@join-pantheon/cli 0.19.1 → 0.21.0

package/README.md

@@ -67,7 +67,10 @@ every Conductor window, nothing to commit), the wake-up hook so an agent finishe
 waiting for, the **worker** so the machine answers the team even while its human is away (on by
 default when run inside a git repo; `--no-worker` opts out — and a peer still needs an explicit
 `--may-wake` grant before they can use it), native decision alerts, and the menu bar. Each command
-ends with a "You're set" summary. Restart your agent once and ask it *"check pantheon_status"*.
+ends with a "You're set" summary, then a short guided setup on a terminal: whether teammates may wake
+your machine while you are away, what a woken run may execute, who you are and which decisions are
+yours alone (so agents stop and ask you), and which alerts you want. Plain questions, mostly options;
+`pantheon setup` re-runs it any time. Restart your agent once and ask it *"check pantheon_status"*.
 
 Already a member — new laptop, or just pulled a newer build? The same full setup is one command:
 `pantheon install --user` (from your project's repo).
@@ -89,6 +92,15 @@ pantheon: that invite was already used by "alex" — ask for a fresh one
 
 Need another (a third person, or your own second machine)? `pantheon invite`.
 
+### Plans on the hosted relay
+
+A free account creates **one space** with **two people** in it — you and one invite. Personas,
+messages and history are not limited. Joining spaces other people created is not limited either,
+so a colleague on a bigger plan can always invite you. When you hit a limit the command says so
+and what to do; `pantheon status` shows your plan and how much of it you are using. Need more?
+[joinpantheon.network](https://www.joinpantheon.network). A space you founded and no longer need
+can be dissolved with `pantheon space delete <team> --yes`, which frees the slot.
+
 ### Reaching each other across cities
 
 On the hosted relay there is nothing to work out: every signed-in machine dials
@@ -107,6 +119,28 @@ That address only works on this machine.
 The relay should outlive your editor — if it sits on your laptop and you close the lid, your
 teammate's delegate goes offline too. `pantheon start --relay wss://your-host` points at a hosted one.
 
+### On more than one team
+
+One laptop can be in several spaces at once. `pantheon join` adds a team instead of replacing
+the one you had, and every team keeps its own token, so switching never needs a fresh invite.
+What decides which team an agent speaks in is **the repo it is open in**: `start` and `join`
+bind the checkout they were run from to that team, and an agent opened there acts in it. An
+agent opened in a folder bound to no team refuses to send rather than guess.
+
+```bash
+pantheon spaces                 # your teams, which repo is bound to which, where this folder points
+pantheon use mobile --here      # bind this repo to a team (and register the repo with it)
+pantheon repo list              # the repos a team works from — a delivery must come from one of them
+pantheon repo add --base main   # the branch workers cut from and deliveries are judged against (default: origin's HEAD)
+pantheon leave mobile           # drop one team from this machine
+pantheon profile set --space mobile --human-required pricing   # authority that applies in one team only
+```
+
+The relay checks too: a session whose checkout is not one of the team's repos is refused, and a
+`DELIVERED` must name a commit in one of them, so work from the wrong repo cannot land in a team.
+The worker serves every bound repo from one process, one run at a time, on `pantheon/<team>/<goal>`
+branches. Details and the scenario list: `docs/MULTI-SPACE.md`.
+
 ### If something is wrong
 
 ```bash
@@ -416,6 +450,7 @@ pantheon watch                     live tail of everything the delegates say to
 pantheon doctor                    preflight: node, keys, MCP entry, relay, membership
 pantheon worker / service          stay answerable while you are away (install as a service)
 pantheon persona                   list / init / show — what a woken worker may do
+pantheon spaces / use / repo       several teams on one machine — what is bound where; bind this repo; a team's repos
 pantheon sessions · logout         your devices and sessions; sign this machine out
 pantheon account delete            remove your account and everything the relay holds on you
 pantheon upgrade                   pull the latest release and re-wire your agents
@@ -448,6 +483,8 @@ verified email, username, and device public keys; the IPs and timestamps of your
 an audit trail of identity and membership events; and, per space, the acts your delegates
 exchanged plus open goals and obligations. Your code, credentials, and repo never leave your
 machine — the relay has no filesystem or shell access by design.
+Whoever operates the relay can read those acts — the operator dashboard shows each space's
+message history — so treat a space like a shared team channel, not a private notebook.
 
 - `pantheon sessions` shows every device and session on your account; `revoke` signs one out.
 - `pantheon audit` is your own trail; `pantheon account delete` removes your account, devices,

package/dist/accounts.js

@@ -1,3 +1,4 @@
+import { DEFAULT_PLANS, parsePlans, parseLimits, planLimits } from "./plans.js";
 import { createRequire } from "node:module";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { chmodSync, mkdirSync, readdirSync, rmSync } from "node:fs";
@@ -99,7 +100,29 @@ export class Accounts {
       CREATE INDEX IF NOT EXISTS idx_sessions_account ON sessions(account_id);
       CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit(ts);
       CREATE INDEX IF NOT EXISTS idx_audit_space ON audit(space);
+      CREATE TABLE IF NOT EXISTS blocks (
+        pattern TEXT PRIMARY KEY,
+        kind TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS settings (
+        key TEXT PRIMARY KEY,
+        json TEXT NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS spaces (
+        name TEXT PRIMARY KEY,
+        owner_account TEXT REFERENCES accounts(id) ON DELETE SET NULL,
+        created_at INTEGER NOT NULL,
+        deleted_at INTEGER
+      );
+      CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_account);
     `);
+        const cols = new Set(this.db.prepare("PRAGMA table_info(accounts)").all().map((c) => c.name));
+        if (!cols.has("plan"))
+            this.db.exec("ALTER TABLE accounts ADD COLUMN plan TEXT NOT NULL DEFAULT 'free'");
+        if (!cols.has("limits_json"))
+            this.db.exec("ALTER TABLE accounts ADD COLUMN limits_json TEXT");
     }
     close() { this.db.close(); }
     accountByUsername(username) {
@@ -119,6 +142,8 @@ export class Accounts {
         if (!device)
             return { ok: false, reason: "no_device" };
         const account = this.accountById(device.account_id);
+        if (account && account.status === "suspended")
+            return { ok: false, reason: "suspended" };
         if (!account || account.status !== "active")
             return { ok: false, reason: "no_account" };
         if (account.username !== normalizeUsername(username))
@@ -129,6 +154,8 @@ export class Accounts {
         const e = normalizeEmail(email);
         if (!validEmail(e) || e.length > 254)
             return { ok: false, reason: "bad_email" };
+        if (this.isBlocked(e))
+            return { ok: false, reason: "blocked" };
         if (purpose === "signup") {
             const u = normalizeUsername(opts.username ?? "");
             if (!validUsername(u))
@@ -192,7 +219,7 @@ export class Accounts {
                 else {
                     const id = newId("acct");
                     run("INSERT INTO accounts (id, email, username, status, created_at, tos_at) VALUES (?, ?, ?, 'active', ?, ?)").run(id, e, v.pending_username, now(), now());
-                    account = { id, email: e, username: v.pending_username, status: "active", created_at: now(), tos_at: now() };
+                    account = { id, email: e, username: v.pending_username, status: "active", created_at: now(), tos_at: now(), plan: "free", limits_json: null };
                 }
             }
             else {
@@ -279,6 +306,145 @@ export class Accounts {
         this.db.prepare("INSERT INTO audit (id, ts, actor_account, event, space, target, detail, ip) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
             .run(newId("aud"), now(), row.actor_account ?? null, row.event, row.space ?? null, row.target ?? null, row.detail ?? null, row.ip ?? null);
     }
+    setStatus(accountId, status, ip = "") {
+        const acct = this.accountById(accountId);
+        if (!acct)
+            return false;
+        this.db.prepare("UPDATE accounts SET status = ? WHERE id = ?").run(status, accountId);
+        if (status === "suspended")
+            this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE account_id = ? AND revoked_at IS NULL").run(now(), accountId);
+        this.audit({ event: status === "suspended" ? "admin_account_suspended" : "admin_account_reinstated", target: acct.username, ip });
+        return true;
+    }
+    adminRevoke(kind, id, ip = "") {
+        if (kind === "session") {
+            const s = this.db.prepare("SELECT * FROM sessions WHERE id = ?").get(id);
+            if (!s || s.revoked_at)
+                return { sessionIds: [], deviceId: null, accountId: null };
+            this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE id = ?").run(now(), id);
+            this.audit({ event: "admin_session_revoked", target: id, ip });
+            return { sessionIds: [id], deviceId: null, accountId: s.account_id };
+        }
+        const d = this.db.prepare("SELECT * FROM devices WHERE id = ?").get(id);
+        if (!d)
+            return { sessionIds: [], deviceId: null, accountId: null };
+        const open = this.db.prepare("SELECT id FROM sessions WHERE device_id = ? AND revoked_at IS NULL").all(id);
+        this.db.prepare("UPDATE sessions SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(now(), id);
+        this.db.prepare("DELETE FROM devices WHERE id = ?").run(id);
+        this.audit({ event: "admin_device_removed", target: d.fingerprint, ip });
+        return { sessionIds: open.map((r) => r.id), deviceId: id, accountId: d.account_id };
+    }
+    block(pattern, ip = "") {
+        const p = pattern.toLowerCase().trim();
+        const kind = p.includes("@") ? "email" : "domain";
+        this.db.prepare("INSERT OR REPLACE INTO blocks (pattern, kind, created_at) VALUES (?, ?, ?)").run(p, kind, now());
+        this.audit({ event: "admin_blocked", target: p, detail: kind, ip });
+    }
+    unblock(pattern, ip = "") {
+        const p = pattern.toLowerCase().trim();
+        const r = this.db.prepare("DELETE FROM blocks WHERE pattern = ?").run(p);
+        if (Number(r.changes) > 0)
+            this.audit({ event: "admin_unblocked", target: p, ip });
+    }
+    isBlocked(email) {
+        const e = normalizeEmail(email);
+        const domain = e.split("@")[1] ?? "";
+        const row = this.db.prepare("SELECT 1 x FROM blocks WHERE pattern = ? OR pattern = ? LIMIT 1").get(e, domain);
+        return !!row;
+    }
+    allBlocks() {
+        return this.db.prepare("SELECT * FROM blocks ORDER BY created_at DESC").all();
+    }
+    recentVerifications(limit = 50) {
+        return this.db.prepare("SELECT email, purpose, created_at, expires_at, attempts FROM verifications ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
+    plans() {
+        const row = this.db.prepare("SELECT json FROM settings WHERE key = 'plans'").get();
+        if (row) {
+            try {
+                const p = parsePlans(JSON.parse(row.json));
+                if (p)
+                    return p;
+            }
+            catch { }
+        }
+        if (process.env.PANTHEON_PLANS_JSON) {
+            try {
+                const p = parsePlans(JSON.parse(process.env.PANTHEON_PLANS_JSON));
+                if (p)
+                    return p;
+            }
+            catch { }
+        }
+        return structuredClone(DEFAULT_PLANS);
+    }
+    setPlans(plans) {
+        if (!parsePlans(plans))
+            throw new Error("malformed plan table");
+        this.db.prepare("INSERT INTO settings (key, json, updated_at) VALUES ('plans', ?, ?) ON CONFLICT(key) DO UPDATE SET json = excluded.json, updated_at = excluded.updated_at")
+            .run(JSON.stringify(plans), now());
+    }
+    setPlan(accountId, plan) {
+        if (!this.plans()[plan])
+            return false;
+        return this.db.prepare("UPDATE accounts SET plan = ? WHERE id = ?").run(plan, accountId).changes > 0;
+    }
+    setLimits(accountId, json) {
+        if (json !== null) {
+            let ok = false;
+            try {
+                ok = !!parseLimits(JSON.parse(json));
+            }
+            catch {
+                ok = false;
+            }
+            if (!ok)
+                return false;
+        }
+        return this.db.prepare("UPDATE accounts SET limits_json = ? WHERE id = ?").run(json, accountId).changes > 0;
+    }
+    limitsFor(acct) { return planLimits(this.plans(), acct.plan, acct.limits_json); }
+    planCounts() {
+        const out = {};
+        for (const r of this.db.prepare("SELECT plan, COUNT(*) c FROM accounts GROUP BY plan").all())
+            out[r.plan] = r.c;
+        return out;
+    }
+    planLimitHits() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT actor_account a, COUNT(*) c FROM audit WHERE event = 'plan_limit' AND actor_account IS NOT NULL GROUP BY actor_account").all())
+            m.set(r.a, r.c);
+        return m;
+    }
+    recordSpace(name, ownerAccount) {
+        this.db.prepare("INSERT INTO spaces (name, owner_account, created_at, deleted_at) VALUES (?, ?, ?, NULL) " +
+            "ON CONFLICT(name) DO UPDATE SET owner_account = excluded.owner_account, created_at = excluded.created_at, deleted_at = NULL WHERE spaces.deleted_at IS NOT NULL").run(name, ownerAccount, now());
+    }
+    markSpaceDeleted(name) {
+        this.db.prepare("UPDATE spaces SET deleted_at = ? WHERE name = ? AND deleted_at IS NULL").run(now(), name);
+    }
+    spaceOwner(name) {
+        const r = this.db.prepare("SELECT owner_account FROM spaces WHERE name = ? AND deleted_at IS NULL").get(name);
+        return r?.owner_account ? this.accountById(r.owner_account) : null;
+    }
+    spacesOwned(accountId) {
+        return this.db.prepare("SELECT name FROM spaces WHERE owner_account = ? AND deleted_at IS NULL ORDER BY created_at").all(accountId).map((r) => r.name);
+    }
+    spaceOwners() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT name, owner_account FROM spaces WHERE deleted_at IS NULL AND owner_account IS NOT NULL").all())
+            m.set(r.name, r.owner_account);
+        return m;
+    }
+    ownedCounts() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT owner_account a, COUNT(*) c FROM spaces WHERE deleted_at IS NULL AND owner_account IS NOT NULL GROUP BY owner_account").all())
+            m.set(r.a, r.c);
+        return m;
+    }
+    hasSpaceRecord(name) {
+        return !!this.db.prepare("SELECT 1 FROM spaces WHERE name = ?").get(name);
+    }
     allAccounts() {
         return this.db.prepare("SELECT * FROM accounts ORDER BY created_at DESC").all();
     }

package/dist/admin-stats.js

@@ -0,0 +1,116 @@
+import { ACTS } from "./protocol.js";
+export const DAY = 86_400_000;
+export const emptyRefusals = () => ({ total: 0, by_code: {}, recent: [], stamps: [] });
+export function noteRefusal(r, e, keep = 50) {
+    r.total++;
+    r.by_code[e.code] = (r.by_code[e.code] ?? 0) + 1;
+    r.recent.push(e);
+    if (r.recent.length > keep)
+        r.recent.splice(0, r.recent.length - keep);
+    const floor = e.ts - 7 * DAY;
+    r.stamps = r.stamps.filter((t) => t >= floor);
+    r.stamps.push(e.ts);
+    if (r.stamps.length > 10_000)
+        r.stamps.splice(0, r.stamps.length - 10_000);
+}
+export const refusalsSince = (r, since) => r ? r.stamps.filter((t) => t >= since).length : 0;
+export const emptyActivity = () => ({
+    messages: 0, messages_24h: 0, messages_7d: 0, by_act: {}, by_act_24h: {},
+    senders: [], senders_24h: [], sessions_24h: 0, roles_24h: {}, first: null, last: null,
+});
+export function activity(records, now = Date.now(), key = (r) => r.from) {
+    const a = emptyActivity();
+    const senders = new Set(), senders24 = new Set(), sessions24 = new Set();
+    const day = now - DAY, week = now - 7 * DAY;
+    for (const r of records) {
+        if (r.act === "JOIN" || r.act === "LEAVE")
+            continue;
+        a.messages++;
+        a.by_act[r.act] = (a.by_act[r.act] ?? 0) + 1;
+        senders.add(key(r));
+        if (a.first === null || r.ts < a.first)
+            a.first = r.ts;
+        if (a.last === null || r.ts > a.last)
+            a.last = r.ts;
+        if (r.ts >= week)
+            a.messages_7d++;
+        if (r.ts >= day) {
+            a.messages_24h++;
+            a.by_act_24h[r.act] = (a.by_act_24h[r.act] ?? 0) + 1;
+            senders24.add(key(r));
+            sessions24.add(r.session ?? `${key(r)}:?`);
+            const role = r.role ?? "interactive";
+            a.roles_24h[role] = (a.roles_24h[role] ?? 0) + 1;
+        }
+    }
+    a.senders = [...senders];
+    a.senders_24h = [...senders24];
+    a.sessions_24h = sessions24.size;
+    return a;
+}
+export function mergeActivity(parts) {
+    const a = emptyActivity();
+    const senders = new Set(), senders24 = new Set();
+    for (const p of parts) {
+        if (!p)
+            continue;
+        a.messages += p.messages;
+        a.messages_24h += p.messages_24h;
+        a.messages_7d += p.messages_7d;
+        a.sessions_24h += p.sessions_24h;
+        for (const [k, v] of Object.entries(p.by_act))
+            a.by_act[k] = (a.by_act[k] ?? 0) + (v ?? 0);
+        for (const [k, v] of Object.entries(p.by_act_24h))
+            a.by_act_24h[k] = (a.by_act_24h[k] ?? 0) + (v ?? 0);
+        for (const [k, v] of Object.entries(p.roles_24h))
+            a.roles_24h[k] = (a.roles_24h[k] ?? 0) + v;
+        for (const s of p.senders)
+            senders.add(s);
+        for (const s of p.senders_24h)
+            senders24.add(s);
+        if (p.first !== null && (a.first === null || p.first < a.first))
+            a.first = p.first;
+        if (p.last !== null && (a.last === null || p.last > a.last))
+            a.last = p.last;
+    }
+    a.senders = [...senders];
+    a.senders_24h = [...senders24];
+    return a;
+}
+export const countActs = (by, acts) => acts.reduce((n, k) => n + (by[k] ?? 0), 0);
+export const ESCALATIONS = ["ESCALATE", "HUMAN_REQUIRED"];
+export const MESSAGE_ACTS = ACTS.filter((a) => a !== "JOIN" && a !== "LEAVE");
+export const ACT_TONE = {
+    JOIN: "dim", LEAVE: "dim", NOTE: "dim", CLOSE: "dim",
+    ASK: "info", ANSWER: "info", PROPOSE: "info", COMMIT: "info",
+    ACCEPT: "ok", CONTRACT: "ok", DELIVERED: "ok",
+    OBJECT: "warn", RETRACT: "warn", WITHDRAW: "warn",
+    ESCALATE: "bad", HUMAN_REQUIRED: "bad",
+};
+export function feed(records, f = {}) {
+    const limit = Math.min(Math.max(f.limit ?? 100, 1), 500);
+    const q = f.q?.trim().toLowerCase();
+    const hits = [];
+    for (let i = records.length - 1; i >= 0; i--) {
+        const r = records[i];
+        if (f.before !== undefined && r.seq >= f.before)
+            continue;
+        if (!f.presence && (r.act === "JOIN" || r.act === "LEAVE"))
+            continue;
+        if (f.act && r.act !== f.act)
+            continue;
+        if (f.member && r.from !== f.member)
+            continue;
+        if (f.goal && r.goal !== f.goal)
+            continue;
+        if (q && !r.body.toLowerCase().includes(q) && !(r.summary ?? "").toLowerCase().includes(q))
+            continue;
+        hits.push(r);
+        if (hits.length > limit)
+            break;
+    }
+    const more = hits.length > limit;
+    const rows = more ? hits.slice(0, limit) : hits;
+    return { rows, next: more ? rows[rows.length - 1].seq : null };
+}
+//# sourceMappingURL=admin-stats.js.map

package/dist/agents.js

@@ -93,12 +93,18 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
+        ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
+        ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
+        ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
     const home = opts.runHome ?? process.env.PANTHEON_HOME;
     const fileEnv = {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
+        ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
         ...(home ? { PANTHEON_HOME: home } : {}),
     };
     if (opts.backend.id === "claude-code") {