@tablation/crew 0.96.0 → 0.97.0

package/dist/cli.js

@@ -7278,6 +7278,18 @@ var Tracker = class {
     if (!row) return;
     await this.client.records.update(this.route.resolved.shipsModelId, row.id, patch2);
   }
+  /**
+   * Writes (or, with `null`, clears) this ship's `relay_url` (CREW-2803). A
+   * no-op when there is no row for this ship or the Ships table has not taken
+   * the column (probed by the key's absence from the row), so the tunnel
+   * still runs on an install that predates it.
+   */
+  async updateRelayUrl(shipName2, url) {
+    const row = await this.myShipRow(shipName2);
+    if (!row || !("relay_url" in row)) return;
+    if ((row.relay_url ?? null) === url) return;
+    await this.client.records.update(this.route.resolved.shipsModelId, row.id, { relay_url: url });
+  }
   /** The other half of `beatEngaged` — clears engagement back to idle. */
   async beatIdle(shipName2) {
     const row = await this.myShipRow(shipName2);
@@ -18145,6 +18157,26 @@ function sshKeygenAvailable() {
   }
 }
 
+// src/relay-probe.ts
+async function probeRelayControl(relayUrl, apiKey, userAgent, fetchFn = fetch, timeoutMs = 1e4) {
+  const started = Date.now();
+  try {
+    const res = await fetchFn(`${relayUrl.replace(/\/+$/, "")}/control/status`, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": userAgent },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    const latencyMs = Date.now() - started;
+    await res.arrayBuffer().catch(() => void 0);
+    if (res.ok) return { ok: true, status: res.status, latencyMs };
+    return { ok: false, status: res.status, error: `HTTP ${res.status}` };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+function describeRelayProbe(url, p) {
+  return p.ok ? `relay control:     OK ${url}/control/status (${p.status}, ${p.latencyMs} ms)` : `relay control:     FAILED ${url}/control/status \u2014 ${p.error}`;
+}
+
 // src/passenger-containers.ts
 import { execFileSync as execFileSync9 } from "child_process";
 import { createHash as createHash7 } from "crypto";
@@ -18362,15 +18394,21 @@ function generateTunnelSlug() {
   for (let i = 0; i < SLUG_LENGTH; i++) out += SLUG_ALPHABET[randomInt(SLUG_ALPHABET.length)];
   return out;
 }
-function bindAddrFor(o) {
-  const base = `workspace-${o.workspaceId}-slug-${o.slug}-key-${o.apiKey}`;
-  return o.mcpSecret ? `${base}-secret-${o.mcpSecret}` : base;
+function bindAddrFor(o, path) {
+  const base = `workspace-${o.workspaceId}-slug-${o.slug}${path ? `-path-${path}` : ""}-key-${o.apiKey}`;
+  return o.mcpSecret && !path ? `${base}-secret-${o.mcpSecret}` : base;
 }
-function publicUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain) {
+function relayBaseUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain) {
   const domain = relayPublicDomain ?? relayHost.replace(/^.*@/, "");
-  return `https://${slug}.${domain}${relayHttpPort === 443 ? "" : `:${relayHttpPort}`}/mcp`;
+  return `https://${slug}.${domain}${relayHttpPort === 443 ? "" : `:${relayHttpPort}`}`;
+}
+function publicUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain) {
+  return `${relayBaseUrlFor(slug, relayHost, relayHttpPort, relayPublicDomain)}/mcp`;
 }
 function sshArgsFor(o) {
+  const forwards = [];
+  if (o.localPort !== void 0) forwards.push("-R", `${bindAddrFor(o)}:0:127.0.0.1:${o.localPort}`);
+  if (o.controlSocket) forwards.push("-R", `${bindAddrFor(o, "control")}:0:${o.controlSocket}`);
   return [
     "-N",
     "-o",
@@ -18385,8 +18423,7 @@ function sshArgsFor(o) {
     o.privateKeyPath,
     "-p",
     String(o.relayPort),
-    "-R",
-    `${bindAddrFor(o)}:0:127.0.0.1:${o.localPort}`,
+    ...forwards,
     o.relayHost
   ];
 }
@@ -18457,16 +18494,19 @@ function isPidAlive(pid) {
     return false;
   }
 }
+var CONTROL_ONLY_HASH = "control-only";
 function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, stateDir, mcpSecrets = /* @__PURE__ */ new Map(), deps = {}) {
   const alive = deps.isPidAlive ?? isPidAlive;
   const plannedIds = new Set(plans.map((p) => p.workspaceId));
   for (const plan of plans) {
     const existing = readPersistedTunnel(stateDir, plan.workspaceId);
+    const mountsHash = plan.mountsHash ?? CONTROL_ONLY_HASH;
+    const controlUnchanged = existing?.controlSocket === deps.controlSocket;
     const currentSecret = mcpSecrets.get(plan.workspaceId);
     const secretUnchanged = (existing?.mcpSecret ?? void 0) === (currentSecret ?? void 0);
     const slug = existing?.slug ?? generateTunnelSlug();
     const slugUnchanged = existing?.liveSlug === slug;
-    if (existing && alive(existing.pid) && existing.mountsHash === plan.mountsHash && secretUnchanged && slugUnchanged) {
+    if (existing && alive(existing.pid) && existing.mountsHash === mountsHash && secretUnchanged && slugUnchanged && controlUnchanged) {
       if (existing.status === "connecting") {
         const settled = { ...existing, status: "connected" };
         writePersistedTunnel(stateDir, settled);
@@ -18493,6 +18533,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
       slug,
       apiKey,
       localPort: plan.port,
+      controlSocket: deps.controlSocket,
       privateKeyPath,
       mcpSecret: currentSecret,
       spawnFn: deps.spawnFn,
@@ -18502,9 +18543,10 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
     });
     const started = {
       pid: tunnel.pid ?? -1,
-      containerName: plan.containerName,
+      containerName: plan.containerName ?? "",
       workspaceId: plan.workspaceId,
-      mountsHash: plan.mountsHash,
+      mountsHash,
+      controlSocket: deps.controlSocket,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: settledStatus,
       mcpSecret: currentSecret,
@@ -20484,6 +20526,11 @@ if (command === "passenger-sync-daemon") {
   }, parseTicketNumber = function(input) {
     const m = /^(?:[A-Za-z]+-)?(\d+)$/.exec(input.trim());
     return m ? m[1] : null;
+  }, routeRelayUrl = function(route3) {
+    const ws = route3.resolved?.workspaceId;
+    const slug = ws ? readPersistedTunnel(cfg.ship.stateDir, ws)?.slug : void 0;
+    if (!cfg.ship.relayHost || !slug) return null;
+    return relayBaseUrlFor(slug, cfg.ship.relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain);
   }, passengerApiKeys = function(routes) {
     const keys = /* @__PURE__ */ new Map();
     for (const r of routes) {
@@ -20531,7 +20578,7 @@ if (command === "passenger-sync-daemon") {
     const unsafe = baseBranchUnsafe(out);
     return { action: out.action, unsafe, detail: unsafe ? describeUnsafeBase(out, remote, base) : out.detail };
   };
-  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, doctorMachineId2 = doctorMachineId, baseHealth2 = baseHealth;
+  requireArmed2 = requireArmed, parseTicketNumber2 = parseTicketNumber, routeRelayUrl2 = routeRelayUrl, passengerApiKeys2 = passengerApiKeys, endpointApiFor2 = endpointApiFor, endpointReconcileDeps2 = endpointReconcileDeps, releaseRefused2 = releaseRefused, doctorMachineId2 = doctorMachineId, baseHealth2 = baseHealth;
   let cfg;
   let firstRun;
   let firstRunFromFlags = false;
@@ -20664,7 +20711,10 @@ if (command === "passenger-sync-daemon") {
   async function syncHostPassengers() {
     if (dryRun) return;
     const passengerRoutes = cfg.routes.filter((r) => r.enabled && r.hostPassengers);
-    if (passengerRoutes.length === 0) return;
+    if (passengerRoutes.length === 0) {
+      await syncShipTunnels([], /* @__PURE__ */ new Map(), []);
+      return;
+    }
     if (!dockerAvailable()) {
       const pathProblem = dockerPathProblem(cfg.ship, COMMON_DOCKER_DIRS);
       emit.warn(
@@ -20706,37 +20756,64 @@ if (command === "passenger-sync-daemon") {
           { step: "passengers", data: { ...result } }
         );
       }
-      if (cfg.ship.relayHost) {
-        try {
-          const { privateKeyPath } = ensureShipSshKeypair(cfg.ship.stateDir);
-          const plans = planContainers(cfg);
-          const mcpSecrets = new Map([...syncEndpoints].map(([workspaceId, e]) => [workspaceId, e.secret]));
-          const relayHost = cfg.ship.relayHost;
-          const reconcile = endpointReconcileDeps(passengerRoutes, relayHost);
-          const pending = [];
-          syncPassengerTunnels(plans, relayHost, cfg.ship.relayPort, privateKeyPath, cfg.ship.stateDir, mcpSecrets, {
-            apiKeys: passengerApiKeys(passengerRoutes),
-            onStatus: (workspaceId, status2, info) => {
-              const owningRoute = passengerRoutes.find((r) => r.resolved?.workspaceId === workspaceId);
-              if (!owningRoute) return;
-              pending.push(
-                new Tracker(owningRoute, cfg.ship).updateTunnelState(cfg.ship.name, { tunnel_status: status2 }).catch((e) => {
-                  emit.warn(`could not write tunnel_status: ${e.message}`, { step: "passengers" });
-                })
-              );
-              if (status2 === "disconnected") pending.push(unregisterEndpoint(workspaceId, info, reconcile));
-            }
-          });
-          for (const plan of plans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
-          await Promise.all(pending);
-        } catch (e) {
-          emit.warn(`passenger tunnel sync failed: ${e.message}`, { step: "passengers" });
-        }
-      }
+      await syncShipTunnels(planContainers(cfg), new Map([...syncEndpoints].map(([workspaceId, e]) => [workspaceId, e.secret])), passengerRoutes);
     } catch (e) {
       emit.warn(`passenger container sync failed: ${e.message}`, { step: "passengers" });
     }
   }
+  async function syncShipTunnels(containerPlans, mcpSecrets, passengerRoutes) {
+    if (!cfg.ship.relayHost) return;
+    const relayHost = cfg.ship.relayHost;
+    try {
+      const { privateKeyPath } = ensureShipSshKeypair(cfg.ship.stateDir);
+      const controlRoutes = cfg.routes.filter((r) => r.enabled && r.resolved?.workspaceId);
+      const planned = new Set(containerPlans.map((p) => p.workspaceId));
+      const plans = [...containerPlans];
+      for (const r of controlRoutes) {
+        const ws = r.resolved.workspaceId;
+        if (planned.has(ws)) continue;
+        planned.add(ws);
+        plans.push({ workspaceId: ws });
+      }
+      const apiRoutes = controlRoutes;
+      const reconcile = endpointReconcileDeps(passengerRoutes, relayHost);
+      const pending = [];
+      syncPassengerTunnels(plans, relayHost, cfg.ship.relayPort, privateKeyPath, cfg.ship.stateDir, mcpSecrets, {
+        apiKeys: passengerApiKeys(apiRoutes),
+        controlSocket: controlSocketFor(cfg.ship.stateDir),
+        onStatus: (workspaceId, status2, info) => {
+          const owningRoute = apiRoutes.find((r) => r.resolved?.workspaceId === workspaceId);
+          if (!owningRoute) return;
+          pending.push(
+            new Tracker(owningRoute, cfg.ship).updateTunnelState(cfg.ship.name, { tunnel_status: status2 }).catch((e) => {
+              emit.warn(`could not write tunnel_status: ${e.message}`, { step: "passengers" });
+            })
+          );
+          if (status2 === "disconnected") pending.push(unregisterEndpoint(workspaceId, info, reconcile));
+        }
+      });
+      for (const plan of containerPlans) pending.push(reconcileEndpoint(plan.workspaceId, reconcile));
+      for (const plan of plans) pending.push(reconcileRelayUrl(plan.workspaceId, apiRoutes));
+      await Promise.all(pending);
+    } catch (e) {
+      emit.warn(`ship tunnel sync failed: ${e.message}`, { step: "passengers" });
+    }
+  }
+  async function reconcileRelayUrl(workspaceId, routes) {
+    if (!cfg.ship.relayHost) return;
+    const persisted = readPersistedTunnel(cfg.ship.stateDir, workspaceId);
+    if (!persisted?.slug || persisted.status !== "connected") return;
+    const url = relayBaseUrlFor(persisted.slug, cfg.ship.relayHost, cfg.ship.relayHttpPort, cfg.ship.relayPublicDomain);
+    if (persisted.relayUrl === url) return;
+    const route3 = routes.find((r) => r.resolved?.workspaceId === workspaceId);
+    if (!route3) return;
+    try {
+      await new Tracker(route3, cfg.ship).updateRelayUrl(cfg.ship.name, url);
+      updatePersistedTunnel(cfg.ship.stateDir, workspaceId, { relayUrl: url });
+    } catch (e) {
+      emit.warn(`could not write relay_url: ${e.message}`, { step: "passengers" });
+    }
+  }
   async function releaseFleet(opts = {}) {
     if (releaseRefused()) return;
     precheckTickets.clear();
@@ -23753,6 +23830,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       const rotatePending = [];
       syncPassengerTunnels(plans, cfg.ship.relayHost, cfg.ship.relayPort, privateKeyPath, cfg.ship.stateDir, /* @__PURE__ */ new Map(), {
         apiKeys: passengerApiKeys([route2]),
+        controlSocket: controlSocketFor(cfg.ship.stateDir),
         onStatus: (wsId, status2, info) => {
           rotatePending.push(
             new Tracker(route2, cfg.ship).updateTunnelState(cfg.ship.name, { tunnel_status: status2 }).catch((e) => {
@@ -24329,6 +24407,14 @@ ${where.join("\n")}`);
       const url = mcpUrlFor(value("base-url") ?? cfg.routes[0]?.baseUrl ?? DEFAULT_BASE_URL);
       const disconnectHarnesses = /* @__PURE__ */ new Set([...shipPair(cfg.ship), ...shipToolchains(cfg.ship).map((t) => t.harness).filter(isPairHarness)]);
       const removePairEntries = (mcpUrl, dry) => [...disconnectHarnesses].map((h) => pairInstallerFor(h).removePair({ url: mcpUrl, bin: cfg.ship.agent.bin, dryRun: dry }));
+      if (!dryRun) {
+        for (const r of cfg.routes.filter((x) => x.resolved?.shipsModelId)) {
+          await new Tracker(r, cfg.ship).updateRelayUrl(cfg.ship.name, null).catch((e) => {
+            process.stderr.write(`could not clear relay_url for ${r.route}: ${e.message}
+`);
+          });
+        }
+      }
       if (!flag("reset")) {
         for (const line of removePairEntries(url, dryRun)) process.stderr.write(`${line}
 `);
@@ -24763,7 +24849,9 @@ ${where.join("\n")}`);
             attention: openShipAttention(state),
             // Additive (CREW-2495): this ship's Ships-row name and whether it has drifted from `name`.
             rowName: nameSync.rowName ?? null,
-            nameDrift: nameSync.drift
+            nameDrift: nameSync.drift,
+            // Additive (CREW-2803): the relay URL this route's tunnel is reachable at, or null.
+            relayUrl: routeRelayUrl(route2)
           },
           // Additive (CREW-1402): what the operator owes. `version` stays 1.
           todo: todo.map((i) => ({ ticket: displayKey(i.ticket), title: i.ticket.title ?? null, reasons: i.reasons })),
@@ -24853,7 +24941,8 @@ ${owed.map((l) => `  ${l}
 route:      ${route2.route} -> ${route2.dir}
 enabled:    ${route2.enabled}
 periscopes: ${periscopeSummary(cfg)}
-` + periscopes.map((p) => `periscope:  ${p.ticket} ${p.repo} ${p.url} ${p.state}${p.serving ? "" : " (not serving)"} expires ${p.expiresAt}
+` + (routeRelayUrl(route2) ? `relay:      ${routeRelayUrl(route2)}
+` : "") + periscopes.map((p) => `periscope:  ${p.ticket} ${p.repo} ${p.url} ${p.state}${p.serving ? "" : " (not serving)"} expires ${p.expiresAt}
 `).join("") + `crew:       ${state.isPaused() ? "paused" : "active"}
 release:    ${state.releaseSkipReason() ? "paused" : "active"}
 watermark:  ${state.watermark()}
@@ -25445,6 +25534,21 @@ ${foreign.join("\n")}
           );
         }
       }
+      if (cfg.ship.relayHost && !flag("offline")) {
+        const relayUrl = routeRelayUrl(route2);
+        if (!relayUrl) {
+          process.stdout.write("relay control:     no tunnel URL yet (the first `crew passengers` cycle opens it)\n");
+        } else {
+          let key;
+          try {
+            key = resolveApiKey(route2);
+          } catch {
+            key = void 0;
+          }
+          process.stdout.write(`${key ? describeRelayProbe(relayUrl, await probeRelayControl(relayUrl, key, cfg.ship.userAgent)) : "relay control:     could not check (no API key for this route)"}
+`);
+        }
+      }
       for (const l of doctorSelftestLines(readSelftest(cfg.ship.stateDir), shipToolchains(cfg.ship).map((t) => t.name))) {
         process.stdout.write(`${l}
 `);
@@ -25466,6 +25570,7 @@ ${foreign.join("\n")}
 }
 var requireArmed2;
 var parseTicketNumber2;
+var routeRelayUrl2;
 var passengerApiKeys2;
 var endpointApiFor2;
 var endpointReconcileDeps2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.96.0",
+  "version": "0.97.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",