@join-pantheon/cli 0.20.0 → 0.21.0

package/README.md

@@ -67,7 +67,10 @@ every Conductor window, nothing to commit), the wake-up hook so an agent finishe
 waiting for, the **worker** so the machine answers the team even while its human is away (on by
 default when run inside a git repo; `--no-worker` opts out — and a peer still needs an explicit
 `--may-wake` grant before they can use it), native decision alerts, and the menu bar. Each command
-ends with a "You're set" summary. Restart your agent once and ask it *"check pantheon_status"*.
+ends with a "You're set" summary, then a short guided setup on a terminal: whether teammates may wake
+your machine while you are away, what a woken run may execute, who you are and which decisions are
+yours alone (so agents stop and ask you), and which alerts you want. Plain questions, mostly options;
+`pantheon setup` re-runs it any time. Restart your agent once and ask it *"check pantheon_status"*.
 
 Already a member — new laptop, or just pulled a newer build? The same full setup is one command:
 `pantheon install --user` (from your project's repo).
@@ -89,6 +92,15 @@ pantheon: that invite was already used by "alex" — ask for a fresh one
 
 Need another (a third person, or your own second machine)? `pantheon invite`.
 
+### Plans on the hosted relay
+
+A free account creates **one space** with **two people** in it — you and one invite. Personas,
+messages and history are not limited. Joining spaces other people created is not limited either,
+so a colleague on a bigger plan can always invite you. When you hit a limit the command says so
+and what to do; `pantheon status` shows your plan and how much of it you are using. Need more?
+[joinpantheon.network](https://www.joinpantheon.network). A space you founded and no longer need
+can be dissolved with `pantheon space delete <team> --yes`, which frees the slot.
+
 ### Reaching each other across cities
 
 On the hosted relay there is nothing to work out: every signed-in machine dials
@@ -119,6 +131,7 @@ agent opened in a folder bound to no team refuses to send rather than guess.
 pantheon spaces                 # your teams, which repo is bound to which, where this folder points
 pantheon use mobile --here      # bind this repo to a team (and register the repo with it)
 pantheon repo list              # the repos a team works from — a delivery must come from one of them
+pantheon repo add --base main   # the branch workers cut from and deliveries are judged against (default: origin's HEAD)
 pantheon leave mobile           # drop one team from this machine
 pantheon profile set --space mobile --human-required pricing   # authority that applies in one team only
 ```

package/dist/accounts.js

@@ -1,3 +1,4 @@
+import { DEFAULT_PLANS, parsePlans, parseLimits, planLimits } from "./plans.js";
 import { createRequire } from "node:module";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { chmodSync, mkdirSync, readdirSync, rmSync } from "node:fs";
@@ -104,7 +105,24 @@ export class Accounts {
         kind TEXT NOT NULL,
         created_at INTEGER NOT NULL
       );
+      CREATE TABLE IF NOT EXISTS settings (
+        key TEXT PRIMARY KEY,
+        json TEXT NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS spaces (
+        name TEXT PRIMARY KEY,
+        owner_account TEXT REFERENCES accounts(id) ON DELETE SET NULL,
+        created_at INTEGER NOT NULL,
+        deleted_at INTEGER
+      );
+      CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_account);
     `);
+        const cols = new Set(this.db.prepare("PRAGMA table_info(accounts)").all().map((c) => c.name));
+        if (!cols.has("plan"))
+            this.db.exec("ALTER TABLE accounts ADD COLUMN plan TEXT NOT NULL DEFAULT 'free'");
+        if (!cols.has("limits_json"))
+            this.db.exec("ALTER TABLE accounts ADD COLUMN limits_json TEXT");
     }
     close() { this.db.close(); }
     accountByUsername(username) {
@@ -201,7 +219,7 @@ export class Accounts {
                 else {
                     const id = newId("acct");
                     run("INSERT INTO accounts (id, email, username, status, created_at, tos_at) VALUES (?, ?, ?, 'active', ?, ?)").run(id, e, v.pending_username, now(), now());
-                    account = { id, email: e, username: v.pending_username, status: "active", created_at: now(), tos_at: now() };
+                    account = { id, email: e, username: v.pending_username, status: "active", created_at: now(), tos_at: now(), plan: "free", limits_json: null };
                 }
             }
             else {
@@ -340,6 +358,93 @@ export class Accounts {
     recentVerifications(limit = 50) {
         return this.db.prepare("SELECT email, purpose, created_at, expires_at, attempts FROM verifications ORDER BY created_at DESC LIMIT ?").all(limit);
     }
+    plans() {
+        const row = this.db.prepare("SELECT json FROM settings WHERE key = 'plans'").get();
+        if (row) {
+            try {
+                const p = parsePlans(JSON.parse(row.json));
+                if (p)
+                    return p;
+            }
+            catch { }
+        }
+        if (process.env.PANTHEON_PLANS_JSON) {
+            try {
+                const p = parsePlans(JSON.parse(process.env.PANTHEON_PLANS_JSON));
+                if (p)
+                    return p;
+            }
+            catch { }
+        }
+        return structuredClone(DEFAULT_PLANS);
+    }
+    setPlans(plans) {
+        if (!parsePlans(plans))
+            throw new Error("malformed plan table");
+        this.db.prepare("INSERT INTO settings (key, json, updated_at) VALUES ('plans', ?, ?) ON CONFLICT(key) DO UPDATE SET json = excluded.json, updated_at = excluded.updated_at")
+            .run(JSON.stringify(plans), now());
+    }
+    setPlan(accountId, plan) {
+        if (!this.plans()[plan])
+            return false;
+        return this.db.prepare("UPDATE accounts SET plan = ? WHERE id = ?").run(plan, accountId).changes > 0;
+    }
+    setLimits(accountId, json) {
+        if (json !== null) {
+            let ok = false;
+            try {
+                ok = !!parseLimits(JSON.parse(json));
+            }
+            catch {
+                ok = false;
+            }
+            if (!ok)
+                return false;
+        }
+        return this.db.prepare("UPDATE accounts SET limits_json = ? WHERE id = ?").run(json, accountId).changes > 0;
+    }
+    limitsFor(acct) { return planLimits(this.plans(), acct.plan, acct.limits_json); }
+    planCounts() {
+        const out = {};
+        for (const r of this.db.prepare("SELECT plan, COUNT(*) c FROM accounts GROUP BY plan").all())
+            out[r.plan] = r.c;
+        return out;
+    }
+    planLimitHits() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT actor_account a, COUNT(*) c FROM audit WHERE event = 'plan_limit' AND actor_account IS NOT NULL GROUP BY actor_account").all())
+            m.set(r.a, r.c);
+        return m;
+    }
+    recordSpace(name, ownerAccount) {
+        this.db.prepare("INSERT INTO spaces (name, owner_account, created_at, deleted_at) VALUES (?, ?, ?, NULL) " +
+            "ON CONFLICT(name) DO UPDATE SET owner_account = excluded.owner_account, created_at = excluded.created_at, deleted_at = NULL WHERE spaces.deleted_at IS NOT NULL").run(name, ownerAccount, now());
+    }
+    markSpaceDeleted(name) {
+        this.db.prepare("UPDATE spaces SET deleted_at = ? WHERE name = ? AND deleted_at IS NULL").run(now(), name);
+    }
+    spaceOwner(name) {
+        const r = this.db.prepare("SELECT owner_account FROM spaces WHERE name = ? AND deleted_at IS NULL").get(name);
+        return r?.owner_account ? this.accountById(r.owner_account) : null;
+    }
+    spacesOwned(accountId) {
+        return this.db.prepare("SELECT name FROM spaces WHERE owner_account = ? AND deleted_at IS NULL ORDER BY created_at").all(accountId).map((r) => r.name);
+    }
+    spaceOwners() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT name, owner_account FROM spaces WHERE deleted_at IS NULL AND owner_account IS NOT NULL").all())
+            m.set(r.name, r.owner_account);
+        return m;
+    }
+    ownedCounts() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT owner_account a, COUNT(*) c FROM spaces WHERE deleted_at IS NULL AND owner_account IS NOT NULL GROUP BY owner_account").all())
+            m.set(r.a, r.c);
+        return m;
+    }
+    hasSpaceRecord(name) {
+        return !!this.db.prepare("SELECT 1 FROM spaces WHERE name = ?").get(name);
+    }
     allAccounts() {
         return this.db.prepare("SELECT * FROM accounts ORDER BY created_at DESC").all();
     }

package/dist/agents.js

@@ -93,6 +93,8 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
+        ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
         ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
         ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
@@ -101,6 +103,8 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
+        ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
         ...(home ? { PANTHEON_HOME: home } : {}),
     };
     if (opts.backend.id === "claude-code") {

package/dist/cli.js

@@ -9,14 +9,16 @@ process.emitWarning = ((warning, ...rest) => {
 import { randomBytes } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
-import { fromInvite, load, save, toInvite, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY } from "./config.js";
+import { fromInvite, load, save, toInvite, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
+import { fmtLimit } from "./plans.js";
 import { validEmail, validUsername } from "./accounts.js";
 import { install, launcher } from "./install.js";
 import { Relay } from "./relay.js";
 import { runMcp } from "./mcp.js";
 import { Worker } from "./worker.js";
 import { DEFAULT_REMINDER_MS, ensureNativeNotifier, HumanNotifier, sendDesktopNotification } from "./notifier.js";
-import { AGENT_SURFACES, applyProfileInit, cleanList, isAgentSurface, loadProfile, organizationProfile, profileInitialized, saveProfile } from "./profile.js";
+import { AGENT_SURFACES, applyProfileInit, cleanList, isAgentSurface, loadProfile, organizationProfile, profileInitialized, saveProfile, wakeDefault } from "./profile.js";
+import { runGuide, terminalIO } from "./setup-guide.js";
 import { doctor, render } from "./doctor.js";
 import { menubarProc, notifierProc, relayProc, workerProc, wiring, logFileFor, dataSummary, stopProc, statFile } from "./machine.js";
 import { assess } from "./untrusted.js";
@@ -266,6 +268,39 @@ function unattendedProject() {
         return { project: resolve(flag("project", ".")), how: "explicit" };
     return { project: resolve("."), how: "default" };
 }
+async function guidedSetup(cfg, project, opts = {}) {
+    if (argv.includes("--no-guide"))
+        return;
+    const interactive = !!process.stdin.isTTY && !argv.includes("--yes");
+    if (!interactive && !opts.force)
+        return;
+    const rl = interactive ? createInterface({ input: process.stdin, output: process.stderr }) : null;
+    const io = rl ? terminalIO(rl, (l) => console.error(l)) : null;
+    console.error(`\n${B("A few choices, then you're done.")}${io ? "" : D("  (no terminal — taking the defaults)")}`);
+    try {
+        const r = await runGuide(io, { cfg, project }, {
+            publish: async (p) => {
+                const c = new PantheonClient(cfg, undefined, { role: "cli" });
+                try {
+                    await c.connect();
+                    await c.publishProfile(organizationProfile(p, cfg.spaceId, cfg.space));
+                }
+                finally {
+                    c.close();
+                }
+            },
+        });
+        console.error("");
+        for (const l of r.applied)
+            console.error(`  ${C("✓")} ${l}`);
+        for (const w of r.warnings)
+            console.error(`\x1b[33m  ! ${w}\x1b[0m`);
+        console.error(D(`\n  Change any of this later: pantheon setup`));
+    }
+    finally {
+        rl?.close();
+    }
+}
 function printReady(tools) {
     const workerOn = tools.some((t) => t.tool === "worker" && t.status.startsWith("on"));
     console.error(`\n${B("You're set.")} Restart your agent once (quit and reopen) and it is connected.`);
@@ -317,7 +352,9 @@ ${B("several teams on one machine")}
   pantheon spaces             your teams, which repo is bound to which, and where this folder points
   pantheon use <team> --here  bind this repo to a team (agents opened here speak in it)
   pantheon repo add | list    the repos a team works from; a delivery must come from one of them
+                              (repo add --base <branch>: the branch workers cut from, else origin's default)
   pantheon leave <team>       drop one team from this machine (its token and repo bindings)
+  pantheon space delete <team> --yes   dissolve a team you founded: disconnects everyone, frees a plan slot
   pantheon profile set --space <team> …   authority that applies in one team only (e.g. --human-required pricing)
 
 ${B("day to day")}
@@ -350,6 +387,8 @@ ${B("control")}
   pantheon leave              remove what pantheon put on this machine
   pantheon panic              cut off all unattended work on this machine, now
   pantheon doctor             check this machine end to end
+  pantheon setup              the guided choices: who may wake this machine, what a run may execute,
+                              what you personally decide, which alerts you want — re-run any time
   pantheon upgrade            pull the latest pantheon, rebuild, and re-wire your agents
 
 ${D("more: pantheon help --all")}
@@ -428,6 +467,8 @@ async function main() {
                 console.error(D(`  ${r.reach.hint}`));
             }
             printReady(r.tools);
+            if (r.claimed)
+                await guidedSetup(load() ?? r.cfg, repoInfo(process.cwd())?.root ?? null);
             if (r.relay) {
                 console.error(D(`\nKeeping the relay running here. Ctrl-C stops it (your teammate goes offline too).`));
                 await new Promise(() => { });
@@ -440,7 +481,8 @@ async function main() {
             await client.connect().catch((e) => die(client.pending ?? e.message));
             await new Promise((r) => setTimeout(r, 250));
             const ttl = Number(flag("ttl", "1440"));
-            const inv = await client.makeInvite(!argv.includes("--no-wake"), ttl).catch((e) => die(e.message));
+            const mayWake = argv.includes("--may-wake") ? true : argv.includes("--no-wake") ? false : wakeDefault(loadProfile(cfg));
+            const inv = await client.makeInvite(mayWake, ttl).catch((e) => die(e.message));
             console.log(`pantheon join ${toInvite({ ...cfg, token: inv.url })}`);
             console.error(D(`\nSingle use, expires ${new Date(inv.expires_at).toLocaleString()}.`));
             client.close();
@@ -558,6 +600,11 @@ async function main() {
                 console.error(`\x1b[33m  ! ${w}\x1b[0m`);
             printGranted(r.granted);
             printReady(r.tools);
+            {
+                const joined = load();
+                if (joined)
+                    await guidedSetup(joined, repoInfo(process.cwd())?.root ?? null);
+            }
             console.error(`\n${D('Then ask your agent: "check pantheon_status and say hello to the team".')}`);
             return;
         }
@@ -618,6 +665,11 @@ async function main() {
             }
             return;
         }
+        case "setup": {
+            const cfg = need();
+            await guidedSetup(cfg, repoInfo(process.cwd())?.root ?? null, { force: true });
+            return;
+        }
         case "version": {
             console.log(VERSION);
             return;
@@ -636,6 +688,8 @@ async function main() {
                 await new Promise((r) => setTimeout(r, 350));
                 const peers = client.roster.filter((m) => m.id !== cfg.member);
                 console.log(`${B(cfg.space)}  you are ${C(cfg.member)}  ${D(cfg.relay)}  ${D(`${client.head} acts`)}\n`);
+                if (client.plan)
+                    console.log(D(`  ${client.plan.name} plan · ${client.plan.usage.spaces} of ${fmtLimit(client.plan.limits.spaces)} spaces created · ${client.plan.usage.members} of ${fmtLimit(client.plan.limits.members)} people here${client.plan.limits.wake ? "" : " · no unattended workers"}`) + "\n");
                 console.log(B("members"));
                 if (!peers.length)
                     console.log(`  ${D("(nobody else yet — send them an invite from `pantheon invite`)")}`);
@@ -944,7 +998,7 @@ async function main() {
         }
         case "hook": {
             const sub = argv[1] ?? "status";
-            const hookCfg = needStrict();
+            const hookCfg = resolveForHook();
             const reportIdle = async (session, seen) => {
                 if (!hookCfg)
                     return true;
@@ -1047,7 +1101,7 @@ async function main() {
                     const { pending: pendingFn } = await import("./pending.js");
                     const { load: loadCfg } = await import("./config.js");
                     const d = await decideStop(JSON.stringify({ session_id: session }), {
-                        pending: async (s) => pendingFn({ session: s }),
+                        pending: async (s) => (hookCfg ? pendingFn({ session: s, cfg: hookCfg }) : Promise.resolve(null)),
                         ...(loadCfg()?.member ? { me: loadCfg().member } : {}),
                     });
                     if (d.exit === 2 && d.message) {
@@ -1080,7 +1134,7 @@ async function main() {
                     const { pending: pendingFn } = await import("./pending.js");
                     const { load: loadCfg } = await import("./config.js");
                     const d = await decideStop(raw, {
-                        pending: async (session) => pendingFn({ session }),
+                        pending: async (session) => (hookCfg ? pendingFn({ session, cfg: hookCfg }) : Promise.resolve(null)),
                         ...(loadCfg()?.member ? { me: loadCfg().member } : {}),
                     });
                     if (d.exit === 2 && d.message) {
@@ -1118,7 +1172,9 @@ async function main() {
                     let surfaced;
                     const d = await decideStop(raw, {
                         pending: async (session) => {
-                            const r = await pendingFn({ session });
+                            if (!hookCfg)
+                                return null;
+                            const r = await pendingFn({ session, cfg: hookCfg });
                             if (r)
                                 surfaced = r.seq;
                             return r;
@@ -1188,6 +1244,24 @@ async function main() {
             }
             return;
         }
+        case "space": {
+            const sub = argv[1];
+            const name = argv[2];
+            if (sub !== "delete" || !name || name.startsWith("--"))
+                die("usage: pantheon space delete <team> --yes");
+            const all = loadAll() ?? die("not configured");
+            const m = findMembership(all, name) ?? die(`you are not in a team called "${name}". Yours: ${Object.values(all.spaces ?? {}).map((x) => x.name).join(", ") || "none"}`);
+            if (!argv.includes("--yes"))
+                die(`this deletes "${m.name}" for everyone in it — its history, goals and invites — and cannot be undone.\n  If you mean it:  pantheon space delete ${m.name} --yes`);
+            const client = new PantheonClient(configFor(all, m, null), undefined, { role: "cli" });
+            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.deleteSpace(m.name).catch((e) => { client.close(); die(e.message); });
+            client.close();
+            const bound = Object.values(all.bindings ?? {}).filter((b) => b.space === m.id).length;
+            removeMembership(m.id);
+            console.error(`${B("deleted")} "${m.name}" — everyone in it was disconnected; its token${bound ? ` and ${bound} repo binding${bound === 1 ? "" : "s"}` : ""} left this machine`);
+            return;
+        }
         case "leave": {
             if (argv[1] && !argv[1].startsWith("--")) {
                 const all = loadAll() ?? die("not configured");
@@ -2159,16 +2233,17 @@ async function main() {
             await client.connect().catch((e) => die(client.pending ?? e.message));
             if (sub === "add") {
                 const r = repoInfo(flag("path") ?? process.cwd()) ?? die("not inside a git repo");
-                await client.bindRepo(r.fingerprint, r.origin).catch((e) => die(e.message));
+                const base = flag("base") ?? null;
+                await client.bindRepo(r.fingerprint, r.origin, base).catch((e) => die(e.message));
                 if (cfg.spaceId)
                     bindRepo(r, cfg.spaceId);
-                console.error(`${B("registered")} ${r.origin ?? r.root} as a repo "${cfg.space}" works from${r.shared ? "" : D("  (no origin remote — deliveries from it cannot be fetched)")}`);
+                console.error(`${B("registered")} ${r.origin ?? r.root} as a repo "${cfg.space}" works from${base ? ` — workers cut from ${C(base)}` : ""}${r.shared ? "" : D("  (no origin remote — deliveries from it cannot be fetched)")}`);
             }
             else {
                 await new Promise((res) => setTimeout(res, 150));
                 console.error(`${B(`repos "${cfg.space}" works from`)}  ${D(`(${client.repos.length})`)}`);
                 for (const r of client.repos)
-                    console.error(`  ${(r.origin ?? r.fingerprint).padEnd(48)} ${D(`added by ${r.added_by}`)}`);
+                    console.error(`  ${(r.origin ?? r.fingerprint).padEnd(48)} ${D(`added by ${r.added_by}`)}${r.base ? `  ${D("base")} ${C(r.base)}` : ""}`);
                 if (!client.repos.length)
                     console.error(D("  none yet — the first member to connect from a checkout registers it"));
             }

package/dist/client.js

@@ -38,6 +38,7 @@ export class PantheonClient {
     enrolledToken = null;
     spaceId = null;
     repos = [];
+    plan = null;
     enroll = null;
     inviteUrl = null;
     constructor(cfg, onEvent, opts) {
@@ -157,6 +158,7 @@ export class PantheonClient {
                             this.cfg.spaceId = msg.space_id;
                         }
                         this.repos = msg.repos ?? [];
+                        this.plan = msg.plan ?? null;
                         this.adoptKnownRepo();
                         this.backoff = 500;
                         this.roster = msg.roster;
@@ -375,29 +377,42 @@ export class PantheonClient {
         if (c.cwdRepoOrigin)
             c.repoOrigin = c.cwdRepoOrigin;
     }
-    bindRepo(fingerprint = this.cfg.repo, origin = this.cfg.repoOrigin ?? null) {
+    reportWorkerState(state, detail, until) {
+        try {
+            this.ws?.send(JSON.stringify({ t: "worker_state", state, ...(detail ? { detail: detail.slice(0, 200) } : {}), ...(until ? { until } : {}) }));
+        }
+        catch { }
+    }
+    deleteSpace(confirm) {
+        return this.rpc({ t: "delete_space", confirm });
+    }
+    bindRepo(fingerprint = this.cfg.repo, origin = this.cfg.repoOrigin ?? null, base = null) {
         if (!fingerprint)
             return Promise.reject(new Error("not inside a git repo — run this from the team's checkout"));
-        return this.rpc({ t: "bind_repo", repo: fingerprint, origin });
+        return this.rpc({ t: "bind_repo", repo: fingerprint, origin, ...(base ? { base } : {}) });
     }
     makeInvite(mayWake = true, ttlMinutes = 60) {
         return new Promise((res, rej) => {
-            const t = setTimeout(() => rej(new Error("relay did not return an invite in 10s")), 10_000);
+            const cid = `c${++this.cid}`;
+            const finish = () => { clearInterval(poll); clearTimeout(t); this.acks.delete(cid); };
+            const t = setTimeout(() => { finish(); rej(new Error("relay did not return an invite in 10s")); }, 10_000);
             const poll = setInterval(() => {
                 if (this.inviteUrl) {
-                    clearInterval(poll);
-                    clearTimeout(t);
+                    finish();
                     const v = this.inviteUrl;
                     this.inviteUrl = null;
                     res(v);
                 }
             }, 40);
+            this.acks.set(cid, (v) => { if ("error" in v) {
+                finish();
+                rej(new Error(v.error));
+            } });
             try {
-                this.ws?.send(JSON.stringify({ t: "invite", may_wake: mayWake, ttl_minutes: ttlMinutes }));
+                this.ws?.send(JSON.stringify({ t: "invite", may_wake: mayWake, ttl_minutes: ttlMinutes, cid }));
             }
             catch (e) {
-                clearInterval(poll);
-                clearTimeout(t);
+                finish();
                 rej(e);
             }
         });

package/dist/config.js

@@ -153,6 +153,20 @@ export function resolveFor(cwd = process.cwd(), opts = {}) {
     }
     return { cfg: null, reason: "unbound", memberships: n, repo };
 }
+export function resolveForHook(cwd = process.cwd()) {
+    const r = resolveFor(cwd, { strict: true });
+    if (!r.cfg?.space)
+        return null;
+    if (r.reason !== "single" || !r.repo)
+        return r.cfg;
+    const f = loadAll();
+    const m = Object.values(f?.spaces ?? {})[0];
+    const bound = Object.values(f?.bindings ?? {}).filter((b) => b.space === m?.id);
+    if (!bound.length)
+        return r.cfg;
+    const here = r.repo;
+    return bound.some((b) => b.path === here.root || (!!b.origin && b.origin === here.origin)) ? r.cfg : null;
+}
 export function load() {
     return resolveFor(process.cwd()).cfg;
 }

package/dist/doctor.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { loadProfile, profileInitialized } from "./profile.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { PantheonClient } from "./client.js";
@@ -74,6 +75,14 @@ export async function doctor(projectDir) {
     verifyChallenge(cfg.publicKey, cfg.space, cfg.member, nonce, sig)
         ? add("pass", "identity", `keypair valid — fingerprint ${fingerprint(cfg.publicKey)}`)
         : add("fail", "identity", "your keypair does not verify against itself", "the config is corrupt — re-run `pantheon join` to mint a new identity, then get re-admitted");
+    const prof = loadProfile(cfg);
+    if (profileInitialized(prof)) {
+        const owns = Object.entries(prof.authority).filter(([, mode]) => mode === "human_required").map(([d]) => d);
+        add("pass", "profile", `${prof.human.display_name} — ${prof.human.title}${owns.length ? `; you personally decide: ${owns.join(", ")}` : "; no human-required domains yet"}`);
+    }
+    else {
+        add("warn", "profile", "no profile published — decisions cannot be routed to you, and a HUMAN_REQUIRED naming you arrives marked unverified", "pantheon profile set --name <you> --title <role> --human-required <domains you personally decide>");
+    }
     const mcpFile = join(projectDir, ".mcp.json");
     if (!existsSync(mcpFile)) {
         add("warn", "mcp entry", "no .mcp.json in this project", "run `pantheon install`");

package/dist/mcp.js

@@ -2,7 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { PantheonClient } from "./client.js";
-import { fenceBlock, fenceRubric } from "./untrusted.js";
+import { fenceBlock, fenceRubric, assess, fenceReminder } from "./untrusted.js";
 import { resolveFor } from "./config.js";
 import { LIMITS, SENDABLE } from "./protocol.js";
 import { VERSION } from "./version.js";
@@ -92,8 +92,16 @@ RULES
 - Answer every ASK addressed to you. An unanswered ASK blocks a peer and eventually stalls the goal.
 - ACCEPT means you actually checked. If something is wrong, OBJECT with the reason.
 - One act per pantheon_send. Keep bodies short and reference file paths instead of pasting code.
-- DELIVERED means pushed, not written: commit, push, then send branch + commit. Your peer cannot
-  see your disk. When a peer DELIVERS to you, fetch their commit and look at it before ACCEPTing.
+- DELIVERED means pushed, not written: commit, push, then send branch + commit (+ base: the commit
+  you cut from). Your peer cannot see your disk. When a peer DELIVERS to you, fetch their commit,
+  check the declared base is an ancestor and nothing unrelated rides along, then ACCEPT or OBJECT.
+- Scope against what the team can see. Grep origin/<branch>, not your working tree: your unpushed
+  commits and local edits do not exist for your peer, and naming files from them wastes a round.
+- If your human answers you directly in this session, settle your own ESCALATE yourself: pantheon_send
+  ANSWER with ref = the ESCALATE's id. In an interactive session ask your human first; ESCALATE is for
+  when they are not here. Never RETRACT an escalation to clear it.
+- Verdict first, evidence after, and short: a peer reads your act in one screen. Say when you edited
+  your own human's working tree as a side effect, and leave those edits uncommitted for them.
 - If pantheon_send returns PEER_TURN you have been talking to yourself — go back to pantheon_wait.
 
 The relay only moves messages. It has no access to your files, your shell, or your credentials.
@@ -137,6 +145,8 @@ export async function runMcp() {
     const role = process.env.PANTHEON_ROLE === "worker" ? "worker" : "interactive";
     const branch = process.env.PANTHEON_BRANCH;
     const client = new PantheonClient(cfg, undefined, { role });
+    let siblingsWarned = false;
+    let rubricShown = false;
     const server = new McpServer({ name: "pantheon", version: VERSION }, { instructions: instructions(cfg, role, branch) });
     let connectError = null;
     await client.connect().catch((e) => { connectError = e.message; });
@@ -211,6 +221,12 @@ export async function runMcp() {
         const ref = m?.branch && m?.commit
             ? `\n>> fetchable: branch ${m.branch} at ${m.commit} — fetch and check it before you ACCEPT`
             : "";
+        const base = m?.base && m?.commit
+            ? `\n>> declared base ${m.base}: verify it is an ancestor (git merge-base --is-ancestor ${m.base} ${m.commit}) and that nothing unrelated rides along (git log --oneline ${m.base}..${m.commit})`
+            : "";
+        const unverified = r.act === "HUMAN_REQUIRED" && m?.authority
+            ? `\n>> authority ${m.authority}: no published profile covers ${(m.unverified_domains ?? []).join(", ") || "these domains"}, so the relay let this reach the named human unverified. Ask them to run pantheon profile set.`
+            : "";
         const who = r.session ? `${r.from}[${r.session.slice(-6)}${r.role === "worker" ? "·worker" : ""}]` : r.from;
         const at = new Date(r.ts).toISOString().replace(/\.\d{3}Z$/, "Z");
         const safeBody = fenceBlock(who, r.body).block;
@@ -223,13 +239,25 @@ export async function runMcp() {
             .map((o) => `\n!! this ${r.act} dissolves obligation ${o.id}, which you had claimed (${o.body}) — it is no longer owed; stop working on it.`)
             .join("");
         return `[${r.seq}] ${r.act} from ${who}${r.to ? ` to ${r.to.join(",")}` : ""}` +
-            `${r.goal ? ` (goal ${r.goal})` : ""} at ${at} id=${r.id}${r.ref ? ` ref=${r.ref}` : ""}${lead}${stale}\n${safeBody}${ref}${dissolved}`;
+            `${r.goal ? ` (goal ${r.goal})` : ""} at ${at} id=${r.id}${r.ref ? ` ref=${r.ref}` : ""}${lead}${stale}\n${safeBody}${ref}${base}${unverified}${dissolved}`;
+    };
+    const fmtAll = (acts) => {
+        const flagged = acts.some((a) => assess(a.body).length > 0);
+        const rubric = !rubricShown || flagged ? fenceRubric(acts.length) : fenceReminder(acts.length);
+        rubricShown = true;
+        return acts.map(fmt).join("\n\n---\n\n") + `\n\n${rubric}`;
     };
-    const fmtAll = (acts) => acts.map(fmt).join("\n\n---\n\n") + `\n\n${fenceRubric(acts.length)}`;
     const situation = () => {
         const open = [...client.goals.values()].filter((g) => g.state !== "CLOSED");
         const reach = (p) => {
             const head = client.head;
+            const w = p.worker;
+            const worker = w?.state === "holding"
+                ? `; their worker is holding — ${w.detail ?? "deferring to a live session"}${w.until && w.until > Date.now() ? `, ~${Math.round((w.until - Date.now()) / 1000)}s more` : ""}`
+                : w?.state === "running" ? `; their worker is running${w.detail ? ` (${w.detail})` : ""}` : "";
+            return reachText(p, head) + worker;
+        };
+        const reachText = (p, head) => {
             if (p.seen_seq === undefined) {
                 return p.delivered_seq !== undefined && p.delivered_seq >= head
                     ? ", delivered but no read-receipt — they have no wake-up hook, so it waits for their human"
@@ -245,10 +273,13 @@ export async function runMcp() {
         const peers = client.roster.filter((m) => m.id !== cfg.member);
         const siblings = (client.roster.find((m) => m.id === cfg.member)?.sessions ?? [])
             .filter((s) => s.id !== client.session);
+        const warnSiblings = siblings.length && !siblingsWarned;
+        if (siblings.length)
+            siblingsWarned = true;
         return [
             `you are: ${cfg.member} (${cfg.agent ?? "unknown agent"}, session ${client.session}, role ${role})   space: ${cfg.space}   relay: ${client.connected ? "connected" : "OFFLINE"}`,
             siblings.length
-                ? `your other sessions: ${siblings.map((s) => `${s.id}[${s.role}]`).join(" ")} — claim work before doing it, or you will duplicate theirs`
+                ? `your other sessions: ${siblings.map((s) => `${s.id}[${s.role}]`).join(" ")}${warnSiblings ? " — claim work before doing it, or you will duplicate theirs" : ""}`
                 : `your other sessions: none`,
             peers.length
                 ? `peers: ${peers.map((p) => `${p.id} [${p.online ? "online" : "offline"}, ${p.agent}${reach(p)}]`).join("  ")}`
@@ -319,7 +350,7 @@ export async function runMcp() {
                 : `ASK ${owner.member}'s agent about ${owner.domains.join(", ")}.`);
         }
         if (route.unmatched_domains.length || !route.domains.length) {
-            next.push(`Authority is unresolved${route.unmatched_domains.length ? ` for ${route.unmatched_domains.join(", ")}` : ""}; ESCALATE to your own human instead of guessing.`);
+            next.push(`No published profile owns${route.unmatched_domains.length ? ` ${route.unmatched_domains.join(", ")}` : " these domains"}. If one named peer's human clearly must decide, HUMAN_REQUIRED to them still goes through, marked unverified — and ask them to run pantheon profile set. If it is your own human's call, ESCALATE. Do not guess an owner.`);
         }
         return text(`${JSON.stringify(route, null, 2)}\n\nNEXT\n${next.map((x) => `- ${x}`).join("\n")}`);
     }));
@@ -362,16 +393,19 @@ export async function runMcp() {
             ref: z.string().optional().describe("id of the act you are responding to; required for ANSWER/ACCEPT/OBJECT"),
             branch: z.string().optional().describe("REQUIRED for DELIVERED: the branch you pushed the work to"),
             commit: z.string().optional().describe("REQUIRED for DELIVERED: the commit sha your peer should fetch and check"),
+            base: z.string().optional().describe("for DELIVERED: the commit your branch was cut from, so your peer can check nothing unrelated rides along. Worker runs fill this in automatically."),
             remote: z.string().optional().describe("for DELIVERED: the git remote your peer should fetch from (https://, ssh://, or user@host:path). Without it they have to guess that your origin is theirs."),
             defers_to: z.string().optional().describe("on CLOSE: the goal id you are standing down in favour of. The relay refuses this if that goal is closed or is itself deferring, because both sides standing down at once leaves the work with nowhere to live."),
             affects: z.array(z.string()).optional().describe("on PROPOSE: whose agreement this actually needs. Without it EVERY member of the goal owes a verdict — including anyone offline — so a three-person goal stalls on whoever is away."),
         },
-    }, async ({ act, body, goal, to, ref, branch, commit, remote, decision_domains, summary, defers_to, affects }) => guard(async () => {
-        const meta = branch || commit || remote || decision_domains?.length
+    }, async ({ act, body, goal, to, ref, branch, commit, remote, base, decision_domains, summary, defers_to, affects }) => guard(async () => {
+        const baseSha = act === "DELIVERED" ? (base ?? process.env.PANTHEON_BASE) : undefined;
+        const meta = branch || commit || remote || baseSha || decision_domains?.length
             ? {
                 ...(branch ? { branch } : {}),
                 ...(commit ? { commit } : {}),
                 ...(remote ? { remote } : {}),
+                ...(baseSha ? { base: baseSha } : {}),
                 ...(decision_domains?.length ? { decision_domains } : {}),
             }
             : undefined;