@tablation/crew 0.97.0 → 0.99.0

package/dist/cli.js

@@ -684,11 +684,17 @@ var claudePair = {
   },
   removePair: (o) => removeClaudeMcp({ bin: o.bin ?? "claude", dryRun: o.dryRun })
 };
+var inferenceBaseUrl = (baseUrl, workspaceId) => `${baseUrl.replace(/\/+$/, "")}/api/workspaces/${workspaceId}/inference`;
+function workspaceSettings(baseUrl) {
+  const blank = BILLING_VARS_TO_UNSET.filter((v) => v !== "ANTHROPIC_AUTH_TOKEN");
+  return JSON.stringify({ env: { ...Object.fromEntries(blank.map((v) => [v, ""])), ANTHROPIC_BASE_URL: baseUrl } });
+}
 function subscriptionSettings() {
   return JSON.stringify({ env: Object.fromEntries(BILLING_VARS_TO_UNSET.map((v) => [v, ""])) });
 }
 function describeClaudeAuth(spec, env = process.env, home = homedir3()) {
   if (spec.auth === "subscription") return "subscription (settings override)";
+  if (spec.auth === "workspace") return `workspace${spec.inference ? ` (${new URL(spec.inference.baseUrl).host})` : " (endpoint resolved per route at run time)"}`;
   let fromSettings;
   try {
     const parsed = JSON.parse(readFileSync6(join6(home, ".claude", "settings.json"), "utf8"));
@@ -702,6 +708,9 @@ function describeClaudeAuth(spec, env = process.env, home = homedir3()) {
   const shell = BILLING_VARS_TO_UNSET.find((v) => v.startsWith("ANTHROPIC_API") && env[v]);
   return shell ? `inherit: ${shell} in env (unset at exec)` : "inherit: subscription login";
 }
+function withoutProviderVars(env) {
+  return Object.fromEntries(Object.entries(env).filter(([k]) => !BILLING_VARS_TO_UNSET.includes(k) && k !== "ANTHROPIC_BASE_URL" && !/^(CLAUDE_CODE_USE_|ANTHROPIC_(VERTEX|BEDROCK|FOUNDRY))/.test(k)));
+}
 var claudeAdapter = {
   harness: "claude",
   displayName: "Claude Code",
@@ -757,6 +766,7 @@ var claudeAdapter = {
         }
       })] : [],
       ...spec.auth === "subscription" ? ["--settings", subscriptionSettings()] : [],
+      ...spec.auth === "workspace" && spec.inference ? ["--settings", workspaceSettings(spec.inference.baseUrl)] : [],
       ...spec.args
     ];
     return wrapInvocation(spec, { model: o.model, args });
@@ -767,7 +777,11 @@ var claudeAdapter = {
       // blocks at all — without it, Agent Log Cycles reporting has nothing
       // to report (ISSUE-558).
       ...spec.maxThinkingTokens > 0 ? { MAX_THINKING_TOKENS: String(spec.maxThinkingTokens) } : {},
-      ...spec.env
+      // CREW-2796: under `workspace` the only route to a model is the endpoint. The provider
+      // variables are already unset at exec (`unsetEnv`), and a spec-level `env:` entry must not
+      // smuggle one back in.
+      ...spec.auth === "workspace" ? withoutProviderVars(spec.env) : spec.env,
+      ...spec.auth === "workspace" && spec.inference ? { ANTHROPIC_BASE_URL: spec.inference.baseUrl, ANTHROPIC_AUTH_TOKEN: spec.inference.token } : {}
     };
   },
   provider: () => "anthropic",
@@ -1588,6 +1602,28 @@ import { dirname as dirname3, join as join9 } from "path";
 var ForgeError = class extends Error {
 };
 var DEFAULT_FORGE_USERNAME = "x-access-token";
+var DEFAULT_FORGE_HOST = "github.com";
+var FORGE_DESCRIPTORS = {
+  github: {
+    kind: "github",
+    httpsUrl: (host, remote) => `https://${host}/${remote}.git`,
+    sshUrl: (host, remote) => `git@${host}:${remote}.git`,
+    credentialUsername: DEFAULT_FORGE_USERNAME
+  },
+  gitlab: {
+    kind: "gitlab",
+    httpsUrl: (host, remote) => `https://${host}/${remote}.git`,
+    sshUrl: (host, remote) => `git@${host}:${remote}.git`,
+    credentialUsername: "oauth2"
+  }
+};
+function normalizeForgeHost(host) {
+  const h = host?.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/\/+$/, "");
+  return h || DEFAULT_FORGE_HOST;
+}
+function forgeDescriptorFor(host) {
+  return normalizeForgeHost(host).includes("gitlab") ? FORGE_DESCRIPTORS.gitlab : FORGE_DESCRIPTORS.github;
+}
 var DEFAULT_KEYCHAIN_SERVICE = "crew-forge";
 function defaultTokenFilePath(stateDir, host) {
   return join9(stateDir, "forges", `${host.replace(/[^a-z0-9.-]/gi, "_")}.token`);
@@ -1800,7 +1836,7 @@ function parseForges(raw) {
       throw new ForgeError(`${where}.token.source must be one of: ${Object.keys(TOKEN_SOURCES).join(", ")}`);
     }
     out[host.toLowerCase()] = {
-      username: typeof e.username === "string" && e.username ? e.username : DEFAULT_FORGE_USERNAME,
+      username: typeof e.username === "string" && e.username ? e.username : forgeDescriptorFor(host).credentialUsername,
       token
     };
   }
@@ -2918,6 +2954,7 @@ function parseResolved(raw, m, where) {
     reposModelId: raw.reposModelId,
     repoNames: raw.repoNames,
     repoRemotes: raw.repoRemotes,
+    repoForgeHosts: raw.repoForgeHosts,
     models: {
       issues: m.req(raw.models?.issues, `${where}.resolved.models.issues`),
       comments: m.req(raw.models?.comments, `${where}.resolved.models.comments`),
@@ -3168,10 +3205,10 @@ function parseToolchains(raw, base, missing, file) {
     const maxRunMinutes = parseMaxRunMinutes(entryRaw.maxRunMinutes, `${where}.maxRunMinutes`, missing);
     let auth;
     if (entryRaw.auth !== void 0) {
-      if (entryRaw.auth !== "subscription" && entryRaw.auth !== "inherit") {
-        missing.add(`${where}.auth must be subscription|inherit (got "${entryRaw.auth}")`);
+      if (entryRaw.auth !== "subscription" && entryRaw.auth !== "inherit" && entryRaw.auth !== "workspace") {
+        missing.add(`${where}.auth must be subscription|inherit|workspace (got "${entryRaw.auth}")`);
       } else if (harness !== "claude") {
-        missing.add(`${where}.auth is only supported on the claude harness`);
+        missing.add(`${where}.auth is only supported on the claude harness (${entryRaw.auth === "workspace" ? "workspace is not available for codex or gemini yet" : "got " + harness})`);
       } else {
         auth = entryRaw.auth;
       }
@@ -3423,23 +3460,29 @@ function reposOf(r) {
   if (r.dirIsCloneBase) {
     const [workspace2] = splitRoute(r.route);
     const remotes2 = r.resolved?.repoRemotes ?? {};
+    const hosts = r.resolved?.repoForgeHosts ?? {};
     return Object.entries(r.resolved?.repoNames ?? {}).map(([id, name]) => ({
       name,
       dir: defaultRepoDir(r.reposBasePath, workspace2, name),
-      remote: remotes2[id]
+      remote: remotes2[id],
+      ...hosts[id] ? { forgeHost: hosts[id] } : {}
     }));
   }
   if (trackerNames.length <= 1) return [{ name: basename3(r.dir), dir: r.dir }];
   const remotes = r.resolved?.repoRemotes ?? {};
   const remoteByName = {};
+  const hostByName = {};
   for (const [id, name] of Object.entries(r.resolved.repoNames)) {
     if (remotes[id]) remoteByName[name] = remotes[id];
+    const h = r.resolved?.repoForgeHosts?.[id];
+    if (h) hostByName[name] = h;
   }
   const [workspace] = splitRoute(r.route);
   return trackerNames.map((name) => ({
     name,
     dir: defaultRepoDir(r.reposBasePath, workspace, name),
-    remote: remoteByName[name]
+    remote: remoteByName[name],
+    ...hostByName[name] ? { forgeHost: hostByName[name] } : {}
   }));
 }
 function passengerRepoTargets(r) {
@@ -3455,10 +3498,12 @@ function passengerCheckoutTargets(r) {
   const remotes = r.resolved?.repoRemotes ?? {};
   return passengerRepoTargets(r).map((t) => {
     const id = repoIdForName(r, t.name);
+    const forgeHost = t.forgeHost ?? (id ? r.resolved?.repoForgeHosts?.[id] : void 0);
     return {
       name: t.name,
       dir: passengerCheckoutDir(r.reposBasePath, workspace, t.name),
-      remote: t.remote ?? (id ? remotes[id] : void 0)
+      remote: t.remote ?? (id ? remotes[id] : void 0),
+      ...forgeHost ? { forgeHost } : {}
     };
   });
 }
@@ -4766,8 +4811,10 @@ function setForgeTokenHosts(hosts) {
 }
 function cloneUrlFor(remote, opts = {}) {
   const origin = opts.originUrl?.trim() ?? "";
-  const scheme = tokenHosts.has("github.com") ? "https" : /^https?:\/\//i.test(origin) ? "https" : /^(git@|ssh:\/\/)/i.test(origin) ? "ssh" : opts.scheme ?? "ssh";
-  return scheme === "https" ? `https://github.com/${remote}.git` : `git@github.com:${remote}.git`;
+  const host = normalizeForgeHost(opts.host);
+  const scheme = tokenHosts.has(host) ? "https" : /^https?:\/\//i.test(origin) ? "https" : /^(git@|ssh:\/\/)/i.test(origin) ? "ssh" : opts.scheme ?? "ssh";
+  const forge = forgeDescriptorFor(host);
+  return scheme === "https" ? forge.httpsUrl(host, remote) : forge.sshUrl(host, remote);
 }
 function originUrlOf(dir, remoteName) {
   try {
@@ -4939,6 +4986,16 @@ function agentLogRefusedItem(route2, role, status2, nowIso = (/* @__PURE__ */ ne
     message: `${route2}: the tracker refused the ${role} seat's run report (${status2}) \u2014 runs and ticket spend are not being recorded; check the seat key's role`
   };
 }
+var workspaceAuthKey = (role) => `workspace_auth:${role}`;
+var workspaceAllowanceKey = (role) => `workspace_allowance:${role}`;
+function workspaceAllowanceItem(route2, role, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+  return {
+    kind: "workspace_allowance",
+    key: workspaceAllowanceKey(role),
+    since: nowIso,
+    message: `${route2}: the ${role} seat is paused \u2014 the workspace is past its AI allowance; it resumes on its own once the limit is raised`
+  };
+}
 var diskLowKey = (repo) => `disk_low:${repo}`;
 var LOW_DISK_BYTES = 2 * 1024 ** 3;
 var gib = (bytes) => (bytes / 1024 ** 3).toFixed(1);
@@ -5220,7 +5277,7 @@ function probePushAuth(o, run2 = realGit, baseEnv = process.env) {
     const raw = (err3.stderr ? String(err3.stderr) : err3.message).trim().split("\n").filter(Boolean).slice(-2).join(" / ");
     const detail = raw || "push dry-run failed";
     const f = o.forge;
-    if (!f) return { state: "failed", detail, hint: pushAuthHint(o.remoteUrl) };
+    if (!f) return { state: "failed", detail: hostOfRemote(o.remoteUrl) ? `${hostOfRemote(o.remoteUrl)}: ${detail}` : detail, hint: pushAuthHint(o.remoteUrl) };
     if (!f.hasToken) {
       return {
         state: "failed",
@@ -9379,6 +9436,37 @@ var AgentError = class extends Error {
 };
 var AgentSpawnError = class extends AgentError {
 };
+var WorkspaceAuthRefused = class extends AgentSpawnError {
+};
+var WorkspaceAllowanceExhausted = class extends AgentError {
+};
+var ALLOWANCE_REFUSAL_MARKER = "AI_ALLOWANCE_EXCEEDED";
+function streamShowsAllowanceRefusal(streamPath) {
+  let raw;
+  try {
+    raw = readFileSync19(streamPath, "utf8");
+  } catch {
+    return false;
+  }
+  if (!raw.includes(ALLOWANCE_REFUSAL_MARKER)) return false;
+  for (const line of raw.split("\n")) {
+    if (!line.includes(ALLOWANCE_REFUSAL_MARKER)) continue;
+    let ev;
+    try {
+      ev = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (typeof ev !== "object" || ev === null) continue;
+    const e = ev;
+    if (e.type === "result" && e.is_error === true) {
+      if (typeof e.result === "string" && e.result.includes(ALLOWANCE_REFUSAL_MARKER)) return true;
+    } else if (e.type === "assistant" && (e.isApiErrorMessage === true || e.error !== void 0)) {
+      if (JSON.stringify(e.message ?? "").includes(ALLOWANCE_REFUSAL_MARKER)) return true;
+    }
+  }
+  return false;
+}
 var digestPathFor = (stateDir, routeLabel, role, runId) => join22(stateDir, `digest-${routeLabel}-${role}${runId ? `-${runId}` : ""}.md`);
 function planAgentRun(o) {
   const briefPath = join22(o.route.promptsDir, "personas", `lane-${o.role}.md`);
@@ -9423,7 +9511,17 @@ function planAgentRun(o) {
   const streamsDir = join22(o.stateDir, "streams");
   const base = `${routeLabel}-${o.role}-${o.cycle}${o.runId ? `-${o.runId}` : ""}`;
   const seat = resolveSeat(o.ship, o.route, o.role, o.agentPersona ?? (o.agentModel ? { model: o.agentModel } : {}), o.repo);
-  const { toolchain, model } = seat;
+  const { model } = seat;
+  let toolchain = seat.toolchain;
+  if (toolchain.auth === "workspace") {
+    if (!o.apiKey || o.seatKind === "ship") {
+      throw new WorkspaceAuthRefused(`${o.role}: toolchain ${toolchain.name} has auth: workspace, which needs the seat's own agent key \u2014 this seat would fall back to the ship key (run \`crew agents sync\`)`);
+    }
+    if (!o.route.resolved) {
+      throw new WorkspaceAuthRefused(`${o.role}: toolchain ${toolchain.name} has auth: workspace, but route ${o.route.route} is not connected (run \`crew connect\`)`);
+    }
+    toolchain = { ...toolchain, inference: { baseUrl: inferenceBaseUrl(o.route.baseUrl, o.route.resolved.workspaceId), token: o.apiKey } };
+  }
   const adapter = adapterFor(toolchain.harness);
   const invocation = adapter.invocation(toolchain, {
     role: o.role,
@@ -9468,6 +9566,7 @@ function planAgentRun(o) {
     args: invocation.args,
     toolchain: toolchain.name,
     harness: toolchain.harness,
+    workspaceAuth: toolchain.auth === "workspace",
     provider: toolchainProvider(toolchain),
     maxRunMinutes: resolveMaxRunMinutes(o.route.maxRunMinutes, toolchain.maxRunMinutes),
     resolution: { toolchain: seat.toolchainWhy, model: seat.modelWhy },
@@ -13090,7 +13189,8 @@ function planRepoClone(i) {
   const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
   const target = i.dir ? expandDir(i.dir, i.base) : join29(expandDir(basePath, i.base), i.route.split("/")[0], name);
   const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
-  return { ...add, remote, target };
+  const forgeHost = i.resolved?.repoForgeHosts?.[id];
+  return { ...add, remote, target, ...forgeHost ? { forgeHost } : {} };
 }
 
 // src/doctor-fix.ts
@@ -15216,7 +15316,7 @@ function runForge(a, io) {
     const doc = parseDocument4(io.readFile(io.configFile));
     doc.setIn(["ship", "forges", host, "token"], tok);
     io.writeFile(io.configFile, doc.toString());
-    io.forges = { ...io.forges ?? {}, [host]: { username: "x-access-token", token: tok } };
+    io.forges = { ...io.forges ?? {}, [host]: { username: forgeDescriptorFor(host).credentialUsername, token: tok } };
     existing = forgeFor(io.forges, host);
   }
   if (existing.entry.token.source === "env") {
@@ -16213,6 +16313,10 @@ async function discover(o) {
       repos.filter((r) => r.remote).map((r) => [r.id, r.remote])
     );
     if (Object.keys(remotes).length > 0) out.repoRemotes = remotes;
+    const forgeHosts = Object.fromEntries(
+      repos.filter((r) => r.forge_host?.trim()).map((r) => [r.id, r.forge_host.trim().toLowerCase()])
+    );
+    if (Object.keys(forgeHosts).length > 0) out.repoForgeHosts = forgeHosts;
   }
   if (o.area) {
     if (!out.areaModelId) problems.push(`--area given but this project has no "Projects" table`);
@@ -18366,7 +18470,8 @@ function passengerCheckoutSyncSpecs(cfg, workspaceId) {
         gitRemoteName: effective.branch.remote,
         base: effective.branch.base,
         originUrl: ordinary ? originUrlOf(ordinary.dir, effective.branch.remote) : null,
-        cloneScheme: cfg.ship.cloneScheme
+        cloneScheme: cfg.ship.cloneScheme,
+        ...target.forgeHost ? { forgeHost: target.forgeHost } : {}
       });
     }
   }
@@ -18376,7 +18481,7 @@ function syncAllPassengerCheckouts(cfg) {
   return passengerCheckoutSyncSpecs(cfg).map((spec) => ({
     name: spec.name,
     workspaceId: spec.workspaceId,
-    outcome: syncPassengerCheckout(spec.dir, spec.remote, spec.gitRemoteName, spec.base, { originUrl: spec.originUrl, scheme: spec.cloneScheme })
+    outcome: syncPassengerCheckout(spec.dir, spec.remote, spec.gitRemoteName, spec.base, { originUrl: spec.originUrl, scheme: spec.cloneScheme, host: spec.forgeHost })
   }));
 }
 
@@ -18749,7 +18854,7 @@ function createSyncDaemonServer(targets, secret) {
     try {
       const synced = targets.map((t) => ({
         name: t.name,
-        outcome: syncPassengerCheckout(t.dir, t.remote, t.gitRemoteName, t.base, { originUrl: t.originUrl, scheme: t.cloneScheme })
+        outcome: syncPassengerCheckout(t.dir, t.remote, t.gitRemoteName, t.base, { originUrl: t.originUrl, scheme: t.cloneScheme, host: t.forgeHost })
       }));
       res.writeHead(200, { "Content-Type": "application/json" }).end(JSON.stringify({ synced }));
     } catch (error) {
@@ -18912,6 +19017,7 @@ import { join as join42 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
+var ALLOWANCE_PAUSE_MS = 5 * 60 * 1e3;
 var defaultSleep = (ms3) => new Promise((resolve6) => setTimeout(resolve6, ms3));
 async function runDaemonLoop(o) {
   const floor = o.floorMs ?? DEFAULT_FLOOR_MS;
@@ -19045,6 +19151,10 @@ var SpawnBreaker = class {
     this.states.set(role, { failures, retryAt: this.now() + retryInMs, lastMessage: message });
     return { parked, firstOfMessage: prev?.lastMessage !== message, failures, retryInMs };
   }
+  /** CREW-2796: holds `role` back for `ms` without counting a failed start (an allowance pause). */
+  pause(role, ms3) {
+    this.states.set(role, { failures: 0, retryAt: this.now() + ms3, lastMessage: "paused" });
+  }
   /** A run for `role` spawned: forget its earlier failed starts. */
   recordSuccess(role) {
     this.states.delete(role);
@@ -19172,8 +19282,27 @@ async function runOnePassUnguarded(o) {
       const run2 = spawn9(role, decision, ctx, { ready }).then(() => {
         breaker.recordSuccess(role);
         clearShipAttention(o.state, `role_parked:${role}`);
+        clearShipAttention(o.state, workspaceAuthKey(role));
+        clearShipAttention(o.state, workspaceAllowanceKey(role));
       }).catch(async (e) => {
         const message = e.message;
+        if (e instanceof WorkspaceAllowanceExhausted) {
+          breaker.pause(role, ALLOWANCE_PAUSE_MS);
+          emit.warn(`${role} paused: ${message}`, { step: "agent", role });
+          await raiseShipAttention({ state: o.state, emit, route: o.route, ship: o.ship }, workspaceAllowanceItem(o.route.route, role));
+          return;
+        }
+        if (e instanceof WorkspaceAuthRefused) {
+          breaker.recordFailure(role, message);
+          emit.warn(`${role} agent refused: ${message}`, { step: "agent", role });
+          await raiseShipAttention({ state: o.state, emit, route: o.route, ship: o.ship }, {
+            kind: "workspace_auth",
+            key: workspaceAuthKey(role),
+            message: `${o.route.route}: ${message}`,
+            since: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          return;
+        }
         if (!(e instanceof AgentSpawnError)) {
           emit.warn(`${role} agent run failed: ${message}`, { step: "agent", role });
           return;
@@ -19421,7 +19550,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       const target = repoTargetFor(route2, result.ticket.repo_id);
       ticketRepo = target?.name;
       try {
-        if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: ship.cloneScheme })) {
+        if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: ship.cloneScheme, host: target.forgeHost })) {
           emit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role });
         }
       } catch (e) {
@@ -19440,6 +19569,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
     roster: rosterFor(decision, route2, role),
     environment: await buildEnvironment(route2, ship, ticketHint),
     apiKey: identity.apiKey,
+    seatKind: identity.kind,
     cycle: emit.cycle,
     runId,
     ticket: ticketHint,
@@ -19484,6 +19614,9 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       await postRunKilled(route2, tracker, workingId, memberId, result.killed.limitMinutes, emit);
     } else {
       await guardRunHandoff(route2, ship, tracker, role, workingId, emit, runStart);
+      if (plan.workspaceAuth && streamShowsAllowanceRefusal(plan.streamPath)) {
+        throw new WorkspaceAllowanceExhausted("the inference endpoint refused the run: the workspace is past its AI allowance");
+      }
     }
   } finally {
     await settleRunEnd({
@@ -21734,7 +21867,7 @@ ${cu.tail.trimEnd()}
             const target = repoTargetFor(w.route, result.ticket.repo_id);
             fleetTicketRepo = target?.name;
             try {
-              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme })) {
+              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme, host: target.forgeHost })) {
                 wemit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role: w.role });
               }
             } catch (e) {
@@ -21951,7 +22084,7 @@ ${cu.tail.trimEnd()}
             const target = repoTargetFor(route2, result.ticket.repo_id);
             ticketRepo = target?.name;
             try {
-              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme })) {
+              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme, host: target.forgeHost })) {
                 emit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role: current });
               }
             } catch (e) {
@@ -22691,7 +22824,7 @@ ${cu.tail.trimEnd()}
           }
           say("cloning", { remote: plan2.remote, target: plan2.target }, `cloning ${plan2.remote} into ${plan2.target}`);
           try {
-            ensureRepoCheckout(plan2.target, plan2.remote, { scheme: cfg.ship.cloneScheme ?? "https" });
+            ensureRepoCheckout(plan2.target, plan2.remote, { scheme: cfg.ship.cloneScheme ?? "https", host: plan2.forgeHost });
           } catch (e) {
             if (!(e instanceof GitError)) throw e;
             const authHint = /authentication failed|could not read (username|password)|permission denied|terminal prompts disabled|repository not found/i.test(e.message) ? "\n  hint: git could not authenticate \u2014 run `gh auth login` (or add an SSH key and set ship.cloneScheme: ssh), then re-run" : "";
@@ -23281,6 +23414,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           reposModelId: found.reposModelId,
           repoNames: found.repoNames,
           repoRemotes: found.repoRemotes,
+          repoForgeHosts: found.repoForgeHosts,
           models: found.models,
           seats: found.seats,
           holds: found.holds.map((h) => ({ id: h.id, role: h.name })),
@@ -25554,6 +25688,14 @@ ${foreign.join("\n")}
 `);
       }
       for (const t of shipToolchains(cfg.ship).filter((t2) => t2.harness === "claude")) {
+        if (t.auth === "workspace") {
+          for (const r of cfg.routes.filter((r2) => r2.enabled)) {
+            const inference = r.resolved ? { baseUrl: inferenceBaseUrl(r.baseUrl, r.resolved.workspaceId), token: "" } : void 0;
+            process.stdout.write(`auth:              ${t.name}: ${r.route}: ${describeClaudeAuth({ ...t, inference })}
+`);
+          }
+          continue;
+        }
         process.stdout.write(`auth:              ${t.name}: ${describeClaudeAuth(t)}
 `);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.97.0",
+  "version": "0.99.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",