@join-pantheon/cli 0.21.0 → 0.21.1

package/README.md

@@ -499,8 +499,12 @@ Security details and how to report a vulnerability:
 ## Upgrading
 
 ```bash
-pantheon upgrade          # installs the latest release and re-wires your agents
+pantheon upgrade          # installs the latest release and finishes the job
 ```
 
-Every command prints its version and nudges you when a newer release exists. Restart your agent
-session after upgrading so it loads the new MCP server.
+Every command prints its version and nudges you when a newer release exists. `pantheon upgrade`
+installs the new release, re-wires your agents, restarts pantheon's own background services (the
+worker, alerts, menu bar) so they load the new code, and asks any setup question the new version
+has that you have never answered. The one thing it cannot do is restart your agent windows: quit
+and reopen them so they load the new server. A self-hosted relay is shared with your teammates, so
+it prints the restart for that and leaves the timing to you.

package/dist/accounts.js

@@ -123,6 +123,11 @@ export class Accounts {
             this.db.exec("ALTER TABLE accounts ADD COLUMN plan TEXT NOT NULL DEFAULT 'free'");
         if (!cols.has("limits_json"))
             this.db.exec("ALTER TABLE accounts ADD COLUMN limits_json TEXT");
+        const scols = new Set(this.db.prepare("PRAGMA table_info(sessions)").all().map((c) => c.name));
+        if (!scols.has("ended_at"))
+            this.db.exec("ALTER TABLE sessions ADD COLUMN ended_at INTEGER");
+        if (!scols.has("role"))
+            this.db.exec("ALTER TABLE sessions ADD COLUMN role TEXT");
     }
     close() { this.db.close(); }
     accountByUsername(username) {
@@ -249,18 +254,28 @@ export class Accounts {
         this.audit({ actor_account: accountId, event: "device_added", target: d.fingerprint });
         return d;
     }
-    openSession(accountId, deviceId, space, ip) {
-        const s = { id: newId("ses"), account_id: accountId, device_id: deviceId, space, ip, created_at: now(), last_seen: now(), revoked_at: null };
-        this.db.prepare("INSERT INTO sessions (id, account_id, device_id, space, ip, created_at, last_seen, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)")
-            .run(s.id, s.account_id, s.device_id, s.space, s.ip, s.created_at, s.last_seen);
-        this.audit({ actor_account: accountId, event: "session_created", space: space || null, target: s.id, ip });
+    openSession(accountId, deviceId, space, ip, role = null) {
+        const prior = this.db.prepare("SELECT ip FROM sessions WHERE device_id = ? ORDER BY created_at DESC LIMIT 1").get(deviceId);
+        const s = { id: newId("ses"), account_id: accountId, device_id: deviceId, space, ip, created_at: now(), last_seen: now(), revoked_at: null, ended_at: null, role };
+        this.db.prepare("INSERT INTO sessions (id, account_id, device_id, space, ip, created_at, last_seen, revoked_at, ended_at, role) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?)")
+            .run(s.id, s.account_id, s.device_id, s.space, s.ip, s.created_at, s.last_seen, role);
+        if (!prior)
+            this.audit({ actor_account: accountId, event: "session_created", space: space || null, target: s.id, ip });
+        else if (prior.ip !== ip)
+            this.audit({ actor_account: accountId, event: "device_new_ip", space: space || null, target: deviceId, detail: `${prior.ip} → ${ip}`, ip });
         return s;
     }
     touchSession(id) {
-        this.db.prepare("UPDATE sessions SET last_seen = ? WHERE id = ? AND revoked_at IS NULL").run(now(), id);
+        this.db.prepare("UPDATE sessions SET last_seen = ? WHERE id = ? AND revoked_at IS NULL AND ended_at IS NULL").run(now(), id);
+    }
+    endAllOpenSessions() {
+        return Number(this.db.prepare("UPDATE sessions SET ended_at = ?, last_seen = last_seen WHERE ended_at IS NULL").run(now()).changes);
+    }
+    endSession(id) {
+        this.db.prepare("UPDATE sessions SET ended_at = ?, last_seen = ? WHERE id = ? AND ended_at IS NULL").run(now(), now(), id);
     }
     sessionsFor(accountId) {
-        return this.db.prepare("SELECT * FROM sessions WHERE account_id = ? ORDER BY created_at DESC").all(accountId);
+        return this.db.prepare("SELECT * FROM sessions WHERE account_id = ? AND ended_at IS NULL ORDER BY created_at DESC").all(accountId);
     }
     devicesFor(accountId) {
         return this.db.prepare("SELECT * FROM devices WHERE account_id = ? ORDER BY created_at ASC").all(accountId);
@@ -451,6 +466,12 @@ export class Accounts {
     allDevices() {
         return this.db.prepare("SELECT * FROM devices ORDER BY created_at DESC").all();
     }
+    liveSessions(limit = 500) {
+        return this.db.prepare("SELECT * FROM sessions WHERE ended_at IS NULL AND revoked_at IS NULL ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
+    endedSessionsSince(sinceMs) {
+        return this.db.prepare("SELECT COUNT(*) c FROM sessions WHERE ended_at IS NOT NULL AND ended_at >= ?").get(sinceMs).c;
+    }
     allSessions(limit = 500) {
         return this.db.prepare("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ?").all(limit);
     }
@@ -460,7 +481,7 @@ export class Accounts {
             accounts: n("SELECT COUNT(*) c FROM accounts"),
             devices: n("SELECT COUNT(*) c FROM devices"),
             sessions: n("SELECT COUNT(*) c FROM sessions"),
-            live_sessions: n("SELECT COUNT(*) c FROM sessions WHERE revoked_at IS NULL"),
+            live_sessions: n("SELECT COUNT(*) c FROM sessions WHERE revoked_at IS NULL AND ended_at IS NULL"),
             audit: n("SELECT COUNT(*) c FROM audit"),
         };
     }
@@ -468,6 +489,7 @@ export class Accounts {
         const sessionDays = opts.sessionDays ?? 30;
         const auditDays = opts.auditDays ?? 365;
         const sCut = now() - sessionDays * 86_400_000;
+        this.db.prepare("DELETE FROM sessions WHERE ended_at IS NOT NULL AND ended_at < ?").run(now() - 7 * 86_400_000);
         const s = this.db.prepare("DELETE FROM sessions WHERE last_seen < ?").run(sCut);
         let a = { changes: 0 };
         if (auditDays > 0)

package/dist/cli.js

@@ -7,6 +7,7 @@ process.emitWarning = ((warning, ...rest) => {
     return _emitWarning(warning, ...rest);
 });
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
 import { fromInvite, load, save, toInvite, resolveFor, loadAll, repoInfo, bindRepo, findMembership, setDefaultSpace, removeMembership, configFor, CONFIG_DIR, CONFIG_PATH, DEFAULT_RELAY, resolveForHook } from "./config.js";
@@ -289,6 +290,24 @@ async function guidedSetup(cfg, project, opts = {}) {
                     c.close();
                 }
             },
+            ...(project ? {
+                setRepoBase: async (base) => {
+                    const info = repoInfo(project);
+                    if (!info)
+                        throw new Error("not inside a git repo");
+                    const { repo: _r, repoOrigin: _o, ...plain } = cfg;
+                    const c = new PantheonClient(plain, undefined, { role: "cli" });
+                    try {
+                        await c.connect();
+                        await c.bindRepo(info.fingerprint, info.origin, base);
+                    }
+                    finally {
+                        c.close();
+                    }
+                    if (cfg.spaceId)
+                        bindRepo(info, cfg.spaceId);
+                },
+            } : {}),
         });
         console.error("");
         for (const l of r.applied)
@@ -301,6 +320,15 @@ async function guidedSetup(cfg, project, opts = {}) {
         rl?.close();
     }
 }
+function workerMidRun() {
+    try {
+        const s = JSON.parse(readFileSync(join(CONFIG_DIR, "worker-state.json"), "utf8"));
+        return !!s.at && Date.now() - s.at < 10 * 60_000 && /run/i.test(String(s.state ?? ""));
+    }
+    catch {
+        return false;
+    }
+}
 function printReady(tools) {
     const workerOn = tools.some((t) => t.tool === "worker" && t.status.startsWith("on"));
     console.error(`\n${B("You're set.")} Restart your agent once (quit and reopen) and it is connected.`);
@@ -396,7 +424,7 @@ ${D("more: pantheon help --all")}
 const HELP_ALL = HELP + `
 ${B("less common")}
   pantheon relay              run only the relay, in this terminal
-  pantheon service install [relay|worker|notifier|menubar] | uninstall
+  pantheon service install [relay|worker|notifier|menubar] | restart | uninstall
                             run a long-lived component in the background, from login
   pantheon members            the full list, with key fingerprints
   pantheon whoami             your name and fingerprint
@@ -654,15 +682,43 @@ async function main() {
                 return;
             }
             console.error(`\n${B(`upgraded ${r.from} → ${r.to}`)}`);
-            console.error(`\n${B("Restart to load the new code:")}`);
-            for (const what of r.restart) {
-                if (what === "relay")
-                    console.error(`  relay   launchctl kickstart -k gui/$(id -u)/dev.pantheon.relay   ${D("(briefly drops your teammates — pick the moment)")}`);
-                else if (what === "worker")
-                    console.error(`  worker  launchctl kickstart -k gui/$(id -u)/dev.pantheon.worker`);
+            const { restartService, serviceInstalled } = await import("./service.js");
+            console.error("");
+            if (process.platform === "darwin") {
+                const { trayStale, ensureTrayBinary, writeTrayCommands } = await import("./tray.js");
+                const { notifierStale, ensureNativeNotifier } = await import("./notifier.js");
+                for (const [stale, build, what] of [[trayStale, () => { ensureTrayBinary(); writeTrayCommands(); }, "menu bar"], [notifierStale, ensureNativeNotifier, "alerts"]]) {
+                    if (!stale())
+                        continue;
+                    try {
+                        build();
+                        console.error(`  ${what}: rebuilt from this release's source`);
+                    }
+                    catch (e) {
+                        console.error(`  ${what}: could not rebuild (${e.message.split("\n")[0]})`);
+                    }
+                }
+            }
+            for (const kind of ["worker", "notifier", "menubar"]) {
+                if (!serviceInstalled(kind))
+                    continue;
+                if (kind === "worker" && workerMidRun()) {
+                    console.error(`  ${D("worker: a run is in progress — left alone. When it is done:")}  pantheon service restart worker`);
+                    continue;
+                }
+                for (const l of restartService(kind))
+                    console.error(l);
+            }
+            if (r.restart.includes("relay"))
+                console.error(`  relay: ${D("shared with your teammates, so it is yours to time:")}  launchctl kickstart -k gui/$(id -u)/dev.pantheon.relay`);
+            const cfgNow = load();
+            if (cfgNow) {
+                if (loadProfile(cfgNow).agent.wake_default === undefined)
+                    await guidedSetup(cfgNow, repoInfo(process.cwd())?.root ?? null);
                 else
-                    console.error(`  agent   quit and reopen ${what.replace(/^your /, "your ")}`);
+                    console.error(D(`\n  Your setup answers still apply — pantheon setup to change them.`));
             }
+            console.error(`\n${B("One thing only you can do:")} quit and reopen your agent windows so they load the new pantheon.`);
             return;
         }
         case "setup": {
@@ -2111,6 +2167,12 @@ async function main() {
                     console.error(l);
                 return;
             }
+            if (sub === "restart") {
+                const { restartService } = await import("./service.js");
+                for (const l of restartService(kind))
+                    console.error(l);
+                return;
+            }
             if (kind === "relay") {
                 const data = resolveDataDir(flag("data")).dir;
                 const port = flag("port", "8787");

package/dist/helpers-build.js

@@ -0,0 +1,23 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+export const helperHashPath = (binary) => `${binary}.source.sha256`;
+export function sourceHash(source) {
+    return createHash("sha256").update(readFileSync(source)).digest("hex");
+}
+export function recordHelperBuild(binary, source) {
+    try {
+        writeFileSync(helperHashPath(binary), sourceHash(source) + "\n");
+    }
+    catch { }
+}
+export function helperStale(binary, source) {
+    if (!existsSync(binary) || !existsSync(source))
+        return false;
+    try {
+        return readFileSync(helperHashPath(binary), "utf8").trim() !== sourceHash(source);
+    }
+    catch {
+        return true;
+    }
+}
+//# sourceMappingURL=helpers-build.js.map

package/dist/notifier.js

@@ -1,4 +1,5 @@
 import { execFileSync, spawn } from "node:child_process";
+import { helperStale, recordHelperBuild } from "./helpers-build.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -56,8 +57,10 @@ export function ensureNativeNotifier(home = CONFIG_DIR) {
     requireDeveloperTools("notifications", "notifier");
     execFileSync("/usr/bin/swiftc", ["-O", source, "-o", binary], { stdio: "pipe" });
     chmodSync(binary, 0o755);
+    recordHelperBuild(binary, source);
     return binary;
 }
+export function notifierStale(home = CONFIG_DIR) { return helperStale(hudBinaryPath(home), hudSourcePath()); }
 export function requireDeveloperTools(what, service) {
     try {
         execFileSync("/usr/bin/xcode-select", ["-p"], { stdio: "pipe" });

package/dist/relay.js

@@ -145,8 +145,12 @@ export class Relay {
         this.adminAllow = (process.env.PANTHEON_ADMIN_ALLOW_IPS ?? "").split(",").map((x) => x.trim()).filter(Boolean);
         const wantStore = this.requireAccounts || this.adminToken !== null;
         this.accounts = opts.accounts ?? (wantStore ? new Accounts(join(this.dataDir, "accounts.db")) : null);
-        if (this.accounts)
+        if (this.accounts) {
             this.backfillSpaceOwners();
+            const closed = this.accounts.endAllOpenSessions();
+            if (closed)
+                this.log(`ended ${closed} session${closed === 1 ? "" : "s"} left open by the previous relay process`);
+        }
         this.email = opts.emailSender ?? emailSenderFromEnv(this.log);
         const envNum = (k) => {
             const v = process.env[k];
@@ -925,7 +929,8 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
         const kb = (n) => n < 1024 ? `${n} B` : n < 1048576 ? `${(n / 1024).toFixed(1)} KB` : `${(n / 1048576).toFixed(1)} MB`;
         const accounts = A.allAccounts();
         const devices = A.allDevices();
-        const sessions = A.allSessions(200);
+        const sessions = A.liveSessions(200);
+        const endedToday = A.endedSessionsSince(Date.now() - DAY);
         const audit = A.auditLog({ limit: 300 });
         const blocks = A.allBlocks();
         const verifs = A.recentVerifications(50);
@@ -970,7 +975,7 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
   <div class=stat><b>${c.accounts}</b><span>accounts</span></div>
   <div class=stat><b>${c.devices}</b><span>devices</span></div>
   <div class=stat><b>${Object.entries(planCounts).filter(([n]) => n !== "free").reduce((s, [, v]) => s + v, 0)}<span class=dim style="font-size:14px"> / ${c.accounts}</span></b><span>paid plans / accounts</span></div>
-  <div class=stat><b>${sessions.filter((s) => !s.revoked_at && Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>sessions active / open</span></div>
+  <div class=stat><b>${sessions.filter((s) => Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>connections heartbeating / open</span></div>
   <div class=stat><b>${spaces.filter((s) => s.live).length}<span class=dim style="font-size:14px"> / ${spaces.length}</span></b><span>spaces live / total · cap ${this.limits.maxSpaces}</span></div>
   <div class="stat ${emailsHour > emailCap * 0.8 ? "warn" : ""}"><b>${emailsHour}<span class=dim style="font-size:14px"> / ${emailCap}</span></b><span>emails this hour</span></div>
   <div class=stat><b>${snapshots.length}</b><span>snapshots · latest ${snapshots.length ? esc(snapshots[snapshots.length - 1].replace(/^accounts-|\\.db$/g, "").replace(/T/, " ").slice(0, 16)) : "—"}</span></div>
@@ -1013,10 +1018,11 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
   <p class=note>Edits apply immediately to the next create, invite or admit of every account on that plan. Unused invites count toward "people per space" so nobody mints five at once. Personas are files on the user's machine and cannot be limited here. Every change is audited.</p>
 
   <h2>Live sessions <input placeholder="filter" data-filter="t-sessions"></h2><div class=wrap><table id=t-sessions>
-    <tr><th>session</th><th>account</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
-    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
-    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=7 class=dim>no live sessions</td></tr>"}
+    <tr><th>session</th><th>account</th><th>device</th><th>role</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
+    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td class=dim>${esc(devices.find((d) => d.id === s.device_id)?.label ?? s.device_id.slice(0, 10))}</td><td>${s.role ? `<span class=pill>${esc(s.role)}</span>` : "<span class=dim>—</span>"}</td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
+    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=9 class=dim>no open connections right now</td></tr>"}
   </table></div>
+  <p class=note>One row per open connection — an agent window, a worker, or a CLI command while it runs. Rows leave when the socket closes; ${endedToday} connection${endedToday === 1 ? "" : "s"} came and went in the last 24 hours. "Stale" means no heartbeat for 15 minutes on a socket that has not closed, usually a machine that went to sleep.</p>
 
   <h2>Blocked emails and domains</h2><div class=wrap><table id=t-blocks>
     <tr><th>pattern</th><th>kind</th><th>since</th><th></th></tr>
@@ -1250,12 +1256,20 @@ pantheon signup --email you@work.com --username you</code></pre>
         let space = null;
         let me = null;
         let acct = null;
+        let dbSession = null;
+        let lastTouch = 0;
+        const touch = () => {
+            if (dbSession && Date.now() - lastTouch > 60_000) {
+                lastTouch = Date.now();
+                this.accounts?.touchSession(dbSession);
+            }
+        };
         let sessionId = "";
         let role = "interactive";
         let lastMsg = "";
         let alive = true;
         const nonce = newNonce();
-        ws.on("pong", () => { alive = true; });
+        ws.on("pong", () => { alive = true; touch(); });
         const probe = ws;
         probe._alive = () => alive;
         probe._clear = () => { alive = false; };
@@ -1303,6 +1317,7 @@ pantheon signup --email you@work.com --username you</code></pre>
             }
             const m = parsed.data;
             lastMsg = m.t === "act" ? m.act : m.t;
+            touch();
             if (m.t === "ping")
                 return this.send(ws, { t: "pong" });
             if (m.t === "hello") {
@@ -1370,7 +1385,9 @@ pantheon signup --email you@work.com --username you</code></pre>
                     }
                     m.member = auth.account.username;
                     acct = auth.account;
-                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip).id;
+                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip, m.role ?? "interactive").id;
+                    dbSession = acctSession;
+                    lastTouch = Date.now();
                 }
                 let enrolled = null;
                 if (m.enroll) {
@@ -1702,6 +1719,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
         });
         ws.on("close", () => {
+            if (dbSession) {
+                this.accounts?.endSession(dbSession);
+                dbSession = null;
+            }
             if (!space || !me)
                 return;
             me.sessions.delete(sessionId);

package/dist/service.js

@@ -138,6 +138,20 @@ export function uninstallService(kind) {
     }
     return out;
 }
+export function restartService(kind, exec = (c, a) => execFileSync(c, a, { stdio: "ignore" })) {
+    if (!serviceInstalled(kind))
+        return [`  ${kind}: not installed here`];
+    try {
+        if (platform() === "darwin")
+            exec("launchctl", ["kickstart", "-k", `gui/${process.getuid?.() ?? 501}/${LABEL(kind)}`]);
+        else
+            exec("systemctl", ["--user", "restart", `pantheon-${kind}`]);
+        return [`  ${kind}: restarted on the new code`];
+    }
+    catch (e) {
+        return [`  ${kind}: could not restart (${e.message.split("\n")[0]}) — pantheon service restart ${kind}`];
+    }
+}
 export function serviceInstalled(kind) {
     try {
         return existsSync(platform() === "darwin" ? plistPath(kind) : unitPath(kind));

package/dist/setup-guide.js

@@ -1,4 +1,5 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { applyProfileInit, loadProfile, profilePath, saveProfile } from "./profile.js";
@@ -39,6 +40,21 @@ export function guideDefaults(profile, cfg) {
         persona: false,
     };
 }
+export function detectBaseBranch(project) {
+    const git = (...a) => { try {
+        return execFileSync("git", a, { cwd: project, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return "";
+    } };
+    if (!git("remote", "get-url", "origin"))
+        return null;
+    const head = git("symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD");
+    if (head)
+        return head.replace(/^origin\//, "");
+    const cur = git("rev-parse", "--abbrev-ref", "HEAD");
+    return cur && cur !== "HEAD" ? cur : null;
+}
 export async function runGuide(io, ctx, deps = {}) {
     const install = deps.installService ?? realInstall;
     const uninstall = deps.uninstallService ?? realUninstall;
@@ -72,6 +88,11 @@ export async function runGuide(io, ctx, deps = {}) {
             const p = await io.choose("Should your worker follow a short written playbook for this repo? It says what a woken run may do here and what it must leave to you. You can edit it any time.", ["Yes — write a starter playbook now (recommended)", "Not now"], 0);
             a.persona = p === 0;
         }
+        const detected = ctx.project && deps.setRepoBase ? detectBaseBranch(ctx.project) : null;
+        if (detected) {
+            const b = await io.choose("Which branch should your worker start from, and deliveries be checked against? Usually the branch this project deploys or releases from.", [`${detected} (what origin calls its default)`, "A different branch"], 0);
+            a.base = b === 0 ? detected : ((await io.ask("Branch name", detected)).trim() || detected);
+        }
     }
     let next = a.title ? applyProfileInit(profile, { name: a.name, title: a.title }) : { ...profile, human: { ...profile.human, display_name: a.name } };
     const authority = { ...next.authority };
@@ -169,6 +190,15 @@ export async function runGuide(io, ctx, deps = {}) {
             applied.push(`playbook written: ${personaFile} — commit it so every machine on this repo follows it`);
         }
     }
+    if (a.base && deps.setRepoBase) {
+        try {
+            await deps.setRepoBase(a.base);
+            applied.push(`workers on this repo cut from ${a.base}, and deliveries are checked against it`);
+        }
+        catch (e) {
+            warnings.push(`could not register the base branch with the team (${e.message}) — later: pantheon repo add --base ${a.base}`);
+        }
+    }
     return { answers: a, applied, warnings, ...(personaFile ? { personaFile } : {}) };
 }
 export function starterPersona(a) {

package/dist/tray.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { helperStale, recordHelperBuild } from "./helpers-build.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -26,8 +27,10 @@ export function ensureTrayBinary(home = CONFIG_DIR) {
     requireDeveloperTools("the menu bar", "menubar");
     execFileSync("/usr/bin/swiftc", ["-O", source, "-o", binary], { stdio: "pipe" });
     chmodSync(binary, 0o755);
+    recordHelperBuild(binary, source);
     return binary;
 }
+export function trayStale(home = CONFIG_DIR) { return helperStale(trayBinaryPath(home), traySourcePath()); }
 export function writeTrayCommands(home = CONFIG_DIR) {
     const bin = whichPantheon() ?? "pantheon";
     const dir = join(home, "bin");

package/dist/upgrade.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { installForUser } from "./install.js";
-import { relayProc, workerProc } from "./machine.js";
+import { relayProc, workerProc, notifierProc, menubarProc } from "./machine.js";
 export function repoRoot() {
     return join(dirname(fileURLToPath(import.meta.url)), "..");
 }
@@ -42,6 +42,16 @@ export function defaultDeps() {
                     up.push("worker");
             }
             catch { }
+            try {
+                if (notifierProc().running)
+                    up.push("notifier");
+            }
+            catch { }
+            try {
+                if (menubarProc().running)
+                    up.push("menubar");
+            }
+            catch { }
             return up;
         },
         npmUpgrade: () => execFileSync("npm", ["install", "-g", `${PKG_NAME}@latest`, "--no-audit", "--no-fund"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }),

package/helper/macos/menubar.swift

@@ -118,21 +118,54 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     }
   }
 
-  /// The glyph is the product's one-word status. Filled bolt: peers can wake
-  /// work here. Hollow bolt: connected but nothing unattended will run.
-  /// Slashed: not configured, or the relay is unreachable. A count rides
-  /// alongside when decisions wait on the human — the badge is the point.
-  private func paint() {
-    let symbol = !state.configured || !state.relayOk ? "bolt.slash.circle"
-      : state.workerRunning ? "bolt.circle.fill" : "bolt.circle"
-    if let img = NSImage(systemSymbolName: symbol, accessibilityDescription: "pantheon") {
-      img.isTemplate = true
-      item.button?.image = img
-      item.button?.title = state.decisions.isEmpty ? "" : " \(state.decisions.count)"
-      item.button?.imagePosition = .imageLeading
-    } else {
-      item.button?.title = state.decisions.isEmpty ? "cw" : "cw \(state.decisions.count)"
+  enum MarkMode { case full, idle, off }
+
+  /// The Three Stones mark — the product's own logo, the same three arcs the
+  /// website draws: a lintel across the top and a gate at the bottom around a
+  /// centre nobody owns. Drawn with paths rather than loaded from an asset, so it
+  /// is a crisp template image at any menu bar scale and takes the system tint.
+  /// State rides on its weight: full when peers can wake work here, lighter when
+  /// connected but nothing unattended will run, faint with a slash when the relay
+  /// is unreachable or this machine is not in a space. Never rotate it.
+  private func markImage(_ mode: MarkMode) -> NSImage {
+    let img = NSImage(size: NSSize(width: 18, height: 18), flipped: false) { rect in
+      let s = rect.width / 24.0                       // the mark is authored on a 24-unit grid
+      let c = NSPoint(x: rect.midX, y: rect.midY)
+      let r = 8.9 * s
+      let stones = NSBezierPath()
+      stones.lineWidth = 3.4 * s
+      stones.lineCapStyle = .round
+      for (a, b) in [(51.0, 129.0), (171.0, 249.0), (291.0, 369.0)] {   // lintel, left stone, right stone
+        let rad = a * .pi / 180
+        stones.move(to: NSPoint(x: c.x + r * cos(rad), y: c.y + r * sin(rad)))
+        stones.appendArc(withCenter: c, radius: r, startAngle: a, endAngle: b, clockwise: false)
+      }
+      let alpha: CGFloat = mode == .full ? 1.0 : mode == .idle ? 0.58 : 0.32
+      NSColor.black.withAlphaComponent(alpha).setStroke()
+      stones.stroke()
+      if mode == .off {
+        let slash = NSBezierPath()
+        slash.lineWidth = 2.2 * s
+        slash.lineCapStyle = .round
+        slash.move(to: NSPoint(x: rect.minX + 4 * s, y: rect.minY + 4 * s))
+        slash.line(to: NSPoint(x: rect.maxX - 4 * s, y: rect.maxY - 4 * s))
+        NSColor.black.setStroke()
+        slash.stroke()
+      }
+      return true
     }
+    img.isTemplate = true
+    img.accessibilityDescription = "pantheon"
+    return img
+  }
+
+  /// The glyph is the product's one-word status; a count rides alongside when
+  /// decisions wait on the human — the badge is the point.
+  private func paint() {
+    let mode: MarkMode = !state.configured || !state.relayOk ? .off : state.workerRunning ? .full : .idle
+    item.button?.image = markImage(mode)
+    item.button?.title = state.decisions.isEmpty ? "" : " \(state.decisions.count)"
+    item.button?.imagePosition = .imageLeading
     item.button?.toolTip = state.configured
       ? "pantheon — \(state.member) in \(state.space)\(state.relayOk ? "" : " (relay unreachable)")"
       : "pantheon — not joined to a space yet"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "relay": "node dist/cli.js relay",
     "test": "PANTHEON_HOME=\"$(mktemp -d)\" node --test --test-force-exit dist/test/*.test.js",
     "prepare": "npm run build",
-    "prepublishOnly": "npm run build && node --test dist/test/*.test.js",
+    "prepublishOnly": "npm run build && npm test",
     "start": "node dist/cli.js relay"
   },
   "dependencies": {