26(stateDir, `digest-${route2}-${role}${runId ? `-${runId}` : ""}.md`);
 function otherRunsRemoved(tickets, own) {
   if (!own) return tickets;
   return tickets.filter((t) => t.id === own.ticket.id || !own.inFlight(t.id));
@@ -11747,7 +11905,7 @@ function writeDigest(o, d, role, stateDir, runId, own) {
 
 ${body}` : body;
     const path = digestPath(stateDir, routeSlug(o.route.route), role, runId);
-    writeFileSync16(path, text);
+    writeFileSync17(path, text);
     o.emit.emit(`queue digest written for ${role} (${Buffer.byteLength(text)} bytes)`, {
       data: { role, bytes: Buffer.byteLength(text) }
     });
@@ -12230,13 +12388,13 @@ Ship ${shipName2} found: ${problem}. The release refuses to squash a ref nobody
 var localRefSkipReported = (ticket, problem, events) => events.some((e) => e.record_id === ticket.id && e.event_type === "local_ref_skip" && (e.message ?? "").includes(problem));
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname11, join as join26 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync23, mkdirSync as mkdirSync15, writeFileSync as writeFileSync17 } from "fs";
+import { delimiter, dirname as dirname11, join as join27 } from "path";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync24, mkdirSync as mkdirSync16, writeFileSync as writeFileSync18 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync23;
+  const exists = opts.configExists ?? existsSync24;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -12244,7 +12402,7 @@ function firstRunConfigPath() {
 }
 function defaultIsExecutable(p) {
   try {
-    accessSync2(p, constants2.X_OK);
+    accessSync3(p, constants3.X_OK);
     return true;
   } catch {
     return false;
@@ -12253,7 +12411,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join26(dir, name);
+    const candidate = join27(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -12314,9 +12472,9 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text) {
-  mkdirSync15(dirname11(path), { recursive: true });
+  mkdirSync16(dirname11(path), { recursive: true });
   try {
-    writeFileSync17(path, text, { mode: 384, flag: "wx" });
+    writeFileSync18(path, text, { mode: 384, flag: "wx" });
     return true;
   } catch (e) {
     if (e.code === "EEXIST") return false;
@@ -12348,9 +12506,9 @@ Wrote ${o.configPath}.
 }
 
 // src/connect-json.ts
-import { accessSync as accessSync3, constants as constants3 } from "fs";
+import { accessSync as accessSync4, constants as constants4 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname12, join as join27 } from "path";
+import { dirname as dirname12, join as join28 } from "path";
 import { delimiter as delimiter2 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json, write) {
@@ -12389,12 +12547,12 @@ function agentBinSearchDirs(home, pathEnv, extraPath) {
   const dirs = [
     ...pathEnv.split(delimiter2),
     ...(extraPath ?? "").split(delimiter2),
-    join27(home, ".local/bin"),
-    join27(home, ".claude/local"),
+    join28(home, ".local/bin"),
+    join28(home, ".claude/local"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    join27(home, ".npm-global/bin"),
-    join27(home, ".volta/bin")
+    join28(home, ".npm-global/bin"),
+    join28(home, ".volta/bin")
   ];
   return [...new Set(dirs.filter(Boolean))];
 }
@@ -12405,7 +12563,7 @@ function findAgentBin(name, env, extraPath, isExec) {
 function flagWizardAnswers(f, env) {
   const isExec = env.isExecutable ?? ((p) => {
     try {
-      accessSync3(p, constants3.X_OK);
+      accessSync4(p, constants4.X_OK);
       return true;
     } catch {
       return false;
@@ -12430,8 +12588,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync18, existsSync as existsSync24, copyFileSync, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync2, rmSync as rmSync13 } from "fs";
-import { dirname as dirname13, join as join28 } from "path";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync19, existsSync as existsSync25, copyFileSync, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, rmSync as rmSync14 } from "fs";
+import { dirname as dirname13, join as join29 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/release.ts
@@ -13172,13 +13330,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join28(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join29(o.cwd, f));
   const first = files[0];
-  if (!existsSync24(first)) {
+  if (!existsSync25(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync22(first, "utf8")).version;
+  const current = JSON.parse(readFileSync23(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -13191,27 +13349,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync22(f, "utf8");
+    const src = readFileSync23(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync18(f, out);
+    writeFileSync19(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join28(o.cwd, file);
+  const path = join29(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync24(path) ? readFileSync22(path, "utf8") : "# Changelog\n";
-  writeFileSync18(path, insertChangelogSection(existing, section));
+  const existing = existsSync25(path) ? readFileSync23(path, "utf8") : "# Changelog\n";
+  writeFileSync19(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -13294,7 +13452,7 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
     run2(cwd, ["worktree", "remove", "--force", dir]);
   } finally {
     try {
-      rmSync13(root, { recursive: true, force: true });
+      rmSync14(root, { recursive: true, force: true });
     } finally {
       run2(cwd, ["worktree", "prune"]);
       run2(cwd, ["branch", "-D", branch]);
@@ -13304,8 +13462,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join28(tmpdir3(), "crew-release-"));
-  const dir = join28(root, "checkout");
+  const root = mkdtempSync2(join29(tmpdir3(), "crew-release-"));
+  const dir = join29(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -13315,10 +13473,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join28(o.cwd, f);
-    if (!existsSync24(src)) continue;
-    mkdirSync16(dirname13(join28(dir, f)), { recursive: true });
-    copyFileSync(src, join28(dir, f));
+    const src = join29(o.cwd, f);
+    if (!existsSync25(src)) continue;
+    mkdirSync17(dirname13(join29(dir, f)), { recursive: true });
+    copyFileSync(src, join29(dir, f));
   }
   return { dir, branch, close };
 }
@@ -14019,12 +14177,12 @@ Passed: ${passed}.${willClose ? " Closing this alert." : ""}`,
 }
 
 // src/live-runs.ts
-import { existsSync as existsSync26, readdirSync as readdirSync11 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync11 } from "fs";
+import { join as join31 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync25, readdirSync as readdirSync10, readFileSync as readFileSync23 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync26, readdirSync as readdirSync10, readFileSync as readFileSync24 } from "fs";
+import { join as join30 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14043,21 +14201,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync25(path)) return false;
+  if (!existsSync26(path)) return false;
   try {
-    return JSON.parse(readFileSync23(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync24(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join29(o.stateDir, "streams");
-  if (!existsSync25(dir)) return [];
+  const dir = join30(o.stateDir, "streams");
+  if (!existsSync26(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join29(dir, name);
+    const streamPath = join30(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14111,12 +14269,12 @@ async function reconcileRuns(o) {
 
 // src/live-runs.ts
 function liveRuns(stateDir, isAlive = runIsAlive) {
-  const dir = join30(stateDir, "streams");
-  if (!existsSync26(dir)) return [];
+  const dir = join31(stateDir, "streams");
+  if (!existsSync27(dir)) return [];
   const out = [];
   for (const name of readdirSync11(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join30(dir, name);
+    const streamPath = join31(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || !isAlive(sidecar)) continue;
@@ -14450,7 +14608,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync27, statSync as statSync8, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync28, statSync as statSync9, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -14551,8 +14709,8 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync27(file)) return { events: [], offset: from };
-  const size = statSync8(file).size;
+  if (!existsSync28(file)) return { events: [], offset: from };
+  const size = statSync9(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
   const fd = openSync4(file, "r");
@@ -14794,19 +14952,19 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync25, renameSync as renameSync2, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync26, renameSync as renameSync3, writeFileSync as writeFileSync21 } from "fs";
 import { dirname as dirname15 } from "path";
 import { parseDocument as parseDocument2 } from "yaml";
 
 // src/machine-id.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync24, writeFileSync as writeFileSync19 } from "fs";
-import { dirname as dirname14, join as join31 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "fs";
+import { dirname as dirname14, join as join32 } from "path";
 function machineIdPathFor(stateDir) {
-  return join31(stateDir, "machine-id");
+  return join32(stateDir, "machine-id");
 }
-var sha256 = (s) => createHash4("sha256").update(s).digest("hex");
+var sha256 = (s) => createHash5("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
   try {
     if (platform2 === "darwin") {
@@ -14817,8 +14975,8 @@ function readRawMachineId(platform2 = process.platform) {
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync28(p)) {
-        const id = readFileSync24(p, "utf8").trim();
+      if (existsSync29(p)) {
+        const id = readFileSync25(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -14829,15 +14987,15 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync28(path)) {
-    const cached = readFileSync24(path, "utf8").trim();
+  if (existsSync29(path)) {
+    const cached = readFileSync25(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync17(dirname14(path), { recursive: true });
-  writeFileSync19(path, `${hashed}
+  mkdirSync18(dirname14(path), { recursive: true });
+  writeFileSync20(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -14908,34 +15066,34 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync29(resolvedFile)) return void 0;
+  if (!existsSync30(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync25(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync26(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync29(resolvedFile)) return;
+  if (!existsSync30(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync25(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync26(resolvedFile, "utf8"));
   } catch {
     return;
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync18(dirname15(resolvedFile), { recursive: true });
+  mkdirSync19(dirname15(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync20(tmp, `${JSON.stringify(raw, null, 2)}
+  writeFileSync21(tmp, `${JSON.stringify(raw, null, 2)}
 `);
-  renameSync2(tmp, resolvedFile);
+  renameSync3(tmp, resolvedFile);
 }
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync25(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync26(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -14959,8 +15117,8 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text = readFileSync25(i.configFile, "utf8");
-    writeFileSync20(i.configFile, setShipNameInYaml(text, result.name));
+    const text = readFileSync26(i.configFile, "utf8");
+    writeFileSync21(i.configFile, setShipNameInYaml(text, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
       i.emit?.warn(
@@ -15558,7 +15716,6 @@ ${opts.area ? `    area: "${opts.area}"
 
 // src/cli.ts
 import {
-  getSessionStore as getSessionStore3,
   hostFromUrl as hostFromUrl4,
   loginWithDeviceCode,
   DeviceLoginError
@@ -15610,7 +15767,7 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync20, readFileSync as readFileSync27, writeFileSync as writeFileSync22 } from "fs";
 import { dirname as dirname16 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
@@ -15644,12 +15801,12 @@ async function runAgentsSync(target, o) {
   for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
   if (!dryRun) {
     const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync30(resolvedPath) ? JSON.parse(readFileSync26(resolvedPath, "utf8")) : {};
+    const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync27(resolvedPath, "utf8")) : {};
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync19(dirname16(resolvedPath), { recursive: true });
-    writeFileSync21(resolvedPath, `${JSON.stringify(raw, null, 2)}
+    mkdirSync20(dirname16(resolvedPath), { recursive: true });
+    writeFileSync22(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
       target.resolved.agentPersonas = personaResult.agentPersonas;
@@ -15664,7 +15821,7 @@ async function runAgentsSync(target, o) {
 }
 
 // src/logbook.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { TablationClient as TablationClient4 } from "@tablation/client";
 var LogbookError = class extends Error {
 };
@@ -15737,7 +15894,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
     };
   }
   const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
-  const actualSha = createHash5("sha256").update(prompt).digest("hex");
+  const actualSha = createHash6("sha256").update(prompt).digest("hex");
   const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
   return {
     entry,
@@ -15753,7 +15910,7 @@ async function showLogEntry(route2, entryId, opts = {}) {
 
 // src/repos-check.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync27 } from "fs";
+import { readFileSync as readFileSync28 } from "fs";
 import { basename as basename8 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
 function checkHookSyntax(script, shell) {
@@ -15794,7 +15951,7 @@ function checkRepoSpec(dir, opts = {}) {
   }
   let parsed;
   try {
-    parsed = parseRepoConfig(readFileSync27(file, "utf8"), file);
+    parsed = parseRepoConfig(readFileSync28(file, "utf8"), file);
   } catch (e) {
     if (!(e instanceof RepoConfigError)) throw e;
     return { ...empty, file, error: e.message, exitCode: 1 };
@@ -15851,7 +16008,7 @@ import { isMap as isMap2, parseDocument as parseDocument4, YAMLMap } from "yaml"
 
 // src/repos-cmd.ts
 import { homedir as homedir9 } from "os";
-import { basename as basename9, join as join32, resolve as resolve3 } from "path";
+import { basename as basename9, join as join33, resolve as resolve3 } from "path";
 import { isMap, isSeq, parseDocument as parseDocument3, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
@@ -16129,7 +16286,7 @@ function planRepoClone(i) {
   }
   const ship = doc.get("ship", true);
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join32(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const target = i.dir ? expandDir(i.dir, i.base) : join33(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
   return { ...add, remote, target };
 }
@@ -16528,7 +16685,7 @@ ${run2.err}` });
 }
 
 // src/sample-ticket.ts
-import { basename as basename10, dirname as dirname18, join as join33 } from "path";
+import { basename as basename10, dirname as dirname18, join as join34 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -16551,8 +16708,8 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join33(dirname18(existing[0]), SAMPLE_REPO);
-  return join33(reposBase, workspace, SAMPLE_REPO);
+  if (existing.length > 0) return join34(dirname18(existing[0]), SAMPLE_REPO);
+  return join34(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
 function sampleDescription() {
@@ -16644,8 +16801,8 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync31, readFileSync as readFileSync28, readdirSync as readdirSync12 } from "fs";
-import { basename as basename11, dirname as dirname19, join as join34, resolve as resolve4 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync29, readdirSync as readdirSync12 } from "fs";
+import { basename as basename11, dirname as dirname19, join as join35, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -16722,7 +16879,7 @@ function siblingWorktreeDirs(target) {
   for (const name of names) {
     if (!name.startsWith(stem)) continue;
     const m = DIR_NUMBER_SUFFIXED.exec(name);
-    const path = join34(parent, name);
+    const path = join35(parent, name);
     if (m && !registered.has(resolve4(path))) out.push({ path, number: m[1] });
   }
   return out;
@@ -16757,7 +16914,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync31(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync32(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -16765,7 +16922,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync31(a.path)) {
+    if (!dryRun && existsSync32(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -16776,7 +16933,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync31(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync32(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -16825,7 +16982,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync28(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync29(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -16930,16 +17087,16 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync32, readdirSync as readdirSync13, rmSync as rmSync14, statSync as statSync9 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync33, readdirSync as readdirSync13, rmSync as rmSync15, statSync as statSync10 } from "fs";
+import { join as join36 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join35(stateDir, "streams");
-  if (!existsSync32(dir)) return [];
+  const dir = join36(stateDir, "streams");
+  if (!existsSync33(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync13(dir).map((name) => join35(dir, name)).filter((path) => {
+  return readdirSync13(dir).map((name) => join36(dir, name)).filter((path) => {
     try {
-      return statSync9(path).mtimeMs < cutoff;
+      return statSync10(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -16953,7 +17110,7 @@ function applyStreamSweep(paths, dryRun, log) {
       continue;
     }
     try {
-      rmSync14(path, { force: true });
+      rmSync15(path, { force: true });
       removed++;
       log.emit(`removed stream artifact ${path}`, { step: "worktree" });
     } catch (e) {
@@ -16963,11 +17120,11 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync32(stateDir)) return [];
+  if (!existsSync33(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync13(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join35(stateDir, name)).filter((path) => {
+  return readdirSync13(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join36(stateDir, name)).filter((path) => {
     try {
-      return statSync9(path).mtimeMs < cutoff;
+      return statSync10(path).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -16975,30 +17132,30 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync34, existsSync as existsSync39, mkdirSync as mkdirSync25, writeFileSync as writeFileSync26, rmSync as rmSync18, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync3, statSync as statSync13, readdirSync as readdirSync18 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync35, existsSync as existsSync40, mkdirSync as mkdirSync26, writeFileSync as writeFileSync27, rmSync as rmSync19, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync4, statSync as statSync14, readdirSync as readdirSync18 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync20, readFileSync as readFileSync29, rmSync as rmSync15, writeFileSync as writeFileSync22 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync30, rmSync as rmSync16, writeFileSync as writeFileSync23 } from "fs";
+import { join as join37 } from "path";
 var PeriscopeError = class extends Error {
 };
-var priorDir = (stateDir) => join36(stateDir, "periscope-priors");
-var priorPath = (stateDir, ticketRecordId) => join36(priorDir(stateDir), `${ticketRecordId}.json`);
+var priorDir = (stateDir) => join37(stateDir, "periscope-priors");
+var priorPath = (stateDir, ticketRecordId) => join37(priorDir(stateDir), `${ticketRecordId}.json`);
 function removePeriscopePrior(stateDir, ticketRecordId) {
-  rmSync15(priorPath(stateDir, ticketRecordId), { force: true });
+  rmSync16(priorPath(stateDir, ticketRecordId), { force: true });
 }
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
-    mkdirSync20(priorDir(stateDir), { recursive: true });
-    writeFileSync22(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
+    mkdirSync21(priorDir(stateDir), { recursive: true });
+    writeFileSync23(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
 }
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync33(p) ? JSON.parse(readFileSync29(p, "utf8")) : void 0;
+    return existsSync34(p) ? JSON.parse(readFileSync30(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -17390,8 +17547,8 @@ ${tail2(preview.output)}`);
 
 // src/periscope-idle.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { statSync as statSync10 } from "fs";
-import { join as join37 } from "path";
+import { statSync as statSync11 } from "fs";
+import { join as join38 } from "path";
 var MAX_SCANNED_FILES = 2e4;
 function newestWorktreeMtime(root) {
   let listing;
@@ -17411,7 +17568,7 @@ function newestWorktreeMtime(root) {
     if (!rel) continue;
     if (++scanned > MAX_SCANNED_FILES) break;
     try {
-      const m = statSync10(join37(root, rel)).mtimeMs;
+      const m = statSync11(join38(root, rel)).mtimeMs;
       if (newest === null || m > newest) newest = m;
     } catch {
     }
@@ -17487,18 +17644,18 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync30, chmodSync as chmodSync2 } from "fs";
-import { dirname as dirname20, join as join38 } from "path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync31, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname20, join as join39 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join38(stateDir, "ssh", "id_ed25519");
+  return join39(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync34(privateKeyPath)) {
-    mkdirSync21(dirname20(privateKeyPath), { recursive: true });
+  if (!existsSync35(privateKeyPath)) {
+    mkdirSync22(dirname20(privateKeyPath), { recursive: true });
     try {
       execFileSync8("ssh-keygen", [
         "-t",
@@ -17516,12 +17673,12 @@ function ensureShipSshKeypair(stateDir) {
       const err2 = e;
       throw new SshKeyError(`ssh-keygen failed: ${err2.stderr?.toString().trim() || err2.message}`);
     }
-    chmodSync2(privateKeyPath, 384);
+    chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync34(publicKeyPath)) {
+  if (!existsSync35(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync30(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync31(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -17535,7 +17692,7 @@ function sshKeygenAvailable() {
 
 // src/passenger-containers.ts
 import { execFileSync as execFileSync9 } from "child_process";
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 var realExec = (cmd, args, opts) => {
   try {
     return execFileSync9(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
@@ -17573,12 +17730,12 @@ function containerNameFor(workspaceId) {
   return `crew-passenger-${workspaceId}`;
 }
 function portFor(workspaceId, base = 28765, span = 1e3) {
-  const digest = createHash6("sha256").update(workspaceId).digest();
+  const digest = createHash7("sha256").update(workspaceId).digest();
   return base + digest.readUInt32BE(0) % span;
 }
 function mountsDigest(mounts, image) {
   const sorted2 = [...mounts].sort((a, b) => a.containerPath.localeCompare(b.containerPath));
-  return createHash6("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
+  return createHash7("sha256").update(JSON.stringify({ mounts: sorted2, image })).digest("hex").slice(0, 16);
 }
 function planContainers(cfg) {
   const byWorkspace = /* @__PURE__ */ new Map();
@@ -17738,9 +17895,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync31, writeFileSync as writeFileSync23, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync23, readFileSync as readFileSync32, writeFileSync as writeFileSync24, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
 import { randomInt } from "crypto";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn5(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -17807,21 +17964,21 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join39(stateDir, "passengers", `${workspaceId}.json`);
+  return join40(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync35(path)) return void 0;
+  if (!existsSync36(path)) return void 0;
   try {
-    return JSON.parse(readFileSync31(path, "utf8"));
+    return JSON.parse(readFileSync32(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync22(join39(stateDir, "passengers"), { recursive: true });
-  writeFileSync23(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync23(join40(stateDir, "passengers"), { recursive: true });
+  writeFileSync24(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -17918,13 +18075,13 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join39(stateDir, "passengers");
-  if (!existsSync35(dir)) return [];
+  const dir = join40(stateDir, "passengers");
+  if (!existsSync36(dir)) return [];
   return readdirSync14(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
 // src/mcp-endpoint-registry.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function endpointsUrl(api, workspaceId, id) {
   const base = `${api.baseUrl.replace(/\/+$/, "")}/api/workspaces/${workspaceId}/mcp-endpoints`;
   return id ? `${base}/${id}` : base;
@@ -17992,7 +18149,7 @@ async function probeEndpointAccess(api, workspaceId) {
 }
 var REGISTER_MCP_ENDPOINTS_HINT = "give this key's role the REGISTER_MCP_ENDPOINTS capability, e.g. via the group that holds the Crew project role";
 function registrationKey(url, mcpSecret) {
-  return createHash7("sha256").update(`${url}
+  return createHash8("sha256").update(`${url}
 ${mcpSecret ?? ""}`).digest("hex").slice(0, 16);
 }
 async function reconcileEndpoint(workspaceId, d) {
@@ -18040,8 +18197,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn6 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync36, mkdirSync as mkdirSync23, readFileSync as readFileSync32, writeFileSync as writeFileSync24, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
+import { join as join41 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -18130,21 +18287,21 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join40(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join41(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync36(path)) return void 0;
+  if (!existsSync37(path)) return void 0;
   try {
-    return JSON.parse(readFileSync32(path, "utf8"));
+    return JSON.parse(readFileSync33(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync23(join40(stateDir, "passengers"), { recursive: true });
-  writeFileSync24(path, `${JSON.stringify(state, null, 2)}
+  mkdirSync24(join41(stateDir, "passengers"), { recursive: true });
+  writeFileSync25(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -18164,8 +18321,8 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join40(stateDir, "passengers");
-  if (!existsSync36(dir)) return [];
+  const dir = join41(stateDir, "passengers");
+  if (!existsSync37(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync15(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -18253,8 +18410,8 @@ function describeCause(err2) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync24, readFileSync as readFileSync33, readdirSync as readdirSync16, rmSync as rmSync16, statSync as statSync11, writeFileSync as writeFileSync25 } from "fs";
-import { join as join41 } from "path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync25, readFileSync as readFileSync34, readdirSync as readdirSync16, rmSync as rmSync17, statSync as statSync12, writeFileSync as writeFileSync26 } from "fs";
+import { join as join42 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
@@ -18317,7 +18474,7 @@ async function runDaemonLoop(o) {
 function latestMtime(path) {
   let stat;
   try {
-    stat = statSync11(path);
+    stat = statSync12(path);
   } catch {
     return 0;
   }
@@ -18325,7 +18482,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync16(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join41(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join42(path, entry.name)));
   }
   return latest;
 }
@@ -18334,23 +18491,23 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync37(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync38(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
-  return join41(stateDir, "reload-requested");
+  return join42(stateDir, "reload-requested");
 }
 function daemonStampFor(stateDir) {
-  return join41(stateDir, "daemon.started");
+  return join42(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync24(stateDir, { recursive: true });
-  rmSync16(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync25(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  mkdirSync25(stateDir, { recursive: true });
+  rmSync17(reloadSentinelFor(stateDir), { force: true });
+  writeFileSync26(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync33(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync34(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -18359,7 +18516,7 @@ function readDaemonStarted(stateDir) {
 function configChangedAfter(files, startedAt) {
   for (const f of files) {
     try {
-      if (statSync11(f).mtimeMs > startedAt) return f;
+      if (statSync12(f).mtimeMs > startedAt) return f;
     } catch {
     }
   }
@@ -18659,6 +18816,23 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
   const { route: route2, ship, emit } = ctx;
   const runId = randomBytes2(3).toString("hex");
   const identity = await resolveSeatKey(route2, role, ctx.getSessionStore);
+  if (identity.kind === "ship" && identity.storeError && SEAT_KEY_ROLES.includes(role)) {
+    emit.warn(`${role} run refused: its agent key cannot be read (${identity.storeError})`, { step: "agent", role });
+    try {
+      await raiseShipAttention(
+        { state: ctx.state, emit, route: route2, ship },
+        seatKeyUnreadableItem(routeSlug(route2.route), role, identity.storeError)
+      );
+    } catch {
+    }
+    return;
+  }
+  if (SEAT_KEY_ROLES.includes(role)) {
+    try {
+      clearShipAttention(ctx.state, seatKeyUnreadableKey(routeSlug(route2.route), role));
+    } catch {
+    }
+  }
   if (identity.kind === "ship" && SEAT_KEY_ROLES.includes(role)) {
     emit.warn(`${role} writes as the ship, not its own agent: ${identity.reason}`, { step: "agent", role });
   } else if (identity.kind === "agent") {
@@ -18830,26 +19004,26 @@ async function buildEnvironment(route2, ship, ticket) {
 }
 
 // src/control-api.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   closeSync as closeSync5,
-  existsSync as existsSync38,
+  existsSync as existsSync39,
   fstatSync,
   openSync as openSync5,
   readSync as readSync3,
   readdirSync as readdirSync17,
-  rmSync as rmSync17,
-  statSync as statSync12,
+  rmSync as rmSync18,
+  statSync as statSync13,
   watch
 } from "fs";
 import { createConnection } from "net";
 import { createServer } from "http";
-import { basename as basename12, dirname as dirname21, join as join42 } from "path";
+import { basename as basename12, dirname as dirname21, join as join43 } from "path";
 import { execFile, spawn as spawn7 } from "child_process";
 var PAUSABLE = ["dev", "design", "qa"];
 var CONTROL_SOCKET_NAME = "control.sock";
-var controlSocketFor = (stateDir) => join42(stateDir, CONTROL_SOCKET_NAME);
+var controlSocketFor = (stateDir) => join43(stateDir, CONTROL_SOCKET_NAME);
 var MAX_SOCKET_PATH = 100;
 var MAX_TAIL_BYTES = 1024 * 1024;
 var MAX_WAIT_SECONDS = 30;
@@ -18865,7 +19039,7 @@ var ControlAuth = class {
     if (!token) return "unauthorized";
     for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
     const now = (this.o.now ?? Date.now)();
-    const id = createHash8("sha256").update(token).digest("hex");
+    const id = createHash9("sha256").update(token).digest("hex");
     const hit = this.cache.get(id);
     if (hit && now - hit.at < (this.o.cacheMs ?? 6e4)) return hit.verdict;
     const verdict = await this.ask(token);
@@ -18920,7 +19094,7 @@ function candidates(live, rotated) {
   const out = [live];
   if (!rotated) return out;
   try {
-    for (const n of readdirSync17(dirname21(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join42(dirname21(live), n));
+    for (const n of readdirSync17(dirname21(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join43(dirname21(live), n));
   } catch {
   }
   return out;
@@ -18943,7 +19117,7 @@ function readRange(path, from, max) {
   }
 }
 function lastLines2(path, n) {
-  const st = statSync12(path);
+  const st = statSync13(path);
   const cursorAt = (off) => encodeCursor({ dev: st.dev, ino: st.ino, off });
   if (n <= 0 || st.size === 0) return { lines: [], cursor: cursorAt(st.size), reset: false };
   let start = st.size;
@@ -18964,7 +19138,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync38(live)) {
+  if (!existsSync39(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -18977,7 +19151,7 @@ function readTail(live, opts) {
   } else {
     const found = candidates(live, opts.rotated ?? false).find((p) => {
       try {
-        const s = statSync12(p);
+        const s = statSync13(p);
         return s.ino === cur.ino && s.dev === cur.dev;
       } catch {
         return false;
@@ -18988,7 +19162,7 @@ function readTail(live, opts) {
       off = cur.off;
     } else reset = true;
   }
-  let size = statSync12(path).size;
+  let size = statSync13(path).size;
   if (off > size) {
     off = 0;
     reset = true;
@@ -18996,12 +19170,12 @@ function readTail(live, opts) {
   if (off >= size && path !== live) {
     path = live;
     off = 0;
-    size = statSync12(path).size;
+    size = statSync13(path).size;
   }
   const { text } = readRange(path, off, max);
   const cut = text.lastIndexOf("\n");
   const whole = cut < 0 ? "" : text.slice(0, cut + 1);
-  const st = statSync12(path);
+  const st = statSync13(path);
   return {
     lines: whole.split("\n").filter((l) => l.length),
     cursor: encodeCursor({ dev: st.dev, ino: st.ino, off: off + Buffer.byteLength(whole) }),
@@ -19108,8 +19282,8 @@ async function route(deps, method, url, req, abort) {
   if (p.startsWith("/streams/") && get2) {
     const run2 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run2) || run2.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run2)) return err(400, "not a run name");
-    const file = join42(deps.stateDir, "streams", run2.endsWith(".jsonl") ? run2 : `${run2}.jsonl`);
-    if (!existsSync38(file)) return err(404, "no such run");
+    const file = join43(deps.stateDir, "streams", run2.endsWith(".jsonl") ? run2 : `${run2}.jsonl`);
+    if (!existsSync39(file)) return err(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -19144,7 +19318,7 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync38(path)) return false;
+  if (!existsSync39(path)) return false;
   return new Promise((resolve6) => {
     const c = createConnection(path);
     c.once("connect", () => {
@@ -19162,8 +19336,8 @@ async function startControlServer(deps) {
     log(`control API not started: socket path is too long for a unix socket (${path})`);
     return null;
   }
-  if (await socketIsStale(path)) rmSync17(path, { force: true });
-  else if (existsSync38(path)) {
+  if (await socketIsStale(path)) rmSync18(path, { force: true });
+  else if (existsSync39(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -19192,7 +19366,7 @@ async function startControlServer(deps) {
     });
     server.listen(path, () => {
       try {
-        chmodSync3(path, 384);
+        chmodSync4(path, 384);
       } catch {
       }
       server.on("error", (e) => log(`control API error: ${e.message}`));
@@ -19201,7 +19375,7 @@ async function startControlServer(deps) {
         path,
         close: () => new Promise((done) => {
           server.close(() => {
-            rmSync17(path, { force: true });
+            rmSync18(path, { force: true });
             done();
           });
         })
@@ -19678,7 +19852,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset");
-      if (configless && !existsSync39(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync40(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -19693,7 +19867,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   if (command === "credential") {
-    const r = runCredential(positional[1], readFileSync34(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    const r = runCredential(positional[1], readFileSync35(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
     process.stdout.write(r.out);
     process.stderr.write(r.err);
     process.exit(r.code);
@@ -19705,9 +19879,9 @@ if (command === "passenger-sync-daemon") {
         forges: cfg.ship.forges,
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
-        readFile: (p) => readFileSync34(p, "utf8"),
-        writeFile: (p, t) => writeFileSync26(p, t),
-        stdin: () => readFileSync34(0, "utf8"),
+        readFile: (p) => readFileSync35(p, "utf8"),
+        writeFile: (p, t) => writeFileSync27(p, t),
+        stdin: () => readFileSync35(0, "utf8"),
         env: process.env
       }
     );
@@ -19943,8 +20117,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join43(homedir10(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync39(staleTimer)) {
+      const staleTimer = join44(homedir10(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync40(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -19971,7 +20145,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync39(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync40(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -19989,7 +20163,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync39(p);
+    const unitExists = (p) => existsSync40(p);
     const crontab = o.host === "linux" ? spawnSync7("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -20006,7 +20180,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync26(cfg.configFile, planEnable(readFileSync34(cfg.configFile, "utf8"), a.route));
+          writeFileSync27(cfg.configFile, planEnable(readFileSync35(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -20150,6 +20324,23 @@ ${changed2.map((c) => `  - ${c}
       }
       if (!dryRun && !c.enabled) return { scope, tests: "skipped", outcome: "skipped", detail: "route not enabled" };
       const releaseIdentity = await resolveReleaseKey(c);
+      const releaseRouteSlug = routeSlug(c.route);
+      if (releaseIdentity.kind === "ship" && releaseIdentity.storeError) {
+        const detail = `release refused: its agent key cannot be read (${releaseIdentity.storeError})`;
+        remit.warn(`${scope}: ${detail}`, { step: "release" });
+        try {
+          await raiseShipAttention(
+            { state: new State(cfg.ship.stateDir), emit: remit, route: c, ship: cfg.ship },
+            seatKeyUnreadableItem(releaseRouteSlug, "release", releaseIdentity.storeError)
+          );
+        } catch {
+        }
+        return { scope, tests: "skipped", outcome: "skipped", detail };
+      }
+      try {
+        clearShipAttention(new State(cfg.ship.stateDir), seatKeyUnreadableKey(releaseRouteSlug, "release"));
+      } catch {
+      }
       if (releaseIdentity.kind === "ship") remit.warn(`release writes as the ship, not its own agent: ${releaseIdentity.reason}`, { step: "release" });
       const tracker = new Tracker(c, cfg.ship, { apiKey: releaseIdentity.apiKey });
       if (!dryRun) {
@@ -21110,7 +21301,7 @@ ${cu.tail.trimEnd()}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join43(CREW_HOME, "src"), join43(CREW_HOME, "dist"), join43(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join44(CREW_HOME, "src"), join44(CREW_HOME, "dist"), join44(CREW_HOME, "bin")];
       const configPaths = daemonConfigPaths(cfg);
       watchPaths.push(...configPaths);
       noteDaemonStarted(cfg.ship.stateDir);
@@ -21362,10 +21553,10 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync39(resolvedPath) ? JSON.parse(readFileSync34(resolvedPath, "utf8")) : {};
+        const raw = existsSync40(resolvedPath) ? JSON.parse(readFileSync35(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync25(dirOf2(resolvedPath), { recursive: true });
-        writeFileSync26(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        mkdirSync26(dirOf2(resolvedPath), { recursive: true });
+        writeFileSync27(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -21388,7 +21579,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync26(cfg.configFile, setShipNameInYaml(readFileSync34(cfg.configFile, "utf8"), newName));
+      writeFileSync27(cfg.configFile, setShipNameInYaml(readFileSync35(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -21435,7 +21626,7 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync34(cfg.configFile, "utf8");
+      const configText = readFileSync35(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
@@ -21466,8 +21657,8 @@ ${cu.tail.trimEnd()}
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
           const dir = repoDirOf(configText, dirname22(cfg.configFile), a.route, a.name);
-          if (!existsSync39(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync39(resolvePath(dir, r)), list: (r) => {
+          if (!existsSync40(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync40(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync18(resolvePath(dir, r));
             } catch {
@@ -21475,7 +21666,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync34(resolvePath(dir, r), "utf8");
+              return readFileSync35(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -21517,19 +21708,19 @@ ${cu.tail.trimEnd()}
           let cleared;
           if (clear2) {
             const plan = clearRouteHooks(configText, a.route, a.name);
-            if (plan.removed.length > 0) writeFileSync26(cfg.configFile, plan.text);
+            if (plan.removed.length > 0) writeFileSync27(cfg.configFile, plan.text);
             cleared = { file: cfg.configFile, removed: plan.removed };
           }
           if (write && suggestion.source === null && recipeIds.length === 0 && hookSpecs.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, picked.hooks, { replace: flag("replace") });
-            writeFileSync26(cfg.configFile, plan.text);
+            writeFileSync27(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept, replaced: plan.replaced };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync26(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            writeFileSync27(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [], replaced: [] };
           }
           if (flag("json")) {
@@ -21585,7 +21776,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync39(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync40(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -21614,16 +21805,16 @@ ${cu.tail.trimEnd()}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync39(resolvedFile)) {
+      if (existsSync40(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync34(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync35(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
       const base = dirname22(cfg.configFile);
-      const isCheckout = (d) => existsSync39(`${d}/.git`);
+      const isCheckout = (d) => existsSync40(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -21633,11 +21824,11 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync39(d),
+              exists: (d) => existsSync40(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
-                  return Object.keys(parseRepoConfig(readFileSync34(resolvePath(d, f), "utf8"), f).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync35(resolvePath(d, f), "utf8"), f).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -21654,7 +21845,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync39(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync40(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -21666,9 +21857,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync39(plan2.target) && (existsSync39(`${plan2.target}/.git`) || readdirSync18(plan2.target).length > 0)) {
+          if (existsSync40(plan2.target) && (existsSync40(`${plan2.target}/.git`) || readdirSync18(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync39(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync40(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -21686,14 +21877,14 @@ ${cu.tail.trimEnd()}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync26(cfg.configFile, plan2.text);
+          writeFileSync27(cfg.configFile, plan2.text);
           if (plan2.droppedDir) process.stderr.write(`crew repos: dropped dir: ${plan2.droppedDir} from route ${routeName} \u2014 it is not a checkout (the clone base); checkouts now live under repos:
 `);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir10()));
-        const top = existsSync39(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync40(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -21745,15 +21936,15 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync39(resolvedFile)) {
-            const raw = JSON.parse(readFileSync34(resolvedFile, "utf8"));
+          if (existsSync40(resolvedFile)) {
+            const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync26(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync26(cfg.configFile, plan.text);
+        writeFileSync27(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -21852,7 +22043,7 @@ ${reconstruction.prompt}
       if (flag("sign-out")) {
         let signOutStore;
         try {
-          signOutStore = getSessionStore3();
+          signOutStore = getSessionStore();
         } catch {
           signOutStore = void 0;
         }
@@ -21892,7 +22083,7 @@ ${reconstruction.prompt}
       const givenKeySource = value("key") ?? process.env.CREW_CONNECT_KEY ? "flag" : "config";
       let store;
       try {
-        store = getSessionStore3();
+        store = getSessionStore();
       } catch {
         store = void 0;
       }
@@ -22120,7 +22311,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync26(cfg.configFile, setShipNameInYaml(readFileSync34(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync27(cfg.configFile, setShipNameInYaml(readFileSync35(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -22139,8 +22330,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         }
         const capabilityMisses = capabilities.filter((i) => i.status === "missing").map(missLine);
         if (found.locksModelId && !dryRun) {
-          const configured = cfg.routes.find((r) => r.route === route3);
-          const repoNames = [...Object.values(found.repoNames ?? {}), ...configured ? reposOf(configured).map((t) => t.name) : []].filter((n) => !!n);
+          const configured2 = cfg.routes.find((r) => r.route === route3);
+          const repoNames = [...Object.values(found.repoNames ?? {}), ...configured2 ? reposOf(configured2).map((t) => t.name) : []].filter((n) => !!n);
           try {
             const made = await provisionReleaseLocks(authOpts, found.locksModelId, route3, repoNames);
             for (const sc of made) process.stderr.write(`created release lock row ${sc}
@@ -22163,10 +22354,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync39(resolvedPath);
+        const hadPreviousFile = existsSync40(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync34(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync35(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -22295,12 +22486,12 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync25(dirname22(resolvedPath), { recursive: true });
+          mkdirSync26(dirname22(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync26(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync27(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
-          renameSync3(tmpPath, resolvedPath);
+          renameSync4(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
 `);
         }
@@ -22344,8 +22535,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync25(dirname22(apiKeyFile), { recursive: true });
-            writeFileSync26(apiKeyFile, `${apiKeyVar}=${apiKey}
+            mkdirSync26(dirname22(apiKeyFile), { recursive: true });
+            writeFileSync27(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -23079,7 +23270,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync39(p),
+            worktreeExists: (p) => existsSync40(p),
             caps: periscopeCaps(cfg.ship),
             runHook: async (name, cwd, env) => {
               const script = hit?.repo.config.hooks[name];
@@ -23173,10 +23364,10 @@ ${where.join("\n")}`);
           },
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
-              const src = join43(repoP.dir, f);
-              if (!existsSync39(src)) continue;
-              mkdirSync25(dirOf2(join43(path, f)), { recursive: true });
-              copyFileSync2(src, join43(path, f));
+              const src = join44(repoP.dir, f);
+              if (!existsSync40(src)) continue;
+              mkdirSync26(dirOf2(join44(path, f)), { recursive: true });
+              copyFileSync2(src, join44(path, f));
             }
             const setup = repoP.config.hooks.setup;
             return setup ? runScript(setup, { cwd: path, shell: shellP, onLine: (l) => {
@@ -23402,7 +23593,7 @@ ${where.join("\n")}`);
       const host = hostPlatform();
       let resetStore;
       try {
-        resetStore = getSessionStore3();
+        resetStore = getSessionStore();
       } catch {
         resetStore = void 0;
       }
@@ -23451,7 +23642,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync34(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync35(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -23493,8 +23684,8 @@ ${where.join("\n")}`);
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync25(cfg.ship.stateDir, { recursive: true });
-      writeFileSync26(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      mkdirSync26(cfg.ship.stateDir, { recursive: true });
+      writeFileSync27(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
@@ -23545,7 +23736,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text = readFileSync34(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync35(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -23568,10 +23759,10 @@ ${where.join("\n")}`);
       };
       if (!route2.resolved) fail(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
-      const configText = readFileSync34(cfg.configFile, "utf8");
+      const configText = readFileSync35(cfg.configFile, "utf8");
       const cfgBase = dirname22(cfg.configFile);
-      const configured = configuredRepos(configText, route2.route, cfgBase);
-      const dir = configured.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
+      const configured2 = configuredRepos(configText, route2.route, cfgBase);
+      const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route2.route);
       const rows = await tracker.repoRows();
       const row = rows.find((r) => r.name === SAMPLE_REPO);
@@ -23595,9 +23786,9 @@ ${where.join("\n")}`);
           say("dry-run", { dir, row: row?.id ?? null, closed }, `would close ${closed.join(", ") || "no tickets"}, delete the Repos row, detach and delete ${dir}`);
           break;
         }
-        if (configured.some((r) => r.dir === dir)) {
+        if (configured2.some((r) => r.dir === dir)) {
           try {
-            writeFileSync26(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
+            writeFileSync27(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -23605,29 +23796,29 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync39(resolvedFile)) {
-            const raw = JSON.parse(readFileSync34(resolvedFile, "utf8"));
+          if (existsSync40(resolvedFile)) {
+            const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync26(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync39(join43(dir, ".git")) && basename13(dir) === SAMPLE_REPO) rmSync18(dir, { recursive: true, force: true });
+        if (existsSync40(join44(dir, ".git")) && basename13(dir) === SAMPLE_REPO) rmSync19(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync39(join43(dir, ".git"));
-      if (existsSync39(dir) && fresh && readdirSync18(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync40(join44(dir, ".git"));
+      if (existsSync40(dir) && fresh && readdirSync18(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
-        mkdirSync25(dir, { recursive: true });
-        writeFileSync26(join43(dir, "README.md"), SAMPLE_README);
-        writeFileSync26(join43(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        mkdirSync26(dir, { recursive: true });
+        writeFileSync27(join44(dir, "README.md"), SAMPLE_README);
+        writeFileSync27(join44(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
           const r = spawnSync7("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
@@ -23645,17 +23836,17 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync39(resolvedFile)) {
-          const raw = JSON.parse(readFileSync34(resolvedFile, "utf8"));
+        if (existsSync40(resolvedFile)) {
+          const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync26(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
-      if (!configured.some((r) => r.dir === dir)) {
+      if (!configured2.some((r) => r.dir === dir)) {
         try {
-          writeFileSync26(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync27(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -23990,7 +24181,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync39(r.dir)) {
+            if (existsSync40(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -24063,6 +24254,8 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       for (const w of roleCapWarnings(cfg.ship)) process.stdout.write(`role concurrency: WARN ${w}
 `);
       process.stdout.write(`periscopes:        ${periscopeSummary(cfg)}
+`);
+      process.stdout.write(`key store:         ${describeKeyStore(cfg.ship)}
 `);
       const previewProblem = await previewHostProblem(cfg);
       if (previewProblem) {
@@ -24073,7 +24266,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync39(evFile) ? statSync13(evFile).size : 0;
+        const evSize = existsSync40(evFile) ? statSync14(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -24084,7 +24277,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync34(p, "utf8");
+            return readFileSync35(p, "utf8");
           } catch {
             return null;
           }
@@ -24100,7 +24293,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
         const changed2 = configChangedAfter(daemonConfigPaths(cfg), daemonStartedAt);
         if (changed2) {
           process.stdout.write(
-            `daemon config:     WARN ${changed2} changed at ${new Date(statSync13(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
+            `daemon config:     WARN ${changed2} changed at ${new Date(statSync14(changed2).mtimeMs).toISOString()} but the daemon started at ${new Date(daemonStartedAt).toISOString()} \u2014 run \`crew reload\`
 `
           );
         }