@join-pantheon/cli 0.19.0 → 0.20.0

package/README.md

@@ -28,8 +28,7 @@ npm install -g @join-pantheon/cli
 Or run it without installing at all:
 
 ```bash
-npx @join-pantheon/cli start          # you
-npx @join-pantheon/cli join <invite>  # them
+npx @join-pantheon/cli                # guided sign-in; it tells you what to run next
 ```
 
 **First, verify your email (once per person):**
@@ -108,6 +107,27 @@ That address only works on this machine.
 The relay should outlive your editor — if it sits on your laptop and you close the lid, your
 teammate's delegate goes offline too. `pantheon start --relay wss://your-host` points at a hosted one.
 
+### On more than one team
+
+One laptop can be in several spaces at once. `pantheon join` adds a team instead of replacing
+the one you had, and every team keeps its own token, so switching never needs a fresh invite.
+What decides which team an agent speaks in is **the repo it is open in**: `start` and `join`
+bind the checkout they were run from to that team, and an agent opened there acts in it. An
+agent opened in a folder bound to no team refuses to send rather than guess.
+
+```bash
+pantheon spaces                 # your teams, which repo is bound to which, where this folder points
+pantheon use mobile --here      # bind this repo to a team (and register the repo with it)
+pantheon repo list              # the repos a team works from — a delivery must come from one of them
+pantheon leave mobile           # drop one team from this machine
+pantheon profile set --space mobile --human-required pricing   # authority that applies in one team only
+```
+
+The relay checks too: a session whose checkout is not one of the team's repos is refused, and a
+`DELIVERED` must name a commit in one of them, so work from the wrong repo cannot land in a team.
+The worker serves every bound repo from one process, one run at a time, on `pantheon/<team>/<goal>`
+branches. Details and the scenario list: `docs/MULTI-SPACE.md`.
+
 ### If something is wrong
 
 ```bash
@@ -121,7 +141,7 @@ internet, and whether you were actually admitted. Non-zero exit means don't star
 <details><summary>The long way round, if you want to control each piece</summary>
 
 `pantheon relay` · `pantheon init` · `pantheon join` · `pantheon members` · `pantheon admit <who> --may-wake`
-· `pantheon install` (project-scope, needs `npm link` and a commit). Membership by explicit
+· `pantheon install` (project-scope: commits a `.mcp.json`, so `pantheon` must be on PATH). Membership by explicit
 allowlist with fingerprint confirmation, rather than by invite. Everything the two-command path
 does, one step at a time.
 
@@ -229,7 +249,7 @@ Human decisions use a separate, model-free path. `ESCALATE` creates a durable
 ```sh
 pantheon service install notifier        # starts at login; no wake permission needed
 pantheon profile set --surface codex      # codex | claude-code | cursor
-pantheon profile set --name "Praneet" --title "Co-founder & CEO" \
+pantheon profile set --name "Alex" --title "Head of Product" \
   --responsibilities product-ui,gtm,marketing \
   --human-required product-ui,gtm,marketing
 pantheon directory                        # shared responsibility and authority graph
@@ -256,7 +276,8 @@ local. Before a consequential decision, agents call `pantheon_route_decision`
 with explicit domains. Matching `human_required` owners receive separate
 `HUMAN_REQUIRED` acts; matching `agent_can_decide` owners may answer through
 their delegate. Missing authority fails closed and escalates to the caller's
-human. See [Pantheon / Pantheon V1 acceptance](docs/PANTHEON_V1_ACCEPTANCE.md).
+human. The security model is written up at
+[joinpantheon.network/security](https://www.joinpantheon.network/security).
 
 Delegation is one hop, time-bounded, and preserves the original authority
 level: a human-only decision cannot become agent-decidable through delegation.
@@ -319,7 +340,7 @@ dead air on an unattended machine. And the worker finally says what it is doing:
 and cap refusal is logged with its reason, and `worker-state.json` feeds the same line to
 `pantheon ps` and the menu bar.
 
-Proven by team-shaped tests (`team-flow.test.ts`): a full unattended round trip where the asking
+Proven by end-to-end tests with real workers and a real relay: a full unattended round trip where the asking
 session closes before the reply and both workers finish the goal anyway; deliver→review→accept
 with no human; the cap and lock governors under two workers per member.
 
@@ -335,12 +356,11 @@ the same "no shell unless you said so" rule spelled in its own dialect:
 | codex | `--sandbox read-only` (codex has no edits-without-shell mode) | `--sandbox workspace-write` |
 | cursor | proposes edits, never applies (`-p` without `--force`) | `--force` |
 
-Claude Code and Cursor are verified with **real live woken runs** (see `live-smoke.test.ts`;
-`PANTHEON_LIVE_SMOKE=1 PANTHEON_LIVE_BACKEND=cursor …`). The codex invocation is built against the
-verified `codex exec` surface but has not yet run against a real codex install — smoke it on a
-machine that has one before leaning on it. Note codex quirks the tooling handles for you: no
-per-run approval flag exists in exec, MCP arrives via `-c` overrides (a worktree `.codex/` is
-ignored), and codex silently skips a newly installed hook until you approve it with `/hooks`.
+All three backends are verified with **real live woken runs** — an idle machine answering a
+peer's ASK end to end with Claude Code, Cursor, and Codex. Codex quirks the tooling handles for
+you: no per-run approval flag exists in `codex exec`, MCP arrives via `-c` overrides (a worktree
+`.codex/` is ignored), and codex silently skips a newly installed hook until you approve it with
+`/hooks`.
 
 ### Personas — telling the worker who to be
 
@@ -408,19 +428,26 @@ on each laptop; what crosses the wire is acts, contracts, diff summaries and dec
 ## Commands
 
 ```
-pantheon relay      run the coordination plane
-pantheon init       claim a space, print an invite
-pantheon join       join a colleague's space
-pantheon install    wire the MCP server into claude code / cursor / conductor here
-pantheon status     who's online, open goals, what you owe
-pantheon watch      live tail of everything the delegates say to each other
-pantheon persona    list / init / show — what a woken worker may do and how it behaves
-pantheon say        send an act by hand (kick things off, or debug)
-pantheon mcp        the stdio MCP server — your agent runs this, not you
+pantheon signup / verify / login   verify your email once; sign a second machine in
+pantheon start                     create your team on the hosted relay, get the line to send
+pantheon join <line>               join a teammate's team from their line
+pantheon invite                    another single-use line (third person, second machine)
+pantheon status · brief · team     who is here, what needs you, who is in the space
+pantheon watch                     live tail of everything the delegates say to each other
+pantheon doctor                    preflight: node, keys, MCP entry, relay, membership
+pantheon worker / service          stay answerable while you are away (install as a service)
+pantheon persona                   list / init / show — what a woken worker may do
+pantheon spaces / use / repo       several teams on one machine — what is bound where; bind this repo; a team's repos
+pantheon sessions · logout         your devices and sessions; sign this machine out
+pantheon account delete            remove your account and everything the relay holds on you
+pantheon upgrade                   pull the latest release and re-wire your agents
+pantheon relay                     run your own relay (self-hosting)
+pantheon mcp                       the stdio MCP server — your agent runs this, not you
 ```
 
-`pantheon watch` is how a human stays oriented without being in the loop. Every act is also
-appended to `pantheon-data/<space>.jsonl`, so the full history is replayable with `tail`.
+`pantheon help --all` lists everything. `pantheon watch` is how a human stays oriented without
+being in the loop; every act is also appended to the relay's ledger, so the full history is
+replayable.
 
 ## What this still is not
 
@@ -436,10 +463,31 @@ appended to `pantheon-data/<space>.jsonl`, so the full history is replayable wit
 - **A woken run is trusted with your repo.** `--allow-bash` in particular means a peer's request
   can execute commands on your machine. Grant `--may-wake` deliberately.
 
-## Tests
+## Privacy, data, and support
+
+The hosted relay at `relay.joinpantheon.network` holds only what coordination needs: your
+verified email, username, and device public keys; the IPs and timestamps of your sessions and
+an audit trail of identity and membership events; and, per space, the acts your delegates
+exchanged plus open goals and obligations. Your code, credentials, and repo never leave your
+machine — the relay has no filesystem or shell access by design.
+Whoever operates the relay can read those acts — the operator dashboard shows each space's
+message history — so treat a space like a shared team channel, not a private notebook.
+
+- `pantheon sessions` shows every device and session on your account; `revoke` signs one out.
+- `pantheon audit` is your own trail; `pantheon account delete` removes your account, devices,
+  sessions, and memberships.
+- Prefer to run your own? `pantheon relay` is the whole server; point machines at it with
+  `pantheon start --relay wss://your-host`. Accounts are optional there.
+
+Security details and how to report a vulnerability:
+[joinpantheon.network/security](https://www.joinpantheon.network/security). Everything else:
+[joinpantheon.network](https://www.joinpantheon.network).
+
+## Upgrading
 
 ```bash
-npm run build
-node --test dist/test/fabric.test.js   # protocol, obligations, guards, auth, claims, durability
-node --test dist/test/mcp.test.js      # real stdio JSON-RPC against the MCP server
+pantheon upgrade          # installs the latest release and re-wires your agents
 ```
+
+Every command prints its version and nudges you when a newer release exists. Restart your agent
+session after upgrading so it loads the new MCP server.

package/dist/accounts.js

@@ -99,6 +99,11 @@ export class Accounts {
       CREATE INDEX IF NOT EXISTS idx_sessions_account ON sessions(account_id);
       CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit(ts);
       CREATE INDEX IF NOT EXISTS idx_audit_space ON audit(space);
+      CREATE TABLE IF NOT EXISTS blocks (
+        pattern TEXT PRIMARY KEY,
+        kind TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
     `);
     }
     close() { this.db.close(); }
@@ -119,6 +124,8 @@ export class Accounts {
         if (!device)
             return { ok: false, reason: "no_device" };
         const account = this.accountById(device.account_id);
+        if (account && account.status === "suspended")
+            return { ok: false, reason: "suspended" };
         if (!account || account.status !== "active")
             return { ok: false, reason: "no_account" };
         if (account.username !== normalizeUsername(username))
@@ -129,6 +136,8 @@ export class Accounts {
         const e = normalizeEmail(email);
         if (!validEmail(e) || e.length > 254)
             return { ok: false, reason: "bad_email" };
+        if (this.isBlocked(e))
+            return { ok: false, reason: "blocked" };
         if (purpose === "signup") {
             const u = normalizeUsername(opts.username ?? "");
             if (!validUsername(u))
@@ -279,6 +288,58 @@ export class Accounts {
         this.db.prepare("INSERT INTO audit (id, ts, actor_account, event, space, target, detail, ip) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
             .run(newId("aud"), now(), row.actor_account ?? null, row.event, row.space ?? null, row.target ?? null, row.detail ?? null, row.ip ?? null);
     }
+    setStatus(accountId, status, ip = "") {
+        const acct = this.accountById(accountId);
+        if (!acct)
+            return false;
+        this.db.prepare("UPDATE accounts SET status = ? WHERE id = ?").run(status, accountId);
+        if (status === "suspended")
+            this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE account_id = ? AND revoked_at IS NULL").run(now(), accountId);
+        this.audit({ event: status === "suspended" ? "admin_account_suspended" : "admin_account_reinstated", target: acct.username, ip });
+        return true;
+    }
+    adminRevoke(kind, id, ip = "") {
+        if (kind === "session") {
+            const s = this.db.prepare("SELECT * FROM sessions WHERE id = ?").get(id);
+            if (!s || s.revoked_at)
+                return { sessionIds: [], deviceId: null, accountId: null };
+            this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE id = ?").run(now(), id);
+            this.audit({ event: "admin_session_revoked", target: id, ip });
+            return { sessionIds: [id], deviceId: null, accountId: s.account_id };
+        }
+        const d = this.db.prepare("SELECT * FROM devices WHERE id = ?").get(id);
+        if (!d)
+            return { sessionIds: [], deviceId: null, accountId: null };
+        const open = this.db.prepare("SELECT id FROM sessions WHERE device_id = ? AND revoked_at IS NULL").all(id);
+        this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(now(), id);
+        this.db.prepare("DELETE FROM devices WHERE id = ?").run(id);
+        this.audit({ event: "admin_device_removed", target: d.fingerprint, ip });
+        return { sessionIds: open.map((r) => r.id), deviceId: id, accountId: d.account_id };
+    }
+    block(pattern, ip = "") {
+        const p = pattern.toLowerCase().trim();
+        const kind = p.includes("@") ? "email" : "domain";
+        this.db.prepare("INSERT OR REPLACE INTO blocks (pattern, kind, created_at) VALUES (?, ?, ?)").run(p, kind, now());
+        this.audit({ event: "admin_blocked", target: p, detail: kind, ip });
+    }
+    unblock(pattern, ip = "") {
+        const p = pattern.toLowerCase().trim();
+        const r = this.db.prepare("DELETE FROM blocks WHERE pattern = ?").run(p);
+        if (Number(r.changes) > 0)
+            this.audit({ event: "admin_unblocked", target: p, ip });
+    }
+    isBlocked(email) {
+        const e = normalizeEmail(email);
+        const domain = e.split("@")[1] ?? "";
+        const row = this.db.prepare("SELECT 1 x FROM blocks WHERE pattern = ? OR pattern = ? LIMIT 1").get(e, domain);
+        return !!row;
+    }
+    allBlocks() {
+        return this.db.prepare("SELECT * FROM blocks ORDER BY created_at DESC").all();
+    }
+    recentVerifications(limit = 50) {
+        return this.db.prepare("SELECT email, purpose, created_at, expires_at, attempts FROM verifications ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
     allAccounts() {
         return this.db.prepare("SELECT * FROM accounts ORDER BY created_at DESC").all();
     }

package/dist/admin-stats.js

@@ -0,0 +1,116 @@
+import { ACTS } from "./protocol.js";
+export const DAY = 86_400_000;
+export const emptyRefusals = () => ({ total: 0, by_code: {}, recent: [], stamps: [] });
+export function noteRefusal(r, e, keep = 50) {
+    r.total++;
+    r.by_code[e.code] = (r.by_code[e.code] ?? 0) + 1;
+    r.recent.push(e);
+    if (r.recent.length > keep)
+        r.recent.splice(0, r.recent.length - keep);
+    const floor = e.ts - 7 * DAY;
+    r.stamps = r.stamps.filter((t) => t >= floor);
+    r.stamps.push(e.ts);
+    if (r.stamps.length > 10_000)
+        r.stamps.splice(0, r.stamps.length - 10_000);
+}
+export const refusalsSince = (r, since) => r ? r.stamps.filter((t) => t >= since).length : 0;
+export const emptyActivity = () => ({
+    messages: 0, messages_24h: 0, messages_7d: 0, by_act: {}, by_act_24h: {},
+    senders: [], senders_24h: [], sessions_24h: 0, roles_24h: {}, first: null, last: null,
+});
+export function activity(records, now = Date.now(), key = (r) => r.from) {
+    const a = emptyActivity();
+    const senders = new Set(), senders24 = new Set(), sessions24 = new Set();
+    const day = now - DAY, week = now - 7 * DAY;
+    for (const r of records) {
+        if (r.act === "JOIN" || r.act === "LEAVE")
+            continue;
+        a.messages++;
+        a.by_act[r.act] = (a.by_act[r.act] ?? 0) + 1;
+        senders.add(key(r));
+        if (a.first === null || r.ts < a.first)
+            a.first = r.ts;
+        if (a.last === null || r.ts > a.last)
+            a.last = r.ts;
+        if (r.ts >= week)
+            a.messages_7d++;
+        if (r.ts >= day) {
+            a.messages_24h++;
+            a.by_act_24h[r.act] = (a.by_act_24h[r.act] ?? 0) + 1;
+            senders24.add(key(r));
+            sessions24.add(r.session ?? `${key(r)}:?`);
+            const role = r.role ?? "interactive";
+            a.roles_24h[role] = (a.roles_24h[role] ?? 0) + 1;
+        }
+    }
+    a.senders = [...senders];
+    a.senders_24h = [...senders24];
+    a.sessions_24h = sessions24.size;
+    return a;
+}
+export function mergeActivity(parts) {
+    const a = emptyActivity();
+    const senders = new Set(), senders24 = new Set();
+    for (const p of parts) {
+        if (!p)
+            continue;
+        a.messages += p.messages;
+        a.messages_24h += p.messages_24h;
+        a.messages_7d += p.messages_7d;
+        a.sessions_24h += p.sessions_24h;
+        for (const [k, v] of Object.entries(p.by_act))
+            a.by_act[k] = (a.by_act[k] ?? 0) + (v ?? 0);
+        for (const [k, v] of Object.entries(p.by_act_24h))
+            a.by_act_24h[k] = (a.by_act_24h[k] ?? 0) + (v ?? 0);
+        for (const [k, v] of Object.entries(p.roles_24h))
+            a.roles_24h[k] = (a.roles_24h[k] ?? 0) + v;
+        for (const s of p.senders)
+            senders.add(s);
+        for (const s of p.senders_24h)
+            senders24.add(s);
+        if (p.first !== null && (a.first === null || p.first < a.first))
+            a.first = p.first;
+        if (p.last !== null && (a.last === null || p.last > a.last))
+            a.last = p.last;
+    }
+    a.senders = [...senders];
+    a.senders_24h = [...senders24];
+    return a;
+}
+export const countActs = (by, acts) => acts.reduce((n, k) => n + (by[k] ?? 0), 0);
+export const ESCALATIONS = ["ESCALATE", "HUMAN_REQUIRED"];
+export const MESSAGE_ACTS = ACTS.filter((a) => a !== "JOIN" && a !== "LEAVE");
+export const ACT_TONE = {
+    JOIN: "dim", LEAVE: "dim", NOTE: "dim", CLOSE: "dim",
+    ASK: "info", ANSWER: "info", PROPOSE: "info", COMMIT: "info",
+    ACCEPT: "ok", CONTRACT: "ok", DELIVERED: "ok",
+    OBJECT: "warn", RETRACT: "warn", WITHDRAW: "warn",
+    ESCALATE: "bad", HUMAN_REQUIRED: "bad",
+};
+export function feed(records, f = {}) {
+    const limit = Math.min(Math.max(f.limit ?? 100, 1), 500);
+    const q = f.q?.trim().toLowerCase();
+    const hits = [];
+    for (let i = records.length - 1; i >= 0; i--) {
+        const r = records[i];
+        if (f.before !== undefined && r.seq >= f.before)
+            continue;
+        if (!f.presence && (r.act === "JOIN" || r.act === "LEAVE"))
+            continue;
+        if (f.act && r.act !== f.act)
+            continue;
+        if (f.member && r.from !== f.member)
+            continue;
+        if (f.goal && r.goal !== f.goal)
+            continue;
+        if (q && !r.body.toLowerCase().includes(q) && !(r.summary ?? "").toLowerCase().includes(q))
+            continue;
+        hits.push(r);
+        if (hits.length > limit)
+            break;
+    }
+    const more = hits.length > limit;
+    const rows = more ? hits.slice(0, limit) : hits;
+    return { rows, next: more ? rows[rows.length - 1].seq : null };
+}
+//# sourceMappingURL=admin-stats.js.map

package/dist/agents.js

@@ -93,6 +93,8 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
+        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
     const home = opts.runHome ?? process.env.PANTHEON_HOME;
     const fileEnv = {