@tablation/crew 0.95.0 → 0.97.0

package/dist/cli.js

@@ -2602,6 +2602,22 @@ function parseCloneScheme(v) {
   if (v === "ssh" || v === "https") return v;
   throw new ConfigError(`ship.cloneScheme must be "ssh" or "https", got ${JSON.stringify(v)}`);
 }
+function parseShipEnv(v) {
+  if (v === void 0 || v === null) return void 0;
+  if (typeof v !== "object" || Array.isArray(v)) throw new ConfigError("ship.env must be a map of variable name to value");
+  const out = {};
+  for (const [k, val] of Object.entries(v)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) throw new ConfigError(`ship.env: "${k}" is not a valid variable name`);
+    if (k === "PATH") throw new ConfigError("ship.env: PATH is set from ship.extraPath, not here");
+    if (typeof val !== "string" && typeof val !== "number" && typeof val !== "boolean") {
+      throw new ConfigError(`ship.env.${k} must be a string, number or boolean`);
+    }
+    const text = String(val);
+    if (/[\r\n\0]/.test(text)) throw new ConfigError(`ship.env.${k} must be a single line`);
+    out[k] = text;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
 function parseShipForges(v) {
   try {
     return parseForges(v);
@@ -2641,7 +2657,8 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "previewHost",
   "maxPeriscopes",
   "periscopeIdleMinutes",
-  "secretStore"
+  "secretStore",
+  "env"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -3065,7 +3082,8 @@ Create the first of those:
       previewHost: shipRaw.previewHost ? String(shipRaw.previewHost).trim() || void 0 : void 0,
       maxPeriscopes,
       periscopeIdleMinutes,
-      secretStore
+      secretStore,
+      env: parseShipEnv(shipRaw.env)
     },
     routes,
     crewHome,
@@ -3717,7 +3735,7 @@ function recoveredFailureHeadlines(o, route2) {
 
 // src/install.ts
 import { dirname as dirname5, join as join13, extname } from "path";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir7, userInfo } from "os";
 import { accessSync as accessSync2, constants as constants2, existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync4, writeFileSync as writeFileSync8, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash3 } from "crypto";
@@ -3785,6 +3803,30 @@ function dockerPathProblem(ship, shellPath = process.env.PATH ?? "") {
   const inShell = findOnPath("docker", shellPath);
   return inShell ? `\`docker\` is not on the scheduler PATH (${schedulerPath}) but is at ${inShell} in your shell; add ${dirname5(inShell)} to ship.extraPath in crew.yaml and run \`crew install\`` : `\`docker\` is not on the scheduler PATH (${schedulerPath}) or your shell PATH; install Docker, then add its directory to ship.extraPath in crew.yaml and run \`crew install\``;
 }
+var USER_INSTALL = { root: false, user: "" };
+function installContext(env = process.env) {
+  const root = typeof process.getuid === "function" && process.getuid() === 0;
+  const user = root && env.SUDO_USER || userInfo().username;
+  return { root, user };
+}
+var SYSTEM_UNIT_DIR = "/etc/systemd/system";
+function systemUnitPathFor(label, suffix = "service") {
+  return join13(SYSTEM_UNIT_DIR, `${label}.${suffix}`);
+}
+function unitEnvironment(ship) {
+  return [["PATH", pathFor(ship)], ...Object.entries(ship.env ?? {})];
+}
+function systemdEnvLines(ship) {
+  return unitEnvironment(ship).map(([k, v]) => {
+    if (k === "PATH") return `Environment=PATH=${v}`;
+    const escaped = `${k}=${v}`.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%");
+    return `Environment="${escaped}"`;
+  }).join("\n");
+}
+function shQuote(v) {
+  if (/^[A-Za-z0-9_/.:,@%+=-]+$/.test(v)) return v;
+  return `'${v.replace(/'/g, `'\\''`)}'`;
+}
 function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -3817,8 +3859,8 @@ function planLaunchd(ship, crewHome, job) {
   </array>
   <key>EnvironmentVariables</key>
   <dict>
-    <key>PATH</key>
-    <string>${xmlEscape(pathFor(ship))}</string>
+${unitEnvironment(ship).map(([k, v]) => `    <key>${xmlEscape(k)}</key>
+    <string>${xmlEscape(v)}</string>`).join("\n")}
   </dict>
   <key>WorkingDirectory</key>
   <string>${xmlEscape(crewHome)}</string>
@@ -3842,9 +3884,17 @@ ${scheduleKeys}
     schedulerLog
   };
 }
-function planSystemd(ship, crewHome, job) {
+function planSystemd(ship, crewHome, job, ctx) {
   const label = labelFor(crewHome, job);
-  const unitDir = join13(homedir7(), ".config", "systemd", "user");
+  const unitDir = ctx.root ? SYSTEM_UNIT_DIR : join13(homedir7(), ".config", "systemd", "user");
+  const ctl = ctx.root ? ["systemctl"] : ["systemctl", "--user"];
+  const userLine = ctx.root && ctx.user && ctx.user !== "root" ? `User=${ctx.user}
+` : "";
+  const wantedBy = ctx.root ? "multi-user.target" : "default.target";
+  const linger = ctx.root || !ctx.user ? {} : {
+    lingerCommand: ["loginctl", "enable-linger", ctx.user],
+    lingerHint: `the daemon will stop when ${ctx.user} logs out; run \`sudo loginctl enable-linger ${ctx.user}\` once, or run \`crew install\` as root for a system unit`
+  };
   const servicePath = join13(unitDir, `${label}.service`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
@@ -3856,9 +3906,9 @@ Description=${description}
 
 [Service]
 Type=simple
-ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
+${userLine}ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
 WorkingDirectory=${crewHome}
-Environment=PATH=${pathFor(ship)}
+${systemdEnvLines(ship)}
 StandardOutput=append:${schedulerLog}
 StandardError=append:${schedulerLog}
 Restart=on-failure
@@ -3868,7 +3918,7 @@ RestartSec=5
 KillMode=process
 
 [Install]
-WantedBy=default.target
+WantedBy=${wantedBy}
 `;
     return {
       mechanism: "systemd",
@@ -3878,11 +3928,12 @@ WantedBy=default.target
       cronMarker: null,
       preLoadCommands: [],
       loadCommands: [
-        ["systemctl", "--user", "daemon-reload"],
-        ["systemctl", "--user", "enable", "--now", `${label}.service`]
+        [...ctl, "daemon-reload"],
+        [...ctl, "enable", "--now", `${label}.service`]
       ],
       crewLog,
-      schedulerLog
+      schedulerLog,
+      ...linger
     };
   }
   const timerPath = join13(unitDir, `${label}.timer`);
@@ -3892,9 +3943,9 @@ Description=${description}
 
 [Service]
 Type=oneshot
-ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
+${userLine}ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
 WorkingDirectory=${crewHome}
-Environment=PATH=${pathFor(ship)}
+${systemdEnvLines(ship)}
 StandardOutput=append:${schedulerLog}
 StandardError=append:${schedulerLog}
 `;
@@ -3918,11 +3969,12 @@ WantedBy=timers.target
     cronMarker: null,
     preLoadCommands: [],
     loadCommands: [
-      ["systemctl", "--user", "daemon-reload"],
-      ["systemctl", "--user", "enable", "--now", `${label}.timer`]
+      [...ctl, "daemon-reload"],
+      [...ctl, "enable", "--now", `${label}.timer`]
     ],
     crewLog,
-    schedulerLog
+    schedulerLog,
+    ...linger
   };
 }
 function planCron(ship, crewHome, job) {
@@ -3930,7 +3982,7 @@ function planCron(ship, crewHome, job) {
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const minutes = Math.max(1, Math.round(INTERVAL_SECONDS / 60));
-  const line = `*/${minutes} * * * * cd ${crewHome} && PATH=${pathFor(ship)} ${[...crewInvocation(crewHome), ...subcommandFor(job, "cron")].join(" ")} >> ${schedulerLog} 2>&1`;
+  const line = `*/${minutes} * * * * cd ${crewHome} && ${unitEnvironment(ship).map(([k, v]) => `${k}=${shQuote(v)}`).join(" ")} ${[...crewInvocation(crewHome), ...subcommandFor(job, "cron")].join(" ")} >> ${schedulerLog} 2>&1`;
   return {
     mechanism: "cron",
     unitPaths: [],
@@ -3950,9 +4002,9 @@ function unitAbandonsAgents(plan, read) {
   if (text === null) return null;
   return plan.mechanism === "launchd" ? /<key>AbandonProcessGroup<\/key>\s*<true\/>/.test(text) : /^KillMode=process\s*$/m.test(text);
 }
-function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
+function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run", ctx = USER_INSTALL) {
   if (hostShip === "macos") return planLaunchd(ship, crewHome, job);
-  if (hostShip === "linux" && hasSystemd) return planSystemd(ship, crewHome, job);
+  if (hostShip === "linux" && hasSystemd) return planSystemd(ship, crewHome, job, ctx);
   if (hostShip === "linux") return planCron(ship, crewHome, job);
   throw new Error(`crew install: no scheduler support yet for ${hostShip} (Windows is planned, not built)`);
 }
@@ -3969,20 +4021,22 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
     };
   }
   if (hostShip === "linux" && hasSystemd) {
-    const unitDir = join13(homedir7(), ".config", "systemd", "user");
+    const system = existsSync11(systemUnitPathFor(label));
+    const unitDir = system ? SYSTEM_UNIT_DIR : join13(homedir7(), ".config", "systemd", "user");
+    const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
     if (job === "run") {
       return {
         mechanism: "systemd",
         unitPaths: [join13(unitDir, `${label}.service`)],
         crontabLine: null,
-        unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.service`]]
+        unloadCommands: [[...ctl, "disable", "--now", `${label}.service`]]
       };
     }
     return {
       mechanism: "systemd",
       unitPaths: [join13(unitDir, `${label}.service`), join13(unitDir, `${label}.timer`)],
       crontabLine: null,
-      unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.timer`]]
+      unloadCommands: [[...ctl, "disable", "--now", `${label}.timer`]]
     };
   }
   if (hostShip === "linux") {
@@ -4008,11 +4062,12 @@ function planDaemonControl(crewHome, hostShip, hasSystemd) {
   }
   if (hostShip === "linux" && hasSystemd) {
     const unit = `${label}.service`;
+    const ctl = existsSync11(systemUnitPathFor(label)) ? ["systemctl"] : ["systemctl", "--user"];
     return {
       mechanism: "systemd",
-      startCommand: ["systemctl", "--user", "start", unit],
-      stopCommand: ["systemctl", "--user", "stop", unit],
-      statusCommand: ["systemctl", "--user", "status", unit]
+      startCommand: [...ctl, "start", unit],
+      stopCommand: [...ctl, "stop", unit],
+      statusCommand: [...ctl, "status", unit]
     };
   }
   if (hostShip === "linux") {
@@ -4033,11 +4088,14 @@ function runAll(commands, cwd, log) {
   return true;
 }
 async function applyInstall(plan, crewHome, dryRun, log) {
+  let changed2 = plan.crontabLine !== null;
   for (const path of plan.unitPaths) {
     if (dryRun) {
       log.emit(`would write ${path}`);
       continue;
     }
+    const before = existsSync11(path) ? readFileSync12(path, "utf8") : null;
+    if (before !== plan.unitContent[path]) changed2 = true;
     mkdirSync7(dirname5(path), { recursive: true });
     writeFileSync8(path, plan.unitContent[path]);
     log.emit(`wrote ${path}`);
@@ -4067,8 +4125,18 @@ async function applyInstall(plan, crewHome, dryRun, log) {
       log.emit(`loaded (${plan.mechanism}), firing every ${INTERVAL_SECONDS}s starting ${INTERVAL_SECONDS}s from now`);
     }
   }
+  if (plan.lingerCommand) {
+    if (dryRun) {
+      log.emit(`would run: ${plan.lingerCommand.join(" ")}`);
+    } else if (runAll([plan.lingerCommand], crewHome, { emit: log.emit.bind(log), warn: () => void 0 })) {
+      log.emit(`lingering enabled for ${plan.lingerCommand[2]}: the unit survives logout`);
+    } else {
+      log.warn(`could not enable lingering \u2014 ${plan.lingerHint ?? "run loginctl enable-linger by hand"}`);
+    }
+  }
   log.emit(`crew's own log: ${plan.crewLog}`);
   log.emit(`scheduler log (only what escapes the crew, e.g. a crash before it starts): ${plan.schedulerLog}`);
+  return { changed: changed2 };
 }
 async function applyUninstall(plan, crewHome, dryRun, log) {
   if (plan.mechanism === "none") {
@@ -7210,6 +7278,18 @@ var Tracker = class {
     if (!row) return;
     await this.client.records.update(this.route.resolved.shipsModelId, row.id, patch2);
   }
+  /**
+   * Writes (or, with `null`, clears) this ship's `relay_url` (CREW-2803). A
+   * no-op when there is no row for this ship or the Ships table has not taken
+   * the column (probed by the key's absence from the row), so the tunnel
+   * still runs on an install that predates it.
+   */
+  async updateRelayUrl(shipName2, url) {
+    const row = await this.myShipRow(shipName2);
+    if (!row || !("relay_url" in row)) return;
+    if ((row.relay_url ?? null) === url) return;
+    await this.client.records.update(this.route.resolved.shipsModelId, row.id, { relay_url: url });
+  }
   /** The other half of `beatEngaged` — clears engagement back to idle. */
   async beatIdle(shipName2) {
     const row = await this.myShipRow(shipName2);
@@ -10465,8 +10545,8 @@ function doctorSelftestLines(stored, toolchains) {
 // src/cli.ts
 import { resolve as resolve5, dirname as dirname22, join as join44, basename as basename13 } from "path";
 import { fileURLToPath } from "url";
-import { hostname as hostname2, homedir as homedir10 } from "os";
-import { spawnSync as spawnSync7 } from "child_process";
+import { hostname as hostname3, homedir as homedir10 } from "os";
+import { spawnSync as spawnSync8 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
 
 // src/argv.ts
@@ -10478,6 +10558,7 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "clear",
   "dir",
   "extra-path",
+  "forge-host",
   "harness",
   "hook",
   "host",
@@ -12718,191 +12799,776 @@ function flagWizardAnswers(f, env) {
   };
 }
 
-// src/release-run.ts
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync19, existsSync as existsSync25, copyFileSync, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, rmSync as rmSync14 } from "fs";
-import { dirname as dirname13, join as join29 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+// src/provision.ts
+import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync25, readFileSync as readFileSync23, writeFileSync as writeFileSync19 } from "fs";
+import { hostname as hostname2 } from "os";
+import { parseDocument as parseDocument3 } from "yaml";
 
-// src/release.ts
-function describeUnplaceable(unplaceable, verifiedStatus) {
-  const stranded = unplaceable.filter((u) => u.ticket.status === verifiedStatus);
-  if (stranded.length === 0) return [];
-  const notes = [];
-  const keysFor = (r) => stranded.filter((u) => u.reason === r).map((u) => u.ticket.issue_id);
-  const noRepo = keysFor("no-repo");
-  if (noRepo.length) {
-    notes.push({
-      level: "warn",
-      message: `${noRepo.length} verified ticket(s) name no repository and cannot be released: ` + noRepo.join(", ")
-    });
-  }
-  const unknown = keysFor("unknown-repo");
-  if (unknown.length) {
-    notes.push({
-      level: "warn",
-      message: `${unknown.length} verified ticket(s) name a repository this ship does not recognise \u2014 run \`crew connect\` to refresh its repo list: ${unknown.join(", ")}`
-    });
-  }
-  const elsewhere = stranded.filter((u) => u.reason === "not-served-here");
-  if (elsewhere.length) {
-    const byRepoName = /* @__PURE__ */ new Map();
-    for (const u of elsewhere) {
-      const name = u.repo ?? "?";
-      byRepoName.set(name, [...byRepoName.get(name) ?? [], u.ticket.issue_id]);
-    }
-    notes.push({
-      level: "info",
-      message: `${elsewhere.length} verified ticket(s) belong to a repository this ship has no checkout for \u2014 another ship releases them: ` + [...byRepoName].map(([n, ids]) => `${n} (${ids.join(", ")})`).join("; ")
-    });
-  }
-  return notes;
+// src/doctor-fix.ts
+import { parseDocument as parseDocument2 } from "yaml";
+
+// src/repos-cmd.ts
+import { homedir as homedir9 } from "os";
+import { basename as basename8, join as join29, resolve as resolve3 } from "path";
+import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
+var ReposError = class extends Error {
+};
+function normalizeRemote(url) {
+  if (!url) return void 0;
+  let s = url.trim();
+  if (!s) return void 0;
+  const scp = /^[^\s@/]+@[^\s:/]+:(.+)$/.exec(s);
+  if (scp) s = scp[1];
+  else s = s.replace(/^[a-z][a-z0-9+.-]*:\/\/(?:[^/@]+@)?[^/]+\//i, "");
+  s = s.replace(/\/+$/, "").replace(/\.git$/i, "");
+  const parts = s.split("/").filter(Boolean);
+  if (parts.length < 2) return void 0;
+  return parts.slice(-2).join("/").toLowerCase();
 }
-var unplaceableReported = /* @__PURE__ */ new Set();
-function reportUnplaceable(routeName, unplaceable, verified, emit) {
-  if (unplaceableReported.has(routeName)) return;
-  unplaceableReported.add(routeName);
-  for (const note of describeUnplaceable(unplaceable, verified)) {
-    if (note.level === "warn") emit.warn(note.message, { step: "release" });
-    else emit.emit(note.message, { step: "release" });
+function matchRepoName(origin, resolved) {
+  const want = normalizeRemote(origin);
+  if (!want || !resolved?.repoRemotes) return void 0;
+  for (const [id, remote] of Object.entries(resolved.repoRemotes)) {
+    if (normalizeRemote(remote) === want) return resolved.repoNames?.[id];
   }
+  return void 0;
 }
-function checkGuards(cwd, base = "main") {
-  const branch = currentBranch(cwd);
-  if (branch !== base) {
-    return { kind: "branch", detail: `primary checkout is on '${branch}', not ${base}` };
+function routeNamesOf(text) {
+  const routes = parseDocument(text).get("routes", true);
+  if (!isSeq(routes)) return [];
+  return routes.items.flatMap((i) => isMap(i) && typeof i.get("route") === "string" ? [i.get("route")] : []);
+}
+function parseAddArgs(args, routes, isDir) {
+  const rest = [...args];
+  let route2;
+  if (rest.length > 0 && routes.includes(rest[0])) route2 = rest.shift();
+  else if (rest.length > 0 && /^[^/\s]+\/[^/\s]+$/.test(rest[0]) && !isDir(rest[0])) {
+    throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
   }
-  const changes = status(cwd);
-  if (changes.length === 0) return null;
-  const untracked = changes.filter((c) => c.untracked).length;
-  const names = changes.slice(0, 3).map((c) => c.path).join(", ");
-  const more = changes.length > 3 ? `, +${changes.length - 3} more` : "";
-  const untrackedNote = untracked > 0 ? ` (${untracked} untracked)` : "";
-  return {
-    kind: "dirty",
-    detail: `working tree has ${changes.length} change(s)${untrackedNote}: ${names}${more}`
-  };
+  if (!route2) {
+    if (routes.length === 1) route2 = routes[0];
+    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
+  }
+  if (rest.length > 2) throw new ReposError("too many arguments: expected [route] [name] [path]");
+  if (rest.length === 2) return { route: route2, name: rest[0], path: rest[1] };
+  if (rest.length === 1) return isDir(rest[0]) ? { route: route2, path: rest[0] } : { route: route2, name: rest[0], path: "." };
+  return { route: route2, path: "." };
 }
-function heldByBlockers(tickets, verifiedStatus, info) {
-  if (!info) return [];
-  return tickets.filter((t) => t.status === verifiedStatus && unresolvedBlockers(t, info, { mergeGated: false }).length > 0).map((ticket) => ({ ticket, blockers: describeUnresolved(ticket, info, { mergeGated: false }) }));
+function expandDir(p, base) {
+  const home = p === "~" ? homedir9() : p.startsWith("~/") ? `${homedir9()}/${p.slice(2)}` : p;
+  return resolve3(base, home);
 }
-var describeHeld = (held) => held.map((h) => `${h.ticket.issue_tag ?? h.ticket.issue_id} held: blocked by ${h.blockers}`);
-var CHANGELOG_LINE = /^Changelog:[ \t]*(.*)$/gm;
-var TICKET_REF_AT_START = /^([A-Z][A-Z0-9]*)-(\d+)\b/;
-function dedupeChangelogEntries(entries, ticket) {
-  const own = (ticket.issue_tag ?? ticket.issue_id).match(/^([A-Z][A-Z0-9]*)-(\d+)$/);
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const raw of entries) {
-    let line = raw.trim();
-    const ref = line.match(TICKET_REF_AT_START);
-    let key = line;
-    if (ref) {
-      const prefix = ref[1];
-      const num = ref[2];
-      const canonical = own && own[2] === num ? own[1] : prefix;
-      line = `${canonical}-${num}${line.slice(ref[0].length)}`;
-      key = `${canonical}-${num}`;
+function routeMapOf(doc, route2) {
+  const routes = doc.get("routes", true);
+  if (isSeq(routes)) {
+    for (const item of routes.items) {
+      if (isMap(item) && item.get("route") === route2) return item;
     }
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(line);
   }
-  return out;
-}
-var BUMP_LINE = /^Bump:[ \t]*(major|minor|patch)\b/gim;
-function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => branchForIssue(cwd, t.issue_id), base = "main", blockerInfo, ref = "HEAD") {
-  const held = new Set(heldByBlockers(tickets, contract.statuses.verified, blockerInfo).map((h) => h.ticket.id));
-  const verified = tickets.filter((t) => t.status === contract.statuses.verified && !held.has(t.id)).sort((a, b) => Number.parseInt(a.issue_id.replace(/^\D+/, ""), 10) - Number.parseInt(b.issue_id.replace(/^\D+/, ""), 10));
-  return verified.map((ticket) => {
-    const branch = branchFor(ticket);
-    if (!branch) {
-      const keys = referenceKeys(ticket);
-      const unreleased = lastReleased ? findKeyInRange(cwd, keys, `${lastReleased}..${ref}`) : null;
-      if (unreleased) {
-        return {
-          ticket,
-          branch: null,
-          entries: [],
-          usedFallback: false,
-          bump: "patch",
-          majorRequested: false,
-          skipReason: "already-merged"
-        };
-      }
-      const anywhere = findKeyInRange(cwd, keys, ref);
-      if (anywhere) {
-        return {
-          ticket,
-          branch: null,
-          entries: [],
-          usedFallback: false,
-          bump: "patch",
-          majorRequested: false,
-          skipReason: lastReleased ? "already-released" : "already-merged",
-          mergedSha: anywhere
-        };
-      }
-      return {
-        ticket,
-        branch: null,
-        entries: [],
-        usedFallback: false,
-        bump: "patch",
-        majorRequested: false,
-        skipReason: "never-built"
-      };
-    }
-    const squash = findSquashOfBranch(cwd, referenceKeys(ticket), branch, base, base);
-    if (squash) {
-      const released = !!lastReleased && isAncestor(cwd, squash, lastReleased);
-      return {
-        ticket,
-        branch,
-        entries: [],
-        usedFallback: false,
-        bump: "patch",
-        majorRequested: false,
-        skipReason: released ? "already-released" : "already-merged",
-        mergedSha: squash
-      };
-    }
-    const bodies = commitBodies(cwd, `${base}..${branch}`);
-    const entries = dedupeChangelogEntries(
-      [...bodies.matchAll(CHANGELOG_LINE)].map((m) => m[1].trim()).filter(Boolean),
-      ticket
-    );
-    const usedFallback = entries.length === 0;
-    const { size, majorRequested } = requestedBump(bodies);
-    return {
-      ticket,
-      branch,
-      entries: usedFallback ? [`${ticket.title || ticket.issue_id} (${ticket.issue_id})`] : entries,
-      usedFallback,
-      bump: size,
-      majorRequested
-    };
-  });
+  const have = isSeq(routes) ? routes.items.map((i) => isMap(i) ? String(i.get("route")) : "?").join(", ") : "none";
+  throw new ReposError(`no route "${route2}" in the config (have: ${have})`);
 }
-function planReleasedBranches(cwd, tickets, contract, branchFor, base = "main", tagPattern = "v*") {
-  const eligible = /* @__PURE__ */ new Set([contract.statuses.building, contract.statuses.needsHuman]);
-  const out = [];
-  for (const ticket of tickets) {
-    if (!eligible.has(ticket.status)) continue;
-    const branch = branchFor(ticket);
-    if (!branch) continue;
-    const sha = findSquashByBranchTip(cwd, referenceKeys(ticket), branch, base);
-    if (!sha) continue;
-    const tag = firstReleaseTagContaining(cwd, sha, tagPattern);
-    if (tag) out.push({ ticket, sha, tag });
+function configuredRepos(text, route2, base) {
+  const doc = parseDocument(text);
+  const m = routeMapOf(doc, route2);
+  const repos = m.get("repos");
+  if (isMap(repos)) {
+    return repos.items.map((p) => {
+      const name = String(p.key.value ?? p.key);
+      const v = p.value;
+      const dir2 = isMap(v) ? String(v.get("dir") ?? "") : String(v?.value ?? "");
+      return { name, dir: expandDir(dir2, base) };
+    });
   }
-  return out;
+  const dir = m.get("dir");
+  return dir ? [{ name: basename8(String(dir)), dir: expandDir(String(dir), base) }] : [];
 }
-function requestedBump(bodies) {
-  const asks = [...bodies.matchAll(BUMP_LINE)].map((m) => m[1].toLowerCase());
-  const majorRequested = asks.includes("major");
-  const size = asks.includes("minor") || majorRequested ? "minor" : "patch";
-  return { size, majorRequested };
+function cloneBaseOf(text, route2, base, isCheckout) {
+  const m = routeMapOf(parseDocument(text), route2);
+  const repos = m.get("repos", true);
+  if (isMap(repos) && repos.items.length > 0) return null;
+  const dir = m.get("dir");
+  if (!dir) return null;
+  const abs = expandDir(String(dir), base);
+  return isCheckout(abs) ? null : abs;
+}
+function routeSetsHooks(text, route2, name) {
+  const m = routeMapOf(parseDocument(text), route2);
+  const repos = m.get("repos", true);
+  let target = m;
+  if (isMap(repos)) target = repos.get(name, true);
+  if (!isMap(target)) return false;
+  const hooks = target.get("hooks", true);
+  return isMap(hooks) && hooks.items.length > 0;
+}
+function listRepoRows(i) {
+  const cloneBase = i.isCheckout ? cloneBaseOf(i.text, i.route, i.base, i.isCheckout) : null;
+  const checkouts = configuredRepos(i.text, i.route, i.base).filter((c) => c.dir !== cloneBase);
+  const claimed = /* @__PURE__ */ new Set();
+  const hooksSourceOf = (c) => i.exists(c.dir) && i.repoHasHooks(c.dir) ? "repo" : routeSetsHooks(i.text, i.route, c.name) ? "route" : "none";
+  const originFor = (c, remote) => {
+    const o = i.originOf(c.dir) ?? null;
+    if (!o) return null;
+    return remote !== null && normalizeRemote(o) === normalizeRemote(remote) ? null : o;
+  };
+  const rows = [];
+  const names = i.resolved?.repoNames ?? {};
+  const remotes = i.resolved?.repoRemotes ?? {};
+  for (const [id, name] of Object.entries(names)) {
+    const remote = remotes[id] ?? null;
+    const want = normalizeRemote(remote);
+    let idx = checkouts.findIndex((c2, n) => !claimed.has(n) && want !== void 0 && normalizeRemote(i.originOf(c2.dir)) === want);
+    if (idx < 0) idx = checkouts.findIndex((c2, n) => !claimed.has(n) && c2.name === name);
+    const c = idx >= 0 ? checkouts[idx] : void 0;
+    if (idx >= 0) claimed.add(idx);
+    rows.push({
+      name,
+      remote,
+      repoRowId: id,
+      attached: c !== void 0,
+      dir: c?.dir ?? null,
+      exists: c ? i.exists(c.dir) : false,
+      origin: c ? originFor(c, remote) : null,
+      matchedRow: c ? name : null,
+      hooksSource: c ? hooksSourceOf(c) : "none"
+    });
+  }
+  checkouts.forEach((c, n) => {
+    if (claimed.has(n)) return;
+    rows.push({
+      name: c.name,
+      remote: null,
+      repoRowId: null,
+      attached: true,
+      dir: c.dir,
+      exists: i.exists(c.dir),
+      origin: originFor(c, null),
+      matchedRow: null,
+      hooksSource: hooksSourceOf(c)
+    });
+  });
+  return rows;
+}
+function planRepoAdd(i) {
+  const doc = parseDocument(i.text);
+  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
+  const m = routeMapOf(doc, i.route);
+  let existing = configuredRepos(i.text, i.route, i.base);
+  const target = expandDir(i.path, i.base);
+  let droppedDir;
+  const placeholder = m.get("dir");
+  const reposNow = m.get("repos", true);
+  if (i.isCheckout && placeholder && !(isMap(reposNow) && reposNow.items.length > 0)) {
+    const placeholderDir = expandDir(String(placeholder), i.base);
+    if (placeholderDir !== target && !i.isCheckout(placeholderDir)) {
+      droppedDir = placeholderDir;
+      m.delete("dir");
+      existing = [];
+    }
+  }
+  if (existing.some((e) => e.dir === target)) {
+    throw new ReposError(`${target} is already configured on route ${i.route}`);
+  }
+  const matched = matchRepoName(i.origin, i.resolved);
+  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename8(target);
+  let warning;
+  if (!matched) {
+    const known = Object.values(i.resolved?.repoNames ?? {});
+    warning = i.origin ? `the tracker has no Repos row for remote ${normalizeRemote(i.origin) ?? i.origin}${known.length ? ` (known: ${known.join(", ")})` : ""} \u2014 added anyway; create the row so ticket routing can find it` : "this checkout has no origin remote, so it cannot be matched to a Repos row \u2014 added anyway";
+  }
+  const repos = m.get("repos", true);
+  let mode;
+  if (isMap(repos)) {
+    if (repos.has(name)) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${String(repos.get(name))})`);
+    repos.set(name, target);
+    mode = "repos";
+  } else if (m.has("dir") && existing.length > 0) {
+    const old = existing[0];
+    const oldName = i.nameForExisting?.(old.dir) ?? old.name;
+    if (oldName === name) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${old.dir})`);
+    const oldDir = String(m.get("dir"));
+    const pair = m.items.find((p) => p.key.value === "dir");
+    pair.key = doc.createNode("repos");
+    pair.value = doc.createNode({ [oldName]: oldDir, [name]: target });
+    mode = "repos";
+  } else if (droppedDir) {
+    m.set("repos", doc.createNode({ [name]: target }));
+    mode = "repos";
+  } else {
+    m.set("dir", target);
+    mode = "dir";
+  }
+  return { text: String(doc), mode, name, block: renderBlock(m), warning, unmatched: !matched, droppedDir };
+}
+function planRepoRemove(text, base, route2, path) {
+  const doc = parseDocument(text);
+  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
+  const m = routeMapOf(doc, route2);
+  const target = expandDir(path, base);
+  const existing = configuredRepos(text, route2, base);
+  const hit = existing.find((e) => e.dir === target);
+  if (!hit) throw new ReposError(`${target} is not configured on route ${route2}`);
+  const repos = m.get("repos", true);
+  if (isMap(repos)) {
+    repos.delete(hit.name);
+    const left = existing.filter((e) => e !== hit);
+    if (left.length === 1) {
+      const pair = m.items.find((p) => p.key.value === "repos");
+      pair.key = doc.createNode("dir");
+      pair.value = doc.createNode(String(repos.get(left[0].name)));
+    } else if (left.length === 0) m.delete("repos");
+  } else {
+    m.delete("dir");
+  }
+  return { text: String(doc), name: hit.name };
+}
+function renderBlock(m) {
+  return stringify2([m.toJSON()]).trimEnd();
+}
+var LOCAL_RELEASE_MODES = /* @__PURE__ */ new Set(["integrate", "external"]);
+function planRepoRow(i) {
+  const remote = normalizeRemote(i.origin);
+  if (!remote) throw new ReposError(`cannot derive an owner/repo from origin "${i.origin}"`);
+  const mode = i.spec?.releaseMode;
+  return {
+    name: i.name,
+    remote,
+    platform: i.spec?.platform ?? "unix",
+    release_mode: mode ? LOCAL_RELEASE_MODES.has(mode) ? "local" : mode : "local",
+    ci_provider: i.spec?.ciProvider ?? "none",
+    enabled: true,
+    project_id: i.projectId
+  };
+}
+function resolveRepoProject(projects, opt, routeAreaId) {
+  if (opt) {
+    const want = opt.toLowerCase();
+    const hit = projects.find((p) => p.id === opt || p.name?.toLowerCase() === want);
+    if (!hit) throw new ReposError(`no Projects row "${opt}" (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"})`);
+    return hit.id;
+  }
+  if (routeAreaId) return routeAreaId;
+  if (projects.length === 1) return projects[0].id;
+  throw new ReposError(
+    `cannot tell which project the new Repos row belongs to \u2014 pass --project <name> (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"}), or --no-create to skip creating it`
+  );
+}
+function parseCloneArgs(args, routes) {
+  const rest = [...args];
+  let route2;
+  if (rest.length > 1 && routes.includes(rest[0])) route2 = rest.shift();
+  else if (rest.length > 1) throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
+  if (!route2) {
+    if (routes.length === 1) route2 = routes[0];
+    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
+  }
+  if (rest.length !== 1) throw new ReposError("expected [route] <name> \u2014 the Repos row to clone (see `crew repos list`)");
+  return { route: route2, name: rest[0] };
+}
+function planRepoClone(i) {
+  const names = i.resolved?.repoNames ?? {};
+  const id = Object.keys(names).find((k) => names[k].toLowerCase() === i.name.toLowerCase());
+  if (!id) {
+    const known = Object.values(names);
+    throw new ReposError(`the tracker has no Repos row named "${i.name}" for route ${i.route}${known.length ? ` (known: ${known.join(", ")})` : " \u2014 run `crew connect` to refresh them"}`);
+  }
+  const name = names[id];
+  const remote = normalizeRemote(i.resolved?.repoRemotes?.[id]);
+  if (!remote) {
+    throw new ReposError(
+      `the Repos row "${name}" has no remote to clone from \u2014 attach an existing checkout with \`crew repos add ${i.route} ${name} <path>\`, or set the row's remote in the tracker and re-run \`crew connect\``
+    );
+  }
+  const doc = parseDocument(i.text);
+  const m = routeMapOf(doc, i.route);
+  const existing = configuredRepos(i.text, i.route, i.base);
+  if (existing.some((e) => e.name.toLowerCase() === name.toLowerCase())) {
+    throw new ReposError(`route ${i.route} already has a checkout named "${name}" \u2014 nothing to clone`);
+  }
+  const ship = doc.get("ship", true);
+  const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
+  const target = i.dir ? expandDir(i.dir, i.base) : join29(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
+  return { ...add, remote, target };
+}
+
+// src/doctor-fix.ts
+var sound = (r) => r.hasRepos && r.problems.length === 0;
+function planFix(f) {
+  const actions = [];
+  const notes = [];
+  for (const r of f.routes) {
+    if (!r.enabled && sound(r)) {
+      actions.push({ kind: "enable", route: r.route });
+      const gaps = r.readiness ?? [];
+      if (gaps.length) {
+        notes.push(`${r.route}: ${gaps.length} release-readiness gap${gaps.length === 1 ? "" : "s"} (${gaps[0]}${gaps.length > 1 ? ", ..." : ""}) \u2014 the route will run, but releases stop at the first missing hook until it is added`);
+      }
+    } else if (!sound(r) && !r.enabled) {
+      notes.push(`${r.route}: not enabled \u2014 ${r.hasRepos ? r.problems[0] : "no checkout is configured"}`);
+    }
+  }
+  if (f.schedulerAbsent && f.routes.some(sound)) {
+    if (f.host === "windows") notes.push("scheduler support is not built for Windows yet \u2014 nothing to install; run `crew run` by hand");
+    else actions.push({ kind: "install" });
+  }
+  return { actions, notes };
+}
+async function gatherHealth(c, check) {
+  let problems;
+  let readiness = [];
+  try {
+    const r = await check();
+    if (Array.isArray(r)) problems = r;
+    else ({ problems, readiness } = r);
+  } catch (e) {
+    problems = [`checks could not run: ${e instanceof Error ? e.message : String(e)}`];
+  }
+  return { route: c.route, enabled: c.enabled, hasRepos: c.hasRepos, problems, readiness };
+}
+function routesInScope(routes, named) {
+  return named ? routes.filter((r) => r.route === named) : routes;
+}
+function planEnable(text, route2) {
+  const doc = parseDocument2(text);
+  routeMapOf(doc, route2).set("enabled", true);
+  return String(doc);
+}
+function schedulerInstalled(plan, exists, crontab) {
+  if (plan.mechanism === "cron") return plan.cronMarker !== null && crontab.includes(plan.cronMarker);
+  return plan.unitPaths.length > 0 && plan.unitPaths.every(exists);
+}
+
+// src/provision.ts
+var PROVISION_EXIT = { ok: 0, failed: 1, problem: 2, choice: 3 };
+function parseEvents(stdout) {
+  const out = [];
+  for (const line of stdout.split("\n")) {
+    const t = line.trim();
+    if (!t.startsWith("{")) continue;
+    try {
+      out.push(JSON.parse(t));
+    } catch {
+    }
+  }
+  return out;
+}
+async function runProvision(o, deps, write, human) {
+  const summary = { ok: false, state: "failed", changed: false, routes: [], forges: [] };
+  const emit = (event, message, data = {}) => {
+    if (o.json) write(`${JSON.stringify({ ...data, event, message })}
+`);
+    else human(`${message}
+`);
+  };
+  const fail = (code, message, data = {}) => {
+    emit("problem", message, data);
+    return { code, summary: { ...summary, ok: false, state: "failed" } };
+  };
+  if (!o.key) return fail(PROVISION_EXIT.problem, "no connect key: pass --key or set CREW_CONNECT_KEY", { stage: "input" });
+  if (o.routes.length === 0) {
+    return fail(PROVISION_EXIT.problem, "no routes to serve: pass --route WORKSPACE[/PROJECT] (repeatable) or set CREW_PROVISION_ROUTES", { stage: "input" });
+  }
+  for (const host of o.forgeHosts) {
+    if (!o.tokens[host]) return fail(PROVISION_EXIT.problem, `no token for forge ${host}: set CREW_FORGE_TOKEN or CREW_FORGE_TOKEN_${envKey(host)}`, { stage: "input" });
+  }
+  const shipName2 = o.shipName ?? deps.defaultShipName();
+  summary.ship = shipName2;
+  const routeNames = [];
+  for (const route2 of o.routes) {
+    const args = [
+      "connect",
+      route2,
+      "--json",
+      "--no-wizard",
+      "--ship-name",
+      shipName2,
+      ...o.agentBin ? ["--agent-bin", o.agentBin] : [],
+      ...o.extraPath ? ["--extra-path", o.extraPath] : [],
+      ...o.baseUrl ? ["--base-url", o.baseUrl] : [],
+      ...o.dryRun ? ["--dry-run"] : [],
+      ...o.choices.flatMap((c) => ["--choose", c])
+    ];
+    const res = deps.crew(args, { env: { CREW_CONNECT_KEY: o.key } });
+    const events = parseEvents(res.stdout);
+    for (const e of events) if (o.json) write(`${JSON.stringify({ ...e, phase: "connect" })}
+`);
+    if (res.status !== 0) {
+      const problem = events.find((e) => e.event === "problem");
+      const msg = String(problem?.message ?? (res.stderr.trim().split("\n").pop() || `crew connect ${route2} exited ${res.status}`));
+      if (!o.json) human(`crew provision: connect ${route2}: ${msg}
+`);
+      return { code: res.status === PROVISION_EXIT.choice ? PROVISION_EXIT.choice : res.status, summary: { ...summary, ok: false, state: "failed" } };
+    }
+    const done = events.find((e) => e.event === "done");
+    const name = String(done?.route ?? route2);
+    routeNames.push(name);
+    const shipRow = events.find((e) => e.event === "ship_row");
+    if (shipRow?.action === "created") summary.changed = true;
+    if (done?.wroteConfig === true) summary.changed = true;
+    emit("connect", `connected ${name}${shipRow ? ` (ship row ${String(shipRow.action)})` : ""}`, { route: name });
+  }
+  summary.routes = routeNames;
+  if (o.dryRun) {
+    summary.ok = true;
+    summary.state = "dry-run";
+    emit("done", "dry run: connected nothing past discovery; no forge, route, unit or daemon was touched", { summary });
+    return { code: PROVISION_EXIT.ok, summary };
+  }
+  const configPath = deps.configFile();
+  if (!configPath) return fail(PROVISION_EXIT.failed, "connect finished but no crew.yaml exists", { stage: "connect" });
+  summary.configPath = configPath;
+  for (const host of o.forgeHosts) {
+    const token = o.tokens[host];
+    const stored = deps.storedToken(host);
+    if (stored === token) {
+      summary.forges.push({ host, action: "unchanged" });
+      emit("forge", `forge ${host}: token already stored`, { host, action: "unchanged" });
+      continue;
+    }
+    const sub = stored === null ? "set" : "rotate";
+    const res = deps.crew(["forge", sub, host, "--token-stdin"], { input: `${token}
+` });
+    if (res.status !== 0) return fail(PROVISION_EXIT.failed, `forge ${host}: ${res.stderr.trim() || `crew forge ${sub} exited ${res.status}`}`, { stage: "forge", host });
+    const action = sub === "set" ? "stored" : "rotated";
+    summary.forges.push({ host, action });
+    summary.changed = true;
+    emit("forge", `forge ${host}: token ${action}`, { host, action });
+  }
+  for (const route2 of routeNames) {
+    if (deps.enableRoute(route2)) {
+      summary.changed = true;
+      emit("route_enabled", `enabled route ${route2}`, { route: route2 });
+    }
+  }
+  const before = deps.installState();
+  if (before.unitsStale || !before.running || !before.lingering) {
+    const res = deps.crew(["install"]);
+    if (res.status !== 0) {
+      return fail(PROVISION_EXIT.failed, `crew install exited ${res.status}: ${(res.stderr || res.stdout).trim().split("\n").pop() ?? ""}`, { stage: "install" });
+    }
+    summary.changed = true;
+    emit("install", `installed ${before.mechanism} units`, { mechanism: before.mechanism });
+  }
+  const after = deps.installState();
+  summary.daemon = { mechanism: after.mechanism, running: after.running, lingering: after.lingering };
+  if (!after.running) {
+    return fail(PROVISION_EXIT.failed, `the ${after.mechanism} daemon unit is not running after install`, { stage: "daemon" });
+  }
+  emit("daemon", `daemon running (${after.mechanism}${after.lingering ? ", survives logout" : ", will stop at logout: lingering is off"})`, { ...summary.daemon });
+  summary.ok = true;
+  summary.state = summary.changed ? "provisioned" : "already provisioned";
+  emit("done", summary.state, { summary });
+  return { code: PROVISION_EXIT.ok, summary };
+}
+function envKey(host) {
+  return host.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function tokensFromEnv(hosts, env) {
+  const out = {};
+  for (const h of hosts) {
+    const t = env[`CREW_FORGE_TOKEN_${envKey(h)}`] ?? env.CREW_FORGE_TOKEN;
+    if (t?.trim()) out[h] = t.trim();
+  }
+  return out;
+}
+function repeated(argv2, name) {
+  const out = [];
+  for (let i = 0; i < argv2.length; i++) {
+    const a = argv2[i];
+    if (a === `--${name}`) {
+      const v = argv2[++i];
+      if (v !== void 0) out.push(v);
+    } else if (a.startsWith(`--${name}=`)) out.push(a.slice(name.length + 3));
+  }
+  return out;
+}
+function splitList(v) {
+  return (v ?? "").split(/[\s,]+/).filter(Boolean);
+}
+function provisionOptionsFrom(argv2, env) {
+  const one = (name) => repeated(argv2, name).at(-1);
+  const routes = repeated(argv2, "route");
+  const forgeFlags = repeated(argv2, "forge-host");
+  const tokenAvailable = !!env.CREW_FORGE_TOKEN?.trim() || Object.keys(env).some((k) => k.startsWith("CREW_FORGE_TOKEN_") && env[k]?.trim());
+  const forgeHosts = (forgeFlags.length ? forgeFlags : tokenAvailable ? splitList(env.CREW_FORGE_HOSTS ?? "github.com") : []).map((h) => h.toLowerCase());
+  return {
+    key: one("key") ?? env.CREW_CONNECT_KEY,
+    routes: routes.length ? routes : splitList(env.CREW_PROVISION_ROUTES),
+    shipName: one("ship-name") ?? env.CREW_SHIP_NAME,
+    agentBin: one("agent-bin"),
+    extraPath: one("extra-path"),
+    baseUrl: one("base-url"),
+    forgeHosts,
+    tokens: tokensFromEnv(forgeHosts, env),
+    json: argv2.includes("--json"),
+    dryRun: argv2.includes("--dry-run"),
+    choices: repeated(argv2, "choose")
+  };
+}
+function realProvisionDeps(crewHome) {
+  const spawnCrew = (args, o = {}) => {
+    const [bin, ...pre] = crewInvocation(crewHome);
+    const env = { ...process.env, ...o.env };
+    delete env.CREW_FORGE_TOKEN;
+    const res = spawnSync6(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
+    return { status: res.status ?? 1, stdout: res.stdout ?? "", stderr: `${res.stderr ?? ""}${res.error ? String(res.error) : ""}` };
+  };
+  const configFile = () => {
+    const f = findConfigFile(crewHome);
+    return existsSync25(f) ? f : null;
+  };
+  return {
+    crew: spawnCrew,
+    configFile,
+    enableRoute(route2) {
+      const file = configFile();
+      if (!file) return false;
+      const text = readFileSync23(file, "utf8");
+      const doc = parseDocument3(text);
+      const routes = doc.get("routes");
+      const entry = routes?.items?.find((r) => r.get("route") === route2);
+      if (!entry) throw new Error(`route ${route2} is not in ${file}`);
+      if (entry.get("enabled") === true) return false;
+      writeFileSync19(file, planEnable(text, route2));
+      return true;
+    },
+    installState() {
+      const file = configFile();
+      const cfg = loadConfig(crewHome, file ?? void 0, { allowNoRoutes: true });
+      const host = hostPlatform();
+      const ctx = installContext();
+      const systemd = detectSystemd();
+      const jobs = ["run", "release", "passengers"];
+      let unitsStale = false;
+      let mechanism = "none";
+      for (const job of jobs) {
+        const plan = planInstall(cfg.ship, crewHome, host, systemd, job, ctx);
+        mechanism = plan.mechanism;
+        if (plan.mechanism === "cron") {
+          unitsStale = true;
+          continue;
+        }
+        for (const p of plan.unitPaths) {
+          if (!existsSync25(p) || readFileSync23(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+        }
+      }
+      const label = labelFor(crewHome, "run");
+      let running = false;
+      let lingering = true;
+      if (mechanism === "systemd") {
+        const system = ctx.root || existsSync25(systemUnitPathFor(label));
+        const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
+        running = spawnSync6(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
+        if (!system) {
+          const out = spawnSync6("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
+          lingering = /Linger=yes/.test(out.stdout ?? "");
+        }
+      } else if (mechanism === "cron") {
+        running = true;
+      } else if (mechanism === "launchd") {
+        running = spawnSync6("launchctl", ["list", label]).status === 0;
+      }
+      return { mechanism, unitsStale, running, lingering };
+    },
+    storedToken(host) {
+      const res = spawnCrew(["credential", "get"], { input: `protocol=https
+host=${host}
+
+` });
+      const m = /^password=(.*)$/m.exec(res.stdout);
+      return m ? m[1] : null;
+    },
+    defaultShipName: () => hostname2()
+  };
+}
+
+// src/release-run.ts
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync20, existsSync as existsSync26, copyFileSync, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, rmSync as rmSync14 } from "fs";
+import { dirname as dirname14, join as join30 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+
+// src/release.ts
+function describeUnplaceable(unplaceable, verifiedStatus) {
+  const stranded = unplaceable.filter((u) => u.ticket.status === verifiedStatus);
+  if (stranded.length === 0) return [];
+  const notes = [];
+  const keysFor = (r) => stranded.filter((u) => u.reason === r).map((u) => u.ticket.issue_id);
+  const noRepo = keysFor("no-repo");
+  if (noRepo.length) {
+    notes.push({
+      level: "warn",
+      message: `${noRepo.length} verified ticket(s) name no repository and cannot be released: ` + noRepo.join(", ")
+    });
+  }
+  const unknown = keysFor("unknown-repo");
+  if (unknown.length) {
+    notes.push({
+      level: "warn",
+      message: `${unknown.length} verified ticket(s) name a repository this ship does not recognise \u2014 run \`crew connect\` to refresh its repo list: ${unknown.join(", ")}`
+    });
+  }
+  const elsewhere = stranded.filter((u) => u.reason === "not-served-here");
+  if (elsewhere.length) {
+    const byRepoName = /* @__PURE__ */ new Map();
+    for (const u of elsewhere) {
+      const name = u.repo ?? "?";
+      byRepoName.set(name, [...byRepoName.get(name) ?? [], u.ticket.issue_id]);
+    }
+    notes.push({
+      level: "info",
+      message: `${elsewhere.length} verified ticket(s) belong to a repository this ship has no checkout for \u2014 another ship releases them: ` + [...byRepoName].map(([n, ids]) => `${n} (${ids.join(", ")})`).join("; ")
+    });
+  }
+  return notes;
+}
+var unplaceableReported = /* @__PURE__ */ new Set();
+function reportUnplaceable(routeName, unplaceable, verified, emit) {
+  if (unplaceableReported.has(routeName)) return;
+  unplaceableReported.add(routeName);
+  for (const note of describeUnplaceable(unplaceable, verified)) {
+    if (note.level === "warn") emit.warn(note.message, { step: "release" });
+    else emit.emit(note.message, { step: "release" });
+  }
+}
+function checkGuards(cwd, base = "main") {
+  const branch = currentBranch(cwd);
+  if (branch !== base) {
+    return { kind: "branch", detail: `primary checkout is on '${branch}', not ${base}` };
+  }
+  const changes = status(cwd);
+  if (changes.length === 0) return null;
+  const untracked = changes.filter((c) => c.untracked).length;
+  const names = changes.slice(0, 3).map((c) => c.path).join(", ");
+  const more = changes.length > 3 ? `, +${changes.length - 3} more` : "";
+  const untrackedNote = untracked > 0 ? ` (${untracked} untracked)` : "";
+  return {
+    kind: "dirty",
+    detail: `working tree has ${changes.length} change(s)${untrackedNote}: ${names}${more}`
+  };
+}
+function heldByBlockers(tickets, verifiedStatus, info) {
+  if (!info) return [];
+  return tickets.filter((t) => t.status === verifiedStatus && unresolvedBlockers(t, info, { mergeGated: false }).length > 0).map((ticket) => ({ ticket, blockers: describeUnresolved(ticket, info, { mergeGated: false }) }));
+}
+var describeHeld = (held) => held.map((h) => `${h.ticket.issue_tag ?? h.ticket.issue_id} held: blocked by ${h.blockers}`);
+var CHANGELOG_LINE = /^Changelog:[ \t]*(.*)$/gm;
+var TICKET_REF_AT_START = /^([A-Z][A-Z0-9]*)-(\d+)\b/;
+function dedupeChangelogEntries(entries, ticket) {
+  const own = (ticket.issue_tag ?? ticket.issue_id).match(/^([A-Z][A-Z0-9]*)-(\d+)$/);
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of entries) {
+    let line = raw.trim();
+    const ref = line.match(TICKET_REF_AT_START);
+    let key = line;
+    if (ref) {
+      const prefix = ref[1];
+      const num = ref[2];
+      const canonical = own && own[2] === num ? own[1] : prefix;
+      line = `${canonical}-${num}${line.slice(ref[0].length)}`;
+      key = `${canonical}-${num}`;
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(line);
+  }
+  return out;
+}
+var BUMP_LINE = /^Bump:[ \t]*(major|minor|patch)\b/gim;
+function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => branchForIssue(cwd, t.issue_id), base = "main", blockerInfo, ref = "HEAD") {
+  const held = new Set(heldByBlockers(tickets, contract.statuses.verified, blockerInfo).map((h) => h.ticket.id));
+  const verified = tickets.filter((t) => t.status === contract.statuses.verified && !held.has(t.id)).sort((a, b) => Number.parseInt(a.issue_id.replace(/^\D+/, ""), 10) - Number.parseInt(b.issue_id.replace(/^\D+/, ""), 10));
+  return verified.map((ticket) => {
+    const branch = branchFor(ticket);
+    if (!branch) {
+      const keys = referenceKeys(ticket);
+      const unreleased = lastReleased ? findKeyInRange(cwd, keys, `${lastReleased}..${ref}`) : null;
+      if (unreleased) {
+        return {
+          ticket,
+          branch: null,
+          entries: [],
+          usedFallback: false,
+          bump: "patch",
+          majorRequested: false,
+          skipReason: "already-merged"
+        };
+      }
+      const anywhere = findKeyInRange(cwd, keys, ref);
+      if (anywhere) {
+        return {
+          ticket,
+          branch: null,
+          entries: [],
+          usedFallback: false,
+          bump: "patch",
+          majorRequested: false,
+          skipReason: lastReleased ? "already-released" : "already-merged",
+          mergedSha: anywhere
+        };
+      }
+      return {
+        ticket,
+        branch: null,
+        entries: [],
+        usedFallback: false,
+        bump: "patch",
+        majorRequested: false,
+        skipReason: "never-built"
+      };
+    }
+    const squash = findSquashOfBranch(cwd, referenceKeys(ticket), branch, base, base);
+    if (squash) {
+      const released = !!lastReleased && isAncestor(cwd, squash, lastReleased);
+      return {
+        ticket,
+        branch,
+        entries: [],
+        usedFallback: false,
+        bump: "patch",
+        majorRequested: false,
+        skipReason: released ? "already-released" : "already-merged",
+        mergedSha: squash
+      };
+    }
+    const bodies = commitBodies(cwd, `${base}..${branch}`);
+    const entries = dedupeChangelogEntries(
+      [...bodies.matchAll(CHANGELOG_LINE)].map((m) => m[1].trim()).filter(Boolean),
+      ticket
+    );
+    const usedFallback = entries.length === 0;
+    const { size, majorRequested } = requestedBump(bodies);
+    return {
+      ticket,
+      branch,
+      entries: usedFallback ? [`${ticket.title || ticket.issue_id} (${ticket.issue_id})`] : entries,
+      usedFallback,
+      bump: size,
+      majorRequested
+    };
+  });
+}
+function planReleasedBranches(cwd, tickets, contract, branchFor, base = "main", tagPattern = "v*") {
+  const eligible = /* @__PURE__ */ new Set([contract.statuses.building, contract.statuses.needsHuman]);
+  const out = [];
+  for (const ticket of tickets) {
+    if (!eligible.has(ticket.status)) continue;
+    const branch = branchFor(ticket);
+    if (!branch) continue;
+    const sha = findSquashByBranchTip(cwd, referenceKeys(ticket), branch, base);
+    if (!sha) continue;
+    const tag = firstReleaseTagContaining(cwd, sha, tagPattern);
+    if (tag) out.push({ ticket, sha, tag });
+  }
+  return out;
+}
+function requestedBump(bodies) {
+  const asks = [...bodies.matchAll(BUMP_LINE)].map((m) => m[1].toLowerCase());
+  const majorRequested = asks.includes("major");
+  const size = asks.includes("minor") || majorRequested ? "minor" : "patch";
+  return { size, majorRequested };
 }
 function renderChangelogSection(version, date, entries) {
   const body = entries.map((e) => `- ${e}`).join("\n");
@@ -13461,13 +14127,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join29(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join30(o.cwd, f));
   const first = files[0];
-  if (!existsSync25(first)) {
+  if (!existsSync26(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync23(first, "utf8")).version;
+  const current = JSON.parse(readFileSync24(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -13480,27 +14146,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync23(f, "utf8");
+    const src = readFileSync24(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync19(f, out);
+    writeFileSync20(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join29(o.cwd, file);
+  const path = join30(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync25(path) ? readFileSync23(path, "utf8") : "# Changelog\n";
-  writeFileSync19(path, insertChangelogSection(existing, section));
+  const existing = existsSync26(path) ? readFileSync24(path, "utf8") : "# Changelog\n";
+  writeFileSync20(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -13593,8 +14259,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join29(tmpdir3(), "crew-release-"));
-  const dir = join29(root, "checkout");
+  const root = mkdtempSync2(join30(tmpdir3(), "crew-release-"));
+  const dir = join30(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -13604,10 +14270,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join29(o.cwd, f);
-    if (!existsSync25(src)) continue;
-    mkdirSync17(dirname13(join29(dir, f)), { recursive: true });
-    copyFileSync(src, join29(dir, f));
+    const src = join30(o.cwd, f);
+    if (!existsSync26(src)) continue;
+    mkdirSync17(dirname14(join30(dir, f)), { recursive: true });
+    copyFileSync(src, join30(dir, f));
   }
   return { dir, branch, close };
 }
@@ -14308,12 +14974,12 @@ Passed: ${passed}.${willClose ? " Closing this alert." : ""}`,
 }
 
 // src/live-runs.ts
-import { existsSync as existsSync27, readdirSync as readdirSync11 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync11 } from "fs";
+import { join as join32 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync26, readdirSync as readdirSync10, readFileSync as readFileSync24 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync10, readFileSync as readFileSync25 } from "fs";
+import { join as join31 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14332,21 +14998,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync26(path)) return false;
+  if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync24(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync25(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join30(o.stateDir, "streams");
-  if (!existsSync26(dir)) return [];
+  const dir = join31(o.stateDir, "streams");
+  if (!existsSync27(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join30(dir, name);
+    const streamPath = join31(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14400,12 +15066,12 @@ async function reconcileRuns(o) {
 
 // src/live-runs.ts
 function liveRuns(stateDir, isAlive = runIsAlive) {
-  const dir = join31(stateDir, "streams");
-  if (!existsSync27(dir)) return [];
+  const dir = join32(stateDir, "streams");
+  if (!existsSync28(dir)) return [];
   const out = [];
   for (const name of readdirSync11(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join31(dir, name);
+    const streamPath = join32(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || !isAlive(sidecar)) continue;
@@ -14506,7 +15172,7 @@ function formatProjectsReport(report) {
 }
 
 // src/forge-cmd.ts
-import { parseDocument } from "yaml";
+import { parseDocument as parseDocument4 } from "yaml";
 function runCredential(action, stdin, forges, stateDir, env = process.env) {
   try {
     return { code: 0, out: answerCredential(action ?? "", parseCredentialInput(stdin), forges, stateDir, env), err: "" };
@@ -14547,7 +15213,7 @@ function runForge(a, io) {
   if (!existing) {
     const tok = sourceFromArgs(a);
     if (typeof tok === "string") return fail(tok);
-    const doc = parseDocument(io.readFile(io.configFile));
+    const doc = parseDocument4(io.readFile(io.configFile));
     doc.setIn(["ship", "forges", host, "token"], tok);
     io.writeFile(io.configFile, doc.toString());
     io.forges = { ...io.forges ?? {}, [host]: { username: "x-access-token", token: tok } };
@@ -14740,7 +15406,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync28, statSync as statSync9, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync29, statSync as statSync9, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -14841,7 +15507,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync28(file)) return { events: [], offset: from };
+  if (!existsSync29(file)) return { events: [], offset: from };
   const size = statSync9(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -15084,17 +15750,17 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync26, renameSync as renameSync3, writeFileSync as writeFileSync21 } from "fs";
-import { dirname as dirname15 } from "path";
-import { parseDocument as parseDocument2 } from "yaml";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync22 } from "fs";
+import { dirname as dirname16 } from "path";
+import { parseDocument as parseDocument5 } from "yaml";
 
 // src/machine-id.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "fs";
-import { dirname as dirname14, join as join32 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "fs";
+import { dirname as dirname15, join as join33 } from "path";
 function machineIdPathFor(stateDir) {
-  return join32(stateDir, "machine-id");
+  return join33(stateDir, "machine-id");
 }
 var sha256 = (s) => createHash5("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
@@ -15107,8 +15773,8 @@ function readRawMachineId(platform2 = process.platform) {
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync29(p)) {
-        const id = readFileSync25(p, "utf8").trim();
+      if (existsSync30(p)) {
+        const id = readFileSync26(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -15119,15 +15785,15 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync29(path)) {
-    const cached = readFileSync25(path, "utf8").trim();
+  if (existsSync30(path)) {
+    const cached = readFileSync26(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync18(dirname14(path), { recursive: true });
-  writeFileSync20(path, `${hashed}
+  mkdirSync18(dirname15(path), { recursive: true });
+  writeFileSync21(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -15156,11 +15822,11 @@ function planNameSync(local, row, lastSynced) {
   return { drift: "local", action: "push" };
 }
 function shipNameOfYaml(text) {
-  const v = parseDocument2(text).getIn(["ship", "name"]);
+  const v = parseDocument5(text).getIn(["ship", "name"]);
   return typeof v === "string" && v.trim() ? v.trim() : void 0;
 }
 function setShipNameInYaml(text, name) {
-  const doc = parseDocument2(text);
+  const doc = parseDocument5(text);
   doc.setIn(["ship", "name"], name);
   return doc.toString();
 }
@@ -15198,34 +15864,34 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync30(resolvedFile)) return void 0;
+  if (!existsSync31(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync26(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync27(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync30(resolvedFile)) return;
+  if (!existsSync31(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync26(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync27(resolvedFile, "utf8"));
   } catch {
     return;
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync19(dirname15(resolvedFile), { recursive: true });
+  mkdirSync19(dirname16(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync21(tmp, `${JSON.stringify(raw, null, 2)}
+  writeFileSync22(tmp, `${JSON.stringify(raw, null, 2)}
 `);
   renameSync3(tmp, resolvedFile);
 }
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync26(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync27(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -15249,8 +15915,8 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text = readFileSync26(i.configFile, "utf8");
-    writeFileSync21(i.configFile, setShipNameInYaml(text, result.name));
+    const text = readFileSync27(i.configFile, "utf8");
+    writeFileSync22(i.configFile, setShipNameInYaml(text, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
       i.emit?.warn(
@@ -15902,8 +16568,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, readFileSync as readFileSync27, writeFileSync as writeFileSync22 } from "fs";
-import { dirname as dirname16 } from "path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync20, readFileSync as readFileSync28, writeFileSync as writeFileSync23 } from "fs";
+import { dirname as dirname17 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -15914,519 +16580,232 @@ async function runAgentsSync(target, o) {
   try {
     personaResult = await runPersonas(readOnly);
   } catch (e) {
-    if (readOnly || !isForbidden(e)) throw e;
-    readOnly = true;
-    personaResult = await runPersonas(true);
-  }
-  o.say(`route: ${target.route}`);
-  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
-  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
-  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
-  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
-  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
-  let skillResult;
-  if (!readOnly) {
-    try {
-      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
-    } catch (e) {
-      if (isForbidden(e)) readOnly = true;
-      else throw e;
-    }
-  }
-  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
-  if (!dryRun) {
-    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync27(resolvedPath, "utf8")) : {};
-    raw.agentPersonas = personaResult.agentPersonas;
-    if (skillResult) raw.agentSkills = skillResult.agentSkills;
-    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync20(dirname16(resolvedPath), { recursive: true });
-    writeFileSync22(resolvedPath, `${JSON.stringify(raw, null, 2)}
-`);
-    if (target.resolved) {
-      target.resolved.agentPersonas = personaResult.agentPersonas;
-      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
-    }
-  }
-  if (readOnly) {
-    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
-  }
-  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
-  return { personaResult, skillResult, readOnly, diverged };
-}
-
-// src/logbook.ts
-import { createHash as createHash6 } from "crypto";
-import { TablationClient as TablationClient4 } from "@tablation/client";
-var LogbookError = class extends Error {
-};
-function client(route2, userAgent) {
-  return new TablationClient4({
-    baseUrl: `${route2.baseUrl}/api`,
-    apiKey: resolveApiKey(route2),
-    headers: { "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-  });
-}
-function requireWorkspace(route2) {
-  if (!route2.resolved) {
-    throw new LogbookError(`route "${route2.route}" has no resolved ids \u2014 run \`crew connect\` first`);
-  }
-}
-async function listLogEntries(route2, opts = {}) {
-  requireWorkspace(route2);
-  const c = client(route2, opts.userAgent);
-  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
-  const filters = [];
-  if (opts.ticket) filters.push({ columnName: "ticket_reference", operator: "EQ", value: opts.ticket });
-  if (opts.role) {
-    const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
-    const rows = await c.records.list(agentsModel.id, { limit: 200 });
-    const match = rows.find((r) => r.name.toLowerCase() === opts.role.toLowerCase());
-    if (!match) return [];
-    filters.push({ columnName: "agent_id", operator: "EQ", value: match.id });
-  }
-  const entries = await c.records.list(agentLogModel.id, {
-    limit: opts.limit ?? 20,
-    ...filters.length > 0 ? { filters: JSON.stringify(filters) } : {}
-  });
-  return [...entries].sort((a, b) => String(b.started_at ?? "").localeCompare(String(a.started_at ?? "")));
-}
-async function showLogEntry(route2, entryId, opts = {}) {
-  requireWorkspace(route2);
-  const c = client(route2, opts.userAgent);
-  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
-  let entry;
-  try {
-    entry = await c.records.get(agentLogModel.id, entryId);
-  } catch (e) {
-    throw new LogbookError(`no Agent Log entry ${entryId} in this workspace (${e.message})`);
-  }
-  if (!opts.withPrompt) return { entry, reconstruction: { status: "not_recorded", reason: "not requested" } };
-  if (!entry.agent_id || !entry.prompt_version) {
-    return {
-      entry,
-      reconstruction: {
-        status: "not_recorded",
-        reason: !entry.agent_id ? "this entry has no linked Agents row (predates crew agents sync being run for its role)" : "this entry predates ISSUE-377/529 \u2014 no prompt_version was recorded"
-      }
-    };
-  }
-  const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
-  let historyEntries;
-  try {
-    historyEntries = await fetchHistoryEntries(route2, agentsModel.id, entry.agent_id, opts.userAgent, 200);
-  } catch (e) {
-    return { entry, reconstruction: { status: "approximate", reason: `history lookup failed: ${e.message}` } };
-  }
-  const match = historyEntries.find((h) => h.history_id === entry.prompt_version);
-  if (!match) {
-    return {
-      entry,
-      reconstruction: {
-        status: "approximate",
-        reason: `history entry ${entry.prompt_version} no longer exists on the Agents row (purged, or the row itself was recreated)`
-      }
-    };
-  }
-  const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
-  const actualSha = createHash6("sha256").update(prompt).digest("hex");
-  const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
-  return {
-    entry,
-    reconstruction: {
-      status: exact ? "exact" : "approximate",
-      historyId: match.history_id,
-      changedAt: match.changed_at,
-      prompt,
-      ...exact ? {} : { reason: entry.prompt_sha ? "stored prompt_sha does not match this history entry's content" : "this entry recorded no prompt_sha to verify against" }
-    }
-  };
-}
-
-// src/repos-check.ts
-import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync28 } from "fs";
-import { basename as basename8 } from "path";
-var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
-function checkHookSyntax(script, shell) {
-  const spec = resolveShell(shell);
-  const name = basename8(spec.bin).replace(/\.exe$/i, "").toLowerCase();
-  let run2;
-  if (POSIX_SHELL.test(name)) {
-    run2 = spawnSync6(spec.bin, ["-n"], { input: script, encoding: "utf8" });
-  } else if (/^(pwsh|powershell)$/.test(name)) {
-    const parse3 = "$e=$null;[void][System.Management.Automation.Language.Parser]::ParseInput($env:CREW_CHECK_SCRIPT,[ref]$null,[ref]$e);if($e){$e|ForEach-Object{[Console]::Error.WriteLine($_.Message)};exit 1}";
-    run2 = spawnSync6(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
-      encoding: "utf8",
-      env: { ...process.env, CREW_CHECK_SCRIPT: script }
-    });
-  } else {
-    return { status: "unchecked", message: `no syntax check for ${spec.bin}` };
-  }
-  if (run2.error) return { status: "unchecked", message: `cannot run ${spec.bin}: ${run2.error.message}` };
-  if (run2.status === 0) return { status: "ok" };
-  const message = `${run2.stderr ?? ""}${run2.stdout ?? ""}`.trim() || `${spec.bin} exited ${run2.status}`;
-  return { status: "error", message };
-}
-function renderSamples(cfg, dir) {
-  const checkout = basename8(dir.replace(/[/\\]+$/, ""));
-  const tagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", tag: "TABL-123", prefix: "tabl", lowercase: cfg.branch.lowercase };
-  const untagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", lowercase: cfg.branch.lowercase };
-  return [["with a project tag", tagged], ["without a project tag", untagged]].map(([label, ctx]) => {
-    const branch = renderBranchName(effectiveBranchTemplate(cfg, ctx.prefix), ctx);
-    const worktree = effectiveWorktreeDirName(cfg, dir, branch, "123", (t) => renderWorktreeName(t, { ...ctx, dir: checkout }));
-    return { case: label, branch, worktree };
-  });
-}
-function checkRepoSpec(dir, opts = {}) {
-  const empty = { parsed: null, effective: null, readiness: [], hooks: [], shadowed: [], samples: [] };
-  const file = findRepoConfig(dir);
-  if (!file) {
-    return { ...empty, file: null, error: `no .crew.yaml, .crew.yml or .crew.json in ${dir}`, exitCode: 1 };
-  }
-  let parsed;
-  try {
-    parsed = parseRepoConfig(readFileSync28(file, "utf8"), file);
-  } catch (e) {
-    if (!(e instanceof RepoConfigError)) throw e;
-    return { ...empty, file, error: e.message, exitCode: 1 };
-  }
-  const effective = resolveRepoConfig(parsed, opts.ship, dir);
-  const readiness = validateEffective(effective);
-  const hooks = Object.keys(effective.hooks).map((name) => ({
-    name,
-    label: hookLabel(effective, name),
-    syntax: checkHookSyntax(effective.hooks[name], effective.shell)
-  }));
-  const failed = hooks.some((h) => h.syntax.status === "error");
-  return {
-    file,
-    parsed,
-    effective,
-    readiness,
-    hooks,
-    shadowed: effective.shadowed,
-    samples: renderSamples(effective, dir),
-    error: null,
-    exitCode: failed || opts.strict && readiness.length > 0 ? 1 : 0
-  };
-}
-function renderRepoCheck(r) {
-  if (r.error) return `${r.file ?? "crew repos check"}: ${r.error}
-`;
-  const e = r.effective;
-  const lines = [
-    `${r.file}`,
-    `  platform           ${e.platform}`,
-    `  release.mode       ${e.release.mode}`,
-    `  release.versioning ${e.release.versioning}`,
-    `  branch.base        ${e.branch.base}`,
-    `  branch.name        ${e.branch.name}`,
-    `  branch.push        ${e.branch.push}`
-  ];
-  for (const s of r.samples) lines.push(`  ${s.case}: branch ${s.branch}, worktree ../${s.worktree}`);
-  lines.push(r.hooks.length ? "  hooks" : "  hooks              none");
-  for (const h of r.hooks) {
-    const named = h.label !== e.hooks[h.name] ? ` (${h.label})` : "";
-    const syntax = h.syntax.status === "ok" ? "syntax ok" : h.syntax.status === "unchecked" ? `syntax not checked: ${h.syntax.message}` : "syntax ERROR";
-    lines.push(`    ${h.name}${named}: ${syntax}`);
-    if (h.syntax.status === "error") lines.push(...(h.syntax.message ?? "").split("\n").map((l) => `      ${l}`));
-  }
-  if (r.shadowed.length) lines.push(`  this ship declares ${r.shadowed.join(", ")}, and the file overrides it \u2014 the file wins`);
-  for (const p of r.readiness) lines.push(`  - release readiness: ${p}`);
-  return `${lines.join("\n")}
-`;
-}
-
-// src/repos-hooks.ts
-import { isMap as isMap2, parseDocument as parseDocument4, YAMLMap } from "yaml";
-
-// src/repos-cmd.ts
-import { homedir as homedir9 } from "os";
-import { basename as basename9, join as join33, resolve as resolve3 } from "path";
-import { isMap, isSeq, parseDocument as parseDocument3, stringify as stringify2 } from "yaml";
-var ReposError = class extends Error {
-};
-function normalizeRemote(url) {
-  if (!url) return void 0;
-  let s = url.trim();
-  if (!s) return void 0;
-  const scp = /^[^\s@/]+@[^\s:/]+:(.+)$/.exec(s);
-  if (scp) s = scp[1];
-  else s = s.replace(/^[a-z][a-z0-9+.-]*:\/\/(?:[^/@]+@)?[^/]+\//i, "");
-  s = s.replace(/\/+$/, "").replace(/\.git$/i, "");
-  const parts = s.split("/").filter(Boolean);
-  if (parts.length < 2) return void 0;
-  return parts.slice(-2).join("/").toLowerCase();
-}
-function matchRepoName(origin, resolved) {
-  const want = normalizeRemote(origin);
-  if (!want || !resolved?.repoRemotes) return void 0;
-  for (const [id, remote] of Object.entries(resolved.repoRemotes)) {
-    if (normalizeRemote(remote) === want) return resolved.repoNames?.[id];
-  }
-  return void 0;
-}
-function routeNamesOf(text) {
-  const routes = parseDocument3(text).get("routes", true);
-  if (!isSeq(routes)) return [];
-  return routes.items.flatMap((i) => isMap(i) && typeof i.get("route") === "string" ? [i.get("route")] : []);
-}
-function parseAddArgs(args, routes, isDir) {
-  const rest = [...args];
-  let route2;
-  if (rest.length > 0 && routes.includes(rest[0])) route2 = rest.shift();
-  else if (rest.length > 0 && /^[^/\s]+\/[^/\s]+$/.test(rest[0]) && !isDir(rest[0])) {
-    throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
+    if (readOnly || !isForbidden(e)) throw e;
+    readOnly = true;
+    personaResult = await runPersonas(true);
   }
-  if (!route2) {
-    if (routes.length === 1) route2 = routes[0];
-    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
+  o.say(`route: ${target.route}`);
+  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
+  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
+  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
+  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
+  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
+  let skillResult;
+  if (!readOnly) {
+    try {
+      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
+    } catch (e) {
+      if (isForbidden(e)) readOnly = true;
+      else throw e;
+    }
   }
-  if (rest.length > 2) throw new ReposError("too many arguments: expected [route] [name] [path]");
-  if (rest.length === 2) return { route: route2, name: rest[0], path: rest[1] };
-  if (rest.length === 1) return isDir(rest[0]) ? { route: route2, path: rest[0] } : { route: route2, name: rest[0], path: "." };
-  return { route: route2, path: "." };
-}
-function expandDir(p, base) {
-  const home = p === "~" ? homedir9() : p.startsWith("~/") ? `${homedir9()}/${p.slice(2)}` : p;
-  return resolve3(base, home);
-}
-function routeMapOf(doc, route2) {
-  const routes = doc.get("routes", true);
-  if (isSeq(routes)) {
-    for (const item of routes.items) {
-      if (isMap(item) && item.get("route") === route2) return item;
+  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
+  if (!dryRun) {
+    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
+    const raw = existsSync32(resolvedPath) ? JSON.parse(readFileSync28(resolvedPath, "utf8")) : {};
+    raw.agentPersonas = personaResult.agentPersonas;
+    if (skillResult) raw.agentSkills = skillResult.agentSkills;
+    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
+    mkdirSync20(dirname17(resolvedPath), { recursive: true });
+    writeFileSync23(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+    if (target.resolved) {
+      target.resolved.agentPersonas = personaResult.agentPersonas;
+      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
     }
   }
-  const have = isSeq(routes) ? routes.items.map((i) => isMap(i) ? String(i.get("route")) : "?").join(", ") : "none";
-  throw new ReposError(`no route "${route2}" in the config (have: ${have})`);
-}
-function configuredRepos(text, route2, base) {
-  const doc = parseDocument3(text);
-  const m = routeMapOf(doc, route2);
-  const repos = m.get("repos");
-  if (isMap(repos)) {
-    return repos.items.map((p) => {
-      const name = String(p.key.value ?? p.key);
-      const v = p.value;
-      const dir2 = isMap(v) ? String(v.get("dir") ?? "") : String(v?.value ?? "");
-      return { name, dir: expandDir(dir2, base) };
-    });
+  if (readOnly) {
+    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
   }
-  const dir = m.get("dir");
-  return dir ? [{ name: basename9(String(dir)), dir: expandDir(String(dir), base) }] : [];
+  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
+  return { personaResult, skillResult, readOnly, diverged };
 }
-function cloneBaseOf(text, route2, base, isCheckout) {
-  const m = routeMapOf(parseDocument3(text), route2);
-  const repos = m.get("repos", true);
-  if (isMap(repos) && repos.items.length > 0) return null;
-  const dir = m.get("dir");
-  if (!dir) return null;
-  const abs = expandDir(String(dir), base);
-  return isCheckout(abs) ? null : abs;
+
+// src/logbook.ts
+import { createHash as createHash6 } from "crypto";
+import { TablationClient as TablationClient4 } from "@tablation/client";
+var LogbookError = class extends Error {
+};
+function client(route2, userAgent) {
+  return new TablationClient4({
+    baseUrl: `${route2.baseUrl}/api`,
+    apiKey: resolveApiKey(route2),
+    headers: { "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+  });
 }
-function routeSetsHooks(text, route2, name) {
-  const m = routeMapOf(parseDocument3(text), route2);
-  const repos = m.get("repos", true);
-  let target = m;
-  if (isMap(repos)) target = repos.get(name, true);
-  if (!isMap(target)) return false;
-  const hooks = target.get("hooks", true);
-  return isMap(hooks) && hooks.items.length > 0;
+function requireWorkspace(route2) {
+  if (!route2.resolved) {
+    throw new LogbookError(`route "${route2.route}" has no resolved ids \u2014 run \`crew connect\` first`);
+  }
 }
-function listRepoRows(i) {
-  const cloneBase = i.isCheckout ? cloneBaseOf(i.text, i.route, i.base, i.isCheckout) : null;
-  const checkouts = configuredRepos(i.text, i.route, i.base).filter((c) => c.dir !== cloneBase);
-  const claimed = /* @__PURE__ */ new Set();
-  const hooksSourceOf = (c) => i.exists(c.dir) && i.repoHasHooks(c.dir) ? "repo" : routeSetsHooks(i.text, i.route, c.name) ? "route" : "none";
-  const originFor = (c, remote) => {
-    const o = i.originOf(c.dir) ?? null;
-    if (!o) return null;
-    return remote !== null && normalizeRemote(o) === normalizeRemote(remote) ? null : o;
-  };
-  const rows = [];
-  const names = i.resolved?.repoNames ?? {};
-  const remotes = i.resolved?.repoRemotes ?? {};
-  for (const [id, name] of Object.entries(names)) {
-    const remote = remotes[id] ?? null;
-    const want = normalizeRemote(remote);
-    let idx = checkouts.findIndex((c2, n) => !claimed.has(n) && want !== void 0 && normalizeRemote(i.originOf(c2.dir)) === want);
-    if (idx < 0) idx = checkouts.findIndex((c2, n) => !claimed.has(n) && c2.name === name);
-    const c = idx >= 0 ? checkouts[idx] : void 0;
-    if (idx >= 0) claimed.add(idx);
-    rows.push({
-      name,
-      remote,
-      repoRowId: id,
-      attached: c !== void 0,
-      dir: c?.dir ?? null,
-      exists: c ? i.exists(c.dir) : false,
-      origin: c ? originFor(c, remote) : null,
-      matchedRow: c ? name : null,
-      hooksSource: c ? hooksSourceOf(c) : "none"
-    });
+async function listLogEntries(route2, opts = {}) {
+  requireWorkspace(route2);
+  const c = client(route2, opts.userAgent);
+  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
+  const filters = [];
+  if (opts.ticket) filters.push({ columnName: "ticket_reference", operator: "EQ", value: opts.ticket });
+  if (opts.role) {
+    const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
+    const rows = await c.records.list(agentsModel.id, { limit: 200 });
+    const match = rows.find((r) => r.name.toLowerCase() === opts.role.toLowerCase());
+    if (!match) return [];
+    filters.push({ columnName: "agent_id", operator: "EQ", value: match.id });
   }
-  checkouts.forEach((c, n) => {
-    if (claimed.has(n)) return;
-    rows.push({
-      name: c.name,
-      remote: null,
-      repoRowId: null,
-      attached: true,
-      dir: c.dir,
-      exists: i.exists(c.dir),
-      origin: originFor(c, null),
-      matchedRow: null,
-      hooksSource: hooksSourceOf(c)
-    });
+  const entries = await c.records.list(agentLogModel.id, {
+    limit: opts.limit ?? 20,
+    ...filters.length > 0 ? { filters: JSON.stringify(filters) } : {}
   });
-  return rows;
+  return [...entries].sort((a, b) => String(b.started_at ?? "").localeCompare(String(a.started_at ?? "")));
 }
-function planRepoAdd(i) {
-  const doc = parseDocument3(i.text);
-  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
-  const m = routeMapOf(doc, i.route);
-  let existing = configuredRepos(i.text, i.route, i.base);
-  const target = expandDir(i.path, i.base);
-  let droppedDir;
-  const placeholder = m.get("dir");
-  const reposNow = m.get("repos", true);
-  if (i.isCheckout && placeholder && !(isMap(reposNow) && reposNow.items.length > 0)) {
-    const placeholderDir = expandDir(String(placeholder), i.base);
-    if (placeholderDir !== target && !i.isCheckout(placeholderDir)) {
-      droppedDir = placeholderDir;
-      m.delete("dir");
-      existing = [];
-    }
-  }
-  if (existing.some((e) => e.dir === target)) {
-    throw new ReposError(`${target} is already configured on route ${i.route}`);
-  }
-  const matched = matchRepoName(i.origin, i.resolved);
-  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename9(target);
-  let warning;
-  if (!matched) {
-    const known = Object.values(i.resolved?.repoNames ?? {});
-    warning = i.origin ? `the tracker has no Repos row for remote ${normalizeRemote(i.origin) ?? i.origin}${known.length ? ` (known: ${known.join(", ")})` : ""} \u2014 added anyway; create the row so ticket routing can find it` : "this checkout has no origin remote, so it cannot be matched to a Repos row \u2014 added anyway";
+async function showLogEntry(route2, entryId, opts = {}) {
+  requireWorkspace(route2);
+  const c = client(route2, opts.userAgent);
+  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
+  let entry;
+  try {
+    entry = await c.records.get(agentLogModel.id, entryId);
+  } catch (e) {
+    throw new LogbookError(`no Agent Log entry ${entryId} in this workspace (${e.message})`);
   }
-  const repos = m.get("repos", true);
-  let mode;
-  if (isMap(repos)) {
-    if (repos.has(name)) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${String(repos.get(name))})`);
-    repos.set(name, target);
-    mode = "repos";
-  } else if (m.has("dir") && existing.length > 0) {
-    const old = existing[0];
-    const oldName = i.nameForExisting?.(old.dir) ?? old.name;
-    if (oldName === name) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${old.dir})`);
-    const oldDir = String(m.get("dir"));
-    const pair = m.items.find((p) => p.key.value === "dir");
-    pair.key = doc.createNode("repos");
-    pair.value = doc.createNode({ [oldName]: oldDir, [name]: target });
-    mode = "repos";
-  } else if (droppedDir) {
-    m.set("repos", doc.createNode({ [name]: target }));
-    mode = "repos";
-  } else {
-    m.set("dir", target);
-    mode = "dir";
+  if (!opts.withPrompt) return { entry, reconstruction: { status: "not_recorded", reason: "not requested" } };
+  if (!entry.agent_id || !entry.prompt_version) {
+    return {
+      entry,
+      reconstruction: {
+        status: "not_recorded",
+        reason: !entry.agent_id ? "this entry has no linked Agents row (predates crew agents sync being run for its role)" : "this entry predates ISSUE-377/529 \u2014 no prompt_version was recorded"
+      }
+    };
   }
-  return { text: String(doc), mode, name, block: renderBlock(m), warning, unmatched: !matched, droppedDir };
-}
-function planRepoRemove(text, base, route2, path) {
-  const doc = parseDocument3(text);
-  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
-  const m = routeMapOf(doc, route2);
-  const target = expandDir(path, base);
-  const existing = configuredRepos(text, route2, base);
-  const hit = existing.find((e) => e.dir === target);
-  if (!hit) throw new ReposError(`${target} is not configured on route ${route2}`);
-  const repos = m.get("repos", true);
-  if (isMap(repos)) {
-    repos.delete(hit.name);
-    const left = existing.filter((e) => e !== hit);
-    if (left.length === 1) {
-      const pair = m.items.find((p) => p.key.value === "repos");
-      pair.key = doc.createNode("dir");
-      pair.value = doc.createNode(String(repos.get(left[0].name)));
-    } else if (left.length === 0) m.delete("repos");
-  } else {
-    m.delete("dir");
+  const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
+  let historyEntries;
+  try {
+    historyEntries = await fetchHistoryEntries(route2, agentsModel.id, entry.agent_id, opts.userAgent, 200);
+  } catch (e) {
+    return { entry, reconstruction: { status: "approximate", reason: `history lookup failed: ${e.message}` } };
   }
-  return { text: String(doc), name: hit.name };
-}
-function renderBlock(m) {
-  return stringify2([m.toJSON()]).trimEnd();
-}
-var LOCAL_RELEASE_MODES = /* @__PURE__ */ new Set(["integrate", "external"]);
-function planRepoRow(i) {
-  const remote = normalizeRemote(i.origin);
-  if (!remote) throw new ReposError(`cannot derive an owner/repo from origin "${i.origin}"`);
-  const mode = i.spec?.releaseMode;
+  const match = historyEntries.find((h) => h.history_id === entry.prompt_version);
+  if (!match) {
+    return {
+      entry,
+      reconstruction: {
+        status: "approximate",
+        reason: `history entry ${entry.prompt_version} no longer exists on the Agents row (purged, or the row itself was recreated)`
+      }
+    };
+  }
+  const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
+  const actualSha = createHash6("sha256").update(prompt).digest("hex");
+  const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
   return {
-    name: i.name,
-    remote,
-    platform: i.spec?.platform ?? "unix",
-    release_mode: mode ? LOCAL_RELEASE_MODES.has(mode) ? "local" : mode : "local",
-    ci_provider: i.spec?.ciProvider ?? "none",
-    enabled: true,
-    project_id: i.projectId
+    entry,
+    reconstruction: {
+      status: exact ? "exact" : "approximate",
+      historyId: match.history_id,
+      changedAt: match.changed_at,
+      prompt,
+      ...exact ? {} : { reason: entry.prompt_sha ? "stored prompt_sha does not match this history entry's content" : "this entry recorded no prompt_sha to verify against" }
+    }
   };
 }
-function resolveRepoProject(projects, opt, routeAreaId) {
-  if (opt) {
-    const want = opt.toLowerCase();
-    const hit = projects.find((p) => p.id === opt || p.name?.toLowerCase() === want);
-    if (!hit) throw new ReposError(`no Projects row "${opt}" (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"})`);
-    return hit.id;
+
+// src/repos-check.ts
+import { spawnSync as spawnSync7 } from "child_process";
+import { readFileSync as readFileSync29 } from "fs";
+import { basename as basename9 } from "path";
+var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
+function checkHookSyntax(script, shell) {
+  const spec = resolveShell(shell);
+  const name = basename9(spec.bin).replace(/\.exe$/i, "").toLowerCase();
+  let run2;
+  if (POSIX_SHELL.test(name)) {
+    run2 = spawnSync7(spec.bin, ["-n"], { input: script, encoding: "utf8" });
+  } else if (/^(pwsh|powershell)$/.test(name)) {
+    const parse3 = "$e=$null;[void][System.Management.Automation.Language.Parser]::ParseInput($env:CREW_CHECK_SCRIPT,[ref]$null,[ref]$e);if($e){$e|ForEach-Object{[Console]::Error.WriteLine($_.Message)};exit 1}";
+    run2 = spawnSync7(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
+      encoding: "utf8",
+      env: { ...process.env, CREW_CHECK_SCRIPT: script }
+    });
+  } else {
+    return { status: "unchecked", message: `no syntax check for ${spec.bin}` };
   }
-  if (routeAreaId) return routeAreaId;
-  if (projects.length === 1) return projects[0].id;
-  throw new ReposError(
-    `cannot tell which project the new Repos row belongs to \u2014 pass --project <name> (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"}), or --no-create to skip creating it`
-  );
+  if (run2.error) return { status: "unchecked", message: `cannot run ${spec.bin}: ${run2.error.message}` };
+  if (run2.status === 0) return { status: "ok" };
+  const message = `${run2.stderr ?? ""}${run2.stdout ?? ""}`.trim() || `${spec.bin} exited ${run2.status}`;
+  return { status: "error", message };
 }
-function parseCloneArgs(args, routes) {
-  const rest = [...args];
-  let route2;
-  if (rest.length > 1 && routes.includes(rest[0])) route2 = rest.shift();
-  else if (rest.length > 1) throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
-  if (!route2) {
-    if (routes.length === 1) route2 = routes[0];
-    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
-  }
-  if (rest.length !== 1) throw new ReposError("expected [route] <name> \u2014 the Repos row to clone (see `crew repos list`)");
-  return { route: route2, name: rest[0] };
+function renderSamples(cfg, dir) {
+  const checkout = basename9(dir.replace(/[/\\]+$/, ""));
+  const tagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", tag: "TABL-123", prefix: "tabl", lowercase: cfg.branch.lowercase };
+  const untagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", lowercase: cfg.branch.lowercase };
+  return [["with a project tag", tagged], ["without a project tag", untagged]].map(([label, ctx]) => {
+    const branch = renderBranchName(effectiveBranchTemplate(cfg, ctx.prefix), ctx);
+    const worktree = effectiveWorktreeDirName(cfg, dir, branch, "123", (t) => renderWorktreeName(t, { ...ctx, dir: checkout }));
+    return { case: label, branch, worktree };
+  });
 }
-function planRepoClone(i) {
-  const names = i.resolved?.repoNames ?? {};
-  const id = Object.keys(names).find((k) => names[k].toLowerCase() === i.name.toLowerCase());
-  if (!id) {
-    const known = Object.values(names);
-    throw new ReposError(`the tracker has no Repos row named "${i.name}" for route ${i.route}${known.length ? ` (known: ${known.join(", ")})` : " \u2014 run `crew connect` to refresh them"}`);
+function checkRepoSpec(dir, opts = {}) {
+  const empty = { parsed: null, effective: null, readiness: [], hooks: [], shadowed: [], samples: [] };
+  const file = findRepoConfig(dir);
+  if (!file) {
+    return { ...empty, file: null, error: `no .crew.yaml, .crew.yml or .crew.json in ${dir}`, exitCode: 1 };
   }
-  const name = names[id];
-  const remote = normalizeRemote(i.resolved?.repoRemotes?.[id]);
-  if (!remote) {
-    throw new ReposError(
-      `the Repos row "${name}" has no remote to clone from \u2014 attach an existing checkout with \`crew repos add ${i.route} ${name} <path>\`, or set the row's remote in the tracker and re-run \`crew connect\``
-    );
+  let parsed;
+  try {
+    parsed = parseRepoConfig(readFileSync29(file, "utf8"), file);
+  } catch (e) {
+    if (!(e instanceof RepoConfigError)) throw e;
+    return { ...empty, file, error: e.message, exitCode: 1 };
   }
-  const doc = parseDocument3(i.text);
-  const m = routeMapOf(doc, i.route);
-  const existing = configuredRepos(i.text, i.route, i.base);
-  if (existing.some((e) => e.name.toLowerCase() === name.toLowerCase())) {
-    throw new ReposError(`route ${i.route} already has a checkout named "${name}" \u2014 nothing to clone`);
+  const effective = resolveRepoConfig(parsed, opts.ship, dir);
+  const readiness = validateEffective(effective);
+  const hooks = Object.keys(effective.hooks).map((name) => ({
+    name,
+    label: hookLabel(effective, name),
+    syntax: checkHookSyntax(effective.hooks[name], effective.shell)
+  }));
+  const failed = hooks.some((h) => h.syntax.status === "error");
+  return {
+    file,
+    parsed,
+    effective,
+    readiness,
+    hooks,
+    shadowed: effective.shadowed,
+    samples: renderSamples(effective, dir),
+    error: null,
+    exitCode: failed || opts.strict && readiness.length > 0 ? 1 : 0
+  };
+}
+function renderRepoCheck(r) {
+  if (r.error) return `${r.file ?? "crew repos check"}: ${r.error}
+`;
+  const e = r.effective;
+  const lines = [
+    `${r.file}`,
+    `  platform           ${e.platform}`,
+    `  release.mode       ${e.release.mode}`,
+    `  release.versioning ${e.release.versioning}`,
+    `  branch.base        ${e.branch.base}`,
+    `  branch.name        ${e.branch.name}`,
+    `  branch.push        ${e.branch.push}`
+  ];
+  for (const s of r.samples) lines.push(`  ${s.case}: branch ${s.branch}, worktree ../${s.worktree}`);
+  lines.push(r.hooks.length ? "  hooks" : "  hooks              none");
+  for (const h of r.hooks) {
+    const named = h.label !== e.hooks[h.name] ? ` (${h.label})` : "";
+    const syntax = h.syntax.status === "ok" ? "syntax ok" : h.syntax.status === "unchecked" ? `syntax not checked: ${h.syntax.message}` : "syntax ERROR";
+    lines.push(`    ${h.name}${named}: ${syntax}`);
+    if (h.syntax.status === "error") lines.push(...(h.syntax.message ?? "").split("\n").map((l) => `      ${l}`));
   }
-  const ship = doc.get("ship", true);
-  const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join33(expandDir(basePath, i.base), i.route.split("/")[0], name);
-  const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
-  return { ...add, remote, target };
+  if (r.shadowed.length) lines.push(`  this ship declares ${r.shadowed.join(", ")}, and the file overrides it \u2014 the file wins`);
+  for (const p of r.readiness) lines.push(`  - release readiness: ${p}`);
+  return `${lines.join("\n")}
+`;
 }
 
 // src/repos-hooks.ts
+import { isMap as isMap2, parseDocument as parseDocument6, YAMLMap } from "yaml";
 function packageManager(f) {
   if (f.exists("pnpm-lock.yaml")) return "pnpm";
   if (f.exists("yarn.lock")) return "yarn";
@@ -16567,7 +16946,7 @@ function repoDirOf(text, base, route2, name) {
   return hit.dir;
 }
 function planRouteHooks(text, route2, name, hooks, opts = {}) {
-  const doc = parseDocument4(text);
+  const doc = parseDocument6(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
@@ -16604,7 +16983,7 @@ function planRouteHooks(text, route2, name, hooks, opts = {}) {
   return { text: String(doc), written, kept, replaced };
 }
 function clearRouteHooks(text, route2, name) {
-  const doc = parseDocument4(text);
+  const doc = parseDocument6(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
@@ -16887,56 +17266,8 @@ function planSampleTicket(i) {
   };
 }
 
-// src/doctor-fix.ts
-import { parseDocument as parseDocument5 } from "yaml";
-var sound = (r) => r.hasRepos && r.problems.length === 0;
-function planFix(f) {
-  const actions = [];
-  const notes = [];
-  for (const r of f.routes) {
-    if (!r.enabled && sound(r)) {
-      actions.push({ kind: "enable", route: r.route });
-      const gaps = r.readiness ?? [];
-      if (gaps.length) {
-        notes.push(`${r.route}: ${gaps.length} release-readiness gap${gaps.length === 1 ? "" : "s"} (${gaps[0]}${gaps.length > 1 ? ", ..." : ""}) \u2014 the route will run, but releases stop at the first missing hook until it is added`);
-      }
-    } else if (!sound(r) && !r.enabled) {
-      notes.push(`${r.route}: not enabled \u2014 ${r.hasRepos ? r.problems[0] : "no checkout is configured"}`);
-    }
-  }
-  if (f.schedulerAbsent && f.routes.some(sound)) {
-    if (f.host === "windows") notes.push("scheduler support is not built for Windows yet \u2014 nothing to install; run `crew run` by hand");
-    else actions.push({ kind: "install" });
-  }
-  return { actions, notes };
-}
-async function gatherHealth(c, check) {
-  let problems;
-  let readiness = [];
-  try {
-    const r = await check();
-    if (Array.isArray(r)) problems = r;
-    else ({ problems, readiness } = r);
-  } catch (e) {
-    problems = [`checks could not run: ${e instanceof Error ? e.message : String(e)}`];
-  }
-  return { route: c.route, enabled: c.enabled, hasRepos: c.hasRepos, problems, readiness };
-}
-function routesInScope(routes, named) {
-  return named ? routes.filter((r) => r.route === named) : routes;
-}
-function planEnable(text, route2) {
-  const doc = parseDocument5(text);
-  routeMapOf(doc, route2).set("enabled", true);
-  return String(doc);
-}
-function schedulerInstalled(plan, exists, crontab) {
-  if (plan.mechanism === "cron") return plan.cronMarker !== null && crontab.includes(plan.cronMarker);
-  return plan.unitPaths.length > 0 && plan.unitPaths.every(exists);
-}
-
 // src/worktree-sweep.ts
-import { existsSync as existsSync32, readFileSync as readFileSync29, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync30, readdirSync as readdirSync12 } from "fs";
 import { basename as basename11, dirname as dirname19, join as join35, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -17049,7 +17380,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync32(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync33(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -17057,7 +17388,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync32(a.path)) {
+    if (!dryRun && existsSync33(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -17068,7 +17399,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync32(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync33(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -17117,7 +17448,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync29(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync30(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -17222,12 +17553,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync33, readdirSync as readdirSync13, rmSync as rmSync15, statSync as statSync10 } from "fs";
+import { existsSync as existsSync34, readdirSync as readdirSync13, rmSync as rmSync15, statSync as statSync10 } from "fs";
 import { join as join36 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join36(stateDir, "streams");
-  if (!existsSync33(dir)) return [];
+  if (!existsSync34(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync13(dir).map((name) => join36(dir, name)).filter((path) => {
     try {
@@ -17255,7 +17586,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync33(stateDir)) return [];
+  if (!existsSync34(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync13(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join36(stateDir, name)).filter((path) => {
     try {
@@ -17267,11 +17598,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync35, existsSync as existsSync40, mkdirSync as mkdirSync26, writeFileSync as writeFileSync27, rmSync as rmSync19, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync4, statSync as statSync14, readdirSync as readdirSync18 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync36, existsSync as existsSync41, mkdirSync as mkdirSync26, writeFileSync as writeFileSync28, rmSync as rmSync19, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync4, statSync as statSync14, readdirSync as readdirSync18 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync30, rmSync as rmSync16, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync21, readFileSync as readFileSync31, rmSync as rmSync16, writeFileSync as writeFileSync24 } from "fs";
 import { join as join37 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -17283,14 +17614,14 @@ function removePeriscopePrior(stateDir, ticketRecordId) {
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
     mkdirSync21(priorDir(stateDir), { recursive: true });
-    writeFileSync23(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
+    writeFileSync24(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
 }
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync34(p) ? JSON.parse(readFileSync30(p, "utf8")) : void 0;
+    return existsSync35(p) ? JSON.parse(readFileSync31(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -17780,7 +18111,7 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync31, chmodSync as chmodSync3 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync22, readFileSync as readFileSync32, chmodSync as chmodSync3 } from "fs";
 import { dirname as dirname20, join as join39 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -17790,7 +18121,7 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync35(privateKeyPath)) {
+  if (!existsSync36(privateKeyPath)) {
     mkdirSync22(dirname20(privateKeyPath), { recursive: true });
     try {
       execFileSync8("ssh-keygen", [
@@ -17811,10 +18142,10 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync35(publicKeyPath)) {
+  if (!existsSync36(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync31(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync32(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -17826,6 +18157,26 @@ function sshKeygenAvailable() {
   }
 }
 
+// src/relay-probe.ts
+async function probeRelayControl(relayUrl, apiKey, userAgent, fetchFn = fetch, timeoutMs = 1e4) {
+  const started = Date.now();
+  try {
+    const res = await fetchFn(`${relayUrl.replace(/\/+$/, "")}/control/status`, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": userAgent },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    const latencyMs = Date.now() - started;
+    await res.arrayBuffer().catch(() => void 0);
+    if (res.ok) return { ok: true, status: res.status, latencyMs };
+    return { ok: false, status: res.status, error: `HTTP ${res.status}` };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+function describeRelayProbe(url, p) {
+  return p.ok ? `relay control:     OK ${url}/control/status (${p.status}, ${p.latencyMs} ms)` : `relay control:     FAILED ${url}/control/status \u2014 ${p.error}`;
+}
+
 // src/passenger-containers.ts
 import { execFileSync as execFileSync9 } from "child_process";
 import { createHash as createHash7 } from "crypto";
@@ -18031,7 +18382,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync36, mkdirSync as mkdirSync23, readFileSync as readFileSync32, writeFileSync as writeFileSync24, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync23, readFileSync as readFileSync33, writeFileSync as writeFileSync25, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
 import { randomInt } from "crypto";
 import { join as join40 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -18043,15 +18394,21 @@ function generateTunnelSlug() {
   for (let i = 0; i < SLUG_LENGTH; i++) out += SLUG_ALPHABET[randomInt(SLUG_ALPHABET.length)];
   return out;
 }
-function bindAddrFor(o) {
-  const base = `workspace-${o.workspaceId}-slug-${o.slug}-key-${o.apiKey}`;
-  return o.mcpSecret ? `${base}-secret-${o.mcpSecret}` : base;
+function bindAddrFor(o, path) {
+  const base = `workspace-${o.workspaceId}-slug-${o.slug}${path ? `-path-${path}` : ""}-key-${o.apiKey}`;
+  return o.mcpSecret && !path ? `${base}-secret-${o.mcpSecret}` : base;
 }
-function publicUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain) {
+function relayBaseUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain) {
   const domain = relayPublicDomain ?? relayHost.replace(/^.*@/, "");
-  return `https://${slug}.${domain}${relayHttpPort === 443 ? "" : `:${relayHttpPort}`}/mcp`;
+  return `https://${slug}.${domain}${relayHttpPort === 443 ? "" : `:${relayHttpPort}`}`;
+}
+function publicUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain) {
+  return `${relayBaseUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain)}/mcp`;
 }
 function sshArgsFor(o) {
+  const forwards = [];
+  if (o.localPort !== void 0) forwards.push("-R", `${bindAddrFor(o)}:0:127.0.0.1:${o.localPort}`);
+  if (o.controlSocket) forwards.push("-R", `${bindAddrFor(o, "control")}:0:${o.controlSocket}`);
   return [
     "-N",
     "-o",
@@ -18066,8 +18423,7 @@ function sshArgsFor(o) {
     o.privateKeyPath,
     "-p",
     String(o.relayPort),
-    "-R",
-    `${bindAddrFor(o)}:0:127.0.0.1:${o.localPort}`,
+    ...forwards,
     o.relayHost
   ];
 }
@@ -18104,9 +18460,9 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync36(path)) return void 0;
+  if (!existsSync37(path)) return void 0;
   try {
-    return JSON.parse(readFileSync32(path, "utf8"));
+    return JSON.parse(readFileSync33(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -18114,7 +18470,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
   mkdirSync23(join40(stateDir, "passengers"), { recursive: true });
-  writeFileSync24(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync25(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -18138,16 +18494,19 @@ function isPidAlive(pid) {
     return false;
   }
 }
+var CONTROL_ONLY_HASH = "control-only";
 function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, stateDir, mcpSecrets = /* @__PURE__ */ new Map(), deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
   const plannedIds = new Set(plans.map((p) => p.workspaceId));
   for (const plan of plans) {
     const existing = readPersistedTunnel(stateDir, plan.workspaceId);
+    const mountsHash = plan.mountsHash ?? CONTROL_ONLY_HASH;
+    const controlUnchanged = existing?.controlSocket === deps.controlSocket;
     const currentSecret = mcpSecrets.get(plan.workspaceId);
     const secretUnchanged = (existing?.mcpSecret ?? void 0) === (currentSecret ?? void 0);
     const slug = existing?.slug ?? generateTunnelSlug();
     const slugUnchanged = existing?.liveSlug === slug;
-    if (existing && alive(existing.pid) && existing.mountsHash === plan.mountsHash && secretUnchanged && slugUnchanged) {
+    if (existing && alive(existing.pid) && existing.mountsHash === mountsHash && secretUnchanged && slugUnchanged && controlUnchanged) {
       if (existing.status === "connecting") {
         const settled = { ...existing, status: "connected" };
         writePersistedTunnel(stateDir, settled);
@@ -18174,6 +18533,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       slug,
       apiKey,
       localPort: plan.port,
+      controlSocket: deps.controlSocket,
       privateKeyPath,
       mcpSecret: currentSecret,
       spawnFn: deps.spawnFn,
@@ -18183,9 +18543,10 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
     });
     const started = {
       pid: tunnel.pid ?? -1,
-      containerName: plan.containerName,
+      containerName: plan.containerName ?? "",
       workspaceId: plan.workspaceId,
-      mountsHash: plan.mountsHash,
+      mountsHash,
+      controlSocket: deps.controlSocket,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: settledStatus,
       mcpSecret: currentSecret,
@@ -18212,7 +18573,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join40(stateDir, "passengers");
-  if (!existsSync36(dir)) return [];
+  if (!existsSync37(dir)) return [];
   return readdirSync14(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -18333,7 +18694,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn6 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync24, readFileSync as readFileSync34, writeFileSync as writeFileSync26, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
 import { join as join41 } from "path";
 
 // src/secret-compare.ts
@@ -18427,9 +18788,9 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync37(path)) return void 0;
+  if (!existsSync38(path)) return void 0;
   try {
-    return JSON.parse(readFileSync33(path, "utf8"));
+    return JSON.parse(readFileSync34(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -18437,7 +18798,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
   mkdirSync24(join41(stateDir, "passengers"), { recursive: true });
-  writeFileSync25(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync26(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -18458,7 +18819,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join41(stateDir, "passengers");
-  if (!existsSync37(dir)) return [];
+  if (!existsSync38(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync15(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -18546,7 +18907,7 @@ function describeCause(err3) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync25, readFileSync as readFileSync34, readdirSync as readdirSync16, rmSync as rmSync17, statSync as statSync12, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync25, readFileSync as readFileSync35, readdirSync as readdirSync16, rmSync as rmSync17, statSync as statSync12, writeFileSync as writeFileSync27 } from "fs";
 import { join as join42 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -18627,7 +18988,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync38(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync39(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join42(stateDir, "reload-requested");
@@ -18638,12 +18999,12 @@ function daemonStampFor(stateDir) {
 function noteDaemonStarted(stateDir, now = Date.now()) {
   mkdirSync25(stateDir, { recursive: true });
   rmSync17(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync26(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync27(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync34(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync35(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -19060,7 +19421,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       const target = repoTargetFor(route2, result.ticket.repo_id);
       ticketRepo = target?.name;
       try {
-        if (target && ensureRepoCheckout(target.dir, target.remote)) {
+        if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: ship.cloneScheme })) {
           emit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role });
         }
       } catch (e) {
@@ -19165,7 +19526,7 @@ import { createHash as createHash9 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync5,
-  existsSync as existsSync39,
+  existsSync as existsSync40,
   fstatSync,
   openSync as openSync5,
   readSync as readSync3,
@@ -19516,7 +19877,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync39(live)) {
+  if (!existsSync40(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -19673,7 +20034,7 @@ async function route(deps, method, url, req, abort) {
     const run2 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run2) || run2.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run2)) return err2(400, "not a run name");
     const file = join43(deps.stateDir, "streams", run2.endsWith(".jsonl") ? run2 : `${run2}.jsonl`);
-    if (!existsSync39(file)) return err2(404, "no such run");
+    if (!existsSync40(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -19717,7 +20078,7 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync39(path)) return false;
+  if (!existsSync40(path)) return false;
   return new Promise((resolve6) => {
     const c = createConnection(path);
     c.once("connect", () => {
@@ -19736,7 +20097,7 @@ async function startControlServer(deps) {
     return null;
   }
   if (await socketIsStale(path)) rmSync18(path, { force: true });
-  else if (existsSync39(path)) {
+  else if (existsSync40(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -19945,6 +20306,9 @@ function usage(problem, requested = false) {
   crew --version [--json]        print the crew version on one line (also: crew version); --json adds home and compiled
   crew status [route] [--json]   paused/running state; --json for a machine reader
   crew projects [--route R] [--json]   the Projects rows each route can read (id, name, prefix, work mode)
+  crew provision --key K --route WS[/PROJECT] [--forge-host H] [--ship-name N] [--json]   one non-interactive run: connect, forge tokens,
+                                 enable routes, install units with lingering, start the daemon; safe to re-run (CREW_CONNECT_KEY,
+                                 CREW_PROVISION_ROUTES, CREW_SHIP_NAME, CREW_FORGE_TOKEN[_<HOST>] also read)
   crew forge [set|rotate <host>] [--token T | --token-stdin] [--source file|keychain|env]   this ship's git-forge tokens (ship.forges)
   crew credential get|store|erase   git credential helper answering from ship.forges (git runs it; not for hand use)
   crew whoami [route] [--json]   the signed-in identity, key role, operator Crew row and credential source per route
@@ -20045,6 +20409,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "agents",
   "connect",
   "credential",
+  "provision",
   "forge",
   "daemon",
   "deploy",
@@ -20120,7 +20485,7 @@ function daemonConfigPaths(c) {
   for (const r of c.routes) if (r.apiKeyFile && !files.includes(r.apiKeyFile)) files.push(r.apiKeyFile);
   return files;
 }
-var STATE_WRITING_COMMANDS = /* @__PURE__ */ new Set(["connect", "disconnect", "install", "uninstall", "reload", "release", "merge", "deploy"]);
+var STATE_WRITING_COMMANDS = /* @__PURE__ */ new Set(["connect", "provision", "disconnect", "install", "uninstall", "reload", "release", "merge", "deploy"]);
 var STATE_WRITING_SUBCOMMANDS = {
   agents: /* @__PURE__ */ new Set(["sync"]),
   skills: /* @__PURE__ */ new Set(["sync"])
@@ -20134,6 +20499,19 @@ if (sessionRole && (STATE_WRITING_COMMANDS.has(command) || STATE_WRITING_SUBCOMM
   );
   process.exit(2);
 }
+if (command === "provision") {
+  const outcome = await runProvision(
+    provisionOptionsFrom(argv, process.env),
+    realProvisionDeps(CREW_HOME),
+    (l) => {
+      process.stdout.write(l);
+    },
+    (l) => {
+      process.stderr.write(l);
+    }
+  );
+  process.exit(outcome.code);
+}
 if (command === "passenger-sync-daemon") {
   runSyncDaemonFromEnv();
 } else {
@@ -20148,6 +20526,11 @@ if (command === "passenger-sync-daemon") {
   }, parseTicketNumber = function(input) {
     const m = /^(?:[A-Za-z]+-)?(\d+)$/.exec(input.trim());
     return m ? m[1] : null;
+  }, routeRelayUrl = function(route3) {
+    const ws = route3.resolved?.workspaceId;
+    const slug = ws ? readPersistedTunnel(cfg.ship.stateDir, ws)?.slug : void 0;
+    if (!cfg.ship.relayHost || !slug) return null;
+    return relayBaseUrlFor(slug, cfg.ship.relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain);
   }, passengerApiKeys = function(routes) {
     const keys = /* @__PURE__ */ new Map();
     for (const r of routes) {
@@ -20195,7 +20578,7 @@ if (command === "passenger-sync-daemon") {
     const unsafe = baseBranchUnsafe(out);
     return { action: out.action, unsafe, detail: unsafe ? describeUnsafeBase(out, remote, base) : out.detail };
   };
-  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, doctorMachineId2 = doctorMachineId, baseHealth2 = baseHealth;
+  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, routeRelayUrl2 = routeRelayUrl, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, doctorMachineId2 = doctorMachineId, baseHealth2 = baseHealth;
   let cfg;
   let firstRun;
   let firstRunFromFlags = false;
@@ -20211,7 +20594,7 @@ if (command === "passenger-sync-daemon") {
     };
     if (command === "connect" && !flag("sign-out") && usesFlagAnswers(wizardFlags, connectIsTTY) && shouldRunWizard({ isTTY: true, crewHome: CREW_HOME })) {
       const flagged = flagWizardAnswers(wizardFlags, {
-        hostname: hostname2(),
+        hostname: hostname3(),
         platform: hostPlatform(),
         pathEnv: process.env.PATH ?? "",
         nodePath: process.execPath,
@@ -20236,7 +20619,7 @@ if (command === "passenger-sync-daemon") {
       let answers;
       try {
         answers = await runWizard(prompter, {
-          hostname: hostname2(),
+          hostname: hostname3(),
           platform: hostPlatform(),
           pathEnv: process.env.PATH ?? "",
           nodePath: process.execPath,
@@ -20251,7 +20634,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset");
-      if (configless && !existsSync40(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync41(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -20266,7 +20649,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   if (command === "credential") {
-    const r = runCredential(positional[1], readFileSync35(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    const r = runCredential(positional[1], readFileSync36(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
     process.stdout.write(r.out);
     process.stderr.write(r.err);
     process.exit(r.code);
@@ -20278,9 +20661,9 @@ if (command === "passenger-sync-daemon") {
         forges: cfg.ship.forges,
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
-        readFile: (p) => readFileSync35(p, "utf8"),
-        writeFile: (p, t) => writeFileSync27(p, t),
-        stdin: () => readFileSync35(0, "utf8"),
+        readFile: (p) => readFileSync36(p, "utf8"),
+        writeFile: (p, t) => writeFileSync28(p, t),
+        stdin: () => readFileSync36(0, "utf8"),
         env: process.env
       }
     );
@@ -20328,7 +20711,10 @@ if (command === "passenger-sync-daemon") {
   async function syncHostPassengers() {
     if (dryRun) return;
     const passengerRoutes = cfg.routes.filter((r) => r.enabled && r.hostPassengers);
-    if (passengerRoutes.length === 0) return;
+    if (passengerRoutes.length === 0) {
+      await syncShipTunnels([], /* @__PURE__ */ new Map(), []);
+      return;
+    }
     if (!dockerAvailable()) {
       const pathProblem = dockerPathProblem(cfg.ship, COMMON_DOCKER_DIRS);
       emit.warn(
@@ -20370,37 +20756,64 @@ if (command === "passenger-sync-daemon") {
           { step: "passengers", data: { ...result } }
         );
       }
-      if (cfg.ship.relayHost) {
-        try {
-          const { privateKeyPath } = ensureShipSshKeypair(cfg.ship.stateDir);
-          const plans = planContainers(cfg);
-          const mcpSecrets = new Map([...syncEndpoints].map(([workspaceId, e]) => [workspaceId, e.secret]));
-          const relayHost = cfg.ship.relayHost;
-          const reconcile = endpointReconcileDeps(passengerRoutes, relayHost);
-          const pending = [];
-          syncPassengerTunnels(plans, relayHost, cfg.ship.relayPort, privateKeyPath, cfg.ship.stateDir, mcpSecrets, {
-            apiKeys: passengerApiKeys(passengerRoutes),
-            onStatus: (workspaceId, status2, info) => {
-              const owningRoute = passengerRoutes.find((r) => r.resolved?.workspaceId === workspaceId);
-              if (!owningRoute) return;
-              pending.push(
-                new Tracker(owningRoute, cfg.ship).updateTunnelState(cfg.ship.name, { tunnel_status: status2 }).catch((e) => {
-                  emit.warn(`could not write tunnel_status: ${e.message}`, { step: "passengers" });
-                })
-              );
-              if (status2 === "disconnected") pending.push(unregisterEndpoint(workspaceId, info, reconcile));
-            }
-          });
-          for (const plan of plans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
-          await Promise.all(pending);
-        } catch (e) {
-          emit.warn(`passenger tunnel sync failed: ${e.message}`, { step: "passengers" });
-        }
-      }
+      await syncShipTunnels(planContainers(cfg), new Map([...syncEndpoints].map(([workspaceId, e]) => [workspaceId, e.secret])), passengerRoutes);
     } catch (e) {
       emit.warn(`passenger container sync failed: ${e.message}`, { step: "passengers" });
     }
   }
+  async function syncShipTunnels(containerPlans, mcpSecrets, passengerRoutes) {
+    if (!cfg.ship.relayHost) return;
+    const relayHost = cfg.ship.relayHost;
+    try {
+      const { privateKeyPath } = ensureShipSshKeypair(cfg.ship.stateDir);
+      const controlRoutes = cfg.routes.filter((r) => r.enabled && r.resolved?.workspaceId);
+      const planned = new Set(containerPlans.map((p) => p.workspaceId));
+      const plans = [...containerPlans];
+      for (const r of controlRoutes) {
+        const ws = r.resolved.workspaceId;
+        if (planned.has(ws)) continue;
+        planned.add(ws);
+        plans.push({ workspaceId: ws });
+      }
+      const apiRoutes = controlRoutes;
+      const reconcile = endpointReconcileDeps(passengerRoutes, relayHost);
+      const pending = [];
+      syncPassengerTunnels(plans, relayHost, cfg.ship.relayPort, privateKeyPath, cfg.ship.stateDir, mcpSecrets, {
+        apiKeys: passengerApiKeys(apiRoutes),
+        controlSocket: controlSocketFor(cfg.ship.stateDir),
+        onStatus: (workspaceId, status2, info) => {
+          const owningRoute = apiRoutes.find((r) => r.resolved?.workspaceId === workspaceId);
+          if (!owningRoute) return;
+          pending.push(
+            new Tracker(owningRoute, cfg.ship).updateTunnelState(cfg.ship.name, { tunnel_status: status2 }).catch((e) => {
+              emit.warn(`could not write tunnel_status: ${e.message}`, { step: "passengers" });
+            })
+          );
+          if (status2 === "disconnected") pending.push(unregisterEndpoint(workspaceId, info, reconcile));
+        }
+      });
+      for (const plan of containerPlans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
+      for (const plan of plans) pending.push(reconcileRelayUrl(plan.workspaceId, apiRoutes));
+      await Promise.all(pending);
+    } catch (e) {
+      emit.warn(`ship tunnel sync failed: ${e.message}`, { step: "passengers" });
+    }
+  }
+  async function reconcileRelayUrl(workspaceId, routes) {
+    if (!cfg.ship.relayHost) return;
+    const persisted = readPersistedTunnel(cfg.ship.stateDir, workspaceId);
+    if (!persisted?.slug || persisted.status !== "connected") return;
+    const url = relayBaseUrlFor(persisted.slug, cfg.ship.relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain);
+    if (persisted.relayUrl === url) return;
+    const route3 = routes.find((r) => r.resolved?.workspaceId === workspaceId);
+    if (!route3) return;
+    try {
+      await new Tracker(route3, cfg.ship).updateRelayUrl(cfg.ship.name, url);
+      updatePersistedTunnel(cfg.ship.stateDir, workspaceId, { relayUrl: url });
+    } catch (e) {
+      emit.warn(`could not write relay_url: ${e.message}`, { step: "passengers" });
+    }
+  }
   async function releaseFleet(opts = {}) {
     if (releaseRefused()) return;
     precheckTickets.clear();
@@ -20504,7 +20917,7 @@ if (command === "passenger-sync-daemon") {
     }
     const hasSystemd = detectSystemd();
     for (const job of ["run", "release", "passengers"]) {
-      const plan = planInstall(cfg.ship, CREW_HOME, host, hasSystemd, job);
+      const plan = planInstall(cfg.ship, CREW_HOME, host, hasSystemd, job, installContext());
       process.stdout.write(`installing ${job} via ${plan.mechanism} for ${host}${dryRun ? " (dry run)" : ""}
 `);
       await applyInstall(plan, CREW_HOME, dryRun, {
@@ -20517,13 +20930,13 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join44(homedir10(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync40(staleTimer)) {
+      if (existsSync41(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
         );
         if (!dryRun) {
-          spawnSync7("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
+          spawnSync8("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
           try {
             unlinkSync5(staleTimer);
           } catch {
@@ -20544,7 +20957,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync40(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync41(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -20562,9 +20975,9 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync40(p);
-    const crontab = o.host === "linux" ? spawnSync7("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
-    const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
+    const unitExists = (p) => existsSync41(p);
+    const crontab = o.host === "linux" ? spawnSync8("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
+    const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
     for (const n of plan.notes) process.stdout.write(`fix: ${n}
 `);
@@ -20579,7 +20992,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync27(cfg.configFile, planEnable(readFileSync35(cfg.configFile, "utf8"), a.route));
+          writeFileSync28(cfg.configFile, planEnable(readFileSync36(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -21321,7 +21734,7 @@ ${cu.tail.trimEnd()}
             const target = repoTargetFor(w.route, result.ticket.repo_id);
             fleetTicketRepo = target?.name;
             try {
-              if (target && ensureRepoCheckout(target.dir, target.remote)) {
+              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme })) {
                 wemit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role: w.role });
               }
             } catch (e) {
@@ -21538,7 +21951,7 @@ ${cu.tail.trimEnd()}
             const target = repoTargetFor(route2, result.ticket.repo_id);
             ticketRepo = target?.name;
             try {
-              if (target && ensureRepoCheckout(target.dir, target.remote)) {
+              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme })) {
                 emit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role: current });
               }
             } catch (e) {
@@ -21659,7 +22072,7 @@ ${cu.tail.trimEnd()}
           }
           let failed = false;
           for (const cmd2 of commands) {
-            const res2 = spawnSync7(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+            const res2 = spawnSync8(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
             if (res2.stdout) process.stdout.write(res2.stdout);
             if (res2.stderr) process.stderr.write(res2.stderr);
             if (cmd2 === control.startCommand && (res2.error || res2.status !== 0)) {
@@ -21677,7 +22090,7 @@ ${cu.tail.trimEnd()}
 `);
           break;
         }
-        const res = spawnSync7(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+        const res = spawnSync8(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
         if (res.stdout) process.stdout.write(res.stdout);
         if (res.stderr) process.stderr.write(res.stderr);
         if (daemonSub !== "status" && (res.error || res.status !== 0)) {
@@ -21961,10 +22374,10 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync40(resolvedPath) ? JSON.parse(readFileSync35(resolvedPath, "utf8")) : {};
+        const raw = existsSync41(resolvedPath) ? JSON.parse(readFileSync36(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync26(dirOf2(resolvedPath), { recursive: true });
-        writeFileSync27(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync28(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -21987,7 +22400,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync27(cfg.configFile, setShipNameInYaml(readFileSync35(cfg.configFile, "utf8"), newName));
+      writeFileSync28(cfg.configFile, setShipNameInYaml(readFileSync36(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -22034,7 +22447,7 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync35(cfg.configFile, "utf8");
+      const configText = readFileSync36(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
@@ -22065,8 +22478,8 @@ ${cu.tail.trimEnd()}
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
           const dir = repoDirOf(configText, dirname22(cfg.configFile), a.route, a.name);
-          if (!existsSync40(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync40(resolvePath(dir, r)), list: (r) => {
+          if (!existsSync41(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync41(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync18(resolvePath(dir, r));
             } catch {
@@ -22074,7 +22487,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync35(resolvePath(dir, r), "utf8");
+              return readFileSync36(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -22116,19 +22529,19 @@ ${cu.tail.trimEnd()}
           let cleared;
           if (clear2) {
             const plan = clearRouteHooks(configText, a.route, a.name);
-            if (plan.removed.length > 0) writeFileSync27(cfg.configFile, plan.text);
+            if (plan.removed.length > 0) writeFileSync28(cfg.configFile, plan.text);
             cleared = { file: cfg.configFile, removed: plan.removed };
           }
           if (write && suggestion.source === null && recipeIds.length === 0 && hookSpecs.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, picked.hooks, { replace: flag("replace") });
-            writeFileSync27(cfg.configFile, plan.text);
+            writeFileSync28(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept, replaced: plan.replaced };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync27(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            writeFileSync28(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [], replaced: [] };
           }
           if (flag("json")) {
@@ -22184,7 +22597,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync40(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync41(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -22213,16 +22626,16 @@ ${cu.tail.trimEnd()}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync40(resolvedFile)) {
+      if (existsSync41(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync36(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
       const base = dirname22(cfg.configFile);
-      const isCheckout = (d) => existsSync40(`${d}/.git`);
+      const isCheckout = (d) => existsSync41(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -22232,11 +22645,11 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync40(d),
+              exists: (d) => existsSync41(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
-                  return Object.keys(parseRepoConfig(readFileSync35(resolvePath(d, f), "utf8"), f).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync36(resolvePath(d, f), "utf8"), f).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -22253,7 +22666,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync40(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync41(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -22265,9 +22678,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync40(plan2.target) && (existsSync40(`${plan2.target}/.git`) || readdirSync18(plan2.target).length > 0)) {
+          if (existsSync41(plan2.target) && (existsSync41(`${plan2.target}/.git`) || readdirSync18(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync40(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync41(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -22285,14 +22698,14 @@ ${cu.tail.trimEnd()}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync27(cfg.configFile, plan2.text);
+          writeFileSync28(cfg.configFile, plan2.text);
           if (plan2.droppedDir) process.stderr.write(`crew repos: dropped dir: ${plan2.droppedDir} from route ${routeName} \u2014 it is not a checkout (the clone base); checkouts now live under repos:
 `);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir10()));
-        const top = existsSync40(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync41(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -22344,15 +22757,15 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync40(resolvedFile)) {
-            const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+          if (existsSync41(resolvedFile)) {
+            const raw = JSON.parse(readFileSync36(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync28(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync27(cfg.configFile, plan.text);
+        writeFileSync28(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -22563,7 +22976,7 @@ ${reconstruction.prompt}
         let result;
         try {
           result = await loginWithDeviceCode(`${baseUrl}/api`, {
-            deviceName: `crew on ${hostname2()}`,
+            deviceName: `crew on ${hostname3()}`,
             // Lets the approval page preselect the workspace this connect is for.
             // A bare `crew connect` has none and passes nothing.
             ...workspace ? { workspaceSlug: workspace } : {},
@@ -22719,7 +23132,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync27(cfg.configFile, setShipNameInYaml(readFileSync35(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync28(cfg.configFile, setShipNameInYaml(readFileSync36(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -22762,10 +23175,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync40(resolvedPath);
+        const hadPreviousFile = existsSync41(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync35(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync36(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -22897,7 +23310,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           mkdirSync26(dirname22(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync27(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync28(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync4(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -22944,7 +23357,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
           } else {
             mkdirSync26(dirname22(apiKeyFile), { recursive: true });
-            writeFileSync27(apiKeyFile, `${apiKeyVar}=${apiKey}
+            writeFileSync28(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -23417,6 +23830,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       const rotatePending = [];
       syncPassengerTunnels(plans, cfg.ship.relayHost, cfg.ship.relayPort, privateKeyPath, cfg.ship.stateDir, /* @__PURE__ */ new Map(), {
         apiKeys: passengerApiKeys([route2]),
+        controlSocket: controlSocketFor(cfg.ship.stateDir),
         onStatus: (wsId, status2, info) => {
           rotatePending.push(
             new Tracker(route2, cfg.ship).updateTunnelState(cfg.ship.name, { tunnel_status: status2 }).catch((e) => {
@@ -23678,7 +24092,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync40(p),
+            worktreeExists: (p) => existsSync41(p),
             caps: periscopeCaps(cfg.ship),
             runHook: async (name, cwd, env) => {
               const script = hit?.repo.config.hooks[name];
@@ -23773,7 +24187,7 @@ ${where.join("\n")}`);
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
               const src = join44(repoP.dir, f);
-              if (!existsSync40(src)) continue;
+              if (!existsSync41(src)) continue;
               mkdirSync26(dirOf2(join44(path, f)), { recursive: true });
               copyFileSync2(src, join44(path, f));
             }
@@ -23861,7 +24275,7 @@ ${where.join("\n")}`);
           process.stdout.write(upOutput(res, terminal));
           const opener = openerFor(process.platform);
           if (opener && shouldOpen({ open: flag("open"), noOpen: flag("no-open"), json: jsonP, terminal })) {
-            const r = spawnSync7(opener, [res.url], { stdio: "ignore" });
+            const r = spawnSync8(opener, [res.url], { stdio: "ignore" });
             if (r.error || r.status !== 0) process.stderr.write(`crew periscope: could not open ${res.url} with ${opener}
 `);
           }
@@ -23993,6 +24407,14 @@ ${where.join("\n")}`);
       const url = mcpUrlFor(value("base-url") ?? cfg.routes[0]?.baseUrl ?? DEFAULT_BASE_URL);
       const disconnectHarnesses = /* @__PURE__ */ new Set([...shipPair(cfg.ship), ...shipToolchains(cfg.ship).map((t) => t.harness).filter(isPairHarness)]);
       const removePairEntries = (mcpUrl, dry) => [...disconnectHarnesses].map((h) => pairInstallerFor(h).removePair({ url: mcpUrl, bin: cfg.ship.agent.bin, dryRun: dry }));
+      if (!dryRun) {
+        for (const r of cfg.routes.filter((x) => x.resolved?.shipsModelId)) {
+          await new Tracker(r, cfg.ship).updateRelayUrl(cfg.ship.name, null).catch((e) => {
+            process.stderr.write(`could not clear relay_url for ${r.route}: ${e.message}
+`);
+          });
+        }
+      }
       if (!flag("reset")) {
         for (const line of removePairEntries(url, dryRun)) process.stderr.write(`${line}
 `);
@@ -24050,7 +24472,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync35(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync36(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -24086,19 +24508,19 @@ ${where.join("\n")}`);
       }
       const host = hostPlatform();
       const control = host === "windows" ? null : planDaemonControl(CREW_HOME, host, detectSystemd());
-      const unitStatus = control?.statusCommand ? spawnSync7(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
+      const unitStatus = control?.statusCommand ? spawnSync8(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
       const unitRunning = unitStatus !== null && !unitStatus.error && unitStatus.status === 0;
       if (!unitRunning) {
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
       mkdirSync26(cfg.ship.stateDir, { recursive: true });
-      writeFileSync27(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      writeFileSync28(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
         for (const cmd of [control.stopCommand, control.startCommand]) {
-          const res = spawnSync7(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+          const res = spawnSync8(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
           if (cmd === control.startCommand && (res.error || res.status !== 0)) {
             process.stderr.write(`crew reload: ${cmd.join(" ")} exited ${res.status ?? "error"}
 `);
@@ -24144,7 +24566,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text = readFileSync35(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync36(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -24167,7 +24589,7 @@ ${where.join("\n")}`);
       };
       if (!route2.resolved) fail(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
-      const configText = readFileSync35(cfg.configFile, "utf8");
+      const configText = readFileSync36(cfg.configFile, "utf8");
       const cfgBase = dirname22(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
@@ -24196,7 +24618,7 @@ ${where.join("\n")}`);
         }
         if (configured2.some((r) => r.dir === dir)) {
           try {
-            writeFileSync27(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
+            writeFileSync28(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -24204,31 +24626,31 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync40(resolvedFile)) {
-            const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+          if (existsSync41(resolvedFile)) {
+            const raw = JSON.parse(readFileSync36(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync28(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync40(join44(dir, ".git")) && basename13(dir) === SAMPLE_REPO) rmSync19(dir, { recursive: true, force: true });
+        if (existsSync41(join44(dir, ".git")) && basename13(dir) === SAMPLE_REPO) rmSync19(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync40(join44(dir, ".git"));
-      if (existsSync40(dir) && fresh && readdirSync18(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync41(join44(dir, ".git"));
+      if (existsSync41(dir) && fresh && readdirSync18(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
         mkdirSync26(dir, { recursive: true });
-        writeFileSync27(join44(dir, "README.md"), SAMPLE_README);
-        writeFileSync27(join44(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        writeFileSync28(join44(dir, "README.md"), SAMPLE_README);
+        writeFileSync28(join44(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
-          const r = spawnSync7("git", a, { cwd: dir, encoding: "utf8" });
+          const r = spawnSync8("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
         };
         g("init", "-b", "main");
@@ -24244,17 +24666,17 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync40(resolvedFile)) {
-          const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+        if (existsSync41(resolvedFile)) {
+          const raw = JSON.parse(readFileSync36(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync28(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured2.some((r) => r.dir === dir)) {
         try {
-          writeFileSync27(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync28(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -24427,7 +24849,9 @@ ${where.join("\n")}`);
             attention: openShipAttention(state),
             // Additive (CREW-2495): this ship's Ships-row name and whether it has drifted from `name`.
             rowName: nameSync.rowName ?? null,
-            nameDrift: nameSync.drift
+            nameDrift: nameSync.drift,
+            // Additive (CREW-2803): the relay URL this route's tunnel is reachable at, or null.
+            relayUrl: routeRelayUrl(route2)
           },
           // Additive (CREW-1402): what the operator owes. `version` stays 1.
           todo: todo.map((i) => ({ ticket: displayKey(i.ticket), title: i.ticket.title ?? null, reasons: i.reasons })),
@@ -24517,7 +24941,8 @@ ${owed.map((l) => `  ${l}
 route:      ${route2.route} -> ${route2.dir}
 enabled:    ${route2.enabled}
 periscopes: ${periscopeSummary(cfg)}
-` + periscopes.map((p) => `periscope:  ${p.ticket} ${p.repo} ${p.url} ${p.state}${p.serving ? "" : " (not serving)"} expires ${p.expiresAt}
+` + (routeRelayUrl(route2) ? `relay:      ${routeRelayUrl(route2)}
+` : "") + periscopes.map((p) => `periscope:  ${p.ticket} ${p.repo} ${p.url} ${p.state}${p.serving ? "" : " (not serving)"} expires ${p.expiresAt}
 `).join("") + `crew:       ${state.isPaused() ? "paused" : "active"}
 release:    ${state.releaseSkipReason() ? "paused" : "active"}
 watermark:  ${state.watermark()}
@@ -24589,7 +25014,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync40(r.dir)) {
+            if (existsSync41(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -24674,7 +25099,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync40(evFile) ? statSync14(evFile).size : 0;
+        const evSize = existsSync41(evFile) ? statSync14(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -24682,10 +25107,10 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       } catch {
       }
       if (host !== "windows") {
-        const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
+        const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run", installContext());
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync35(p, "utf8");
+            return readFileSync36(p, "utf8");
           } catch {
             return null;
           }
@@ -25109,6 +25534,21 @@ ${foreign.join("\n")}
           );
         }
       }
+      if (cfg.ship.relayHost && !flag("offline")) {
+        const relayUrl = routeRelayUrl(route2);
+        if (!relayUrl) {
+          process.stdout.write("relay control:     no tunnel URL yet (the first `crew passengers` cycle opens it)\n");
+        } else {
+          let key;
+          try {
+            key = resolveApiKey(route2);
+          } catch {
+            key = void 0;
+          }
+          process.stdout.write(`${key ? describeRelayProbe(relayUrl, await probeRelayControl(relayUrl, key, cfg.ship.userAgent)) : "relay control:     could not check (no API key for this route)"}
+`);
+        }
+      }
       for (const l of doctorSelftestLines(readSelftest(cfg.ship.stateDir), shipToolchains(cfg.ship).map((t) => t.name))) {
         process.stdout.write(`${l}
 `);
@@ -25130,6 +25570,7 @@ ${foreign.join("\n")}
 }
 var requireArmed2;
 var parseTicketNumber2;
+var routeRelayUrl2;
 var passengerApiKeys2;
 var endpointApiFor2;
 var endpointReconcileDeps2;