@join-pantheon/cli 0.20.0 → 0.21.1

package/README.md

@@ -67,7 +67,10 @@ every Conductor window, nothing to commit), the wake-up hook so an agent finishe
 waiting for, the **worker** so the machine answers the team even while its human is away (on by
 default when run inside a git repo; `--no-worker` opts out — and a peer still needs an explicit
 `--may-wake` grant before they can use it), native decision alerts, and the menu bar. Each command
-ends with a "You're set" summary. Restart your agent once and ask it *"check pantheon_status"*.
+ends with a "You're set" summary, then a short guided setup on a terminal: whether teammates may wake
+your machine while you are away, what a woken run may execute, who you are and which decisions are
+yours alone (so agents stop and ask you), and which alerts you want. Plain questions, mostly options;
+`pantheon setup` re-runs it any time. Restart your agent once and ask it *"check pantheon_status"*.
 
 Already a member — new laptop, or just pulled a newer build? The same full setup is one command:
 `pantheon install --user` (from your project's repo).
@@ -89,6 +92,15 @@ pantheon: that invite was already used by "alex" — ask for a fresh one
 
 Need another (a third person, or your own second machine)? `pantheon invite`.
 
+### Plans on the hosted relay
+
+A free account creates **one space** with **two people** in it — you and one invite. Personas,
+messages and history are not limited. Joining spaces other people created is not limited either,
+so a colleague on a bigger plan can always invite you. When you hit a limit the command says so
+and what to do; `pantheon status` shows your plan and how much of it you are using. Need more?
+[joinpantheon.network](https://www.joinpantheon.network). A space you founded and no longer need
+can be dissolved with `pantheon space delete <team> --yes`, which frees the slot.
+
 ### Reaching each other across cities
 
 On the hosted relay there is nothing to work out: every signed-in machine dials
@@ -119,6 +131,7 @@ agent opened in a folder bound to no team refuses to send rather than guess.
 pantheon spaces                 # your teams, which repo is bound to which, where this folder points
 pantheon use mobile --here      # bind this repo to a team (and register the repo with it)
 pantheon repo list              # the repos a team works from — a delivery must come from one of them
+pantheon repo add --base main   # the branch workers cut from and deliveries are judged against (default: origin's HEAD)
 pantheon leave mobile           # drop one team from this machine
 pantheon profile set --space mobile --human-required pricing   # authority that applies in one team only
 ```
@@ -486,8 +499,12 @@ Security details and how to report a vulnerability:
 ## Upgrading
 
 ```bash
-pantheon upgrade          # installs the latest release and re-wires your agents
+pantheon upgrade          # installs the latest release and finishes the job
 ```
 
-Every command prints its version and nudges you when a newer release exists. Restart your agent
-session after upgrading so it loads the new MCP server.
+Every command prints its version and nudges you when a newer release exists. `pantheon upgrade`
+installs the new release, re-wires your agents, restarts pantheon's own background services (the
+worker, alerts, menu bar) so they load the new code, and asks any setup question the new version
+has that you have never answered. The one thing it cannot do is restart your agent windows: quit
+and reopen them so they load the new server. A self-hosted relay is shared with your teammates, so
+it prints the restart for that and leaves the timing to you.

package/dist/accounts.js

@@ -1,3 +1,4 @@
+import { DEFAULT_PLANS, parsePlans, parseLimits, planLimits } from "./plans.js";
 import { createRequire } from "node:module";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { chmodSync, mkdirSync, readdirSync, rmSync } from "node:fs";
@@ -104,7 +105,29 @@ export class Accounts {
         kind TEXT NOT NULL,
         created_at INTEGER NOT NULL
       );
+      CREATE TABLE IF NOT EXISTS settings (
+        key TEXT PRIMARY KEY,
+        json TEXT NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS spaces (
+        name TEXT PRIMARY KEY,
+        owner_account TEXT REFERENCES accounts(id) ON DELETE SET NULL,
+        created_at INTEGER NOT NULL,
+        deleted_at INTEGER
+      );
+      CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_account);
     `);
+        const cols = new Set(this.db.prepare("PRAGMA table_info(accounts)").all().map((c) => c.name));
+        if (!cols.has("plan"))
+            this.db.exec("ALTER TABLE accounts ADD COLUMN plan TEXT NOT NULL DEFAULT 'free'");
+        if (!cols.has("limits_json"))
+            this.db.exec("ALTER TABLE accounts ADD COLUMN limits_json TEXT");
+        const scols = new Set(this.db.prepare("PRAGMA table_info(sessions)").all().map((c) => c.name));
+        if (!scols.has("ended_at"))
+            this.db.exec("ALTER TABLE sessions ADD COLUMN ended_at INTEGER");
+        if (!scols.has("role"))
+            this.db.exec("ALTER TABLE sessions ADD COLUMN role TEXT");
     }
     close() { this.db.close(); }
     accountByUsername(username) {
@@ -201,7 +224,7 @@ export class Accounts {
                 else {
                     const id = newId("acct");
                     run("INSERT INTO accounts (id, email, username, status, created_at, tos_at) VALUES (?, ?, ?, 'active', ?, ?)").run(id, e, v.pending_username, now(), now());
-                    account = { id, email: e, username: v.pending_username, status: "active", created_at: now(), tos_at: now() };
+                    account = { id, email: e, username: v.pending_username, status: "active", created_at: now(), tos_at: now(), plan: "free", limits_json: null };
                 }
             }
             else {
@@ -231,18 +254,28 @@ export class Accounts {
         this.audit({ actor_account: accountId, event: "device_added", target: d.fingerprint });
         return d;
     }
-    openSession(accountId, deviceId, space, ip) {
-        const s = { id: newId("ses"), account_id: accountId, device_id: deviceId, space, ip, created_at: now(), last_seen: now(), revoked_at: null };
-        this.db.prepare("INSERT INTO sessions (id, account_id, device_id, space, ip, created_at, last_seen, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)")
-            .run(s.id, s.account_id, s.device_id, s.space, s.ip, s.created_at, s.last_seen);
-        this.audit({ actor_account: accountId, event: "session_created", space: space || null, target: s.id, ip });
+    openSession(accountId, deviceId, space, ip, role = null) {
+        const prior = this.db.prepare("SELECT ip FROM sessions WHERE device_id = ? ORDER BY created_at DESC LIMIT 1").get(deviceId);
+        const s = { id: newId("ses"), account_id: accountId, device_id: deviceId, space, ip, created_at: now(), last_seen: now(), revoked_at: null, ended_at: null, role };
+        this.db.prepare("INSERT INTO sessions (id, account_id, device_id, space, ip, created_at, last_seen, revoked_at, ended_at, role) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?)")
+            .run(s.id, s.account_id, s.device_id, s.space, s.ip, s.created_at, s.last_seen, role);
+        if (!prior)
+            this.audit({ actor_account: accountId, event: "session_created", space: space || null, target: s.id, ip });
+        else if (prior.ip !== ip)
+            this.audit({ actor_account: accountId, event: "device_new_ip", space: space || null, target: deviceId, detail: `${prior.ip} → ${ip}`, ip });
         return s;
     }
     touchSession(id) {
-        this.db.prepare("UPDATE sessions SET last_seen = ? WHERE id = ? AND revoked_at IS NULL").run(now(), id);
+        this.db.prepare("UPDATE sessions SET last_seen = ? WHERE id = ? AND revoked_at IS NULL AND ended_at IS NULL").run(now(), id);
+    }
+    endAllOpenSessions() {
+        return Number(this.db.prepare("UPDATE sessions SET ended_at = ?, last_seen = last_seen WHERE ended_at IS NULL").run(now()).changes);
+    }
+    endSession(id) {
+        this.db.prepare("UPDATE sessions SET ended_at = ?, last_seen = ? WHERE id = ? AND ended_at IS NULL").run(now(), now(), id);
     }
     sessionsFor(accountId) {
-        return this.db.prepare("SELECT * FROM sessions WHERE account_id = ? ORDER BY created_at DESC").all(accountId);
+        return this.db.prepare("SELECT * FROM sessions WHERE account_id = ? AND ended_at IS NULL ORDER BY created_at DESC").all(accountId);
     }
     devicesFor(accountId) {
         return this.db.prepare("SELECT * FROM devices WHERE account_id = ? ORDER BY created_at ASC").all(accountId);
@@ -340,12 +373,105 @@ export class Accounts {
     recentVerifications(limit = 50) {
         return this.db.prepare("SELECT email, purpose, created_at, expires_at, attempts FROM verifications ORDER BY created_at DESC LIMIT ?").all(limit);
     }
+    plans() {
+        const row = this.db.prepare("SELECT json FROM settings WHERE key = 'plans'").get();
+        if (row) {
+            try {
+                const p = parsePlans(JSON.parse(row.json));
+                if (p)
+                    return p;
+            }
+            catch { }
+        }
+        if (process.env.PANTHEON_PLANS_JSON) {
+            try {
+                const p = parsePlans(JSON.parse(process.env.PANTHEON_PLANS_JSON));
+                if (p)
+                    return p;
+            }
+            catch { }
+        }
+        return structuredClone(DEFAULT_PLANS);
+    }
+    setPlans(plans) {
+        if (!parsePlans(plans))
+            throw new Error("malformed plan table");
+        this.db.prepare("INSERT INTO settings (key, json, updated_at) VALUES ('plans', ?, ?) ON CONFLICT(key) DO UPDATE SET json = excluded.json, updated_at = excluded.updated_at")
+            .run(JSON.stringify(plans), now());
+    }
+    setPlan(accountId, plan) {
+        if (!this.plans()[plan])
+            return false;
+        return this.db.prepare("UPDATE accounts SET plan = ? WHERE id = ?").run(plan, accountId).changes > 0;
+    }
+    setLimits(accountId, json) {
+        if (json !== null) {
+            let ok = false;
+            try {
+                ok = !!parseLimits(JSON.parse(json));
+            }
+            catch {
+                ok = false;
+            }
+            if (!ok)
+                return false;
+        }
+        return this.db.prepare("UPDATE accounts SET limits_json = ? WHERE id = ?").run(json, accountId).changes > 0;
+    }
+    limitsFor(acct) { return planLimits(this.plans(), acct.plan, acct.limits_json); }
+    planCounts() {
+        const out = {};
+        for (const r of this.db.prepare("SELECT plan, COUNT(*) c FROM accounts GROUP BY plan").all())
+            out[r.plan] = r.c;
+        return out;
+    }
+    planLimitHits() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT actor_account a, COUNT(*) c FROM audit WHERE event = 'plan_limit' AND actor_account IS NOT NULL GROUP BY actor_account").all())
+            m.set(r.a, r.c);
+        return m;
+    }
+    recordSpace(name, ownerAccount) {
+        this.db.prepare("INSERT INTO spaces (name, owner_account, created_at, deleted_at) VALUES (?, ?, ?, NULL) " +
+            "ON CONFLICT(name) DO UPDATE SET owner_account = excluded.owner_account, created_at = excluded.created_at, deleted_at = NULL WHERE spaces.deleted_at IS NOT NULL").run(name, ownerAccount, now());
+    }
+    markSpaceDeleted(name) {
+        this.db.prepare("UPDATE spaces SET deleted_at = ? WHERE name = ? AND deleted_at IS NULL").run(now(), name);
+    }
+    spaceOwner(name) {
+        const r = this.db.prepare("SELECT owner_account FROM spaces WHERE name = ? AND deleted_at IS NULL").get(name);
+        return r?.owner_account ? this.accountById(r.owner_account) : null;
+    }
+    spacesOwned(accountId) {
+        return this.db.prepare("SELECT name FROM spaces WHERE owner_account = ? AND deleted_at IS NULL ORDER BY created_at").all(accountId).map((r) => r.name);
+    }
+    spaceOwners() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT name, owner_account FROM spaces WHERE deleted_at IS NULL AND owner_account IS NOT NULL").all())
+            m.set(r.name, r.owner_account);
+        return m;
+    }
+    ownedCounts() {
+        const m = new Map();
+        for (const r of this.db.prepare("SELECT owner_account a, COUNT(*) c FROM spaces WHERE deleted_at IS NULL AND owner_account IS NOT NULL GROUP BY owner_account").all())
+            m.set(r.a, r.c);
+        return m;
+    }
+    hasSpaceRecord(name) {
+        return !!this.db.prepare("SELECT 1 FROM spaces WHERE name = ?").get(name);
+    }
     allAccounts() {
         return this.db.prepare("SELECT * FROM accounts ORDER BY created_at DESC").all();
     }
     allDevices() {
         return this.db.prepare("SELECT * FROM devices ORDER BY created_at DESC").all();
     }
+    liveSessions(limit = 500) {
+        return this.db.prepare("SELECT * FROM sessions WHERE ended_at IS NULL AND revoked_at IS NULL ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
+    endedSessionsSince(sinceMs) {
+        return this.db.prepare("SELECT COUNT(*) c FROM sessions WHERE ended_at IS NOT NULL AND ended_at >= ?").get(sinceMs).c;
+    }
     allSessions(limit = 500) {
         return this.db.prepare("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ?").all(limit);
     }
@@ -355,7 +481,7 @@ export class Accounts {
             accounts: n("SELECT COUNT(*) c FROM accounts"),
             devices: n("SELECT COUNT(*) c FROM devices"),
             sessions: n("SELECT COUNT(*) c FROM sessions"),
-            live_sessions: n("SELECT COUNT(*) c FROM sessions WHERE revoked_at IS NULL"),
+            live_sessions: n("SELECT COUNT(*) c FROM sessions WHERE revoked_at IS NULL AND ended_at IS NULL"),
             audit: n("SELECT COUNT(*) c FROM audit"),
         };
     }
@@ -363,6 +489,7 @@ export class Accounts {
         const sessionDays = opts.sessionDays ?? 30;
         const auditDays = opts.auditDays ?? 365;
         const sCut = now() - sessionDays * 86_400_000;
+        this.db.prepare("DELETE FROM sessions WHERE ended_at IS NOT NULL AND ended_at < ?").run(now() - 7 * 86_400_000);
         const s = this.db.prepare("DELETE FROM sessions WHERE last_seen < ?").run(sCut);
         let a = { changes: 0 };
         if (auditDays > 0)

package/dist/agents.js

@@ -93,6 +93,8 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
+        ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
         ...(opts.cfg.repo ? { PANTHEON_REPO: opts.cfg.repo } : {}),
         ...(opts.cfg.spaceId ? { PANTHEON_SPACE_ID: opts.cfg.spaceId } : {}),
     };
@@ -101,6 +103,8 @@ export function headlessSpawn(opts) {
         PANTHEON_AGENT: opts.backend.id,
         PANTHEON_ROLE: "worker",
         PANTHEON_BRANCH: opts.branch,
+        ...(opts.base ? { PANTHEON_BASE: opts.base } : {}),
+        ...(opts.goal ? { PANTHEON_GOAL: opts.goal } : {}),
         ...(home ? { PANTHEON_HOME: home } : {}),
     };
     if (opts.backend.id === "claude-code") {

package/dist/cli.js

@@ -7,16 +7,19 @@ process.emitWarning = ((warning, ...rest) => {
     return _emitWarning(warning, ...rest);
 });
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
-import { fromInvite, load, save, toInvite, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY } from "./config.js";
+import { fromInvite, load, save, toInvite, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
+import { fmtLimit } from "./plans.js";
 import { validEmail, validUsername } from "./accounts.js";
 import { install, launcher } from "./install.js";
 import { Relay } from "./relay.js";
 import { runMcp } from "./mcp.js";
 import { Worker } from "./worker.js";
 import { DEFAULT_REMINDER_MS, ensureNativeNotifier, HumanNotifier, sendDesktopNotification } from "./notifier.js";
-import { AGENT_SURFACES, applyProfileInit, cleanList, isAgentSurface, loadProfile, organizationProfile, profileInitialized, saveProfile } from "./profile.js";
+import { AGENT_SURFACES, applyProfileInit, cleanList, isAgentSurface, loadProfile, organizationProfile, profileInitialized, saveProfile, wakeDefault } from "./profile.js";
+import { runGuide, terminalIO } from "./setup-guide.js";
 import { doctor, render } from "./doctor.js";
 import { menubarProc, notifierProc, relayProc, workerProc, wiring, logFileFor, dataSummary, stopProc, statFile } from "./machine.js";
 import { assess } from "./untrusted.js";
@@ -266,6 +269,66 @@ function unattendedProject() {
         return { project: resolve(flag("project", ".")), how: "explicit" };
     return { project: resolve("."), how: "default" };
 }
+async function guidedSetup(cfg, project, opts = {}) {
+    if (argv.includes("--no-guide"))
+        return;
+    const interactive = !!process.stdin.isTTY && !argv.includes("--yes");
+    if (!interactive && !opts.force)
+        return;
+    const rl = interactive ? createInterface({ input: process.stdin, output: process.stderr }) : null;
+    const io = rl ? terminalIO(rl, (l) => console.error(l)) : null;
+    console.error(`\n${B("A few choices, then you're done.")}${io ? "" : D("  (no terminal — taking the defaults)")}`);
+    try {
+        const r = await runGuide(io, { cfg, project }, {
+            publish: async (p) => {
+                const c = new PantheonClient(cfg, undefined, { role: "cli" });
+                try {
+                    await c.connect();
+                    await c.publishProfile(organizationProfile(p, cfg.spaceId, cfg.space));
+                }
+                finally {
+                    c.close();
+                }
+            },
+            ...(project ? {
+                setRepoBase: async (base) => {
+                    const info = repoInfo(project);
+                    if (!info)
+                        throw new Error("not inside a git repo");
+                    const { repo: _r, repoOrigin: _o, ...plain } = cfg;
+                    const c = new PantheonClient(plain, undefined, { role: "cli" });
+                    try {
+                        await c.connect();
+                        await c.bindRepo(info.fingerprint, info.origin, base);
+                    }
+                    finally {
+                        c.close();
+                    }
+                    if (cfg.spaceId)
+                        bindRepo(info, cfg.spaceId);
+                },
+            } : {}),
+        });
+        console.error("");
+        for (const l of r.applied)
+            console.error(`  ${C("✓")} ${l}`);
+        for (const w of r.warnings)
+            console.error(`\x1b[33m  ! ${w}\x1b[0m`);
+        console.error(D(`\n  Change any of this later: pantheon setup`));
+    }
+    finally {
+        rl?.close();
+    }
+}
+function workerMidRun() {
+    try {
+        const s = JSON.parse(readFileSync(join(CONFIG_DIR, "worker-state.json"), "utf8"));
+        return !!s.at && Date.now() - s.at < 10 * 60_000 && /run/i.test(String(s.state ?? ""));
+    }
+    catch {
+        return false;
+    }
+}
 function printReady(tools) {
     const workerOn = tools.some((t) => t.tool === "worker" && t.status.startsWith("on"));
     console.error(`\n${B("You're set.")} Restart your agent once (quit and reopen) and it is connected.`);
@@ -317,7 +380,9 @@ ${B("several teams on one machine")}
   pantheon spaces             your teams, which repo is bound to which, and where this folder points
   pantheon use <team> --here  bind this repo to a team (agents opened here speak in it)
   pantheon repo add | list    the repos a team works from; a delivery must come from one of them
+                              (repo add --base <branch>: the branch workers cut from, else origin's default)
   pantheon leave <team>       drop one team from this machine (its token and repo bindings)
+  pantheon space delete <team> --yes   dissolve a team you founded: disconnects everyone, frees a plan slot
   pantheon profile set --space <team> …   authority that applies in one team only (e.g. --human-required pricing)
 
 ${B("day to day")}
@@ -350,6 +415,8 @@ ${B("control")}
   pantheon leave              remove what pantheon put on this machine
   pantheon panic              cut off all unattended work on this machine, now
   pantheon doctor             check this machine end to end
+  pantheon setup              the guided choices: who may wake this machine, what a run may execute,
+                              what you personally decide, which alerts you want — re-run any time
   pantheon upgrade            pull the latest pantheon, rebuild, and re-wire your agents
 
 ${D("more: pantheon help --all")}
@@ -357,7 +424,7 @@ ${D("more: pantheon help --all")}
 const HELP_ALL = HELP + `
 ${B("less common")}
   pantheon relay              run only the relay, in this terminal
-  pantheon service install [relay|worker|notifier|menubar] | uninstall
+  pantheon service install [relay|worker|notifier|menubar] | restart | uninstall
                             run a long-lived component in the background, from login
   pantheon members            the full list, with key fingerprints
   pantheon whoami             your name and fingerprint
@@ -428,6 +495,8 @@ async function main() {
                 console.error(D(`  ${r.reach.hint}`));
             }
             printReady(r.tools);
+            if (r.claimed)
+                await guidedSetup(load() ?? r.cfg, repoInfo(process.cwd())?.root ?? null);
             if (r.relay) {
                 console.error(D(`\nKeeping the relay running here. Ctrl-C stops it (your teammate goes offline too).`));
                 await new Promise(() => { });
@@ -440,7 +509,8 @@ async function main() {
             await client.connect().catch((e) => die(client.pending ?? e.message));
             await new Promise((r) => setTimeout(r, 250));
             const ttl = Number(flag("ttl", "1440"));
-            const inv = await client.makeInvite(!argv.includes("--no-wake"), ttl).catch((e) => die(e.message));
+            const mayWake = argv.includes("--may-wake") ? true : argv.includes("--no-wake") ? false : wakeDefault(loadProfile(cfg));
+            const inv = await client.makeInvite(mayWake, ttl).catch((e) => die(e.message));
             console.log(`pantheon join ${toInvite({ ...cfg, token: inv.url })}`);
             console.error(D(`\nSingle use, expires ${new Date(inv.expires_at).toLocaleString()}.`));
             client.close();
@@ -558,6 +628,11 @@ async function main() {
                 console.error(`\x1b[33m  ! ${w}\x1b[0m`);
             printGranted(r.granted);
             printReady(r.tools);
+            {
+                const joined = load();
+                if (joined)
+                    await guidedSetup(joined, repoInfo(process.cwd())?.root ?? null);
+            }
             console.error(`\n${D('Then ask your agent: "check pantheon_status and say hello to the team".')}`);
             return;
         }
@@ -607,15 +682,48 @@ async function main() {
                 return;
             }
             console.error(`\n${B(`upgraded ${r.from} → ${r.to}`)}`);
-            console.error(`\n${B("Restart to load the new code:")}`);
-            for (const what of r.restart) {
-                if (what === "relay")
-                    console.error(`  relay   launchctl kickstart -k gui/$(id -u)/dev.pantheon.relay   ${D("(briefly drops your teammates — pick the moment)")}`);
-                else if (what === "worker")
-                    console.error(`  worker  launchctl kickstart -k gui/$(id -u)/dev.pantheon.worker`);
+            const { restartService, serviceInstalled } = await import("./service.js");
+            console.error("");
+            if (process.platform === "darwin") {
+                const { trayStale, ensureTrayBinary, writeTrayCommands } = await import("./tray.js");
+                const { notifierStale, ensureNativeNotifier } = await import("./notifier.js");
+                for (const [stale, build, what] of [[trayStale, () => { ensureTrayBinary(); writeTrayCommands(); }, "menu bar"], [notifierStale, ensureNativeNotifier, "alerts"]]) {
+                    if (!stale())
+                        continue;
+                    try {
+                        build();
+                        console.error(`  ${what}: rebuilt from this release's source`);
+                    }
+                    catch (e) {
+                        console.error(`  ${what}: could not rebuild (${e.message.split("\n")[0]})`);
+                    }
+                }
+            }
+            for (const kind of ["worker", "notifier", "menubar"]) {
+                if (!serviceInstalled(kind))
+                    continue;
+                if (kind === "worker" && workerMidRun()) {
+                    console.error(`  ${D("worker: a run is in progress — left alone. When it is done:")}  pantheon service restart worker`);
+                    continue;
+                }
+                for (const l of restartService(kind))
+                    console.error(l);
+            }
+            if (r.restart.includes("relay"))
+                console.error(`  relay: ${D("shared with your teammates, so it is yours to time:")}  launchctl kickstart -k gui/$(id -u)/dev.pantheon.relay`);
+            const cfgNow = load();
+            if (cfgNow) {
+                if (loadProfile(cfgNow).agent.wake_default === undefined)
+                    await guidedSetup(cfgNow, repoInfo(process.cwd())?.root ?? null);
                 else
-                    console.error(`  agent   quit and reopen ${what.replace(/^your /, "your ")}`);
+                    console.error(D(`\n  Your setup answers still apply — pantheon setup to change them.`));
             }
+            console.error(`\n${B("One thing only you can do:")} quit and reopen your agent windows so they load the new pantheon.`);
+            return;
+        }
+        case "setup": {
+            const cfg = need();
+            await guidedSetup(cfg, repoInfo(process.cwd())?.root ?? null, { force: true });
             return;
         }
         case "version": {
@@ -636,6 +744,8 @@ async function main() {
                 await new Promise((r) => setTimeout(r, 350));
                 const peers = client.roster.filter((m) => m.id !== cfg.member);
                 console.log(`${B(cfg.space)}  you are ${C(cfg.member)}  ${D(cfg.relay)}  ${D(`${client.head} acts`)}\n`);
+                if (client.plan)
+                    console.log(D(`  ${client.plan.name} plan · ${client.plan.usage.spaces} of ${fmtLimit(client.plan.limits.spaces)} spaces created · ${client.plan.usage.members} of ${fmtLimit(client.plan.limits.members)} people here${client.plan.limits.wake ? "" : " · no unattended workers"}`) + "\n");
                 console.log(B("members"));
                 if (!peers.length)
                     console.log(`  ${D("(nobody else yet — send them an invite from `pantheon invite`)")}`);
@@ -944,7 +1054,7 @@ async function main() {
         }
         case "hook": {
             const sub = argv[1] ?? "status";
-            const hookCfg = needStrict();
+            const hookCfg = resolveForHook();
             const reportIdle = async (session, seen) => {
                 if (!hookCfg)
                     return true;
@@ -1047,7 +1157,7 @@ async function main() {
                     const { pending: pendingFn } = await import("./pending.js");
                     const { load: loadCfg } = await import("./config.js");
                     const d = await decideStop(JSON.stringify({ session_id: session }), {
-                        pending: async (s) => pendingFn({ session: s }),
+                        pending: async (s) => (hookCfg ? pendingFn({ session: s, cfg: hookCfg }) : Promise.resolve(null)),
                         ...(loadCfg()?.member ? { me: loadCfg().member } : {}),
                     });
                     if (d.exit === 2 && d.message) {
@@ -1080,7 +1190,7 @@ async function main() {
                     const { pending: pendingFn } = await import("./pending.js");
                     const { load: loadCfg } = await import("./config.js");
                     const d = await decideStop(raw, {
-                        pending: async (session) => pendingFn({ session }),
+                        pending: async (session) => (hookCfg ? pendingFn({ session, cfg: hookCfg }) : Promise.resolve(null)),
                         ...(loadCfg()?.member ? { me: loadCfg().member } : {}),
                     });
                     if (d.exit === 2 && d.message) {
@@ -1118,7 +1228,9 @@ async function main() {
                     let surfaced;
                     const d = await decideStop(raw, {
                         pending: async (session) => {
-                            const r = await pendingFn({ session });
+                            if (!hookCfg)
+                                return null;
+                            const r = await pendingFn({ session, cfg: hookCfg });
                             if (r)
                                 surfaced = r.seq;
                             return r;
@@ -1188,6 +1300,24 @@ async function main() {
             }
             return;
         }
+        case "space": {
+            const sub = argv[1];
+            const name = argv[2];
+            if (sub !== "delete" || !name || name.startsWith("--"))
+                die("usage: pantheon space delete <team> --yes");
+            const all = loadAll() ?? die("not configured");
+            const m = findMembership(all, name) ?? die(`you are not in a team called "${name}". Yours: ${Object.values(all.spaces ?? {}).map((x) => x.name).join(", ") || "none"}`);
+            if (!argv.includes("--yes"))
+                die(`this deletes "${m.name}" for everyone in it — its history, goals and invites — and cannot be undone.\n  If you mean it:  pantheon space delete ${m.name} --yes`);
+            const client = new PantheonClient(configFor(all, m, null), undefined, { role: "cli" });
+            await client.connect().catch((e) => die(client.pending ?? e.message));
+            await client.deleteSpace(m.name).catch((e) => { client.close(); die(e.message); });
+            client.close();
+            const bound = Object.values(all.bindings ?? {}).filter((b) => b.space === m.id).length;
+            removeMembership(m.id);
+            console.error(`${B("deleted")} "${m.name}" — everyone in it was disconnected; its token${bound ? ` and ${bound} repo binding${bound === 1 ? "" : "s"}` : ""} left this machine`);
+            return;
+        }
         case "leave": {
             if (argv[1] && !argv[1].startsWith("--")) {
                 const all = loadAll() ?? die("not configured");
@@ -2037,6 +2167,12 @@ async function main() {
                     console.error(l);
                 return;
             }
+            if (sub === "restart") {
+                const { restartService } = await import("./service.js");
+                for (const l of restartService(kind))
+                    console.error(l);
+                return;
+            }
             if (kind === "relay") {
                 const data = resolveDataDir(flag("data")).dir;
                 const port = flag("port", "8787");
@@ -2159,16 +2295,17 @@ async function main() {
             await client.connect().catch((e) => die(client.pending ?? e.message));
             if (sub === "add") {
                 const r = repoInfo(flag("path") ?? process.cwd()) ?? die("not inside a git repo");
-                await client.bindRepo(r.fingerprint, r.origin).catch((e) => die(e.message));
+                const base = flag("base") ?? null;
+                await client.bindRepo(r.fingerprint, r.origin, base).catch((e) => die(e.message));
                 if (cfg.spaceId)
                     bindRepo(r, cfg.spaceId);
-                console.error(`${B("registered")} ${r.origin ?? r.root} as a repo "${cfg.space}" works from${r.shared ? "" : D("  (no origin remote — deliveries from it cannot be fetched)")}`);
+                console.error(`${B("registered")} ${r.origin ?? r.root} as a repo "${cfg.space}" works from${base ? ` — workers cut from ${C(base)}` : ""}${r.shared ? "" : D("  (no origin remote — deliveries from it cannot be fetched)")}`);
             }
             else {
                 await new Promise((res) => setTimeout(res, 150));
                 console.error(`${B(`repos "${cfg.space}" works from`)}  ${D(`(${client.repos.length})`)}`);
                 for (const r of client.repos)
-                    console.error(`  ${(r.origin ?? r.fingerprint).padEnd(48)} ${D(`added by ${r.added_by}`)}`);
+                    console.error(`  ${(r.origin ?? r.fingerprint).padEnd(48)} ${D(`added by ${r.added_by}`)}${r.base ? `  ${D("base")} ${C(r.base)}` : ""}`);
                 if (!client.repos.length)
                     console.error(D("  none yet — the first member to connect from a checkout registers it"));
             }

package/dist/client.js

@@ -38,6 +38,7 @@ export class PantheonClient {
     enrolledToken = null;
     spaceId = null;
     repos = [];
+    plan = null;
     enroll = null;
     inviteUrl = null;
     constructor(cfg, onEvent, opts) {
@@ -157,6 +158,7 @@ export class PantheonClient {
                             this.cfg.spaceId = msg.space_id;
                         }
                         this.repos = msg.repos ?? [];
+                        this.plan = msg.plan ?? null;
                         this.adoptKnownRepo();
                         this.backoff = 500;
                         this.roster = msg.roster;
@@ -375,29 +377,42 @@ export class PantheonClient {
         if (c.cwdRepoOrigin)
             c.repoOrigin = c.cwdRepoOrigin;
     }
-    bindRepo(fingerprint = this.cfg.repo, origin = this.cfg.repoOrigin ?? null) {
+    reportWorkerState(state, detail, until) {
+        try {
+            this.ws?.send(JSON.stringify({ t: "worker_state", state, ...(detail ? { detail: detail.slice(0, 200) } : {}), ...(until ? { until } : {}) }));
+        }
+        catch { }
+    }
+    deleteSpace(confirm) {
+        return this.rpc({ t: "delete_space", confirm });
+    }
+    bindRepo(fingerprint = this.cfg.repo, origin = this.cfg.repoOrigin ?? null, base = null) {
         if (!fingerprint)
             return Promise.reject(new Error("not inside a git repo — run this from the team's checkout"));
-        return this.rpc({ t: "bind_repo", repo: fingerprint, origin });
+        return this.rpc({ t: "bind_repo", repo: fingerprint, origin, ...(base ? { base } : {}) });
     }
     makeInvite(mayWake = true, ttlMinutes = 60) {
         return new Promise((res, rej) => {
-            const t = setTimeout(() => rej(new Error("relay did not return an invite in 10s")), 10_000);
+            const cid = `c${++this.cid}`;
+            const finish = () => { clearInterval(poll); clearTimeout(t); this.acks.delete(cid); };
+            const t = setTimeout(() => { finish(); rej(new Error("relay did not return an invite in 10s")); }, 10_000);
             const poll = setInterval(() => {
                 if (this.inviteUrl) {
-                    clearInterval(poll);
-                    clearTimeout(t);
+                    finish();
                     const v = this.inviteUrl;
                     this.inviteUrl = null;
                     res(v);
                 }
             }, 40);
+            this.acks.set(cid, (v) => { if ("error" in v) {
+                finish();
+                rej(new Error(v.error));
+            } });
             try {
-                this.ws?.send(JSON.stringify({ t: "invite", may_wake: mayWake, ttl_minutes: ttlMinutes }));
+                this.ws?.send(JSON.stringify({ t: "invite", may_wake: mayWake, ttl_minutes: ttlMinutes, cid }));
             }
             catch (e) {
-                clearInterval(poll);
-                clearTimeout(t);
+                finish();
                 rej(e);
             }
         });