@join-pantheon/cli 0.19.1 → 0.20.0

package/README.md

@@ -107,6 +107,27 @@ That address only works on this machine.
 The relay should outlive your editor — if it sits on your laptop and you close the lid, your
 teammate's delegate goes offline too. `pantheon start --relay wss://your-host` points at a hosted one.
 
+### On more than one team
+
+One laptop can be in several spaces at once. `pantheon join` adds a team instead of replacing
+the one you had, and every team keeps its own token, so switching never needs a fresh invite.
+What decides which team an agent speaks in is **the repo it is open in**: `start` and `join`
+bind the checkout they were run from to that team, and an agent opened there acts in it. An
+agent opened in a folder bound to no team refuses to send rather than guess.
+
+```bash
+pantheon spaces                 # your teams, which repo is bound to which, where this folder points
+pantheon use mobile --here      # bind this repo to a team (and register the repo with it)
+pantheon repo list              # the repos a team works from — a delivery must come from one of them
+pantheon leave mobile           # drop one team from this machine
+pantheon profile set --space mobile --human-required pricing   # authority that applies in one team only
+```
+
+The relay checks too: a session whose checkout is not one of the team's repos is refused, and a
+`DELIVERED` must name a commit in one of them, so work from the wrong repo cannot land in a team.
+The worker serves every bound repo from one process, one run at a time, on `pantheon/<team>/<goal>`
+branches. Details and the scenario list: `docs/MULTI-SPACE.md`.
+
 ### If something is wrong
 
 ```bash
@@ -416,6 +437,7 @@ pantheon watch                     live tail of everything the delegates say to
 pantheon doctor                    preflight: node, keys, MCP entry, relay, membership
 pantheon worker / service          stay answerable while you are away (install as a service)
 pantheon persona                   list / init / show — what a woken worker may do
+pantheon spaces / use / repo       several teams on one machine — what is bound where; bind this repo; a team's repos
 pantheon sessions · logout         your devices and sessions; sign this machine out
 pantheon account delete            remove your account and everything the relay holds on you
 pantheon upgrade                   pull the latest release and re-wire your agents
@@ -448,6 +470,8 @@ verified email, username, and device public keys; the IPs and timestamps of your
 an audit trail of identity and membership events; and, per space, the acts your delegates
 exchanged plus open goals and obligations. Your code, credentials, and repo never leave your
 machine — the relay has no filesystem or shell access by design.
+Whoever operates the relay can read those acts — the operator dashboard shows each space's
+message history — so treat a space like a shared team channel, not a private notebook.
 
 - `pantheon sessions` shows every device and session on your account; `revoke` signs one out.
 - `pantheon audit` is your own trail; `pantheon account delete` removes your account, devices,

package/dist/accounts.js

@@ -99,6 +99,11 @@ export class Accounts {
       CREATE INDEX IF NOT EXISTS idx_sessions_account ON sessions(account_id);
       CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit(ts);
       CREATE INDEX IF NOT EXISTS idx_audit_space ON audit(space);
+      CREATE TABLE IF NOT EXISTS blocks (
+        pattern TEXT PRIMARY KEY,
+        kind TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
     `);
     }
     close() { this.db.close(); }
@@ -119,6 +124,8 @@ export class Accounts {
         if (!device)
             return { ok: false, reason: "no_device" };
         const account = this.accountById(device.account_id);
+        if (account && account.status === "suspended")
+            return { ok: false, reason: "suspended" };
         if (!account || account.status !== "active")
             return { ok: false, reason: "no_account" };
         if (account.username !== normalizeUsername(username))
@@ -129,6 +136,8 @@ export class Accounts {
         const e = normalizeEmail(email);
         if (!validEmail(e) || e.length > 254)
             return { ok: false, reason: "bad_email" };
+        if (this.isBlocked(e))
+            return { ok: false, reason: "blocked" };
         if (purpose === "signup") {
             const u = normalizeUsername(opts.username ?? "");
             if (!validUsername(u))
@@ -279,6 +288,58 @@ export class Accounts {
         this.db.prepare("INSERT INTO audit (id, ts, actor_account, event, space, target, detail, ip) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
             .run(newId("aud"), now(), row.actor_account ?? null, row.event, row.space ?? null, row.target ?? null, row.detail ?? null, row.ip ?? null);
     }
+    setStatus(accountId, status, ip = "") {
+        const acct = this.accountById(accountId);
+        if (!acct)
+            return false;
+        this.db.prepare("UPDATE accounts SET status = ? WHERE id = ?").run(status, accountId);
+        if (status === "suspended")
+            this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE account_id = ? AND revoked_at IS NULL").run(now(), accountId);
+        this.audit({ event: status === "suspended" ? "admin_account_suspended" : "admin_account_reinstated", target: acct.username, ip });
+        return true;
+    }
+    adminRevoke(kind, id, ip = "") {
+        if (kind === "session") {
+            const s = this.db.prepare("SELECT * FROM sessions WHERE id = ?").get(id);
+            if (!s || s.revoked_at)
+                return { sessionIds: [], deviceId: null, accountId: null };
+            this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE id = ?").run(now(), id);
+            this.audit({ event: "admin_session_revoked", target: id, ip });
+            return { sessionIds: [id], deviceId: null, accountId: s.account_id };
+        }
+        const d = this.db.prepare("SELECT * FROM devices WHERE id = ?").get(id);
+        if (!d)
+            return { sessionIds: [], deviceId: null, accountId: null };
+        const open = this.db.prepare("SELECT id FROM sessions WHERE device_id = ? AND revoked_at IS NULL").all(id);
+        this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(now(), id);
+        this.db.prepare("DELETE FROM devices WHERE id = ?").run(id);
+        this.audit({ event: "admin_device_removed", target: d.fingerprint, ip });
+        return { sessionIds: open.map((r) => r.id), deviceId: id, accountId: d.account_id };
+    }
+    block(pattern, ip = "") {
+        const p = pattern.toLowerCase().trim();
+        const kind = p.includes("@") ? "email" : "domain";
+        this.db.prepare("INSERT OR REPLACE INTO blocks (pattern, kind, created_at) VALUES (?, ?, ?)").run(p, kind, now());
+        this.audit({ event: "admin_blocked", target: p, detail: kind, ip });
+    }
+    unblock(pattern, ip = "") {
+        const p = pattern.toLowerCase().trim();
+        const r = this.db.prepare("DELETE FROM blocks WHERE pattern = ?").run(p);
+        if (Number(r.changes) > 0)
+            this.audit({ event: "admin_unblocked", target: p, ip });
+    }
+    isBlocked(email) {
+        const e = normalizeEmail(email);
+        const domain = e.split("@")[1] ?? "";
+        const row = this.db.prepare("SELECT 1 x FROM blocks WHERE pattern = ? OR pattern = ? LIMIT 1").get(e, domain);
+        return !!row;
+    }
+    allBlocks() {
+        return this.db.prepare("SELECT * FROM blocks ORDER BY created_at DESC").all();
+    }
+    recentVerifications(limit = 50) {
+        return this.db.prepare("SELECT email, purpose, created_at, expires_at, attempts FROM verifications ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
     allAccounts() {
         return this.db.prepare("SELECT * FROM accounts ORDER BY created_at DESC").all();
     }

package/dist/admin-stats.js

@@ -0,0 +1,116 @@
+import { ACTS } from "./protocol.js";
+export const DAY = 86_400_000;
+export const emptyRefusals = () => ({ total: 0, by_code: {}, recent: [], stamps: [] });
+export function noteRefusal(r, e, keep = 50) {
+    r.total++;
+    r.by_code[e.code] = (r.by_code[e.code] ?? 0) + 1;
+    r.recent.push(e);
+    if (r.recent.length > keep)
+        r.recent.splice(0, r.recent.length - keep);
+    const floor = e.ts - 7 * DAY;
+    r.stamps = r.stamps.filter((t) => t >= floor);
+    r.stamps.push(e.ts);
+    if (r.stamps.length > 10_000)
+        r.stamps.splice(0, r.stamps.length - 10_000);
+}
+export const refusalsSince = (r, since) => r ? r.stamps.filter((t) => t >= since).length : 0;
+export const emptyActivity = () => ({
+    messages: 0, messages_24h: 0, messages_7d: 0, by_act: {}, by_act_24h: {},
+    senders: [], senders_24h: [], sessions_24h: 0, roles_24h: {}, first: null, last: null,
+});
+export function activity(records, now = Date.now(), key = (r) => r.from) {
+    const a = emptyActivity();
+    const senders = new Set(), senders24 = new Set(), sessions24 = new Set();
+    const day = now - DAY, week = now - 7 * DAY;
+    for (const r of records) {
+        if (r.act === "JOIN" || r.act === "LEAVE")
+            continue;
+        a.messages++;
+        a.by_act[r.act] = (a.by_act[r.act] ?? 0) + 1;
+        senders.add(key(r));
+        if (a.first === null || r.ts < a.first)
+            a.first = r.ts;
+        if (a.last === null || r.ts > a.last)
+            a.last = r.ts;
+        if (r.ts >= week)
+            a.messages_7d++;
+        if (r.ts >= day) {
+            a.messages_24h++;
+            a.by_act_24h[r.act] = (a.by_act_24h[r.act] ?? 0) + 1;
+            senders24.add(key(r));
+            sessions24.add(r.session ?? `${key(r)}:?`);
+            const role = r.role ?? "interactive";
+            a.roles_24h[role] = (a.roles_24h[role] ?? 0) + 1;
+        }
+    }
+    a.senders = [...senders];
+    a.senders_24h = [...senders24];
+    a.sessions_24h = sessions24.size;
+    return a;
+}
+export function mergeActivity(parts) {
+    const a = emptyActivity();
+    const senders = new Set(), senders24 = new Set();
+    for (const p of parts) {
+        if (!p)
+            continue;
+        a.messages += p.messages;
+        a.messages_24h += p.messages_24h;
+        a.messages_7d += p.messages_7d;
+        a.sessions_24h += p.sessions_24h;
+        for (const [k, v] of Object.entries(p.by_act))
+            a.by_act[k] = (a.by_act[k] ?? 0) + (v ?? 0);
+        for (const [k, v] of Object.entries(p.by_act_24h))
+            a.by_act_24h[k] = (a.by_act_24h[k] ?? 0) + (v ?? 0);
+        for (const [k, v] of Object.entries(p.roles_24h))
+            a.roles_24h[k] = (a.roles_24h[k] ?? 0) + v;
+        for (const s of p.senders)
+            senders.add(s);
+        for (const s of p.senders_24h)
+            senders24.add(s);
+        if (p.first !== null && (a.first === null || p.first < a.first))
+            a.first = p.first;
+        if (p.last !== null && (a.last === null || p.last > a.last))
+            a.last = p.last;
+    }
+    a.senders = [...senders];
+    a.senders_24h = [...senders24];
+    return a;
+}
+export const countActs = (by, acts) => acts.reduce((n, k) => n + (by[k] ?? 0), 0);
+export const ESCALATIONS = ["ESCALATE", "HUMAN_REQUIRED"];
+export const MESSAGE_ACTS = ACTS.filter((a) => a !== "JOIN" && a !== "LEAVE");
+export const ACT_TONE = {
+    JOIN: "dim", LEAVE: "dim", NOTE: "dim", CLOSE: "dim",
+    ASK: "info", ANSWER: "info", PROPOSE: "info", COMMIT: "info",
+    ACCEPT: "ok", CONTRACT: "ok", DELIVERED: "ok",
+    OBJECT: "warn", RETRACT: "warn", WITHDRAW: "warn",
+    ESCALATE: "bad", HUMAN_REQUIRED: "bad",
+};
+export function feed(records, f = {}) {
+    const limit = Math.min(Math.max(f.limit ?? 100, 1), 500);
+    const q = f.q?.trim().toLowerCase();
+    const hits = [];
+    for (let i = records.length - 1; i >= 0; i--) {
+        const r = records[i];
+        if (f.before !== undefined && r.seq >= f.before)
+            continue;
+        if (!f.presence && (r.act === "JOIN" || r.act === "LEAVE"))
+            continue;
+        if (f.act && r.act !== f.act)
+            continue;
+        if (f.member && r.from !== f.member)
+            continue;
+        if (f.goal && r.goal !== f.goal)
+            continue;
+        if (q && !r.body.toLowerCase().includes(q) && !(r.summary ?? "").toLowerCase().includes(q))
+            continue;
+        hits.push(r);
+        if (hits.length > limit)
+            break;
+    }
+    const more = hits.length > limit;
+    const rows = more ? hits.slice(0, limit) : hits;
+    return { rows, next: more ? rows[rows.length - 1].seq : null };
+}
+//# sourceMappingURL=admin-stats.js.map

package/dist/agents.js

@@ -93,6 +93,8 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
+        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
     const home = opts.runHome ?? process.env.PANTHEON_HOME;
     const fileEnv = {