@tablation/crew 0.93.0 → 0.95.0

package/crew.example.yaml

@@ -56,6 +56,7 @@ ship:
   #       deep: { model: claude-opus-5-5 }
   #     args: []                   # appended to the harness argv
   #     env: {}                    # added to the session environment
+  #     maxRunMinutes: 240         # wall-clock limit per agent run (default 240; 0 = none); a route's maxRunMinutes overrides it (CREW-2786)
   #   gemini: { harness: gemini, bin: gemini, model: gemini-2.5-pro }
 
   # shell: bash                      # defaults per platform

package/dist/cli.js

@@ -363,11 +363,11 @@ var Emitter = class _Emitter {
       const result = await fn();
       this.emit(message, { data: { ms: this.now().getTime() - started, ok: true } });
       return result;
-    } catch (err2) {
-      this.error(`${message} \u2014 ${err2.message}`, {
+    } catch (err3) {
+      this.error(`${message} \u2014 ${err3.message}`, {
         data: { ms: this.now().getTime() - started, ok: false }
       });
-      throw err2;
+      throw err3;
     }
   }
 };
@@ -2665,7 +2665,8 @@ var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "promptSet",
   "hostPassengers",
   "hostPeriscopes",
-  "toolchain"
+  "toolchain",
+  "maxRunMinutes"
 ]);
 function parseWorktreeName(v, where, file) {
   const problem = typeof v === "string" ? worktreeNameProblem(v) : "must be a string";
@@ -3075,7 +3076,21 @@ Create the first of those:
 function expandCommand(cmd, base) {
   return cmd.includes("/") || cmd.startsWith("~") ? expand(cmd, base) : cmd;
 }
-var TOOLCHAIN_KEYS = /* @__PURE__ */ new Set(["harness", "bin", "launcher", "launcherBin", "model", "tiers", "args", "env", "maxThinkingTokens", "auth"]);
+var TOOLCHAIN_KEYS = /* @__PURE__ */ new Set(["harness", "bin", "launcher", "launcherBin", "model", "tiers", "args", "env", "maxThinkingTokens", "auth", "maxRunMinutes"]);
+var MAX_RUN_MINUTES_CEILING = Math.floor((2 ** 31 - 1) / 6e4);
+function parseMaxRunMinutes(raw, where, missing) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) {
+    missing.add(`${where} must be a non-negative integer number of minutes, 0 for no limit (got "${String(raw)}")`);
+    return void 0;
+  }
+  if (n > MAX_RUN_MINUTES_CEILING) {
+    missing.add(`${where} is too large (${n}); the most it can be is ${MAX_RUN_MINUTES_CEILING} minutes \u2014 use 0 for no limit`);
+    return void 0;
+  }
+  return n;
+}
 function parsePair(raw, missing) {
   if (raw === void 0) return void 0;
   if (!Array.isArray(raw)) {
@@ -3132,6 +3147,7 @@ function parseToolchains(raw, base, missing, file) {
     if (!Number.isInteger(maxThinkingTokens) || maxThinkingTokens < 0) {
       missing.add(`${where}.maxThinkingTokens must be a non-negative integer (got "${entryRaw.maxThinkingTokens}")`);
     }
+    const maxRunMinutes = parseMaxRunMinutes(entryRaw.maxRunMinutes, `${where}.maxRunMinutes`, missing);
     let auth;
     if (entryRaw.auth !== void 0) {
       if (entryRaw.auth !== "subscription" && entryRaw.auth !== "inherit") {
@@ -3153,7 +3169,8 @@ function parseToolchains(raw, base, missing, file) {
       tiers,
       args: Array.isArray(args) ? args.map(String) : [],
       env: Object.fromEntries(Object.entries(env).map(([k, v]) => [k, String(v)])),
-      maxThinkingTokens
+      maxThinkingTokens,
+      ...maxRunMinutes !== void 0 ? { maxRunMinutes } : {}
     });
   }
   return out;
@@ -3161,6 +3178,7 @@ function parseToolchains(raw, base, missing, file) {
 function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, toolchainNames) {
   rejectUnknownKeys(c, ROUTE_KEYS, `${where}`, file);
   const toolchain = c?.toolchain === void 0 ? void 0 : String(c.toolchain);
+  const maxRunMinutes = parseMaxRunMinutes(c?.maxRunMinutes, `${where}.maxRunMinutes`, missing);
   if (toolchain !== void 0 && !toolchainNames.has(toolchain)) {
     missing.add(`${where}.toolchain "${toolchain}" is not defined in ship.toolchains (have: ${[...toolchainNames].join(", ")})`);
   }
@@ -3224,6 +3242,7 @@ function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, t
     repoOverrides,
     worktreePrefix: c?.worktreePrefix ? String(c.worktreePrefix) : void 0,
     ...toolchain !== void 0 ? { toolchain } : {},
+    ...maxRunMinutes !== void 0 ? { maxRunMinutes } : {},
     promptsDir: resolvePromptsDir(c?.promptSet ? String(c.promptSet) : void 0, crewHome, base),
     weight,
     baseUrl: String(c?.baseUrl ?? raw.ship?.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, ""),
@@ -3549,10 +3568,10 @@ function runScript(script, opts) {
     child.stdout.on("data", absorb);
     child.stderr.on("data", absorb);
     const timer = opts.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs) : void 0;
-    child.on("error", (err2) => {
+    child.on("error", (err3) => {
       if (timer) clearTimeout(timer);
       resolvePromise({ code: 127, output: `${output}
-crew: cannot run ${shell.bin}: ${err2.message}` });
+crew: cannot run ${shell.bin}: ${err3.message}` });
     });
     child.on("close", (code) => {
       if (timer) clearTimeout(timer);
@@ -4248,18 +4267,18 @@ function gitRaw(cwd, args) {
   try {
     return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
-    const err2 = e;
-    const why = [err2.stderr, err2.stdout].map(streamText).filter(Boolean).join(" / ");
-    throw new GitError(`git ${args.join(" ")}: ${why || err2.message.trim()}`);
+    const err3 = e;
+    const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
+    throw new GitError(`git ${args.join(" ")}: ${why || err3.message.trim()}`);
   }
 }
 function git(cwd, args) {
   try {
     return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (e) {
-    const err2 = e;
-    const why = [err2.stderr, err2.stdout].map(streamText).filter(Boolean).join(" / ");
-    throw new GitError(`git ${args.join(" ")}: ${why || err2.message.trim()}`);
+    const err3 = e;
+    const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
+    throw new GitError(`git ${args.join(" ")}: ${why || err3.message.trim()}`);
   }
 }
 function gitOk(cwd, args) {
@@ -4701,9 +4720,9 @@ function ensureRepoCheckout(dir, remote, opts = {}) {
   try {
     execFileSync2("git", ["clone", url, dir], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
-    const err2 = e;
-    const why = [err2.stderr, err2.stdout].map(streamText).filter(Boolean).join(" / ");
-    throw new GitError(`git clone ${url} ${dir}: ${why || err2.message.trim()}`);
+    const err3 = e;
+    const why = [err3.stderr, err3.stdout].map(streamText).filter(Boolean).join(" / ");
+    throw new GitError(`git clone ${url} ${dir}: ${why || err3.message.trim()}`);
   }
   cloneRecorder?.(dir);
   return true;
@@ -4736,8 +4755,8 @@ function acquireCheckoutLock(dir, timeoutMs = 3e4) {
         }
       };
     } catch (e) {
-      const err2 = e;
-      if (err2.code !== "EEXIST") throw err2;
+      const err3 = e;
+      if (err3.code !== "EEXIST") throw err3;
       try {
         if (Date.now() - statSync5(lockPath).mtimeMs > CHECKOUT_LOCK_STALE_MS) {
           try {
@@ -5129,8 +5148,8 @@ function probePushAuth(o, run2 = realGit, baseEnv = process.env) {
     run2(o.dir, ["push", "--dry-run", o.remote, `HEAD:refs/heads/${PROBE_BRANCH}`], env);
     return { state: "ok" };
   } catch (e) {
-    const err2 = e;
-    const raw = (err2.stderr ? String(err2.stderr) : err2.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
+    const err3 = e;
+    const raw = (err3.stderr ? String(err3.stderr) : err3.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
     const detail = raw || "push dry-run failed";
     const f = o.forge;
     if (!f) return { state: "failed", detail, hint: pushAuthHint(o.remoteUrl) };
@@ -7359,8 +7378,8 @@ var Tracker = class {
       if (res.status === 404) return [];
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       rows = await res.json();
-    } catch (err2) {
-      this.onReadFailure?.(`reading ${type} events failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    } catch (err3) {
+      this.onReadFailure?.(`reading ${type} events failed: ${err3 instanceof Error ? err3.message : String(err3)}`);
       return [];
     }
     return rows.filter((e) => e.event_type === type).sort((a, b) => Date.parse(b.occurred_at ?? b.created_at ?? "") - Date.parse(a.occurred_at ?? a.created_at ?? ""));
@@ -7563,6 +7582,28 @@ var Tracker = class {
     if (!auth.commentShip) missing.push(`Comments.${this.contract.comments.ship}`);
     return missing;
   }
+  /**
+   * The runtime-map columns (ISSUE-2791) this workspace's template has not
+   * taken yet, as `table.column` names for `crew doctor`. Each is read as its
+   * default when absent, so this is informational: `Repos.forge_host`
+   * (default `github.com`), `Ships.kind` (`developer_machine`),
+   * `Ships.instance_class` and `Ships.relay_url` (blank). A table the route
+   * does not have is skipped, not reported.
+   */
+  async missingRuntimeColumns() {
+    const wanted = [
+      [this.route.resolved?.reposModelId, "Repos", ["forge_host"]],
+      [this.route.resolved?.shipsModelId, "Ships", ["kind", "instance_class", "relay_url"]]
+    ];
+    const missing = [];
+    for (const [modelId, label, columns] of wanted) {
+      if (!modelId) continue;
+      const have = await this.columnNames(modelId);
+      if (have.size === 0) continue;
+      for (const c of columns) if (!have.has(c)) missing.push(`${label}.${c}`);
+    }
+    return missing;
+  }
   /**
    * The public `/v/<slug>/r/<token>` link for one ticket (ISSUE-928) —
    * fetch-or-create via `POST /views/:viewId/record-links`, so a repeated
@@ -9190,6 +9231,55 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
   return out;
 }
 
+// src/run-limit.ts
+var DEFAULT_MAX_RUN_MINUTES = 240;
+var KILL_GRACE_MS = 5e3;
+var WALL_CLOCK_REASON = "wall-clock";
+function resolveMaxRunMinutes(route2, toolchain) {
+  return route2 ?? toolchain ?? DEFAULT_MAX_RUN_MINUTES;
+}
+function deadlineFor(spawnedAt, maxRunMinutes) {
+  if (!maxRunMinutes || maxRunMinutes <= 0) return void 0;
+  const t = Date.parse(spawnedAt);
+  return Number.isNaN(t) ? void 0 : new Date(t + maxRunMinutes * 6e4).toISOString();
+}
+function msUntilDeadline(deadline, now = Date.now()) {
+  if (!deadline) return void 0;
+  const t = Date.parse(deadline);
+  return Number.isNaN(t) ? void 0 : t - now;
+}
+async function killRunGroup(pid, o = {}) {
+  const alive = o.isAlive ?? ((p) => {
+    try {
+      process.kill(p, 0);
+      return true;
+    } catch (e) {
+      return e.code === "EPERM";
+    }
+  });
+  const signal = (sig) => {
+    try {
+      process.kill(-pid, sig);
+    } catch {
+      try {
+        process.kill(pid, sig);
+      } catch {
+      }
+    }
+  };
+  signal("SIGTERM");
+  const end = Date.now() + (o.graceMs ?? KILL_GRACE_MS);
+  while (alive(pid) && Date.now() < end) await new Promise((r) => setTimeout(r, 50));
+  if (alive(pid)) signal("SIGKILL");
+}
+var RUN_KILLED_MARKER = "<!-- crew:run-killed -->";
+function runKilledComment(b) {
+  const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
+  return `${RUN_KILLED_MARKER}
+
+The agent run on this ticket was stopped at its wall-clock limit of ${b.limitMinutes} minutes before it handed on${b.branch ? `; its branch is \`${b.branch}\`` : ""}. ${tree} The worktree is left as it was. The next run on this seat resumes from it rather than starting over.`;
+}
+
 // src/agent.ts
 var DIGEST_MAX_AGE_SECONDS = 600;
 var LEGACY_TOOLCHAIN_HARNESS = "claude";
@@ -9299,6 +9389,7 @@ function planAgentRun(o) {
     toolchain: toolchain.name,
     harness: toolchain.harness,
     provider: toolchainProvider(toolchain),
+    maxRunMinutes: resolveMaxRunMinutes(o.route.maxRunMinutes, toolchain.maxRunMinutes),
     resolution: { toolchain: seat.toolchainWhy, model: seat.modelWhy },
     warnings: [...seat.warnings ?? [], ...expanded.warnings],
     prompt,
@@ -9388,6 +9479,17 @@ function identityOf(plan, adapterHarness) {
     promptSha: plan.promptSha
   };
 }
+async function killForDeadline(pid, emit, role, ticket, spawnedAt, limitMinutes) {
+  const elapsedMs = Date.now() - Date.parse(spawnedAt);
+  const limit = limitMinutes ?? Math.round(elapsedMs / 6e4);
+  emit.emit(`run_killed: ${role} run exceeded its wall-clock limit of ${limit} min (ran ${Math.round(elapsedMs / 6e4)} min)`, {
+    role,
+    ...ticket ? { ticket } : {},
+    data: { event: "run_killed", reason: WALL_CLOCK_REASON, limitMinutes: limit, elapsedMs, pid }
+  });
+  await killRunGroup(pid);
+  return { limitMinutes: limit, elapsedMs };
+}
 var withoutKey = ({ apiKey: _apiKey, ...rest }) => rest;
 function openSink(path) {
   try {
@@ -9747,13 +9849,16 @@ function spawnAgent(plan, emit, hintMoved) {
       detached: true
     });
     closeSync3(streamFd);
+    const spawnedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const deadline = deadlineFor(spawnedAt, plan.maxRunMinutes);
     if (child.pid !== void 0) {
       const sidecar = {
         pid: child.pid,
         ownerPid: process.pid,
-        spawnedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        spawnedAt,
         role: plan.role,
         route: plan.route,
+        ...deadline ? { deadline, maxRunMinutes: plan.maxRunMinutes } : {},
         ticket: plan.ticket ?? null,
         ticketRecordId: plan.ticketRecordId ?? null,
         repo: plan.repo ?? null,
@@ -9773,28 +9878,48 @@ function spawnAgent(plan, emit, hintMoved) {
       }
     }
     const obs = new RunObserver(id, adapter, eventsSink, emit.cycle);
-    const meta = { pid: child.pid ?? null };
+    const meta = { pid: child.pid ?? null, ...deadline ? { deadline } : {} };
     obs.onClaim = () => writeRunMeta(id, startedAt, obs.liveTicket, meta);
     if (child.pid !== void 0) writeRunMeta(id, startedAt, obs.liveTicket, meta);
     const tail3 = new FileTail(plan.streamPath);
     const timer = setInterval(() => obs.feed(tail3.poll()), TAIL_POLL_MS);
+    let killed;
+    const limitTimer = child.pid !== void 0 && deadline ? setTimeout(() => {
+      const pid = child.pid;
+      void killForDeadline(pid, emit, plan.role, obs.liveTicket ?? plan.ticket ?? null, spawnedAt, plan.maxRunMinutes).then((k) => {
+        killed = k;
+      });
+    }, Math.max(0, msUntilDeadline(deadline) ?? 0)) : void 0;
     let spawnFailed = false;
-    child.on("error", (err2) => {
+    child.on("error", (err3) => {
       spawnFailed = true;
       clearInterval(timer);
-      reject(new AgentSpawnError(`cannot run ${plan.bin}: ${err2.message}`));
+      clearTimeout(limitTimer);
+      reject(new AgentSpawnError(`cannot run ${plan.bin}: ${err3.message}`));
     });
     child.on("close", async (code) => {
       clearInterval(timer);
+      clearTimeout(limitTimer);
       obs.feed(tail3.poll());
       obs.end();
       await endSink(eventsSink);
       if (spawnFailed) return;
-      const { ms: ms3, handoffPending } = await finishRun(id, obs, emit, startedAt, { code: code ?? 1 }, plan.agentLog?.apiKey, hintMoved);
-      resolve6({ code: code ?? 1, ms: ms3, ...handoffPending ? { handoffPending } : {} });
+      if (limitTimer && !killed && !obs.sawResult && msUntilDeadline(deadline) <= 0) {
+        killed = { limitMinutes: plan.maxRunMinutes ?? 0, elapsedMs: Date.now() - Date.parse(spawnedAt) };
+      }
+      const { ms: ms3, handoffPending } = await finishRun(
+        id,
+        obs,
+        emit,
+        startedAt,
+        { code: code ?? 1, ...killed ? { interrupted: WALL_CLOCK_REASON } : {} },
+        plan.agentLog?.apiKey,
+        hintMoved
+      );
+      resolve6({ code: code ?? 1, ms: ms3, ...handoffPending ? { handoffPending } : {}, ...killed ? { killed } : {} });
     });
-    child.stdin?.on("error", (err2) => {
-      emit.warn(`agent closed stdin before the prompt was delivered: ${err2.message}`, { step: "agent" });
+    child.stdin?.on("error", (err3) => {
+      emit.warn(`agent closed stdin before the prompt was delivered: ${err3.message}`, { step: "agent" });
     });
     child.stdin?.end(plan.prompt);
   });
@@ -9810,18 +9935,23 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
   obs.feed(tail3.poll());
   obs.muted = false;
   const adopted = isAlive(sc);
+  let killed;
   if (adopted) {
     o.onAdopted?.();
     const pollMs = o.pollMs ?? TAIL_POLL_MS;
     while (isAlive(sc)) {
       obs.feed(tail3.poll());
+      if (!killed && (msUntilDeadline(sc.deadline) ?? 1) <= 0) {
+        killed = await killForDeadline(sc.pid, emit, sc.role, obs.liveTicket ?? sc.ticket, sc.spawnedAt, sc.maxRunMinutes);
+        continue;
+      }
       await new Promise((r) => setTimeout(r, pollMs));
     }
   }
   obs.feed(tail3.poll());
   obs.end();
   await endSink(eventsSink);
-  const interrupted = obs.sawResult ? void 0 : adopted ? "no-result" : "daemon-exit";
+  const interrupted = killed ? WALL_CLOCK_REASON : obs.sawResult ? void 0 : adopted ? "no-result" : "daemon-exit";
   const { ms: ms3, ticket } = await finishRun(
     id,
     obs,
@@ -9830,7 +9960,7 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
     { code: null, ...interrupted ? { interrupted } : {} },
     o.agentLogKey
   );
-  return { adopted, ...interrupted ? { interrupted } : {}, ms: ms3, ticket };
+  return { adopted, ...interrupted ? { interrupted } : {}, ...killed ? { killed } : {}, ms: ms3, ticket };
 }
 
 // src/seat-keys.ts
@@ -9881,8 +10011,8 @@ async function resolveSeatKey(route2, role, getStore = getSessionStore) {
   }
 }
 function safeStderrLine(e) {
-  const err2 = e;
-  const raw = typeof err2?.stderr === "string" && err2.stderr.trim() ? err2.stderr : typeof err2?.message === "string" ? err2.message : "";
+  const err3 = e;
+  const raw = typeof err3?.stderr === "string" && err3.stderr.trim() ? err3.stderr : typeof err3?.message === "string" ? err3.message : "";
   for (const line of raw.split("\n")) {
     const t = line.trim();
     if (!t || /^Command failed:/i.test(t) || /(^|\s)-w(\s|$)/.test(t)) continue;
@@ -10378,6 +10508,7 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "service",
   "topic",
   "assignee",
+  "requested-by",
   "issue",
   "shell",
   "resume"
@@ -10806,12 +10937,12 @@ async function checkCrewFloor(o, deps = {}) {
 function openOutdated(state) {
   return state.shipAttention().previous().find((i) => i.key === CREW_OUTDATED_KEY)?.message ?? null;
 }
-function isUpgradeRequired(err2) {
-  return err2 instanceof TablationApiError3 && err2.status === 426;
+function isUpgradeRequired(err3) {
+  return err3 instanceof TablationApiError3 && err3.status === 426;
 }
-async function raiseFromUpgradeRequired(o, err2) {
+async function raiseFromUpgradeRequired(o, err3) {
   const have = sentVersion(o.ship) ?? "unknown";
-  const floor = /(\d+\.\d+\.\d+)/.exec(err2.message.replace(have, ""))?.[1] ?? "a newer version";
+  const floor = /(\d+\.\d+\.\d+)/.exec(err3.message.replace(have, ""))?.[1] ?? "a newer version";
   await raiseShipAttention(o, outdatedItem(have, floor));
 }
 
@@ -11626,8 +11757,8 @@ async function decideCycle(o) {
   const optional = async (what, read, fallback) => {
     try {
       return await read;
-    } catch (err2) {
-      emit.warn(`reading ${what} failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    } catch (err3) {
+      emit.warn(`reading ${what} failed: ${err3 instanceof Error ? err3.message : String(err3)}`);
       return fallback;
     }
   };
@@ -14330,7 +14461,8 @@ function describeRun(run2, route2, seatIds, worktreeOf = (d, n) => {
     worktree: repoDir && num ? worktreeOf(repoDir, num) : null,
     stream: run2.streamPath,
     pid: run2.pid,
-    startedAt: run2.spawnedAt
+    startedAt: run2.spawnedAt,
+    deadline: run2.deadline ?? null
   };
 }
 
@@ -15504,7 +15636,10 @@ async function discover(o) {
         ...hostPeriscopes !== void 0 ? { host_periscopes: hostPeriscopes } : {},
         ...sshPublicKey !== void 0 ? { ssh_public_key: sshPublicKey } : {},
         ...ownerId !== void 0 ? { owner_id: ownerId } : {},
-        ...writeMachineId ? { machine_id: machineId } : {}
+        ...writeMachineId ? { machine_id: machineId } : {},
+        // ISSUE-2791: a ship connecting by hand is a developer machine; the
+        // column arrives with a template update, so only written when present.
+        ...shipColumns.has("kind") ? { kind: "developer_machine" } : {}
       });
       shipRowId = created.id;
       out.shipRow = { id: shipRowId, name: o.ship.name, action: "created", matchedBy };
@@ -16633,7 +16768,7 @@ async function runAgentSuggest(o) {
   const signal = o.signal ? AbortSignal.any([o.signal, timeout]) : timeout;
   const run2 = await new Promise((resolve6) => {
     let out = "";
-    let err2 = "";
+    let err3 = "";
     const child = spawn4(bin, args, { cwd: o.dir, env, detached: true, stdio: ["pipe", "pipe", "pipe"] });
     let settled = false;
     const settle = (r) => {
@@ -16650,7 +16785,7 @@ async function runAgentSuggest(o) {
       }
       child.stdout.destroy();
       child.stderr.destroy();
-      settle({ code: null, out, err: err2, aborted: true });
+      settle({ code: null, out, err: err3, aborted: true });
     };
     if (signal.aborted) onAbort();
     else signal.addEventListener("abort", onAbort, { once: true });
@@ -16658,10 +16793,10 @@ async function runAgentSuggest(o) {
       out += d.toString();
     });
     child.stderr.on("data", (d) => {
-      err2 += d.toString();
+      err3 += d.toString();
     });
-    child.on("error", (e) => settle({ code: null, out, err: err2, spawnError: e, aborted: false }));
-    child.on("close", (code) => settle({ code, out, err: err2, aborted: false }));
+    child.on("error", (e) => settle({ code: null, out, err: err3, spawnError: e, aborted: false }));
+    child.on("close", (code) => settle({ code, out, err: err3, aborted: false }));
     child.stdin.on("error", () => {
     });
     child.stdin.end(buildAgentPrompt(o.sniff));
@@ -17163,7 +17298,7 @@ function readPeriscopePrior(stateDir, ticketRecordId) {
 var DEFAULT_MAX_PERISCOPES2 = 3;
 var DEFAULT_PERISCOPE_IDLE_MINUTES2 = 120;
 function parsePeriscopeUpArgs(positional2, flags) {
-  const usage2 = "usage: crew periscope up [[route] REPO] [--topic TEXT | --issue NNN] [--isolate] [--host HOST] [--assignee CREW_ROW_ID] [--no-open] [--json]";
+  const usage2 = "usage: crew periscope up [[route] REPO] [--topic TEXT | --issue NNN] [--isolate] [--host HOST] [--assignee CREW_ROW_ID] [--requested-by ID] [--no-open] [--json]";
   const rest = positional2.slice(2);
   if (rest.length > 2) throw new PeriscopeError(usage2);
   const topic = flags.topic?.trim();
@@ -17184,6 +17319,7 @@ ${usage2}`);
     isolate: flags.isolate,
     ...flags.host ? { host: flags.host } : {},
     ...flags.assignee ? { assignee: flags.assignee } : {},
+    ...flags.requestedBy?.trim() ? { requestedBy: flags.requestedBy.trim() } : {},
     json: flags.json
   };
 }
@@ -17670,8 +17806,8 @@ function ensureShipSshKeypair(stateDir) {
         "-q"
       ], { stdio: ["ignore", "ignore", "pipe"] });
     } catch (e) {
-      const err2 = e;
-      throw new SshKeyError(`ssh-keygen failed: ${err2.stderr?.toString().trim() || err2.message}`);
+      const err3 = e;
+      throw new SshKeyError(`ssh-keygen failed: ${err3.stderr?.toString().trim() || err3.message}`);
     }
     chmodSync3(privateKeyPath, 384);
   }
@@ -17697,9 +17833,9 @@ var realExec = (cmd, args, opts) => {
   try {
     return execFileSync9(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs });
   } catch (e) {
-    const err2 = e;
-    const why = [err2.stderr, err2.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
-    throw new Error(`${cmd} ${args.join(" ")}: ${why || err2.message.trim()}`);
+    const err3 = e;
+    const why = [err3.stderr, err3.stdout].map((x) => (x ?? "").trim()).filter(Boolean).join(" / ");
+    throw new Error(`${cmd} ${args.join(" ")}: ${why || err3.message.trim()}`);
   }
 };
 var DOCKER_INFO_TIMEOUT_MS = 1e4;
@@ -18272,8 +18408,8 @@ function runSyncDaemonFromEnv(env = process.env) {
   const secret = requireEnv(env, "PASSENGER_SYNC_SECRET");
   const targets = JSON.parse(requireEnv(env, "PASSENGER_SYNC_TARGETS"));
   const server = createSyncDaemonServer(targets, secret);
-  server.on("error", (err2) => {
-    console.error(`Passenger sync daemon failed to bind 0.0.0.0:${port}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+  server.on("error", (err3) => {
+    console.error(`Passenger sync daemon failed to bind 0.0.0.0:${port}: ${err3 instanceof Error ? err3.message : String(err3)}`);
     process.exit(1);
   });
   server.listen(port, "0.0.0.0", () => {
@@ -18390,22 +18526,22 @@ function codeOf(e) {
   const code = e?.code;
   return typeof code === "string" ? code : void 0;
 }
-function isTransientError(err2) {
-  if (!(err2 instanceof Error)) return false;
-  const msg = err2.message;
+function isTransientError(err3) {
+  if (!(err3 instanceof Error)) return false;
+  const msg = err3.message;
   if (msg === "fetch failed" || msg.startsWith("fetch failed")) return true;
-  for (let e = err2, depth = 0; e && depth < 4; e = e.cause, depth++) {
+  for (let e = err3, depth = 0; e && depth < 4; e = e.cause, depth++) {
     const code = codeOf(e);
     if (code && NETWORK_CODES.includes(code)) return true;
   }
   if (NETWORK_CODES.some((c) => msg.includes(c))) return true;
   if (/\b(?:HTTP|status)\s*:?\s*(502|503|504)\b/i.test(msg) || /^(502|503|504)\b/.test(msg)) return true;
-  if (err2 instanceof SyntaxError && /Unexpected token '?<|is not valid JSON|Unexpected end of JSON/.test(msg)) return true;
+  if (err3 instanceof SyntaxError && /Unexpected token '?<|is not valid JSON|Unexpected end of JSON/.test(msg)) return true;
   return false;
 }
-function describeCause(err2) {
-  const first = (err2 instanceof Error ? err2.message : String(err2)).split("\n")[0];
-  const code = codeOf(err2?.cause);
+function describeCause(err3) {
+  const first = (err3 instanceof Error ? err3.message : String(err3)).split("\n")[0];
+  const code = codeOf(err3?.cause);
   return code && !first.includes(code) ? `${first} (${code})` : first;
 }
 
@@ -18434,22 +18570,22 @@ async function runDaemonLoop(o) {
         o.onRecovered?.({ downMs: now() - downSince });
         transientRun = 0;
       }
-    } catch (err2) {
-      if (isTransientError(err2)) {
+    } catch (err3) {
+      if (isTransientError(err3)) {
         passes++;
         if (transientRun === 0) downSince = now();
         transientRun++;
         const wait = transientBackoffMs(transientRun);
         const downMs = now() - downSince;
-        o.onTransient?.({ err: err2, consecutive: transientRun, backoffMs: wait, downMs });
-        if (transientRun === OUTAGE_ESCALATE_AFTER) o.onOutage?.({ err: err2, consecutive: transientRun, downMs });
+        o.onTransient?.({ err: err3, consecutive: transientRun, backoffMs: wait, downMs });
+        if (transientRun === OUTAGE_ESCALATE_AFTER) o.onOutage?.({ err: err3, consecutive: transientRun, downMs });
         if (o.maxPasses !== void 0 && passes >= o.maxPasses) return "maxPasses";
         if (o.signal?.aborted) return "aborted";
         await sleep(wait);
         continue;
       }
       passes++;
-      o.onPassError?.(err2);
+      o.onPassError?.(err3);
       if (o.maxPasses !== void 0 && passes >= o.maxPasses) return "maxPasses";
       if (o.signal?.aborted) return "aborted";
       await sleep(backoff);
@@ -18568,7 +18704,7 @@ async function runOnePassUnguarded(o) {
   await hydrateApiKeys([o.route], o.getSessionStore);
   const emit = o.newEmitter();
   const decide = o.decide ?? decideCycle;
-  const spawn8 = o.spawnRoleAgent ?? runRoleAgent;
+  const spawn9 = o.spawnRoleAgent ?? runRoleAgent;
   const breaker = o.spawnBreaker ?? new SpawnBreaker();
   const ctx = { route: o.route, ship: o.ship, state: o.state, emit, getSessionStore: o.getSessionStore };
   if (o.configFile) await reconcileRouteShipName({ route: o.route, ship: o.ship, configFile: o.configFile, emit });
@@ -18672,7 +18808,7 @@ async function runOnePassUnguarded(o) {
       const settled = new Promise((resolve6) => {
         ready = resolve6;
       });
-      const run2 = spawn8(role, decision, ctx, { ready }).then(() => {
+      const run2 = spawn9(role, decision, ctx, { ready }).then(() => {
         breaker.recordSuccess(role);
         clearShipAttention(o.state, `role_parked:${role}`);
       }).catch(async (e) => {
@@ -18780,7 +18916,7 @@ async function reconcileForRoute(ctx, o) {
             if (wt) dirty = status(wt.path).length > 0;
           } catch {
           }
-          await tracker.postEvent(sc.ticketRecordId, interruptedComment({
+          await tracker.postEvent(sc.ticketRecordId, result.killed ? runKilledComment({ limitMinutes: result.killed.limitMinutes, branch: wt?.branch ?? null, dirty }) : interruptedComment({
             branch: wt?.branch ?? null,
             dirty,
             reason: result.interrupted === "daemon-exit" ? "the crew daemon exited" : "it exited without a result"
@@ -18803,6 +18939,23 @@ async function reconcileForRoute(ctx, o) {
     }
   });
 }
+async function postRunKilled(route2, tracker, ticketId, memberId, limitMinutes, emit) {
+  if (!ticketId || !memberId) return;
+  try {
+    const t = await tracker.ticket(ticketId);
+    const target = repoTargetFor(route2, t.repo_id);
+    const num = String(t[tracker.contract.columns.key] ?? "").replace(/^\D+/, "");
+    const wt = target && num ? worktreeForNumber(target.dir, num) : null;
+    let dirty = null;
+    try {
+      if (wt) dirty = status(wt.path).length > 0;
+    } catch {
+    }
+    await tracker.postEvent(ticketId, runKilledComment({ limitMinutes, branch: wt?.branch ?? null, dirty }), memberId, "interrupted");
+  } catch (e) {
+    emit.warn(`could not post the wall-clock limit comment: ${e.message}`, { step: "agent" });
+  }
+}
 async function runRoleAgent(role, decision, ctx, hooks) {
   const held = {};
   try {
@@ -18965,8 +19118,12 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       } catch {
       }
     }
-    await spawnAgent(plan, emit, hintMoved);
-    await guardRunHandoff(route2, ship, tracker, role, workingId, emit, runStart);
+    const result = await spawnAgent(plan, emit, hintMoved);
+    if (result.killed) {
+      await postRunKilled(route2, tracker, workingId, memberId, result.killed.limitMinutes, emit);
+    } else {
+      await guardRunHandoff(route2, ship, tracker, role, workingId, emit, runStart);
+    }
   } finally {
     await settleRunEnd({
       tracker,
@@ -19020,7 +19177,213 @@ import {
 import { createConnection } from "net";
 import { createServer } from "http";
 import { basename as basename12, dirname as dirname21, join as join43 } from "path";
-import { execFile, spawn as spawn7 } from "child_process";
+import { execFile, spawn as spawn8 } from "child_process";
+
+// src/periscope-control.ts
+import { spawn as spawn7 } from "child_process";
+var reply = (status2, body) => ({ status: status2, body });
+var err = (status2, message) => reply(status2, { error: message });
+var TICKET_RE = /^(?:[A-Za-z]+-)?\d+$/;
+var MAX_FIELD = 200;
+function plainText(v, field, required) {
+  if (v === void 0 || v === null || v === "") return required ? { error: `${field} is required` } : void 0;
+  if (typeof v !== "string") return { error: `${field} must be a string` };
+  const t = v.trim();
+  if (!t) return required ? { error: `${field} is required` } : void 0;
+  if (t.length > MAX_FIELD || /[\r\n\0]/.test(t)) return { error: `${field} must be one line of at most ${MAX_FIELD} characters` };
+  if (t.startsWith("-")) return { error: `${field} must not start with "-"` };
+  return t;
+}
+var isErr = (v) => typeof v === "object" && v !== null && "error" in v;
+function pickRoute(h, named) {
+  const hosting = h.routes.filter((r) => r.hostPeriscopes);
+  if (named !== void 0) {
+    const hit = hosting.find((r) => r.route === named);
+    return hit ?? err(404, "not found");
+  }
+  if (hosting.length === 1) return hosting[0];
+  return err(400, `route is required (this ship hosts periscopes on: ${hosting.map((r) => r.route).join(", ")})`);
+}
+function cliMessage(r) {
+  const lines = r.stderr.split("\n").map((l) => l.trim()).filter(Boolean);
+  const plain = lines.filter((l) => !l.startsWith("{"));
+  const last = plain[plain.length - 1] ?? lines[lines.length - 1] ?? `crew exited with status ${r.code}`;
+  return last.replace(/^crew periscope:\s*/, "");
+}
+function failureStatus(r) {
+  const m = cliMessage(r);
+  if (/^no periscope for ticket /.test(m)) return 404;
+  if (/already hosts \d+ live periscope/.test(m)) return 409;
+  return r.code === 1 ? 422 : 500;
+}
+function lastJsonLine(stdout) {
+  const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    try {
+      const v = JSON.parse(lines[i]);
+      if (v && typeof v === "object" && !Array.isArray(v)) return v;
+    } catch {
+    }
+  }
+  return null;
+}
+function parseLine(line) {
+  try {
+    const v = JSON.parse(line);
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function execute(h, args, streaming) {
+  const finish = (r) => {
+    if (r.code !== 0) return { status: failureStatus(r), body: { error: cliMessage(r) } };
+    const done = lastJsonLine(r.stdout);
+    return done ? { status: 200, body: done } : { status: 502, body: { error: "the command finished without a result" } };
+  };
+  if (!streaming) {
+    const f = finish(await h.run(args, () => {
+    }));
+    return reply(f.status, f.body);
+  }
+  return {
+    status: 200,
+    body: null,
+    stream: async (write) => {
+      const r = await h.run(args, (line) => {
+        const ev = parseLine(line);
+        if (ev) write(ev);
+      });
+      const f = finish(r);
+      write(f.status === 200 ? f.body : { event: "error", status: f.status, message: f.body.error });
+    }
+  };
+}
+var isPeriscopePath = (p) => p === "/periscopes" || p.startsWith("/periscopes/");
+async function handlePeriscopes(h, q) {
+  if (!h || !h.routes.some((r) => r.hostPeriscopes)) return err(404, "not found");
+  const down = /^\/periscopes\/([^/]+)\/down$/.exec(q.path);
+  const isUp = q.path === "/periscopes" && q.method === "POST";
+  const isList = q.path === "/periscopes" && q.method === "GET";
+  if (q.path === "/periscopes" && !isUp && !isList) return err(405, "method not allowed");
+  if (down && q.method !== "POST") return err(405, "method not allowed");
+  if (q.path !== "/periscopes" && !down) return err(404, "not found");
+  const member = async (workspaceId) => {
+    const v = await h.verifyIn(q.token, workspaceId);
+    if (v === "ok") return void 0;
+    if (v === "unavailable") return err(503, "could not verify the key right now");
+    return err(403, "this key does not belong to the workspace of this route");
+  };
+  if (isList) {
+    const named = q.query.get("route") ?? void 0;
+    const candidates2 = named === void 0 ? h.routes.filter((r) => r.hostPeriscopes) : [pickRoute(h, named)];
+    const rows = [];
+    for (const c of candidates2) {
+      if ("status" in c) return c;
+      const denied2 = await member(c.workspaceId);
+      if (denied2) {
+        if (named !== void 0) return denied2;
+        continue;
+      }
+      const r = await h.run(["periscope", "list", c.route, "--json"], () => {
+      });
+      if (r.code !== 0) return err(failureStatus(r), cliMessage(r));
+      try {
+        const list = JSON.parse(r.stdout);
+        if (Array.isArray(list)) for (const e of list) rows.push({ route: c.route, ...e });
+      } catch {
+        return err(502, "the list command did not answer JSON");
+      }
+    }
+    return reply(200, { periscopes: rows });
+  }
+  const b = q.body;
+  if (!b) return err(400, "body must be a small JSON object");
+  const routeName = plainText(b.route, "route", false);
+  if (isErr(routeName)) return err(400, routeName.error);
+  const picked = pickRoute(h, routeName);
+  if ("status" in picked) return picked;
+  const denied = await member(picked.workspaceId);
+  if (denied) return denied;
+  if (down) {
+    const ticket = decodeURIComponent(down[1]);
+    if (!TICKET_RE.test(ticket)) return err(400, "ticket must be a ticket number such as 123 or CREW-123");
+    if (b.outcome !== "keep" && b.outcome !== "discard") return err(400, 'outcome must be "keep" or "discard"');
+    if (b.allowEmpty !== void 0 && typeof b.allowEmpty !== "boolean") return err(400, "allowEmpty must be a boolean");
+    return execute(h, [
+      "periscope",
+      "down",
+      picked.route,
+      ticket,
+      `--${b.outcome}`,
+      ...b.allowEmpty === true ? ["--allow-empty"] : [],
+      "--json"
+    ], q.wantsStream);
+  }
+  const repo = plainText(b.repo, "repo", true);
+  const topic = plainText(b.topic, "topic", true);
+  const requestedBy = plainText(b.requestedBy, "requestedBy", false);
+  for (const v of [repo, topic, requestedBy]) if (isErr(v)) return err(400, v.error);
+  if (b.isolate !== void 0 && typeof b.isolate !== "boolean") return err(400, "isolate must be a boolean");
+  if (!h.previewHost) return err(409, "this ship has no ship.previewHost, so a Passenger could not reach a periscope");
+  const live = await h.run(["periscope", "list", picked.route, "--json"], () => {
+  });
+  if (live.code === 0) {
+    try {
+      const n = JSON.parse(live.stdout).length;
+      if (n >= h.maxPeriscopes) return err(409, `this ship already hosts ${n} live periscope(s) (ship.maxPeriscopes is ${h.maxPeriscopes}) \u2014 discard one first`);
+    } catch {
+    }
+  }
+  return execute(h, [
+    "periscope",
+    "up",
+    picked.route,
+    repo,
+    "--topic",
+    topic,
+    "--host",
+    h.previewHost,
+    ...requestedBy ? ["--requested-by", requestedBy] : [],
+    ...b.isolate === true ? ["--isolate"] : [],
+    "--no-open",
+    "--json"
+  ], q.wantsStream);
+}
+function runCrew(args, onLine, timeoutMs = 20 * 6e4) {
+  return new Promise((resolve6) => {
+    const child = spawn7(process.execPath, [process.argv[1] ?? "", ...args], { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let pending = "";
+    child.stdout.on("data", (d) => {
+      stdout += d.toString("utf8");
+    });
+    child.stderr.on("data", (d) => {
+      const text = d.toString("utf8");
+      stderr += text;
+      pending += text;
+      let i;
+      while ((i = pending.indexOf("\n")) >= 0) {
+        const line = pending.slice(0, i).trim();
+        pending = pending.slice(i + 1);
+        if (line) onLine(line);
+      }
+    });
+    const t = setTimeout(() => child.kill("SIGTERM"), timeoutMs);
+    child.on("error", (e) => {
+      clearTimeout(t);
+      resolve6({ code: 127, stdout, stderr: `${stderr}${e.message}
+` });
+    });
+    child.on("close", (code) => {
+      clearTimeout(t);
+      resolve6({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+
+// src/control-api.ts
 var PAUSABLE = ["dev", "design", "qa"];
 var CONTROL_SOCKET_NAME = "control.sock";
 var controlSocketFor = (stateDir) => join43(stateDir, CONTROL_SOCKET_NAME);
@@ -19051,11 +19414,26 @@ var ControlAuth = class {
     }
     return verdict;
   }
-  async ask(token) {
+  /**
+   * Like `verify`, but the token must belong to `workspaceId` itself, not just
+   * to some workspace this ship serves. The ship's own keys pass.
+   */
+  async verifyIn(token, workspaceId) {
+    if (!token) return "unauthorized";
+    for (const k of this.o.shipKeys()) if (k && secretsMatch(token, k)) return "ok";
+    const now = (this.o.now ?? Date.now)();
+    const id = `${workspaceId}:${createHash9("sha256").update(token).digest("hex")}`;
+    const hit = this.cache.get(id);
+    if (hit && now - hit.at < (this.o.cacheMs ?? 6e4)) return hit.verdict;
+    const verdict = await this.ask(token, [workspaceId]);
+    if (verdict !== "unavailable") this.cache.set(id, { verdict, at: now });
+    return verdict;
+  }
+  async ask(token, workspaceIds = this.o.workspaceIds) {
     const doFetch = this.o.fetch ?? fetch;
     const base = this.o.baseUrl.replace(/\/+$/, "");
     let forbidden = false;
-    for (const ws of this.o.workspaceIds) {
+    for (const ws of workspaceIds) {
       let res;
       try {
         res = await doFetch(`${base}/api/auth/me?workspaceId=${encodeURIComponent(ws)}`, {
@@ -19206,8 +19584,8 @@ function waitForChange(dir, ms3, signal) {
     }
   });
 }
-var reply = (status2, body) => ({ status: status2, body });
-var err = (status2, message) => reply(status2, { error: message });
+var reply2 = (status2, body) => ({ status: status2, body });
+var err2 = (status2, message) => reply2(status2, { error: message });
 function pauseDoc(state) {
   return {
     crew: state.isPaused(),
@@ -19247,26 +19625,38 @@ async function readJsonBody(req) {
 async function tailReply(path, q, rotated, abort) {
   const after = q.get("after") ?? void 0;
   const tail3 = q.has("tail") ? Number(q.get("tail")) : void 0;
-  if (tail3 !== void 0 && !(Number.isInteger(tail3) && tail3 >= 0 && tail3 <= 1e3)) return err(400, "tail must be an integer from 0 to 1000");
+  if (tail3 !== void 0 && !(Number.isInteger(tail3) && tail3 >= 0 && tail3 <= 1e3)) return err2(400, "tail must be an integer from 0 to 1000");
   const wait = q.has("wait") ? Number(q.get("wait")) : 0;
-  if (!(Number.isFinite(wait) && wait >= 0)) return err(400, "wait must be a number of seconds");
-  if (after !== void 0 && !decodeCursor(after)) return err(400, "after is not a cursor this API issued");
+  if (!(Number.isFinite(wait) && wait >= 0)) return err2(400, "wait must be a number of seconds");
+  if (after !== void 0 && !decodeCursor(after)) return err2(400, "after is not a cursor this API issued");
   const deadline = Date.now() + Math.min(wait, MAX_WAIT_SECONDS) * 1e3;
   let r = readTail(path, { after, tail: tail3, rotated });
   while (after && !r.lines.length && !r.reset && Date.now() < deadline && !abort.aborted) {
     await waitForChange(dirname21(path), deadline - Date.now(), abort);
     r = readTail(path, { after: r.cursor, rotated });
   }
-  return reply(200, r);
+  return reply2(200, r);
 }
 async function route(deps, method, url, req, abort) {
   const p = url.pathname.replace(/\/+$/, "") || "/";
   const get2 = method === "GET";
   const post3 = method === "POST";
+  if (isPeriscopePath(p)) {
+    const token = /^Bearer (.+)$/.exec(req.headers.authorization ?? "")?.[1]?.trim() ?? "";
+    const body = method === "POST" ? await readJsonBody(req) : {};
+    return handlePeriscopes(deps.periscopes, {
+      method,
+      path: p,
+      query: url.searchParams,
+      token,
+      body,
+      wantsStream: url.searchParams.get("stream") === "1" || (req.headers.accept ?? "").includes("application/x-ndjson")
+    });
+  }
   if (p === "/status" && get2) {
     const doc = await deps.status();
-    if (!doc) return err(502, "could not produce the status document");
-    return reply(200, {
+    if (!doc) return err2(502, "could not produce the status document");
+    return reply2(200, {
       ...doc,
       daemon: {
         alive: true,
@@ -19278,41 +19668,50 @@ async function route(deps, method, url, req, abort) {
     });
   }
   if (p === "/events" && get2) return tailReply(eventFileFor(deps.stateDir), url.searchParams, true, abort);
-  if (p === "/streams" && get2) return reply(200, { streams: liveRuns(deps.stateDir).map(describeStream) });
+  if (p === "/streams" && get2) return reply2(200, { streams: liveRuns(deps.stateDir).map(describeStream) });
   if (p.startsWith("/streams/") && get2) {
     const run2 = decodeURIComponent(p.slice("/streams/".length));
-    if (!RUN_NAME_RE.test(run2) || run2.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run2)) return err(400, "not a run name");
+    if (!RUN_NAME_RE.test(run2) || run2.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run2)) return err2(400, "not a run name");
     const file = join43(deps.stateDir, "streams", run2.endsWith(".jsonl") ? run2 : `${run2}.jsonl`);
-    if (!existsSync39(file)) return err(404, "no such run");
+    if (!existsSync39(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
     const body = await readJsonBody(req);
-    if (!body) return err(400, "body must be a small JSON object");
+    if (!body) return err2(400, "body must be a small JSON object");
     const role = body.role;
-    if (role !== void 0 && !PAUSABLE.includes(role)) return err(400, `role must be one of ${PAUSABLE.join(", ")}`);
+    if (role !== void 0 && !PAUSABLE.includes(role)) return err2(400, `role must be one of ${PAUSABLE.join(", ")}`);
     if (p === "/pause") deps.state.pause(role);
     else deps.state.resume(role);
-    return reply(200, { ok: true, pause: pauseDoc(deps.state) });
+    return reply2(200, { ok: true, pause: pauseDoc(deps.state) });
   }
   if ((p === "/release/pause" || p === "/release/resume") && post3) {
     deps.state.setReleasePaused(p === "/release/pause");
-    return reply(200, { ok: true, pause: pauseDoc(deps.state) });
+    return reply2(200, { ok: true, pause: pauseDoc(deps.state) });
   }
   const sched = /^\/scheduler\/(start|stop|restart)$/.exec(p);
   if (sched && post3) {
     const r = deps.scheduler(sched[1]);
-    return r.accepted ? reply(202, { accepted: true, detail: r.detail }) : err(409, r.detail);
+    return r.accepted ? reply2(202, { accepted: true, detail: r.detail }) : err2(409, r.detail);
   }
   if (p === "/doctor" && get2) {
     const doc = await deps.doctor();
-    return doc ? reply(200, doc) : err(502, "could not produce the doctor report");
+    return doc ? reply2(200, doc) : err2(502, "could not produce the doctor report");
   }
   const known = ["/status", "/events", "/streams", "/pause", "/resume", "/release/pause", "/release/resume", "/doctor"];
-  if (known.includes(p) || p.startsWith("/streams/") || sched) return err(405, "method not allowed");
-  return err(404, "not found");
+  if (known.includes(p) || p.startsWith("/streams/") || sched) return err2(405, "method not allowed");
+  return err2(404, "not found");
 }
 function send(res, r) {
+  if (r.stream) {
+    res.writeHead(200, { "Content-Type": "application/x-ndjson", "Cache-Control": "no-store" });
+    return r.stream((ev) => {
+      if (!res.writableEnded) res.write(`${JSON.stringify(ev)}
+`);
+    }).then(() => {
+      res.end();
+    });
+  }
   const body = JSON.stringify(r.body);
   res.writeHead(r.status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body), "Cache-Control": "no-store" });
   res.end(body);
@@ -19348,13 +19747,13 @@ async function startControlServer(deps) {
       try {
         const m = /^Bearer (.+)$/.exec(req.headers.authorization ?? "");
         const verdict = await deps.auth.verify(m?.[1]?.trim() ?? "");
-        if (verdict === "unauthorized") return send(res, err(401, "invalid or revoked key"));
-        if (verdict === "forbidden") return send(res, err(403, "this key does not belong to a workspace this ship serves"));
-        if (verdict === "unavailable") return send(res, err(503, "could not verify the key right now"));
-        send(res, await route(deps, req.method ?? "GET", new URL(req.url ?? "/", "http://ship"), req, abort.signal));
+        if (verdict === "unauthorized") return send(res, err2(401, "invalid or revoked key"));
+        if (verdict === "forbidden") return send(res, err2(403, "this key does not belong to a workspace this ship serves"));
+        if (verdict === "unavailable") return send(res, err2(503, "could not verify the key right now"));
+        await send(res, await route(deps, req.method ?? "GET", new URL(req.url ?? "/", "http://ship"), req, abort.signal));
       } catch (e) {
         log(`control API request failed: ${e.message}`);
-        if (!res.headersSent) send(res, err(500, "internal error"));
+        if (!res.headersSent) send(res, err2(500, "internal error"));
         else res.end();
       }
     })();
@@ -19384,7 +19783,7 @@ async function startControlServer(deps) {
   });
 }
 var shq2 = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-function runDetached(commands, spawnFn = spawn7) {
+function runDetached(commands, spawnFn = spawn8) {
   const script = `sleep 1; ${commands.map((c) => c.map(shq2).join(" ")).join("; ")}`;
   const child = spawnFn("/bin/sh", ["-c", script], { detached: true, stdio: "ignore" });
   child.on("error", () => {
@@ -20790,8 +21189,8 @@ ${cu.tail.trimEnd()}
               `swept ${r.parked} parked, ${r.restored} restored${r.failed ? `, ${r.failed} failed` : ""}${r.contended ? `, ${r.contended} contended` : ""} (${e.route.route})`,
               { step: "sweep", data: r }
             );
-          } catch (err2) {
-            remit.warn(`could not sweep ${e.route.route}: ${err2.message}`, { step: "sweep" });
+          } catch (err3) {
+            remit.warn(`could not sweep ${e.route.route}: ${err3.message}`, { step: "sweep" });
           }
         }
         process.stdout.write(renderFleet(fleet, state));
@@ -21307,21 +21706,30 @@ ${cu.tail.trimEnd()}
       noteDaemonStarted(cfg.ship.stateDir);
       const spawnBreaker = new SpawnBreaker();
       const controlRoutes = cfg.routes.filter((r) => r.resolved?.workspaceId);
+      const controlAuth = new ControlAuth({
+        baseUrl: route2.baseUrl || DEFAULT_BASE_URL,
+        workspaceIds: [...new Set(controlRoutes.map((r) => r.resolved.workspaceId))],
+        shipKeys: () => cfg.routes.flatMap((r) => {
+          try {
+            return [resolveApiKey(r)];
+          } catch {
+            return [];
+          }
+        }),
+        userAgent: cfg.ship.userAgent
+      });
       const controlServer = await startControlServer({
         stateDir: cfg.ship.stateDir,
         state,
-        auth: new ControlAuth({
-          baseUrl: route2.baseUrl || DEFAULT_BASE_URL,
-          workspaceIds: [...new Set(controlRoutes.map((r) => r.resolved.workspaceId))],
-          shipKeys: () => cfg.routes.flatMap((r) => {
-            try {
-              return [resolveApiKey(r)];
-            } catch {
-              return [];
-            }
-          }),
-          userAgent: cfg.ship.userAgent
-        }),
+        auth: controlAuth,
+        // CREW-2859: Passenger periscopes, only on a route that sets hostPeriscopes.
+        periscopes: {
+          routes: controlRoutes.filter((r) => r.enabled).map((r) => ({ route: r.route, workspaceId: r.resolved.workspaceId, hostPeriscopes: r.hostPeriscopes === true })),
+          previewHost: cfg.ship.previewHost,
+          maxPeriscopes: cfg.ship.maxPeriscopes,
+          run: runCrew,
+          verifyIn: (token, ws) => controlAuth.verifyIn(token, ws)
+        },
         status: () => crewJson(["status", route2.route, "--json"]),
         doctor: () => crewJson(["doctor", route2.route, "--json", "--offline"]),
         scheduler: schedulerHandler(planDaemonControl(CREW_HOME, hostPlatform(), detectSystemd())),
@@ -21346,11 +21754,11 @@ ${cu.tail.trimEnd()}
 `)
           })
         }),
-        onTransient: ({ err: err2, consecutive, backoffMs }) => emit.warn(
-          `tracker unavailable (${describeCause(err2)}); attempt ${consecutive}, retrying in ${Math.round(backoffMs / 1e3)}s`
+        onTransient: ({ err: err3, consecutive, backoffMs }) => emit.warn(
+          `tracker unavailable (${describeCause(err3)}); attempt ${consecutive}, retrying in ${Math.round(backoffMs / 1e3)}s`
         ),
-        onOutage: ({ err: err2, downMs }) => {
-          const msg = `tracker unreachable for ${Math.max(1, Math.round(downMs / 6e4))} minutes: ${describeCause(err2)}`;
+        onOutage: ({ err: err3, downMs }) => {
+          const msg = `tracker unreachable for ${Math.max(1, Math.round(downMs / 6e4))} minutes: ${describeCause(err3)}`;
           emit.error(msg);
           void raiseShipAttention({ state, emit, route: route2, ship: cfg.ship }, {
             kind: "tracker_unreachable",
@@ -21363,8 +21771,8 @@ ${cu.tail.trimEnd()}
           clearShipAttention(state, TRACKER_OUTAGE_KEY);
           emit.emit(`tracker is back after ${Math.max(1, Math.round(downMs / 1e3))}s`);
         },
-        onPassError: (err2) => emit.error(
-          `daemon pass failed, continuing: ${err2 instanceof Error ? err2.stack ?? err2.message : String(err2)}`
+        onPassError: (err3) => emit.error(
+          `daemon pass failed, continuing: ${err3 instanceof Error ? err3.stack ?? err3.message : String(err3)}`
         ),
         checkStale: makeStaleChecker(watchPaths, { reloadSentinel: reloadSentinelFor(cfg.ship.stateDir) }),
         onPass: (result) => {
@@ -23289,7 +23697,7 @@ ${resumed.url}
 `);
           break;
         }
-        const parsedUp = parsePeriscopeUpArgs(positional, { topic: value("topic"), issue: value("issue"), host: value("host"), assignee: value("assignee"), isolate: flag("isolate"), json: jsonP });
+        const parsedUp = parsePeriscopeUpArgs(positional, { topic: value("topic"), issue: value("issue"), host: value("host"), assignee: value("assignee"), requestedBy: value("requested-by"), isolate: flag("isolate"), json: jsonP });
         let a;
         if (parsedUp.repo !== void 0) a = { ...parsedUp, repo: parsedUp.repo };
         else {
@@ -23347,7 +23755,7 @@ ${where.join("\n")}`);
               title,
               description: `A periscope: a throwaway preview of ${a.repo} for a viewer, opened by \`crew periscope up\`.`,
               report_type: "feature",
-              reporter_name: operatorName,
+              reporter_name: a.requestedBy ?? operatorName,
               [cP.columns.status]: cP.statuses.draft,
               [cP.columns.assignee]: pairId,
               ...routeP.resolved.areaId ? { [cP.columns.slice]: routeP.resolved.areaId } : {},
@@ -24150,7 +24558,7 @@ watermark:  ${state.watermark()}
         );
       }
       for (const x of runs) {
-        process.stdout.write(`running:    ${x.role} \u2014 ${x.ticket ?? "(no ticket)"}${x.repo ? ` in ${x.repo}` : ""} (pid ${x.pid}, since ${x.spawnedAt})
+        process.stdout.write(`running:    ${x.role} \u2014 ${x.ticket ?? "(no ticket)"}${x.repo ? ` in ${x.repo}` : ""} (pid ${x.pid}, since ${x.spawnedAt}${x.deadline ? `, deadline ${x.deadline}` : ""})
 `);
       }
       if (shipRows.length) {
@@ -24360,6 +24768,11 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       const missingAuthorship = await tracker.missingAuthorshipColumns();
       process.stdout.write(
         missingAuthorship.length === 0 ? "authorship:       filed_by_id, ship_id present\n" : `authorship:       missing ${missingAuthorship.join(", ")} \u2014 update the Issues template
+`
+      );
+      const missingRuntime = await tracker.missingRuntimeColumns();
+      process.stdout.write(
+        missingRuntime.length === 0 ? "runtime columns: forge_host, kind, instance_class, relay_url present\n" : `runtime columns: missing ${missingRuntime.join(", ")} \u2014 read as their defaults; update the Issues template
 `
       );
       process.stdout.write(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.93.0",
+  "version": "0.95.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",